@nimbus-sh/core 0.3.0 → 0.5.0

package/src/runtime/esbuild-service.ts

@@ -19,8 +19,9 @@
 
 import type { CredentialedVfs, SqliteVFS } from '../vfs/sqlite-vfs.js';
 import { CRED_KERNEL } from './os-contracts.js';
-import { resolvePackageEntry, resolveExports } from '../_shared/exports-resolver.js';
+import { resolvePackageEntry, resolveExports, type ResolvablePackageJson } from '../_shared/exports-resolver.js';
 import { normalizeVfsPath, stripLeadingSlashes } from '../vfs/path.js';
+import { errorText } from '../_shared/error-text.js';
 
 /**
  * Bundler version tag. BUMP THIS whenever bundling semantics change —
@@ -175,7 +176,6 @@ export function hasTopLevelAwait(src: string): boolean {
   // inside `(...)`; a `{` only opens a function body when a `function`/
   // `=>` is pending AND we're at parenDepth 0 (past the param list).
   const re = /\b(await|function|class)\b|=>|\{|\}|\(|\)/g;
-  let m: RegExpExecArray | null;
   const fnEntryDepths: number[] = [];
   let depth = 0;
   let parenDepth = 0;
@@ -189,7 +189,7 @@ export function hasTopLevelAwait(src: string): boolean {
   // `x => ({ ... })` (object-returning expression body, `{` at parenDepth
   // 1) does not leak a body slot onto a later top-level block.
   let arrowPending = false;
-  while ((m = re.exec(stripped)) !== null) {
+  for (let m = re.exec(stripped); m !== null; m = re.exec(stripped)) {
     const tok = m[0];
     if (arrowPending && tok !== '{') arrowPending = false;
     if (tok === '(') { parenDepth++; }
@@ -803,7 +803,7 @@ async function loadEsbuild(): Promise<typeof esbuild> {
 export interface TransformResult {
   code: string;
   map: string;
-  warnings: { text: string; location?: any }[];
+  warnings: { text: string; location?: esbuild.Location | null }[];
 }
 
 export interface BuildOutputFile {
@@ -813,8 +813,8 @@ export interface BuildOutputFile {
 
 export interface BuildResult {
   outputFiles: BuildOutputFile[];
-  errors: { text: string; location?: any }[];
-  warnings: { text: string; location?: any }[];
+  errors: { text: string; location?: esbuild.Location | null }[];
+  warnings: { text: string; location?: esbuild.Location | null }[];
 }
 
 // ── EsbuildService ──────────────────────────────────────────────────────
@@ -876,7 +876,11 @@ export class EsbuildService {
         let initTimeout: ReturnType<typeof setTimeout> | null = null;
         await Promise.race([
           esb.initialize({
-            wasmModule: esbuildWasmUrl as any,
+            // wrangler resolves this static `.wasm` import to a compiled
+            // module at bundle time; the asset stub for a `.wasm` module can
+            // only declare its default export as a string, and the guard
+            // above is what checks the resolution actually happened.
+            wasmModule: esbuildWasmUrl as unknown as WebAssembly.Module,
             worker: false,
           }),
           new Promise<never>((_, reject) => {
@@ -890,14 +894,15 @@ export class EsbuildService {
           }),
         ]).finally(() => { if (initTimeout) clearTimeout(initTimeout); });
         this.initialized = true;
-      } catch (e: any) {
+      } catch (e) {
+        const message = errorText(e);
         // "Cannot call initialize more than once" means it's already ready
-        if (e?.message?.includes('more than once')) {
+        if (message.includes('more than once')) {
           this.initialized = true;
           return;
         }
         this.initPromise = null;
-        throw new Error('esbuild init failed: ' + (e?.message || e));
+        throw new Error('esbuild init failed: ' + message);
       }
     })();
 
