@nimbus-sh/fabric 0.7.1 → 0.9.0

package/dist/process-fabric.d.ts

@@ -73,7 +73,7 @@
  * bytes, and the host reads them off the coordinator's own disk through the
  * `ResidentDiskReader` it was given.
  */
-import type { HostRoute } from './composition.js';
+import type { SupervisorBindingProps } from './supervisor-props.js';
 import { z } from 'zod/v4';
 import type { RouteableFacetTarget } from '@nimbus-sh/core/runtime/os-contracts.js';
 import type { ServiceStub } from './vendor/types.js';
@@ -109,6 +109,7 @@ export declare const ResidentCodeSpecSchema: z.ZodObject<{
     }, z.core.$strip>]>>;
     vfsWasmModules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     vfsTextModules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    vfsCommonJsPacks: z.ZodOptional<z.ZodArray<z.ZodString>>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     globalOutbound: z.ZodOptional<z.ZodNullable<z.ZodCustom<ServiceStub, ServiceStub>>>;
 }, z.core.$strip>;
@@ -136,6 +137,7 @@ export declare function residentBootSpecSchema<Stage extends z.ZodType>(stageSch
         }, z.core.$strip>]>>;
         vfsWasmModules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         vfsTextModules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        vfsCommonJsPacks: z.ZodOptional<z.ZodArray<z.ZodString>>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         globalOutbound: z.ZodOptional<z.ZodNullable<z.ZodCustom<ServiceStub, ServiceStub>>>;
     }, z.core.$strip>;
@@ -178,7 +180,7 @@ export declare const FACET_IMAGE_DIR = "var/lib/nimbus/facet-images";
  * generated text into `startArgs` would make every image per-PROGRAM and
  * shareable across spawns and sessions; the sweep bounds the store either way.
  */
-export declare function facetImageDigest(source: string): Promise<string>;
+export declare function facetImageDigest(image: string | Uint8Array): Promise<string>;
 export declare function facetImagePath(digest: string): string;
 /**
  * The digest an image path claims, for the reader's verify-on-read. Content
@@ -214,21 +216,30 @@ export interface ResidentDiskReader {
  * so the worker config can tell "embedder takes the env" from the default.
  */
 export declare function residentLoaderConfig(spec: ResidentCodeSpec, disk: ResidentDiskReader): Promise<Record<string, unknown>>;
+/**
+ * One image holding many `{ cjs }` modules: a JSON index of `[name, length]`
+ * rows, a newline, and the module texts back to back. Lengths are UTF-16 code
+ * units, the unit the decoded text is sliced in, so decoding copies nothing:
+ * each module is a slice of the one string read.
+ *
+ * Encoded as its parts, in order, never joined: the image store encodes them
+ * straight into the image's bytes, and a joined copy would be a second full
+ * copy of the program's code on the coordinator.
+ */
+export declare function encodeCommonJsPack(modules: Record<string, string>): string[];
+export declare function decodeCommonJsPack(pack: string): Record<string, {
+    cjs: string;
+}>;
 /**
  * The identity a resident process's SUPERVISOR binding is minted for. Always
  * the COORDINATOR's — a process hosted somewhere else still reads and writes
- * the user's disk, and still reports to the user's process table.
+ * the user's disk, and still reports to the user's process table. Minted by
+ * `supervisorBindingProps` on the coordinator; `route` is absent only when
+ * the coordinator's isolate composed nothing, in which case no supervisor
+ * binding is minted either.
  */
-export interface ResidentSupervisorProps {
-    doId: string;
-    pid: number;
+export interface ResidentSupervisorProps extends SupervisorBindingProps {
     writerId: string;
-    /**
-     * The way back to the coordinator, minted with the binding. Absent only
-     * when the coordinator's isolate composed nothing, in which case no
-     * supervisor binding is minted either.
-     */
-    route?: HostRoute;
 }
 /** Everything a host needs to run one process. Substrate-free by construction. */
 export interface ProcessHostParams {
@@ -253,6 +264,13 @@ export interface ProcessHostParams {
         name: string;
         durable: boolean;
     };
+    /**
+     * Bytes the process's store is filled with before it runs (its data plan).
+     * The hosting actor's storage ledger (N18) admits them under the facet's
+     * name before the facet starts: ENOSPC, and no facet, when they would cross
+     * the storage limit.
+     */
+    storageBytes?: number;
 }
 /**
  * One resident process, as its coordinator sees it. Identical in meaning on
@@ -321,17 +339,14 @@ export interface ProcessImageDelivery {
      *   across one. A peer-hosted process can only ever receive an image
      *   through `moduleCeilingBytes` below, or by streaming it.
      *
-     * Reachable in PRODUCTION but not from a type checker or `wrangler dev`, and
-     * the difference is worth stating precisely because inferring one from the
-     * other is how a wrong claim gets written down. `@cloudflare/workers-types`
-     * 4.20260605.1 declares `get`/`abort`/`delete` and no `clone`, and the pinned
-     * workerd is 1.20260603.1 — but the deployed runtime is Cloudflare's, not the
-     * one wrangler bundles, and there it is present and works: enumerating the
-     * binding on a live Worker at this repo's own compatibility_date returns
-     * `["abort","clone","constructor","delete","get"]`, and a clone into a
-     * destination of a DIFFERENT class had all 500 seeded files readable from the
-     * destination's CONSTRUCTOR. No compat-date gate. So calling it is a
-     * lockfile-and-types problem, not a platform one.
+     * Present in production, and since the pins moved to
+     * `@cloudflare/workers-types` 5.20260928.1 and workerd 1.20260926.1 also in
+     * the type checker and `wrangler dev` (DurableObjectFacets.clone;
+     * src/workerd/api/actor-state.h). Before that the types declared no `clone`
+     * and the pinned workerd 1.20260603.1 lacked it, while on a live Worker the
+     * binding enumerated `["abort","clone","constructor","delete","get"]` and a
+     * clone into a destination of a DIFFERENT class had all 500 seeded files
+     * readable from the destination's CONSTRUCTOR. No compat-date gate.
      *
      * The hazard that comes with it, measured rather than assumed: ANY `src`
      * that does not resolve to a populated facet — a typo, a name not created
@@ -382,6 +397,8 @@ export interface OneShotCodeSpec {
     mainModule: string;
     modules: Record<string, string | {
         wasm: ArrayBuffer;
+    } | {
+        cjs: string;
     }>;
 }
 /**
@@ -524,6 +541,8 @@ export interface ResidentProcessSpawn {
         name: string;
         durable: boolean;
     };
+    /** See {@link ProcessHostParams.storageBytes}. */
+    storageBytes?: number;
     /**
      * Called before any concrete host capability can expose this writer.
      * A spawn must not proceed unless the supervisor accepts the authority.

