@nimbus-sh/core 0.5.0 → 0.7.0

package/README.md

@@ -5,16 +5,23 @@
 > presented as-is.
 
 The backend-agnostic half of Nimbus: a durable POSIX-like filesystem, a shell
-with 60+ Unix commands, and the WASI runtime layer — with no Cloudflare
-dependency. You hand it a SQLite and get back `.fs` and `.exec`. On
-Cloudflare that SQLite is `ctx.storage.sql` inside your Durable Object; in bun
-or node it is `bun:sqlite` or `node:sqlite`.
+with 60+ Unix commands, and the WASI runtime layer. It has no Cloudflare
+dependency.
 
-I extracted this package because I kept wanting Nimbus *inside* other
-projects — a Durable Object that already does something else but needs a real
-workspace, or a local script that needs the same filesystem semantics the
-hosted product has. The whole of it runs on two narrow ports (`SqlDatabase`
-and `SqlTransactions`), so the same code serves both hosts.
+You hand it a SQLite and get back `.fs` and `.exec`. On Cloudflare that
+SQLite is `ctx.storage.sql` inside your Durable Object; in bun or node it is
+`bun:sqlite` or `node:sqlite`. The whole package rests on two narrow ports
+(`SqlDatabase` and `SqlTransactions`), so the same code serves both hosts.
+
+Use it when something you already run needs a real workspace. A Durable
+Object that does something else and needs somewhere to work. A local script
+that needs the filesystem semantics the hosted product has.
+
+## Install
+
+```bash
+npm install @nimbus-sh/core
+```
 
 ## Quick start
 
@@ -73,13 +80,13 @@ export class Workspace extends DurableObject {
 ```
 
 Files written through `.fs` are owned by the session user (uid 1000), not
-root, and the shell enforces the same permission model either way: a
-root-owned `/etc/passwd` refuses a write from `.fs`, and `id` resolves names
-through it.
+root. The shell enforces the same permission model either way: a root-owned
+`/etc/passwd` refuses a write from `.fs`, and `id` resolves names through
+it.
 
 ## Real runtimes, off Cloudflare
 
-The wasm runtimes are separate npm packages so nobody downloads a Python
+The wasm runtimes are separate npm packages, so nobody downloads a Python
 interpreter to get a filesystem. Install the ones you want and pass them in:
 
 ```bash
@@ -104,35 +111,49 @@ await ws.exec(`python -c "import sqlite3; print('live')"`);  // CPython 3.13, re
 `@nimbus-sh/runtime-ruby` (Ruby 3.3) and `@nimbus-sh/runtime-clang` (clang →
 `wasm32-wasi`, compile and run C in the workspace) work the same way. Every
 package carries the same manifest and the same sha256-verified blobs the
-hosted product serves from R2 — one publisher, two transports.
+hosted product serves from R2.
+
+Without `facets` and `runtimes` you still get the full shell and coreutils.
+The wasm runtimes are a dependency you add.
 
-Without `facets` and `runtimes` you still get the full shell and coreutils;
-the wasm runtimes are a dependency you add, not a mode you enable. One caveat:
-`localFacetHost()` covers bun and node only — on workerd the CSP forbids
+`localFacetHost()` covers bun and node only. On workerd the CSP forbids
 request-time `WebAssembly.instantiate`, so wasm has to ride the Worker Loader
-module map, which is the machinery in `@nimbus-sh/worker` and
-`@nimbus-sh/fabric`; the shell, coreutils, and filesystem need none of it.
+module map. That machinery lives in `@nimbus-sh/worker` and
+`@nimbus-sh/fabric`. The shell, coreutils, and filesystem need none of it.
 
 ## Sharing a database with your own app
 
-The workspace is designed to be a tenant in a database you own, not the owner
-of it:
+The workspace is a tenant in a database you own:
 
 - It creates and touches only its own tables (`inodes`, `file_chunks`,
   `content_lifecycle`, `vfs_*`).
-- `destroy()` drops exactly those tables. It never calls `deleteAll()`.
+- `destroy()` drops those tables and does not call `deleteAll()`.
 - `transactionSync` must be a real transaction. An implementation that only
   calls the callback turns every atomic write into a torn one.
-- `generation` must never repeat across restarts of your host — pids derive
+- `generation` must never repeat across restarts of your host. Pids derive
   from it, and a repeated generation would hand a dead process live write
   authority.
 