@@ -1315,7 +1320,7 @@ export class EsbuildService {
         if (vfs.exists(strip(nmDir)) && vfs.isDirectory(strip(nmDir))) {
           // Read package.json so we can consult the exports field.
           const pkgJsonPath = nmDir + '/package.json';
-          let pkgJson: any = null;
+          let pkgJson: ResolvablePackageJson | null = null;
           if (vfs.exists(strip(pkgJsonPath))) {
             try { pkgJson = JSON.parse(vfs.readFileString(strip(pkgJsonPath))); } catch {}
           }

package/src/runtime/facet-host.ts

@@ -79,6 +79,18 @@ export interface FacetSpec {
   syscalls?: FacetSyscalls;
   /** Facets the host may keep warm for this spec. Default 1. */
   concurrency?: number;
+  /**
+   * Who a warm facet may be reused FOR. Default `session`.
+   *
+   * A scope keeps whatever the last call left in it, so by default it may only
+   * ever answer for the session that opened it. `global` is a claim the
+   * RUNTIME makes about itself and one only a pure function can make: no
+   * syscalls binding, nothing retained between calls, output decided entirely
+   * by the arguments. The clang toolchain is that — a compile is the same
+   * compile for every tenant — and one warm isolate holding its 31 MiB of
+   * compiled compiler serves all of them.
+   */
+  reuse?: 'session' | 'global';
 }
 
 /** The session a facet's syscalls reach, and who they reach it as. */

package/src/runtime/installed-runtimes.ts

@@ -17,6 +17,7 @@
  */
 
 import type { CredentialedVfs, SqliteVFS } from '../vfs/sqlite-vfs.js';
+import type { Command } from '../substrate/lifo/commands/types.js';
 import {
   CRED_KERNEL,
   NIMBUS_ABI_TARGET,
@@ -32,9 +33,9 @@ import {
 
 /** Minimal shell-registry shape we depend on. */
 export interface MinShellRegistry {
-  register(name: string, handler: (ctx: any) => Promise<number>): void;
+  register(name: string, handler: Command): void;
   unregister?(name: string): void;
-  resolve?(name: string): any;
+  resolve?(name: string): Promise<Command | null | undefined> | Command | null | undefined;
 }
 
 /** Runner-factory contract. Each registered runner produces a shell-
@@ -46,7 +47,7 @@ export type RunnerFactory = (
   installRoot: string,
   binName: string,
   binKind: string | undefined,
-) => (ctx: any) => Promise<number>;
+) => Command;
 
 /**
  * How a manifest entrypoint's `runner` key is resolved to code.

package/src/runtime/local-facet-host.ts

@@ -113,12 +113,21 @@ export function localFacetHost(): FacetHost {
       root: string,
       options?: FacetFilesystemOptions,
     ): FacetFilesystemSeed | { error: string } {
-      return snapshotVfs(vfs, root, {
+      const seeded = snapshotVfs(vfs, root, {
         extraRoots: options?.extraRoots,
         skipSubdirs: [],
         maxBytes: LOCAL_SEED_MAX_BYTES,
         maxFiles: LOCAL_SEED_MAX_FILES,
       });
+      if ('error' in seeded) return seeded;
+      // The seed is also the WHOLE of what this guest has, which is a stronger
+      // claim than the walk's: `snapshotVfs` reports the roots it listed
+      // exhaustively, and this says every path outside them is absent too. It
+      // is — a miss out there could only be answered by suspending the guest
+      // mid-syscall, which this host cannot do, so the alternative to "absent"
+      // is not "fetched" but a read the guest can never receive. Ruby's VM
+      // startup stats dozens of prefixes it was never given.
+      return { ...seeded, snapshot: { ...seeded.snapshot, enumeratedRoots: [''] } };
     },
     open: (spec) => new LocalFacet(spec),
   };
@@ -152,8 +161,7 @@ class LocalFacet implements Facet {
 
