@nimbus-sh/worker 0.12.0 → 0.13.0

package/public/_assets/runtime/{node-shims-f92f16c7d7c532e9.js → node-shims-e3adc4576da31e6e.js}

@@ -901,7 +901,7 @@ const __fsMod = (() => {
       const real = __nsResolve(own && own.alias !== undefined ? own.alias : k, true);
       if (real && real !== "ELOOP") {
         for (const child of __nsChildren(real.path)) {
-          names.set(child.name, child.kind === 1 ? "directory" : child.kind === 2 ? "symlink" : "file");
+          names.set(child.name, child.kind === 1 ? "directory" : child.kind === 2 ? "symlink" : _direntTypeOfMode(child.mode, "file"));
         }
       }
     }
@@ -976,8 +976,9 @@ const __fsMod = (() => {
   function _noteCreation(k) {
     if (_createdHere.has(k)) return;
     const absPath = "/" + k;
-    // Known absent: the namespace names everything this credential can see.
-    if (_statLadder(absPath) !== undefined) return;
+    // Known absent: the namespace names everything this credential can see,
+    // except on a mount where the launch did not list it, which is unknown.
+    if (_statLadder(absPath) !== undefined || _nsUnlisted(absPath, true, false) !== null) return;
     _createdHere.add(k);
   }
   function _forgetCreation(k) {
@@ -2613,24 +2614,37 @@ const __fsMod = (() => {
     return stat;
   }
 
+  // Each exact dirent type's S_IFMT bits and Node predicate (core's vfs/dirent-type.ts).
+  const _direntTypes = {"file":{"format":32768,"node":"isFile"},"directory":{"format":16384,"node":"isDirectory"},"symlink":{"format":40960,"node":"isSymbolicLink"},"character":{"format":8192,"node":"isCharacterDevice"},"block":{"format":24576,"node":"isBlockDevice"},"fifo":{"format":4096,"node":"isFIFO"},"socket":{"format":49152,"node":"isSocket"}};
+  /** The dirent type a mode's format bits name, or `fallback` where they name none. */
+  function _direntTypeOfMode(mode, fallback) {
+    const format = Number(mode) & 0o170000;
+    for (const type in _direntTypes) if (_direntTypes[type].format === format) return type;
+    return fallback;
+  }
+  /** The dirent type an lstat says, for an entry the listing could not type ('unknown'). */
+  function _direntTypeOfStats(st) {
+    return _direntTypeOfMode(st.mode, st.isDirectory() ? "directory" : st.isSymbolicLink() ? "symlink" : "file");
+  }
+
   // The one Dirent shape: readdir({ withFileTypes }) sync and async, and
-  // every Dir.read(). `parentPath` is Node's field; `path` its deprecated
+  // every Dir.read(), for an entry whose type is known (an 'unknown' one is
+  // lstat'ed first). `parentPath` is Node's field; `path` its deprecated
   // alias that older callers still read.
   class __Dirent {
     constructor(name, type, parentPath) {
       this.name = name;
       this.parentPath = parentPath === undefined ? "" : String(parentPath);
       this.path = this.parentPath;
-      this._isDir = type === "directory" || type === "dir";
-      this._isSymlink = type === "symlink";
+      this._holds = _direntTypes[type === "dir" ? "directory" : type]?.node;
     }
-    isFile() { return !this._isDir && !this._isSymlink; }
-    isDirectory() { return this._isDir; }
-    isSymbolicLink() { return this._isSymlink; }
-    isBlockDevice() { return false; }
-    isCharacterDevice() { return false; }
-    isFIFO() { return false; }
-    isSocket() { return false; }
+    isFile() { return this._holds === "isFile"; }
+    isDirectory() { return this._holds === "isDirectory"; }
+    isSymbolicLink() { return this._holds === "isSymbolicLink"; }
+    isBlockDevice() { return this._holds === "isBlockDevice"; }
+    isCharacterDevice() { return this._holds === "isCharacterDevice"; }
+    isFIFO() { return this._holds === "isFIFO"; }
+    isSocket() { return this._holds === "isSocket"; }
   }
   function _direntObject(name, type, parentPath) { return new __Dirent(name, type, parentPath); }
 
@@ -3033,8 +3047,11 @@ const __fsMod = (() => {
         // listing does not. So it is asked for, never assumed (one lstat per
         // child directory, concurrently).
         if (opts?.withFileTypes) {
+          const base = absPath === "/" ? "" : absPath;
+          const types = await Promise.all(entries.map(async (entry) =>
+            entry.type === "unknown" ? _direntTypeOfStats(await _lstatAsync(base + "/" + entry.name)) : entry.type));
           return entries
-            .map((entry) => _direntObject(entry.name, entry.type, absPath))
+            .map((entry, i) => _direntObject(entry.name, types[i], absPath))
             .sort((a, b) => a.name.localeCompare(b.name));
         }
         return entries.map((entry) => entry.name).sort();
@@ -3080,8 +3097,12 @@ const __fsMod = (() => {
 
   async function _writeFileAsync(p, data, opts) {
     const absPath = _resolveFollow(p, "open");
-    writeFileSync(p, data, opts);
     const supervisor = _supervisor();
+    // A target this view cannot judge (on a mount, where the launch did not
+    // list it) is the authority's to answer for, as the async rename's
+    // destination is: parked and written back like any other write, and
+    // refused (and the parked bytes dropped) if the authority refuses it.
+    _parkWholeWrite(p, data, supervisor && typeof supervisor.writeFile === "function");
     if (supervisor && typeof supervisor.writeFile === "function") {
       await _announceLocalDirs(absPath, supervisor);
       // The revision comes back so the ledger can stamp the cell: an async
@@ -3502,8 +3523,17 @@ const __fsMod = (() => {
   // (the hot path for source code / package.json / user JS).
   // Anything else is stringified (Node's behaviour for e.g. numbers).
   function writeFileSync(p, data, opts) {
+    _parkWholeWrite(p, data, false);
+  }
+
+  /**
+   * A whole-file write's local effect: the bytes parked for write-back.
+   * `live`: the async form, whose write-back the authority answers for a
+   * target this view cannot judge (_ensureWritable).
+   */
+  function _parkWholeWrite(p, data, live) {
     const absPath = _resolveFollow(p, "open");
-    _ensureWritable(absPath, "open", p);
+    _ensureWritable(absPath, "open", p, live);
     const k = _strip(absPath);
     let cell;
     if (data instanceof Uint8Array) cell = data;
@@ -7627,31 +7657,20 @@ const __cryptoMod = (() => {
 // execution does not.  Documented in W3 retro for W3.5 follow-up
 // (a parser-based vm fallback, or pre-bundle vm-using scripts at
 // install time).
-// ── Runtime code: the async and generator Function constructors ──
+// ── Runtime code: the Function constructors ──
 //
 // A Worker generates code from strings only while its modules evaluate: at
 // request time — where every program runs — `new Function(...)` and its async
 // and generator siblings throw EvalError "Code generation from strings
-// disallowed for this context". The async and generator constructors here ask
-// the native one first and, refused that way, hand the arguments to the
-// launch's runtime-code service (core/_shared/commonjs-cell.ts, RUNTIME CODE),
-// which answers from this launch's module map or records the text for the next
-// launch of the command and throws EvalError code ERR_NIMBUS_CODE_NEXT_LAUNCH.
