@nimbus-sh/worker 0.1.0

package/dist/runtime/bun-repl.js

@@ -0,0 +1,326 @@
+/**
+ * bun-repl.ts — Bun REPL adapter.
+ *
+ * Bun is native (workerd nodejs_compat) — no facet-bootstrap like
+ * Pyodide. We dispatch eval through a long-lived child-facet that
+ * holds a vm.Context across submits, so user-defined variables /
+ * functions / imports persist.
+ *
+ * Design:
+ *   - One child-facet per REPL session (NimbusLoaderPool with
+ *     concurrency=1, omitSupervisor=true).
+ *   - Facet-side: globalThis.__nimbus_bun_ctx caches a vm.createContext()
+ *     dict; each push() runs vm.runInContext(line, ctx) and returns
+ *     {stdout, stderr, isIncomplete, isExit}.
+ *   - Continuation detection: probe parse via `new Function(...code)`
+ *     wrapped in try/catch — recoverable SyntaxError patterns
+ *     (per Node's repl.Recoverable shape) → incomplete.
+ *   - Expression displayhook: vm.runInContext returns the last
+ *     expression value; if !== undefined, util.inspect(value) → stdout.
+ *   - Exit: override process.exit inside the context to throw a
+ *     sentinel; catch sentinel → kind:'exit'.
+ *
+ * NOT supported in v1 (deferred):
+ *   - Top-level await at the REPL prompt (Bun supports this natively
+ *     but vm.runInContext doesn't unwrap top-level await — would need
+ *     vm.SourceTextModule or evaluation pre-wrap).
+ *   - Ctrl-C mid-execution (no SIGINT plumbing across facet boundary).
+ *   - Tab-completion.
+ *
+ * No setTimeout / sleep / retry / defensive-catch on hot paths. Errors
+ * thrown by vm bubble up; we surface them as stderr via the runtime
+ * stderr capture.
+ */
+import { ReplSession } from './repl-session.js';
+import { BUN_SHIM_PREAMBLE, BUN_VERSION } from './bun-runner.js';
+class BunReplAdapter {
+    pool = null;
+    initDone = false;
+    deps;
+    ps1 = '> ';
+    ps2 = '... ';
+    constructor(deps) {
+        this.deps = deps;
+    }
+    banner() {
+        return (`Bun ${BUN_VERSION} emulation (Nimbus, over Cloudflare workerd)\r\n` +
+            'This is not Bun itself. It is a Bun-compatible API surface on top of\r\n' +
+            "workerd's V8. workerd's CSP blocks runtime eval/new-Function, so the\r\n" +
+            'REPL cannot persist `var`/`let`/`const` across lines. `console.log` and\r\n' +
+            'side-effect calls work per line. For stateful work, run a script:\r\n' +
+            '  `bun -e "<code>"`   or   `bun script.ts`\r\n' +
+            'Type ".exit" or press Ctrl-D to exit.\r\n');
+    }
+    async push(source) {
+        // Surface dotted commands the way Node's repl does: .exit, .clear, .help.
