@nimbus-sh/worker 0.1.2 → 0.1.4

package/dist/facets/wasm-swap-registry.js

@@ -1,5 +1,5 @@
 /**
- * W6 — WASM swap + REJECT_INSTALL registry.
+ * WASM swap and rejected-package registry.
  *
  * The contract:
  *   - WASM_SWAPS    : name→name rewrite at the resolver/installer boundary.
@@ -19,12 +19,9 @@
  *
  * IMPORTANT: This module is the single source of truth in the supervisor
  * isolate. The same data is *duplicated* into
- * `src/parallel/npm-resolve-preamble.ts` because that preamble is shipped
+ * `src/loaders/npm-resolve-preamble.ts` because that preamble is shipped
  * into NimbusLoaderPool isolates as a string (cannot `import`). The
- * `audit/probes/w6/functional/preamble-parity.mjs` snapshot test gates
- * the duplication.
- *
- * See `audit/sections/W6-plan.md` §3.
+ * preamble parity test gates the duplication.
  */
 // ─────────────────────────────────────────────────────────────────────────
 // Registries
@@ -35,8 +32,7 @@ export const WASM_SWAPS = [
     // @swc/wasm-web) are intentionally NOT here. Without npm-alias
     // support, swapping them would silently break the user's
     // `require(originalName)` call site. They are in REJECT_INSTALL
-    // with a code-change suggestion. Tracked as W6.5 to add alias
-    // support. See plan §2 + §10.
+    // with a code-change suggestion until npm-alias support exists.
     {
         from: 'esbuild',
         to: 'esbuild-wasm',
@@ -73,20 +69,20 @@ export const REJECT_INSTALL = [
     {
         from: 'sqlite3',
         reason: 'Native sqlite3 .node binding.',
-        suggest: 'better-sqlite3-wasm (untested by Nimbus) or sql.js (loader gap — see audit/probes/w6.5/spike/sql-js.verdict.md).',
+        suggest: 'better-sqlite3-wasm (untested by Nimbus) or sql.js once wasm asset loading is available.',
         transitive: 'fail',
     },
     {
         from: 'better-sqlite3',
         reason: 'Native sqlite .node binding.',
-        suggest: 'better-sqlite3-wasm (untested by Nimbus) or @libsql/client (resolver subpath gap — see audit/probes/w6.5/spike/libsql-client.verdict.md; may already work post-W2.6a).',
+        suggest: 'better-sqlite3-wasm (untested by Nimbus) or @libsql/client if its subpath exports resolve in your project.',
         transitive: 'fail',
     },
     {
         from: 'canvas',
         reason: 'Native Cairo bindings.',
-        suggest: 'canvaskit-wasm (Skia → WASM, canvas-API-compatible, ~7MB; untested by Nimbus) ' +
-            'or @resvg/resvg-wasm for SVG (verified — see audit/probes/wasm/resvg-wasm.out.txt).',
+        suggest: 'canvaskit-wasm (Skia -> WASM, canvas-API-compatible, ~7MB; untested by Nimbus) ' +
+            'or @resvg/resvg-wasm for SVG.',
         transitive: 'fail',
     },
     {
@@ -136,32 +132,32 @@ export const REJECT_INSTALL = [
     // ── Different-require-name natives (would be swaps with alias support) ─
     {
         from: 'bcrypt',
-        reason: 'Native bcrypt; pure-JS bcryptjs has identical sync API but the require() name differs and Nimbus does not yet support `npm:` aliases (W6.6).',
-        suggest: 'change `require("bcrypt")` to `require("bcryptjs")`, then `npm install bcryptjs` (verified — see audit/probes/wasm/bcryptjs.out.txt). APIs are sync-compatible.',
+        reason: 'Native bcrypt; pure-JS bcryptjs has an equivalent sync API but the require() name differs and Nimbus does not yet support npm aliases.',
+        suggest: 'change `require("bcrypt")` to `require("bcryptjs")`, then `npm install bcryptjs`. APIs are sync-compatible.',
         transitive: 'fail',
     },
     {
         from: 'argon2',
         reason: 'Native Argon2 C bindings.',
-        suggest: 'hash-wasm (argon2d/argon2i/argon2id; verified — see audit/probes/wasm/hash-wasm.out.txt).',
+        suggest: 'hash-wasm for argon2d, argon2i, and argon2id.',
         transitive: 'fail',
     },
     {
         from: 'node-sass',
