@nimbus-sh/core 0.3.0 → 0.5.0

package/src/runtime/runtime-registry.ts

@@ -43,6 +43,8 @@ import { CRED_KERNEL, type VfsCred } from './os-contracts.js';
 import type { EsbuildService } from './esbuild-service.js';
 import { parseFacetBundleProfile, type FacetBundleProfile } from './bundle-profile.js';
 import { bindImportMetaResolve, importMetaDefines } from './import-meta-transform.js';
+import type { Command, CommandContext } from '../substrate/lifo/commands/types.js';
+import { errorText } from '../_shared/error-text.js';
 
 /**
  * Result shape that runtime-registry expects from a runner. Mirrors
@@ -130,7 +132,7 @@ export function resolveRuntimeScriptPath(
  * a second one.
  */
 export type RuntimeSubcommand = (
-  ctx: any,
+  ctx: CommandContext,
   registry: ShellRegistry,
   runAsRuntime: (args: string[]) => Promise<number>,
 ) => Promise<number>;
@@ -181,7 +183,7 @@ export interface RuntimeSpec {
  * shell registry type tree when the runtime path only needs resolve().
  */
 export interface ShellRegistry {
-  resolve(name: string): Promise<any> | any;
+  resolve(name: string): Promise<Command | null | undefined> | Command | null | undefined;
 }
 
 /**
@@ -201,7 +203,7 @@ export function buildRuntimeHandler(
     getEsbuild(): EsbuildService | Promise<EsbuildService>;
     registry: ShellRegistry;
   },
-): (ctx: any) => Promise<number> {
+): Command {
   const { vfs, getEsbuild, registry } = ctx0;
   const fs = vfs.as(CRED_KERNEL);
 
@@ -211,7 +213,7 @@ export function buildRuntimeHandler(
    * caller has already consumed them — so a verb handler can delegate
    * back in with a rewritten argv without re-triggering itself.
    */
-  async function runtimeInvocation(ctx: any, args: string[]): Promise<number> {
+  async function runtimeInvocation(ctx: CommandContext, args: string[]): Promise<number> {
     const name = spec.name;
     const nimbusCtx = ctx as {
       __nimbusCaptureOutput?: unknown;
@@ -449,8 +451,8 @@ export function buildRuntimeHandler(
           define: importMetaDefines(absUrl),
         });
         code = bindImportMetaResolve(transformed.code, absUrl);
-      } catch (e: any) {
-        ctx.stderr.write(`${name}: transform error for ${scriptPath}: ${e?.message}\n`);
+      } catch (e) {
+        ctx.stderr.write(`${name}: transform error for ${scriptPath}: ${errorText(e)}\n`);
         return 1;
       }
     }
@@ -488,7 +490,7 @@ export function buildRuntimeHandler(
     return result.exitCode;
   }
 
-  return async function runtimeHandler(ctx: any): Promise<number> {
+  return async function runtimeHandler(ctx: CommandContext): Promise<number> {
     const args: string[] = ctx.args || [];
 
     // ── Subcommand dispatch ──

package/src/runtime/session-process-supervisor.ts

@@ -67,6 +67,8 @@ export class SessionProcessSupervisor {
   private terminators = new Map<number, () => void>();
   /** Fires after every appendOutput/markExit once log persistence is wired. */
   private logActivity: (() => void) | null = null;
+  /** Fires once per pid on its first terminal transition; see setOnTerminal. */
+  private onTerminalCb: ((pid: number) => void) | null = null;
 
   // ── Lifecycle / PID authority ─────────────────────────────────────────
 
@@ -130,10 +132,33 @@ export class SessionProcessSupervisor {
     return this.table.setUmask(pid, umask);
   }
 
+  /**
+   * Observe every pid's FIRST transition out of `running`, whichever door it
+   * leaves by — exit(), kill(), a facet's self-reported exit, a timeout abort:
+   * all of them end here, which is what makes this one callback a complete
+   * seam for per-pid durable state (the resident-launch journal) that must be
+   * released exactly when the process ends and never before.
+   *
+   * One slot, owned by the FacetManager. A second subscriber would mean two
+   * owners of process-end policy; grow this into a list only when a second
+   * genuine owner exists.
+   */
+  setOnTerminal(cb: (pid: number) => void): void {
+    this.onTerminalCb = cb;
+  }
+
+  private fireTerminal(pid: number, wasRunning: boolean): void {
+    if (!wasRunning || !this.onTerminalCb) return;
+    if (this.table.get(pid)?.state === 'running') return;
+    try { this.onTerminalCb(pid); } catch { /* the process is gone regardless */ }
+  }
+
   /** Mark a process as exited. First terminal state wins. */
   exit(pid: number, exitCode: number): void {
+    const wasRunning = this.table.get(pid)?.state === 'running';
     this.table.exit(pid, exitCode);
     this.terminators.delete(pid);
+    this.fireTerminal(pid, wasRunning);
   }
 
   /**
@@ -141,9 +166,11 @@ export class SessionProcessSupervisor {
    * stdin can't outlive the process.
    */
   kill(pid: number): boolean {
+    const wasRunning = this.table.get(pid)?.state === 'running';
     const killed = this.table.kill(pid);
     this.terminate(pid);
     this.input.close(pid);
+    this.fireTerminal(pid, wasRunning);
     return killed;
   }
 

package/src/runtime/sqlite-runtime-fs-bridge.ts

@@ -455,12 +455,15 @@ function normalizeOpenFlags(flags: RuntimeOpenFlags): RuntimeFileHandle['flags']
   };
 }
 
-function fsError(code: string, syscall: string, path: string): Error {
-  const err: any = new Error(`${code}: ${syscall} '${path}'`);
-  err.code = code;
-  err.syscall = syscall;
-  err.path = path;
-  return err;
+/** An error carrying the fields Node's `fs` puts on a failed syscall. */
+interface FsError extends Error {
+  code: string;
+  syscall: string;
+  path: string;
+}
+
+function fsError(code: string, syscall: string, path: string): FsError {
+  return Object.assign(new Error(`${code}: ${syscall} '${path}'`), { code, syscall, path });
 }
 
 function hasErrorCode(error: unknown, code: string): boolean {

package/src/runtime/virtual-socket-kernel.generated.ts

@@ -8,7 +8,7 @@
  * Consumed by python-runner.ts and ruby-runner.ts: spliced into the
  * socket process worker module source passed to NimbusLoaderPool.
  *
- * Size: 33.72 KiB
+ * Size: 33.76 KiB
  */
 