   private async call<A, R>(fn: FacetFn<A, R>, args: A, options?: FacetSubmitOptions): Promise<R> {
     if (this.disposed) throw new Error(`Nimbus: facet '${this.spec.tag}' is disposed`);
-    const scope = await this.scope();
-    await this.addModules(options?.wasmModules);
+    const scope = await this.scope(options?.wasmModules);
     let scoped = this.scoped.get(fn as FacetFn<never, unknown>);
     if (!scoped) {
       const value = scope(`(${fn.toString()})`);
@@ -172,17 +180,29 @@ class LocalFacet implements Facet {
    * The returned closure's `eval` is a DIRECT eval inside the body the preamble
    * was evaluated in, which is what puts the preamble's top-level declarations
    * in scope for every function submitted afterwards.
+   *
+   * Both wasm tables are filled BEFORE that body runs, per-call images merged
+   * over the spec's. A preamble may boot its runtime as it is evaluated — Ruby
+   * instantiates the interpreter right there — so it reads the table at that
+   * moment and an image added afterwards would arrive to a facet that had
+   * already given up on it. workerd has the same ordering for the same reason:
+   * per-call images ride in the module map the inner worker is built from.
    */
-  private async scope(): Promise<(source: string) => unknown> {
-    if (this.evaluate) return this.evaluate;
-    await this.addModules(this.spec.wasmModules);
+  private async scope(
+    callModules: Record<string, ArrayBuffer> | undefined,
+  ): Promise<(source: string) => unknown> {
+    const built = this.evaluate;
+    if (!built) await this.addModules(this.spec.wasmModules);
+    await this.addModules(callModules);
+    if (built) return built;
     const globals = { __NIMBUS_WASM: this.wasmTable };
     const build = new AsyncFunction(
       'globalThis',
       `${this.spec.preamble ?? ''}\nreturn (source) => eval(source);`,
     );
-    this.evaluate = await build.call(globals, globals) as (source: string) => unknown;
-    return this.evaluate;
+    const evaluate = await build.call(globals, globals) as (source: string) => unknown;
+    this.evaluate = evaluate;
+    return evaluate;
   }
 
   private async addModules(modules: Record<string, ArrayBuffer> | undefined): Promise<void> {

package/src/runtime/long-running-handle.ts

@@ -107,7 +107,7 @@ export function parsePortFromArgv(argv: string[]): number | null {
  */
 export function resolveLongRunningPort(opts: {
   argv?: string[];
-  env?: Record<string, any> | undefined;
+  env?: Record<string, string> | undefined;
   configPort?: number | undefined;
   fallback: number;
 }): number {
@@ -152,7 +152,7 @@ export function resolveLongRunningPort(opts: {
  */
 export function expandShellDefaults(
   token: string,
-  env: Record<string, any> | undefined,
+  env: Record<string, string> | undefined,
 ): string {
   if (!token || token.indexOf('${') < 0) return token;
   const lookup = (name: string): string | undefined => {
@@ -179,7 +179,7 @@ export function expandShellDefaults(
  */
 export function expandArgvShellDefaults(
   argv: ReadonlyArray<string>,
-  env: Record<string, any> | undefined,
+  env: Record<string, string> | undefined,
 ): string[] {
   return argv.map((t) => expandShellDefaults(t, env));
 }

package/src/runtime/os-contracts.ts

@@ -312,11 +312,12 @@ export interface RuntimeTtyOptions {
 /**
  * Where a registered port's traffic goes: one process, reached by HTTP.
  *
- * The whole of what a listening process exposes, deliberately. A resident
- * process never receives a WebSocket — every inbound socket Nimbus serves
- * terminates on the session and reaches the process, if at all, as events on a
- * poll — so a target that could return a 101 would describe a case no runner
- * produces.
+ * Ordinary HTTP may cross Workers RPC as Request/Response values. A WebSocket
+ * upgrade may not: its 101 Response owns a live socket, and RPC's
+ * Request/Response transport reconstructs the value rather than handing over
+ * the socket. So a target that can serve an upgrade exposes a separate
+ * fetch-semantic entrypoint, and every hop of an upgrade stays on the HTTP
+ * service-binding path. A target that omits it serves HTTP only.
  *
  * Lives here rather than beside the registry because both ends need it and
  * neither owns it: the port registry stores these, and the process fabric
@@ -325,6 +326,7 @@ export interface RuntimeTtyOptions {
  */
 export interface RouteableFacetTarget {
   handleHttpRequest(request: Request): Promise<Response>;
+  handleWebSocketRequest?(request: Request): Promise<Response>;
 }
 
 export interface RuntimePortBridge {

package/src/runtime/port-registry.ts

@@ -40,6 +40,17 @@ export interface PortEntry {
    */
   facetStub: RouteableFacetTarget | null;
   registeredAt: number;
+  /**
+   * Unguessable token for the lifetime of THIS registration, so an embedder
+   * can hand out one port's traffic without handing out the session. A fresh
+   * one per `register`, which is what makes an unexposed port stay unexposed.
+   */
+  capability: string;
+}
+
+function createPortCapability(): string {
+  const bytes = crypto.getRandomValues(new Uint8Array(12));
+  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0')).join('');
 }
 
 export class PortRegistry {
@@ -64,7 +75,13 @@ export class PortRegistry {
    */
   register(port: number, pid: number): void {
     const target = this.facetStubsByPid.get(pid) ?? null;
-    this.ports.set(port, { port, pid, facetStub: target, registeredAt: Date.now() });
+    this.ports.set(port, {
+      port,
+      pid,
+      facetStub: target,
+      registeredAt: Date.now(),
+      capability: createPortCapability(),
+    });
     this.notifyPortWaiters(pid);
   }
 