-## What needs the Worker package instead
+When your own SQL rows must commit with filesystem bytes, use
+`SqliteVFS.withTransaction(callback)` instead of an outer
+`storage.transactionSync`. Use the credentialed synchronous VFS methods inside
+the callback, not the workspace's asynchronous file methods. The callback can
+read its writes; revisions and watch events publish only after commit. On
+rollback, Nimbus clears cached chunks and reloads the always-resident inode
+tree from SQLite before rethrowing with the original error as `cause`.
+
+The method must own the outermost transaction on the same SQL host. Do not
+nest it or start asynchronous work inside it. The host's transaction primitive
+must support nested savepoints for individual VFS writes. If rollback reload
+also fails, Nimbus throws an `AggregateError` carrying both failures; discard
+that VFS instance and reopen it after storage recovers.
+
+## What the worker package adds
 
 Resident processes (long-running servers, attached TUIs), the session
 protocol, port routing to the public internet, and the hosted terminal all
-live in [`@nimbus-sh/worker`](https://www.npmjs.com/package/@nimbus-sh/worker),
-which composes on this package. If you want the full hosted product shape,
+live in [`@nimbus-sh/worker`](https://www.npmjs.com/package/@nimbus-sh/worker).
+That package composes on this one. If you want the full hosted product shape,
 start from `npx create-nimbus-app`.
 
 ## License

package/dist/_shared/byte-stream.d.ts

@@ -17,10 +17,11 @@
 /**
  * A command's output destination.
  *
- * `writeBytes` is present on sinks that store bytes verbatim (files). Sinks
- * that are inherently textual — the terminal, shell pipes — omit it and
- * receive decoded text instead. This is a real capability difference, not a
- * fallback: a terminal has no way to hold a byte that is not text.
+ * `writeBytes` is present on sinks that store bytes verbatim — files,
+ * `/dev/null`, and shell pipes, which carry the producer's exact bytes.
+ * Sinks without it take decoded text instead. This is a real capability
+ * difference, not a fallback: a terminal has no way to hold a byte that is
+ * not text.
  */
 export interface ByteSink {
     write(text: string): void;

package/dist/_shared/byte-stream.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"byte-stream.d.ts","sourceRoot":"","sources":["../../src/_shared/byte-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CACtC;AAED,2EAA2E;AAC3E,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AAEzE,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,QAAY,CAAC;AAE5C;;;;GAIG;AACH,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,OAAO,CAAK;gBAES,IAAI,EAAE,QAAQ;IAI3C,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAO9B,GAAG,IAAI,IAAI;CAKZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GACvE,MAAM,CAkBR"}
+{"version":3,"file":"byte-stream.d.ts","sourceRoot":"","sources":["../../src/_shared/byte-stream.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CACtC;AAED,2EAA2E;AAC3E,MAAM,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AAEzE,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,QAAY,CAAC;AAE5C;;;;GAIG;AACH,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,OAAO,CAAK;gBAES,IAAI,EAAE,QAAQ;IAI3C,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAO9B,GAAG,IAAI,IAAI;CAKZ;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,UAAU,EAClB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,GACvE,MAAM,CAkBR"}

package/dist/_shared/cache-stats.d.ts

@@ -11,7 +11,7 @@
  *   L4 — registry.npmjs.org origin                   ~100-300 ms cross-region
  *
  * Pre-cache metrics support: hit/miss counters lived in
- * src/observability/diag-counters.ts but only tracked the RPC-call
+ * @nimbus-sh/platform/diag-counters.js but only tracked the RPC-call
  * boundary, not per-tier. Those flat counters have since been removed.
  *
  * This module adds per-tier × per-kind counters. SAME singleton-per-
@@ -142,4 +142,26 @@ export declare function snapshot(): CacheStatsSnapshot;
  * were reset at Y" (the gap is intentional vs an isolate reboot).
  */
 export declare function reset(): void;
+/**
+ * cache-obs-2: fold facet-collected per-tier cache events into the
+ * DO-side cache-stats singleton. Called from installer.ts after a
+ * batch-facet / resolve-facet returns — mirrors recordR2RaceCounters
+ * (the facet collects metrics in its result and the supervisor folds
+ * them into the DO isolate).
+ *
+ * Each event has shape:
+ *   { kind: 'hit', tier: 'L2'|'L3'|'L4', cacheKind: 'tarball'|'packument'|'asset', bytes: number }
+ *   { kind: 'miss', tier: ..., cacheKind: ... }
+ */
+export type CacheStatEvent = {
+    kind: 'hit';
+    tier: CacheTier;
+    cacheKind: CacheKind;
+    bytes: number;
+} | {
+    kind: 'miss';
+    tier: CacheTier;
+    cacheKind: CacheKind;
+};
+export declare function recordCacheStatEvents(events: readonly CacheStatEvent[] | undefined): void;
 //# sourceMappingURL=cache-stats.d.ts.map

package/dist/_shared/cache-stats.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache-stats.d.ts","sourceRoot":"","sources":["../../src/_shared/cache-stats.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACxD;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;CACvD;AAyCD;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAO/E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAGjE;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,IAAI,kBAAkB,CAqB7C;AAED;;;;;;;GAOG;AACH,wBAAgB,KAAK,IAAI,IAAI,CAS5B"}
+{"version":3,"file":"cache-stats.d.ts","sourceRoot":"","sources":["../../src/_shared/cache-stats.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACxD;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;CACvD;AAyCD;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAO/E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI,CAGjE;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,IAAI,kBAAkB,CAqB7C;AAED;;;;;;;GAOG;AACH,wBAAgB,KAAK,IAAI,IAAI,CAS5B;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAE5D,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,GAAG,SAAS,GAAG,IAAI,CASzF"}