-export const VIRTUAL_SOCKET_KERNEL_SRC: string = "(() => {\n  // ../core/src/runtime/virtual-socket-kernel.ts\n  var DEFAULT_LIMITS = {\n    responseTimeoutMs: 3e4,\n    maxRequestBodyBytes: 32 * 1024 * 1024,\n    maxResponseBufferBytes: 64 * 1024 * 1024\n  };\n  var EMPTY_BYTES = new Uint8Array(0);\n  var Deferred = class {\n    promise;\n    resolve;\n    reject;\n    constructor() {\n      let resolve = () => {\n      };\n      let reject = () => {\n      };\n      this.promise = new Promise((res, rej) => {\n        resolve = res;\n        reject = rej;\n      });\n      this.resolve = resolve;\n      this.reject = reject;\n    }\n  };\n  function isPyodideProxyLike(value) {\n    return value !== null && typeof value === \"object\" && typeof value.toJs === \"function\";\n  }\n  function toBytes(value) {\n    if (value instanceof Uint8Array) return value;\n    if (value instanceof ArrayBuffer) return new Uint8Array(value);\n    if (ArrayBuffer.isView(value)) return new Uint8Array(value.buffer, value.byteOffset, value.byteLength);\n    if (Array.isArray(value)) return Uint8Array.from(value);\n    if (typeof value === \"string\") return new TextEncoder().encode(value);\n    if (isPyodideProxyLike(value)) return toBytes(value.toJs());\n    return EMPTY_BYTES;\n  }\n  function concatBytes(parts) {\n    let length = 0;\n    for (const part of parts) length += part.byteLength;\n    const out = new Uint8Array(length);\n    let offset = 0;\n    for (const part of parts) {\n      out.set(part, offset);\n      offset += part.byteLength;\n    }\n    return out;\n  }\n  function responseCanHaveBody(requestMethod, status) {\n    if (requestMethod.toUpperCase() === \"HEAD\") return false;\n    return status !== 204 && status !== 205 && status !== 304;\n  }\n  function encodeHttpRequest(request, body) {\n    const url = new URL(request.url);\n    const path = (url.pathname || \"/\") + url.search;\n    const headers = new Headers(request.headers);\n    if (!headers.has(\"Host\")) headers.set(\"Host\", url.host || \"nimbus.local\");\n    if (body.byteLength > 0 && !headers.has(\"Content-Length\")) {\n      headers.set(\"Content-Length\", String(body.byteLength));\n    }\n    const lines = [`${request.method} ${path} HTTP/1.1`];\n    headers.forEach((value, key) => lines.push(`${key}: ${value}`));\n    lines.push(\"\", \"\");\n    return concatBytes([new TextEncoder().encode(lines.join(\"\\r\\n\")), body]);\n  }\n  function encodeHttpResponseHead(status, statusText, headers, chunkedBody) {\n    const lines = [`HTTP/1.1 ${status} ${statusText}`];\n    headers.forEach((value, key) => lines.push(`${key}: ${value}`));\n    if (chunkedBody) lines.push(\"Transfer-Encoding: chunked\");\n    lines.push(\"Connection: close\");\n    lines.push(\"\", \"\");\n    return new TextEncoder().encode(lines.join(\"\\r\\n\"));\n  }\n  function encodeChunkedFrame(bytes) {\n    return concatBytes([\n      new TextEncoder().encode(`${bytes.byteLength.toString(16)}\\r\n`),\n      bytes,\n      new TextEncoder().encode(\"\\r\\n\")\n    ]);\n  }\n  var CHUNKED_TERMINATOR = new TextEncoder().encode(\"0\\r\\n\\r\\n\");\n  var LOOPBACK_READ_HIGH_WATER_BYTES = 1024 * 1024;\n  var LOOPBACK_STREAM_CHUNK_BYTES = 64 * 1024;\n  var ByteChunkQueue = class {\n    constructor(limitTotalBytes, overflowLabel) {\n      this.limitTotalBytes = limitTotalBytes;\n      this.overflowLabel = overflowLabel;\n    }\n    limitTotalBytes;\n    overflowLabel;\n    chunks = [];\n    headOffset = 0;\n    enqueuedTotalBytes = 0;\n    undrainedBytes = 0;\n    /** Bytes enqueued but not yet read. Drives flow control on streamed queues. */\n    get pendingBytes() {\n      return this.undrainedBytes;\n    }\n    enqueue(bytes) {\n      if (bytes.byteLength === 0) return;\n      if (this.enqueuedTotalBytes + bytes.byteLength > this.limitTotalBytes) {\n        throw new Error(\n          `Nimbus virtual socket: ${this.overflowLabel} exceeds ${this.limitTotalBytes} bytes`\n        );\n      }\n      this.enqueuedTotalBytes += bytes.byteLength;\n      this.undrainedBytes += bytes.byteLength;\n      this.chunks.push(bytes);\n    }\n    /** Drain up to maxBytes from the head chunk; empty result means no data is queued. */\n    readUpTo(maxBytes) {\n      const head = this.chunks[0];\n      if (!head) return EMPTY_BYTES;\n      const available = head.byteLength - this.headOffset;\n      const take = Math.min(available, Math.max(1, maxBytes));\n      const out = head.subarray(this.headOffset, this.headOffset + take);\n      this.headOffset += take;\n      this.undrainedBytes -= take;\n      if (this.headOffset >= head.byteLength) {\n        this.chunks.shift();\n        this.headOffset = 0;\n      }\n      return out;\n    }\n  };\n  var HttpMessageParser = class {\n    phase = \"headers\";\n    settled = null;\n    headerBuffer = EMPTY_BYTES;\n    headerScanOffset = 0;\n    headerPairs = [];\n    framing = \"none\";\n    expectedBodyBytes = 0;\n    bodyChunks = [];\n    bodyByteCount = 0;\n    chunkState = \"size\";\n    chunkSizeLine = [];\n    chunkDataRemaining = 0;\n    get outcome() {\n      return this.settled;\n    }\n    feed(chunk) {\n      if (this.phase === \"done\" || chunk.byteLength === 0) return;\n      if (this.phase === \"headers\") {\n        this.feedHeaders(chunk);\n        return;\n      }\n      this.feedBody(chunk);\n    }\n    /** EOF from the peer closing the connection (or the request being torn down). */\n    finish() {\n      if (this.phase === \"done\") return;\n      if (this.phase === \"headers\") {\n        this.fail(`connection closed before ${this.messageLabel} headers`);\n        return;\n      }\n      if (this.framing === \"until-close\") {\n        this.completeWithBody(concatBytes(this.bodyChunks));\n        return;\n      }\n      this.fail(`connection closed before the ${this.messageLabel} completed`);\n    }\n    feedHeaders(chunk) {\n      this.headerBuffer = concatBytes([this.headerBuffer, chunk]);\n      const headerEnd = this.findHeaderEnd();\n      if (headerEnd < 0) {\n        this.headerScanOffset = Math.max(0, this.headerBuffer.byteLength - 3);\n        return;\n      }\n      const parsed = this.parseHeaderBlock(this.headerBuffer.subarray(0, headerEnd));\n      const leftover = this.headerBuffer.subarray(headerEnd);\n      this.headerBuffer = EMPTY_BYTES;\n      if (!parsed) return;\n      if (!this.bodyAllowed()) {\n        this.completeWithBody(null);\n        return;\n      }\n      const transferEncoding = this.headerValue(\"Transfer-Encoding\");\n      if (transferEncoding !== null && /chunked/i.test(transferEncoding)) {\n        this.framing = \"chunked\";\n      } else {\n        const contentLength = this.headerValue(\"Content-Length\");\n        const expected = contentLength === null ? Number.NaN : parseInt(contentLength, 10);\n        if (Number.isFinite(expected) && expected >= 0) {\n          this.framing = \"content-length\";\n          this.expectedBodyBytes = expected;\n          if (expected === 0) {\n            this.completeWithBody(EMPTY_BYTES);\n            return;\n          }\n        } else {\n          this.framing = this.defaultFramingWhenUnframed();\n          if (this.framing === \"none\") {\n            this.completeWithBody(null);\n            return;\n          }\n        }\n      }\n      this.phase = \"body\";\n      this.feedBody(leftover);\n    }\n    feedBody(chunk) {\n      if (this.framing === \"chunked\") {\n        this.feedChunkedBody(chunk);\n        return;\n      }\n      if (chunk.byteLength === 0) return;\n      if (this.framing === \"content-length\") {\n        const needed = this.expectedBodyBytes - this.bodyByteCount;\n        this.appendBody(chunk.subarray(0, Math.min(needed, chunk.byteLength)));\n        if (this.bodyByteCount >= this.expectedBodyBytes) {\n          this.completeWithBody(concatBytes(this.bodyChunks));\n        }\n        return;\n      }\n      this.appendBody(chunk);\n    }\n    feedChunkedBody(chunk) {\n      let i = 0;\n      while (i < chunk.byteLength && this.phase === \"body\") {\n        if (this.chunkState === \"size\") {\n          const byte = chunk[i++];\n          if (byte === 10) {\n            const line = new TextDecoder().decode(Uint8Array.from(this.chunkSizeLine)).trim();\n            this.chunkSizeLine.length = 0;\n            const size = parseInt(line.split(\";\", 1)[0], 16);\n            if (!Number.isFinite(size) || size < 0) {\n              this.fail(\"malformed chunked transfer encoding\");\n              return;\n            }\n            if (size === 0) {\n              this.completeWithBody(concatBytes(this.bodyChunks));\n              return;\n            }\n            this.chunkState = \"data\";\n            this.chunkDataRemaining = size;\n          } else if (byte !== 13) {\n            this.chunkSizeLine.push(byte);\n          }\n        } else if (this.chunkState === \"data\") {\n          const take = Math.min(this.chunkDataRemaining, chunk.byteLength - i);\n          this.appendBody(chunk.subarray(i, i + take));\n          i += take;\n          this.chunkDataRemaining -= take;\n          if (this.chunkDataRemaining === 0) this.chunkState = \"data-end\";\n        } else {\n          const byte = chunk[i++];\n          if (byte === 10) {\n            this.chunkState = \"size\";\n          } else if (byte !== 13) {\n            this.fail(\"malformed chunked transfer encoding\");\n            return;\n          }\n        }\n      }\n    }\n    appendBody(bytes) {\n      if (bytes.byteLength === 0) return;\n      this.bodyChunks.push(bytes);\n      this.bodyByteCount += bytes.byteLength;\n    }\n    findHeaderEnd() {\n      const bytes = this.headerBuffer;\n      for (let i = this.headerScanOffset; i + 3 < bytes.byteLength; i++) {\n        if (bytes[i] === 13 && bytes[i + 1] === 10 && bytes[i + 2] === 13 && bytes[i + 3] === 10) {\n          return i + 4;\n        }\n      }\n      return -1;\n    }\n    /** Returns false when the start line is malformed (the parser has already failed). */\n    parseHeaderBlock(headerBytes) {\n      const headerText = new TextDecoder().decode(headerBytes);\n      const lines = headerText.replace(/\\r\\n/g, \"\\n\").split(\"\\n\").filter((line) => line.length > 0);\n      const startLine = lines.shift() ?? \"\";\n      if (!this.parseStartLine(startLine)) return false;\n      for (const line of lines) {\n        const separator = line.indexOf(\":\");\n        if (separator <= 0) continue;\n        this.headerPairs.push([line.slice(0, separator), line.slice(separator + 1).trimStart()]);\n      }\n      return true;\n    }\n    headerValue(name) {\n      const target = name.toLowerCase();\n      for (const [key, value] of this.headerPairs) {\n        if (key.toLowerCase() === target) return value;\n      }\n      return null;\n    }\n    completeWithBody(body) {\n      this.phase = \"done\";\n      this.settled = { kind: \"message\", message: this.buildMessage(body) };\n    }\n    fail(message) {\n      this.phase = \"done\";\n      this.settled = { kind: \"failed\", message };\n    }\n  };\n  var HttpResponseParser = class extends HttpMessageParser {\n    constructor(requestMethod) {\n      super();\n      this.requestMethod = requestMethod;\n    }\n    requestMethod;\n    status = 200;\n    statusText = \"\";\n    get messageLabel() {\n      return \"response\";\n    }\n    parseStartLine(line) {\n      const match = /^HTTP\\/\\d(?:\\.\\d)?\\s+(\\d{3})(?:\\s+(.*))?$/.exec(line || \"HTTP/1.1 200 OK\");\n      this.status = match ? parseInt(match[1], 10) : 200;\n      this.statusText = match?.[2] ?? \"\";\n      return true;\n    }\n    bodyAllowed() {\n      return responseCanHaveBody(this.requestMethod, this.status);\n    }\n    defaultFramingWhenUnframed() {\n      return \"until-close\";\n    }\n    buildMessage(body) {\n      return { status: this.status, statusText: this.statusText, headerPairs: this.headerPairs, body };\n    }\n  };\n  var HttpRequestParser = class extends HttpMessageParser {\n    method = \"GET\";\n    target = \"/\";\n    get messageLabel() {\n      return \"request\";\n    }\n    parseStartLine(line) {\n      const match = /^([A-Za-z]+)\\s+(\\S+)\\s+HTTP\\/\\d(?:\\.\\d)?$/.exec(line);\n      if (!match) {\n        this.fail(`malformed HTTP request line: ${JSON.stringify(line.slice(0, 120))}`);\n        return false;\n      }\n      this.method = match[1].toUpperCase();\n      this.target = match[2];\n      return true;\n    }\n    bodyAllowed() {\n      return true;\n    }\n    defaultFramingWhenUnframed() {\n      return \"none\";\n    }\n    buildMessage(body) {\n      return { method: this.method, target: this.target, headerPairs: this.headerPairs, body };\n    }\n  };\n  function errorResponse(status, message) {\n    return {\n      status,\n      statusText: \"\",\n      headerPairs: [[\"content-type\", \"text/plain; charset=utf-8\"]],\n      body: new TextEncoder().encode(`Nimbus virtual socket: ${message}`)\n    };\n  }\n  function toResponse(settled) {\n    const headers = new Headers();\n    for (const [key, value] of settled.headerPairs) headers.append(key, value);\n    return new Response(settled.body, {\n      status: settled.status,\n      statusText: settled.statusText,\n      headers\n    });\n  }\n  var VirtualConnection = class {\n    constructor(id, requestMethod, requestBytes, limits) {\n      this.id = id;\n      this.inbound = new ByteChunkQueue(requestBytes.byteLength, \"request buffer\");\n      this.inbound.enqueue(requestBytes);\n      this.outbound = new ByteChunkQueue(limits.maxResponseBufferBytes, \"response buffer\");\n      this.parser = new HttpResponseParser(requestMethod);\n    }\n    id;\n    /** Request bytes the guest server reads; filled in one shot in stage 1. */\n    inbound;\n    /** Response bytes the guest server writes; drained into the parser. */\n    outbound;\n    parser;\n    responseReady = new Deferred();\n    settled = false;\n    closed = false;\n    read(maxBytes) {\n      return Array.from(this.inbound.readUpTo(Math.max(1, maxBytes | 0)));\n    }\n    /** The whole request is buffered before the connection is accepted, so nothing is ever awaited. */\n    readAsync(maxBytes) {\n      return Promise.resolve(this.read(maxBytes));\n    }\n    readBytesAsync(maxBytes) {\n      return Promise.resolve(this.inbound.readUpTo(Math.max(1, maxBytes | 0)));\n    }\n    /** Same reason: an empty read on an accepted connection is always genuine EOF. */\n    atEof() {\n      return true;\n    }\n    write(bytesLike) {\n      const bytes = toBytes(bytesLike);\n      if (bytes.byteLength === 0 || this.settled || this.closed) return bytes.byteLength;\n      this.outbound.enqueue(bytes.slice());\n      this.pumpParser();\n      return bytes.byteLength;\n    }\n    /** EOF from the server side (or request teardown); completes until-close bodies. */\n    close() {\n      if (this.closed) return;\n      this.closed = true;\n      if (this.settled) return;\n      this.parser.finish();\n      this.pumpParser();\n    }\n    /** Abort propagation: settle the pending preview request with a terminal status. */\n    abort(message, status) {\n      this.closed = true;\n      this.settle(errorResponse(status, message));\n    }\n    async response(timeoutMs) {\n      const timer = setTimeout(() => {\n        this.settle(errorResponse(504, \"timed out waiting for response\"));\n      }, Math.max(1, timeoutMs));\n      try {\n        return toResponse(await this.responseReady.promise);\n      } finally {\n        clearTimeout(timer);\n      }\n    }\n    pumpParser() {\n      for (; ; ) {\n        const chunk = this.outbound.readUpTo(Number.MAX_SAFE_INTEGER);\n        if (chunk.byteLength === 0) break;\n        this.parser.feed(chunk);\n      }\n      const outcome = this.parser.outcome;\n      if (!outcome) return;\n      if (outcome.kind === \"failed\") {\n        this.settle(errorResponse(502, outcome.message));\n        return;\n      }\n      const { status, statusText, headerPairs, body } = outcome.message;\n      this.settle({\n        status,\n        statusText,\n        // The framing is consumed here; the Worker Response re-frames the body itself.