package/dist/process-fabric.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-fabric.d.ts","sourceRoot":"","sources":["../src/process-fabric.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,MAAM,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;iBA0CjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK;;;;;;;;;;;;;;;;;4BAKjF;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAU7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,gCAAgC,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGtE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAID;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmBlC;AA2BD;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,IAAI,EAAE,gBAAgB,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;CAC5C;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,uDAAuD;IACvD,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD;;;OAGG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,uEAAuE;IACvE,QAAQ,IAAI,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;CAC5C;AAED;;;;GAIG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;CACzD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;OAQG;IACH,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACjC,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C;;;;;;;;;OASG;IACH,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,kBAAkB,KAC3B,WAAW,CAAC;AAIjB;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAqB;;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;gBAM/B,IAAI,EAAE;QAChB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,WAAW,EAAE,oBAAoB,CAAC;QAClC,IAAI,EAAE,MAAM,IAAI,CAAC;QACjB,QAAQ,EAAE,MAAM,MAAM,CAAC;KACxB;IAcD;;;;OAIG;IACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAI1B,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,uEAAuE;IACvE,iBAAiB,IAAI,MAAM;IAI3B,2DAA2D;IAC3D,IAAI,IAAI,IAAI;CAKb;AAID,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,aAAa,EAAE,aAAa,CAAC;IAC7B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,IAAI,EAAE,gBAAgB,CAAC;IACvB,uDAAuD;IACvD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3C;;;OAGG;IACH,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,iFAAiF;IACjF,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7C;AASD,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAE9C;;;;;;;;OAQG;IACG,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAyDxF"}
+{"version":3,"file":"process-fabric.d.ts","sourceRoot":"","sources":["../src/process-fabric.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0EG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,MAAM,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;iBAkDjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK;;;;;;;;;;;;;;;;;;4BAKjF;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAU7C;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,gCAAgC,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAKlF;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAID;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC1D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA8BlC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAS5E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAWhF;AA4BD;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAwB,SAAQ,sBAAsB;IACrE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,IAAI,EAAE,gBAAgB,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3C;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,uDAAuD;IACvD,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD;;;OAGG;IACH,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5D;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,uEAAuE;IACvE,QAAQ,IAAI,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAAC;IAC/C;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC;CAC5C;AAED;;;;GAIG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,GAAG;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;OAQG;IACH,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACjC,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C;;;;;;;;;OASG;IACH,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACzD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,kBAAkB,KAC3B,WAAW,CAAC;AAIjB;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAqB;;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;gBAM/B,IAAI,EAAE;QAChB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B,WAAW,EAAE,oBAAoB,CAAC;QAClC,IAAI,EAAE,MAAM,IAAI,CAAC;QACjB,QAAQ,EAAE,MAAM,MAAM,CAAC;KACxB;IAcD;;;;OAIG;IACH,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC;IAI1B,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED,uEAAuE;IACvE,iBAAiB,IAAI,MAAM;IAI3B,2DAA2D;IAC3D,IAAI,IAAI,IAAI;CAKb;AAID,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,aAAa,EAAE,aAAa,CAAC;IAC7B,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,IAAI,EAAE,gBAAgB,CAAC;IACvB,uDAAuD;IACvD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3C,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,iBAAiB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,iFAAiF;IACjF,eAAe,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7C;AASD,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,WAAW;IAE9C;;;;;;;;OAQG;IACG,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA0DxF"}