-// That is the constructor a module runner evaluates with (Vite's SSR runner:
-// `new AsyncFunction(...)`), reached as each kind's `prototype.constructor`,
-// which is how `(async function () {}).constructor` finds it. A facet without
-// the service (opencode's) keeps the native refusal.
-//
-// The plain `Function` constructor is routed differently, on evidence: code
-// probes it once and keeps the answer. TypeBox's CanEvaluate (pi 0.87.1) tries
-// `Function("null")`, remembers whether it worked, and then compiles every
-// schema check with `Function`; staging every text, the next launch staged the
-// probe's text but not the checks' — the probe said yes, the first check threw,
-// and pi's TUI died. So it answers only text an earlier launch staged, keeps
-// the native refusal otherwise, and stages a refused text only when a failed
-// launch is attributable to it (the service's plainFunction, noteFailure and
-// stageFailedLaunch): a probe answers the same in every launch, while depd's
-// wrapper (express 4) and ajv's validators (serve) run from the next launch on.
+// disallowed for this context". Each constructor here asks the native one
+// first and, refused that way, hands the arguments to the launch's
+// runtime-code service (core/_shared/commonjs-cell.ts, RUNTIME CODE), which
+// answers from this launch's module map when an earlier launch staged the
+// text, and otherwise records it for the next launch and runs it in the
+// interpreter. That is the constructor a module runner evaluates with
+// (Vite's SSR runner: `new AsyncFunction(...)`), reached as each kind's
+// `prototype.constructor`, which is how `(async function () {}).constructor`
+// finds it. A facet without the service (opencode's) keeps the native refusal.
 function __nimbusIsCodegenRefusal(e) {
   return e instanceof EvalError && /Code generation from strings disallowed/.test(String(e.message));
 }
@@ -7772,15 +7791,20 @@ const __nimbusDecodeStringLiteral = function decodeJavaScriptStringLiteral(sourc
     if (Native.__nimbusNative) continue;
     const routed = function (...args) {
       try {
-        return Reflect.apply(Native, undefined, args);
+        return new.target === undefined ? Reflect.apply(Native, undefined, args) : Reflect.construct(Native, args, new.target);
       } catch (e) {
         const service = globalThis.__nimbusRuntimeCode;
         if (!__nimbusIsCodegenRefusal(e) || !service) throw e;
         const params = args.slice(0, -1).map(String);
         const body = args.length > 0 ? String(args[args.length - 1]) : "";
-        if (kind === "function") return service.plainFunction(params, body, e);
         try {
-          return service.compileFunction(kind, params, body);
+          const fn = service.compileFunction(kind, params, body);
+          // A subclass's `new` (`class F extends Function`) makes an instance of the subclass.
+          if (new.target !== undefined && new.target !== routed) {
+            const proto = new.target.prototype;
+            if (proto !== null && (typeof proto === "object" || typeof proto === "function")) Object.setPrototypeOf(fn, proto);
+          }
+          return fn;
         } catch (refusal) {
           const importAt = params.indexOf("__vite_ssr_import__");
           if (kind !== "async" || importAt < 0 || !refusal || refusal.code !== "ERR_NIMBUS_CODE_NEXT_LAUNCH") throw refusal;
@@ -7813,6 +7837,11 @@ const __nimbusDecodeStringLiteral = function decodeJavaScriptStringLiteral(sourc
 
 const __vmMod = (() => {
   const real = (typeof __real_vm !== 'undefined') ? (__real_vm.default ?? __real_vm) : null;
+  // What a script's function is called with, as the launch starts: the
+  // program may later replace Reflect.apply or the globalThis property, and
+  // native vm consults neither.
+  const apply = Reflect.apply;
+  const scriptThis = globalThis;
   function honestError(method, originalErr) {
     const e = new Error(
       'vm.' + method + ': workerd does not implement runtime eval. ' +
@@ -7849,12 +7878,16 @@ const __vmMod = (() => {
     isContext: real?.isContext ?? ((o) => !!o),
     runInContext: wrapRuntimeEval('runInContext'),
     runInNewContext: wrapRuntimeEval('runInNewContext'),
-    // jiti evaluates a parenthesized (async) CommonJS wrapper expression.
-    // Stage that expression as a zero-argument function returning its value;
-    // the wrapper itself executes only when the caller invokes it. This is
-    // not a vm context or a global-script evaluator: declarations/completion
-    // values spanning statements, execution deadlines and context mutation
-    // have no equivalent here and remain unsupported.
+    // jiti evaluates a parenthesized (async) CommonJS wrapper expression
+    // statement, `(function (exports, require, ...) { ... });`. The service
+    // stages a script that is one expression as a zero-argument function
+    // returning its value (the script's completion value); the wrapper
+    // itself executes only when the caller invokes it. The function is
+    // called with the global object as `this`, which is a script's
+    // `this` at its top level, strict or not. This is not a vm
+    // context or a global-script evaluator: declarations/completion values
+    // spanning statements, execution deadlines and context mutation have no
+    // equivalent here and remain unsupported.
     runInThisContext: (code, options = {}) => {
       try { return wrapRuntimeEval('runInThisContext')(code, options); }
       catch (e) {
@@ -7862,7 +7895,7 @@ const __vmMod = (() => {
         if (e?.code !== 'ERR_VM_DYNAMIC_EVAL_DISALLOWED' || !service
           || options?.timeout !== undefined || options?.breakOnSigint
           || options?.importModuleDynamically || options?.cachedData) throw e;
-        return service.compileFunction("function", [], "return (\n" + String(code) + "\n);")();
+        return apply(service.compileExpression(String(code)), scriptThis, []);
       }
     },
     // A function of `params` and `code` is what the Function constructor
@@ -7888,45 +7921,540 @@ const __vmMod = (() => {
 })();
 
 // ═══════════════════════════════════════════════════════════════════════
-// ──  http2 module (W3: stub — non-throwing load, honest connect err) ─
+// ──  http2 module: Node's exports, no HTTP/2 transport ──────────────
 // ═══════════════════════════════════════════════════════════════════════
 //
 // axios's dist/node code does `var http2 = require('http2')` at top
-// level, unconditionally. Without this stub the require fails →
-// axios fails to load. The actual HTTP/2 transport is only invoked
-// when user opts in (`httpVersion: 2`); otherwise this shim is dormant.
-const __http2Mod = (() => {
-  function _err(op) {
-    const e = new Error('http2.' + op + ': not implemented in Nimbus. Use fetch() or HTTP/1.1.');
-    e.code = 'ERR_HTTP2_NOT_SUPPORTED';
-    return e;
+// level, unconditionally, and Astro's dev server asks
+// `res instanceof Http2ServerResponse` of every response: the module
+// loads with every name Node's has, and only opening HTTP/2 refuses.
+// core/_shared/http2-module.ts, compiled once by
+// scripts/bundle-facet-workers.mjs, declares createHttp2Module; the
+// substrate's node-compat imports the same function.