\n        headerPairs: headerPairs.filter(([key]) => !/^transfer-encoding$/i.test(key)),\n        body\n      });\n    }\n    settle(response) {\n      if (this.settled) return;\n      this.settled = true;\n      this.responseReady.resolve(response);\n    }\n  };\n  var LoopbackClientConnection = class {\n    constructor(id, port, route, limits) {\n      this.id = id;\n      this.port = port;\n      this.route = route;\n      this.limits = limits;\n    }\n    id;\n    port;\n    route;\n    limits;\n    parser = new HttpRequestParser();\n    /** Response bytes the guest client reads. */\n    inbound = new ByteChunkQueue(Number.MAX_SAFE_INTEGER, \"loopback response buffer\");\n    readable = null;\n    drained = null;\n    dispatched = false;\n    eof = false;\n    closed = false;\n    write(bytesLike) {\n      const bytes = toBytes(bytesLike);\n      if (bytes.byteLength === 0 || this.closed) return bytes.byteLength;\n      if (this.dispatched) {\n        throw new Error(\n          `Nimbus loopback socket: port ${this.port} answered with \"Connection: close\"; open a new connection for the next request`\n        );\n      }\n      this.parser.feed(bytes.slice());\n      const outcome = this.parser.outcome;\n      if (!outcome) return bytes.byteLength;\n      this.dispatched = true;\n      if (outcome.kind === \"failed\") this.failWith(400, outcome.message);\n      else void this.dispatch(outcome.message);\n      return bytes.byteLength;\n    }\n    read(maxBytes) {\n      return Array.from(this.readBytes(maxBytes));\n    }\n    /** Byte-array read. The fd-backed path uses this so a stream never round-trips through number[]. */\n    readBytes(maxBytes) {\n      const out = this.inbound.readUpTo(Math.max(1, maxBytes | 0));\n      if (this.drained && this.inbound.pendingBytes <= LOOPBACK_READ_HIGH_WATER_BYTES) {\n        const waiter = this.drained;\n        this.drained = null;\n        waiter.resolve();\n      }\n      return out;\n    }\n    atEof() {\n      return (this.eof || this.closed) && this.inbound.pendingBytes === 0;\n    }\n    /** Blocks the guest until response bytes arrive; an empty result is EOF. */\n    async readAsync(maxBytes) {\n      return Array.from(await this.readBytesAsync(maxBytes));\n    }\n    async readBytesAsync(maxBytes) {\n      for (; ; ) {\n        const chunk = this.readBytes(maxBytes);\n        if (chunk.byteLength > 0) return chunk;\n        if (this.eof || this.closed) return EMPTY_BYTES;\n        if (!this.dispatched) {\n          throw new Error(\n            \"Nimbus loopback socket: read before a complete HTTP request was written (loopback sockets carry HTTP requests, not arbitrary byte streams)\"\n          );\n        }\n        const waiter = this.readable ??= new Deferred();\n        await waiter.promise;\n      }\n    }\n    close() {\n      if (this.closed) return;\n      this.closed = true;\n      this.wakeReader();\n      if (this.drained) {\n        const waiter = this.drained;\n        this.drained = null;\n        waiter.resolve();\n      }\n    }\n    async dispatch(parsed) {\n      let request;\n      try {\n        request = this.buildRequest(parsed);\n      } catch (error) {\n        this.failWith(400, describeError(error));\n        return;\n      }\n      let response;\n      try {\n        response = await this.withTimeout(this.route(this.port, request));\n      } catch (error) {\n        this.failWith(502, describeError(error));\n        return;\n      }\n      await this.streamResponse(request.method, response);\n    }\n    buildRequest(parsed) {\n      const headers = new Headers();\n      let authority = `127.0.0.1:${this.port}`;\n      for (const [key, value] of parsed.headerPairs) {\n        if (/^host$/i.test(key)) {\n          authority = value;\n          continue;\n        }\n        if (/^(transfer-encoding|connection|content-length|keep-alive)$/i.test(key)) continue;\n        headers.append(key, value);\n      }\n      const target = parsed.target.startsWith(\"/\") ? parsed.target : `/${parsed.target}`;\n      const url = /^https?:\\/\\//i.test(parsed.target) ? parsed.target : `http://${authority}${target}`;\n      const body = parsed.body && parsed.body.byteLength > 0 ? parsed.body : null;\n      const methodTakesBody = parsed.method !== \"GET\" && parsed.method !== \"HEAD\";\n      return new Request(url, {\n        method: parsed.method,\n        headers,\n        body: methodTakesBody ? body : null\n      });\n    }\n    async streamResponse(method, response) {\n      const withBody = responseCanHaveBody(method, response.status) && response.body !== null;\n      const headers = new Headers(response.headers);\n      for (const hopByHop of [\"transfer-encoding\", \"content-length\", \"connection\", \"keep-alive\"]) {\n        headers.delete(hopByHop);\n      }\n      this.pushBytes(encodeHttpResponseHead(response.status, response.statusText, headers, withBody));\n      if (!withBody || !response.body) {\n        this.finishStream();\n        return;\n      }\n      const reader = response.body.getReader();\n      try {\n        for (; ; ) {\n          const { value, done } = await reader.read();\n          if (done) break;\n          if (this.closed) return;\n          const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);\n          if (bytes.byteLength === 0) continue;\n          this.pushBytes(encodeChunkedFrame(bytes));\n          await this.awaitDrain();\n        }\n        this.pushBytes(CHUNKED_TERMINATOR);\n      } catch {\n      } finally {\n        try {\n          await reader.cancel();\n        } catch {\n        }\n        this.finishStream();\n      }\n    }\n    /** Synthesize a complete response so the guest sees an HTTP error, never a hang. */\n    failWith(status, detail) {\n      const body = new TextEncoder().encode(`Nimbus loopback socket: ${detail}`);\n      const headers = new Headers({\n        \"content-type\": \"text/plain; charset=utf-8\",\n        \"content-length\": String(body.byteLength)\n      });\n      this.pushBytes(encodeHttpResponseHead(status, \"\", headers, false));\n      this.pushBytes(body);\n      this.finishStream();\n    }\n    pushBytes(bytes) {\n      if (this.closed) return;\n      this.inbound.enqueue(bytes);\n      this.wakeReader();\n    }\n    finishStream() {\n      this.eof = true;\n      this.wakeReader();\n    }\n    wakeReader() {\n      const waiter = this.readable;\n      if (!waiter) return;\n      this.readable = null;\n      waiter.resolve();\n    }\n    /** Pause the body pump while the guest is behind, so a big stream cannot grow unbounded. */\n    awaitDrain() {\n      if (this.inbound.pendingBytes <= LOOPBACK_READ_HIGH_WATER_BYTES) return Promise.resolve();\n      return (this.drained ??= new Deferred()).promise;\n    }\n    withTimeout(promise) {\n      let timer = null;\n      const timeout = new Promise((_resolve, reject) => {\n        timer = setTimeout(\n          () => reject(new Error(`port ${this.port} did not respond within ${this.limits.responseTimeoutMs}ms`)),\n          Math.max(1, this.limits.responseTimeoutMs)\n        );\n      });\n      return Promise.race([promise, timeout]).finally(() => {\n        if (timer !== null) clearTimeout(timer);\n      });\n    }\n  };\n  function describeError(error) {\n    return error instanceof Error ? error.message : String(error);\n  }\n  function socketStreamFor(conn) {\n    return {\n      // Neither direction has a handshake: an accepted connection already holds\n      // the request, and a dialed one starts its exchange on the first write.\n      opened: Promise.resolve(),\n      readable: new ReadableStream(\n        {\n          async pull(controller) {\n            const bytes = await conn.readBytesAsync(LOOPBACK_STREAM_CHUNK_BYTES);\n            if (bytes.byteLength === 0) controller.close();\n            else controller.enqueue(bytes);\n          },\n          cancel() {\n            conn.close();\n          }\n        },\n        // highWaterMark 0 so the stream never pulls speculatively. A default\n        // strategy pulls once at construction, which on a client connection\n        // means reading before the guest has written its request.\n        { highWaterMark: 0 }\n      ),\n      writable: new WritableStream({\n        write(chunk) {\n          conn.write(chunk);\n        },\n        abort() {\n          conn.close();\n        }\n      }),\n      close() {\n        conn.close();\n        return Promise.resolve();\n      }\n    };\n  }\n  var VirtualListener = class {\n    constructor(port) {\n      this.port = port;\n    }\n    port;\n    queue = [];\n    acceptWaiters = [];\n    push(conn) {\n      const waiter = this.acceptWaiters.shift();\n      if (waiter) waiter.resolve(conn);\n      else this.queue.push(conn);\n    }\n    accept() {\n      const queued = this.queue.shift();\n      if (queued) return Promise.resolve(queued);\n      const waiter = new Deferred();\n      this.acceptWaiters.push(waiter);\n      return waiter.promise;\n    }\n    take() {\n      return this.queue.shift() ?? null;\n    }\n    pending() {\n      return this.queue.length;\n    }\n    drainQueued() {\n      return this.queue.splice(0);\n    }\n    rejectPendingAccepts(error) {\n      for (const waiter of this.acceptWaiters.splice(0)) waiter.reject(error);\n    }\n  };\n  var VirtualSocketKernel = class {\n    constructor(host, limits) {\n      this.host = host;\n      this.limits = { ...DEFAULT_LIMITS, ...limits };\n    }\n    host;\n    /** Public: runner glue inspects listeners.keys() for the default preview port. */\n    listeners = /* @__PURE__ */ new Map();\n    connections = /* @__PURE__ */ new Map();\n    limits;\n    nextConnectionId = 1;\n    nextEphemeralPort = 49152;\n    listenWaiters = [];\n    readableWaiters = /* @__PURE__ */ new Set();\n    listen(port) {\n      let n = Number(port);\n      if (!Number.isInteger(n) || n < 0 || n >= 65536) throw new Error(`invalid port: ${port}`);\n      if (n === 0) {\n        while (this.listeners.has(this.nextEphemeralPort)) {\n          this.nextEphemeralPort++;\n          if (this.nextEphemeralPort >= 65535) this.nextEphemeralPort = 49152;\n        }\n        n = this.nextEphemeralPort++;\n        if (this.nextEphemeralPort >= 65535) this.nextEphemeralPort = 49152;\n      }\n      if (!this.listeners.has(n)) {\n        this.listeners.set(n, new VirtualListener(n));\n        try {\n          this.host.__nimbusVirtualSocketDidListen?.(n);\n        } catch {\n        }\n        for (const waiter of this.listenWaiters.splice(0)) waiter.resolve(n);\n      }\n      return n;\n    }\n    closeListener(port) {\n      const n = Number(port);\n      const listener = this.listeners.get(n);\n      if (!listener) return;\n      this.listeners.delete(n);\n      for (const conn of listener.drainQueued()) {\n        this.connections.delete(conn.id);\n        conn.abort(`listener closed on port ${n}`, 502);\n      }\n      listener.rejectPendingAccepts(new Error(`port is not listening: ${n}`));\n    }\n    async accept(port) {\n      const listener = this.listeners.get(Number(port));\n      if (!listener) throw new Error(`port is not listening: ${port}`);\n      const conn = await listener.accept();\n      return { id: conn.id, host: \"127.0.0.1\", port: 0 };\n    }\n    acceptNow(port) {\n      const listener = this.listeners.get(Number(port));\n      if (!listener) throw new Error(`port is not listening: ${port}`);\n      const conn = listener.take();\n      return conn ? { id: conn.id, host: \"127.0.0.1\", port: 0 } : null;\n    }\n    /**\n     * Open a client connection to `port` on the session's loopback.\n     *\n     * The returned id is an ordinary connection id: send() writes the\n     * request, recv()/recvAsync() read the response, close() releases it.\n     * Only HTTP/1.1 crosses a loopback connection - see\n     * LoopbackClientConnection for why - and each one carries a single\n     * request/response exchange.\n     */\n    connect(port) {\n      const conn = this.openLoopbackClient(port);\n      this.connections.set(conn.id, conn);\n      return conn.id;\n    }\n    /**\n     * The same client connection as `connect`, handed back in Cloudflare's\n     * `Socket` shape.