package/dist/_shared/cache-stats.js

@@ -11,7 +11,7 @@
  *   L4 — registry.npmjs.org origin                   ~100-300 ms cross-region
  *
  * Pre-cache metrics support: hit/miss counters lived in
- * src/observability/diag-counters.ts but only tracked the RPC-call
+ * @nimbus-sh/platform/diag-counters.js but only tracked the RPC-call
  * boundary, not per-tier. Those flat counters have since been removed.
  *
  * This module adds per-tier × per-kind counters. SAME singleton-per-
@@ -159,3 +159,15 @@ export function reset() {
     }
     _lastResetAt = Date.now();
 }
+export function recordCacheStatEvents(events) {
+    if (!events || events.length === 0)
+        return;
+    for (const e of events) {
+        if (e.kind === 'hit') {
+            recordHit(e.tier, e.cacheKind, e.bytes);
+        }
+        else {
+            recordMiss(e.tier, e.cacheKind);
+        }
+    }
+}

package/dist/_shared/exports-resolver.d.ts

@@ -7,7 +7,7 @@
  *   1. Install-time supervisor (TS) — `src/npm-resolver.ts` re-exports the
  *      typed functions for tree resolution.
  *
- *   2. LoaderPool isolates (JS string) — `src/loaders/pre-bundle-preamble.ts`
+ *   2. IsolatePool isolates (JS string) — `src/loaders/pre-bundle-preamble.ts`
  *      embeds `getExportsResolverJS()` as part of the pool preamble so the
  *      pre-bundle facet uses identical resolution semantics to the supervisor.
  *

package/dist/_shared/exports-resolver.js

@@ -7,7 +7,7 @@
  *   1. Install-time supervisor (TS) — `src/npm-resolver.ts` re-exports the
  *      typed functions for tree resolution.
  *
- *   2. LoaderPool isolates (JS string) — `src/loaders/pre-bundle-preamble.ts`
+ *   2. IsolatePool isolates (JS string) — `src/loaders/pre-bundle-preamble.ts`
  *      embeds `getExportsResolverJS()` as part of the pool preamble so the
  *      pre-bundle facet uses identical resolution semantics to the supervisor.
  *

package/dist/_shared/real-node-imports.d.ts

@@ -38,6 +38,13 @@
  *                         constructed Session's connect/post are inert.
  *                         Tools (e.g. nuxi) that open a Session purely
  *                         for optional profiling degrade cleanly.
+ *   - node:zlib         — full surface: every *Sync variant, brotli/zstd,
+ *                         crc32, constants, and streaming create* factories
+ *                         (probe-verified 2026-08-23 at compat date
+ *                         2026-04-01). Forwarded verbatim by the zlib
+ *                         block in node-shims.ts; results are the host
+ *                         realm's own Buffers, which the widened
+ *                         __BufferMod.isBuffer recognizes.
  */
 export declare function getRealNodeImportsCode(): string;
 //# sourceMappingURL=real-node-imports.d.ts.map

package/dist/_shared/real-node-imports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"real-node-imports.d.ts","sourceRoot":"","sources":["../../src/_shared/real-node-imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,wBAAgB,sBAAsB,IAAI,MAAM,CAU/C"}
+{"version":3,"file":"real-node-imports.d.ts","sourceRoot":"","sources":["../../src/_shared/real-node-imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,wBAAgB,sBAAsB,IAAI,MAAM,CAW/C"}

package/dist/_shared/real-node-imports.js

@@ -38,6 +38,13 @@
  *                         constructed Session's connect/post are inert.
  *                         Tools (e.g. nuxi) that open a Session purely
  *                         for optional profiling degrade cleanly.
+ *   - node:zlib         — full surface: every *Sync variant, brotli/zstd,
+ *                         crc32, constants, and streaming create* factories
+ *                         (probe-verified 2026-08-23 at compat date
+ *                         2026-04-01). Forwarded verbatim by the zlib
+ *                         block in node-shims.ts; results are the host
+ *                         realm's own Buffers, which the widened
+ *                         __BufferMod.isBuffer recognizes.
  */
 export function getRealNodeImportsCode() {
     return `
@@ -48,5 +55,6 @@ import * as __real_diagnostics_channel from 'node:diagnostics_channel';
 import * as __real_repl from 'node:repl';
 import * as __real_vm from 'node:vm';
 import * as __real_inspector from 'node:inspector';
+import * as __real_zlib from 'node:zlib';
 `.trim();
 }

package/dist/_shared/retry.js

@@ -22,7 +22,7 @@
  * helper. resolve-one-facet.ts and install-batch-facet.ts therefore keep
  * equivalent retry loops inside their isolated function bodies.
  */
-import { disposeRpcResource } from './rpc-dispose.js';
+import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { errorText } from './error-text.js';
 /** Default retry count AFTER the first attempt (3 = up to 4 total attempts). */
 export const DEFAULT_RETRIES = 3;