@@ -126,6 +143,24 @@ export class PortRegistry {
     return [...this.ports.values()];
   }
 
+  /** Answer only whether this capability matches, never what is registered. */
+  hasCapability(port: number, capability: string): boolean {
+    return this.ports.get(port)?.capability === capability;
+  }
+
+  /**
+   * Re-adopt a capability the embedder was already handed, after the supervisor
+   * was rebuilt. A restored dev server is a NEW registration with a new token,
+   * which would silently invalidate every preview URL already in circulation
+   * across an eviction — so the durable value wins over the fresh one.
+   */
+  restoreCapability(port: number, capability: string): boolean {
+    const entry = this.ports.get(port);
+    if (!entry || !/^[a-f0-9]{24}$/.test(capability)) return false;
+    entry.capability = capability;
+    return true;
+  }
+
   /**
    * Forward an HTTP request to the facet owning a port.
    *
@@ -148,6 +183,36 @@ export class PortRegistry {
    * client receives.
    */
   async routeRequest(port: number, request: Request, pathname: string): Promise<Response | null> {
+    return this.routeRequestInternal(port, request, pathname, false);
+  }
+
+  /**
+   * Route a request a trusted embedder has already authenticated against the
+   * port's capability and stripped its own credentials from.
+   *
+   * Unlike the generic route, this one PRESERVES `Authorization`. The generic
+   * route strips it because the header it sees is Nimbus's own, and handing a
+   * session credential to untrusted code is the thing that must never happen.
+   * Here the embedder has removed that credential already and what remains
+   * belongs to the guest application, which needs it to authenticate its own
+   * users.
+   */
+  async routeCapabilityRequest(
+    port: number,
+    capability: string,
+    request: Request,
+    pathname: string,
+  ): Promise<Response | null> {
+    if (!this.hasCapability(port, capability)) return null;
+    return this.routeRequestInternal(port, request, pathname, true);
+  }
+
+  private async routeRequestInternal(
+    port: number,
+    request: Request,
+    pathname: string,
+    preserveAuthorization: boolean,
+  ): Promise<Response | null> {
     const entry = this.ports.get(port);
     // Honour the documented contract: no entry at all → null, so callers
     // report "no process listening". (Pre-fix this fell into the 501 below,
@@ -189,7 +254,12 @@ export class PortRegistry {
       // if a body is supplied on those methods.
       const hasBody = request.method !== 'GET' && request.method !== 'HEAD';
       const headers = new Headers(request.headers);
+      // The strip below removes Nimbus's own credentials. On a capability
+      // route the embedder has already removed those, so what is left belongs
+      // to the guest application and has to survive the hop.
+      const authorization = preserveAuthorization ? headers.get('authorization') : null;
       sanitizeUntrustedHeaders(headers);
+      if (authorization) headers.set('authorization', authorization);
 
       headers.set('X-Nimbus-Port', String(port));
       // `duplex: 'half'` is required by workerd when body is a
@@ -205,11 +275,19 @@ export class PortRegistry {
       if (hasBody) init.duplex = 'half';
       const forwarded = new Request(innerUrl.toString(), init);
 
-      // RPC: the facet receives the Request and returns a Response.
-      // Both cross the isolate boundary via Workers RPC's native
-      // Request/Response transport — bytes are streamed with
-      // flow-control, never materialised.
-      const response: Response = await entry.facetStub.handleHttpRequest(forwarded);
+      // HTTP crosses Workers RPC as Request/Response values, streamed with
+      // flow control and never materialised. A WebSocket upgrade cannot: its
+      // 101 owns a live socket, so it takes the fetch-semantic entrypoint,
+      // which every hop preserves. A target with no such entrypoint serves
+      // HTTP only, and says so rather than dropping the socket.
+      const isWebSocket = request.headers.get('upgrade')?.toLowerCase() === 'websocket';
+      const handler = isWebSocket
+        ? entry.facetStub.handleWebSocketRequest
+        : entry.facetStub.handleHttpRequest;
+      if (!handler) {
+        return new Response('Port target does not expose a WebSocket fetch route', { status: 501 });
+      }
+      const response: Response = await handler(forwarded);
 