\n     *\n     * Guests whose sockets are real WASI file descriptors (ruby.wasm, and any\n     * future wasm32-wasi program) reach loopback through this: the WASI shim\n     * stores it in exactly the fd slot a `cloudflare:sockets` connection would\n     * occupy, so `fd_read` on an in-session port is the same suspending read as\n     * `fd_read` on a remote host.\n     */\n    connectStream(port) {\n      return socketStreamFor(this.openLoopbackClient(port));\n    }\n    /**\n     * An already-accepted connection in the same `Socket` shape, so a server's\n     * accepted socket is the same kind of file descriptor as a client's dialed\n     * one. `accept`/`acceptNow` still hand out the connection id, because accept\n     * itself stays on the cooperative pump - this only binds the result.\n     */\n    streamFor(id) {\n      const conn = this.connections.get(Number(id));\n      if (!conn) throw new Error(`connection is closed: ${id}`);\n      return socketStreamFor(conn);\n    }\n    openLoopbackClient(port) {\n      const n = Number(port);\n      if (!Number.isInteger(n) || n <= 0 || n >= 65536) throw new Error(`invalid port: ${port}`);\n      const route = this.host.__nimbusVirtualSocketRouteLoopback;\n      if (typeof route !== \"function\") {\n        throw new Error(\"Nimbus loopback sockets are unavailable in this runtime\");\n      }\n      return new LoopbackClientConnection(this.nextConnectionId++, n, route, this.limits);\n    }\n    /** Plain number array: Pyodide bytes() and the ruby.wasm base64 bridge both consume it. */\n    recv(id, maxBytes) {\n      const conn = this.connections.get(Number(id));\n      if (!conn) return [];\n      return conn.read(Number(maxBytes));\n    }\n    /**\n     * Suspending read. A client connection has nothing to hand back until\n     * the loopback response arrives, so guests that can suspend (Pyodide\n     * `run_sync`, a JSPI-suspending WASI call) await this instead of\n     * spinning on recv(). An empty result is EOF.\n     */\n    async recvAsync(id, maxBytes) {\n      const conn = this.connections.get(Number(id));\n      if (!conn) return [];\n      return conn.readAsync(Number(maxBytes));\n    }\n    /**\n     * Whether an empty recv() means end-of-response rather than \"not yet\".\n     * Guests that poll instead of suspending (ruby.wasm, whose JS bridge is\n     * synchronous) need the two apart to avoid truncating a response.\n     */\n    atEof(id) {\n      const conn = this.connections.get(Number(id));\n      return conn ? conn.atEof() : true;\n    }\n    send(id, bytesLike) {\n      const conn = this.connections.get(Number(id));\n      if (!conn) throw new Error(`connection is closed: ${id}`);\n      return conn.write(bytesLike);\n    }\n    close(id) {\n      const conn = this.connections.get(Number(id));\n      if (!conn) return;\n      conn.close();\n      this.connections.delete(Number(id));\n    }\n    pending(port) {\n      return this.listeners.get(Number(port))?.pending() ?? 0;\n    }\n    firstListeningPort() {\n      for (const port of this.listeners.keys()) return port;\n      return null;\n    }\n    /** select()-style readiness: resolves ports with queued connections, [] on timeout. */\n    waitReadable(ports, timeoutSeconds) {\n      const normalized = (Array.isArray(ports) ? ports : []).map((p) => Number(p)).filter((p) => Number.isInteger(p));\n      const readyNow = normalized.filter((port) => this.pending(port) > 0);\n      if (readyNow.length > 0) return Promise.resolve(readyNow);\n      const timeoutMs = timeoutSeconds == null ? this.limits.responseTimeoutMs : Math.max(0, Number(timeoutSeconds) * 1e3);\n      const deferred = new Deferred();\n      const waiter = {\n        ports: normalized,\n        deferred,\n        timer: setTimeout(() => {\n          this.readableWaiters.delete(waiter);\n          deferred.resolve([]);\n        }, timeoutMs)\n      };\n      this.readableWaiters.add(waiter);\n      return deferred.promise;\n    }\n    async waitForListen(timeoutMs) {\n      const existing = this.firstListeningPort();\n      if (existing) return existing;\n      const waiter = new Deferred();\n      this.listenWaiters.push(waiter);\n      let timer = null;\n      const timeout = new Promise((resolve) => {\n        timer = setTimeout(() => resolve(null), Math.max(1, timeoutMs ?? 5e3));\n      });\n      try {\n        return await Promise.race([waiter.promise, timeout]);\n      } finally {\n        if (timer !== null) clearTimeout(timer);\n      }\n    }\n    async handleHttpRequest(port, request) {\n      const n = Number(port);\n      let listener = this.listeners.get(n);\n      if (!listener) {\n        try {\n          await this.host.__nimbusVirtualSocketEnsureListener?.(n);\n        } catch {\n        }\n        listener = this.listeners.get(n);\n      }\n      if (!listener) {\n        return new Response(`Nimbus virtual socket: no listener on port ${port}`, { status: 502 });\n      }\n      const body = request.method === \"GET\" || request.method === \"HEAD\" ? EMPTY_BYTES : new Uint8Array(await request.arrayBuffer());\n      if (body.byteLength > this.limits.maxRequestBodyBytes) {\n        return new Response(\n          `Nimbus virtual socket: request body exceeds ${this.limits.maxRequestBodyBytes} bytes`,\n          { status: 413 }\n        );\n      }\n      const id = this.nextConnectionId++;\n      const conn = new VirtualConnection(id, request.method, encodeHttpRequest(request, body), this.limits);\n      this.connections.set(id, conn);\n      listener.push(conn);\n      this.notifyReadable(n);\n      const signal = request.signal;\n      const onAbort = () => conn.abort(\"client aborted the request\", 499);\n      if (signal?.aborted) onAbort();\n      else signal?.addEventListener(\"abort\", onAbort);\n      try {\n        try {\n          const accepted = await this.host.__nimbusVirtualSocketRequestQueued?.(n);\n          if (accepted === false) {\n            const detail = typeof this.host.__nimbusVirtualSocketLastError === \"string\" ? this.host.__nimbusVirtualSocketLastError.trim() : \"\";\n            const suffix = detail ? `: ${detail}` : \"\";\n            return new Response(\n              `Nimbus virtual socket: runtime handler did not accept the request${suffix}`,\n              { status: 502 }\n            );\n          }\n        } catch {\n        }\n        return await conn.response(this.limits.responseTimeoutMs);\n      } finally {\n        signal?.removeEventListener(\"abort\", onAbort);\n        conn.close();\n        this.connections.delete(id);\n      }\n    }\n    notifyReadable(port) {\n      for (const waiter of Array.from(this.readableWaiters)) {\n        if (!waiter.ports.includes(port)) continue;\n        const ready = waiter.ports.filter((p) => this.pending(p) > 0);\n        if (ready.length === 0) continue;\n        clearTimeout(waiter.timer);\n        this.readableWaiters.delete(waiter);\n        waiter.deferred.resolve(ready);\n      }\n    }\n  };\n  function installVirtualSocketKernel(scope = globalThis) {\n    if (!scope.__nimbusVirtualSockets) {\n      scope.__nimbusVirtualSockets = new VirtualSocketKernel(scope);\n    }\n    return scope.__nimbusVirtualSockets;\n  }\n\n  // <stdin>\n  installVirtualSocketKernel();\n})();\n";
+export const VIRTUAL_SOCKET_KERNEL_SRC: string = "(() => {\n  // ../core/src/runtime/virtual-socket-kernel.ts\n  var DEFAULT_LIMITS = {\n    responseTimeoutMs: 3e4,\n    maxRequestBodyBytes: 32 * 1024 * 1024,\n    maxResponseBufferBytes: 64 * 1024 * 1024\n  };\n  var EMPTY_BYTES = new Uint8Array(0);\n  var Deferred = class {\n    promise;\n    resolve;\n    reject;\n    constructor() {\n      let resolve = () => {\n      };\n      let reject = () => {\n      };\n      this.promise = new Promise((res, rej) => {\n        resolve = res;\n        reject = rej;\n      });\n      this.resolve = resolve;\n      this.reject = reject;\n    }\n  };\n  function isPyodideProxyLike(value) {\n    return value !== null && typeof value === \"object\" && typeof value.toJs === \"function\";\n  }\n  function toBytes(value) {\n    if (value instanceof Uint8Array) return value;\n    if (value instanceof ArrayBuffer) return new Uint8Array(value);\n    if (ArrayBuffer.isView(value)) return new Uint8Array(value.buffer, value.byteOffset, value.byteLength);\n    if (Array.isArray(value)) return Uint8Array.from(value);\n    if (typeof value === \"string\") return new TextEncoder().encode(value);\n    if (isPyodideProxyLike(value)) return toBytes(value.toJs());\n    return EMPTY_BYTES;\n  }\n  function concatBytes(parts) {\n    let length = 0;\n    for (const part of parts) length += part.byteLength;\n    const out = new Uint8Array(length);\n    let offset = 0;\n    for (const part of parts) {\n      out.set(part, offset);\n      offset += part.byteLength;\n    }\n    return out;\n  }\n  function responseCanHaveBody(requestMethod, status) {\n    if (requestMethod.toUpperCase() === \"HEAD\") return false;\n    return status !== 204 && status !== 205 && status !== 304;\n  }\n  function encodeHttpRequest(request, body) {\n    const url = new URL(request.url);\n    const path = (url.pathname || \"/\") + url.search;\n    const headers = new Headers(request.headers);\n    if (!headers.has(\"Host\")) headers.set(\"Host\", url.host || \"nimbus.local\");\n    if (body.byteLength > 0 && !headers.has(\"Content-Length\")) {\n      headers.set(\"Content-Length\", String(body.byteLength));\n    }\n    const lines = [`${request.method} ${path} HTTP/1.1`];\n    headers.forEach((value, key) => {\n      lines.push(`${key}: ${value}`);\n    });\n    lines.push(\"\", \"\");\n    return concatBytes([new TextEncoder().encode(lines.join(\"\\r\\n\")), body]);\n  }\n  function encodeHttpResponseHead(status, statusText, headers, chunkedBody) {\n    const lines = [`HTTP/1.1 ${status} ${statusText}`];\n    headers.forEach((value, key) => {\n      lines.push(`${key}: ${value}`);\n    });\n    if (chunkedBody) lines.push(\"Transfer-Encoding: chunked\");\n    lines.push(\"Connection: close\");\n    lines.push(\"\", \"\");\n    return new TextEncoder().encode(lines.join(\"\\r\\n\"));\n  }\n  function encodeChunkedFrame(bytes) {\n    return concatBytes([\n      new TextEncoder().encode(`${bytes.byteLength.toString(16)}\\r\n`),\n      bytes,\n      new TextEncoder().encode(\"\\r\\n\")\n    ]);\n  }\n  var CHUNKED_TERMINATOR = new TextEncoder().encode(\"0\\r\\n\\r\\n\");\n  var LOOPBACK_READ_HIGH_WATER_BYTES = 1024 * 1024;\n  var LOOPBACK_STREAM_CHUNK_BYTES = 64 * 1024;\n  var ByteChunkQueue = class {\n    constructor(limitTotalBytes, overflowLabel) {\n      this.limitTotalBytes = limitTotalBytes;\n      this.overflowLabel = overflowLabel;\n    }\n    limitTotalBytes;\n    overflowLabel;\n    chunks = [];\n    headOffset = 0;\n    enqueuedTotalBytes = 0;\n    undrainedBytes = 0;\n    /** Bytes enqueued but not yet read. Drives flow control on streamed queues. */\n    get pendingBytes() {\n      return this.undrainedBytes;\n    }\n    enqueue(bytes) {\n      if (bytes.byteLength === 0) return;\n      if (this.enqueuedTotalBytes + bytes.byteLength > this.limitTotalBytes) {\n        throw new Error(\n          `Nimbus virtual socket: ${this.overflowLabel} exceeds ${this.limitTotalBytes} bytes`\n        );\n      }\n      this.enqueuedTotalBytes += bytes.byteLength;\n      this.undrainedBytes += bytes.byteLength;\n      this.chunks.push(bytes);\n    }\n    /** Drain up to maxBytes from the head chunk; empty result means no data is queued. */\n    readUpTo(maxBytes) {\n      const head = this.chunks[0];\n      if (!head) return EMPTY_BYTES;\n      const available = head.byteLength - this.headOffset;\n      const take = Math.min(available, Math.max(1, maxBytes));\n      const out = head.subarray(this.headOffset, this.headOffset + take);\n      this.headOffset += take;\n      this.undrainedBytes -= take;\n      if (this.headOffset >= head.byteLength) {\n        this.chunks.shift();\n        this.headOffset = 0;\n      }\n      return out;\n    }\n  };\n  var HttpMessageParser = class {\n    phase = \"headers\";\n    settled = null;\n    headerBuffer = EMPTY_BYTES;\n    headerScanOffset = 0;\n    headerPairs = [];\n    framing = \"none\";\n    expectedBodyBytes = 0;\n    bodyChunks = [];\n    bodyByteCount = 0;\n    chunkState = \"size\";\n    chunkSizeLine = [];\n    chunkDataRemaining = 0;\n    get outcome() {\n      return this.settled;\n    }\n    feed(chunk) {\n      if (this.phase === \"done\" || chunk.byteLength === 0) return;\n      if (this.phase === \"headers\") {\n        this.feedHeaders(chunk);\n        return;\n      }\n      this.feedBody(chunk);\n    }\n    /** EOF from the peer closing the connection (or the request being torn down). */\n    finish() {\n      if (this.phase === \"done\") return;\n      if (this.phase === \"headers\") {\n        this.fail(`connection closed before ${this.messageLabel} headers`);\n        return;\n      }\n      if (this.framing === \"until-close\") {\n        this.completeWithBody(concatBytes(this.bodyChunks));\n        return;\n      }\n      this.fail(`connection closed before the ${this.messageLabel} completed`);\n    }\n    feedHeaders(chunk) {\n      this.headerBuffer = concatBytes([this.headerBuffer, chunk]);\n      const headerEnd = this.findHeaderEnd();\n      if (headerEnd < 0) {\n        this.headerScanOffset = Math.max(0, this.headerBuffer.byteLength - 3);\n        return;\n      }\n      const parsed = this.parseHeaderBlock(this.headerBuffer.subarray(0, headerEnd));\n      const leftover = this.headerBuffer.subarray(headerEnd);\n      this.headerBuffer = EMPTY_BYTES;\n      if (!parsed) return;\n      if (!this.bodyAllowed()) {\n        this.completeWithBody(null);\n        return;\n      }\n      const transferEncoding = this.headerValue(\"Transfer-Encoding\");\n      if (transferEncoding !