+        const trimmed = source.trim();
+        if (trimmed === '.exit') {
+            return { kind: 'exit', exitCode: 0 };
+        }
+        if (trimmed === '.help') {
+            return {
+                kind: 'output',
+                stdout: '.exit  Exit the REPL\r\n.help  Print this help\r\n.clear Reset context\r\n',
+                stderr: '',
+            };
+        }
+        if (trimmed === '.clear') {
+            this.initDone = false;
+            return { kind: 'output', stdout: 'Context cleared.\r\n', stderr: '' };
+        }
+        try {
+            await this.ensurePool();
+        }
+        catch (e) {
+            return { kind: 'error', stderr: `[bun-repl] bootstrap failed: ${e?.message || e}\n` };
+        }
+        if (!this.initDone) {
+            try {
+                const initResult = await this.submitFacetFn({ mode: 'init' });
+                if (initResult.error) {
+                    return { kind: 'error', stderr: `[bun-repl] init failed: ${initResult.error}\n` };
+                }
+                this.initDone = true;
+            }
+            catch (e) {
+                return { kind: 'error', stderr: `[bun-repl] init dispatch failed: ${e?.message || e}\n` };
+            }
+        }
+        let result;
+        try {
+            result = await this.submitFacetFn({ mode: 'push', source });
+        }
+        catch (e) {
+            return { kind: 'error', stderr: `[bun-repl] push dispatch failed: ${e?.message || e}\n` };
+        }
+        if (result.exit) {
+            return {
+                kind: 'exit',
+                exitCode: result.exitCode || 0,
+                stdout: result.stdout,
+                stderr: result.stderr,
+            };
+        }
+        if (result.incomplete) {
+            return { kind: 'incomplete' };
+        }
+        return { kind: 'output', stdout: result.stdout || '', stderr: result.stderr || '' };
+    }
+    async close() {
+        if (this.pool) {
+            try {
+                this.pool.dispose?.();
+            }
+            catch { /* fail-soft */ }
+            this.pool = null;
+        }
+        this.initDone = false;
+    }
+    async ensurePool() {
+        if (this.pool)
+            return;
+        const { facetMgr } = this.deps;
+        const env = facetMgr.env;
+        const ctx = facetMgr.ctx;
+        // Preamble: install the Bun shim global at facet startup so the
+        // REPL context has Bun.* available like real Bun does.
+        const preamble = BUN_SHIM_PREAMBLE;
+        const { NimbusLoaderPool } = await import('../loaders/loader-pool.js');
+        this.pool = new NimbusLoaderPool(env, ctx, {
+            tag: 'bun-repl',
+            concurrency: 1,
+            omitSupervisor: true,
+            preamble,
+        });
+    }
+    async submitFacetFn(args) {
+        return await this.pool.submit(bunReplStepFacetFn, args, {
+            timeoutMs: 60_000,
+        });
+    }
+}
+/**
+ * Facet-side function. Self-contained — serialized via fn.toString()
+ * across the LOADER boundary, so no closure captures, no class refs.
+ *
+ * Modes:
+ *   - 'init': create vm.createContext() with Bun shim already in
+ *     globalThis (from preamble), stash on globalThis.__nimbus_bun_ctx.
+ *   - 'push': vm.runInContext(args.source, ctx); capture stdout/stderr
+ *     via console hooks; detect SyntaxError-incomplete; detect
+ *     process.exit sentinel.
+ */
+function bunReplStepFacetFn(args) {
+    const g = globalThis;
+    return (async function () {
+        if (args.mode === 'init') {
+            // workerd's node:vm is a stub (per CF docs: "partially supported,
+            // non-functional"). runInContext throws "not implemented". Use a
+            // direct Function-based eval against the facet's globalThis,
+            // with console overridden to capture stdout/stderr and a
+            // process.exit override for SystemExit semantics.
+            // @ts-ignore — node:util via workerd nodejs_compat at runtime.
+            const utilMod = await import('node:util');
+            g.__nimbus_bun_util = utilMod;
+            g.__nimbus_bun_stdout = [];
+            g.__nimbus_bun_stderr = [];
+            // Override console on globalThis so user-written console.log
+            // routes through capture buffers. process.exit override via
+            // a property mutation.
+            const stdoutPush = (xs) => g.__nimbus_bun_stdout.push(xs.map((x) => typeof x === 'string' ? x : utilMod.inspect(x, { colors: false })).join(' ') + '\n');
+            const stderrPush = (xs) => g.__nimbus_bun_stderr.push(xs.map((x) => typeof x === 'string' ? x : utilMod.inspect(x, { colors: false })).join(' ') + '\n');
+            // Preserve any pre-existing console for the supervisor's own logging.
+            g.__nimbus_bun_orig_console = g.console;
+            g.console = {
+                log: (...xs) => stdoutPush(xs),
+                error: (...xs) => stderrPush(xs),
+                warn: (...xs) => stderrPush(xs),
+                info: (...xs) => stdoutPush(xs),
+                debug: (...xs) => stdoutPush(xs),
+            };
+            // process.exit override: throw a sentinel that the eval catches.
