@nimbus-sh/worker 0.12.0 → 0.13.0

package/scripts/bundle-esbuild-wasm.mjs

@@ -4,24 +4,21 @@
  *
  * Why this exists
  * ───────────────
- * Pre-bundling npm packages (the `Pre-bundling N modules…` step in
- * src/npm/installer.ts) runs inside NimbusIsolatePool isolates so each
- * `esbuild.build()` allocation hits a fresh 128 MiB envelope rather
- * than the supervisor's. The facet needs two pieces of esbuild-wasm
- * at module-load time:
+ * esbuild runs only in a Durable Object's esbuild facet
+ * (src/facets/esbuild-transform.ts), and only for what Nimbus's own engines
+ * do not do: the `esbuild` command, a module nested too deeply for Oxc's
+ * stack, and a build whose rolldown binding died. The facet needs two
+ * pieces of esbuild-wasm, both staged in the static-assets layer and
+ * fetched, digest-checked, only when the facet is loaded:
  *
  *   1. The JS adapter (`esbuild-wasm/esm/browser.js`, ~117 KiB), rewritten
- *      into a function body. The supervisor already imports the same
- *      build as a module for its own transforms, so the adapter is staged
- *      in the static-assets layer rather than embedded a second time as a
- *      string.
+ *      into a function body the facet compiles at startup.
  *
- *   2. The wasm binary (`esbuild.wasm`) — 12 MiB. The host Worker bundles
- *      it already (core's EsbuildService imports `esbuild-wasm/esbuild.wasm`)
- *      and workerd compiles it at script startup, so facets are handed
- *      that compiled WebAssembly.Module (src/runtime/host-wasm.ts). Neither
- *      a staged copy, nor a fetch of it, nor a second compile. This script
- *      only records its size.
+ *   2. The wasm binary (`esbuild.wasm`, 11.4 MiB), a module of the facet's
+ *      module map, compiled when the facet starts. The host Worker carries
+ *      none of it: bundled, wrangler made it a compiled module of the
+ *      Worker, which workerd compiled at startup in every isolate, whether
+ *      or not the isolate ever ran esbuild.
  *
  * Pre-A'.5 design (this script's prior form) embedded the wasm bytes
  * as a base64 string in src/esbuild-wasm-bundle.generated.ts. That
@@ -51,11 +48,15 @@
  *   src/esbuild-wasm-bundle.generated.ts
  *     export const ESBUILD_WASM_VERSION: string;
  *     export const ESBUILD_JS_ASSET_PATH: string;    // /_assets/esbuild-<version>.js
- *     export const ESBUILD_WASM_BYTES: number;       // bundled wasm size
  *     export const ESBUILD_JS_SHA256: string;        // staged adapter digest
+ *     export const ESBUILD_WASM_ASSET_PATH: string;  // /_assets/esbuild-<version>.wasm
+ *     export const ESBUILD_WASM_SHA256: string;      // staged wasm digest
+ *     export const ESBUILD_WASM_BYTES: number;       // staged wasm size
  *
  *   public/_assets/esbuild-<version>.js
  *     The adapter as a function body, picked up by the ASSETS binding.
+ *   public/_assets/esbuild-<version>.wasm
+ *     esbuild-wasm's esbuild.wasm, byte for byte.
  *
  * Run via:
  *   node scripts/bundle-esbuild-wasm.mjs
@@ -143,25 +144,19 @@ async function main() {
     `[bundle-esbuild-wasm] rewrote ${exportBody.split(',').length} exports → object-return shape`,
   );
 
