@jerryan/just-bash 3.5.0 → 3.6.1

package/dist/commands/js-exec/js-exec.d.ts

@@ -7,6 +7,10 @@
  * This command is Node.js only (uses worker_threads).
  */
 import type { RuntimeCommand } from "../../types.js";
+/** @internal Set the idle-teardown delay — for focused lifecycle tests only. */
+export declare function _setJsExecWorkerIdleTimeoutMsForTests(ms: number): void;
+/** @internal Whether the shared worker is currently alive — for tests only. */
+export declare function _hasSharedJsExecWorkerForTests(): boolean;
 /** @internal Reset singleton worker state — for focused protocol tests only. */
 export declare function _resetJsExecWorkerForTests(): void;
 export declare const jsExecCommand: RuntimeCommand;

package/dist/commands/worker-bridge/bridge-handler.d.ts

@@ -29,6 +29,10 @@ export declare class BridgeHandler {
     private outputLimitExceeded;
     private startTime;
     private timeoutMs;
+    /** Complete buffer of the last published oversized result, retained
+     * so the worker can fetch it in READ_RESULT_RANGE slices. Replaced on
+     * every publish. */
+    private lastResult;
     constructor(sharedBuffer: SharedArrayBuffer, fs: IFileSystem, cwd: string, commandName: string, secureFetch?: SecureFetch | undefined, maxOutputSize?: number, exec?: ((command: string, options: CommandExecOptions) => Promise<ExecResult>) | undefined, invokeTool?: ((path: string, argsJson: string) => Promise<string>) | undefined);
     /**
      * Returns remaining milliseconds before the overall execution deadline.
@@ -45,8 +49,13 @@ export declare class BridgeHandler {
     run(timeoutMs: number): Promise<BridgeOutput>;
     stop(): void;
     private handleOperation;
+    /** Publish a result of any size; oversized results are fetched by the
+     * worker in READ_RESULT_RANGE slices from the retained buffer. */
+    private publishResult;
+    private handleReadResultRange;
     private resolvePath;
     private handleReadFile;
+    private handleWriteFileRange;
     private handleWriteFile;
     private handleStat;
     private handleLstat;

package/dist/commands/worker-bridge/protocol.d.ts

@@ -33,6 +33,8 @@ export declare const OpCode: {
     readonly REALPATH: 13;
     readonly RENAME: 14;
     readonly COPY_FILE: 15;
+    readonly WRITE_FILE_RANGE: 17;
+    readonly READ_RESULT_RANGE: 18;
     readonly WRITE_STDOUT: 100;
     readonly WRITE_STDERR: 101;
     readonly EXIT: 102;
@@ -62,8 +64,16 @@ export declare const ErrorCode: {
     readonly TIMEOUT: 8;
     readonly NETWORK_ERROR: 9;
     readonly NETWORK_NOT_CONFIGURED: 10;
+    readonly NOT_EMPTY: 11;
 };
 export type ErrorCodeType = (typeof ErrorCode)[keyof typeof ErrorCode];
+/** Buffer sizes */
+export declare const Size: {
+    readonly CONTROL_REGION: 32;
+    readonly PATH_BUFFER: 4096;
+    readonly DATA_BUFFER: 8388608;
+    readonly TOTAL: 8392736;
+};
 /** Flags for operations */
 export declare const Flags: {
     readonly NONE: 0;
@@ -104,6 +114,13 @@ export declare class ProtocolBuffer {
     setDataFromString(str: string): void;
     getResult(): Uint8Array;
     setResult(data: Uint8Array): void;
+    /**
+     * Publish a result of ANY size: the first DATA_BUFFER bytes land in
+     * the data region and RESULT_LENGTH carries the FULL length. The
+     * worker detects the overflow and fetches the rest with
+     * READ_RESULT_RANGE ops (served from the host's retained buffer).
+     */
+    setResultPrefix(data: Uint8Array): void;
     getResultAsString(): string;
     setResultFromString(str: string): void;
     encodeStat(stat: {

package/dist/commands/worker-bridge/sync-backend.d.ts

@@ -12,6 +12,9 @@ export declare class SyncBackend {
     private operationTimeoutMs;
     constructor(sharedBuffer: SharedArrayBuffer, operationTimeoutMs?: number);
     private execSync;
+    /** Build an op failure that preserves the bridge's numeric error code,
+     * so downstream errno mapping prefers it over substring matching. */
+    private opError_;
     readFile(path: string): Uint8Array;
     writeFile(path: string, data: Uint8Array): void;
     stat(path: string): {