         reason: 'Native libsass; deprecated upstream.',
-        suggest: 'sass (dart-sass, pure JS — partial support: top-level CJS load fails today, see audit/probes/wasm/sass.out.txt; untested for ESM imports).',
+        suggest: 'sass (dart-sass, pure JS).',
         transitive: 'fail',
     },
     {
         from: 'grpc',
         reason: 'Deprecated native gRPC.',
-        suggest: '@grpc/grpc-js (pure JS — runtime resolver gap on internal subpath today, see audit/probes/wasm/grpc-grpc-js.out.txt; untested end-to-end).',
+        suggest: '@grpc/grpc-js (pure JS, untested end-to-end in Nimbus).',
         transitive: 'fail',
     },
     {
         from: '@swc/core',
         reason: 'Native Rust SWC.',
-        suggest: '@swc/wasm-web (transform/parse only; no Plugin API; loader gap — see audit/probes/wasm/swc-wasm-web.out.txt and audit/probes/w6.5/spike/swc-wasm-web.verdict.md).',
+        suggest: '@swc/wasm-web for transform/parse only; it does not provide the native Plugin API.',
         transitive: 'fail',
     },
     // ── ORM natives ──────────────────────────────────────────────────────
@@ -169,7 +165,7 @@ export const REJECT_INSTALL = [
         from: 'prisma',
         reason: 'Native query engine; not portable to Workers in this configuration.',
         suggest: '@prisma/adapter-d1 (Prisma official Workers adapter, untested by Nimbus), ' +
-            'or migrate to drizzle-orm + @libsql/client (untested; @libsql/client has known resolver gap — see audit/probes/wasm/libsql-client.out.txt).',
+            'or migrate to drizzle-orm + @libsql/client (untested by Nimbus).',
         transitive: 'fail',
     },
     {
@@ -204,62 +200,56 @@ export const REJECT_INSTALL = [
         suggest: 'no Workers-compatible target for bundled browsers — use @playwright/test against a remote browser endpoint (untested by Nimbus).',
         transitive: 'fail',
     },
-    // ── Loader-gap honesty (install OK; runtime FAIL today) ─────────────
-    // These come out of REJECT once the loader work lands. Spike verdicts
-    // (audit/probes/w6.5/spike/) confirmed both gaps span >1 src/ file.
+    // ── Packages that install but do not run correctly in the current loader ─
     {
         from: 'sql.js',
-        reason: 'Installs but fails at runtime: ENOENT on dist/sql-wasm.wasm. Loader gap NOT in tar extraction — likely between streamTarEntries and writeBatch RPC handler, or in cirrus-real fs shim. See audit/probes/w6.5/spike/sql-js.verdict.md.',
-        suggest: 'no Workers-compatible target today — tracked for W6.5.x (multi-file fix exceeded W6.5 surface-area gate). For SQL in Workers consider Cloudflare D1 or @libsql/client (loader gap — see audit/probes/w6.5/spike/libsql-client.verdict.md).',
+        reason: 'Installs but fails at runtime because dist/sql-wasm.wasm is not available to the runtime loader.',
+        suggest: 'For SQL in Workers, consider Cloudflare D1 or @libsql/client.',
         transitive: 'fail',
     },
     {
         from: '@swc/wasm-web',
-        reason: 'Installs but fails at runtime: node-shims.ts:2058 throws "Cannot load module … file was not pre-bundled" — this is a workerd CSP-like new-Function block, not a slice walker gap. See audit/probes/w6.5/spike/swc-wasm-web.verdict.md.',
-        suggest: 'no Workers-compatible target today — tracked for W6.5.x (general facet-runtime issue, not @swc/wasm-web-specific). For ESM transforms consider esbuild-wasm (verified — see audit/probes/wasm/esbuild-wasm.out.txt; a Nimbus W6 swap target).',
+        reason: 'Installs but fails at runtime because its generated code path depends on workerd-blocked dynamic code generation.',
+        suggest: 'For ESM transforms consider esbuild-wasm.',
         transitive: 'fail',
     },
-    // ── W6.5 additions: WASM/wasi-flavour packages that don't load ──────
+    // ── WASM/WASI-flavoured packages that still do not load ─────────────