+function createHttp2Module(host) {
+  const nodeError = (Base, code, message, props = {}) => Object.assign(new Base(message), { code }, props);
+  const notSupported = (op) => nodeError(Error, "ERR_HTTP2_NOT_SUPPORTED", `http2.${op}: not implemented in Nimbus. Use fetch() or HTTP/1.1.`);
+  const describe = (value) => {
+    if (value === null) return "null";
+    if (value === void 0) return "undefined";
+    switch (typeof value) {
+      case "bigint":
+        return `type bigint (${value}n)`;
+      case "number":
+        if (Object.is(value, -0)) return "type number (-0)";
+        return `type number (${value})`;
+      case "boolean":
+        return `type boolean (${value})`;
+      case "symbol":
+        return `type symbol (${String(value)})`;
+      case "function":
+        return `function ${value.name}`;
+      case "string": {
+        const shown = value.length > 28 ? `${value.slice(0, 25)}...` : value;
+        return shown.includes("'") ? `type string (${JSON.stringify(shown)})` : `type string ('${shown}')`;
+      }
+      default: {
+        const ctor = Reflect.get(Object(value), "constructor");
+        return typeof ctor === "function" && ctor.name ? `an instance of ${ctor.name}` : String(value);
+      }
+    }
+  };
+  const invalidArgType = (name, expected, value) => nodeError(TypeError, "ERR_INVALID_ARG_TYPE", `The "${name}" argument must be ${expected}. Received ${describe(value)}`);
+  const invalidSetting = (Base, name, actual, min, max) => nodeError(
+    Base,
+    "ERR_HTTP2_INVALID_SETTING_VALUE",
+    `Invalid value for setting "${name}": ${String(actual)}`,
+    min === void 0 ? { actual } : { actual, min, max }
+  );
+  const MAX_INT = 2 ** 32 - 1;
+  const MAX_ADDITIONAL_SETTINGS = 10;
+  const HEADER_TABLE_SIZE = 1;
+  const ENABLE_PUSH = 2;
+  const MAX_CONCURRENT_STREAMS = 3;
+  const INITIAL_WINDOW_SIZE = 4;
+  const MAX_FRAME_SIZE = 5;
+  const MAX_HEADER_LIST_SIZE = 6;
+  const ENABLE_CONNECT_PROTOCOL = 8;
+  const NO_RFC7540_PRIORITIES = 9;
+  const isObjectArg = (value) => value === void 0 || value !== null && typeof value === "object" && !Array.isArray(value);
+  const withinRange = (name, value, min, max) => {
+    if (value !== void 0 && (typeof value !== "number" || value < min || value > max)) {
+      throw invalidSetting(RangeError, name, value, min, max);
+    }
+  };
+  const validate = (settings) => {
+    if (settings === void 0) return;
+    if (!isObjectArg(settings.customSettings)) throw invalidArgType("customSettings", "an instance of Number", settings.customSettings);
+    if (settings.customSettings) {
+      const entries = Object.entries(settings.customSettings);
+      if (entries.length > MAX_ADDITIONAL_SETTINGS) {
+        throw nodeError(Error, "ERR_HTTP2_TOO_MANY_CUSTOM_SETTINGS", "Number of custom settings exceeds MAX_ADDITIONAL_SETTINGS");
+      }
+      for (const [key, value] of entries) {
+        withinRange("customSettings:id", Number(key), 0, 65535);
+        withinRange("customSettings:value", Number(value), 0, MAX_INT);
+      }
+    }
+    withinRange("headerTableSize", settings.headerTableSize, 0, MAX_INT);
+    withinRange("initialWindowSize", settings.initialWindowSize, 0, 2 ** 31 - 1);
+    withinRange("maxFrameSize", settings.maxFrameSize, 16384, 2 ** 24 - 1);
+    withinRange("maxConcurrentStreams", settings.maxConcurrentStreams, 0, MAX_INT);
+    withinRange("maxHeaderListSize", settings.maxHeaderListSize, 0, MAX_INT);
+    withinRange("maxHeaderSize", settings.maxHeaderSize, 0, MAX_INT);
+    for (const name of ["enablePush", "enableConnectProtocol"]) {
+      const value = settings[name];
+      if (value !== void 0 && typeof value !== "boolean") throw invalidSetting(TypeError, name, value);
+    }
+  };
+  function getDefaultSettings() {
+    const settings =   Object.create(null);
+    settings.headerTableSize = 4096;
+    settings.enablePush = true;
+    settings.initialWindowSize = 65535;
+    settings.maxFrameSize = 16384;
+    settings.maxConcurrentStreams = MAX_INT;
+    settings.maxHeaderListSize = settings.maxHeaderSize = 65535;
+    settings.enableConnectProtocol = false;
+    return settings;
+  }
+  function getPackedSettings(settings) {
+    if (!isObjectArg(settings)) throw invalidArgType("settings", "of type object", settings);
+    validate(settings);
+    const given = { ...settings };
+    const slots = [
+      "headerTableSize",
+      "enablePush",
+      "initialWindowSize",
+      "maxFrameSize",
+      "maxConcurrentStreams",
+      "maxHeaderListSize",
+      "enableConnectProtocol"
+    ];
+    const known =   new Map();
+    const custom =   new Map();
+    if (typeof given.customSettings === "object") {
+      for (const key in given.customSettings) {
+        const value = given.customSettings[key];
+        if (typeof value !== "number") continue;
+        const id = Number(key);
+        if (Number.isNaN(id) || id <= 0 || id > 65535) throw invalidSetting(RangeError, "Range Error", id, 0, 65535);
+        if (Number.isNaN(value) || value <= 0 || value > 4294967295) throw invalidSetting(RangeError, "Range Error", value, 0, 4294967295);
+        if (id < slots.length) known.set(slots[id], value);
+        else {
+          if (!custom.has(id) && custom.size === MAX_ADDITIONAL_SETTINGS) {
+            throw nodeError(Error, "ERR_HTTP2_TOO_MANY_CUSTOM_SETTINGS", "Number of custom settings exceeds MAX_ADDITIONAL_SETTINGS");
+          }
+          custom.set(id, value);
+        }
+      }
+    }