package/dist/process-fabric.js

@@ -115,6 +115,14 @@ export const ResidentCodeSpecSchema = z.object({
      * image store below and the spec names it.
      */
     vfsTextModules: z.record(z.string(), z.string()).optional(),
+    /**
+     * VFS paths of generated CommonJS PACKS (encodeCommonJsPack): each image
+     * carries many `{ cjs }` modules, and the map gains every one of them at
+     * load. A node process's module cells travel this way — one module per
+     * file, so the guest's registry compiles only what the program requires,
+     * and one image per launch, so the boot spec names a path and not thousands.
+     */
+    vfsCommonJsPacks: z.array(z.string()).optional(),
     /**
      * The isolate's exact `env`: one entry per binding the embedder minted,
      * carried by reference so loopback stubs survive untouched. Defined —
@@ -179,8 +187,10 @@ export const FACET_IMAGE_DIR = 'var/lib/nimbus/facet-images';
  * generated text into `startArgs` would make every image per-PROGRAM and
  * shareable across spawns and sessions; the sweep bounds the store either way.
  */
-export async function facetImageDigest(source) {
-    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(source));
+export async function facetImageDigest(image) {
+    // An image is its UTF-8 bytes; a caller holding them is not made to encode a second copy.
+    const bytes = typeof image === 'string' ? new TextEncoder().encode(image) : image;
+    const digest = await crypto.subtle.digest('SHA-256', bytes);
     return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, '0')).join('');
 }
 export function facetImagePath(digest) {
@@ -212,13 +222,24 @@ export async function residentLoaderConfig(spec, disk) {
     const resolved = {};
     for (const [moduleName, path] of Object.entries(spec.vfsWasmModules ?? {})) {
         const bytes = await disk.readFile(path);
+        // The read's own buffer when it fits exactly, and only otherwise a copy.
+        // These are the largest members a spec carries — ruby's interpreter image
+        // is 34.3 MiB, esbuild's 13.3 — and an unconditional slice held both
+        // copies at once in the coordinator's 128 MiB isolate, at the one moment
+        // the module map is also resident.
+        const exact = bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength;
         resolved[moduleName] = {
-            wasm: bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength),
+            wasm: exact
+                ? bytes.buffer
+                : bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength),
         };
     }
     for (const [moduleName, path] of Object.entries(spec.vfsTextModules ?? {})) {
         resolved[moduleName] = await readFacetImage(disk, path);
     }
+    for (const path of spec.vfsCommonJsPacks ?? []) {
+        Object.assign(resolved, decodeCommonJsPack(await readFacetImage(disk, path)));
+    }
     return {
         compatibilityDate: spec.compatibilityDate,
         compatibilityFlags: spec.compatibilityFlags,
@@ -228,6 +249,39 @@ export async function residentLoaderConfig(spec, disk) {
         ...(spec.globalOutbound !== undefined ? { globalOutbound: spec.globalOutbound } : {}),
     };
 }
+/**
+ * One image holding many `{ cjs }` modules: a JSON index of `[name, length]`
+ * rows, a newline, and the module texts back to back. Lengths are UTF-16 code
+ * units, the unit the decoded text is sliced in, so decoding copies nothing:
+ * each module is a slice of the one string read.
+ *
+ * Encoded as its parts, in order, never joined: the image store encodes them
+ * straight into the image's bytes, and a joined copy would be a second full
+ * copy of the program's code on the coordinator.
+ */
+export function encodeCommonJsPack(modules) {
+    const index = [];
+    const parts = [''];
+    for (const [name, text] of Object.entries(modules)) {
+        index.push([name, text.length]);
+        parts.push(text);
+    }
+    parts[0] = JSON.stringify(index) + '\n';
+    return parts;
+}
+export function decodeCommonJsPack(pack) {
+    const newline = pack.indexOf('\n');
+    const index = z.array(z.tuple([z.string(), z.number().int().nonnegative()])).parse(JSON.parse(pack.slice(0, newline)));
+    const modules = {};
+    let offset = newline + 1;
+    for (const [name, length] of index) {
+        modules[name] = { cjs: pack.slice(offset, offset + length) };
+        offset += length;
+    }
+    if (offset !== pack.length)
+        throw new Error(`Nimbus: CommonJS pack holds ${pack.length - offset} bytes its index does not name`);
+    return modules;
+}
 /**
  * Read one content-addressed facet image and verify it against the digest its
  * path claims. Content addressing is only a guarantee if the bytes are checked
@@ -240,13 +294,14 @@ async function readFacetImage(disk, path) {
     if (!expected) {
         throw new Error(`Nimbus: '${path}' is not a content-addressed facet image path`);
     }
-    const source = new TextDecoder().decode(await disk.readFile(path));
-    const actual = await facetImageDigest(source);
+    // Verified from the bytes read, and decoded only after: re-encoding the decoded string held a third copy of the largest member.
+    const bytes = await disk.readFile(path);
+    const actual = await facetImageDigest(bytes);
     if (actual !== expected) {
         throw new Error(`Nimbus: facet image '${path}' does not match its digest (read ${actual}); `
             + 'the image store is corrupt and the process cannot boot from it');
     }
-    return source;
+    return new TextDecoder().decode(bytes);
 }
 // ── Handle ──────────────────────────────────────────────────────────────────
 /**
@@ -350,6 +405,7 @@ export class ProcessFabric {
                 writerId,
                 startArgs: spawn.startArgs,
                 ...(spawn.facet !== undefined ? { facet: spawn.facet } : {}),
+                ...(spawn.storageBytes !== undefined ? { storageBytes: spawn.storageBytes } : {}),
             });
         }
         catch (error) {