     {
         from: '@img/sharp-wasm32',
-        reason: 'WASM build of sharp; package is wasm32-cpu-only (npm refuses install on x64) AND libvips initThreads() fails under workerd (no pthread support — see audit/sections/07-workerd-hard-limits.md).',
-        suggest: 'wasm-vips (verified install + load, default-export-only API — see audit/probes/wasm/wasm-vips.out.txt). For complex pipelines: render server-side and ship pixels.',
+        reason: 'WASM build of sharp; package is wasm32-cpu-only and libvips initThreads() requires pthread support unavailable in Workers.',
+        suggest: 'wasm-vips may work for simple pipelines; for complex pipelines, render server-side and ship pixels.',
         transitive: 'fail',
     },
     {
         from: '@napi-rs/canvas',
         reason: 'Native bindings only (linux-x64-gnu/musl, darwin-arm64/x64, android-arm64, linux-arm64-gnu/musl, win32-x64-msvc, linux-arm-gnueabihf). No WASM build published.',
-        suggest: 'canvaskit-wasm (Skia → WASM, canvas-API-compatible, ~7MB; untested by Nimbus) ' +
-            'or @resvg/resvg-wasm for SVG (verified — see audit/probes/wasm/resvg-wasm.out.txt).',
+        suggest: 'canvaskit-wasm (Skia -> WASM, canvas-API-compatible, ~7MB; untested by Nimbus) ' +
+            'or @resvg/resvg-wasm for SVG.',
         transitive: 'fail',
     },
     {
         from: '@napi-rs/canvas-wasm32-wasi',
         reason: '@napi-rs/canvas does not publish a wasm32-wasi variant on npm (404). The @napi-rs/canvas project ships only native bindings. No WASM/WASI build exists.',
-        suggest: 'canvaskit-wasm (Skia → WASM, canvas-API-compatible; untested by Nimbus) ' +
-            'or @resvg/resvg-wasm (verified — see audit/probes/wasm/resvg-wasm.out.txt) for SVG.',
+        suggest: 'canvaskit-wasm (Skia -> WASM, canvas-API-compatible; untested by Nimbus) ' +
+            'or @resvg/resvg-wasm for SVG.',
         transitive: 'fail',
     },
-    // ── X.5-26b additions: Tailwind v4 oxide + lightningcss native parents ─
+    // ── Tailwind v4 oxide + lightningcss native parents ────────────────
     // Both ship only platform-native .node bindings + a wasm32-wasi shard.
-    // workerd has no node:wasi (W6.5 hard limit), so neither path loads.
+    // workerd has no node:wasi, so neither path loads.
     // Without these REJECT entries, both parents install fine and surface
     // a misleading runtime error (npm-4828 fallthrough for oxide, detect-
     // libc execSync gap for lightningcss). With transitive='fail', the
-    // install is loud-rejected at resolve time → ⚠ → ⛔ classifier flip.
-    // Investigation: audit/probes/x526b/investigation/{tailwindcss-oxide,lightningcss}.out.txt
-    // Plan: audit/sections/X526b-plan.md §3.1
-    // Functional probes: audit/probes/x526b/functional/{oxide,lightningcss}-rejected.mjs
-    // E2E probes: audit/probes/x526b/e2e/{oxide,lightningcss,tailwindcss-vite-transitive}-e2e.mjs
+    // install is loudly rejected at resolve time.
     {
         from: '@tailwindcss/oxide',
-        reason: 'Native Rust Tailwind v4 oxide engine; ships only platform-specific .node bindings (linux-x64-gnu/musl, darwin-x64/arm64, freebsd-x64, win32-x64-msvc, etc.) plus a wasm32-wasi shard. workerd has no node:wasi (W6.5 hard limit; see audit/sections/07-workerd-hard-limits.md), and bare native bindings cannot dlopen. The parent index.js throws an npm-4828 message at runtime when no sibling shard loads.',
+        reason: 'Native Rust Tailwind v4 oxide engine; ships only platform-specific .node bindings plus a wasm32-wasi shard. workerd has no node:wasi, and bare native bindings cannot dlopen.',
         suggest: 'no Workers-compatible target — Tailwind v3 (`tailwindcss@^3`) is pure JS and works in Workers (untested by Nimbus). Tailwind v4 inherently requires the Rust oxide engine.',
         transitive: 'fail',
     },
     {