+    for (const name of ["headerTableSize", "maxConcurrentStreams", "initialWindowSize", "maxFrameSize"]) {
+      const value = given[name];
+      if (typeof value === "number") known.set(name, value);
+    }
+    if (typeof given.maxHeaderListSize === "number" || typeof given.maxHeaderSize === "number") {
+      if (given.maxHeaderSize !== void 0 && given.maxHeaderSize !== given.maxHeaderListSize) {
+        host.emitWarning?.("settings.maxHeaderSize overwrite settings.maxHeaderListSize");
+        known.set("maxHeaderListSize", Number(given.maxHeaderSize));
+      } else {
+        known.set("maxHeaderListSize", Number(given.maxHeaderListSize));
+      }
+    }
+    for (const name of ["enablePush", "enableConnectProtocol"]) {
+      const value = given[name];
+      if (typeof value === "boolean") known.set(name, Number(value));
+    }
+    const ids = {
+      headerTableSize: HEADER_TABLE_SIZE,
+      enablePush: ENABLE_PUSH,
+      maxConcurrentStreams: MAX_CONCURRENT_STREAMS,
+      initialWindowSize: INITIAL_WINDOW_SIZE,
+      maxFrameSize: MAX_FRAME_SIZE,
+      maxHeaderListSize: MAX_HEADER_LIST_SIZE,
+      enableConnectProtocol: ENABLE_CONNECT_PROTOCOL
+    };
+    const entries = [];
+    for (const name of [
+      "headerTableSize",
+      "enablePush",
+      "maxConcurrentStreams",
+      "initialWindowSize",
+      "maxFrameSize",
+      "maxHeaderListSize",
+      "enableConnectProtocol"
+    ]) {
+      const value = known.get(name);
+      if (value !== void 0) entries.push([ids[name], value >>> 0]);
+    }
+    for (const [id, value] of custom) entries.push([id, value >>> 0]);
+    for (const [id, value] of entries) {
+      if ((id === ENABLE_PUSH || id === ENABLE_CONNECT_PROTOCOL || id === NO_RFC7540_PRIORITIES) && value > 1) return void 0;
+      if (id === INITIAL_WINDOW_SIZE && value > 2 ** 31 - 1) return void 0;
+      if (id === MAX_FRAME_SIZE && (value < 16384 || value > 2 ** 24 - 1)) return void 0;
+    }
+    const out = host.Buffer.alloc(entries.length * 6);
+    const view = new DataView(out.buffer, out.byteOffset, out.byteLength);
+    entries.forEach(([id, value], i) => {
+      view.setUint16(i * 6, id);
+      view.setUint32(i * 6 + 2, value);
+    });
+    return out;
   }
-  class Http2Session extends __eventsMod {
-    constructor() { super(); this.destroyed = false; }
-    request() { throw _err('request'); }
-    close() { this.destroyed = true; this.emit('close'); }
-    destroy(err) { this.destroyed = true; if (err) this.emit('error', err); this.emit('close'); }
-    settings() {}
+  function getUnpackedSettings(buf, options = {}) {
+    if (!ArrayBuffer.isView(buf) || Reflect.get(buf, "length") === void 0) {
+      throw invalidArgType("buf", "an instance of Buffer or TypedArray", buf);
+    }
+    if (buf.length % 6 !== 0) {
+      throw nodeError(RangeError, "ERR_HTTP2_INVALID_PACKED_SETTINGS_LENGTH", "Packed settings length must be a multiple of six");
+    }
+    const settings = {};
+    for (let offset = 0; offset < buf.length; offset += 6) {
+      const id = buf[offset] * 2 ** 8 + buf[offset + 1];
+      const value = buf[offset + 2] * 2 ** 24 + buf[offset + 3] * 2 ** 16 + buf[offset + 4] * 2 ** 8 + buf[offset + 5];
+      switch (id) {
+        case HEADER_TABLE_SIZE:
+          settings.headerTableSize = value;
+          break;
+        case ENABLE_PUSH:
+          settings.enablePush = value !== 0;
+          break;
+        case MAX_CONCURRENT_STREAMS:
+          settings.maxConcurrentStreams = value;
+          break;
+        case INITIAL_WINDOW_SIZE:
+          settings.initialWindowSize = value;
+          break;
+        case MAX_FRAME_SIZE:
+          settings.maxFrameSize = value;
+          break;
+        case MAX_HEADER_LIST_SIZE:
+          settings.maxHeaderListSize = settings.maxHeaderSize = value;
+          break;
+        case ENABLE_CONNECT_PROTOCOL:
+          settings.enableConnectProtocol = value !== 0;
+          break;
+        default:
+          (settings.customSettings ??= {})[id] = value;
+      }
+    }
+    if (options != null && options.validate) validate(settings);
+    return settings;
+  }
+  class ClientHttp2Session extends host.EventEmitter {
+    destroyed = false;
+    closed = false;
+    constructor() {
+      super();
+      queueMicrotask(() => this.emit("error", notSupported("connect")));
+    }
+    request() {
+      throw notSupported("request");
+    }
+    settings() {
+    }
+    close(callback) {
+      this.closed = true;
+      queueMicrotask(() => {
+        this.emit("close");
+        callback?.();
+      });
+    }
+    destroy(error) {
+      this.destroyed = true;
+      if (error) this.emit("error", error);
+      this.emit("close");
+    }
+  }
+  function connect(_authority, _options, _listener) {
+    return new ClientHttp2Session();
+  }
+  function createServer(_options, _onRequestHandler) {
+    throw notSupported("createServer");
   }
-  function connect(/* authority, opts, listener */) {
-    const session = new Http2Session();
-    queueMicrotask(() => session.emit('error', _err('connect')));
-    return session;
+  function createSecureServer(_options, _onRequestHandler) {
+    throw notSupported("createSecureServer");
   }
-  function createServer() { throw _err('createServer'); }
+  function performServerHandshake(_socket, _options = {}) {
+    throw notSupported("performServerHandshake");
+  }
+  class Http2ServerRequest extends host.Readable {
+    constructor(_stream, _headers, _options, _rawHeaders) {
+      super();
+      throw notSupported("Http2ServerRequest");
+    }
+  }