package/dist/_shared/tarball.d.ts

@@ -1,5 +1,5 @@
 /**
- * tarball.ts — a whole tarball, in memory, as a path→bytes map.
+ * Tarball extraction for streaming installers and buffered archive consumers.
  *
  * The streaming primitives it walks with (`parseTarHeader`, `streamTarEntries`,
  * `readableStreamToAsyncIterable`) live in `./tarball-stream.ts` — a
@@ -7,11 +7,29 @@
  * into a string the loader pool injects into dynamic workers, where an import
  * would not resolve.
  *
- * This half is for a caller that already holds the bytes: `gem install`, which
- * fetches a `.gem` (a tar holding a gzipped tar) and needs both layers open at
- * once. An installer streaming a tarball it is still downloading should drive
- * `streamTarEntries` itself and never hold the whole thing.
+ * Installers use writeTarballStream. extractTarball retains a map for callers
+ * such as gem install, which must open an archive nested inside another one.
  */
+export interface TarballWriteTarget {
+    exists(path: string): boolean;
+    mkdir(path: string, options?: {
+        recursive?: boolean;
+    }): void;
+    writeFile(path: string, data: Uint8Array | string): unknown;
+}
+export interface TarballWriteResult {
+    /** Regular files written, including the manifest. */
+    files: number;
+    /** Total decompressed bytes written. */
+    bytes: number;
+}
+/**
+ * Stream a gzipped npm archive into a package directory. Entry names are
+ * already canonical and prefix-stripped by streamTarEntries. Hold only the
+ * current entry and the manifest; write the manifest last so a failed install
+ * is not mistaken for a complete package on retry. Filesystem failures reject.
+ */
+export declare function writeTarballStream(body: ReadableStream<Uint8Array>, targetDir: string, vfs: TarballWriteTarget): Promise<TarballWriteResult>;
 /** Extract every regular file. Gzipped input is decompressed first. */
 export declare function extractTarball(tarball: ArrayBuffer): Promise<Map<string, Uint8Array>>;
 //# sourceMappingURL=tarball.d.ts.map

package/dist/_shared/tarball.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tarball.d.ts","sourceRoot":"","sources":["../../src/_shared/tarball.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,uEAAuE;AACvE,wBAAsB,cAAc,CAClC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAsBlC"}
+{"version":3,"file":"tarball.d.ts","sourceRoot":"","sources":["../../src/_shared/tarball.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7D,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;CAC7D;AAED,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,EAChC,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CA0B7B;AAED,uEAAuE;AACvE,wBAAsB,cAAc,CAClC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAsBlC"}

package/dist/_shared/tarball.js

@@ -1,5 +1,5 @@
 /**
- * tarball.ts — a whole tarball, in memory, as a path→bytes map.
+ * Tarball extraction for streaming installers and buffered archive consumers.
  *
  * The streaming primitives it walks with (`parseTarHeader`, `streamTarEntries`,
  * `readableStreamToAsyncIterable`) live in `./tarball-stream.ts` — a
@@ -7,12 +7,45 @@
  * into a string the loader pool injects into dynamic workers, where an import
  * would not resolve.
  *
- * This half is for a caller that already holds the bytes: `gem install`, which
- * fetches a `.gem` (a tar holding a gzipped tar) and needs both layers open at
- * once. An installer streaming a tarball it is still downloading should drive
- * `streamTarEntries` itself and never hold the whole thing.
+ * Installers use writeTarballStream. extractTarball retains a map for callers
+ * such as gem install, which must open an archive nested inside another one.
  */
 import { streamTarEntries, readableStreamToAsyncIterable, } from './tarball-stream.js';
+const PACKAGE_MANIFEST = 'package.json';
+/**
+ * Stream a gzipped npm archive into a package directory. Entry names are
+ * already canonical and prefix-stripped by streamTarEntries. Hold only the
+ * current entry and the manifest; write the manifest last so a failed install
+ * is not mistaken for a complete package on retry. Filesystem failures reject.
+ */
+export async function writeTarballStream(body, targetDir, vfs) {
+    const ensureDir = (path) => {
+        if (!vfs.exists(path))
+            vfs.mkdir(path, { recursive: true });
+    };
+    ensureDir(targetDir);
+    let files = 0;
+    let bytes = 0;
+    let manifest = null;
+    const entries = streamTarEntries(readableStreamToAsyncIterable(body.pipeThrough(new DecompressionStream('gzip'))));
+    for await (const entry of entries) {
+        if (entry.name === PACKAGE_MANIFEST) {
+            manifest = entry.data;
+            continue;
+        }
+        const fullPath = `${targetDir}/${entry.name}`;
+        const cut = fullPath.lastIndexOf('/');
+        if (cut > 0)
+            ensureDir(fullPath.slice(0, cut));
+        await vfs.writeFile(fullPath, entry.data);
+        files++;
+        bytes += entry.data.length;
+    }
+    if (!manifest)
+        throw new Error(`tarball for ${targetDir} carried no ${PACKAGE_MANIFEST}`);
+    await vfs.writeFile(`${targetDir}/${PACKAGE_MANIFEST}`, manifest);
+    return { files: files + 1, bytes: bytes + manifest.length };
+}
 /** Extract every regular file. Gzipped input is decompressed first. */
 export async function extractTarball(tarball) {
     const files = new Map();