-  // ── 2. The wasm: bundled into the Worker, not staged ────────────────
-  // Core's EsbuildService imports `esbuild-wasm/esbuild.wasm`, so wrangler
-  // already bundles this exact file as a compiled wasm module, and workerd
-  // compiles it at script startup. Facets are handed that WebAssembly.Module
-  // (src/runtime/host-wasm.ts) instead of fetching a second copy from
-  // ASSETS and compiling it again. The generated module records its size,
-  // which the 64 MiB dynamic-worker code budget counts: a compiled module's
-  // wire bytes still count toward it (workerd src/workerd/api/
-  // worker-loader.c++, extractWasmModuleContent), and JS cannot read that
-  // size off a Module.
+  // ── 2. The wasm: staged, byte for byte ──────────────────────────────
+  // The esbuild facet fetches it (digest-checked) when it is loaded and
+  // hands it to its module map, where workerd compiles it at the facet's
+  // startup; no other isolate holds it.
   const wasmBytes = await fs.readFile(WASM_SRC);
+  await fs.mkdir(OUT_ASSETS_DIR, { recursive: true });
+  const wasmAssetName = `esbuild-${version}.wasm`;
+  await fs.writeFile(path.join(OUT_ASSETS_DIR, wasmAssetName), wasmBytes);
+  const wasmSha256 = createHash('sha256').update(wasmBytes).digest('hex');
   console.log(
-    `[bundle-esbuild-wasm] esbuild.wasm: ${(wasmBytes.length / (1024 * 1024)).toFixed(1)} MiB, handed to facets as the host's compiled module`,
+    `[bundle-esbuild-wasm] staged esbuild.wasm → public/_assets/${wasmAssetName} (${(wasmBytes.length / (1024 * 1024)).toFixed(1)} MiB)`,
   );
-  await fs.mkdir(OUT_ASSETS_DIR, { recursive: true });
-  // The JS adapter is staged. Facets splice it into their source as a
-  // string; the supervisor imports esbuild-wasm as a module for its own
-  // transforms, so carrying the adapter inline as well shipped it twice in
-  // the Worker bundle.
+  // The JS adapter, staged beside it: the facet splices it into its source as a string.
   const jsAssetName = `esbuild-${version}.js`;
   const jsAssetOut = path.join(OUT_ASSETS_DIR, jsAssetName);
   const jsBytes = Buffer.from(jsFn, 'utf8');
@@ -172,30 +167,26 @@ async function main() {
   );
 
   // ── 3. Clean up stale staged esbuild assets in public/_assets/ ──────
-  // Keeps the deploy lean: an old version's adapter, and any staged wasm
-  // (no longer staged at all), are removed.
+  // Keeps the deploy lean: an old version's adapter and wasm are removed.
   for (const entry of await fs.readdir(OUT_ASSETS_DIR)) {
-    if (entry.startsWith('esbuild-') && (entry.endsWith('.wasm') || (entry.endsWith('.js') && entry !== jsAssetName))) {
+    if (entry.startsWith('esbuild-') && ((entry.endsWith('.wasm') && entry !== wasmAssetName) || (entry.endsWith('.js') && entry !== jsAssetName))) {
       const stale = path.join(OUT_ASSETS_DIR, entry);
       await fs.unlink(stale);
       console.log(`[bundle-esbuild-wasm] removed stale asset: ${entry}`);
     }
   }
 