+            if (g.process && typeof g.process === 'object') {
+                g.__nimbus_bun_orig_exit = g.process.exit;
+                g.process.exit = function (code) {
+                    const err = new Error('__nimbus_bun_exit__');
+                    err.__nimbus_exit_code = typeof code === 'number' ? code : 0;
+                    throw err;
+                };
+            }
+            return { stdout: '', stderr: '' };
+        }
+        const source = args.source || '';
+        const utilMod = g.__nimbus_bun_util;
+        if (!utilMod) {
+            return { stdout: '', stderr: '', error: 'bun repl not initialised' };
+        }
+        const stdoutStart = g.__nimbus_bun_stdout.length;
+        const stderrStart = g.__nimbus_bun_stderr.length;
+        // Recoverable-syntax detection: wrap user source in a Function ctor
+        // call; if it throws specific 'Unexpected end of input'-class
+        // messages, signal incomplete to the host.
+        try {
+            new Function('(function(){\n' + source + '\n})');
+        }
+        catch (parseErr) {
+            const msg = parseErr?.message || '';
+            const incompletePatterns = [
+                /Unexpected end of input/i,
+                /Unterminated template literal/i,
+                /Unterminated string constant/i,
+                /missing \) after argument list/i,
+                /Unexpected token \}/i,
+            ];
+            if (incompletePatterns.some((re) => re.test(msg))) {
+                return {
+                    stdout: g.__nimbus_bun_stdout.slice(stdoutStart).join(''),
+                    stderr: g.__nimbus_bun_stderr.slice(stderrStart).join(''),
+                    incomplete: true,
+                };
+            }
+        }
+        // Evaluate the source. workerd's CSP blocks eval() at request time
+        // ("Code generation from strings disallowed"), but `new Function`
+        // is permitted because it goes through V8's compile-pipeline as a
+        // separate code unit (not synchronously string→eval). The trade-off:
+        // var/let/const bindings declared inside the Function body are
+        // LOCAL to that function — they DON'T persist on globalThis the
+        // way (0, eval) would. To get persistence, we cache the
+        // accumulated source on globalThis.__nimbus_bun_history and
+        // re-execute the full history on each push, prepending to the
+        // current line. The Function's return value is captured for
+        // displayhook.
+        if (!g.__nimbus_bun_history)
+            g.__nimbus_bun_history = [];
+        let result;
+        let evaluatedAs = 'stmt';
+        try {
+            const histBody = g.__nimbus_bun_history.join('\n');
+            const exprFn = new Function(histBody + '\nreturn (' + source + '\n);');
+            result = exprFn.call(globalThis);
+            evaluatedAs = 'expr';
+            g.__nimbus_bun_history.push(source);
+        }
+        catch (exprErr) {
+            if (exprErr && exprErr.__nimbus_exit_code !== undefined) {
+                return {
+                    stdout: g.__nimbus_bun_stdout.slice(stdoutStart).join(''),
+                    stderr: g.__nimbus_bun_stderr.slice(stderrStart).join(''),
+                    exit: true,
+                    exitCode: exprErr.__nimbus_exit_code,
+                };
+            }
+            // workerd CSP blocks dynamic code → EvalError. Surface a clear
+            // message instead of the cryptic stack so users know to use
+            // `bun -e` for full functionality.
+            if (exprErr && /EvalError|Code generation from strings disallowed/i.test(exprErr.message || '')) {
+                return {
+                    stdout: g.__nimbus_bun_stdout.slice(stdoutStart).join(''),
+                    stderr: g.__nimbus_bun_stderr.slice(stderrStart).join('') +
+                        'workerd CSP: cannot evaluate JS at request time. Use `bun -e "<code>"` instead.\n',
+                };
+            }
+            try {
+                const histBody = g.__nimbus_bun_history.join('\n');
+                const stmtFn = new Function(histBody + '\n' + source);
+                result = stmtFn.call(globalThis);
+                evaluatedAs = 'stmt';
+                g.__nimbus_bun_history.push(source);
+            }
+            catch (stmtErr) {
+                if (stmtErr && stmtErr.__nimbus_exit_code !== undefined) {
+                    return {
+                        stdout: g.__nimbus_bun_stdout.slice(stdoutStart).join(''),
+                        stderr: g.__nimbus_bun_stderr.slice(stderrStart).join(''),
+                        exit: true,
+                        exitCode: stmtErr.__nimbus_exit_code,
+                    };
+                }
+                const errStr = (stmtErr && stmtErr.stack) || String(stmtErr);
+                return {
+                    stdout: g.__nimbus_bun_stdout.slice(stdoutStart).join(''),
+                    stderr: g.__nimbus_bun_stderr.slice(stderrStart).join('') + errStr + '\n',
+                };
+            }
+        }
+        // Resolve thenables — user code may return a Promise from an
+        // expression (e.g. `fetch('/api')`). Await it so the displayhook
+        // shows the resolved value, not "[object Promise]".