package/dist/process-host.d.ts

@@ -64,7 +64,7 @@
  * that pair unforgeable by anything that did not open the process.
  */
 import { type ProcessHost, type ResidentDiskReader } from './process-fabric.js';
-import { type HostRoute } from './composition.js';
+import type { HostRoute } from './composition.js';
 /** The substrates this deployment can be configured for. */
 export type ProcessHostMode = 'facet' | 'peer';
 /**
@@ -84,6 +84,8 @@ export interface HostProcessOpts {
     route?: HostRoute;
     pid: number;
     writerId: string;
+    /** The coordinator instance's delivery incarnation, minted into the SUPERVISOR binding (ResidentSupervisorProps). */
+    hostIncarnation?: string;
     workerKey: string;
     /** Unforgeable capability for the fetch-semantic WebSocket hop. */
     webSocketCapability: string;

package/dist/process-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-host.d.ts","sourceRoot":"","sources":["../src/process-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAOH,OAAO,EAGL,KAAK,WAAW,EAIhB,KAAK,kBAAkB,EAExB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7D,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,kBAAkB,GAC7B,WAAW,CAIb;AA+ED,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AAaD;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AACvE,eAAO,MAAM,kCAAkC,yCAAyC,CAAC;AAiUzF;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAWhE"}
+{"version":3,"file":"process-host.d.ts","sourceRoot":"","sources":["../src/process-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AAOH,OAAO,EAGL,KAAK,WAAW,EAIhB,KAAK,kBAAkB,EAExB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGlD,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,MAAM,CAAC;AAE/C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,MAAM,kBAAkB,GAC7B,WAAW,CAIb;AA0ED,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,qHAAqH;IACrH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5B,IAAI,EAAE,cAAc,GAAG,IAAI,CAAC;CAC7B;AAaD;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,8BAA8B,CAAC;AACvE,eAAO,MAAM,kCAAkC,yCAAyC,CAAC;AAqUzF;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAWhE"}