-  // ── 4. Emit the generated TS module: version, size and digest only ──
-  // Nothing is inline. The base64 wasm string was 16 MiB and sat in
-  // supervisor module scope for the isolate's lifetime; the JS adapter
-  // followed the wasm to env.ASSETS so the bundle carries esbuild-wasm
-  // once, as the modules the supervisor imports.
+  // ── 4. Emit the generated TS module: paths, sizes and digests only ──
+  // Nothing is inline: the Worker bundle carries no part of esbuild-wasm.
   const header = `/**
  * esbuild-wasm-bundle.generated.ts — AUTO-GENERATED by scripts/bundle-esbuild-wasm.mjs
  * DO NOT EDIT.
  *
- * The esbuild-wasm ${version} artifacts facets use. The wasm is the host
- * Worker's own bundled module (\`esbuild-wasm/esbuild.wasm\`), handed over
- * compiled by src/runtime/host-wasm.ts; the JS adapter lives in the
- * static-assets layer, public/_assets/esbuild-${version}.js, fetched on
- * demand and verified by src/runtime/esbuild-wasm-bytes.ts.
+ * The esbuild-wasm ${version} artifacts the esbuild facet runs: the wasm,
+ * public/_assets/esbuild-${version}.wasm, and the JS adapter,
+ * public/_assets/esbuild-${version}.js, both in the static-assets layer,
+ * fetched when the facet is loaded and verified by
+ * src/runtime/esbuild-wasm-bytes.ts. The host Worker bundles neither.
  *
  * The JS adapter is node_modules/esbuild-wasm/esm/browser.js with the
  * trailing \`export { ... }\` rewritten to \`return { ... };\`, so that
@@ -226,13 +217,14 @@ export const ESBUILD_WASM_VERSION: string = ${JSON.stringify(version)};
  * check, which discovers asset paths by value in generated modules.
  */
 export const ESBUILD_JS_ASSET_PATH: string = ${JSON.stringify('/_assets/' + jsAssetName)};
-/**
- * Bytes of the esbuild.wasm the host bundles: what a facet carrying the
- * host's compiled module counts toward the dynamic-worker code budget.
- */
-export const ESBUILD_WASM_BYTES: number = ${wasmBytes.length};
 /** SHA-256 of the staged public/_assets/esbuild-${version}.js adapter, checked before it is evaluated. */
 export const ESBUILD_JS_SHA256: string = ${JSON.stringify(jsSha256)};
+/** Where esbuild.wasm lives inside env.ASSETS, version-named like the adapter. */
+export const ESBUILD_WASM_ASSET_PATH: string = ${JSON.stringify('/_assets/' + wasmAssetName)};
+/** SHA-256 of the staged esbuild.wasm, checked before the facet compiles it. */
+export const ESBUILD_WASM_SHA256: string = ${JSON.stringify(wasmSha256)};
+/** Bytes of the staged esbuild.wasm: what the facet's module map counts toward the dynamic-worker code budget. */
+export const ESBUILD_WASM_BYTES: number = ${wasmBytes.length};
 `;
   await fs.writeFile(OUT_TS, header, 'utf8');
   const stat = await fs.stat(OUT_TS);

package/scripts/bundle-facet-workers.mjs

@@ -23,6 +23,11 @@
  *   globalThis.__nimbusVirtualSockets — python-runner and ruby-runner
  *   splice it into their socket process worker module sources.
  *
+ *   The answering supervisor client (@nimbus-sh/core
+ *   src/runtime/vfs-supervisor.ts answeringSupervisor) is an IIFE the same
+ *   way, installing globalThis.__nimbusAnsweringSupervisor for the node
+ *   bodies, which are generated text and splice it.
+ *
  *   The WASI shim (src/runtime/wasi/preamble.ts) is bundled as a flat ESM
  *   body, NOT an IIFE: runners and tests append `export { __wasiInitFS, … }`
  *   to the emitted string and wasi-threads.ts is concatenated after it into
@@ -35,6 +40,8 @@
  *       W7_FRAME_PREAMBLE: string         (W7 — streaming bulk-write encoder)
  *   @nimbus-sh/core src/runtime/virtual-socket-kernel.generated.ts — exports
  *       VIRTUAL_SOCKET_KERNEL_SRC: string
+ *   @nimbus-sh/core src/runtime/supervisor-answering.generated.ts — exports
+ *       SUPERVISOR_ANSWERING_SRC: string
  *   @nimbus-sh/core src/runtime/wasi-instance.generated.ts — exports
  *       WASI_INSTANCE_BODY_SRC: string
  *   @nimbus-sh/core src/runtime/bash-runner.generated.ts — exports
@@ -44,6 +51,11 @@
  *       asset rather than a string in the Worker bundle, like the esbuild
  *       adapter and the node shims; src/esbuild-cli-artifact.generated.ts
  *       exports ESBUILD_CLI_ASSET_PATH, ESBUILD_CLI_BUILD_ID, ESBUILD_CLI_SHA256.
+ *   public/_assets/runtime/oxc-facet-<buildId>.js — the transform facet's
+ *       runtime (the Oxc wasm's driver, the dynamic-import rewrite and the
+ *       top-level-await lowering), staged the same way;
+ *       src/oxc-facet-artifact.generated.ts exports OXC_FACET_ASSET_PATH,
+ *       OXC_FACET_BUILD_ID, OXC_FACET_SHA256.
  *
  * Runs as a postinstall + predev + predeploy step via package.json.
  */
@@ -164,6 +176,36 @@ async function bundleVirtualSocketKernel() {
   return withoutComments(result.outputFiles[0].text);
 }
 