         from: 'lightningcss',
-        reason: 'Native Rust CSS parser; ships platform-specific .node bindings + a wasm32-wasi-only `lightningcss-wasm` package (cpu=wasm32; npm refuses install on x64). workerd has no node:wasi (W6.5). Even before the binding load, the detect-libc dependency throws because child_process.execSync returns undefined inside workerd.',
+        reason: 'Native Rust CSS parser; ships platform-specific .node bindings plus a wasm32-wasi-only `lightningcss-wasm` package. workerd has no node:wasi, and the package probes libc through child_process.execSync.',
         suggest: 'no Workers-compatible target today — postcss + cssnano (pure JS, untested by Nimbus) cover most lightningcss use cases. For CSS minification only: clean-css (pure JS, untested by Nimbus).',
         transitive: 'fail',
     },
@@ -282,8 +272,8 @@ export function lookupReject(name) {
  * Idempotent: running on already-swapped specs is a no-op.
  *
  * Range carry-over: the original spec range is preserved on the new key.
- * (Future W6.5 may want 'latest' to force pulling the current swap-target
- * version, but for now we honour the user's intent.)
+ * Future alias support may force pulling the current swap target version,
+ * but for now we honour the user's requested range.
  */
 export function applySwaps(specs) {
     const out = {};
@@ -376,22 +366,20 @@ export function formatTransitiveSkip(r) {
 // ─────────────────────────────────────────────────────────────────────────
 /**
  * Tag class for registry-driven rejects. Both the supervisor-side path
- * (npm-installer.ts:applyW6Registry, npm-resolver.ts:resolveTree) and the
+ * (npm-installer.ts and npm-resolver.ts) and the
  * facet-side path (npm-resolve-facet.ts:resolveTreeInFacet) throw errors
  * tagged for this case.
  *
  * Supervisor-side: throw `new RegistryRejectError(rejects)` directly.
  * Facet-side: cannot import this class (preamble has no import surface),
- *   so the facet throws `new Error(...)` with `err.__w6_reject = true`.
+ *   so the facet throws `new Error(...)` with `err.__nimbus_registry_reject = true`.
  *   Both are detected via `isRegistryReject()`.
  *
- * The own-property `__w6_reject = true` survives any boundary that
- * preserves error own-properties (NimbusLoaderPool's loadable contract
- * is checked in audit/probes/w6/ ...).
+ * The own-property survives worker boundary serialization.
  */
 export class RegistryRejectError extends Error {
     rejects;
-    __w6_reject = true;
+    __nimbus_registry_reject = true;
     constructor(rejects) {
         super(formatRejectError(rejects));
         this.name = 'RegistryRejectError';
@@ -403,7 +391,7 @@ export class RegistryRejectError extends Error {
  * are lost across that boundary, so we tag via an own-property.
  */
 export function isRegistryReject(e) {
-    return !!(e && typeof e === 'object' && e.__w6_reject === true);
+    return !!(e && typeof e === 'object' && e.__nimbus_registry_reject === true);
 }
 let _sink = null;
 let _sinkThrowCount = 0;
@@ -413,8 +401,7 @@ let _sinkThrowCount = 0;
  * The sink is a per-isolate singleton. The supervisor isolate's sink does
  * NOT propagate to facet isolates — facet emits travel through
  * `ResolveFacetResult.registryEvents` and are flushed by the supervisor
- * after the facet returns. See W6.5-plan.md §5.5 for the per-isolate
- * invariant.
+ * after the facet returns.
  */
 export function setRegistryEventSink(s) {
     _sink = s;
@@ -544,7 +531,7 @@ export function classifyInstallError(e, ctx = {}) {
 (() => {
     for (const s of WASM_SWAPS) {
         if (_rejectByFrom.has(s.from)) {
-            throw new Error(`W6 registry conflict: '${s.from}' is in both WASM_SWAPS and REJECT_INSTALL. ` +
+            throw new Error(`Registry conflict: '${s.from}' is in both WASM_SWAPS and REJECT_INSTALL. ` +
                 `A name must own one role.`);
         }
     }