== null && /chunked/i.test(transferEncoding)) {\n        this.framing = \"chunked\";\n      } else {\n        const contentLength = this.headerValue(\"Content-Length\");\n        const expected = contentLength === null ? Number.NaN : parseInt(contentLength, 10);\n        if (Number.isFinite(expected) && expected >= 0) {\n          this.framing = \"content-length\";\n          this.expectedBodyBytes = expected;\n          if (expected === 0) {\n            this.completeWithBody(EMPTY_BYTES);\n            return;\n          }\n        } else {\n          this.framing = this.defaultFramingWhenUnframed();\n          if (this.framing === \"none\") {\n            this.completeWithBody(null);\n            return;\n          }\n        }\n      }\n      this.phase = \"body\";\n      this.feedBody(leftover);\n    }\n    feedBody(chunk) {\n      if (this.framing === \"chunked\") {\n        this.feedChunkedBody(chunk);\n        return;\n      }\n      if (chunk.byteLength === 0) return;\n      if (this.framing === \"content-length\") {\n        const needed = this.expectedBodyBytes - this.bodyByteCount;\n        this.appendBody(chunk.subarray(0, Math.min(needed, chunk.byteLength)));\n        if (this.bodyByteCount >= this.expectedBodyBytes) {\n          this.completeWithBody(concatBytes(this.bodyChunks));\n        }\n        return;\n      }\n      this.appendBody(chunk);\n    }\n    feedChunkedBody(chunk) {\n      let i = 0;\n      while (i < chunk.byteLength && this.phase === \"body\") {\n        if (this.chunkState === \"size\") {\n          const byte = chunk[i++];\n          if (byte === 10) {\n            const line = new TextDecoder().decode(Uint8Array.from(this.chunkSizeLine)).trim();\n            this.chunkSizeLine.length = 0;\n            const size = parseInt(line.split(\";\", 1)[0], 16);\n            if (!Number.isFinite(size) || size < 0) {\n              this.fail(\"malformed chunked transfer encoding\");\n              return;\n            }\n            if (size === 0) {\n              this.completeWithBody(concatBytes(this.bodyChunks));\n              return;\n            }\n            this.chunkState = \"data\";\n            this.chunkDataRemaining = size;\n          } else if (byte !== 13) {\n            this.chunkSizeLine.push(byte);\n          }\n        } else if (this.chunkState === \"data\") {\n          const take = Math.min(this.chunkDataRemaining, chunk.byteLength - i);\n          this.appendBody(chunk.subarray(i, i + take));\n          i += take;\n          this.chunkDataRemaining -= take;\n          if (this.chunkDataRemaining === 0) this.chunkState = \"data-end\";\n        } else {\n          const byte = chunk[i++];\n          if (byte === 10) {\n            this.chunkState = \"size\";\n          } else if (byte !== 13) {\n            this.fail(\"malformed chunked transfer encoding\");\n            return;\n          }\n        }\n      }\n    }\n    appendBody(bytes) {\n      if (bytes.byteLength === 0) return;\n      this.bodyChunks.push(bytes);\n      this.bodyByteCount += bytes.byteLength;\n    }\n    findHeaderEnd() {\n      const bytes = this.headerBuffer;\n      for (let i = this.headerScanOffset; i + 3 < bytes.byteLength; i++) {\n        if (bytes[i] === 13 && bytes[i + 1] === 10 && bytes[i + 2] === 13 && bytes[i + 3] === 10) {\n          return i + 4;\n        }\n      }\n      return -1;\n    }\n    /** Returns false when the start line is malformed (the parser has already failed). */\n    parseHeaderBlock(headerBytes) {\n      const headerText = new TextDecoder().decode(headerBytes);\n      const lines = headerText.replace(/\\r\\n/g, \"\\n\").split(\"\\n\").filter((line) => line.length > 0);\n      const startLine = lines.shift() ?? \"\";\n      if (!this.parseStartLine(startLine)) return false;\n      for (const line of lines) {\n        const separator = line.indexOf(\":\");\n        if (separator <= 0) continue;\n        this.headerPairs.push([line.slice(0, separator), line.slice(separator + 1).trimStart()]);\n      }\n      return true;\n    }\n    headerValue(name) {\n      const target = name.toLowerCase();\n      for (const [key, value] of this.headerPairs) {\n        if (key.toLowerCase() === target) return value;\n      }\n      return null;\n    }\n    completeWithBody(body) {\n      this.phase = \"done\";\n      this.settled = { kind: \"message\", message: this.buildMessage(body) };\n    }\n    fail(message) {\n      this.phase = \"done\";\n      this.settled = { kind: \"failed\", message };\n    }\n  };\n  var HttpResponseParser = class extends HttpMessageParser {\n    constructor(requestMethod) {\n      super();\n      this.requestMethod = requestMethod;\n    }\n    requestMethod;\n    status = 200;\n    statusText = \"\";\n    get messageLabel() {\n      return \"response\";\n    }\n    parseStartLine(line) {\n      const match = /^HTTP\\/\\d(?:\\.\\d)?\\s+(\\d{3})(?:\\s+(.*))?$/.exec(line || \"HTTP/1.1 200 OK\");\n      this.status = match ? parseInt(match[1], 10) : 200;\n      this.statusText = match?.[2] ?? \"\";\n      return true;\n    }\n    bodyAllowed() {\n      return responseCanHaveBody(this.requestMethod, this.status);\n    }\n    defaultFramingWhenUnframed() {\n      return \"until-close\";\n    }\n    buildMessage(body) {\n      return { status: this.status, statusText: this.statusText, headerPairs: this.headerPairs, body };\n    }\n  };\n  var HttpRequestParser = class extends HttpMessageParser {\n    method = \"GET\";\n    target = \"/\";\n    get messageLabel() {\n      return \"request\";\n    }\n    parseStartLine(line) {\n      const match = /^([A-Za-z]+)\\s+(\\S+)\\s+HTTP\\/\\d(?:\\.\\d)?$/.exec(line);\n      if (!match) {\n        this.fail(`malformed HTTP request line: ${JSON.stringify(line.slice(0, 120))}`);\n        return false;\n      }\n      this.method = match[1].toUpperCase();\n      this.target = match[2];\n      return true;\n    }\n    bodyAllowed() {\n      return true;\n    }\n    defaultFramingWhenUnframed() {\n      return \"none\";\n    }\n    buildMessage(body) {\n      return { method: this.method, target: this.target, headerPairs: this.headerPairs, body };\n    }\n  };\n  function errorResponse(status, message) {\n    return {\n      status,\n      statusText: \"\",\n      headerPairs: [[\"content-type\", \"text/plain; charset=utf-8\"]],\n      body: new TextEncoder().encode(`Nimbus virtual socket: ${message}`)\n    };\n  }\n  function toResponse(settled) {\n    const headers = new Headers();\n    for (const [key, value] of settled.headerPairs) headers.append(key, value);\n    return new Response(settled.body, {\n      status: settled.status,\n      statusText: settled.statusText,\n      headers\n    });\n  }\n  var VirtualConnection = class {\n    constructor(id, requestMethod, requestBytes, limits) {\n      this.id = id;\n      this.inbound = new ByteChunkQueue(requestBytes.byteLength, \"request buffer\");\n      this.inbound.enqueue(requestBytes);\n      this.outbound = new ByteChunkQueue(limits.maxResponseBufferBytes, \"response buffer\");\n      this.parser = new HttpResponseParser(requestMethod);\n    }\n    id;\n    /** Request bytes the guest server reads; filled in one shot in stage 1. */\n    inbound;\n    /** Response bytes the guest server writes; drained into the parser. */\n    outbound;\n    parser;\n    responseReady = new Deferred();\n    settled = false;\n    closed = false;\n    read(maxBytes) {\n      return Array.from(this.inbound.readUpTo(Math.max(1, maxBytes | 0)));\n    }\n    /** The whole request is buffered before the connection is accepted, so nothing is ever awaited. */\n    readAsync(maxBytes) {\n      return Promise.resolve(this.read(maxBytes));\n    }\n    readBytesAsync(maxBytes) {\n      return Promise.resolve(this.inbound.readUpTo(Math.max(1, maxBytes | 0)));\n    }\n    /** Same reason: an empty read on an accepted connection is always genuine EOF. */\n    atEof() {\n      return true;\n    }\n    write(bytesLike) {\n      const bytes = toBytes(bytesLike);\n      if (bytes.byteLength === 0 || this.settled || this.closed) return bytes.byteLength;\n      this.outbound.enqueue(bytes.slice());\n      this.pumpParser();\n      return bytes.byteLength;\n    }\n    /** EOF from the server side (or request teardown); completes until-close bodies. */\n    close() {\n      if (this.closed) return;\n      this.closed = true;\n      if (this.settled) return;\n      this.parser.finish();\n      this.pumpParser();\n    }\n    /** Abort propagation: settle the pending preview request with a terminal status. */\n    abort(message, status) {\n      this.closed = true;\n      this.settle(errorResponse(status, message));\n    }\n    async response(timeoutMs) {\n      const timer = setTimeout(() => {\n        this.settle(errorResponse(504, \"timed out waiting for response\"));\n      }, Math.max(1, timeoutMs));\n      try {\n        return toResponse(await this.responseReady.promise);\n      } finally {\n        clearTimeout(timer);\n      }\n    }\n    pumpParser() {\n      for (; ; ) {\n        const chunk = this.outbound.readUpTo(Number.MAX_SAFE_INTEGER);\n        if (chunk.byteLength === 0) break;\n        this.parser.feed(chunk);\n      }\n      const outcome = this.parser.outcome;\n      if (!outcome) return;\n      if (outcome.kind === \"failed\") {\n        this.settle(errorResponse(502, outcome.message));\n        return;\n      }\n      const { status, statusText, headerPairs, body } = outcome.message;\n      this.settle({\n        status,\n        statusText,\n        // The framing is consumed here; the Worker Response re-frames the body itself.\n        headerPairs: headerPairs.filter(([key]) => !/^transfer-encoding$/i.test(key)),\n        body\n      });\n    }\n    settle(response) {\n      if (this.settled) return;\n      this.settled = true;\n      this.responseReady.resolve(response);\n    }\n  };\n  var LoopbackClientConnection = class {\n    constructor(id, port, route, limits) {\n      this.id = id;\n      this.port = port;\n      this.route = route;\n      this.limits = limits;\n    }\n    id;\n    port;\n    route;\n    limits;\n    parser = new HttpRequestParser();\n    /** Response bytes the guest client reads. */\n    inbound = new ByteChunkQueue(Number.MAX_SAFE_INTEGER, \"loopback response buffer\");\n    readable = null;\n    drained = null;\n    dispatched = false;\n    eof = false;\n    closed = false;\n    write(bytesLike) {\n      const bytes = toBytes(bytesLike);\n      if (bytes.byteLength === 0 || this.closed) return bytes.byteLength;\n      if (this.dispatched) {\n        throw new Error(\n          `Nimbus loopback socket: port ${this.port} answered with \"Connection: close\"; open a new connection for the next request`\n        );\n      }\n      this.parser.feed(bytes.slice());\n      const outcome = this.parser.outcome;\n      if (!outcome) return bytes.byteLength;\n      this.dispatched = true;\n      if (outcome.kind === \"failed\") this.failWith(400, outcome.message);\n      else void this.dispatch(outcome.message);\n      return bytes.byteLength;\n    }\n    read(maxBytes) {\n      return Array.from(this.readBytes(maxBytes));\n    }\n    /** Byte-array read. The fd-backed path uses this so a stream never round-trips through number[]. */\n    readBytes(maxBytes) {\n      const out = this.inbound.readUpTo(Math.max(1, maxBytes | 0));\n      if (this.drained && this.inbound.pendingBytes <= LOOPBACK_READ_HIGH_WATER_BYTES) {\n        const waiter = this.drained;\n        this.drained = null;\n        waiter.resolve();\n      }\n      return out;\n    }\n    atEof() {\n      return (this.eof || this.closed) && this.inbound.pendingBytes === 0;\n    }\n    /** Blocks the guest until response bytes arrive; an empty result is EOF. */\n    async readAsync(maxBytes) {\n      return Array.from(await this.readBytesAsync(maxBytes));\n    }\n    async readBytesAsync(maxBytes) {\n      for (; ; ) {\n        const chunk = this.readBytes(maxBytes);\n        if (chunk.byteLength > 0) return chunk;\n        if (this.eof || this.closed) return EMPTY_BYTES;\n        if (!this.dispatched) {\n          throw new Error(\n            \"Nimbus loopback socket: read before a complete HTTP request was written (loopback sockets carry HTTP requests, not arbitrary byte streams)\"\n          );\n        }\n        this.readable ??= new Deferred();\n        await this.readable.promise;\n      }\n    }\n    close() {\n      if (this.closed) return;\n      this.closed = true;\n      this.wakeReader();\n      if (this.drained) {\n        const waiter = this.drained;\n        this.drained = null;\n        waiter.resolve();\n      }\n    }\n    async dispatch(parsed) {\n      let request;\n      try {\n        request = this.buildRequest(parsed);\n      } catch (error) {\n        this.failWith(400, describeError(error));\n        return;\n      }\n      let response;\n      try {\n        response = await this.withTimeout(this.route(this.port, request));\n      } catch (error) {\n        this.failWith(502, describeError(error));\n        return;\n      }\n      await this.streamResponse(request.method, response);\n    }\n    buildRequest(parsed) {\n      const headers = new Headers();\n      let authority = `127.0.0.1:${this.port}`;\n      for (const [key, value] of parsed.headerPairs) {\n        if (/^host$/i.test(key)) {\n          authority = value;\n          continue;\n        }\n        if (/^(transfer-encoding|connection|content-length|keep-alive)$/i.test(key)) continue;\n        headers.append(key, value);\n      }\n      const target = parsed.target.startsWith(\"/\") ? parsed.target : `/${parsed.target}`;\n      const url = /^https?:\\/\\//i.test(parsed.target) ? parsed.target : `http://${authority}${target}`;\n      const body = parsed.body && parsed.body.byteLength > 0 ? parsed.body : null;\n      const methodTakesBody = parsed.method !== \"GET\" && parsed.method !== \"HEAD\";\n      return new Request(url, {\n        method: parsed.method,\n        headers,\n        body: methodTakesBody ? body : null\n      });\n    }\n    async streamResponse(method, response) {\n      const withBody = responseCanHaveBody(method, response.status) && response.body !