@nimbus-sh/worker 0.1.0

package/dist/runtime/ruby-runner.d.ts

@@ -0,0 +1,62 @@
+/**
+ * ruby-runner.ts — ruby.wasm (Ruby 3.3.x) runner.
+ *
+ * Mirror of python-runner.ts patterns adapted to Ruby's wasi-vfs +
+ * canonical-abi binding. v1 scope:
+ *   - `ruby --version` / `ruby -e '<code>'` / `ruby <file.rb>`
+ *   - stdout/stderr → processLogs (Process tab integration)
+ *   - exit code via `exit N` / unhandled exception → 1
+ *   - argv passed through to ARGV; $PROGRAM_NAME / $0 set
+ *   - stdlib loaded from the packed wasi-vfs inside the wasm
+ *
+ * Out of v1:
+ *   - REPL mode (`ruby` with no args)
+ *   - require_relative for non-bundled files (basic require for
+ *     stdlib works since stdlib is wasi-vfs-packed inside the wasm)
+ *   - gems, bundler
+ *   - js-runtime bindings (gem "js") — those imports are stubbed
+ *     and will raise NotImplementedError if Ruby code tries to use
+ *     them
+ *
+ * Architecture: SAME LOADER-modules transport as python-runner / wasm-
+ * runner. ruby+stdlib.wasm bytes ship via the LOADER `modules` map
+ * (workerd compiles at child-facet module-init time, where CSP
+ * permits). Per-user-VFS path: ~/.nimbus/runtimes/ruby/3.3.4/share/ruby/.
+ *
+ * Per /workspace/.seal-internal/2026-05-11-ruby-v1/audit.md:
+ *   - Wasm size 34.3 MiB (well under empirical 32 MiB-ish per-call
+ *     ceiling we cleared with Pyodide + clang).
+ *   - 35 wasi_snapshot_preview1 imports (provided by wasi-instance.ts).
+ *   - 21 rb-js-abi-host imports (stubbed throw-when-called — none fire
+ *     for v1 `puts "hi"`).
+ *   - 3 canonical_abi imports (resource lifecycle — implemented as
+ *     a minimal Slab<number,object>).
+ *   - Exports: _initialize, __wasi_vfs_rt_init, ruby-init,
+ *     ruby-init-loadpath, rb-eval-string-protect, cabi_realloc,
+ *     canonical_abi_drop_rb-abi-value, memory.
+ */
+import type { RuntimeManifest } from './runtime-catalog.js';
+import type { SqliteVFS } from '../vfs/sqlite-vfs.js';
+import type { FacetManager } from '../facets/manager.js';
+/**
+ * Build the ruby-runner factory. Called once at session init; the
+ * returned factory binds the manifest + install root for each
+ * registered entrypoint (`ruby`, `ruby3`).
+ */
+export declare function makeRubyRunnerFactory(deps: {
+    facetMgr: FacetManager;
+    vfs: SqliteVFS;
+}): (manifest: RuntimeManifest, installRoot: string, binName: string, binKind: string | undefined) => (ctx: any) => Promise<number>;
+/**
+ * The Ruby-specific portion of the preamble. Wires the wasm imports
+ * (wasi_snapshot_preview1 from __wasiMakeImports, canonical_abi from a
+ * tiny Slab implementation, rb-js-abi-host as stubs that throw on
+ * call), instantiates the wasm Module from __NIMBUS_WASM at module-
+ * init, and runs Ruby's bootstrap sequence.
+ *
+ * Per-call __rubyRun then mutates WASI argv/env, clears the stdout/
+ * stderr capture buffers, and invokes rb-eval-string-protect with a
+ * wrapper that captures SystemExit to extract the exit code.