+  class Http2ServerResponse extends host.Stream {
+    constructor(_stream, _options) {
+      super();
+      throw notSupported("Http2ServerResponse");
+    }
+  }
+  const constants = {
+    NGHTTP2_ERR_FRAME_SIZE_ERROR: -522,
+    NGHTTP2_SESSION_SERVER: 0,
+    NGHTTP2_SESSION_CLIENT: 1,
+    NGHTTP2_STREAM_STATE_IDLE: 1,
+    NGHTTP2_STREAM_STATE_OPEN: 2,
+    NGHTTP2_STREAM_STATE_RESERVED_LOCAL: 3,
+    NGHTTP2_STREAM_STATE_RESERVED_REMOTE: 4,
+    NGHTTP2_STREAM_STATE_HALF_CLOSED_LOCAL: 5,
+    NGHTTP2_STREAM_STATE_HALF_CLOSED_REMOTE: 6,
+    NGHTTP2_STREAM_STATE_CLOSED: 7,
+    NGHTTP2_FLAG_NONE: 0,
+    NGHTTP2_FLAG_END_STREAM: 1,
+    NGHTTP2_FLAG_END_HEADERS: 4,
+    NGHTTP2_FLAG_ACK: 1,
+    NGHTTP2_FLAG_PADDED: 8,
+    NGHTTP2_FLAG_PRIORITY: 32,
+    DEFAULT_SETTINGS_HEADER_TABLE_SIZE: 4096,
+    DEFAULT_SETTINGS_ENABLE_PUSH: 1,
+    DEFAULT_SETTINGS_MAX_CONCURRENT_STREAMS: 4294967295,
+    DEFAULT_SETTINGS_INITIAL_WINDOW_SIZE: 65535,
+    DEFAULT_SETTINGS_MAX_FRAME_SIZE: 16384,
+    DEFAULT_SETTINGS_MAX_HEADER_LIST_SIZE: 65535,
+    DEFAULT_SETTINGS_ENABLE_CONNECT_PROTOCOL: 0,
+    MAX_MAX_FRAME_SIZE: 16777215,
+    MIN_MAX_FRAME_SIZE: 16384,
+    MAX_INITIAL_WINDOW_SIZE: 2147483647,
+    NGHTTP2_SETTINGS_HEADER_TABLE_SIZE: 1,
+    NGHTTP2_SETTINGS_ENABLE_PUSH: 2,
+    NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS: 3,
+    NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE: 4,
+    NGHTTP2_SETTINGS_MAX_FRAME_SIZE: 5,
+    NGHTTP2_SETTINGS_MAX_HEADER_LIST_SIZE: 6,
+    NGHTTP2_SETTINGS_ENABLE_CONNECT_PROTOCOL: 8,
+    PADDING_STRATEGY_NONE: 0,
+    PADDING_STRATEGY_ALIGNED: 1,
+    PADDING_STRATEGY_MAX: 2,
+    PADDING_STRATEGY_CALLBACK: 1,
+    NGHTTP2_NO_ERROR: 0,
+    NGHTTP2_PROTOCOL_ERROR: 1,
+    NGHTTP2_INTERNAL_ERROR: 2,
+    NGHTTP2_FLOW_CONTROL_ERROR: 3,
+    NGHTTP2_SETTINGS_TIMEOUT: 4,
+    NGHTTP2_STREAM_CLOSED: 5,
+    NGHTTP2_FRAME_SIZE_ERROR: 6,
+    NGHTTP2_REFUSED_STREAM: 7,
+    NGHTTP2_CANCEL: 8,
+    NGHTTP2_COMPRESSION_ERROR: 9,
+    NGHTTP2_CONNECT_ERROR: 10,
+    NGHTTP2_ENHANCE_YOUR_CALM: 11,
+    NGHTTP2_INADEQUATE_SECURITY: 12,
+    NGHTTP2_HTTP_1_1_REQUIRED: 13,
+    NGHTTP2_DEFAULT_WEIGHT: 16,
+    HTTP2_HEADER_STATUS: ":status",
+    HTTP2_HEADER_METHOD: ":method",
+    HTTP2_HEADER_AUTHORITY: ":authority",
+    HTTP2_HEADER_SCHEME: ":scheme",
+    HTTP2_HEADER_PATH: ":path",
+    HTTP2_HEADER_PROTOCOL: ":protocol",
+    HTTP2_HEADER_ACCEPT_ENCODING: "accept-encoding",
+    HTTP2_HEADER_ACCEPT_LANGUAGE: "accept-language",
+    HTTP2_HEADER_ACCEPT_RANGES: "accept-ranges",
+    HTTP2_HEADER_ACCEPT: "accept",
+    HTTP2_HEADER_ACCESS_CONTROL_ALLOW_CREDENTIALS: "access-control-allow-credentials",
+    HTTP2_HEADER_ACCESS_CONTROL_ALLOW_HEADERS: "access-control-allow-headers",
+    HTTP2_HEADER_ACCESS_CONTROL_ALLOW_METHODS: "access-control-allow-methods",
+    HTTP2_HEADER_ACCESS_CONTROL_ALLOW_ORIGIN: "access-control-allow-origin",
+    HTTP2_HEADER_ACCESS_CONTROL_EXPOSE_HEADERS: "access-control-expose-headers",
+    HTTP2_HEADER_ACCESS_CONTROL_REQUEST_HEADERS: "access-control-request-headers",
+    HTTP2_HEADER_ACCESS_CONTROL_REQUEST_METHOD: "access-control-request-method",
+    HTTP2_HEADER_AGE: "age",
+    HTTP2_HEADER_AUTHORIZATION: "authorization",
+    HTTP2_HEADER_CACHE_CONTROL: "cache-control",
+    HTTP2_HEADER_CONNECTION: "connection",
+    HTTP2_HEADER_CONTENT_DISPOSITION: "content-disposition",
+    HTTP2_HEADER_CONTENT_ENCODING: "content-encoding",
+    HTTP2_HEADER_CONTENT_LENGTH: "content-length",
+    HTTP2_HEADER_CONTENT_TYPE: "content-type",
+    HTTP2_HEADER_COOKIE: "cookie",
+    HTTP2_HEADER_DATE: "date",
+    HTTP2_HEADER_ETAG: "etag",
+    HTTP2_HEADER_FORWARDED: "forwarded",
+    HTTP2_HEADER_HOST: "host",
+    HTTP2_HEADER_IF_MODIFIED_SINCE: "if-modified-since",
+    HTTP2_HEADER_IF_NONE_MATCH: "if-none-match",
+    HTTP2_HEADER_IF_RANGE: "if-range",
+    HTTP2_HEADER_LAST_MODIFIED: "last-modified",
+    HTTP2_HEADER_LINK: "link",
+    HTTP2_HEADER_LOCATION: "location",
+    HTTP2_HEADER_RANGE: "range",
+    HTTP2_HEADER_REFERER: "referer",
+    HTTP2_HEADER_SERVER: "server",
+    HTTP2_HEADER_SET_COOKIE: "set-cookie",
+    HTTP2_HEADER_STRICT_TRANSPORT_SECURITY: "strict-transport-security",
+    HTTP2_HEADER_TRANSFER_ENCODING: "transfer-encoding",
+    HTTP2_HEADER_TE: "te",
+    HTTP2_HEADER_UPGRADE_INSECURE_REQUESTS: "upgrade-insecure-requests",
+    HTTP2_HEADER_UPGRADE: "upgrade",
+    HTTP2_HEADER_USER_AGENT: "user-agent",
+    HTTP2_HEADER_VARY: "vary",
+    HTTP2_HEADER_X_CONTENT_TYPE_OPTIONS: "x-content-type-options",
+    HTTP2_HEADER_X_FRAME_OPTIONS: "x-frame-options",
+    HTTP2_HEADER_KEEP_ALIVE: "keep-alive",
+    HTTP2_HEADER_PROXY_CONNECTION: "proxy-connection",
+    HTTP2_HEADER_X_XSS_PROTECTION: "x-xss-protection",
+    HTTP2_HEADER_ALT_SVC: "alt-svc",
+    HTTP2_HEADER_CONTENT_SECURITY_POLICY: "content-security-policy",
+    HTTP2_HEADER_EARLY_DATA: "early-data",
+    HTTP2_HEADER_EXPECT_CT: "expect-ct",
+    HTTP2_HEADER_ORIGIN: "origin",
+    HTTP2_HEADER_PURPOSE: "purpose",
+    HTTP2_HEADER_TIMING_ALLOW_ORIGIN: "timing-allow-origin",
+    HTTP2_HEADER_X_FORWARDED_FOR: "x-forwarded-for",
+    HTTP2_HEADER_PRIORITY: "priority",
+    HTTP2_HEADER_ACCEPT_CHARSET: "accept-charset",
+    HTTP2_HEADER_ACCESS_CONTROL_MAX_AGE: "access-control-max-age",
+    HTTP2_HEADER_ALLOW: "allow",
+    HTTP2_HEADER_CONTENT_LANGUAGE: "content-language",
+    HTTP2_HEADER_CONTENT_LOCATION: "content-location",
+    HTTP2_HEADER_CONTENT_MD5: "content-md5",
+    HTTP2_HEADER_CONTENT_RANGE: "content-range",