package/dist/process-host.js

@@ -64,14 +64,14 @@
  * that pair unforgeable by anything that did not open the process.
  */
 import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
-import { isTransientDoReset } from '@nimbus-sh/platform/oom-classify.js';
+import { classifyDoCall, isRetryableDoCall } from '@nimbus-sh/platform/oom-classify.js';
 import { PEER_RETRY_BACKOFF_MS, PEER_TRANSIENT_RESET_RETRIES } from './fanout.js';
 import { hostNamespaceBinding, hostOpDispatch } from './host-dispatch.js';
 import { z } from 'zod/v4';
 import { DYNAMIC_WORKER_CODE_LIMIT_BYTES } from './budgets.js';
 import { BindingError } from './vendor/errors.js';
 import { processes, } from './workerd-facet-host.js';
-import { hostRoute } from './composition.js';
+import { supervisorBindingProps } from './supervisor-props.js';
 /**
  * The substrate for this deployment, resolved once. The mode arrives already
  * decided — the embedder owns the config var that picks it, and refuses an
@@ -109,15 +109,10 @@ class FacetProcessHost {
         this.coordDoId = ctx.id.toString();
     }
     runOnce(params, consume) {
-        return processes(this.ctx, this.env).run({ doId: this.coordDoId, pid: params.pid, writerId: params.writerId, route: hostRoute() ?? undefined }, params, consume);
+        return processes(this.ctx, this.env).run({ ...supervisorBindingProps(this.ctx, params.pid), writerId: params.writerId }, params, consume);
     }
     async open(params) {
-        const supervisor = {
-            doId: this.coordDoId,
-            pid: params.pid,
-            writerId: params.writerId,
-            route: hostRoute() ?? undefined,
-        };
+        const supervisor = { ...supervisorBindingProps(this.ctx, params.pid), writerId: params.writerId };
         const { name, ...facet } = processes(this.ctx, this.env).spawn(this.disk, supervisor, params);
         return {
             ...facet,
@@ -261,7 +256,7 @@ class PeerProcessHost {
      * worker of the coordinator here exactly as it does on `facet`.
      */
     runOnce(params, consume) {
-        return processes(this.ctx, this.env).run({ doId: this.coordDoId, pid: params.pid, writerId: params.writerId, route: hostRoute() ?? undefined }, params, consume);
+        return processes(this.ctx, this.env).run({ ...supervisorBindingProps(this.ctx, params.pid), writerId: params.writerId }, params, consume);
     }
     async open(params) {
         if (params.facet) {
@@ -280,11 +275,15 @@ class PeerProcessHost {
         // also what keeps the hosting DO resident. It settles when a `lifetime`
         // runner exits or when a `boot` runner's host is cancelled, and rejects if
         // the peer dies under either.
+        // The peer mints the process's binding from these, for THIS object: the
+        // coordinator's doId, route and delivery instance.
+        const supervisor = supervisorBindingProps(this.ctx, params.pid);
         const hostLeg = placement.stub._rpcHostProcess(params.boot, {
-            coordinatorDoId: this.coordDoId,
-            route: hostRoute() ?? undefined,
-            pid: params.pid,
+            coordinatorDoId: supervisor.doId,
+            route: supervisor.route,
+            pid: supervisor.pid,
             writerId: params.writerId,
+            hostIncarnation: supervisor.hostIncarnation,
             workerKey: params.workerKey,
             webSocketCapability,
             startArgs: params.startArgs,
@@ -396,7 +395,7 @@ class PeerProcessHost {
                 return probe;
             }
             catch (err) {
-                if (attempt < PEER_TRANSIENT_RESET_RETRIES && isTransientDoReset(err)) {
+                if (attempt < PEER_TRANSIENT_RESET_RETRIES && isRetryableDoCall(classifyDoCall(err))) {
                     await new Promise((r) => setTimeout(r, PEER_RETRY_BACKOFF_MS[Math.min(attempt, PEER_RETRY_BACKOFF_MS.length - 1)]));
                     continue;
                 }