package/dist/_shared/vfs-write-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vfs-write-ledger.d.ts","sourceRoot":"","sources":["../../src/_shared/vfs-write-ledger.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,+BAA+B,QAqZpC,CAAC;AAET,eAAO,MAAM,uBAAuB,QAgC5B,CAAC"}
+{"version":3,"file":"vfs-write-ledger.d.ts","sourceRoot":"","sources":["../../src/_shared/vfs-write-ledger.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,+BAA+B,QA2ZpC,CAAC;AAET,eAAO,MAAM,uBAAuB,QAgC5B,CAAC"}

package/dist/_shared/vfs-write-ledger.js

@@ -317,26 +317,32 @@ async function __nimbusPersistVfsWrite(supervisor, path, content, snapshot) {
 }
 
 /**
- * Write back everything parked, keeping any failure for the exit drain.
+ * Write back the cells parked at THIS instant, and only those.
  *
- * The write-back sites that are not the exit drain — the debounce below and
- * the RELEASE barrier ahead of egress — have no caller who could act on a
- * failure: there is no user frame to throw into, and rejecting the fetch that
- * happened to trigger the flush would blame the wrong operation. Retaining
- * the failure in the channel \`__nimbusDrainVfsMutations\` already drains means
- * the exit path still reports it, so a lost write is loud exactly once and
- * never silent.
+ * Bounded on purpose, and deliberately not routed through
+ * \`__nimbusDrainVfsWrites\`, whose \`while (pending > 0)\` waits for the mutation
+ * queue to be EMPTY. That wait is correct at process exit, where no new writes
+ * are coming. Anywhere else it is a livelock: a facet unpacking a tarball adds
+ * mutations faster than the loop retires them, so the loop never returns.
+ * Sited ahead of egress — where it was — that stopped the request from ever
+ * leaving the facet, and \`npx sv create\` ran, printed its intro, and then
+ * never reported an exit at all. A barrier may delay a request; it may not
+ * wait on a condition a busy process never reaches.
+ *
+ * Failures are retained rather than thrown. The two callers — the debounce
+ * below, and the RELEASE barrier ahead of egress — have no frame that could
+ * act on one: rejecting the fetch that happened to trigger the flush would
+ * blame the wrong operation. The exit drain reports what is retained, so a
+ * lost write is loud exactly once and never silent.
  */
 async function __nimbusFlushVfsWriteBack(supervisor) {
   if (!supervisor) return;
-  try {
-    await __nimbusDrainVfsWrites(supervisor);
-  } catch (error) {
-    if (!__nimbusHasPendingVfsMutationFailure) {
-      __nimbusHasPendingVfsMutationFailure = true;
-      __nimbusPendingVfsMutationFailure = error;
-    }
-  }
+  const paths = Object.keys(__vfsWrites);
+  if (paths.length === 0) return;
+  await Promise.allSettled(paths.map((path) => __nimbusFlushVfsWrite(
+    path,
+    (content, snapshot) => __nimbusPersistVfsWrite(supervisor, path, content, snapshot),
+  )));
 }
 