+    HTTP2_HEADER_DNT: "dnt",
+    HTTP2_HEADER_EXPECT: "expect",
+    HTTP2_HEADER_EXPIRES: "expires",
+    HTTP2_HEADER_FROM: "from",
+    HTTP2_HEADER_IF_MATCH: "if-match",
+    HTTP2_HEADER_IF_UNMODIFIED_SINCE: "if-unmodified-since",
+    HTTP2_HEADER_MAX_FORWARDS: "max-forwards",
+    HTTP2_HEADER_PREFER: "prefer",
+    HTTP2_HEADER_PROXY_AUTHENTICATE: "proxy-authenticate",
+    HTTP2_HEADER_PROXY_AUTHORIZATION: "proxy-authorization",
+    HTTP2_HEADER_REFRESH: "refresh",
+    HTTP2_HEADER_RETRY_AFTER: "retry-after",
+    HTTP2_HEADER_TRAILER: "trailer",
+    HTTP2_HEADER_TK: "tk",
+    HTTP2_HEADER_VIA: "via",
+    HTTP2_HEADER_WARNING: "warning",
+    HTTP2_HEADER_WWW_AUTHENTICATE: "www-authenticate",
+    HTTP2_HEADER_HTTP2_SETTINGS: "http2-settings",
+    HTTP2_METHOD_ACL: "ACL",
+    HTTP2_METHOD_BASELINE_CONTROL: "BASELINE-CONTROL",
+    HTTP2_METHOD_BIND: "BIND",
+    HTTP2_METHOD_CHECKIN: "CHECKIN",
+    HTTP2_METHOD_CHECKOUT: "CHECKOUT",
+    HTTP2_METHOD_CONNECT: "CONNECT",
+    HTTP2_METHOD_COPY: "COPY",
+    HTTP2_METHOD_DELETE: "DELETE",
+    HTTP2_METHOD_GET: "GET",
+    HTTP2_METHOD_HEAD: "HEAD",
+    HTTP2_METHOD_LABEL: "LABEL",
+    HTTP2_METHOD_LINK: "LINK",
+    HTTP2_METHOD_LOCK: "LOCK",
+    HTTP2_METHOD_MERGE: "MERGE",
+    HTTP2_METHOD_MKACTIVITY: "MKACTIVITY",
+    HTTP2_METHOD_MKCALENDAR: "MKCALENDAR",
+    HTTP2_METHOD_MKCOL: "MKCOL",
+    HTTP2_METHOD_MKREDIRECTREF: "MKREDIRECTREF",
+    HTTP2_METHOD_MKWORKSPACE: "MKWORKSPACE",
+    HTTP2_METHOD_MOVE: "MOVE",
+    HTTP2_METHOD_OPTIONS: "OPTIONS",
+    HTTP2_METHOD_ORDERPATCH: "ORDERPATCH",
+    HTTP2_METHOD_PATCH: "PATCH",
+    HTTP2_METHOD_POST: "POST",
+    HTTP2_METHOD_PRI: "PRI",
+    HTTP2_METHOD_PROPFIND: "PROPFIND",
+    HTTP2_METHOD_PROPPATCH: "PROPPATCH",
+    HTTP2_METHOD_PUT: "PUT",
+    HTTP2_METHOD_REBIND: "REBIND",
+    HTTP2_METHOD_REPORT: "REPORT",
+    HTTP2_METHOD_SEARCH: "SEARCH",
+    HTTP2_METHOD_TRACE: "TRACE",
+    HTTP2_METHOD_UNBIND: "UNBIND",
+    HTTP2_METHOD_UNCHECKOUT: "UNCHECKOUT",
+    HTTP2_METHOD_UNLINK: "UNLINK",
+    HTTP2_METHOD_UNLOCK: "UNLOCK",
+    HTTP2_METHOD_UPDATE: "UPDATE",
+    HTTP2_METHOD_UPDATEREDIRECTREF: "UPDATEREDIRECTREF",
+    HTTP2_METHOD_VERSION_CONTROL: "VERSION-CONTROL",
+    HTTP_STATUS_CONTINUE: 100,
+    HTTP_STATUS_SWITCHING_PROTOCOLS: 101,
+    HTTP_STATUS_PROCESSING: 102,
+    HTTP_STATUS_EARLY_HINTS: 103,
+    HTTP_STATUS_OK: 200,
+    HTTP_STATUS_CREATED: 201,
+    HTTP_STATUS_ACCEPTED: 202,
+    HTTP_STATUS_NON_AUTHORITATIVE_INFORMATION: 203,
+    HTTP_STATUS_NO_CONTENT: 204,
+    HTTP_STATUS_RESET_CONTENT: 205,
+    HTTP_STATUS_PARTIAL_CONTENT: 206,
+    HTTP_STATUS_MULTI_STATUS: 207,
+    HTTP_STATUS_ALREADY_REPORTED: 208,
+    HTTP_STATUS_IM_USED: 226,
+    HTTP_STATUS_MULTIPLE_CHOICES: 300,
+    HTTP_STATUS_MOVED_PERMANENTLY: 301,
+    HTTP_STATUS_FOUND: 302,
+    HTTP_STATUS_SEE_OTHER: 303,
+    HTTP_STATUS_NOT_MODIFIED: 304,
+    HTTP_STATUS_USE_PROXY: 305,
+    HTTP_STATUS_TEMPORARY_REDIRECT: 307,
+    HTTP_STATUS_PERMANENT_REDIRECT: 308,
+    HTTP_STATUS_BAD_REQUEST: 400,
+    HTTP_STATUS_UNAUTHORIZED: 401,
+    HTTP_STATUS_PAYMENT_REQUIRED: 402,
+    HTTP_STATUS_FORBIDDEN: 403,
+    HTTP_STATUS_NOT_FOUND: 404,
+    HTTP_STATUS_METHOD_NOT_ALLOWED: 405,
+    HTTP_STATUS_NOT_ACCEPTABLE: 406,
+    HTTP_STATUS_PROXY_AUTHENTICATION_REQUIRED: 407,
+    HTTP_STATUS_REQUEST_TIMEOUT: 408,
+    HTTP_STATUS_CONFLICT: 409,
+    HTTP_STATUS_GONE: 410,
+    HTTP_STATUS_LENGTH_REQUIRED: 411,
+    HTTP_STATUS_PRECONDITION_FAILED: 412,
+    HTTP_STATUS_PAYLOAD_TOO_LARGE: 413,
+    HTTP_STATUS_URI_TOO_LONG: 414,
+    HTTP_STATUS_UNSUPPORTED_MEDIA_TYPE: 415,
+    HTTP_STATUS_RANGE_NOT_SATISFIABLE: 416,
+    HTTP_STATUS_EXPECTATION_FAILED: 417,
+    HTTP_STATUS_TEAPOT: 418,
+    HTTP_STATUS_MISDIRECTED_REQUEST: 421,
+    HTTP_STATUS_UNPROCESSABLE_ENTITY: 422,
+    HTTP_STATUS_LOCKED: 423,
+    HTTP_STATUS_FAILED_DEPENDENCY: 424,
+    HTTP_STATUS_TOO_EARLY: 425,
+    HTTP_STATUS_UPGRADE_REQUIRED: 426,
+    HTTP_STATUS_PRECONDITION_REQUIRED: 428,
+    HTTP_STATUS_TOO_MANY_REQUESTS: 429,
+    HTTP_STATUS_REQUEST_HEADER_FIELDS_TOO_LARGE: 431,
+    HTTP_STATUS_UNAVAILABLE_FOR_LEGAL_REASONS: 451,
+    HTTP_STATUS_INTERNAL_SERVER_ERROR: 500,
+    HTTP_STATUS_NOT_IMPLEMENTED: 501,
+    HTTP_STATUS_BAD_GATEWAY: 502,
+    HTTP_STATUS_SERVICE_UNAVAILABLE: 503,
+    HTTP_STATUS_GATEWAY_TIMEOUT: 504,
+    HTTP_STATUS_HTTP_VERSION_NOT_SUPPORTED: 505,
+    HTTP_STATUS_VARIANT_ALSO_NEGOTIATES: 506,
+    HTTP_STATUS_INSUFFICIENT_STORAGE: 507,
+    HTTP_STATUS_LOOP_DETECTED: 508,
+    HTTP_STATUS_BANDWIDTH_LIMIT_EXCEEDED: 509,
+    HTTP_STATUS_NOT_EXTENDED: 510,
+    HTTP_STATUS_NETWORK_AUTHENTICATION_REQUIRED: 511
+  };
   return {
-    connect, createServer,
-    createSecureServer: createServer,
-    Http2Session,
-    constants: {
-      NGHTTP2_NO_ERROR: 0, NGHTTP2_PROTOCOL_ERROR: 1,
-      HTTP2_HEADER_PATH: ':path', HTTP2_HEADER_METHOD: ':method',
-      HTTP2_HEADER_STATUS: ':status', HTTP2_HEADER_AUTHORITY: ':authority',
-      HTTP2_HEADER_SCHEME: ':scheme',
-    },
-    sensitiveHeaders: Symbol('nodejs.http2.sensitiveHeaders'),
+    connect,
+    constants,
+    createServer,
+    createSecureServer,
+    getDefaultSettings,
+    getPackedSettings,
+    getUnpackedSettings,
+    performServerHandshake,
+    sensitiveHeaders:   Symbol("sensitiveHeaders"),
+    Http2ServerRequest,
+    Http2ServerResponse
   };
-})();
+}
+const __http2Mod = createHttp2Module({
+  EventEmitter: __eventsMod,
+  Readable: __streamMod.Readable,