+/**
+ * The answering supervisor client as a self-contained IIFE that installs
+ * globalThis.__nimbusAnsweringSupervisor, so a facet body that is generated
+ * text runs the one implementation the bundled facets import.
+ */
+async function bundleAnsweringSupervisor() {
+  const result = await build({
+    stdin: {
+      contents: [
+        "import { installAnsweringSupervisor } from './src/runtime/vfs-supervisor.ts';",
+        'installAnsweringSupervisor();',
+      ].join('\n'),
+      resolveDir: coreRoot,
+      loader: 'ts',
+    },
+    bundle: true,
+    format: 'iife',
+    target: 'esnext',
+    platform: 'neutral',
+    absWorkingDir: root,
+    write: false,
+    logLevel: 'warning',
+    legalComments: 'none',
+  });
+  if (!result.outputFiles || result.outputFiles.length === 0) {
+    throw new Error('[bundle-facet-workers/supervisor-answering] esbuild produced no output');
+  }
+  return withoutComments(result.outputFiles[0].text);
+}
+
 /**
  * Symbols the emitted WASI body must declare at top level. Runners and tests
  * append `export { … }` to the string and wasi-threads is concatenated into the
@@ -347,46 +389,187 @@ async function bundleEsbuildCli() {
 }
 
 /**
- * Stage the esbuild CLI runner under public/_assets/runtime/, named by a
- * prefix of its own digest so no cache layer can serve another build's bytes
- * under its name, and pin it in src/esbuild-cli-artifact.generated.ts.
+ * Stage a runtime script under public/_assets/runtime/<prefix>-<build id>.js,
+ * named by a prefix of its own digest so no cache layer can serve another
+ * build's bytes under its name, and pin it in src/<generated>: exports
+ * <constant>_ASSET_PATH, <constant>_BUILD_ID (the content-hash prefix) and
+ * <constant>_SHA256 (the digest every fetch is verified against).
  */
-function stageEsbuildCli(src) {
+function stageRuntimeSource(src, { prefix, generated, constant, description }) {
   const sha256 = createHash('sha256').update(src, 'utf8').digest('hex');
   const buildId = sha256.slice(0, 16);
   const assetDir = join(root, 'public', '_assets', 'runtime');
-  const assetName = `esbuild-cli-${buildId}.js`;
+  const assetName = `${prefix}-${buildId}.js`;
   mkdirSync(assetDir, { recursive: true });
   for (const entry of readdirSync(assetDir)) {
-    if (entry.startsWith('esbuild-cli-') && entry !== assetName) unlinkSync(join(assetDir, entry));
+    if (entry.startsWith(`${prefix}-`) && entry !== assetName) unlinkSync(join(assetDir, entry));
   }
   writeFileSync(join(assetDir, assetName), src, 'utf8');
   const assetPath = `/_assets/runtime/${assetName}`;
-  const generatedPath = join(root, 'src', 'esbuild-cli-artifact.generated.ts');
+  const generatedPath = join(root, 'src', generated);
   writeFileSync(generatedPath, [
     '/**',
-    ' * esbuild-cli-artifact.generated.ts — AUTO-GENERATED by',
+    ` * ${generated} — AUTO-GENERATED by`,
     ' * scripts/bundle-facet-workers.mjs. DO NOT EDIT.',
     ' *',
-    ' * Pins the staged runner of the `esbuild` command: esbuild-wasm/wasm_exec.js',
-    ' * (Go js/wasm glue, as __esbuildGoRuntime) followed by @nimbus-sh/core',
-    ' * src/runtime/esbuild-cli/preamble.ts as an IIFE. Only the session\'s esbuild',
-    ' * facet evaluates it, so src/runtime/esbuild-wasm-bytes.ts fetches it from',
-    ' * ASSETS when that facet is built, instead of the Worker bundle carrying it.',
-    ' * ESBUILD_CLI_BUILD_ID is a content-hash prefix, ESBUILD_CLI_SHA256 the',
+    ...description.map((line) => ` * ${line}`),
+    ` * ${constant}_BUILD_ID is a content-hash prefix, ${constant}_SHA256 the`,
     ' * digest every fetch is verified against.',
     ' *',
     ` * Size: ${(src.length / 1024).toFixed(2)} KiB`,
     ' */',
     '',
-    `export const ESBUILD_CLI_ASSET_PATH: string = ${JSON.stringify(assetPath)};`,
-    `export const ESBUILD_CLI_BUILD_ID: string = ${JSON.stringify(buildId)};`,
-    `export const ESBUILD_CLI_SHA256: string = ${JSON.stringify(sha256)};`,
+    `export const ${constant}_ASSET_PATH: string = ${JSON.stringify(assetPath)};`,
+    `export const ${constant}_BUILD_ID: string = ${JSON.stringify(buildId)};`,
+    `export const ${constant}_SHA256: string = ${JSON.stringify(sha256)};`,
     '',
   ].join('\n'));
   return { assetPath, generatedPath };
 }
 