package/dist/supervisor-props.d.ts

@@ -0,0 +1,47 @@
+/**
+ * supervisor-props.ts — what every SUPERVISOR binding a Durable Object mints
+ * for a process carries, and the one rule for naming the instance in it.
+ *
+ * A binding names its host INSTANCE (`hostIncarnation`) exactly when a
+ * mutation sent through it can be delivered once
+ * (@nimbus-sh/core/workspace/supervisor-delivery.js): the host opened a
+ * delivery store, the binding acts as a real process (SupervisorRPC refuses
+ * every filesystem mutation of pid 0), and it routes back to this very
+ * object rather than another (a fanout pool writes to its coordinator).
+ * Minting every binding here is what keeps a new mint site from forgetting
+ * that, which would fail silently: its mutations would simply never be
+ * re-sent.
+ */
+import { type HostRoute } from './composition.js';
+/** The props every SUPERVISOR binding for a process carries. */
+export interface SupervisorBindingProps {
+    /** The Durable Object the binding's calls reach. */
+    doId: string;
+    /** The process the calls act as; 0 is none, and can mutate nothing. */
+    pid: number;
+    /** The way back, minted with the binding in the host's isolate. */
+    route?: HostRoute;
+    /** The host instance that applies this binding's mutations once, when there is one. */
+    hostIncarnation?: string;
+}
+/**
+ * The props of a SUPERVISOR binding minted in the Durable Object whose state
+ * is `ctx`, for process `pid`, reaching `options.doId` (this object by
+ * default) by `options.route` (this isolate's composition by default).
+ */
+export declare function supervisorBindingProps(ctx: {
+    readonly id: {
+        toString(): string;
+    };
+}, pid: number, options?: {
+    doId?: string;
+    route?: HostRoute;
+}): SupervisorBindingProps;
+/**
+ * `key`, for a loader cache entry whose worker holds a binding with `props`:
+ * made specific to the host instance the binding names, since the loader
+ * outlives that instance and the next one refuses every mutation the binding
+ * would deliver. A binding that names none keeps `key`, and its warm worker.
+ */
+export declare function supervisorLoaderKey(key: string, props: Pick<SupervisorBindingProps, 'hostIncarnation'>): string;
+//# sourceMappingURL=supervisor-props.d.ts.map

package/dist/supervisor-props.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisor-props.d.ts","sourceRoot":"","sources":["../src/supervisor-props.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7D,gEAAgE;AAChE,MAAM,WAAW,sBAAsB;IACrC,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,GAAG,EAAE,MAAM,CAAC;IACZ,mEAAmE;IACnE,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,uFAAuF;IACvF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE;IAAE,QAAQ,CAAC,EAAE,EAAE;QAAE,QAAQ,IAAI,MAAM,CAAA;KAAE,CAAA;CAAE,EAC5C,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAO,GACjD,sBAAsB,CAMxB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,iBAAiB,CAAC,GAAG,MAAM,CAE/G"}

package/dist/supervisor-props.js

@@ -0,0 +1,37 @@
+/**
+ * supervisor-props.ts — what every SUPERVISOR binding a Durable Object mints
+ * for a process carries, and the one rule for naming the instance in it.
+ *
+ * A binding names its host INSTANCE (`hostIncarnation`) exactly when a
+ * mutation sent through it can be delivered once
+ * (@nimbus-sh/core/workspace/supervisor-delivery.js): the host opened a
+ * delivery store, the binding acts as a real process (SupervisorRPC refuses
+ * every filesystem mutation of pid 0), and it routes back to this very
+ * object rather than another (a fanout pool writes to its coordinator).
+ * Minting every binding here is what keeps a new mint site from forgetting
+ * that, which would fail silently: its mutations would simply never be
+ * re-sent.
+ */
+import { supervisorDeliveryProps } from '@nimbus-sh/core/workspace/supervisor-delivery.js';
+import { hostRoute } from './composition.js';
+/**
+ * The props of a SUPERVISOR binding minted in the Durable Object whose state
+ * is `ctx`, for process `pid`, reaching `options.doId` (this object by
+ * default) by `options.route` (this isolate's composition by default).
+ */
+export function supervisorBindingProps(ctx, pid, options = {}) {
+    const own = ctx.id.toString();
+    const doId = options.doId ?? own;
+    const route = options.route ?? hostRoute() ?? undefined;
+    const delivery = pid > 0 && doId === own ? supervisorDeliveryProps(ctx) : {};
+    return { doId, pid, route, ...delivery };
+}
+/**
+ * `key`, for a loader cache entry whose worker holds a binding with `props`:
+ * made specific to the host instance the binding names, since the loader
+ * outlives that instance and the next one refuses every mutation the binding
+ * would deliver. A binding that names none keeps `key`, and its warm worker.
+ */
+export function supervisorLoaderKey(key, props) {
+    return props.hostIncarnation === undefined ? key : `${key}:${props.hostIncarnation}`;
+}