+ */
+export declare const RUBY_RUNNER_PREAMBLE_TAIL = "\n// \u2500\u2500 BEGIN: ruby-runner preamble (Ruby 3.3.4, Nimbus v1) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n// Capture buffers shared across the bootstrap and per-call paths. The\n// preamble's WASI imports route fd_write stdout/stderr into these via\n// __wasiMakeImports({stdoutWrite, stderrWrite}). Per-call __rubyRun\n// slices from these to isolate output per invocation.\nglobalThis.__nimbusRubyStdout = globalThis.__nimbusRubyStdout || [];\nglobalThis.__nimbusRubyStderr = globalThis.__nimbusRubyStderr || [];\n\n// \u2500\u2500 Canonical-ABI resource Slab \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// Pyodide-style minimal resource manager. Ruby's rb-abi-guest.js uses\n// these 4 functions for resource_drop / resource_new / resource_get /\n// resource_clone, but the wasm itself only imports 3:\n//   resource_drop_js-abi-value, resource_new_rb-abi-value, resource_get_rb-abi-value\nclass __NimbusRubySlab {\n  constructor() { this._map = new Map(); this._next = 1; }\n  insert(obj) { const id = this._next++; this._map.set(id, obj); return id; }\n  get(id) { return this._map.get(id); }\n  remove(id) { const v = this._map.get(id); this._map.delete(id); return v; }\n}\n\n// \u2500\u2500 Bootstrap promise: runs at child-facet module-init time \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// Mirrors pyodide v2's __pyodideBootstrap pattern. The synchronous\n// portion (WebAssembly.instantiate + _initialize + ruby-init-loadpath\n// + ruby-init) all completes before the first await \u2014 so it executes\n// in module-init CSP context where workerd permits wasm code-gen\n// from the LOADER-provided Module.\nglobalThis.__rubyBootstrap = (async function nimbusRubyBootstrap() {\n  const wasmTable = globalThis.__NIMBUS_WASM || {};\n  const rubyMod = wasmTable['ruby+stdlib.wasm'];\n  if (!rubyMod) {\n    return { ok: false, error: '__NIMBUS_WASM missing ruby+stdlib.wasm' };\n  }\n\n  // WASI init \u2014 empty preopens initially. Per-call __rubyRun can mount\n  // a cwd preopen if needed (for ruby <file.rb> reading via WASI).\n  // For v1 (-e mode) we just need stdout/stderr capture + a minimal\n  // FS so Ruby's stdlib init (which probes /tmp + $HOME) doesn't crash.\n  __wasiInitFS({\n    root: '',\n    preopens: [\n      // Preopen / so Ruby can resolve all FS paths through WASI.\n      // Ruby's __wasi_vfs_rt_init mounts its packed stdlib under /usr\n      // inside the wasm's internal VFS \u2014 these preopens are for the\n      // OUTER (host-visible) FS that wasi_snapshot_preview1 exposes.\n      { wasiPath: '/',        vfsPath: '' },\n      { wasiPath: '/tmp',     vfsPath: 'tmp' },\n      { wasiPath: '/home',    vfsPath: 'home' },\n    ],\n    files: {},\n    dirs: ['tmp', 'home'],\n  });\n\n  // Initial argv/env (bootstrap defaults). Per-call __rubyRun re-\n  // initializes WASI with the actual user argv/env before evaluating\n  // user code.\n  let memRef = null;\n  const wasi = __wasiMakeImports({\n    argv: ['ruby'],\n    env: { HOME: '/home/ruby', LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8' },\n    getMemory: () => memRef,\n    stdoutWrite: (s) => { globalThis.__nimbusRubyStdout.push(s); },\n    stderrWrite: (s) => { globalThis.__nimbusRubyStderr.push(s); },\n  });\n\n  // canonical_abi imports \u2014 3 resource lifecycle fns. The Slab is\n  // shared across the lifetime of the facet (single call, then the\n  // facet is reaped).