package/dist/facets/ws-terminal.d.ts

@@ -18,14 +18,13 @@ export declare class WebSocketTerminal {
      * by the disposer the attach call returns. Supports nesting (the
      * disposer restores the prior callback).
      *
-     * Reasoning per /workspace/.seal-internal/2026-05-11-repl-plan/plan.md
      * §3 (Layer 2): the explicit handoff mirrors how `vim`/`less` swap
      * the parent shell's terminal handler. Auto-detect was rejected as
      * fragile. Additive only — when null, behavior is identical to pre-W1.
      */
     private replCallback;
     /**
-     * monaco-wave-a (2026-05-13): Editor-pane file-system bridge.
+     * editor/monaco (2026-05-13): Editor-pane file-system bridge.
      *
      * When non-null, fs-* messages (fs-read / fs-write / fs-list) are
      * routed to this callback INSTEAD of the shell. The callback is
@@ -34,7 +33,7 @@ export declare class WebSocketTerminal {
      * frames over the live WS.
      *
      * Additive — when null, fs-* messages are silently dropped (same
-     * pre-Wave-A behavior, since handleMessage's switch had no case
+     * pre-editor behavior, since handleMessage's switch had no case
      * for them).
      */
     private fsCallback;
@@ -67,7 +66,7 @@ export declare class WebSocketTerminal {
      * stderr, and the next-prompt as three discrete frames in deterministic
      * order. Without this, all three coalesce into one `{type:'output'}`
      * frame and probes asserting frame-order (stderr-before-stdout or
-     * prompt-after-output) see false-RED.
+     * prompt-after-output) see false-failing.
      *
      * Idempotent: cancels the pending timer + sends current buffer (if any).
      * Safe to call on an empty buffer (no-op).
@@ -86,7 +85,7 @@ export declare class WebSocketTerminal {
         recursive?: boolean;
     }): void;
     /**
-     * monaco-wave-a (2026-05-13): install the fs-* message handler.
+     * editor/monaco (2026-05-13): install the fs-* message handler.
      * The callback receives the raw message + a reply lambda that
      * accepts a JSON-serializable frame and pushes it over this WS.
      * Single-slot (last call wins) — init.ts is the only caller and

package/dist/facets/ws-terminal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ws-terminal.d.ts","sourceRoot":"","sources":["../../src/facets/ws-terminal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IACrB,EAAE,EAAE,SAAS,CAAC;IACrB,OAAO,CAAC,YAAY,CAAyC;IAC7D;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,YAAY,CAAyC;IAC7D;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,UAAU,CAAkE;IACpF,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAA8C;IAChE;;;4EAGwE;IACxE,OAAO,CAAC,OAAO,CAAkC;gBAErC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI;IAK3D;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAK7D,IAAI,IAAI,IAAI,MAAM,CAAuB;IACzC,IAAI,IAAI,IAAI,MAAM,CAAuB;IAEzC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAOzB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAE3B;;;;;;;;;;OAUG;IACH,QAAQ,IAAI,IAAI;IAQhB,OAAO,CAAC,KAAK;IAeb,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAE9C,aAAa,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IA+C3J;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,IAAI,GAAG,IAAI;IAI/D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAO5B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAWlD,KAAK,IAAI,IAAI;IACb,KAAK,IAAI,IAAI;CACd"}
+{"version":3,"file":"ws-terminal.d.ts","sourceRoot":"","sources":["../../src/facets/ws-terminal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,iBAAiB;IACrB,EAAE,EAAE,SAAS,CAAC;IACrB,OAAO,CAAC,YAAY,CAAyC;IAC7D;;;;;;;;;;OAUG;IACH,OAAO,CAAC,YAAY,CAAyC;IAC7D;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,UAAU,CAAkE;IACpF,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,KAAK,CAAc;IAC3B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAA8C;IAChE;;;4EAGwE;IACxE,OAAO,CAAC,OAAO,CAAkC;gBAErC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI;IAK3D;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAK7D,IAAI,IAAI,IAAI,MAAM,CAAuB;IACzC,IAAI,IAAI,IAAI,MAAM,CAAuB;IAEzC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAOzB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAE3B;;;;;;;;;;OAUG;IACH,QAAQ,IAAI,IAAI;IAQhB,OAAO,CAAC,KAAK;IAeb,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI;IAE9C,aAAa,CAAC,GAAG,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IA+C3J;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,IAAI,GAAG,IAAI;IAI/D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAO5B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAWlD,KAAK,IAAI,IAAI;IACb,KAAK,IAAI,IAAI;CACd"}

