@nimbus-sh/fabric 0.4.0 → 0.6.0

package/dist/bindings.d.ts

@@ -25,16 +25,6 @@
 import { WorkerEntrypoint } from 'cloudflare:workers';
 import { z } from 'zod/v4';
 import type { WorkerCode } from './vendor/types.js';
-/**
- * The supervisor DO namespace a shim resolves ONE stub from, by the id its
- * props carry. `Stub` is that DO's RPC surface as the calling shim uses it —
- * the supervisor class belongs to the embedder, so each shim names the methods
- * it calls rather than the class.
- */
-interface SupervisorNamespace<Stub> {
-    idFromString(id: string): DurableObjectId;
-    get(id: DurableObjectId): Stub;
-}
 /**
  * A dynamic worker's entrypoint, as hop 3 relays to it. `fetch` is the
  * entrypoint contract every loaded worker answers; `handleHttpRequest` is the
@@ -69,17 +59,6 @@ interface NimbusLoaderShimEnv {
     LOADER?: OuterWorkerLoader;
     NIMBUS_INNER_LOADER_DEPTH?: string;
 }
-/**
- * What the assets shim reads off the supervisor DO: the VFS bytes of one path,
- * or null when it holds no such file.
- */
-interface AssetsSupervisorStub {
-    _rpcReadFileBytes(path: string): Promise<ArrayBuffer | Uint8Array | null>;
-}
-/** `env` for the assets shim: the supervisor its VFS reads round-trip through. */
-interface NimbusAssetsEnv {
-    NIMBUS_SESSION?: SupervisorNamespace<AssetsSupervisorStub>;
-}
 /** Props the assets shim is minted with. */
 interface NimbusAssetsProps {
     /** Project root in VFS (e.g. "home/user/myapp"). */
@@ -110,7 +89,7 @@ interface NimbusAssetsProps {
  * For Phase 1, we use a simpler approach: the props carry a supervisor
  * DO id so we can round-trip through an RPC method that reads the file.
  */
-export declare class NimbusAssetsRPC extends WorkerEntrypoint<NimbusAssetsEnv, NimbusAssetsProps> {
+export declare class NimbusAssetsRPC extends WorkerEntrypoint<object, NimbusAssetsProps> {
     /**
      * Fetch a static asset. Called by the inner Worker as
      * `env.ASSETS.fetch(request)`. The request URL's pathname is used to
@@ -269,29 +248,6 @@ export declare class NimbusDurableObjectNamespace extends WorkerEntrypoint<unkno
     /** Return a stub bound to the given id. */
     get(id: string): unknown;
 }
-/**
- * What the DO shim reads off the supervisor: one inner-DO request, answered
- * from the facet the supervisor resolves in its own request context.
- */
-interface InnerDoSupervisorStub {
-    _rpcInnerDoFetch(request: {
-        bindingName: string;
-        id: string;
-        method: string;
-        url: string;
-        headers: [string, string][];
-        body: ArrayBuffer | null;
-    }): Promise<{
-        body: ArrayBuffer;
-        status: number;
-        statusText: string;
-        headers: [string, string][];
-    }>;
-}
-/** `env` for the DO shim: the supervisor that owns the facet. */
-interface NimbusInnerDoEnv {
-    NIMBUS_SESSION?: SupervisorNamespace<InnerDoSupervisorStub>;
-}
 /** Props the DO stub carries: which binding, which supervisor, which id. */
 interface NimbusDoStubProps extends NimbusDoNamespaceProps {
     id?: string;
@@ -304,11 +260,11 @@ interface NimbusDoStubProps extends NimbusDoNamespaceProps {
  * spins up / attaches to a facet via the supervisor's ctx.facets in
  * the SAME outer request context — never reusing stubs across requests.
  */
-export declare class NimbusDOStub extends WorkerEntrypoint<NimbusInnerDoEnv, NimbusDoStubProps> {
+export declare class NimbusDOStub extends WorkerEntrypoint<object, NimbusDoStubProps> {
     /**
-     * Resolve the supervisor DO from env.NIMBUS_SESSION and route through
-     * its _rpcInnerDoFetch RPC method, which runs ctx.facets.get(...) in
-     * its own context and forwards the request.
+     * Resolve the supervisor DO through the composed host namespace and
+     * dispatch the innerDoFetch op through its one supervisorOp entrypoint —
+     * a host forwards envelopes, not private _rpc* methods.
      */
     fetch(request: Request): Promise<Response>;
 }