== null;\n      const headers = new Headers(response.headers);\n      for (const hopByHop of [\"transfer-encoding\", \"content-length\", \"connection\", \"keep-alive\"]) {\n        headers.delete(hopByHop);\n      }\n      this.pushBytes(encodeHttpResponseHead(response.status, response.statusText, headers, withBody));\n      if (!withBody || !response.body) {\n        this.finishStream();\n        return;\n      }\n      const reader = response.body.getReader();\n      try {\n        for (; ; ) {\n          const { value, done } = await reader.read();\n          if (done) break;\n          if (this.closed) return;\n          const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);\n          if (bytes.byteLength === 0) continue;\n          this.pushBytes(encodeChunkedFrame(bytes));\n          await this.awaitDrain();\n        }\n        this.pushBytes(CHUNKED_TERMINATOR);\n      } catch {\n      } finally {\n        try {\n          await reader.cancel();\n        } catch {\n        }\n        this.finishStream();\n      }\n    }\n    /** Synthesize a complete response so the guest sees an HTTP error, never a hang. */\n    failWith(status, detail) {\n      const body = new TextEncoder().encode(`Nimbus loopback socket: ${detail}`);\n      const headers = new Headers({\n        \"content-type\": \"text/plain; charset=utf-8\",\n        \"content-length\": String(body.byteLength)\n      });\n      this.pushBytes(encodeHttpResponseHead(status, \"\", headers, false));\n      this.pushBytes(body);\n      this.finishStream();\n    }\n    pushBytes(bytes) {\n      if (this.closed) return;\n      this.inbound.enqueue(bytes);\n      this.wakeReader();\n    }\n    finishStream() {\n      this.eof = true;\n      this.wakeReader();\n    }\n    wakeReader() {\n      const waiter = this.readable;\n      if (!waiter) return;\n      this.readable = null;\n      waiter.resolve();\n    }\n    /** Pause the body pump while the guest is behind, so a big stream cannot grow unbounded. */\n    awaitDrain() {\n      if (this.inbound.pendingBytes <= LOOPBACK_READ_HIGH_WATER_BYTES) return Promise.resolve();\n      this.drained ??= new Deferred();\n      return this.drained.promise;\n    }\n    withTimeout(promise) {\n      let timer = null;\n      const timeout = new Promise((_resolve, reject) => {\n        timer = setTimeout(\n          () => reject(new Error(`port ${this.port} did not respond within ${this.limits.responseTimeoutMs}ms`)),\n          Math.max(1, this.limits.responseTimeoutMs)\n        );\n      });\n      return Promise.race([promise, timeout]).finally(() => {\n        if (timer !== null) clearTimeout(timer);\n      });\n    }\n  };\n  function describeError(error) {\n    return error instanceof Error ? error.message : String(error);\n  }\n  function socketStreamFor(conn) {\n    return {\n      // Neither direction has a handshake: an accepted connection already holds\n      // the request, and a dialed one starts its exchange on the first write.\n      opened: Promise.resolve(),\n      readable: new ReadableStream(\n        {\n          async pull(controller) {\n            const bytes = await conn.readBytesAsync(LOOPBACK_STREAM_CHUNK_BYTES);\n            if (bytes.byteLength === 0) controller.close();\n            else controller.enqueue(bytes);\n          },\n          cancel() {\n            conn.close();\n          }\n        },\n        // highWaterMark 0 so the stream never pulls speculatively. A default\n        // strategy pulls once at construction, which on a client connection\n        // means reading before the guest has written its request.\n        { highWaterMark: 0 }\n      ),\n      writable: new WritableStream({\n        write(chunk) {\n          conn.write(chunk);\n        },\n        abort() {\n          conn.close();\n        }\n      }),\n      close() {\n        conn.close();\n        return Promise.resolve();\n      }\n    };\n  }\n  var VirtualListener = class {\n    constructor(port) {\n      this.port = port;\n    }\n    port;\n    queue = [];\n    acceptWaiters = [];\n    push(conn) {\n      const waiter = this.acceptWaiters.shift();\n      if (waiter) waiter.resolve(conn);\n      else this.queue.push(conn);\n    }\n    accept() {\n      const queued = this.queue.shift();\n      if (queued) return Promise.resolve(queued);\n      const waiter = new Deferred();\n      this.acceptWaiters.push(waiter);\n      return waiter.promise;\n    }\n    take() {\n      return this.queue.shift() ?? null;\n    }\n    pending() {\n      return this.queue.length;\n    }\n    drainQueued() {\n      return this.queue.splice(0);\n    }\n    rejectPendingAccepts(error) {\n      for (const waiter of this.acceptWaiters.splice(0)) waiter.reject(error);\n    }\n  };\n  var VirtualSocketKernel = class {\n    constructor(host, limits) {\n      this.host = host;\n      this.limits = { ...DEFAULT_LIMITS, ...limits };\n    }\n    host;\n    /** Public: runner glue inspects listeners.keys() for the default preview port. */\n    listeners = /* @__PURE__ */ new Map();\n    connections = /* @__PURE__ */ new Map();\n    limits;\n    nextConnectionId = 1;\n    nextEphemeralPort = 49152;\n    listenWaiters = [];\n    readableWaiters = /* @__PURE__ */ new Set();\n    listen(port) {\n      let n = Number(port);\n      if (!Number.isInteger(n) || n < 0 || n >= 65536) throw new Error(`invalid port: ${port}`);\n      if (n === 0) {\n        while (this.listeners.has(this.nextEphemeralPort)) {\n          this.nextEphemeralPort++;\n          if (this.nextEphemeralPort >= 65535) this.nextEphemeralPort = 49152;\n        }\n        n = this.nextEphemeralPort++;\n        if (this.nextEphemeralPort >= 65535) this.nextEphemeralPort = 49152;\n      }\n      if (!this.listeners.has(n)) {\n        this.listeners.set(n, new VirtualListener(n));\n        try {\n          this.host.__nimbusVirtualSocketDidListen?.(n);\n        } catch {\n        }\n        for (const waiter of this.listenWaiters.splice(0)) waiter.resolve(n);\n      }\n      return n;\n    }\n    closeListener(port) {\n      const n = Number(port);\n      const listener = this.listeners.get(n);\n      if (!listener) return;\n      this.listeners.delete(n);\n      for (const conn of listener.drainQueued()) {\n        this.connections.delete(conn.id);\n        conn.abort(`listener closed on port ${n}`, 502);\n      }\n      listener.rejectPendingAccepts(new Error(`port is not listening: ${n}`));\n    }\n    async accept(port) {\n      const listener = this.listeners.get(Number(port));\n      if (!listener) throw new Error(`port is not listening: ${port}`);\n      const conn = await listener.accept();\n      return { id: conn.id, host: \"127.0.0.1\", port: 0 };\n    }\n    acceptNow(port) {\n      const listener = this.listeners.get(Number(port));\n      if (!listener) throw new Error(`port is not listening: ${port}`);\n      const conn = listener.take();\n      return conn ? { id: conn.id, host: \"127.0.0.1\", port: 0 } : null;\n    }\n    /**\n     * Open a client connection to `port` on the session's loopback.\n     *\n     * The returned id is an ordinary connection id: send() writes the\n     * request, recv()/recvAsync() read the response, close() releases it.\n     * Only HTTP/1.1 crosses a loopback connection - see\n     * LoopbackClientConnection for why - and each one carries a single\n     * request/response exchange.\n     */\n    connect(port) {\n      const conn = this.openLoopbackClient(port);\n      this.connections.set(conn.id, conn);\n      return conn.id;\n    }\n    /**\n     * The same client connection as `connect`, handed back in Cloudflare's\n     * `Socket` shape.\n     *\n     * Guests whose sockets are real WASI file descriptors (ruby.wasm, and any\n     * future wasm32-wasi program) reach loopback through this: the WASI shim\n     * stores it in exactly the fd slot a `cloudflare:sockets` connection would\n     * occupy, so `fd_read` on an in-session port is the same suspending read as\n     * `fd_read` on a remote host.\n     */\n    connectStream(port) {\n      return socketStreamFor(this.openLoopbackClient(port));\n    }\n    /**\n     * An already-accepted connection in the same `Socket` shape, so a server's\n     * accepted socket is the same kind of file descriptor as a client's dialed\n     * one. `accept`/`acceptNow` still hand out the connection id, because accept\n     * itself stays on the cooperative pump - this only binds the result.\n     */\n    streamFor(id) {\n      const conn = this.connections.get(Number(id));\n      if (!conn) throw new Error(`connection is closed: ${id}`);\n      return socketStreamFor(conn);\n    }\n    openLoopbackClient(port) {\n      const n = Number(port);\n      if (!Number.isInteger(n) || n <= 0 || n >= 65536) throw new Error(`invalid port: ${port}`);\n      const route = this.host.__nimbusVirtualSocketRouteLoopback;\n      if (typeof route !== \"function\") {\n        throw new Error(\"Nimbus loopback sockets are unavailable in this runtime\");\n      }\n      return new LoopbackClientConnection(this.nextConnectionId++, n, route, this.limits);\n    }\n    /** Plain number array: Pyodide bytes() and the ruby.wasm base64 bridge both consume it. */\n    recv(id, maxBytes) {\n      const conn = this.connections.get(Number(id));\n      if (!conn) return [];\n      return conn.read(Number(maxBytes));\n    }\n    /**\n     * Suspending read. A client connection has nothing to hand back until\n     * the loopback response arrives, so guests that can suspend (Pyodide\n     * `run_sync`, a JSPI-suspending WASI call) await this instead of\n     * spinning on recv(). An empty result is EOF.\n     */\n    async recvAsync(id, maxBytes) {\n      const conn = this.connections.get(Number(id));\n      if (!conn) return [];\n      return conn.readAsync(Number(maxBytes));\n    }\n    /**\n     * Whether an empty recv() means end-of-response rather than \"not yet\".\n     * Guests that poll instead of suspending (ruby.wasm, whose JS bridge is\n     * synchronous) need the two apart to avoid truncating a response.\n     */\n    atEof(id) {\n      const conn = this.connections.get(Number(id));\n      return conn ? conn.atEof() : true;\n    }\n    send(id, bytesLike) {\n      const conn = this.connections.get(Number(id));\n      if (!conn) throw new Error(`connection is closed: ${id}`);\n      return conn.write(bytesLike);\n    }\n    close(id) {\n      const conn = this.connections.get(Number(id));\n      if (!conn) return;\n      conn.close();\n      this.connections.delete(Number(id));\n    }\n    pending(port) {\n      return this.listeners.get(Number(port))?.pending() ?? 0;\n    }\n    firstListeningPort() {\n      for (const port of this.listeners.keys()) return port;\n      return null;\n    }\n    /** select()-style readiness: resolves ports with queued connections, [] on timeout. */\n    waitReadable(ports, timeoutSeconds) {\n      const normalized = (Array.isArray(ports) ? ports : []).map((p) => Number(p)).filter((p) => Number.isInteger(p));\n      const readyNow = normalized.filter((port) => this.pending(port) > 0);\n      if (readyNow.length > 0) return Promise.resolve(readyNow);\n      const timeoutMs = timeoutSeconds == null ? this.limits.responseTimeoutMs : Math.max(0, Number(timeoutSeconds) * 1e3);\n      const deferred = new Deferred();\n      const waiter = {\n        ports: normalized,\n        deferred,\n        timer: setTimeout(() => {\n          this.readableWaiters.delete(waiter);\n          deferred.resolve([]);\n        }, timeoutMs)\n      };\n      this.readableWaiters.add(waiter);\n      return deferred.promise;\n    }\n    async waitForListen(timeoutMs) {\n      const existing = this.firstListeningPort();\n      if (existing) return existing;\n      const waiter = new Deferred();\n      this.listenWaiters.push(waiter);\n      let timer = null;\n      const timeout = new Promise((resolve) => {\n        timer = setTimeout(() => resolve(null), Math.max(1, timeoutMs ?? 5e3));\n      });\n      try {\n        return await Promise.race([waiter.promise, timeout]);\n      } finally {\n        if (timer !== null) clearTimeout(timer);\n      }\n    }\n    async handleHttpRequest(port, request) {\n      const n = Number(port);\n      let listener = this.listeners.get(n);\n      if (!listener) {\n        try {\n          await this.host.__nimbusVirtualSocketEnsureListener?.(n);\n        } catch {\n        }\n        listener = this.listeners.get(n);\n      }\n      if (!listener) {\n        return new Response(`Nimbus virtual socket: no listener on port ${port}`, { status: 502 });\n      }\n      const body = request.method === \"GET\" || request.method === \"HEAD\" ? EMPTY_BYTES : new Uint8Array(await request.arrayBuffer());\n      if (body.byteLength > this.limits.maxRequestBodyBytes) {\n        return new Response(\n          `Nimbus virtual socket: request body exceeds ${this.limits.maxRequestBodyBytes} bytes`,\n          { status: 413 }\n        );\n      }\n      const id = this.nextConnectionId++;\n      const conn = new VirtualConnection(id, request.method, encodeHttpRequest(request, body), this.limits);\n      this.connections.set(id, conn);\n      listener.push(conn);\n      this.notifyReadable(n);\n      const signal = request.signal;\n      const onAbort = () => conn.abort(\"client aborted the request\", 499);\n      if (signal?.aborted) onAbort();\n      else signal?.addEventListener(\"abort\", onAbort);\n      try {\n        try {\n          const accepted = await this.host.__nimbusVirtualSocketRequestQueued?.(n);\n          if (accepted === false) {\n            const detail = typeof this.host.__nimbusVirtualSocketLastError === \"string\" ? this.host.__nimbusVirtualSocketLastError.trim() : \"\";\n            const suffix = detail ? `: ${detail}` : \"\";\n            return new Response(\n              `Nimbus virtual socket: runtime handler did not accept the request${suffix}`,\n              { status: 502 }\n            );\n          }\n        } catch {\n        }\n        return await conn.response(this.limits.responseTimeoutMs);\n      } finally {\n        signal?.removeEventListener(\"abort\", onAbort);\n        conn.close();\n        this.connections.delete(id);\n      }\n    }\n    notifyReadable(port) {\n      for (const waiter of Array.from(this.readableWaiters)) {\n        if (!waiter.ports.includes(port)) continue;\n        const ready = waiter.ports.filter((p) => this.pending(p) > 0);\n        if (ready.length === 0) continue;\n        clearTimeout(waiter.timer);\n        this.readableWaiters.delete(waiter);\n        waiter.deferred.resolve(ready);\n      }\n    }\n  };\n  function installVirtualSocketKernel(scope = globalThis) {\n    if (!scope.__nimbusVirtualSockets) {\n      scope.__nimbusVirtualSockets = new VirtualSocketKernel(scope);\n    }\n    return scope.__nimbusVirtualSockets;\n  }\n\n  // <stdin>\n  installVirtualSocketKernel();\n})();\n";