+/** The esbuild CLI runner, staged (stageRuntimeSource). */
+function stageEsbuildCli(src) {
+  return stageRuntimeSource(src, {
+    prefix: 'esbuild-cli',
+    generated: 'esbuild-cli-artifact.generated.ts',
+    constant: 'ESBUILD_CLI',
+    description: [
+      'Pins the staged runner of the `esbuild` command: esbuild-wasm/wasm_exec.js',
+      '(Go js/wasm glue, as __esbuildGoRuntime) followed by @nimbus-sh/core',
+      'src/runtime/esbuild-cli/preamble.ts as an IIFE. Only the session\'s esbuild',
+      'facet evaluates it, so src/runtime/esbuild-wasm-bytes.ts fetches it from',
+      'ASSETS when that facet is built, instead of the Worker bundle carrying it.',
+    ],
+  });
+}
+
+/**
+ * The transform facet's runtime (core src/runtime/oxc-facet/preamble.ts) as
+ * an IIFE: the Oxc wasm's driver, the dynamic-import rewrite and the
+ * top-level-await lowering, installed as globals the facet's class reads.
+ */
+async function bundleOxcFacet() {
+  const result = await build({
+    entryPoints: [join(coreRoot, 'src', 'runtime', 'oxc-facet', 'preamble.ts')],
+    bundle: true,
+    format: 'iife',
+    target: 'esnext',
+    platform: 'neutral',
+    absWorkingDir: root,
+    write: false,
+    logLevel: 'warning',
+    legalComments: 'none',
+  });
+  if (!result.outputFiles || result.outputFiles.length === 0) {
+    throw new Error('[bundle-facet-workers/oxc-facet] esbuild produced no output');
+  }
+  const runtime = withoutComments(result.outputFiles[0].text);
+  for (const global of ['__nimbusCreateOxcTransform', '__nimbusRewriteDynamicImports', '__nimbusLowerAsyncModule']) {
+    if (!runtime.includes(global)) {
+      throw new Error(`[bundle-facet-workers/oxc-facet] the bundle no longer installs globalThis.${global}`);
+    }
+  }
+  if (/^\s*(?:import|export)\b/m.test(runtime)) {
+    throw new Error('[bundle-facet-workers/oxc-facet] an import/export survived bundling');
+  }
+  return runtime;
+}
+
+/**
+ * The build facet's runtime (scripts/rolldown-facet/entry.mjs) as an ES
+ * module: rolldown's JavaScript API, pinned to the staged binding's version,
+ * and core's esbuild-contract adapter (runtime/rolldown-build.ts). The Node
+ * modules rolldown imports and a facet has no use for are shims.mjs; node:path
+ * is workerd's. rolldown finds its binding at globalThis.__nimbusRolldownBinding,
+ * which the facet installs before it imports this module.
+ */
+async function bundleRolldownFacet() {
+  const shims = join(root, 'scripts', 'rolldown-facet', 'shims.mjs');
+  const rolldownPkg = JSON.parse(readFileSync(join(root, 'node_modules', 'rolldown', 'package.json'), 'utf8'));
+  const artifacts = readFileSync(join(root, 'src', 'napi-wasm-artifacts.generated.ts'), 'utf8');
+  const stagedVersion = /"name": "rolldown",\s*"version": "([^"]+)"/.exec(artifacts)?.[1];
+  if (rolldownPkg.version !== stagedVersion) {
+    throw new Error(`[bundle-facet-workers/rolldown-facet] rolldown ${rolldownPkg.version} is installed; the staged binding is ${stagedVersion}`);
+  }
+  const result = await build({
+    entryPoints: [join(root, 'scripts', 'rolldown-facet', 'entry.mjs')],
+    bundle: true,
+    format: 'esm',
+    target: 'esnext',
+    platform: 'neutral',
+    mainFields: ['module', 'main'],
+    conditions: ['import', 'default'],
+    absWorkingDir: root,
+    write: false,
+    logLevel: 'warning',
+    legalComments: 'none',
+    plugins: [{