\n  const rbValueSlab = new __NimbusRubySlab();\n  const jsValueSlab = new __NimbusRubySlab();\n  const canonical_abi = {\n    'resource_drop_js-abi-value': (i) => { jsValueSlab.remove(i); },\n    'resource_new_rb-abi-value': (i) => rbValueSlab.insert({ _wasm_val: i }),\n    'resource_get_rb-abi-value': (i) => {\n      const r = rbValueSlab.get(i);\n      return r ? r._wasm_val : 0;\n    },\n  };\n\n  // rb-js-abi-host imports \u2014 21 fns. Ruby only calls these when user\n  // code interacts with JS (gem \"js\"). For v1 (puts \"hi\") none fire.\n  // We stub each to throw a clear error so any future user code that\n  // needs JS interop gets a recognizable diagnostic instead of a\n  // wasm trap.\n  const _stub = (name) => () => { throw new Error('ruby-runner v1: rb-js-abi-host.' + name + ' not implemented (gem \"js\" not supported)'); };\n  const rb_js_abi_host = {\n    rb_wasm_throw_prohibit_rewind_exception: () => {\n      // This one CAN fire from Ruby internals (Fiber rewind guard).\n      // Make it a no-op so Ruby's continuation machinery proceeds.\n    },\n    'eval-js: func(code: string) -> variant { success(handle<js-abi-value>), failure(handle<js-abi-value>) }': _stub('eval-js'),\n    'is-js: func(value: handle<js-abi-value>) -> bool': _stub('is-js'),\n    'instance-of: func(value: handle<js-abi-value>, klass: handle<js-abi-value>) -> bool': _stub('instance-of'),\n    'global-this: func() -> handle<js-abi-value>': _stub('global-this'),\n    'int-to-js-number: func(value: s32) -> handle<js-abi-value>': _stub('int-to-js-number'),\n    'float-to-js-number: func(value: float64) -> handle<js-abi-value>': _stub('float-to-js-number'),\n    'string-to-js-string: func(value: string) -> handle<js-abi-value>': _stub('string-to-js-string'),\n    'bool-to-js-bool: func(value: bool) -> handle<js-abi-value>': _stub('bool-to-js-bool'),\n    'proc-to-js-function: func(value: u32) -> handle<js-abi-value>': _stub('proc-to-js-function'),\n    'rb-object-to-js-rb-value: func(raw-rb-abi-value: u32) -> handle<js-abi-value>': _stub('rb-object-to-js-rb-value'),\n    'js-value-to-string: func(value: handle<js-abi-value>) -> string': _stub('js-value-to-string'),\n    'js-value-to-integer: func(value: handle<js-abi-value>) -> variant { as-float(float64), bignum(string) }': _stub('js-value-to-integer'),\n    'export-js-value-to-host: func(value: handle<js-abi-value>) -> ()': _stub('export-js-value-to-host'),\n    'import-js-value-from-host: func() -> handle<js-abi-value>': _stub('import-js-value-from-host'),\n    'js-value-typeof: func(value: handle<js-abi-value>) -> string': _stub('js-value-typeof'),\n    'js-value-equal: func(lhs: handle<js-abi-value>, rhs: handle<js-abi-value>) -> bool': _stub('js-value-equal'),\n    'js-value-strictly-equal: func(lhs: handle<js-abi-value>, rhs: handle<js-abi-value>) -> bool': _stub('js-value-strictly-equal'),\n    'reflect-apply: func(target: handle<js-abi-value>, this-argument: handle<js-abi-value>, arguments: list<handle<js-abi-value>>) -> variant { success(handle<js-abi-value>), failure(handle<js-abi-value>) }': _stub('reflect-apply'),\n    'reflect-get: func(target: handle<js-abi-value>, property-key: string) -> variant { success(handle<js-abi-value>), failure(handle<js-abi-value>) }': _stub('reflect-get'),\n    'reflect-set: func(target: handle<js-abi-value>, property-key: string, value: handle<js-abi-value>) -> variant { success(handle<js-abi-value>), failure(handle<js-abi-value>) }': _stub('reflect-set'),\n  };\n\n  const imports = {\n    wasi_snapshot_preview1: wasi.wasiImport,\n    canonical_abi,\n    'rb-js-abi-host': rb_js_abi_host,\n  };\n\n  let instance;\n  try {\n    const result = await WebAssembly.instantiate(rubyMod, imports);\n    instance = (result instanceof WebAssembly.Instance ? result : result.instance);\n  } catch (e) {\n    return { ok: false, error: 'WebAssembly.instantiate failed: ' + (e && e.message), stack: e && e.stack };\n  }\n  memRef = instance.exports.memory;\n\n  // \u2500\u2500 Ruby bootstrap sequence \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  // Order matters (per ruby.wasm DefaultRubyVM):\n  //   1. _initialize (reactor entry; runs static initializers)\n  //   2. __wasi_vfs_rt_init (mount packed stdlib at the wasi-vfs's\n  //      internal FS \u2014 needed for require to find Ruby's *.rb files)\n  //   3. ruby-init([progName])  \u2014 initialize VM with argv[0]\n  //   4. ruby-init-loadpath()   \u2014 set $LOAD_PATH from packed stdlib\n  try {\n    if (typeof instance.exports._initialize === 'function') {\n      instance.exports._initialize();\n    }\n    if (typeof instance.exports.__wasi_vfs_rt_init === 'function') {\n      instance.exports.__wasi_vfs_rt_init();\n    }\n  } catch (e) {\n    return { ok: false, error: '_initialize/wasi_vfs_rt_init failed: ' + (e && e.message), stack: e && e.stack };\n  }\n\n  // Locate the canonical Ruby ABI exports. Names embed the WIT\n  // signature literal (e.g. 'ruby-init: func(args: list<string>) -> ()')\n  // because rb-abi-guest is wit-bindgen-generated.\n  const rubyInit = instance.exports['ruby-init: func(args: list<string>) -> ()'];\n  const rubyInitLoadpath = instance.exports['ruby-init-loadpath: func() -> ()'];\n  const rbEvalStringProtect = instance.exports['rb-eval-string-protect: func(str: string) -> tuple<handle<rb-abi-value>, s32>'];\n  const rubyShowVersion = instance.exports['ruby-show-version: func() -> ()'];\n  const cabiRealloc = instance.exports.cabi_realloc;\n  if (!rubyInit || !rubyInitLoadpath || !rbEvalStringProtect || !cabiRealloc) {\n    return { ok: false, error: 'Required Ruby ABI exports missing (ruby-init/init-loadpath/eval-string-protect/cabi_realloc)' };\n  }\n\n  // Encode a list<string> argument for ruby-init. WIT canonical-ABI\n  // shape: caller allocates list buffer; each element is (ptr, len).\n  // Strings are UTF-8 encoded into separately-allocated buffers.\n  function writeListString(strings) {\n    const memory = instance.exports.memory;\n    const enc = new TextEncoder();\n    const len = strings.length;\n    const listBufPtr = cabiRealloc(0, 0, 4, len * 8);  // align=4, size=len*8\n    const encoded = strings.map((s) => enc.encode(s));\n    for (let i = 0; i < len; i++) {\n      const bytes = encoded[i];\n      const strPtr = cabiRealloc(0, 0, 1, bytes.length);\n      new Uint8Array(memory.buffer).set(bytes, strPtr);\n      const dv = new DataView(memory.buffer);\n      dv.setUint32(listBufPtr + i * 8 + 0, strPtr, true);\n      dv.setUint32(listBufPtr + i * 8 + 4, bytes.length, true);\n    }\n    return { ptr: listBufPtr, len };\n  }\n\n  function writeString(s) {\n    const memory = instance.exports.memory;\n    const enc = new TextEncoder();\n    const bytes = enc.encode(s);\n    const ptr = cabiRealloc(0, 0, 1, bytes.length);\n    new Uint8Array(memory.buffer).set(bytes, ptr);\n    return { ptr, len: bytes.length };\n  }\n\n  // NOTE: We DO NOT call ruby-init or ruby-init-loadpath here. Both\n  // invoke CPython-like random-seed initialization (random_get via\n  // wasi_snapshot_preview1.random_get), which workerd blocks in the\n  // global-scope (module-init) context. Same constraint that bit us\n  // for Pyodide v2 P21. The per-call __rubyRun runs them at request-\n  // handler time where crypto.getRandomValues is permitted.