       if (!(response instanceof Response)) {
         // Defensive: if a facet ever returns something else (JSON
@@ -286,10 +364,20 @@ export class PortRegistry {
 
 function routeableFacetTarget(value: unknown): RouteableFacetTarget | null {
   if ((typeof value !== 'object' && typeof value !== 'function') || value === null) return null;
-  const method = Reflect.get(value, 'fetch') || Reflect.get(value, 'handleHttpRequest');
-  if (typeof method !== 'function') return null;
+  // A `fetch` target already has fetch semantics, so it serves both.
+  const fetchMethod = Reflect.get(value, 'fetch');
+  if (typeof fetchMethod === 'function') {
+    const fetch = fetchMethod.bind(value) as (request: Request) => Promise<Response>;
+    return { handleHttpRequest: fetch, handleWebSocketRequest: fetch };
+  }
+  const httpMethod = Reflect.get(value, 'handleHttpRequest');
+  if (typeof httpMethod !== 'function') return null;
+  const webSocketMethod = Reflect.get(value, 'handleWebSocketRequest');
   return {
-    handleHttpRequest: method.bind(value),
+    handleHttpRequest: httpMethod.bind(value),
+    ...(typeof webSocketMethod === 'function'
+      ? { handleWebSocketRequest: webSocketMethod.bind(value) }
+      : {}),
   };
 }
 

package/src/runtime/process-logs.ts

@@ -61,6 +61,15 @@ export interface SequencedLogChunk extends LogChunk {
   seq: number;
 }
 
+/**
+ * A chunk as a persist adapter hands it back on load. `seq` is the sequence
+ * number the adapter stored alongside it; hydration falls back to array
+ * position for a row that carries none.
+ */
+export interface PersistedLogChunk extends LogChunk {
+  seq?: number;
+}
+
 export interface ProcessLogReadOptions {
   cursor?: number;
   lines?: number;
@@ -130,7 +139,7 @@ interface PidState {
  *     against the SQLite engine); KV is not used by W9.
  */
 export interface PersistAdapter {
-  load(pid: number): { chunks: LogChunk[]; exit: ProcessExitInfo | null } | null;
+  load(pid: number): { chunks: PersistedLogChunk[]; exit: ProcessExitInfo | null } | null;
   persistChunks(pid: number, rows: { seq: number; chunk: LogChunk }[]): void;
   persistExit(pid: number, info: ProcessExitInfo): void;
   dropPid(pid: number): void;
@@ -710,7 +719,7 @@ export class ProcessLogStore {
     if (state.hydrated) return;
     state.hydrated = true;
     if (!this._persist) return;
-    let loaded: { chunks: LogChunk[]; exit: ProcessExitInfo | null } | null;
+    let loaded: { chunks: PersistedLogChunk[]; exit: ProcessExitInfo | null } | null;
     try {
       loaded = this._persist.load(pid);
     } catch {
@@ -736,7 +745,7 @@ export class ProcessLogStore {
     let highestSeq = -1;
     for (let i = loaded.chunks.length - 1; i >= 0; i--) {
       const c = loaded.chunks[i];
-      const seq = (c as any).seq ?? i;
+      const seq = c.seq ?? i;
       if (seq > highestSeq) highestSeq = seq;
       const size = c.data.length;
       if (bytes + size > this.perPidBytes && newest.length > 0) {

package/src/runtime/project-detect.ts

@@ -10,6 +10,12 @@
  * can add detectVite, detectNext, etc. here.
  */
 
+/** The filesystem reads a project probe needs. */
+export interface ProjectProbeFs {
+  exists(path: string): boolean;
+  readFileString(path: string): string;
+}
+
 /**
  * W10: detect whether the project at `<root>` is a Cloudflare Workers
  * project. Returns true if any of the standard markers are present:
@@ -18,7 +24,7 @@
  *   - <root>/wrangler.toml
  *   - <root>/package.json with `wrangler` in deps or devDeps
  */
-export function detectCloudflareWorkersProject(vfs: any, root: string): boolean {
+export function detectCloudflareWorkersProject(vfs: ProjectProbeFs, root: string): boolean {
   const r = String(root).replace(/^\/+/, '').replace(/\/+$/, '');
   for (const f of ['wrangler.jsonc', 'wrangler.json', 'wrangler.toml']) {
     try {