package/dist/fs/overlay-fs/apply.d.ts

@@ -20,3 +20,16 @@ export declare function removeFromRealFs(path: string): void;
  * mtime restored after the content write.
  */
 export declare function applyWriteToRealFs(path: string, write: Omit<OverlayWrite, "path">): void;
+/**
+ * Apply a change set with real absolute paths to the real filesystem:
+ * deletions first (deepest path first, so subtrees go before their
+ * parents), then writes (shallowest first, so explicit directory
+ * entries land before their children). Standalone counterpart of
+ * AgentSandbox.applyChanges for the fork model — no overlay instance
+ * is involved and nothing is dropped; the caller owns the overlays'
+ * lifecycle (typically: discard after diff()).
+ */
+export declare function applyDiffToRealFs(diff: {
+    writes: OverlayWrite[];
+    deletions: string[];
+}): void;

package/dist/fs/overlay-fs/index.d.ts

@@ -1 +1,3 @@
+export { applyDiffToRealFs } from "./apply.js";
+export { mergeDiffs } from "./merge.js";
 export { type OverlayDiff, OverlayFs, type OverlayFsOptions, type OverlayNodeType, type OverlayWrite, } from "./overlay-fs.js";

package/dist/fs/overlay-fs/merge.d.ts

@@ -0,0 +1,24 @@
+import type { OverlayDiff } from "./overlay-fs.js";
+/**
+ * Merge change sets from independent overlays into one deterministic
+ * change set. Paths must already share one space (e.g. real absolute
+ * paths — map mount-relative diffs through each mount's root first).
+ *
+ * Semantics (see docs/design/vfs-template-fork-model.md):
+ *
+ * - Ordering key per entry: `changedAt` (overlay-assigned, untamperable;
+ *   missing stamps count as 0), ties broken by input order — later wins.
+ * - One winner per path (the latest entry).
+ * - A winning whiteout suppresses earlier entries under its subtree;
+ *   later entries survive and the path resurrects as their scaffolding
+ *   (overlayfs opaque-dir semantics).
+ * - A winning file/symlink drops every entry under its path, regardless
+ *   of time — files cannot have children.
+ * - Scaffolding and metadataOnly need no special rules: ensured-parent
+ *   dir entries only ever win alongside their fork's surviving
+ *   descendants, and a metadataOnly winner already carries the metadata.
+ *
+ * Conflicts are racy input by definition; this merge owes determinism,
+ * not correctness. It never throws on malformed combinations.
+ */
+export declare function mergeDiffs(diffs: OverlayDiff[]): OverlayDiff;

package/dist/fs/overlay-fs/overlay-fs.d.ts

@@ -48,6 +48,13 @@ export interface OverlayWrite {
     mode: number;
     /** Modification time; hosts may apply it (utimes) for fidelity. */
     mtime: Date;
+    /**
+     * Wall-clock time the overlay recorded this mutation (attach or last
+     * in-place change). Unlike `mtime` this cannot be set from inside the
+     * sandbox, which makes it the trustworthy ordering key for merging
+     * change sets from independent overlays (see mergeDiffs).
+     */
+    changedAt?: number;
     /**
      * When true, only metadata changed (chmod/utimes via a metacopy shadow):
      * apply `mode` and `mtime` and never touch file content.
@@ -70,6 +77,13 @@ export interface OverlayDiff {
      * never nest, so each entry is a top-most deletion covering its subtree.
      */
     deletions: string[];
+    /**
+     * Wall-clock creation time of each whiteout, aligned with `deletions`
+     * (same order). Overlay-assigned and untamperable — the ordering key
+     * for merging deletions against writes from other overlays. Present
+     * whenever `deletions` is non-empty; absent otherwise.
+     */
+    deletionChangedAt?: number[];
 }
 export interface OverlayFsOptions {
     /**
@@ -285,6 +299,9 @@ export declare class OverlayFs implements IFileSystem {
      */
     private inheritedMode;
     appendFile(path: string, content: FileContent, options?: WriteFileOptions | BufferEncoding): Promise<void>;
+    /** Append to an existing upper file node, completing a metacopy
+     * copy-up first when needed (preserving the node's upper mode). */
+    private appendToExisting_;
     exists(path: string): Promise<boolean>;
     stat(path: string, seen?: Set<string>): Promise<FsStat>;
     lstat(path: string): Promise<FsStat>;