\n  //\n  // _initialize and __wasi_vfs_rt_init are safe at module-init because\n  // they only do static initialization (no entropy reads).\n\n  return {\n    ok: true,\n    instance,\n    wasi,\n    rubyInit,\n    rubyInitLoadpath,\n    rbEvalStringProtect,\n    rubyShowVersion,\n    writeListString,\n    writeString,\n    rubyInitialized: false,  // mutated to true by __rubyRun on first call\n  };\n})();\n\n// \u2500\u2500 Per-call entry point \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n//\n// Invoked from the LOADER child facet's execute() (which calls the\n// serialized facetFn that does globalThis.__rubyRun(args)).\n//\n// At this point the bootstrap promise has resolved (since it's\n// awaited inside the child facet's module-init context \u2014 the\n// instantiate finishes before the request handler runs). We:\n//   1. Update Ruby's $0 / $PROGRAM_NAME / ARGV via rb-eval-string-protect\n//   2. Wrap the user code in a begin/rescue SystemExit/StandardError\n//      handler so we can extract exit code without losing stdout\n//   3. Read stdout/stderr buffers and slice from the per-call start\nglobalThis.__rubyRun = async function __rubyRun(args) {\n  const stdoutStart = globalThis.__nimbusRubyStdout.length;\n  const stderrStart = globalThis.__nimbusRubyStderr.length;\n\n  const boot = await globalThis.__rubyBootstrap;\n  if (!boot.ok) {\n    return {\n      exitCode: 1,\n      stdout: globalThis.__nimbusRubyStdout.slice(stdoutStart).join(''),\n      stderr: globalThis.__nimbusRubyStderr.slice(stderrStart).join(''),\n      error: 'ruby bootstrap failed: ' + (boot.error || 'unknown') + (boot.stack ? ' [stack=' + boot.stack + ']' : ''),\n    };\n  }\n\n  // First call into __rubyRun: complete Ruby VM init (ruby-init +\n  // ruby-init-loadpath) now that we're in request-handler context\n  // where crypto.getRandomValues is permitted. Subsequent calls skip.\n  if (!boot.rubyInitialized) {\n    try {\n      const initArgs = boot.writeListString(['ruby', '-e_=0']);\n      boot.rubyInit(initArgs.ptr, initArgs.len);\n      boot.rubyInitLoadpath();\n      boot.rubyInitialized = true;\n    } catch (e) {\n      return {\n        exitCode: 1,\n        stdout: globalThis.__nimbusRubyStdout.slice(stdoutStart).join(''),\n        stderr: globalThis.__nimbusRubyStderr.slice(stderrStart).join(''),\n        error: 'ruby-init / ruby-init-loadpath failed at request time: ' + (e && e.message),\n      };\n    }\n  }\n\n  // Wrapper code: set $0/$PROGRAM_NAME/ARGV/ENV, run user code,\n  // capture SystemExit. We embed the user code as a Ruby string\n  // literal via JSON.stringify (Ruby's double-quote strings accept\n  // \\n \\t etc which JSON also emits \u2014 safe round-trip).\n  //\n  // The wrapper sets __NIMBUS_RUBY_EXIT to the desired exit code so\n  // we can read it via a second rb-eval-string-protect call. Failing\n  // SystemExit (raise) ends up with __NIMBUS_RUBY_EXIT = 1 + stderr\n  // message.