package/dist/bindings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../src/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAM3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAcpD;;;;;GAKG;AACH,UAAU,mBAAmB,CAAC,IAAI;IAChC,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,IAAI,CAAC;CAChC;AAED;;;;GAIG;AACH,UAAU,gBAAgB;IACxB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,iBAAiB,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACzD;AAED,4EAA4E;AAC5E,UAAU,YAAY;IACpB,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC/C,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAAC;CACzD;AAED;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAAC;IACrC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC;CAC/D;AAED;;;;GAIG;AACH,UAAU,mBAAmB;IAC3B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAwCD;;;GAGG;AACH,UAAU,oBAAoB;IAC5B,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC;CAC3E;AAED,kFAAkF;AAClF,UAAU,eAAe;IACvB,cAAc,CAAC,EAAE,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;CAC5D;AAED,4CAA4C;AAC5C,UAAU,iBAAiB;IACzB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,eAAgB,SAAQ,gBAAgB,CAAC,eAAe,EAAE,iBAAiB,CAAC;IACvF;;;;OAIG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CA2DjD;AA2FD,QAAA,MAAM,iCAAiC;;;;;;;;;;iBAiBvB,CAAC;AAEjB,KAAK,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AA4CrF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAMhG;AAqBD,8EAA8E;AAC9E,UAAU,sBAAsB;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,kEAAkE;AAClE,qBAAa,eAAgB,SAAQ,gBAAgB,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;IAChG,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,cAAc;IAWtB;;;;;OAKG;IACH,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;IAmB/B;;;;OAIG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAiB1F;AAED,kFAAkF;AAClF,UAAU,uBAAwB,SAAQ,sBAAsB;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,mEAAmE;AACnE,qBAAa,kBAAmB,SAAQ,gBAAgB,CAAC,mBAAmB,EAAE,uBAAuB,CAAC;IACpG;;;;;;OAMG;IACH,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO;IAWrC;;;;;;;;OAQG;IACH,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB;CAQxD;AAED,8DAA8D;AAC9D,qBAAa,sBAAuB,SAAQ,gBAAgB,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;IAC5G,MAAM,IAAI,2BAA2B;IAI/B,kBAAkB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,CAAC;IAWxE,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAqCrD;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAyB/B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,gBAAgB;IAMlB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAe5D;;;;;OAKG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAUjD;AAqBD,mFAAmF;AACnF,UAAU,sBAAsB;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,4BAA6B,SAAQ,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACjG,mEAAmE;IACnE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAiBhC,sEAAsE;IACtE,WAAW,IAAI,MAAM;IAIrB,kDAAkD;IAClD,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM;IAI/B,2CAA2C;IAC3C,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;CAYzB;AAED;;;GAGG;AACH,UAAU,qBAAqB;IAC7B,gBAAgB,CAAC,OAAO,EAAE;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;KAC1B,GAAG,OAAO,CAAC;QACV,IAAI,EAAE,WAAW,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;KAC7B,CAAC,CAAC;CACJ;AAED,iEAAiE;AACjE,UAAU,gBAAgB;IACxB,cAAc,CAAC,EAAE,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;CAC7D;AAED,4EAA4E;AAC5E,UAAU,iBAAkB,SAAQ,sBAAsB;IACxD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,SAAQ,gBAAgB,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IACrF;;;;OAIG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAuCjD"}
+{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../src/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAO3B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAcpD;;;;GAIG;AACH,UAAU,gBAAgB;IACxB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,iBAAiB,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACzD;AAED,4EAA4E;AAC5E,UAAU,YAAY;IACpB,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IAC/C,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAAC;CACzD;AAED;;;;;;GAMG;AACH,UAAU,iBAAiB;IACzB,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAAC;IACrC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC;CAC/D;AAED;;;;GAIG;AACH,UAAU,mBAAmB;IAC3B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAyBD,4CAA4C;AAC5C,UAAU,iBAAiB;IACzB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,eAAgB,SAAQ,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAC9E;;;;OAIG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAyEjD;AA2FD,QAAA,MAAM,iCAAiC;;;;;;;;;;iBAiBvB,CAAC;AAEjB,KAAK,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AA4CrF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAMhG;AAqBD,8EAA8E;AAC9E,UAAU,sBAAsB;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,kEAAkE;AAClE,qBAAa,eAAgB,SAAQ,gBAAgB,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;IAChG,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,cAAc;IAWtB;;;;;OAKG;IACH,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;IAmB/B;;;;OAIG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;CAiB1F;AAED,kFAAkF;AAClF,UAAU,uBAAwB,SAAQ,sBAAsB;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,mEAAmE;AACnE,qBAAa,kBAAmB,SAAQ,gBAAgB,CAAC,mBAAmB,EAAE,uBAAuB,CAAC;IACpG;;;;;;OAMG;IACH,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO;IAWrC;;;;;;;;OAQG;IACH,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB;CAQxD;AAED,8DAA8D;AAC9D,qBAAa,sBAAuB,SAAQ,gBAAgB,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;IAC5G,MAAM,IAAI,2BAA2B;IAI/B,kBAAkB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,OAAO,CAAC;IAWxE,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAqCrD;;;;;;;OAOG;IACH,OAAO,CAAC,uBAAuB;IAyB/B;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,gBAAgB;IAMlB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IAe5D;;;;;OAKG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAUjD;AAqBD,mFAAmF;AACnF,UAAU,sBAAsB;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,4BAA6B,SAAQ,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACjG,mEAAmE;IACnE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAiBhC,sEAAsE;IACtE,WAAW,IAAI,MAAM;IAIrB,kDAAkD;IAClD,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM;IAI/B,2CAA2C;IAC3C,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;CAYzB;AAED,4EAA4E;AAC5E,UAAU,iBAAkB,SAAQ,sBAAsB;IACxD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,SAAQ,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAC3E;;;;OAIG;IACG,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;CAqDjD"}