package/src/runtime/require-resolver.ts

@@ -33,6 +33,7 @@ import {
   resolveExports as sharedResolveExports,
   DEFAULT_CJS_CONDITIONS,
   DEFAULT_ESM_CONDITIONS,
+  type ResolvablePackageJson,
 } from '../_shared/exports-resolver.js';
 import {
   TYPESCRIPT_INDEX_CANDIDATES,
@@ -146,7 +147,7 @@ function resolveFile(vfs: CredentialedVfs, base: string, sink?: PkgJsonSink): st
   const baseTrim = base.replace(/\/+$/, '');
   const pkgJsonPath = normalizePath(baseTrim + '/package.json');
   if (vfs.exists(pkgJsonPath) && !vfs.isDirectory(pkgJsonPath)) {
-    let pkg: any = null;
+    let pkg: ResolvablePackageJson | null = null;
     try { pkg = JSON.parse(vfs.readFileString(pkgJsonPath)); } catch { /* fall through */ }
     if (pkg && typeof pkg.main === 'string' && pkg.main.length > 0) {
       // Record this package.json so the bundle carries the content the
@@ -257,7 +258,7 @@ function resolvePkgSubpathEx(vfs: CredentialedVfs, pkgDir: string, subpath: stri
     // fallback (consistent behaviour across the no-pkgjson branch).
     return tryLegacyDirectorySubpath(vfs, pkgDir, subpath, sink);
   }
-  let pkg: { exports?: any; module?: string; main?: string };
+  let pkg: ResolvablePackageJson;
   try { pkg = JSON.parse(vfs.readFileString(pkgJsonPath)); }
   catch {
     const r = resolveFile(vfs, pkgDir + '/index', sink);
@@ -477,7 +478,7 @@ function resolveImportsField(
   while (true) {
     const pkgJsonPath = (dir ? dir + '/' : '') + 'package.json';
     if (vfs.exists(pkgJsonPath) && !vfs.isDirectory(pkgJsonPath)) {
-      let pkg: any = null;
+      let pkg: ResolvablePackageJson | null = null;
       try { pkg = JSON.parse(vfs.readFileString(pkgJsonPath)); } catch { /* malformed */ }
       // First package.json wins (Node spec), even if no imports field.
       if (pkg && pkg.imports) {
@@ -618,8 +619,7 @@ export function prefetchForRequire(
     const stripped = stripCommentsForImports(code);
 
     REQUIRE_RE.lastIndex = 0;
-    let match;
-    while ((match = REQUIRE_RE.exec(stripped)) !== null) {
+    for (let match = REQUIRE_RE.exec(stripped); match !== null; match = REQUIRE_RE.exec(stripped)) {
       const specifier = match[2];
       if (isFacetProvided(specifier)) continue;
       const r = resolveRequireEx(vfs, specifier, fromDir, addPkgJson);
@@ -635,7 +635,7 @@ export function prefetchForRequire(
     // runtime W3.5 Fix B's CJS rewrite calls require('./x') which then
     // fails because `x` was never added.
     IMPORT_RE.lastIndex = 0;
-    while ((match = IMPORT_RE.exec(stripped)) !== null) {
+    for (let match = IMPORT_RE.exec(stripped); match !== null; match = IMPORT_RE.exec(stripped)) {
       const specifier = match[2];
       if (isFacetProvided(specifier)) continue;
       const r = resolveRequireEx(vfs, specifier, fromDir, addPkgJson);
@@ -647,7 +647,7 @@ export function prefetchForRequire(
     // Follow static-string dynamic imports so a CLI entry that defers to
     // import('./dist/index.js') has that subtree's content prefetched.
     DYNIMPORT_RE.lastIndex = 0;
-    while ((match = DYNIMPORT_RE.exec(stripped)) !== null) {
+    for (let match = DYNIMPORT_RE.exec(stripped); match !== null; match = DYNIMPORT_RE.exec(stripped)) {
       const specifier = match[2];
       if (isFacetProvided(specifier)) continue;
       const r = resolveRequireEx(vfs, specifier, fromDir, addPkgJson);