+      name: 'rolldown-facet-shims',
+      setup(b) {
+        b.onResolve({ filter: /^node:path$/ }, () => ({ path: 'node:path', external: true }));
+        b.onResolve({ filter: /^node:(worker_threads|tty|os|util|module|fs|fs\/promises|process|url|readline|child_process)$/ }, () => ({ path: shims }));
+        // rolldown's binding loader (createRequire, native shards, WASI fallbacks): the facet's binding instead.
+        b.onResolve({ filter: /\/binding-[A-Za-z0-9_-]+\.mjs$/ }, (args) => ({ path: args.path, namespace: 'rolldown-binding' }));
+        b.onLoad({ filter: /.*/, namespace: 'rolldown-binding' }, () => ({
+          contents: [
+            'export const t = () => {',
+            '  const binding = globalThis.__nimbusRolldownBinding;',
+            '  if (!binding) throw new Error("Nimbus: the build facet imported rolldown before installing its binding");',
+            '  return binding;',
+            '};',
+            'export const n = (mod) => mod;',
+          ].join('\n'),
+          loader: 'js',
+        }));
+      },
+    }],
+  });
+  if (!result.outputFiles || result.outputFiles.length === 0) {
+    throw new Error('[bundle-facet-workers/rolldown-facet] esbuild produced no output');
+  }
+  const runtime = result.outputFiles[0].text;
+  const imports = [...runtime.matchAll(/^import\b[^'"]*['"]([^'"]+)['"]/gm)].map((m) => m[1]);
+  if (imports.some((specifier) => specifier !== 'node:path')) {
+    throw new Error(`[bundle-facet-workers/rolldown-facet] the runtime imports ${imports.join(', ')}; only node:path is allowed`);
+  }
+  for (const name of ['build', 'prebundle']) {
+    if (!new RegExp(`export\\s*\\{[^}]*\\b${name}\\b`).test(runtime)) throw new Error(`[bundle-facet-workers/rolldown-facet] the runtime no longer exports ${name}`);
+  }
+  return runtime;
+}
+
+/** The build facet's runtime, staged (stageRuntimeSource). */
+function stageRolldownFacet(src) {
+  return stageRuntimeSource(src, {
+    prefix: 'rolldown-facet',
+    generated: 'rolldown-facet-artifact.generated.ts',
+    constant: 'ROLLDOWN_FACET',
+    description: [
+      'Pins the staged runtime of the build facet: scripts/rolldown-facet/entry.mjs',
+      'as an ES module (rolldown\'s JavaScript API over the staged threadless',
+      'binding, and @nimbus-sh/core runtime/rolldown-build.ts). Only the build',
+      'facet imports it, so facets/build-facet.ts fetches it from ASSETS when',
+      'that facet is built.',
+    ],
+  });
+}
+
+/** The transform facet's runtime, staged (stageRuntimeSource). */
+function stageOxcFacet(src) {
+  return stageRuntimeSource(src, {
+    prefix: 'oxc-facet',
+    generated: 'oxc-facet-artifact.generated.ts',
+    constant: 'OXC_FACET',
+    description: [
+      'Pins the staged runtime of the transform facet: @nimbus-sh/core',
+      'src/runtime/oxc-facet/preamble.ts as an IIFE (the Oxc wasm\'s driver, the',
+      'dynamic-import rewrite and the top-level-await lowering). Only the',
+      'transform facet evaluates it, so src/runtime/oxc-wasm-bytes.ts fetches it',
+      'from ASSETS when that facet is built.',
+    ],
+  });
+}
+
 async function main() {
   // 1. Tar-parser preamble (existing W2.5/W4 hot-path helpers).
   const tarStripped = await bundleAsPreamble(
@@ -417,6 +600,16 @@ async function main() {
     throw new Error('[bundle-facet-workers/esm-resolver] the bundle no longer declares function createEsmResolver');
   }
 