package/dist/bindings.js

@@ -27,6 +27,7 @@ import { z } from 'zod/v4';
 import { disposeRpcResource, useRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { supervisorEntrypoint, supervisorEntrypointName } from './composition.js';
 import { stagedBootAssembler } from './composition.js';
+import { hostNamespaceBinding, hostOpDispatch } from './host-dispatch.js';
 import { assertModuleMapWithinCodeLimit } from './budgets.js';
 /**
  * `ctx.exports` — workerd's loopback bag, which the installed
@@ -88,12 +89,23 @@ export class NimbusAssetsRPC extends WorkerEntrypoint {
         let clean = url.pathname.replace(/^\/+/, '');
         const parts = clean.split('/').filter((p) => p && p !== '..' && p !== '.');
         clean = parts.join('/');
-        // Resolve the supervisor DO stub so we can call its VFS read RPC.
-        const ns = this.env.NIMBUS_SESSION;
-        if (!ns || !doId) {
-            return new Response('ASSETS binding not wired: missing NIMBUS_SESSION or doId', { status: 500 });
+        // Resolve the supervisor DO through the composed host namespace and
+        // dispatch readFileBytes through its supervisorOp entrypoint — a host
+        // forwards envelopes, not private _rpc* methods.
+        if (!doId) {
+            return new Response('ASSETS binding not wired: missing doId', { status: 500 });
+        }
+        let stub = null;
+        let dispatch;
+        try {
+            const ns = hostNamespaceBinding(this.env, 'NimbusAssetsRPC');
+            stub = ns.get(ns.idFromString(doId));
+            dispatch = hostOpDispatch(stub, 'NimbusAssetsRPC');
+        }
+        catch (e) {
+            disposeRpcResource(stub);
+            return new Response(`ASSETS binding not wired: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
         }
-        const stub = ns.get(ns.idFromString(doId));
         // Candidate VFS paths, tried in order. The assetsDir is relative to
         // the project root in VFS. Trailing-slash and bare dir → index.html.
         const base = (vfsRoot ? vfsRoot + '/' : '') + (assetsDir ? assetsDir + '/' : '');
@@ -112,10 +124,15 @@ export class NimbusAssetsRPC extends WorkerEntrypoint {
         try {
             for (const candidate of candidates) {
                 try {
-                    const response = await useRpcResource(stub._rpcReadFileBytes(candidate), (bytes) => {
-                        if (!bytes || bytes.byteLength === undefined)
+                    const response = await useRpcResource(dispatch({ op: 'readFileBytes', args: [candidate] }), (bytes) => {
+                        if (bytes === null)
                             return null;
-                        return new Response(bytes, {
+                        const body = bytes instanceof ArrayBuffer ? bytes
+                            : bytes instanceof Uint8Array && bytes.buffer instanceof ArrayBuffer
+                                ? new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength) : null;
+                        if (!body)
+                            return new Response('Nimbus: readFileBytes returned invalid bytes', { status: 502 });
+                        return new Response(body, {
                             status: 200,
                             headers: {
                                 'Content-Type': mimeTypeForPath(candidate),
@@ -633,21 +650,28 @@ export class NimbusDurableObjectNamespace extends WorkerEntrypoint {
  */
 export class NimbusDOStub extends WorkerEntrypoint {
     /**
-     * Resolve the supervisor DO from env.NIMBUS_SESSION and route through
-     * its _rpcInnerDoFetch RPC method, which runs ctx.facets.get(...) in
-     * its own context and forwards the request.
+     * Resolve the supervisor DO through the composed host namespace and
+     * dispatch the innerDoFetch op through its one supervisorOp entrypoint —
+     * a host forwards envelopes, not private _rpc* methods.
      */
     async fetch(request) {
         const props = this.ctx.props || {};
-        const ns = this.env?.NIMBUS_SESSION;
-        if (!ns)
-            return new Response('Nimbus: env.NIMBUS_SESSION unavailable', { status: 500 });
         const supervisorDoId = String(props.supervisorDoId || '');
         if (!supervisorDoId)
             return new Response('Nimbus: supervisorDoId missing', { status: 500 });
         const bindingName = String(props.bindingName || '');
         const id = String(props.id || '');
-        const stub = ns.get(ns.idFromString(supervisorDoId));
+        let stub = null;
+        let dispatch;
+        try {
+            const ns = hostNamespaceBinding(this.env ?? {}, 'NimbusDOStub');
+            stub = ns.get(ns.idFromString(supervisorDoId));
+            dispatch = hostOpDispatch(stub, 'NimbusDOStub');
+        }
+        catch (e) {
+            disposeRpcResource(stub);
+            return new Response(`Nimbus: ${e instanceof Error ? e.message : String(e)}`, { status: 500 });
+        }
         // Forward the full request (method, body, headers preserved) by
         // serializing what's needed and reconstructing on the other side.
         // The supervisor reconstitutes the Request from these fields and
@@ -658,18 +682,26 @@ export class NimbusDOStub extends WorkerEntrypoint {
         const headerList = [];
         request.headers.forEach((v, k) => { headerList.push([k, v]); });
         try {
-            return await useRpcResource(stub._rpcInnerDoFetch({
-                bindingName,
-                id,
-                method: request.method,
-                url: request.url,
-                headers: headerList,
-                body,
-            }), (res) => new Response(res.body, {
-                status: res.status,
-                statusText: res.statusText,
-                headers: res.headers,
-            }));
+            return await useRpcResource(dispatch({
+                op: 'innerDoFetch',
+                args: [{
+                        bindingName,
+                        id,
+                        method: request.method,
+                        url: request.url,
+                        headers: headerList,
+                        body,
+                    }],
+            }), (res) => {
+                if (!(res instanceof Response)) {
+                    return new Response('Nimbus: innerDoFetch returned an invalid result', { status: 502 });
+                }
+                return new Response(res.body, {
+                    status: res.status,
+                    statusText: res.statusText,
+                    headers: res.headers,
+                });
+            });
         }
         finally {
             disposeRpcResource(stub);