package/dist/fs/overlay-fs/overlay-tree.d.ts

@@ -36,6 +36,21 @@ export interface OverlayFileNode {
     lowerSize?: number;
     /** Append segments retained without copying the complete file per append. */
     appendChunks?: Uint8Array[];
+    /**
+     * Mutation sequence stamp (tree-local, monotonically increasing).
+     * Set by in-place mutations (appendChunk, chmod, utimes) so sync()
+     * can compare-and-swap: an entry checked against disk is only
+     * detached if it has not been mutated since the check began.
+     * Node replacement (attach/detach) needs no stamp — object identity
+     * already changes. Undefined means never mutated in place.
+     */
+    seq?: number;
+    /**
+     * Wall-clock time of the last mutation (attach/touch), stamped by the
+     * tree. Distinct from `mtime`: user-visible and utimes-able, whereas
+     * changedAt is the untamperable ordering key mergeDiffs relies on.
+     */
+    changedAt?: number;
     mode: number;
     mtime: Date;
     identity?: string;
@@ -44,6 +59,10 @@ export interface OverlayDirNode {
     type: "directory";
     /** Child nodes keyed by name segment, in insertion order. */
     children: Map<string, OverlayNode>;
+    /** In-place mutation stamp (see OverlayFileNode.seq). */
+    seq?: number;
+    /** Wall-clock time of the last mutation (see OverlayFileNode.changedAt). */
+    changedAt?: number;
     mode: number;
     mtime: Date;
     identity?: string;
@@ -51,12 +70,18 @@ export interface OverlayDirNode {
 export interface OverlaySymlinkNode {
     type: "symlink";
     target: string;
+    /** In-place mutation stamp (see OverlayFileNode.seq). */
+    seq?: number;
+    /** Wall-clock time of the last mutation (see OverlayFileNode.changedAt). */
+    changedAt?: number;
     mode: number;
     mtime: Date;
 }
 /** Leaf marker hiding a lower-layer (real-FS) path and everything under it. */
 export interface OverlayWhiteoutNode {
     type: "whiteout";
+    /** Wall-clock time the whiteout was created (merge ordering). */
+    changedAt?: number;
 }
 export type OverlayEntryNode = OverlayFileNode | OverlayDirNode | OverlaySymlinkNode;
 export type OverlayNode = OverlayEntryNode | OverlayWhiteoutNode;
@@ -101,6 +126,7 @@ export declare class OverlayTree {
     private readonly maxMemoryBytes;
     private rootNode;
     private bytes;
+    private mutationSeq_;
     constructor(maxMemoryBytes: number);
     /** The root directory node — the VFS root ("/"). */
     get root(): OverlayDirNode;
@@ -160,6 +186,19 @@ export declare class OverlayTree {
      * Append a chunk to a file node, accounting its bytes against capacity.
      */
     appendChunk(node: OverlayFileNode, chunk: Uint8Array): void;
+    /** Stamp a node as mutated in place (see OverlayFileNode.seq). */
+    touch(node: {
+        seq?: number;
+        changedAt?: number;
+    }): void;
+    /**
+     * Compare-and-swap detach: remove the node at `path` only if it is
+     * still the exact same object with the same mutation sequence — i.e.
+     * nothing changed it while the caller's (async) verification ran.
+     * Also refuses to detach a directory that has gained children.
+     * Returns whether the detach happened.
+     */
+    detachIfUnchanged(path: string, node: OverlayNode, seq?: number): boolean;
     /**
      * Yield every node, parents before children (pre-order), starting with the
      * root at path "/". Whiteouts are included; callers filter as needed.