 /**

package/dist/constants.d.ts

@@ -1,6 +1,11 @@
 /**
  * constants.ts — Single source of truth for all Nimbus configuration.
+ *
+ * Nimbus POLICY only. The measured platform limits these policies are
+ * derived from (tx bounds, the RPC envelope, supervisor budgets) live in
+ * `@nimbus-sh/platform/limits.js`.
  */
+export { CHUNK_SIZE, MAX_GLOBAL_WRITE_STREAM_CREDIT_BYTES, MAX_RPC_SAFE_PAYLOAD_BYTES, MAX_TX_BLOB_BYTES, MAX_TX_LOGICAL_ROWS, MAX_TX_SQL_EXECS, PRE_BUNDLE_CONCURRENCY, PRE_BUNDLE_SLICE_CAP_BYTES, SUPERVISOR_HEAP_CEILING_BYTES, SUPERVISOR_IN_FLIGHT_ALLOCATION_BUDGET_BYTES, SUPERVISOR_READ_RESERVE_BYTES, } from '@nimbus-sh/platform/limits.js';
 export declare const NIMBUS_VERSION = "2.0.0";
 export declare const NODE_VERSION = "v22.19.0";
 export declare const NODE_VERSIONS: {
@@ -11,15 +16,9 @@ export declare const NODE_VERSIONS: {
 export declare const ESBUILD_VERSION = "0.24.2";
 export declare const SQLJS_VERSION = "1.14.1";
 export declare const OPENCODE_VERSION = "1.16.2";
-export declare const CHUNK_SIZE = 65536;
 export declare const LRU_MAX_ENTRIES = 512;
 export declare const BATCH_SIZE = 64;
 export declare const VFS_CAPACITY: number;
-export declare const MAX_TX_BLOB_BYTES: number;
-export declare const MAX_TX_LOGICAL_ROWS = 256;
-export declare const MAX_TX_SQL_EXECS = 64;
-export declare const MAX_GLOBAL_WRITE_STREAM_CREDIT_BYTES: number;
-export declare const MAX_RPC_SAFE_PAYLOAD_BYTES: number;
 export declare const FS_READ_BATCH_PATH_LIMIT = 1024;
 export declare const FS_READ_BATCH_REQUEST_BYTES: number;
 export declare const FS_LIST_PAGE_LIMIT = 8192;
@@ -43,17 +42,12 @@ export declare const CWD_SNAPSHOT_MAX_FILE_BYTES: number;
 export declare const NPM_REGISTRY = "https://registry.npmjs.org";
 export declare const NPM_CONCURRENCY = 12;
 export declare const NPM_DECOMPRESS_TIMEOUT = 15000;
-export declare const PRE_BUNDLE_SLICE_CAP_BYTES: number;
-export declare const PRE_BUNDLE_CONCURRENCY = 1;
 export declare const DEFAULT_VITE_PORT = 5173;
 export declare const DEFAULT_PREVIEW_BASE = "/preview";
 export declare const DEFAULT_WORKER_BASE = "/worker";
 export declare const WRANGLER_DEBOUNCE_MS = 250;
 export declare const NIMBUS_AI_GATEWAY_PORT = 8790;
 export declare const CF_COMPAT_DATE = "2026-04-01";
-export declare const SUPERVISOR_HEAP_CEILING_BYTES: number;
-export declare const SUPERVISOR_IN_FLIGHT_ALLOCATION_BUDGET_BYTES: number;
-export declare const SUPERVISOR_READ_RESERVE_BYTES: number;
 export declare const DEFAULT_HOSTNAME = "nimbus";
 export declare const DEFAULT_HOME = "/home/user";
 export declare const DEFAULT_USER = "user";

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,eAAO,MAAM,cAAc,UAAU,CAAC;AA+BtC,eAAO,MAAM,YAAY,aAAa,CAAC;AACvC,eAAO,MAAM,aAAa;;;;CAAyD,CAAC;AACpF,eAAO,MAAM,eAAe,WAAW,CAAC;AAQxC,eAAO,MAAM,aAAa,WAAW,CAAC;AAQtC,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAGzC,eAAO,MAAM,UAAU,QAAS,CAAC;AACjC,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,YAAY,QAA0B,CAAC;AACpD,eAAO,MAAM,iBAAiB,QAAkB,CAAC;AACjD,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,oCAAoC,QAAkB,CAAC;AAKpE,eAAO,MAAM,0BAA0B,QAAmB,CAAC;AAyB3D,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,eAAO,MAAM,2BAA2B,QAAkB,CAAC;AAa3D,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAO/C,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAQlD,eAAO,MAAM,yBAAyB,QAA6B,CAAC;AAGpE,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAyBvC,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AACrD,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAiBzD,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAoBzD,eAAO,MAAM,2BAA2B,QAAkB,CAAC;AAG3D,eAAO,MAAM,YAAY,+BAA+B,CAAC;AACzD,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,0BAA0B,QAA6B,CAAC;AACrE,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAGxC,eAAO,MAAM,iBAAiB,OAAO,CAAC;AACtC,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAC/C,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAC7C,eAAO,MAAM,oBAAoB,MAAM,CAAC;AASxC,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAG3C,eAAO,MAAM,cAAc,eAAe,CAAC;AA6B3C,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAO9D,eAAO,MAAM,4CAA4C,QAAmB,CAAC;AAY7E,eAAO,MAAM,6BAA6B,QAAc,CAAC;AAGzD,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC,eAAO,MAAM,YAAY,eAAe,CAAC;AACzC,eAAO,MAAM,YAAY,SAAS,CAAC;AACnC,eAAO,MAAM,aAAa,YAAY,CAAC;AACvC,eAAO,MAAM,YAAY,2EAA2E,CAAC;AACrG,eAAO,MAAM,oBAAoB,UAAqD,CAAC;AAiBvF,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAe,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EACL,UAAU,EACV,oCAAoC,EACpC,0BAA0B,EAC1B,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,EAC1B,6BAA6B,EAC7B,4CAA4C,EAC5C,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAGvC,eAAO,MAAM,cAAc,UAAU,CAAC;AA+BtC,eAAO,MAAM,YAAY,aAAa,CAAC;AACvC,eAAO,MAAM,aAAa;;;;CAAyD,CAAC;AACpF,eAAO,MAAM,eAAe,WAAW,CAAC;AAQxC,eAAO,MAAM,aAAa,WAAW,CAAC;AAQtC,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAKzC,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,YAAY,QAA0B,CAAC;AAyBpD,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAC7C,eAAO,MAAM,2BAA2B,QAAkB,CAAC;AAa3D,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAO/C,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAQlD,eAAO,MAAM,yBAAyB,QAA6B,CAAC;AAGpE,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAyBvC,eAAO,MAAM,oBAAoB,OAAO,CAAC;AACzC,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AACrD,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAiBzD,eAAO,MAAM,wBAAwB,QAAmB,CAAC;AAoBzD,eAAO,MAAM,2BAA2B,QAAkB,CAAC;AAM3D,eAAO,MAAM,YAAY,+BAA+B,CAAC;AACzD,eAAO,MAAM,eAAe,KAAK,CAAC;AAClC,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAG7C,eAAO,MAAM,iBAAiB,OAAO,CAAC;AACtC,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAC/C,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAC7C,eAAO,MAAM,oBAAoB,MAAM,CAAC;AASxC,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAG3C,eAAO,MAAM,cAAc,eAAe,CAAC;AAG3C,eAAO,MAAM,gBAAgB,WAAW,CAAC;AACzC,eAAO,MAAM,YAAY,eAAe,CAAC;AACzC,eAAO,MAAM,YAAY,SAAS,CAAC;AACnC,eAAO,MAAM,aAAa,YAAY,CAAC;AACvC,eAAO,MAAM,YAAY,2EAA2E,CAAC;AACrG,eAAO,MAAM,oBAAoB,UAAqD,CAAC;AAiBvF,eAAO,MAAM,uBAAuB,EAAE,SAAS,MAAM,EAAe,CAAC"}