package/dist/fanout.d.ts

@@ -15,18 +15,12 @@
  */
 import { type FacetTaskFn } from './isolate-pool.js';
 import type { WorkerLoader } from './vendor/types.js';
-/**
- * The sibling-session namespace the peer-DO topology routes through. Ids are
- * derived from a name so a task key always lands on the same peer.
- */
-interface PeerSessionNamespace {
-    idFromName(name: string): DurableObjectId;
-    get(id: DurableObjectId): unknown;
-}
-/** The bindings a fan-out needs off the coordinator DO's env. */
+/** The bindings a fan-out needs off the coordinator DO's env. The host
+ *  namespace key is the composed one — whatever this host named its own
+ *  binding (default NIMBUS_SESSION); peers dispatch supervisorOp envelopes. */
 export interface FanoutEnv {
     LOADER?: WorkerLoader;
-    NIMBUS_SESSION?: PeerSessionNamespace;
+    NIMBUS_SESSION?: unknown;
 }
 /**
  * Threshold at which routing switches from coordinator-local loaders to
@@ -219,5 +213,4 @@ export declare class Fanout {
  * Tests use this to predict placement.
  */
 export declare function hashKeyToShard(key: string, peerCount: number): number;
-export {};
 //# sourceMappingURL=fanout.d.ts.map