package/dist/facets/ws-terminal.js

@@ -18,14 +18,13 @@ export class WebSocketTerminal {
      * by the disposer the attach call returns. Supports nesting (the
      * disposer restores the prior callback).
      *
-     * Reasoning per /workspace/.seal-internal/2026-05-11-repl-plan/plan.md
      * §3 (Layer 2): the explicit handoff mirrors how `vim`/`less` swap
      * the parent shell's terminal handler. Auto-detect was rejected as
      * fragile. Additive only — when null, behavior is identical to pre-W1.
      */
     replCallback = null;
     /**
-     * monaco-wave-a (2026-05-13): Editor-pane file-system bridge.
+     * editor/monaco (2026-05-13): Editor-pane file-system bridge.
      *
      * When non-null, fs-* messages (fs-read / fs-write / fs-list) are
      * routed to this callback INSTEAD of the shell. The callback is
@@ -34,7 +33,7 @@ export class WebSocketTerminal {
      * frames over the live WS.
      *
      * Additive — when null, fs-* messages are silently dropped (same
-     * pre-Wave-A behavior, since handleMessage's switch had no case
+     * pre-editor behavior, since handleMessage's switch had no case
      * for them).
      */
     fsCallback = null;
@@ -79,7 +78,7 @@ export class WebSocketTerminal {
      * stderr, and the next-prompt as three discrete frames in deterministic
      * order. Without this, all three coalesce into one `{type:'output'}`
      * frame and probes asserting frame-order (stderr-before-stdout or
-     * prompt-after-output) see false-RED.
+     * prompt-after-output) see false-failing.
      *
      * Idempotent: cancels the pending timer + sends current buffer (if any).
      * Safe to call on an empty buffer (no-op).
@@ -125,16 +124,16 @@ export class WebSocketTerminal {
                 if (msg.rows)
                     this._rows = msg.rows;
                 break;
-            // monaco-wave-a (2026-05-13): editor-pane fs bridge. Route to
+            // editor/monaco (2026-05-13): editor-pane fs bridge. Route to
             // the registered fsCallback (set by init.ts which holds the
             // SqliteVFS). Callback uses the reply lambda to push fs-*-result
             // frames over this WS. Untouched messages (no callback) are
-            // silently dropped — same pre-Wave-A behavior.
+            // silently dropped — same pre-editor behavior.
             case 'fs-read':
             case 'fs-write':
             case 'fs-list':
                 if (this.fsCallback) {
-                    // monaco-wave-a hotfix (2026-05-13): auto-echo reqId from
+                    // editor/monaco hotfix (2026-05-13): auto-echo reqId from
                     // the inbound msg into every reply frame. The client side
                     // (public/s/index.html Editor.fsRequest) keys its pending-
                     // request Map on reqId; without echo, every request hangs
@@ -167,7 +166,7 @@ export class WebSocketTerminal {
         }
     }
     /**
-     * monaco-wave-a (2026-05-13): install the fs-* message handler.
+     * editor/monaco (2026-05-13): install the fs-* message handler.
      * The callback receives the raw message + a reply lambda that
      * accepts a JSON-serializable frame and pushes it over this WS.
      * Single-slot (last call wins) — init.ts is the only caller and