package/dist/fs/real-fs-utils.d.ts

@@ -9,6 +9,7 @@
  * live in path-utils.ts (no node:fs dependency, browser-safe) and are
  * re-exported here for convenience.
  */
+import * as fs from "node:fs";
 export { isSameOrDescendantPath, normalizePath, validatePath, } from "./path-utils.js";
 /**
  * Check whether `resolved` is equal to, or a child of, `canonicalRoot`.
@@ -88,3 +89,17 @@ export declare function sanitizeSymlinkTarget(rawTarget: string, canonicalRoot:
  * a generic `"CODE: operation 'virtualPath'"` message.
  */
 export declare function sanitizeFsError(e: unknown, virtualPath: string, operation: string, passthroughPatterns: readonly string[]): never;
+/**
+ * lstat a validated real path, normalizing Windows mode fiction: libuv
+ * reports no execute bits on Windows, so directories stat as 0o40666.
+ * Nothing inside the sandbox enforces mode bits, but real POSIX runtimes
+ * behind the fs bridge do — the python worker's Emscripten VFS masks
+ * `mode & 0o777`, making a 0o666 directory untraversable (chdir, listdir,
+ * open all EACCES). Report POSIX-conventional 0o755 for directories,
+ * matching DEFAULT_DIR_MODE so lower and upper dirs present uniformly.
+ * File modes are left as reported (executable-bit fiction for .exe etc.
+ * is a separate question). No-op on other platforms.
+ */
+export declare function lstatReal(path: string): Promise<fs.Stats>;
+/** Synchronous counterpart of {@link lstatReal}. */
+export declare function lstatRealSync(path: string): fs.Stats;

package/dist/fs/vfs-template.d.ts

@@ -0,0 +1,51 @@
+import { MountableFs } from "./mountable-fs/mountable-fs.js";
+import type { OverlayDiff } from "./overlay-fs/overlay-fs.js";
+/** One privatized subtree: virtual mount point + real backing root. */
+export interface VfsTemplateMount {
+    /** Virtual absolute path the overlay serves (e.g. "/project"). */
+    at: string;
+    /** Real absolute directory the overlay reads through and diffs against. */
+    root: string;
+}
+export interface VfsTemplateOptions {
+    /**
+     * Subtrees privatized per fork. Everything else (/, /tmp, ...) lives
+     * in the template's shared in-memory scratch fs and behaves like
+     * shared memory: visible to every fork immediately.
+     */
+    mounts: VfsTemplateMount[];
+}
+/**
+ * A process image for parallel agent tool calls (see
+ * docs/design/vfs-template-fork-model.md). The template owns the shared
+ * scratch fs and the mount configuration; each fork() stamps out a
+ * ready MountableFs with fresh copy-on-write overlays over every
+ * mounted real root. Forks are single-use: run, diff via merge(),
+ * discard.
+ *
+ * ```ts
+ * const tpl = createVfsTemplate({ mounts: [{ at: "/project", root: projDir }] });
+ * const a = tpl.fork();
+ * const b = tpl.fork();
+ * await Promise.all([runA(a), runB(b)]);
+ * const merged = tpl.merge([a, b]);  // completion order = tiebreak
+ * tpl.apply(merged);
+ * ```
+ */
+export interface VfsTemplate {
+    /** A fresh per-call filesystem: shared scratch + fresh overlays. */
+    fork(): MountableFs;
+    /**
+     * Merge the change sets of the given forks (in completion order —
+     * the tiebreak under changedAt) into one diff with real absolute
+     * paths. Forks not listed are merged after, in registration order.
+     */
+    merge(forksInCompletionOrder?: MountableFs[]): OverlayDiff;
+    /**
+     * Validate a merged diff against the mount map (an entry outside
+     * every registered root fails loudly) and apply it to the real
+     * roots. Consumes all registered forks.
+     */
+    apply(merged: OverlayDiff): void;
+}
+export declare function createVfsTemplate(options: VfsTemplateOptions): VfsTemplate;

package/dist/index.d.cts

@@ -11,8 +11,9 @@ export { bytesOutput, decodeBytesToUtf8, EMPTY_BYTES, encodeUtf8ToBytes, latin1F
 export { InMemoryFs } from "./fs/in-memory-fs/index.js";
 export type { BufferEncoding, CpOptions, DirectoryEntry, FileContent, FileEntry, FileInit, FileSystemFactory, FsEntry, FsStat, InitialFiles, LazyFileEntry, LazyFileProvider, MkdirOptions, RmOptions, SymlinkEntry, } from "./fs/interface.js";
 export { MountableFs, type MountableFsOptions, type MountConfig, } from "./fs/mountable-fs/index.js";
-export { type OverlayDiff, OverlayFs, type OverlayFsOptions, type OverlayNodeType, type OverlayWrite, } from "./fs/overlay-fs/index.js";
+export { applyDiffToRealFs, mergeDiffs, type OverlayDiff, OverlayFs, type OverlayFsOptions, type OverlayNodeType, type OverlayWrite, } from "./fs/overlay-fs/index.js";
 export { ReadWriteFs, type ReadWriteFsOptions, } from "./fs/read-write-fs/index.js";
+export { createVfsTemplate, type VfsTemplate, type VfsTemplateMount, type VfsTemplateOptions, } from "./fs/vfs-template.js";
 export type { AllowedUrl, AllowedUrlEntry, NetworkConfig, RequestTransform, SecureFetch, } from "./network/index.js";
 export { NetworkAccessDeniedError, RedirectNotAllowedError, TooManyRedirectsError, } from "./network/index.js";
 export { parse } from "./parser/parser.js";