package/dist/fanout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fanout.d.ts","sourceRoot":"","sources":["../src/fanout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGlE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD;;;GAGG;AACH,UAAU,oBAAoB;IAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC;CACnC;AAED,iEAAiE;AACjE,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,cAAc,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC;;;GAGG;AACH,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,qBAAqB,UAAmB,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,UAAqB,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,uCAAuC;AACvC,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,IAAI,EAAE,CAAC,CAAC;CACT;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7D;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA4BD;;;;;;;;GAQG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAE5B,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa;IAoBzE;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,UAAU,CAAC,CAAC,EAAE,CAAC,EACnB,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,EACtB,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,EAAE,CAAC;IASf,mEAAmE;IACnE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO;IAK7D;;;;;;OAMG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;YAOvC,aAAa;YAoCb,eAAe;CA2J9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAUrE"}
+{"version":3,"file":"fanout.d.ts","sourceRoot":"","sources":["../src/fanout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGlE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAOtD;;+EAE+E;AAC/E,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AAEjC;;;GAGG;AACH,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAC9C,eAAO,MAAM,qBAAqB,UAAmB,CAAC;AAEtD;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,UAAqB,CAAC;AAE3D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,uCAAuC;AACvC,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,IAAI,EAAE,CAAC,CAAC;CACT;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7D;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAWD;;;;;;;;GAQG;AACH,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAY;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgB;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;gBAE5B,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa;IAoBzE;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,UAAU,CAAC,CAAC,EAAE,CAAC,EACnB,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,EACtB,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,GACpB,OAAO,CAAC,CAAC,EAAE,CAAC;IASf,mEAAmE;IACnE,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO;IAK7D;;;;;;OAMG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;YAOvC,aAAa;YAoCb,eAAe;CA2J9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAUrE"}

package/dist/fanout.js

@@ -18,6 +18,7 @@ import { BindingError } from './vendor/errors.js';
 import { IsolatePool } from './isolate-pool.js';
 import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { describeError, isDoOverloaded, isTransientDoReset } from '@nimbus-sh/platform/oom-classify.js';
+import { hostNamespaceBinding, hostOpDispatch, } from './host-dispatch.js';
 /**
  * Threshold at which routing switches from coordinator-local loaders to
  * sibling Durable Objects.
@@ -70,21 +71,9 @@ export const PEER_OVERLOAD_BACKOFF_MS = [1000, 3000, 6000];
  * tolerates rather than by the barrier count.
  */
 export const FANOUT_PHASE_SIZE = 4;
-function isFanoutPeerStub(value) {
-    if ((typeof value !== 'object' && typeof value !== 'function') || value === null) {
-        return false;
-    }
-    const execute = Reflect.get(value, '_rpcFanoutExecute');
-    return typeof execute === 'function';
-}
-function fanoutPeerStub(value) {
-    if ((typeof value !== 'object' && typeof value !== 'function') || value === null) {
-        throw new BindingError('Fanout: NIMBUS_SESSION.get() did not return a peer stub.');
-    }
-    if (!isFanoutPeerStub(value)) {
-        throw new BindingError('Fanout: peer stub does not expose _rpcFanoutExecute().');
-    }
-    return value;
+// Task values retain the submitted function's type; validate the wire envelope.
+function isPeerResult(value) {
+    return value !== null && typeof value === 'object' && 'results' in value && Array.isArray(value.results);
 }
 /**
  * Two-tier fan-out pool. Constructed by the supervisor DO; routes
@@ -201,12 +190,10 @@ export class Fanout {
     }
     // ── Private: peer-DO dispatch (peer-DO fanout) ────────────────────────────
     async _dispatchPeerDo(tasks, fn) {
-        const ns = this.env?.NIMBUS_SESSION;
-        if (!ns || typeof ns.idFromName !== 'function' || typeof ns.get !== 'function') {
-            throw new BindingError('Fanout: env.NIMBUS_SESSION binding missing or invalid. ' +
-                'The peer-DO topology requires it. ' +
-                'Add the binding via durable_objects.bindings in wrangler.jsonc.');
-        }
+        // The peer-DO topology routes through the composed host namespace —