+  Stream: __streamMod,
+  Buffer: __BufferMod,
+  emitWarning: (message) => {
+    const proc = globalThis.process;
+    if (proc && typeof proc.emitWarning === "function") proc.emitWarning(message);
+  },
+});
 
 // ═══════════════════════════════════════════════════════════════════════
 // ──  repl module (W3: forward to workerd) ───────────────────────────
@@ -9599,7 +10127,6 @@ function __nimbusFailUnhandledAsync(error, kind) {
     __nimbusReportProcessExit(error.code, "");
     return;
   }
-  if (globalThis.__nimbusRuntimeCode) globalThis.__nimbusRuntimeCode.noteFailure(error);
   const label = kind === "rejection"
     ? "Unhandled promise rejection: "
     : "Uncaught exception: ";
@@ -10838,6 +11365,9 @@ builtins.undici = __undiciMod;
 // ──  require() — full Node.js module resolution ─────────────────────
 // ═══════════════════════════════════════════════════════════════════════
 const __moduleCache = new Map();
+// A module cell's evaluation when it completes later (top-level await), by
+// its evaluation key: what an import of it waits for.
+const __moduleEvaluations = new Map();
 // package → why the package ABI policy says it cannot run here (wasm-swap-registry.ts).
 const __nimbusAbiAdvisories = new Map([["sharp","Native libvips bindings; not portable to Workers. … try: no Workers-compatible target — render server-side or use Cloudflare Images. For the wasm32 build see @img/sharp-wasm32 entry below."],["sqlite3","Native sqlite3 .node binding. … try: better-sqlite3-wasm (untested by Nimbus) or sql.js once wasm asset loading is available."],["better-sqlite3","Native sqlite .node binding. … try: better-sqlite3-wasm (untested by Nimbus) or @libsql/client if its subpath exports resolve in your project."],["canvas","Native Cairo bindings. … try: canvaskit-wasm (Skia -> WASM, canvas-API-compatible, ~7MB; untested by Nimbus) or @resvg/resvg-wasm for SVG."],["sodium-native","Native libsodium. … try: tweetnacl (pure JS, untested by Nimbus) or libsodium-wrappers (WASM, untested by Nimbus)."],["node-pty","PTY syscalls unavailable in workerd. … try: no Workers-compatible target — use the Nimbus built-in shell."],["robotjs","Desktop automation; sandboxed Workers cannot access OS UI. … try: no Workers-compatible target."],["electron","Embedded Chromium runtime; not applicable to Workers. … try: no Workers-compatible target."],["bcrypt","Native bcrypt; pure-JS bcryptjs has an equivalent sync API but the require() name differs and Nimbus does not yet support npm aliases. … try: change `require(\"bcrypt\")` to `require(\"bcryptjs\")`, then `npm install bcryptjs`. APIs are sync-compatible."],["argon2","Native Argon2 C bindings. … try: hash-wasm for argon2d, argon2i, and argon2id."],["node-sass","Native libsass; deprecated upstream. … try: sass (dart-sass, pure JS)."],["grpc","Deprecated native gRPC. … try: @grpc/grpc-js (pure JS, untested end-to-end in Nimbus)."],["@swc/core","Native Rust SWC. … try: @swc/wasm-web for transform/parse only; it does not provide the native Plugin API."],["prisma","Native query engine; not portable to Workers in this configuration. … try: @prisma/adapter-d1 (Prisma official Workers adapter, untested by Nimbus), or migrate to drizzle-orm + @libsql/client (untested by Nimbus)."],["@prisma/client","Same as `prisma` (native query engine). … try: @prisma/adapter-d1 (untested by Nimbus), or drizzle-orm + @libsql/client (untested)."],["puppeteer","Bundled Chromium binary (~150 MB). … try: no Workers-compatible target for the bundled binary — use puppeteer-core + Cloudflare Browser Rendering (untested by Nimbus)."],["playwright","Bundled browsers (~300 MB). … try: no Workers-compatible target for bundled browsers — use @playwright/test against a remote browser endpoint (untested by Nimbus)."],["sql.js","Installs but fails at runtime because dist/sql-wasm.wasm is not available to the runtime loader. … try: For SQL in Workers, consider Cloudflare D1 or @libsql/client."],["@swc/wasm-web","Installs but fails at runtime because its generated code path depends on workerd-blocked dynamic code generation. … try: For ESM transforms consider esbuild-wasm."],["@img/sharp-wasm32","WASM build of sharp; package is wasm32-cpu-only and libvips initThreads() requires pthread support unavailable in Workers. … try: wasm-vips may work for simple pipelines; for complex pipelines, render server-side and ship pixels."],["@napi-rs/canvas","Native bindings only (linux-x64-gnu/musl, darwin-arm64/x64, android-arm64, linux-arm64-gnu/musl, win32-x64-msvc, linux-arm-gnueabihf). No WASM build published. … try: canvaskit-wasm (Skia -> WASM, canvas-API-compatible, ~7MB; untested by Nimbus) or @resvg/resvg-wasm for SVG."],["@napi-rs/canvas-wasm32-wasi","@napi-rs/canvas does not publish a wasm32-wasi variant on npm (404). The @napi-rs/canvas project ships only native bindings. No WASM/WASI build exists. … try: canvaskit-wasm (Skia -> WASM, canvas-API-compatible; untested by Nimbus) or @resvg/resvg-wasm for SVG."],["@tailwindcss/oxide","Native Rust Tailwind v4 oxide engine; ships only platform-specific .node bindings plus a wasm32-wasi shard. workerd has no node:wasi, and bare native bindings cannot dlopen. … try: no Workers-compatible target — Tailwind v3 (`tailwindcss@^3`) is pure JS and works in Workers (untested by Nimbus). Tailwind v4 inherently requires the Rust oxide engine."]]);
 
@@ -11340,6 +11870,22 @@ function __makeLoadingExports(mod) {
  * Nothing here compiles source: request-time code generation is not
  * available in a Worker, so a file the launch did not map cannot run.