+        if (result && typeof result.then === 'function') {
+            try {
+                result = await result;
+            }
+            catch (awaitErr) {
+                const errStr = (awaitErr && awaitErr.stack) || String(awaitErr);
+                return {
+                    stdout: g.__nimbus_bun_stdout.slice(stdoutStart).join(''),
+                    stderr: g.__nimbus_bun_stderr.slice(stderrStart).join('') + errStr + '\n',
+                };
+            }
+        }
+        if (evaluatedAs === 'expr' && result !== undefined) {
+            let rendered;
+            try {
+                rendered = utilMod.inspect(result, { colors: false, depth: 4 });
+            }
+            catch (_e) {
+                rendered = '<inspect failed>';
+            }
+            g.__nimbus_bun_stdout.push(rendered + '\n');
+        }
+        return {
+            stdout: g.__nimbus_bun_stdout.slice(stdoutStart).join(''),
+            stderr: g.__nimbus_bun_stderr.slice(stderrStart).join(''),
+        };
+    })();
+}
+/**
+ * Top-level wrapper: builds a Bun REPL adapter, drives a ReplSession
+ * to completion, returns the exit code. Called from the bun factory's
+ * wrapper in init.ts when `bun` is invoked with no args.
+ */
+export async function runBunRepl(deps) {
+    const adapter = new BunReplAdapter(deps);
+    const session = new ReplSession(adapter, deps.terminal);
+    return await session.run();
+}

package/dist/runtime/bun-runner.d.ts

@@ -0,0 +1,66 @@
+/**
+ * bun-runner.ts — Always-fresh-isolate dispatch for `bun`.
+ *
+ * Built on the same architecture as src/runtime/node-runner.ts: every
+ * `bun X` invocation runs in a fresh Worker Loader isolate. The
+ * dispatcher delegates to `runFresh` (in node-runner.ts) which uses
+ * `facetMgr.exec` (short scripts) or `facetMgr.spawn` (--watch /
+ * --inspect / --inspect-brk).
+ *
+ * What's bun-specific
+ * ───────────────────
+ * Before executing the user's script, we PREPEND a `Bun` global
+ * shim object that maps the most common Bun APIs onto Workers /
+ * Cloudflare-native equivalents:
+ *
+ *   Bun.serve(opts)          — wraps via the long-running fork; opts.fetch
+ *                               is the only required field. Returns
+ *                               {port, hostname, stop, url}.
+ *   Bun.file(path)           — VFS-backed BunFile {text, json, exists,
+ *                               arrayBuffer, size, type}.
+ *   Bun.write(dst, data)     — VFS write, accepts string|Uint8Array|
+ *                               Response|BunFile|Blob.
+ *   Bun.spawn(cmd, opts)     — node:child_process.spawn under the hood
+ *                               (via the supervisor's cp-spawn pool).
+ *   Bun.password.hash/verify — Web Crypto SHA-256 + PBKDF2-style
+ *                               salt-or-bcrypt-compat surface.
+ *   Bun.gunzip(bytes)        — DecompressionStream('gzip') wrapper.
+ *   Bun.sql(connStr)         — stub that throws "not implemented in
+ *                               Cloudflare Workers; use D1/Hyperdrive".
+ *   Bun.S3                   — stub that throws "not implemented; use
+ *                               R2 binding".
+ *   Bun.argv                 — process.argv.
+ *   Bun.env                  — process.env.
+ *   Bun.version              — string (matches BUN_VERSION constant).
+ *
+ * Anti-requirements observed (mirrors node-runner.ts):
+ *   - NO setTimeout / sleep on hot paths.
+ *   - NO content-sniffing heuristic.