+        // a workspace host names its own binding, and its stub forwards one
+        // supervisorOp entrypoint, not private _rpc* methods.
+        const ns = hostNamespaceBinding(this.env ?? {}, 'Fanout');
         // Serialize the user function ONCE here on the supervisor side.
         // Each peer DO receives the same fnSource string; warm peer
         // loader isolates (keyed on fnHash) reuse across calls with
@@ -252,34 +239,43 @@ export class Fanout {
                     // stub points at a torn-down object, so a retry re-resolves the
                     // sibling by its stable id.
                     const peerStub = ns.get(id);
-                    const stub = fanoutPeerStub(peerStub);
                     try {
+                        const dispatch = hostOpDispatch(peerStub, `Fanout peer ${siblingName}`);
                         // Each peer DO RPC call uses ONE LOADER worker on its side.
                         // Supervisor → peer DO is a stub.fetch / RPC method call,
                         // NOT an env.LOADER.get(); that's the cap-sidestep that
                         // makes peer-DO fanout work.
-                        const rpcResp = await stub._rpcFanoutExecute(fnSource, peerArgs, {
-                            tag: this.opts.tag,
-                            timeoutMs: this.opts.timeoutMs,
-                            preamble: this.opts.preamble,
-                            wasmModules: this.opts.wasmModules,
-                            extraBindings: this.opts.extraBindings,
-                            omitSupervisor: this.opts.omitSupervisor,
-                            // INSTALL-HONESTY: forward the COORDINATOR's full doId so
-                            // the peer's IsolatePool can mint a SUPERVISOR
-                            // binding that routes back HERE (the user's session DO),
-                            // not to the peer DO itself. Without this, peer DOs'
-                            // env.SUPERVISOR.writeBatch / writeBatchStream / stdout /
-                            // ... write into the peer's own VFS — invisible to the
-                            // user. See INSTALL-HONESTY-retro.md.
-                            coordinatorDoId: this.coordDoId,
-                            // Credential source for peer-side writeBatchStream — the
-                            // invoking process pid, so package writes are authorized
-                            // as the user (not rejected as pid:0).
-                            supervisorPid: this.opts.supervisorPid,
+                        const rpcResp = await dispatch({
+                            op: 'fanoutExecute',
+                            args: [
+                                fnSource,
+                                peerArgs,
+                                {
+                                    tag: this.opts.tag,
+                                    timeoutMs: this.opts.timeoutMs,
+                                    preamble: this.opts.preamble,
+                                    wasmModules: this.opts.wasmModules,
+                                    extraBindings: this.opts.extraBindings,
+                                    omitSupervisor: this.opts.omitSupervisor,
+                                    // INSTALL-HONESTY: forward the COORDINATOR's full doId so
+                                    // the peer's IsolatePool can mint a SUPERVISOR
+                                    // binding that routes back HERE (the user's session DO),
+                                    // not to the peer DO itself. Without this, peer DOs'
+                                    // env.SUPERVISOR.writeBatch / writeBatchStream / stdout /
+                                    // ... write into the peer's own VFS — invisible to the
+                                    // user. See INSTALL-HONESTY-retro.md.
+                                    coordinatorDoId: this.coordDoId,
+                                    // Credential source for peer-side writeBatchStream — the
+                                    // invoking process pid, so package writes are authorized
+                                    // as the user (not rejected as pid:0).
+                                    supervisorPid: this.opts.supervisorPid,
+                                },
+                            ],
                         });
                         try {
-                            const peerResults = rpcResp.results ?? [];
+                            if (!isPeerResult(rpcResp))
+                                throw new BindingError(`Fanout peer '${siblingName}' returned no result array`);
+                            const peerResults = rpcResp.results;
                             if (peerResults.length !== bucket.length) {
                                 throw new Error(`peer DO returned ${peerResults.length} results for ${bucket.length} tasks ` +
                                     `(siblingName=${siblingName})`);