package/src/runtime/virtual-socket-kernel.ts

@@ -191,7 +191,9 @@ function encodeHttpRequest(request: Request, body: Uint8Array): Uint8Array {
     headers.set('Content-Length', String(body.byteLength));
   }
   const lines = [`${request.method} ${path} HTTP/1.1`];
-  headers.forEach((value, key) => lines.push(`${key}: ${value}`));
+  headers.forEach((value, key) => {
+    lines.push(`${key}: ${value}`);
+  });
   lines.push('', '');
   return concatBytes([new TextEncoder().encode(lines.join('\r\n')), body]);
 }
@@ -213,7 +215,9 @@ function encodeHttpResponseHead(
   chunkedBody: boolean,
 ): Uint8Array {
   const lines = [`HTTP/1.1 ${status} ${statusText}`];
-  headers.forEach((value, key) => lines.push(`${key}: ${value}`));
+  headers.forEach((value, key) => {
+    lines.push(`${key}: ${value}`);
+  });
   if (chunkedBody) lines.push('Transfer-Encoding: chunked');
   lines.push('Connection: close');
   lines.push('', '');
@@ -839,8 +843,8 @@ class LoopbackClientConnection implements VirtualSocketConnection {
             '(loopback sockets carry HTTP requests, not arbitrary byte streams)',
         );
       }
-      const waiter = (this.readable ??= new Deferred<void>());
-      await waiter.promise;
+      this.readable ??= new Deferred<void>();
+      await this.readable.promise;
     }
   }
 