package/dist/index.d.ts

@@ -11,8 +11,9 @@ export { bytesOutput, decodeBytesToUtf8, EMPTY_BYTES, encodeUtf8ToBytes, latin1F
 export { InMemoryFs } from "./fs/in-memory-fs/index.js";
 export type { BufferEncoding, CpOptions, DirectoryEntry, FileContent, FileEntry, FileInit, FileSystemFactory, FsEntry, FsStat, InitialFiles, LazyFileEntry, LazyFileProvider, MkdirOptions, RmOptions, SymlinkEntry, } from "./fs/interface.js";
 export { MountableFs, type MountableFsOptions, type MountConfig, } from "./fs/mountable-fs/index.js";
-export { type OverlayDiff, OverlayFs, type OverlayFsOptions, type OverlayNodeType, type OverlayWrite, } from "./fs/overlay-fs/index.js";
+export { applyDiffToRealFs, mergeDiffs, type OverlayDiff, OverlayFs, type OverlayFsOptions, type OverlayNodeType, type OverlayWrite, } from "./fs/overlay-fs/index.js";
 export { ReadWriteFs, type ReadWriteFsOptions, } from "./fs/read-write-fs/index.js";
+export { createVfsTemplate, type VfsTemplate, type VfsTemplateMount, type VfsTemplateOptions, } from "./fs/vfs-template.js";
 export type { AllowedUrl, AllowedUrlEntry, NetworkConfig, RequestTransform, SecureFetch, } from "./network/index.js";
 export { NetworkAccessDeniedError, RedirectNotAllowedError, TooManyRedirectsError, } from "./network/index.js";
 export { parse } from "./parser/parser.js";