package/dist/constants.js

@@ -1,6 +1,17 @@
 /**
  * constants.ts — Single source of truth for all Nimbus configuration.
+ *
+ * Nimbus POLICY only. The measured platform limits these policies are
+ * derived from (tx bounds, the RPC envelope, supervisor budgets) live in
+ * `@nimbus-sh/platform/limits.js`.
  */
+import { MAX_RPC_SAFE_PAYLOAD_BYTES } from '@nimbus-sh/platform/limits.js';
+// Published-surface forwarding: @nimbus-sh/core@0.5.0 exports these from
+// this module and real consumers import them here (Proteus merge-back.ts
+// pulls CHUNK_SIZE and the MAX_TX_* set). The platform split moved the
+// definitions to @nimbus-sh/platform/limits.js, which stays the single
+// source of truth; core's own modules import platform directly.
+export { CHUNK_SIZE, MAX_GLOBAL_WRITE_STREAM_CREDIT_BYTES, MAX_RPC_SAFE_PAYLOAD_BYTES, MAX_TX_BLOB_BYTES, MAX_TX_LOGICAL_ROWS, MAX_TX_SQL_EXECS, PRE_BUNDLE_CONCURRENCY, PRE_BUNDLE_SLICE_CAP_BYTES, SUPERVISOR_HEAP_CEILING_BYTES, SUPERVISOR_IN_FLIGHT_ALLOCATION_BUDGET_BYTES, SUPERVISOR_READ_RESERVE_BYTES, } from '@nimbus-sh/platform/limits.js';
 // ── Versions ────────────────────────────────────────────────────────────
 export const NIMBUS_VERSION = '2.0.0';
 //
@@ -52,18 +63,11 @@ export const SQLJS_VERSION = '1.14.1';
 // runtime/opencode-artifact.ts and served as the package's `opencode` bin.
 export const OPENCODE_VERSION = '1.16.2';
 // ── VFS Constants ───────────────────────────────────────────────────────
-export const CHUNK_SIZE = 65_536; // 64KB per content chunk
+// The chunk size itself (CHUNK_SIZE) and the transaction bounds are
+// platform limits — see @nimbus-sh/platform/limits.js.
 export const LRU_MAX_ENTRIES = 512; // 512 × 64KB = 32MB hot cache
 export const BATCH_SIZE = 64; // rows per batch INSERT
 export const VFS_CAPACITY = 10 * 1024 * 1024 * 1024; // 10 GB
-export const MAX_TX_BLOB_BYTES = 1 * 1024 * 1024;
-export const MAX_TX_LOGICAL_ROWS = 256;
-export const MAX_TX_SQL_EXECS = 64;
-export const MAX_GLOBAL_WRITE_STREAM_CREDIT_BYTES = 8 * 1024 * 1024;
-// Largest byte payload Nimbus sends through an ordinary Workers RPC value.
-// The platform limit is 32 MiB; 28 MiB leaves room for structured-clone
-// metadata and matches the proven on-demand facet transfer envelope.
-export const MAX_RPC_SAFE_PAYLOAD_BYTES = 28 * 1024 * 1024;
 // ── Batched filesystem reads ────────────────────────────────────────────
 // A round trip costs an order of magnitude more than the SQLite lookup
 // behind it, so a program that touches many files pays for round trips and
@@ -188,11 +192,12 @@ export const PREFETCH_CACHE_MAX_BYTES = 16 * 1024 * 1024;
 // it now raises ENOENT instead of costing the session.
 export const CWD_SNAPSHOT_MAX_FILE_BYTES = 2 * 1024 * 1024;
 // ── npm Constants ───────────────────────────────────────────────────────
+// The pre-bundle admission envelope (PRE_BUNDLE_SLICE_CAP_BYTES,
+// PRE_BUNDLE_CONCURRENCY) is a measured platform envelope — see
+// @nimbus-sh/platform/limits.js.
 export const NPM_REGISTRY = 'https://registry.npmjs.org';
 export const NPM_CONCURRENCY = 12;
 export const NPM_DECOMPRESS_TIMEOUT = 15_000;
-export const PRE_BUNDLE_SLICE_CAP_BYTES = MAX_RPC_SAFE_PAYLOAD_BYTES;
-export const PRE_BUNDLE_CONCURRENCY = 1;
 // ── Dev Server Constants ────────────────────────────────────────────────
 export const DEFAULT_VITE_PORT = 5173;
 export const DEFAULT_PREVIEW_BASE = '/preview';
@@ -208,51 +213,6 @@ export const WRANGLER_DEBOUNCE_MS = 250;