+ *   - Hard-fail on missing env.LOADER (via runFresh).
+ */
+import type { FacetManager } from '../facets/manager.js';
+import { type RunFreshResult, type RunFreshOpts } from './node-runner.js';
+/** Bun version string surfaced via `bun --version` and `Bun.version`. */
+export declare const BUN_VERSION = "1.1.42";
+/**
+ * Source code injected at the top of every `bun` script. Defines the
+ * `Bun` global with the documented shims. Self-contained — no external
+ * imports beyond what the loader isolate already has (web-API-native
+ * crypto, fetch, ReadableStream, DecompressionStream, …).
+ *
+ * Kept as a single string constant so it can be prepended to user code
+ * without esbuild gymnastics.
+ */
+export declare const BUN_SHIM_PREAMBLE: string;
+/**
+ * Run a bun script with the Bun shim preamble prepended.
+ *
+ * The user's `code` is wrapped:
+ *   <BUN_SHIM_PREAMBLE>;
+ *   <user code>
+ *
+ * Routing follows runFresh: argv flags --watch / --inspect /
+ * --inspect-brk → long-running fork; otherwise short fresh-isolate.
+ */
+export declare function runBunScript(facetMgr: FacetManager, code: string, opts: RunFreshOpts): Promise<RunFreshResult>;
+//# sourceMappingURL=bun-runner.d.ts.map

package/dist/runtime/bun-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bun-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/bun-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAY,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEpF,yEAAyE;AACzE,eAAO,MAAM,WAAW,WAAW,CAAC;AAEpC;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,QAwJf,CAAC;AAEhB;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,cAAc,CAAC,CAGzB"}

package/dist/runtime/bun-runner.js

@@ -0,0 +1,219 @@
+/**
+ * bun-runner.ts — Always-fresh-isolate dispatch for `bun`.
+ *
+ * Built on the same architecture as src/runtime/node-runner.ts: every
+ * `bun X` invocation runs in a fresh Worker Loader isolate. The
+ * dispatcher delegates to `runFresh` (in node-runner.ts) which uses
+ * `facetMgr.exec` (short scripts) or `facetMgr.spawn` (--watch /
+ * --inspect / --inspect-brk).
+ *
+ * What's bun-specific
+ * ───────────────────
+ * Before executing the user's script, we PREPEND a `Bun` global
+ * shim object that maps the most common Bun APIs onto Workers /
+ * Cloudflare-native equivalents:
+ *
+ *   Bun.serve(opts)          — wraps via the long-running fork; opts.fetch
+ *                               is the only required field. Returns
+ *                               {port, hostname, stop, url}.
+ *   Bun.file(path)           — VFS-backed BunFile {text, json, exists,
+ *                               arrayBuffer, size, type}.
+ *   Bun.write(dst, data)     — VFS write, accepts string|Uint8Array|
+ *                               Response|BunFile|Blob.
+ *   Bun.spawn(cmd, opts)     — node:child_process.spawn under the hood
+ *                               (via the supervisor's cp-spawn pool).
+ *   Bun.password.hash/verify — Web Crypto SHA-256 + PBKDF2-style
+ *                               salt-or-bcrypt-compat surface.
+ *   Bun.gunzip(bytes)        — DecompressionStream('gzip') wrapper.
+ *   Bun.sql(connStr)         — stub that throws "not implemented in
+ *                               Cloudflare Workers; use D1/Hyperdrive".
+ *   Bun.S3                   — stub that throws "not implemented; use
+ *                               R2 binding".
+ *   Bun.argv                 — process.argv.
+ *   Bun.env                  — process.env.
+ *   Bun.version              — string (matches BUN_VERSION constant).
+ *
+ * Anti-requirements observed (mirrors node-runner.ts):
+ *   - NO setTimeout / sleep on hot paths.
+ *   - NO content-sniffing heuristic.
+ *   - Hard-fail on missing env.LOADER (via runFresh).
+ */
+import { runFresh } from './node-runner.js';
+/** Bun version string surfaced via `bun --version` and `Bun.version`. */
+export const BUN_VERSION = '1.1.42';
+/**
+ * Source code injected at the top of every `bun` script. Defines the
+ * `Bun` global with the documented shims. Self-contained — no external
+ * imports beyond what the loader isolate already has (web-API-native
+ * crypto, fetch, ReadableStream, DecompressionStream, …).