+  // 4. node:http2, which the node shims embed as source, as the substrate's
+  //    node-compat module map imports it: one module, both runtimes.
+  const http2Module = await bundleAsPreamble(
+    join(coreRoot, 'src', '_shared', 'http2-module.ts'),
+    'http2-module',
+  );
+  if (!/^function createHttp2Module\(/m.test(http2Module)) {
+    throw new Error('[bundle-facet-workers/http2-module] the bundle no longer declares function createHttp2Module');
+  }
+
   const tarEncoded = JSON.stringify(tarStripped);
   const w7Encoded = JSON.stringify(w7Stripped);
   const outPath = join(root, 'src', 'loaders', 'generated-workers.ts');
@@ -429,6 +622,7 @@ async function main() {
     ' *   - @nimbus-sh/core src/_shared/tarball-stream.ts (streaming tar primitives)',
     ' *   - @nimbus-sh/platform src/w7-frame.ts (W7 streaming bulk-write encoder)',
     ' *   - @nimbus-sh/core src/_shared/esm-resolver.ts (Node\'s ESM resolver, for the node shims)',
+    ' *   - @nimbus-sh/core src/_shared/http2-module.ts (node:http2, for the node shims)',
     ' *',
     ' * Consumed by fabric/isolate-pool.ts callers via the `preamble`',
     ' * option. The preamble is injected at the top of every generated',
@@ -451,6 +645,9 @@ async function main() {
     '/** Declares `function createEsmResolver(host)`; the node shims call it. */',
     `export const ESM_RESOLVER_PREAMBLE: string = ${JSON.stringify(esmResolver)};`,
     '',
+    '/** Declares `function createHttp2Module(host)`; the node shims call it. */',
+    `export const HTTP2_MODULE_PREAMBLE: string = ${JSON.stringify(http2Module)};`,
+    '',
   ].join('\n');
 