package/dist/timers.d.ts

@@ -51,9 +51,12 @@ export declare const TIMER_REASONS_KEY = "w1_next_alarm_reasons";
  * The host instance carrying the per-instance timer chain. The field lives on
  * the embedder's DO instance so one chain serializes every timer-map
  * read-modify-write for that instance (see {@link Timers.schedule}).
+ * `_timerEpoch` counts {@link Timers.reset}s: a schedule or dispatch writes
+ * only while the epoch it was requested in is still current.
  */
 export interface TimerHost {
     _timerChain?: Promise<unknown>;
+    _timerEpoch?: number;
 }
 /**
  * What one timer handler may return: nothing, or a deadline this reason
@@ -113,6 +116,15 @@ export declare class Timers {
      * subsystem's in-isolate setTimeout fallback continues to work).
      */
     schedule(reason: string, whenMs: number): Promise<boolean>;
+    /**
+     * Void every timer of this instance: a schedule or dispatch already
+     * requested — still queued on the chain, or a dispatch whose handlers are
+     * running — writes no reason and arms no alarm from here on. For a
+     * deliberate end of the actor's state (a session destroy): call it before
+     * wiping storage and deleting the alarm, so nothing in flight writes the
+     * map back or re-arms after the wipe. Requests made after it proceed.
+     */
+    reset(): void;
     /**
      * Multi-reason timer dispatcher. Called from the DO's `alarm()` handler
      * with the embedder's handler map.

package/dist/timers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timers.d.ts","sourceRoot":"","sources":["../src/timers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,QAAQ,CAAC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;CAChC;AAmBD;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,qEAAqE;AACrE,MAAM,MAAM,aAAa,GAAG,MAAM,CAChC,MAAM,EACN,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,KAAK,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CACzF,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,MAAM,CAEjE;AAED,qBAAa,MAAM;IAEf,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,YAAY;IAGpC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4C1D;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CACN,QAAQ,EAAE,aAAa,EACvB,aAAa,CAAC,EAAE,MAAM,IAAI,EAC1B,SAAS,CAAC,EAAE,cAAc,GACzB,OAAO,CAAC,IAAI,CAAC;CAWjB"}
+{"version":3,"file":"timers.d.ts","sourceRoot":"","sources":["../src/timers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,QAAQ,CAAC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjD;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,YAAY,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAmBD;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,qEAAqE;AACrE,MAAM,MAAM,aAAa,GAAG,MAAM,CAChC,MAAM,EACN,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,KAAK,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CACzF,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,GAAG,MAAM,CAEjE;AAED,qBAAa,MAAM;IAEf,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,YAAY;IAGpC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkD1D;;;;;;;OAOG;IACH,KAAK,IAAI,IAAI;IAIb;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CACN,QAAQ,EAAE,aAAa,EACvB,aAAa,CAAC,EAAE,MAAM,IAAI,EAC1B,SAAS,CAAC,EAAE,cAAc,GACzB,OAAO,CAAC,IAAI,CAAC;CAajB"}