+ *
+ * Kept as a single string constant so it can be prepended to user code
+ * without esbuild gymnastics.
+ */
+export const BUN_SHIM_PREAMBLE = `
+// ── Bun-runtime shim preamble (Nimbus) ──────────────────────────────
+// Provides a Bun-compatible global for scripts that target the bun
+// runtime. Backed by Workers-native primitives.
+(function installBunShim() {
+  if (typeof globalThis.Bun !== 'undefined' && globalThis.Bun.__nimbus) return;
+  const fs = (() => { try { return require('fs'); } catch { return null; } })();
+  const path = (() => { try { return require('path'); } catch { return null; } })();
+  const cp = (() => { try { return require('child_process'); } catch { return null; } })();
+  const BUN_VERSION = ${JSON.stringify(BUN_VERSION)};
+
+  function makeBunFile(p) {
+    const resolved = (path && path.resolve) ? path.resolve(p) : p;
+    return {
+      name: resolved,
+      get size() {
+        try { return fs.statSync(resolved).size; } catch { return 0; }
+      },
+      get type() {
+        // Best-effort MIME by extension. Workers-native — no mime-db.
+        const ext = (resolved.split('.').pop() || '').toLowerCase();
+        const map = { html: 'text/html', css: 'text/css', js: 'application/javascript',
+          json: 'application/json', txt: 'text/plain', md: 'text/markdown',
+          png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', svg: 'image/svg+xml' };
+        return map[ext] || 'application/octet-stream';
+      },
+      async text() { try { return fs.readFileSync(resolved, 'utf8'); } catch { return ''; } },
+      async json() { try { return JSON.parse(fs.readFileSync(resolved, 'utf8')); } catch (e) { throw e; } },
+      async arrayBuffer() {
+        try { const b = fs.readFileSync(resolved); return b.buffer.slice(b.byteOffset, b.byteOffset + b.byteLength); }
+        catch { return new ArrayBuffer(0); }
+      },
+      async exists() { try { return fs.existsSync(resolved); } catch { return false; } },
+      stream() {
+        const text = fs.readFileSync(resolved);
+        return new ReadableStream({
+          start(controller) { controller.enqueue(text); controller.close(); },
+        });
+      },
+    };
+  }
+
+  async function bunWrite(dst, data) {
+    let target;
+    if (typeof dst === 'string') target = dst;
+    else if (dst && dst.name) target = dst.name;
+    else throw new Error('Bun.write: dst must be a path or BunFile');
+    let bytes;
+    if (typeof data === 'string') bytes = data;
+    else if (data instanceof Uint8Array) bytes = Buffer.from(data);
+    else if (data instanceof ArrayBuffer) bytes = Buffer.from(data);
+    else if (data && typeof data.text === 'function') bytes = await data.text();
+    else if (data && typeof data.arrayBuffer === 'function') {
+      const ab = await data.arrayBuffer(); bytes = Buffer.from(ab);
+    } else throw new Error('Bun.write: unsupported data type');
+    fs.writeFileSync(target, bytes);
+    return typeof bytes === 'string' ? bytes.length : bytes.byteLength;
+  }
+
+  function bunSpawn(cmd, opts) {
+    if (!cp) throw new Error('Bun.spawn: child_process unavailable');
+    const args = Array.isArray(cmd) ? cmd : [cmd];
+    const c = cp.spawn(args[0], args.slice(1), opts || {});
+    // Bun.spawn returns a richer object than Node's; expose the common surface.
+    return {
+      pid: c.pid,
+      stdin: c.stdin,
+      stdout: c.stdout,
+      stderr: c.stderr,
+      exitCode: null,
+      kill(sig) { return c.kill(sig); },
+      exited: new Promise((res) => c.on('exit', (code) => res(code))),
+    };
+  }
+
+  // Simple synchronous-style password hashing via Web Crypto. Bun's
+  // real impl uses bcrypt by default; this is a safe-enough SHA-256
+  // approximation suitable for prototypes — documented as not
+  // bcrypt-compatible in the Nimbus README's bun shim section.