package/dist/timers.d.ts

@@ -1,5 +1,14 @@
 export declare const _setTimeout: typeof globalThis.setTimeout;
 export declare const _clearTimeout: typeof globalThis.clearTimeout;
+/**
+ * Native setTimeout WITHOUT execution-context binding. `_setTimeout`
+ * binds callbacks to the scheduling execution's defense context, which
+ * DefenseInDepthBox suppresses once that execution deactivates — correct
+ * for intra-execution timers (sleep, fetch deadlines), fatal for host
+ * infrastructure callbacks that must fire AFTER the execution ends
+ * (e.g. idle teardown of a shared worker). Use this for the latter.
+ */
+export declare const _setTimeoutUnbound: typeof globalThis.setTimeout;
 export interface FiniteTimeoutHandle {
     cleared: boolean;
     remainingMs: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jerryan/just-bash",
-  "version": "3.5.0",
+  "version": "3.6.1",
   "description": "A simulated bash environment with virtual filesystem",
   "repository": {
     "type": "git",
@@ -62,37 +62,6 @@
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
-  "scripts": {
-    "build": "rm -rf dist && tsc && pnpm build:lib && pnpm build:lib:cjs && pnpm build:browser && pnpm build:cli && pnpm build:shell && pnpm build:worker && pnpm build:clean && cp dist/index.d.ts dist/index.d.cts && sed '1,/^-->/d' AGENTS.npm.md > dist/AGENTS.md",
-    "build:clean": "find dist -name '*.test.js' -delete && find dist -name '*.test.d.ts' -delete",
-    "build:worker": "esbuild src/commands/python3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/python3/worker.js --external:../../../vendor/cpython-emscripten/* && cp src/commands/python3/worker.js dist/commands/python3/worker.js && mkdir -p dist/bin/chunks && cp src/commands/python3/worker.js dist/bin/chunks/worker.js && mkdir -p dist/bundle/chunks && cp src/commands/python3/worker.js dist/bundle/chunks/worker.js && esbuild src/commands/js-exec/js-exec-worker.ts --bundle --platform=node --format=esm --outfile=src/commands/js-exec/js-exec-worker.js --external:quickjs-emscripten && cp src/commands/js-exec/js-exec-worker.js dist/commands/js-exec/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bin/chunks/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bundle/chunks/js-exec-worker.js && esbuild src/commands/sqlite3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/sqlite3/worker.js --external:sql.js && mkdir -p dist/commands/sqlite3 && cp src/commands/sqlite3/worker.js dist/commands/sqlite3/worker.js && cp src/commands/sqlite3/worker.js dist/bin/chunks/sqlite3-worker.js && cp src/commands/sqlite3/worker.js dist/bundle/chunks/sqlite3-worker.js",
-    "build:lib": "esbuild dist/index.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bundle --chunk-names=chunks/[name]-[hash] --banner:js='import{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:diff --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --external:guarded-fetch",
-    "build:lib:cjs": "esbuild dist/index.js --bundle --platform=node --format=cjs --minify --outfile=dist/bundle/index.cjs --external:diff --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --external:guarded-fetch",
-    "build:browser": "esbuild dist/browser.js --bundle --platform=browser --format=esm --minify --outfile=dist/bundle/browser.js --external:diff --external:sprintf-js --external:turndown --external:undici --external:guarded-fetch --external:node:zlib --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --define:__BROWSER__=true --alias:node:async_hooks=./src/shims/browser-unsupported.js --alias:node:dns=./src/shims/browser-unsupported.js --alias:node:module=./src/shims/browser-unsupported.js",
-    "build:cli": "esbuild dist/cli/just-bash.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
-    "build:shell": "esbuild dist/cli/shell.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin/shell --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
-    "prepublishOnly": "pnpm test:dist",
-    "validate": "pnpm lint && pnpm knip && pnpm typecheck && pnpm build && pnpm check:worker-sync && pnpm test:run && pnpm test:wasm && pnpm test:dist",
-    "typecheck": "tsc --noEmit",
-    "lint": "pnpm lint:banned",
-    "check:worker-sync": "node scripts/check-worker-sync.js",
-    "lint:banned": "node scripts/check-banned-patterns.js",
-    "lint:fix": "pnpm --workspace-root lint:fix",
-    "knip": "knip",
-    "test": "vitest",
-    "test:run": "vitest run --exclude src/security/fuzzing/ --exclude src/commands/python3/ --exclude src/commands/sqlite3/ --exclude src/commands/js-exec/ --exclude src/agent-examples/python-scripting.test.ts",
-    "test:dist": "vitest run src/cli/just-bash.bundle.test.ts src/package-contents.test.ts",
-    "test:unit": "vitest run --config vitest.unit.config.ts",
-    "test:wasm": "vitest run --config vitest.wasm.config.ts",
-    "test:comparison": "vitest run --config vitest.comparison.config.ts",
-    "test:comparison:record": "RECORD_FIXTURES=1 vitest run --config vitest.comparison.config.ts",
-    "test:coverage": "vitest run --coverage",