@@ -963,7 +967,8 @@ class LoopbackClientConnection implements VirtualSocketConnection {
   /** Pause the body pump while the guest is behind, so a big stream cannot grow unbounded. */
   private awaitDrain(): Promise<void> {
     if (this.inbound.pendingBytes <= LOOPBACK_READ_HIGH_WATER_BYTES) return Promise.resolve();
-    return (this.drained ??= new Deferred<void>()).promise;
+    this.drained ??= new Deferred<void>();
+    return this.drained.promise;
   }
 
   private withTimeout(promise: Promise<Response>): Promise<Response> {

package/src/runtime/wasm-runner.ts

@@ -57,6 +57,7 @@ import type { WasiInitOptions, WasiInstanceBundle, WasiMakeImportsOptions } from
 import type { WasiAbi } from './wasi-instance.js';
 import { inspectWasmThreads, wasiThreadsLoadError } from './wasi-threads.js';
 import { withMemoryLimit, DEFAULT_WASM_PROCESS_LIMIT_BYTES } from './wasm-memory.js';
+import { errorText } from '../_shared/error-text.js';
 
 // ── facet-side globals injected by the WASI preamble ─────────────────
 // The preamble (WASI_INSTANCE_PREAMBLE_SRC) runs at facet module-init
@@ -365,6 +366,22 @@ export function makeWasmRunner(deps: {
         dirsDeleted: string[];
       };
     };
+    /**
+     * What `WebAssembly.instantiate` resolves to: the instance for a compiled
+     * module, `{ instance, module }` for bytes. The engine's own types describe
+     * only the first, which is what the facet host's table holds — the second
+     * is named because the checks below are what keep a table filled with
+     * anything else from yielding an instance-less object.
+     */
+    type WasmInstantiateResult =
+      | WebAssembly.Instance
+      | { instance: WebAssembly.Instance; module: WebAssembly.Module };
+    /**
+     * A direct-mode export: integer args in, one scalar — or nothing — out.
+     * `WebAssembly.Exports` types every export as a bare `Function`, which
+     * carries no signature of its own.
+     */
+    type WasmDirectExport = (...args: number[]) => number | bigint | undefined;
     const facetFn = async function wasmFacetCall(
       args: {
         mode: 'direct' | 'wasi';
@@ -405,7 +422,14 @@ export function makeWasmRunner(deps: {
       },
       facetEnv?: { SUPERVISOR?: unknown },
     ): Promise<WasmCallResult> {
-      const wasmTable = (globalThis as any).__NIMBUS_WASM || {};
+      // This body is serialized into the facet isolate, where the supervisor's
+      // module graph — and so _shared/error-text.js — does not exist. Same
+      // fallback as errorText, spelled out locally.
+      const errText = (err: unknown): string =>
+        typeof err === 'object' && err !== null && 'message' in err && err.message
+          ? String(err.message)
+          : String(err);
+      const wasmTable = globalThis.__NIMBUS_WASM || {};
       const mod = wasmTable['user.wasm'];
       if (!mod) {
         return {
@@ -516,7 +540,7 @@ export function makeWasmRunner(deps: {
               maximum: args.threads.memory.maximum,
               shared: true,
             });
-          } catch (e: any) {
+          } catch (e) {
             // A shared memory reserves its MAXIMUM up front, so an over-large
             // --max-memory fails here rather than when the program grows into
             // it. Say which number did it; the alternative message is a bare
@@ -527,7 +551,7 @@ export function makeWasmRunner(deps: {
               error:
                 `wasi-threads: could not reserve the shared memory the module declares `
                 + `(${args.threads.memory.initial}–${args.threads.memory.maximum} pages, `
-                + `${(args.threads.memory.maximum * 64) / 1024} MiB): ${e?.message || e}. `
+                + `${(args.threads.memory.maximum * 64) / 1024} MiB): ${errText(e)}. `
                 + 'A shared memory reserves its maximum immediately — lower --max-memory.',
             };
           }
@@ -538,22 +562,25 @@ export function makeWasmRunner(deps: {
           };
           sched = __wasiThreadsCreate({
             memory: shared,
-            startThread: __wasiThreadsStarter(mod as WebAssembly.Module, importObject),
+            startThread: __wasiThreadsStarter(mod, importObject),
           });
           Object.assign(importObject, sched.hostImports());
         }
         let inst: WebAssembly.Instance;
         try {
-          const result: any = await WebAssembly.instantiate(mod as any, importObject);
+          const result = await WebAssembly.instantiate(mod, importObject) as WasmInstantiateResult;
           inst = (result instanceof WebAssembly.Instance ? result : result.instance);
-        } catch (e: any) {
+        } catch (e) {
           return {
             ok: false,
             mode: 'wasi',
-            error: `instantiate failed: ${e?.message || e}`,
+            error: `instantiate failed: ${errText(e)}`,
           };
         }
-        if (!memRef.mem) memRef.mem = (inst.exports as any).memory as WebAssembly.Memory;
+        if (!memRef.mem) {
+          const exported = inst.exports.memory;
+          if (exported instanceof WebAssembly.Memory) memRef.mem = exported;
+        }
         if (!memRef.mem) {
           return {
             ok: false,
@@ -593,17 +620,17 @@ export function makeWasmRunner(deps: {
         // Single-arg instantiate against a precompiled Module — this
         // is the form workerd's CSP DOES allow. The dynamic-bytes
         // form (instantiate(ArrayBuffer)) is what's blocked.
-        const result: any = await WebAssembly.instantiate(mod as any, {});
+        const result = await WebAssembly.instantiate(mod, {}) as WasmInstantiateResult;
         inst = (result instanceof WebAssembly.Instance ? result : result.instance);
-      } catch (e: any) {
+      } catch (e) {
         return {
           ok: false,
           mode: 'direct',
-          error: `instantiate failed: ${e?.message || e}`,
+          error: `instantiate failed: ${errText(e)}`,
         };
       }
       const exportNames = Object.keys(inst.exports);
-      const fn = (inst.exports as any)[args.exportName!];
+      const fn = inst.exports[args.exportName!];
       if (typeof fn !== 'function') {
         return {
           ok: false,
@@ -614,16 +641,16 @@ export function makeWasmRunner(deps: {
             `Available exports: ${exportNames.join(', ')}`,
         };
       }
-      let out: any;
+      let out: number | bigint | undefined;
       try {
-        out = fn(...(args.intArgs || []));
-      } catch (e: any) {
+        out = (fn as WasmDirectExport)(...(args.intArgs || []));
+      } catch (e) {
         return {
           ok: false,
           mode: 'direct',
           exports: exportNames,
           error:
-            `${args.exportName}(${(args.intArgs||[]).join(', ')}) threw: ${e?.message || e}`,
+            `${args.exportName}(${(args.intArgs||[]).join(', ')}) threw: ${errText(e)}`,
         };
       }
       // BigInt (i64) → string; everything else → as-is.
@@ -688,10 +715,11 @@ export function makeWasmRunner(deps: {
       wasiFsFiles = seed.files;
     }
 
-    type DispatchOutcome =
-      | { ok: true; mode: 'direct'; result?: number | string; exports?: string[] }
-      | { ok: true; mode: 'wasi'; stdout?: string; stderr?: string; exitCode?: number; exports?: string[]; error?: string }
-      | { ok: false; mode?: 'direct' | 'wasi'; error: string };
+    /**
+     * What the facet call resolved to, or the supervisor-side dispatch failure
+     * that never reached it — and so names no mode.
+     */
+    type DispatchOutcome = WasmCallResult | { ok: false; mode?: undefined; error: string };
 
     let outcome: DispatchOutcome;
     let facet: Facet | null = null;
@@ -737,8 +765,8 @@ export function makeWasmRunner(deps: {
           timeoutMs: 30_000,
         },
       )) as DispatchOutcome;
-    } catch (e: any) {
-      outcome = { ok: false, error: `dispatch failed: ${e?.message || e}` };
+    } catch (e) {
+      outcome = { ok: false, error: `dispatch failed: ${errorText(e)}` };
     } finally {
       facet?.dispose();
     }
@@ -757,15 +785,13 @@ export function makeWasmRunner(deps: {
       // If runStart reported an `error` (wasm trapped, _start missing,
       // …), append it to stderr but still surface its exitCode (default
       // 1 from runStart on trap) so callers can distinguish.
-      const wasiOut = outcome as Extract<DispatchOutcome, { mode: 'wasi' }> | (DispatchOutcome & { mode: 'wasi' });
-      // Either branch carries optional stdout/stderr/exitCode/error.
-      stdout = (wasiOut as any).stdout || '';
-      stderr = (wasiOut as any).stderr || '';
-      if ((wasiOut as any).error) {
+      stdout = outcome.stdout || '';
+      stderr = outcome.stderr || '';
+      if (outcome.error) {
         stderr = (stderr ? stderr : '') +
-          `wasm-runner: wasi trap: ${(wasiOut as any).error}\n`;
+          `wasm-runner: wasi trap: ${outcome.error}\n`;
       }
-      exitCode = (wasiOut as any).exitCode ?? ((wasiOut as any).ok ? 0 : 1);
+      exitCode = outcome.exitCode ?? (outcome.ok ? 0 : 1);
     } else if (!outcome.ok) {
       // Direct-mode failure or pre-instantiate dispatch failure — shell
       // sees rc=1 + stderr.

package/src/shell/features.ts

@@ -158,7 +158,7 @@ export class HeredocHandler {
         return;
       }
 
-      return this._handleOriginalInput(data);
+      this._handleOriginalInput(data);
     };
 
     this.shell.executeLine = async (line: string): Promise<void> => {
@@ -185,7 +185,7 @@ export class HeredocHandler {
         this._accumulateLine('');
         return;
       }
-      return this._printPrompt();
+      this._printPrompt();
     };
   }
 
@@ -414,7 +414,8 @@ export class LineEditorExtender {
       // shell-prompt input. Process-stdin input has its own model
       // (terminalStdin / stdinLineBuffer) handled by the shell.
       if (this.shell.running) {
-        return this.originalHandleInput!(data);
+        this.originalHandleInput!(data);
+        return;
       }
 
       // Reverse-i-search sub-mode owns ALL input until exited.
@@ -432,7 +433,7 @@ export class LineEditorExtender {
       // Try each binding. First-match wins; on no match fall through.
       if (this._handleBinding(data)) return;
 
-      return this.originalHandleInput!(data);
+      this.originalHandleInput!(data);
     };
   }