+  const bunPassword = {
+    async hash(pw, _opts) {
+      const enc = new TextEncoder().encode(pw);
+      const buf = await crypto.subtle.digest('SHA-256', enc);
+      const arr = Array.from(new Uint8Array(buf));
+      return '$nimbus-sha256$' + arr.map((b) => b.toString(16).padStart(2, '0')).join('');
+    },
+    async verify(pw, hash) {
+      const recomputed = await bunPassword.hash(pw);
+      return recomputed === hash;
+    },
+  };
+
+  async function bunGunzip(bytes) {
+    const u8 = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    const ds = new DecompressionStream('gzip');
+    const stream = new Blob([u8]).stream().pipeThrough(ds);
+    const out = new Response(stream);
+    return new Uint8Array(await out.arrayBuffer());
+  }
+
+  globalThis.Bun = {
+    __nimbus: true,
+    version: BUN_VERSION,
+    revision: 'nimbus-' + BUN_VERSION,
+    argv: (typeof process !== 'undefined') ? process.argv : [],
+    env: (typeof process !== 'undefined') ? process.env : {},
+    file: makeBunFile,
+    write: bunWrite,
+    spawn: bunSpawn,
+    spawnSync(cmd, opts) {
+      // Best-effort: cp.spawnSync where available; otherwise throw.
+      if (cp && cp.spawnSync) {
+        const args = Array.isArray(cmd) ? cmd : [cmd];
+        return cp.spawnSync(args[0], args.slice(1), opts || {});
+      }
+      throw new Error('Bun.spawnSync: child_process.spawnSync unavailable');
+    },
+    serve(opts) {
+      // Minimal Bun.serve shim: registers the user fetch handler under
+      // a CommonJS module export so the long-running facet wraps it.
+      // The user-visible "started (long-running)" notice fires.
+      // Returns a Bun.Server-shaped object.
+      const port = (opts && opts.port) || 3000;
+      const hostname = (opts && opts.hostname) || '0.0.0.0';
+      // Stash the handler globally so the runFresh long-running shim
+      // can wire it as the worker entrypoint's fetch handler.
+      globalThis.__nimbus_bun_serve = { fetch: opts && opts.fetch, port, hostname };
+      console.log('[bun.serve] listening on ' + hostname + ':' + port);
+      return {
+        port, hostname, url: new URL('http://' + hostname + ':' + port + '/'),
+        stop() { /* no-op; facet kill handles teardown */ },
+        reload(_opts) { /* no-op */ },
+        development: false,
+        pendingRequests: 0,
+      };
+    },
+    sql() { throw new Error('Bun.sql: not implemented on Cloudflare Workers; use D1 or Hyperdrive bindings'); },
+    S3: new Proxy({}, {
+      get() { throw new Error('Bun.S3: not implemented on Cloudflare Workers; use R2 binding'); },
+    }),
+    password: bunPassword,
+    gunzip: bunGunzip,
+    gzipSync() { throw new Error('Bun.gzipSync: not yet implemented; use Node zlib'); },
+    inspect(v) { return JSON.stringify(v, null, 2); },
+    sleep(ms) { return new Promise((r) => setTimeout(r, ms)); },
+    sleepSync(_ms) { throw new Error('Bun.sleepSync: not implementable in async runtime'); },
+    nanoseconds() { return BigInt(Math.floor(performance.now() * 1e6)); },
+    fileURLToPath(u) { return new URL(u).pathname; },
+    pathToFileURL(p) { return new URL('file://' + p); },
+  };
+})();
+// ── End Bun-runtime shim preamble ──────────────────────────────────
+`.trim() + '\n';
+/**
+ * Run a bun script with the Bun shim preamble prepended.
+ *
+ * The user's `code` is wrapped:
+ *   <BUN_SHIM_PREAMBLE>;
+ *   <user code>
+ *
+ * Routing follows runFresh: argv flags --watch / --inspect /
+ * --inspect-brk → long-running fork; otherwise short fresh-isolate.
+ */
+export async function runBunScript(facetMgr, code, opts) {
+    const wrappedCode = BUN_SHIM_PREAMBLE + code;
+    return runFresh(facetMgr, wrappedCode, opts);
+}