package/dist/timers.js

@@ -103,6 +103,7 @@ export class Timers {
             arms.push({ reason, whenMs });
             return Promise.resolve(true);
         }
+        const epoch = host._timerEpoch ?? 0;
         // Serialize every read-modify-write of the reasons map through one
         // per-instance chain: two schedulers firing back-to-back from one activity
         // hook would otherwise interleave their get→put cycles and silently drop
@@ -113,15 +114,21 @@ export class Timers {
                 if (typeof setAlarmFn !== 'function')
                     return false;
                 const existing = (await ctx.storage.get(TIMER_REASONS_KEY));
+                // Requested before a reset: it belongs to the timers the reset voided.
+                if ((host._timerEpoch ?? 0) !== epoch)
+                    return false;
                 const map = { ...(existing || {}) };
                 // Earliest-deadline-first: only update if new request is sooner or
                 // this reason has no pending entry.
+                let written;
                 if (!(reason in map) || whenMs < map[reason]) {
                     map[reason] = whenMs;
-                    await ctx.storage.put(TIMER_REASONS_KEY, map);
+                    written = ctx.storage.put(TIMER_REASONS_KEY, map);
                 }
-                const earliest = Math.min(...Object.values(map));
-                setAlarmFn.call(ctx.storage, earliest);
+                // Issued in the turn the epoch was checked in: a reset after this
+                // point wipes and disarms after these, never before.
+                setAlarmFn.call(ctx.storage, Math.min(...Object.values(map)));
+                await written;
                 return true;
             }
             catch (e) {
@@ -133,6 +140,17 @@ export class Timers {
         host._timerChain = chained;
         return chained;
     }
+    /**
+     * Void every timer of this instance: a schedule or dispatch already
+     * requested — still queued on the chain, or a dispatch whose handlers are
+     * running — writes no reason and arms no alarm from here on. For a
+     * deliberate end of the actor's state (a session destroy): call it before
+     * wiping storage and deleting the alarm, so nothing in flight writes the
+     * map back or re-arms after the wipe. Requests made after it proceed.
+     */
+    reset() {
+        this.host._timerEpoch = (this.host._timerEpoch ?? 0) + 1;
+    }
     /**
      * Multi-reason timer dispatcher. Called from the DO's `alarm()` handler
      * with the embedder's handler map.
@@ -155,14 +173,22 @@ export class Timers {
      */
     dispatch(handlers, onLegacyAlarm, alarmInfo) {
         const { host, ctx } = this;
+        const epoch = host._timerEpoch ?? 0;
+        const current = () => (host._timerEpoch ?? 0) === epoch;
         // Same serialization as schedule: the dispatcher's read→handlers→write
         // cycle must not interleave with an activity-hook schedule.
-        const chained = (host._timerChain ?? Promise.resolve()).then(() => dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo), () => dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo));
+        const chained = (host._timerChain ?? Promise.resolve()).then(() => dispatchBody(ctx, current, handlers, onLegacyAlarm, alarmInfo), () => dispatchBody(ctx, current, handlers, onLegacyAlarm, alarmInfo));
         host._timerChain = chained;
         return chained;
     }
 }
-async function dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo) {
+/**
+ * One dispatch. `current` answers whether the epoch it was requested in still
+ * stands: once a reset voids it, no further handler runs and nothing is
+ * written or armed — the reset's caller is wiping this state, and a write
+ * after the wipe would outlive it.
+ */
+async function dispatchBody(ctx, current, handlers, onLegacyAlarm, alarmInfo) {
     // Collect schedule requests made inside handler context (see
     // dispatchArms) and fold them into the map below, so an in-dispatch arm
     // neither deadlocks on the chain nor races the write.
@@ -170,6 +196,8 @@ async function dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo) {
     try {
         const now = Date.now();
         const existing = (await ctx?.storage?.get?.(TIMER_REASONS_KEY));
+        if (!current())
+            return;
         const map = { ...(existing || {}) };
         const hadMap = Object.keys(map).length > 0;
         if (!hadMap) {
@@ -185,6 +213,8 @@ async function dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo) {
                     fired.push(reason);
             }
             for (const reason of fired) {
+                if (!current())
+                    return;
                 delete map[reason];
                 const handler = handlers[reason];
                 // Unknown reasons silently dropped (forward-compat).
@@ -201,20 +231,25 @@ async function dispatchBody(ctx, handlers, onLegacyAlarm, alarmInfo) {
                 }
             }
         }
+        // A reset while the handlers ran: the map read above is gone, and
+        // writing it back — or arming for it — would revive what was ended.
+        if (!current())
+            return;
         // Fold the in-dispatch arms, earliest-deadline-first per reason.
         for (const arm of arms) {
             if (!(arm.reason in map) || arm.whenMs < map[arm.reason]) {
                 map[arm.reason] = arm.whenMs;
             }
         }
-        // Re-arm or clear.
+        // Re-arm or clear, issued in the turn the epoch was checked in: a reset
+        // after this point wipes and disarms after these, never before.
         const setAlarmFn = ctx?.storage?.setAlarm;
         if (Object.keys(map).length > 0) {
-            await ctx.storage.put(TIMER_REASONS_KEY, map);
-            const earliest = Math.min(...Object.values(map));
+            const written = ctx.storage.put(TIMER_REASONS_KEY, map);
             if (typeof setAlarmFn === 'function') {
-                setAlarmFn.call(ctx.storage, earliest);
+                setAlarmFn.call(ctx.storage, Math.min(...Object.values(map)));
             }
+            await written;
         }
         else if (hadMap) {
             try {