-    "test:coverage:unit": "vitest run --config vitest.unit.config.ts --coverage",
-    "test:fuzz": "vitest run src/security/fuzzing/",
-    "test:fuzz:long": "FUZZ_RUNS=10000 vitest run src/security/fuzzing/",
-    "shell": "tsx src/cli/shell.ts",
-    "dev:exec": "tsx src/cli/exec.ts"
-  },
   "keywords": [],
   "author": "Malte and Claude",
   "license": "Apache-2.0",
@@ -132,5 +101,35 @@
   "optionalDependencies": {
     "@mongodb-js/zstd": "^7.0.0",
     "node-liblzma": "^2.2.0"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc && pnpm build:lib && pnpm build:lib:cjs && pnpm build:browser && pnpm build:cli && pnpm build:shell && pnpm build:worker && pnpm build:clean && cp dist/index.d.ts dist/index.d.cts && sed '1,/^-->/d' AGENTS.npm.md > dist/AGENTS.md",
+    "build:clean": "find dist -name '*.test.js' -delete && find dist -name '*.test.d.ts' -delete",
+    "build:worker": "esbuild src/commands/python3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/python3/worker.js --external:../../../vendor/cpython-emscripten/* && cp src/commands/python3/worker.js dist/commands/python3/worker.js && mkdir -p dist/bin/chunks && cp src/commands/python3/worker.js dist/bin/chunks/worker.js && mkdir -p dist/bundle/chunks && cp src/commands/python3/worker.js dist/bundle/chunks/worker.js && esbuild src/commands/js-exec/js-exec-worker.ts --bundle --platform=node --format=esm --outfile=src/commands/js-exec/js-exec-worker.js --external:quickjs-emscripten && cp src/commands/js-exec/js-exec-worker.js dist/commands/js-exec/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bin/chunks/js-exec-worker.js && cp src/commands/js-exec/js-exec-worker.js dist/bundle/chunks/js-exec-worker.js && esbuild src/commands/sqlite3/worker.ts --bundle --platform=node --format=esm --outfile=src/commands/sqlite3/worker.js --external:sql.js && mkdir -p dist/commands/sqlite3 && cp src/commands/sqlite3/worker.js dist/commands/sqlite3/worker.js && cp src/commands/sqlite3/worker.js dist/bin/chunks/sqlite3-worker.js && cp src/commands/sqlite3/worker.js dist/bundle/chunks/sqlite3-worker.js",
+    "build:lib": "esbuild dist/index.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bundle --chunk-names=chunks/[name]-[hash] --banner:js='import{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:diff --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --external:guarded-fetch",
+    "build:lib:cjs": "esbuild dist/index.js --bundle --platform=node --format=cjs --minify --outfile=dist/bundle/index.cjs --external:diff --external:sprintf-js --external:turndown --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --external:guarded-fetch",
+    "build:browser": "esbuild dist/browser.js --bundle --platform=browser --format=esm --minify --outfile=dist/bundle/browser.js --external:diff --external:sprintf-js --external:turndown --external:undici --external:guarded-fetch --external:node:zlib --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip --define:__BROWSER__=true --alias:node:async_hooks=./src/shims/browser-unsupported.js --alias:node:dns=./src/shims/browser-unsupported.js --alias:node:module=./src/shims/browser-unsupported.js",
+    "build:cli": "esbuild dist/cli/just-bash.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
+    "build:shell": "esbuild dist/cli/shell.js --bundle --splitting --platform=node --format=esm --minify --outdir=dist/bin/shell --entry-names=[name] --chunk-names=chunks/[name]-[hash] --banner:js='#!/usr/bin/env node\nimport{createRequire} from\"node:module\";const require=createRequire(import.meta.url);' --external:sql.js --external:quickjs-emscripten --external:@mongodb-js/zstd --external:node-liblzma --external:seek-bzip",
+    "validate": "pnpm lint && pnpm knip && pnpm typecheck && pnpm build && pnpm check:worker-sync && pnpm test:run && pnpm test:wasm && pnpm test:dist",
+    "typecheck": "tsc --noEmit",
+    "lint": "pnpm lint:banned",
+    "check:worker-sync": "node scripts/check-worker-sync.js",
+    "lint:banned": "node scripts/check-banned-patterns.js",
+    "lint:fix": "pnpm --workspace-root lint:fix",
+    "knip": "knip",
+    "test": "vitest",
+    "test:run": "vitest run --exclude src/security/fuzzing/ --exclude src/commands/python3/ --exclude src/commands/sqlite3/ --exclude src/commands/js-exec/ --exclude src/agent-examples/python-scripting.test.ts",
+    "test:dist": "vitest run src/cli/just-bash.bundle.test.ts src/package-contents.test.ts",
+    "test:unit": "vitest run --config vitest.unit.config.ts",
+    "test:wasm": "vitest run --config vitest.wasm.config.ts",
+    "test:comparison": "vitest run --config vitest.comparison.config.ts",
+    "test:comparison:record": "RECORD_FIXTURES=1 vitest run --config vitest.comparison.config.ts",
+    "test:coverage": "vitest run --coverage",
+    "test:coverage:unit": "vitest run --config vitest.unit.config.ts --coverage",
+    "test:fuzz": "vitest run src/security/fuzzing/",
+    "test:fuzz:long": "FUZZ_RUNS=10000 vitest run src/security/fuzzing/",
+    "shell": "tsx src/cli/shell.ts",
+    "dev:exec": "tsx src/cli/exec.ts"
   }
-}
+}