  */
+// import.meta of the module file at `filename`, evaluated as `url`: an
+// entry script's or a loaded module's. It lives on the module, not in source
+// text, so the five CommonJS arguments stay as they are, and
+// import.meta.resolve keeps its parent even when extracted and called later.
+// The registry's own import.meta cannot serve: its module URLs all live
+// under file:///bundle/, never at the file's own path. dirname and filename
+// name the file, without the URL's query or fragment.
+function __nimbusFileImportMeta(filename, url = builtins.url.pathToFileURL(filename).href) {
+  return Object.assign(Object.create(null), {
+    dirname: __pathMod.dirname(filename),
+    filename,
+    url,
+    resolve: (specifier) => globalThis.__nimbusImportMetaResolve(specifier, url),
+  });
+}
+
 function __loadModule(resolvedPath, evaluationKey = resolvedPath) {
   if (globalThis.__nimbusProfileStaged) globalThis.__nimbusProfileStaged.delete(String(resolvedPath).replace(/^\/+/, ""));
   if (__moduleCache.has(evaluationKey)) return __moduleCache.get(evaluationKey);
@@ -11377,19 +11923,7 @@ function __loadModule(resolvedPath, evaluationKey = resolvedPath) {
   globalThis.__currentModulePath = resolvedPath;
   const moduleUrl = evaluationKey.startsWith("file:")
     ? evaluationKey : builtins.url.pathToFileURL("/" + resolvedPath).href;
-  // Evaluation metadata lives on the module, not in source text. Keeping
-  // it here preserves the five CommonJS arguments and captures the parent
-  // even when import.meta.resolve is extracted and called later. The
-  // registry's own import.meta cannot serve: its module URLs all live under
-  // file:///bundle/, never at the file's own path.
-  // dirname and filename name the file, without the URL's query or fragment.
-  const importMeta = Object.assign(Object.create(null), {
-    dirname: __pathMod.dirname("/" + resolvedPath),
-    filename: "/" + resolvedPath,
-    url: moduleUrl,
-    resolve: (specifier) => globalThis.__nimbusImportMetaResolve(specifier, moduleUrl),
-  });
-  Object.defineProperty(mod, "__nimbusImportMeta", { value: importMeta });
+  Object.defineProperty(mod, "__nimbusImportMeta", { value: __nimbusFileImportMeta("/" + resolvedPath, moduleUrl) });
   try {
     const normalizedPath = resolvedPath.replace(/^\/+/, "");
     let cell = __nimbusModuleCell(normalizedPath);
@@ -11407,7 +11941,11 @@ function __loadModule(resolvedPath, evaluationKey = resolvedPath) {
       cell = __nimbusRuntimeModule(normalizedPath, text);
       globalThis.__nimbusModuleMisses.delete(normalizedPath);
     }
-    cell(mod.exports, scopedRequire, mod, "/" + resolvedPath, "/" + modDir);
+    const evaluation = cell(mod.exports, scopedRequire, mod, "/" + resolvedPath, "/" + modDir);
+    // A module with top-level await completes later. require() returns its
+    // exports now (static imports lowered to require cannot wait); import()
+    // waits for it (__esmLoad).
+    if (evaluation && typeof evaluation.then === "function") __moduleEvaluations.set(evaluationKey, evaluation);
   } catch (e) {
     __moduleCache.delete(evaluationKey);
     if (e && typeof e === "object" && !e.__nimbusModulePath) {
@@ -12096,21 +12634,31 @@ function __esmLoad(resolution) {
     // Canonical queryless ESM shares evaluation with require() and static
     // imports lowered to require(). Queries/fragments are distinct jobs.
     const variant = esm && (resolution.url.includes("?") || resolution.url.includes("#"));
-    const exports = __loadModule(key, variant ? resolution.url : key);
-    if (resolution.format === "json") {
-      ns = __esmNamespaceOf(["default"], () => exports);
-    } else if (esm) {
-      // The ESM→CJS transform's exports: the module's own names, live.
-      const names = exports && typeof exports === "object" ? Object.keys(exports).filter((name) => name !== "__esModule") : [];
-      ns = __esmNamespaceOf(names, (name) => exports[name]);
-    } else {
+    const evaluationKey = variant ? resolution.url : key;
+    const exports = __loadModule(key, evaluationKey);
+    const namespace = () => {
+      if (resolution.format === "json") return __esmNamespaceOf(["default"], () => exports);
+      if (esm) {
+        // The ESM→CJS transform's exports: the module's own names, live.
+        const names = exports && typeof exports === "object" ? Object.keys(exports).filter((name) => name !== "__esModule") : [];
+        return __esmNamespaceOf(names, (name) => exports[name]);
+      }
       // CommonJS: module.exports is the default, its names the named exports.
       const mod = exports;
       const names = new Set(mod && (typeof mod === "object" || typeof mod === "function") ? Object.keys(mod) : []);
       names.delete("default");
       names.add("default");
-      ns = __esmNamespaceOf(names, (name) => name === "default" ? mod : mod[name]);
-    }
+      return __esmNamespaceOf(names, (name) => name === "default" ? mod : mod[name]);
+    };
+    // A module with top-level await: the import resolves once its evaluation
+    // completes, and rejects with what it throws.
+    const evaluation = __moduleEvaluations.get(evaluationKey);
+    if (evaluation !== undefined) {
+      const pending = evaluation.then(namespace, (error) => { __esmNamespaces.delete(resolution.url); throw error; });
+      __esmNamespaces.set(resolution.url, pending);
+      return pending;
+    }
+    ns = namespace();
   }
   __esmNamespaces.set(resolution.url, ns);
   return ns;