 export const NIMBUS_AI_GATEWAY_PORT = 8790;
 // ── Compatibility ───────────────────────────────────────────────────────
 export const CF_COMPAT_DATE = '2026-04-01';
-// ── Supervisor heap budget [C'.1] ───────────────────────────────────────
-//
-// Three distinct memory regimes, not one shared pool:
-//
-//   - Supervisor DO isolate: 128 MiB HARD platform ceiling ("Each isolate
-//     can consume up to 128 MB of memory" —
-//     https://developers.cloudflare.com/workers/platform/limits/).
-//   - Facets: ~208-256 MiB EACH, measured — memory independent of the
-//     supervisor and of each other (1,664 MiB live across 8 facets +
-//     parent) but CPU SHARED across the actor thread. See
-//     packages/worker/src/loaders/process-fabric.ts.
-//   - Peer DOs: independent memory AND CPU budgets, measured 1.2 GiB
-//     live across 8 peers.
-//
-// Nimbus targets HALF of the supervisor's 128 MiB as a self-imposed soft
-// ceiling so the supervisor always has runway when workerd LRU-evicts
-// neighbours or AIR (Asynchronous Isolate Recreation) folds growing
-// isolates.
-//
-// 64 MiB is a soft admission budget, not a measurement — the right value
-// is unmeasured — and nothing enforces it directly.
-// src/observability/heap-estimate.ts sums the INSTRUMENTED contributors —
-// the supervisor baseline, VFS LRU and in-flight writes, pre-bundle
-// slices, streaming RPC buffers, and the prefetch-bundle build lease and
-// cache gauge — which is a lower bound, not full coverage; allocation
-// sites known to be missing are listed in HEAP_BLIND_SPOTS. Read a low
-// percentOfCeiling accordingly.
-export const SUPERVISOR_HEAP_CEILING_BYTES = 64 * 1024 * 1024;
-// Shared allowance for transient allocations in the supervisor DO. With the
-// VFS LRU shrunk to 8 MiB during an active reservation, 40 MiB of admitted
-// payload plus the 9 MiB bundle baseline stays below the 64 MiB soft ceiling
-// with 7 MiB left for metadata, structured-clone overhead, and runtime state.
-// This is 31.25% of the platform's 128 MiB hard isolate ceiling.
-export const SUPERVISOR_IN_FLIGHT_ALLOCATION_BUDGET_BYTES = 40 * 1024 * 1024;
-// Reserved slice of that allowance for chunk-sized filesystem reads, so a
-// read is never queued behind a multi-megabyte owner for a wait that has
-// nothing to do with its own cost. A read only draws on this when the shared
-// budget is already contended — which is exactly when the VFS LRU is shrunk
-// to 8 MiB — so peak accounting is 40 + 1 admitted, 8 LRU, 9 bundle baseline:
-// 58 MiB, still under the 64 MiB soft ceiling.
-//
-// 1 MiB is 16 concurrent READ_STREAM_CHUNK_BYTES reads. The point is not
-// depth, it is that a read loop keeps moving while a heavy owner works
-// instead of stopping dead for the duration.
-export const SUPERVISOR_READ_RESERVE_BYTES = 1024 * 1024;
 // ── OS Defaults ─────────────────────────────────────────────────────────
 export const DEFAULT_HOSTNAME = 'nimbus';
 export const DEFAULT_HOME = '/home/user';

package/dist/runtime/assets-loader.js

@@ -34,7 +34,7 @@
  * Within a single isolate's lifetime, the same path always returns the
  * same content.
  */
-import { disposeRpcResource } from '../_shared/rpc-dispose.js';
+import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 /**
  * Per-isolate cache. Keys are asset paths (e.g. `/_assets/foo.js`).
  * Values are settled promises so concurrent callers share the same