\n  const userCodeRb = JSON.stringify(args.userCode);\n  const argvRb = JSON.stringify(args.rbArgv.slice(1));  // exclude argv[0]\n  const envRb = JSON.stringify(args.userEnv || {});\n  const progNameRb = JSON.stringify(args.progName);\n\n  // STAGED execution: we split the prelude (stdout sync + ARGV/ENV/$0\n  // setup) from the user-code eval. The prelude has no failure modes\n  // we care about; user-code is wrapped in begin/rescue for SystemExit\n  // and Exception. If the wrapper itself trips a syntax/runtime error,\n  // we surface it via the __NIMBUS_RUBY_DIAG side channel.\n  // Build env list as string-keyed Ruby hash via the rocket-syntax.\n  // Ruby treats colon-style hash literals as Symbol-keyed; we need\n  // String keys so ENV[k] = v works without TypeError.\n  const envEntries = Object.entries(args.userEnv || {})\n    .map(([k, v]) => JSON.stringify(k) + ' => ' + JSON.stringify(v))\n    .join(', ');\n  const envHashRb = '{' + envEntries + '}';\n\n  const preludeRb = [\n    // Reset exit state FIRST so partial prelude failures still\n    // surface a clean exit code (previously: exit 7 left $__nimbus_exit\n    // = 7 \u2192 next call's prelude could fail before resetting \u2192 second\n    // exit 0 returned 7).\n    '$__nimbus_exit = 0',\n    '$stdout.sync = true',\n    '$stderr.sync = true',\n    '$0 = ' + progNameRb,\n    '$PROGRAM_NAME = ' + progNameRb,\n    'ARGV.replace(' + argvRb + ')',\n    envHashRb + '.each_pair { |k, v| ENV[k] = v }',\n  ].join('; ');\n\n  const userWrapper = [\n    'begin',\n    '  ' + 'eval(' + userCodeRb + ', TOPLEVEL_BINDING, ' + progNameRb + ', 1)',\n    'rescue SystemExit => e',\n    '  $__nimbus_exit = e.status',\n    'rescue Exception => e',\n    '  $stderr.write(e.full_message(highlight: false, order: :top))',\n    '  $__nimbus_exit = 1',\n    'ensure',\n    '  $stdout.flush rescue nil',\n    '  $stderr.flush rescue nil',\n    'end',\n  ].join(\"\\n\");\n\n  const memory = boot.instance.exports.memory;\n\n  function callEvalStringProtect(rubyCode) {\n    const enc = new TextEncoder();\n    const bytes = enc.encode(rubyCode);\n    const cabiRealloc = boot.instance.exports.cabi_realloc;\n    const codePtr = cabiRealloc(0, 0, 1, bytes.length);\n    new Uint8Array(memory.buffer).set(bytes, codePtr);\n    const retPtr = boot.rbEvalStringProtect(codePtr, bytes.length);\n    // Return is a tuple: (rb-abi-value handle u32, status s32) \u2014 8 bytes\n    const dv = new DataView(memory.buffer);\n    const handle = dv.getUint32(retPtr + 0, true);\n    const status = dv.getInt32(retPtr + 4, true);\n    return { handle, status };\n  }\n\n  // Stage 1: run the prelude (sync flags, ARGV, ENV, $0/$PROGRAM_NAME).\n  let preludeStatus;\n  try {\n    preludeStatus = callEvalStringProtect(preludeRb);\n  } catch (e) {\n    return {\n      exitCode: 1,\n      stdout: globalThis.__nimbusRubyStdout.slice(stdoutStart).join(''),\n      stderr: globalThis.__nimbusRubyStderr.slice(stderrStart).join(''),\n      error: 'ruby prelude threw: ' + (e && e.message),\n    };\n  }\n  if (preludeStatus && preludeStatus.status !== 0) {\n    globalThis.__nimbusRubyStderr.push('[ruby-runner-diag] prelude returned non-zero status: ' + preludeStatus.status + '\\n');\n  }\n\n  // Stage 2: run user code wrapped for SystemExit/Exception capture.\n  let evalStatus;\n  try {\n    evalStatus = callEvalStringProtect(userWrapper);\n  } catch (e) {\n    return {\n      exitCode: 1,\n      stdout: globalThis.__nimbusRubyStdout.slice(stdoutStart).join(''),\n      stderr: globalThis.