package/dist/generation.d.ts

@@ -14,6 +14,12 @@
  * counter, and bumps it once. The embedder reads `generation(ctx)` wherever it
  * needs the incarnation number — one source of truth instead of mirrored host
  * fields.
+ *
+ * This is also the allocator for a workspace's generation: an embedder
+ * composing NimbusWorkspace over its own Durable Object calls
+ * `adoptGeneration(ctx)` once per incarnation and passes `generation(ctx)`
+ * as the workspace's `generation` — the same persisted counter the session
+ * derives its pid generation from, so there is no second counter to keep.
  */
 /**
  * Storage key for the isolate-generation counter (cold-start +

package/dist/generation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generation.d.ts","sourceRoot":"","sources":["../src/generation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAsBD,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,yEAAyE;AACzE,wBAAsB,eAAe,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B3E;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAE3E;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYvD"}
+{"version":3,"file":"generation.d.ts","sourceRoot":"","sources":["../src/generation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,qEAAqE;AACrE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAsBD,6EAA6E;AAC7E,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED,yEAAyE;AACzE,wBAAsB,eAAe,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B3E;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAE3E;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYvD"}

package/dist/generation.js

@@ -14,6 +14,12 @@
  * counter, and bumps it once. The embedder reads `generation(ctx)` wherever it
  * needs the incarnation number — one source of truth instead of mirrored host
  * fields.
+ *
+ * This is also the allocator for a workspace's generation: an embedder
+ * composing NimbusWorkspace over its own Durable Object calls
+ * `adoptGeneration(ctx)` once per incarnation and passes `generation(ctx)`
+ * as the workspace's `generation` — the same persisted counter the session
+ * derives its pid generation from, so there is no second counter to keep.
  */
 import { errorText } from '@nimbus-sh/core/_shared/error-text.js';
 /**

package/dist/host-dispatch.d.ts

@@ -0,0 +1,6 @@
+import type { createSupervisorOpHandler } from '@nimbus-sh/core/workspace/supervisor-op.js';
+export type HostNamespaceBinding = Pick<DurableObjectNamespace, 'get' | 'idFromName' | 'idFromString'>;
+export type HostOpDispatch = ReturnType<typeof createSupervisorOpHandler>;
+export declare function hostNamespaceBinding(env: object | null | undefined, usage: string): HostNamespaceBinding;
+export declare function hostOpDispatch(stub: object, usage: string): HostOpDispatch;
+//# sourceMappingURL=host-dispatch.d.ts.map

package/dist/host-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-dispatch.d.ts","sourceRoot":"","sources":["../src/host-dispatch.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAE5F,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,sBAAsB,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,CAAC;AACvG,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAQ1E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,oBAAoB,CAOxG;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,CAW1E"}

package/dist/host-dispatch.js

@@ -0,0 +1,27 @@
+import { BindingError } from './vendor/errors.js';
+import { hostDispatchMethod, hostNamespace } from './composition.js';
+function isNamespace(value) {
+    return typeof Reflect.get(value, 'idFromName') === 'function'
+        && typeof Reflect.get(value, 'idFromString') === 'function'
+        && typeof Reflect.get(value, 'get') === 'function';
+}
+export function hostNamespaceBinding(env, usage) {
+    const name = hostNamespace();
+    const binding = env ? Reflect.get(env, name) : undefined;
+    if (binding === null || (typeof binding !== 'object' && typeof binding !== 'function') || !isNamespace(binding)) {
+        throw new BindingError(`${usage}: env.${name} must be the Durable Object namespace configured by composeFabric`);
+    }
+    return binding;
+}
+export function hostOpDispatch(stub, usage) {
+    const name = hostDispatchMethod();
+    if (stub === null || (typeof stub !== 'object' && typeof stub !== 'function')) {
+        throw new BindingError(`${usage}: the workspace namespace returned no stub`);
+    }
+    const dispatch = Reflect.get(stub, name);
+    if (typeof dispatch !== 'function') {
+        throw new BindingError(`${usage}: the workspace host must forward ${name}(envelope) to the runtime`);
+    }
+    // RpcStub.call would invoke a remote method named "call".
+    return (envelope) => Promise.resolve(Reflect.apply(dispatch, stub, [envelope]));
+}

package/dist/image-store.d.ts

@@ -92,10 +92,20 @@ export declare class ImageStore {
      * Materialize generated module sources in the content-addressed image store
      * and return the module-name → path map naming them.
      *
+     * Takes the images as a SEQUENCE, produced on demand and released as each
+     * one's slices land, so exactly one image's text is resident here. The old
+     * record-shaped parameter held every source for the whole call, and the
+     * caller held its own copy beside it: measured on a real-vite launch, the
+     * second image reported not one slice — ~25 MB of module text as UTF-16 in
+     * two places, plus the first image's just-freed 10.36 MB encode buffer, on a
+     * 128 MiB isolate. Yielding and dropping is what makes the peak one image
+     * instead of all of them; it is not a pacing question, and a fresh turn does
+     * not shrink a live heap.
+     *
      * Writing the sources here, once, is what lets the session stop holding
      * them: after this returns, the only thing it keeps is a path.
      */
-    materialize(pid: number, modules: Record<string, string>, pacer: TurnBudget): Promise<Record<string, string>>;
+    materialize(pid: number, images: AsyncIterable<readonly [string, string]> | Iterable<readonly [string, string]>, pacer: TurnBudget): Promise<Record<string, string>>;
     /**
      * Drop every image no running process boots from.
      *