package/dist/git/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/git/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAwKtD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,EACb,GAAG,EAAE,SAAS,EACd,KAAK,CAAC,EAAE,kBAAkB,EAC1B,KAAK,CAAC,EAAE,GAAG,GACV,IAAI,CAwaN"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/git/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAwKtD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,GAAG,EACb,GAAG,EAAE,SAAS,EACd,KAAK,CAAC,EAAE,kBAAkB,EAC1B,KAAK,CAAC,EAAE,GAAG,GACV,IAAI,CAuaN"}

package/dist/git/commands.js

@@ -229,7 +229,6 @@ export function registerGitCommands(registry, vfs, doCtx, doEnv) {
                     // unconditionally prepended getDir(ctx). The clone "succeeded" into
                     // <cwd>//tmp/x (note double slash) and the user's later `cd /tmp/x`
                     // hit ENOENT. Real-world git treats absolute targets as absolute.
-                    // See /workspace/.seal-internal/2026-05-12-hardening-r5/repro-git.mjs.
                     let dest;
                     if (subArgs[1]) {
                         dest = subArgs[1].startsWith('/')

package/dist/git/network-facet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-facet.d.ts","sourceRoot":"","sources":["../../src/git/network-facet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/D,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,YAAY,CAAC;IACjB,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,+BAA+B;IAC/B,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,gBAAgB,CAAC,CA4H3B"}
+{"version":3,"file":"network-facet.d.ts","sourceRoot":"","sources":["../../src/git/network-facet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAOH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAE/D,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,YAAY,CAAC;IACjB,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,IAAI,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,+BAA+B;IAC/B,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,kBAAkB,EACvB,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,gBAAgB,CAAC,CA2H3B"}

package/dist/git/network-facet.js

@@ -68,7 +68,6 @@ export async function execGitNetwork(ctx, env, opts) {
             //     SupervisorRPC wrapper isolate, which OOMs after ~5 waves
             //     on real repos. writeBatchStream uses a 256 KiB-highwater
             //     ReadableStream, keeping wrapper-isolate residency
-            //     bounded. See audit/sections/GIT-FREEZE-retro.md.
             //   - the pre-bundled isomorphic-git (git-bundle.js)
             modules: {
                 'git-network-worker.js': W7_FRAME_PREAMBLE + '\n' + generateGitNetworkFacetCode(),
@@ -403,7 +402,6 @@ function createBufferedFs(supervisor, stats) {
         // detached buffer throws
         //   "Cannot perform Construct on a detached ArrayBuffer"
         // inside the byte-stream RPC machinery — the prod-only failure
-        // mode in audit/probes/git-freeze/detached-buffer-tail-2026-05-09T14-35-39Z.jsonl
         // (pre-fix prod d185e0d1).
         //
         // Aliasing sources observed (Q4-A first-deploy verification at

package/dist/git-bundle.generated.d.ts

@@ -8,9 +8,8 @@
  * Consumed by git-network-facet.ts: passed to LOADER.load()'s
  * `modules` record so the facet can `import` isomorphic-git.
  *
- * Generated at: 2026-06-04T22:29:13.356Z
- * Size: 465.8 KiB
+ * Size: 466.1 KiB
  */
 export declare const GIT_BUNDLE_CODE: string;
-export declare const GIT_BUNDLE_SIZE = 476954;
+export declare const GIT_BUNDLE_SIZE = 477254;
 //# sourceMappingURL=git-bundle.generated.d.ts.map

package/dist/git-bundle.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-bundle.generated.d.ts","sourceRoot":"","sources":["../src/git-bundle.generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,eAAe,EAAE,MAA8jre,CAAC;AAE7lre,eAAO,MAAM,eAAe,SAAS,CAAC"}
+{"version":3,"file":"git-bundle.generated.d.ts","sourceRoot":"","sources":["../src/git-bundle.generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,eAAe,EAAE,MAA02re,CAAC;AAEz4re,eAAO,MAAM,eAAe,SAAS,CAAC"}