__nimbusRubyStderr.slice(stderrStart).join(''),\n      error: 'rb-eval-string-protect threw: ' + (e && e.message),\n    };\n  }\n  if (evalStatus && evalStatus.status !== 0) {\n    globalThis.__nimbusRubyStderr.push('[ruby-runner-diag] user wrapper returned non-zero status: ' + evalStatus.status + '\\n');\n  }\n\n  // Read $__nimbus_exit by evaluating it and inspecting the result\n  // via Ruby's puts (captured into stderr). Simpler: call exit through\n  // rb-eval-string-protect and parse the status code from there.\n  //\n  // Actually rbEvalStringProtect already returns a status (second\n  // tuple element). When the wrapper completes normally, status is 0\n  // and we read $__nimbus_exit. We use a follow-up eval that prints\n  // the exit code to a sentinel marker on stderr we can scrape, but\n  // a cleaner approach: have the wrapper's last expression BE the\n  // exit code (so it's the return value of eval).\n  //\n  // Re-do: eval $__nimbus_exit and read it from a marker line we\n  // emit to a side channel \u2014 easiest is to call $stdout via a unique\n  // marker that we then strip from output.\n  const NIMBUS_EXIT_MARKER = '__NIMBUS_RUBY_EXIT_';\n  let exitCode = 0;\n  try {\n    // Print the marker + exit code to stderr (a side channel separate\n    // from user-visible stdout). We strip it before returning.\n    callEvalStringProtect(\n      '$stderr.write(' + JSON.stringify(NIMBUS_EXIT_MARKER) + ' + $__nimbus_exit.to_s + \"\\\\n\")'\n    );\n    // Scrape the marker from stderr buffer \u2014 using ONLY this call's\n    // slice (from stderrStart). The same facet can be reused across\n    // multiple __rubyRun invocations (loader-pool dedup by tag), so\n    // a previous call's marker would otherwise be matched first.\n    const callStderr = globalThis.__nimbusRubyStderr.slice(stderrStart).join('');\n    // Match the LAST marker in this slice (the one our just-completed\n    // call emitted; if the user wrapper also emitted writes, the\n    // marker is appended after them).\n    const markerRe = new RegExp(NIMBUS_EXIT_MARKER + '(-?\\\\d+)', 'g');\n    let lastMatch = null;\n    let mit;\n    while ((mit = markerRe.exec(callStderr)) !== null) lastMatch = mit;\n    if (lastMatch) exitCode = parseInt(lastMatch[1], 10);\n  } catch (e) {\n    // Failure to read exit code \u2192 assume 0 if no errors observed.\n    exitCode = 0;\n  }\n\n  // Slice + scrub the marker from stderr output before returning.\n  const stdoutOut = globalThis.__nimbusRubyStdout.slice(stdoutStart).join('');\n  let stderrOut = globalThis.__nimbusRubyStderr.slice(stderrStart).join('');\n  stderrOut = stderrOut.replace(new RegExp(NIMBUS_EXIT_MARKER + '-?\\\\d+\\\\n?', 'g'), '');\n\n  return {\n    exitCode: exitCode,\n    stdout: stdoutOut,\n    stderr: stderrOut,\n  };\n};\n\n// \u2500\u2500 END: ruby-runner preamble \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n";
+//# sourceMappingURL=ruby-runner.d.ts.map

package/dist/runtime/ruby-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruby-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/ruby-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,QAAQ,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,SAAS,CAAC;CAChB,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,KAC7F,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,CAoGhC;AAyND;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,y4oBA6ZrC,CAAC"}