package/dist/image-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image-store.d.ts","sourceRoot":"","sources":["../src/image-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,QAA0D,CAAC;AAErG;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,wEAAwE;IACxE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACjD,kDAAkD;IAClD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAClE,2EAA2E;IAC3E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,qDAAqD;IACrD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,UAAU;IAanB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAbzB,8EAA8E;IAC9E,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;OAMG;gBAEgB,KAAK,EAAE,MAAM,cAAc,EAC3B,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO;IAGnD;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,IAAI,IAAI;IAOjB;;;;;;OAMG;IACG,WAAW,CACf,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAoDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,KAAK;CAgBd"}
+{"version":3,"file":"image-store.d.ts","sourceRoot":"","sources":["../src/image-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,QAA0D,CAAC;AAErG;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,wEAAwE;IACxE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,wEAAwE;IACxE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACjD,kDAAkD;IAClD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IAClE,2EAA2E;IAC3E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,qDAAqD;IACrD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,UAAU;IAanB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAbzB,8EAA8E;IAC9E,OAAO,CAAC,cAAc,CAA+B;IACrD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;OAMG;gBAEgB,KAAK,EAAE,MAAM,cAAc,EAC3B,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO;IAGnD;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,IAAI,IAAI;IAOjB;;;;;;;;;;;;;;;;OAgBG;IACG,WAAW,CACf,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACtF,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAuDlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,KAAK;CAgBd"}

package/dist/image-store.js

@@ -84,32 +84,42 @@ export class ImageStore {
      * Materialize generated module sources in the content-addressed image store
      * and return the module-name → path map naming them.
      *
+     * Takes the images as a SEQUENCE, produced on demand and released as each
+     * one's slices land, so exactly one image's text is resident here. The old
+     * record-shaped parameter held every source for the whole call, and the
+     * caller held its own copy beside it: measured on a real-vite launch, the
+     * second image reported not one slice — ~25 MB of module text as UTF-16 in
+     * two places, plus the first image's just-freed 10.36 MB encode buffer, on a
+     * 128 MiB isolate. Yielding and dropping is what makes the peak one image
+     * instead of all of them; it is not a pacing question, and a fresh turn does
+     * not shrink a live heap.
+     *
      * Writing the sources here, once, is what lets the session stop holding
      * them: after this returns, the only thing it keeps is a path.
      */
-    async materialize(pid, modules, pacer) {
+    async materialize(pid, images, pacer) {
         const fs = this.blobs();
-        const images = {};
-        const sources = new Map();
-        for (const [moduleName, source] of Object.entries(modules)) {
-            const path = facetImagePath(await facetImageDigest(source));
-            images[moduleName] = path;
-            sources.set(path, source);
-            await pacer.spend(source.length);
-        }
-        // Register the WHOLE root set here, in one synchronous step, before any
-        // byte of it exists on disk. That ordering is the entire protocol between
-        // a launch and the sweep: an image is rooted from before it is written, so
-        // a sweep can never observe a file this launch has written but not yet
-        // claimed. The old loop achieved it by not awaiting at all, which read as
-        // "the writes must not be interrupted" — they may be. What must not be
-        // interrupted is the gap between writing and rooting, and rooting first
-        // closes it for every write that follows, however many turns they span.
-        this.residentImages.set(pid, [...sources.keys()]);
+        const paths = {};
+        // The root set is this ARRAY, held by the sweep's map from before the
+        // first byte and appended to as each image is named. Rooting an image
+        // before its own first byte is the whole of the protocol: a sweep that
+        // runs while this launch is suspended sees every image already written as
+        // rooted, and an image not yet written is not yet a file. The array
+        // identity is what makes an append visible — do not replace it.
+        const rooted = [];
+        this.residentImages.set(pid, rooted);
         fs.mkdirp(FACET_IMAGE_DIR);
-        for (const [path, source] of sources) {
+        let count = 0;
+        for await (const [moduleName, source] of images) {
+            const path = facetImagePath(await facetImageDigest(source));
+            paths[moduleName] = path;
+            rooted.push(path);
+            count++;
             const stored = path.replace(/^\/+/, '');
             const bytes = new TextEncoder().encode(source);
+            console.log('[image-store] pid=' + pid + ' image ' + count + ' ' + moduleName + ' → '
+                + path.slice(-12) + ' ' + bytes.byteLength + ' bytes, slice=' + FACET_IMAGE_WRITE_SLICE_BYTES
+                + ' turns=' + pacer.chunks);
             // An image at its full size is a COMPLETE one: a write only ever grows
             // the file from offset zero, so a write cut short by a reset leaves a
             // strictly shorter file and fails this test. Size is enough of a check
@@ -138,7 +148,8 @@ export class ImageStore {
             } while (offset < bytes.byteLength);
         }
         this.sweep(fs);
-        return images;
+        console.log('[image-store] pid=' + pid + ' materialized ' + count + ' image(s) in ' + pacer.chunks + ' turn(s)');
+        return paths;
     }
     /**
      * Drop every image no running process boots from.