   mkdirSync(dirname(outPath), { recursive: true });
@@ -477,6 +674,26 @@ async function main() {
   ].join('\n');
   writeFileSync(kernelOutPath, kernelWrapper);
 
+  const answeringSrc = await bundleAnsweringSupervisor();
+  const answeringOutPath = join(coreRoot, 'src', 'runtime', 'supervisor-answering.generated.ts');
+  writeFileSync(answeringOutPath, [
+    '/**',
+    ' * supervisor-answering.generated.ts — AUTO-GENERATED. DO NOT EDIT.',
+    ' *',
+    ' * Produced by scripts/bundle-facet-workers.mjs from:',
+    ' *   - @nimbus-sh/core src/runtime/vfs-supervisor.ts (answeringSupervisor)',
+    ' *',
+    ' * Self-contained IIFE that installs globalThis.__nimbusAnsweringSupervisor.',
+    ' * Spliced into the node facet bodies (worker facets/manager.ts) and the',
+    ' * opencode runner, which wrap their SUPERVISOR binding with it.',
+    ' *',
+    ` * Size: ${(answeringSrc.length / 1024).toFixed(2)} KiB`,
+    ' */',
+    '',
+    `export const SUPERVISOR_ANSWERING_SRC: string = ${JSON.stringify(answeringSrc)};`,
+    '',
+  ].join('\n'));
+
   console.log(
     `[bundle-facet-workers] wrote ${outPath} ` +
     `(tar=${(tarStripped.length / 1024).toFixed(2)} KiB, ` +
@@ -524,6 +741,10 @@ async function main() {
 
   const esbuildCliSrc = await bundleEsbuildCli();
   const esbuildCli = stageEsbuildCli(esbuildCliSrc);
+  const oxcFacetSrc = await bundleOxcFacet();
+  const oxcFacet = stageOxcFacet(oxcFacetSrc);
+  const rolldownFacetSrc = await bundleRolldownFacet();
+  const rolldownFacet = stageRolldownFacet(rolldownFacetSrc);
 
   console.log(
     `[bundle-facet-workers] wrote ${kernelOutPath} ` +
@@ -541,13 +762,21 @@ async function main() {
     `[bundle-facet-workers] staged ${esbuildCli.assetPath} and wrote ${esbuildCli.generatedPath} ` +
     `(esbuild-cli=${(esbuildCliSrc.length / 1024).toFixed(2)} KiB)`,
   );
+  console.log(
+    `[bundle-facet-workers] staged ${oxcFacet.assetPath} and wrote ${oxcFacet.generatedPath} ` +
+    `(oxc-facet=${(oxcFacetSrc.length / 1024).toFixed(2)} KiB)`,
+  );
+  console.log(
+    `[bundle-facet-workers] staged ${rolldownFacet.assetPath} and wrote ${rolldownFacet.generatedPath} ` +
+    `(rolldown-facet=${(rolldownFacetSrc.length / 1024).toFixed(2)} KiB)`,
+  );
 }
 
 // The bundle functions are exported so the parity test can re-derive the
 // generated files from source and compare, rather than restating the esbuild
 // settings — a second copy of those settings is exactly the drift such a test
 // exists to catch. main() therefore runs only when this file is the entry point.
-export { bundleWasiInstance, bundleBashRunner, bundleEsbuildCli };
+export { bundleWasiInstance, bundleBashRunner, bundleEsbuildCli, bundleOxcFacet, bundleAnsweringSupervisor };
 
 if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
   main().catch((e) => {

package/scripts/bundle-node-shims.mjs

@@ -12,6 +12,9 @@
  *     the write ledger the shims' filesystem writes go through;
  *   - `FACET_RESIDENT_STORE_SOURCE` (src/vfs/facet-resident-store.ts), a
  *     resident facet's SQLite-backed resident set the shims read from.
+ * and carries two more as modules of its map: the runtime-code interpreter
+ * and its host module (scripts/interpreter-bundle.mjs), which a launch
+ * compiles only when its program first produces code no launch staged.
  * Keeping them inside the worker bundle pushed the main bundle over its size
  * gate (tests/behavioral/assets-fetch/new/worker-bundle-size.mjs), whose
  * intended fix is exactly this promote: large facet-runner source strings
@@ -28,6 +31,8 @@
  *   public/_assets/runtime/node-shims-<buildId>.js
  *   public/_assets/runtime/vfs-write-ledger-<buildId>.js
  *   public/_assets/runtime/resident-store-<buildId>.js
+ *   public/_assets/runtime/js-interpreter-<buildId>.js
+ *   public/_assets/runtime/js-interpreter-ops-<buildId>.js
  *   src/node-shims-artifact.generated.ts, per source:
  *     export const <NAME>_ENTRY: string;     // asset path
  *     export const <NAME>_BUILD_ID: string;  // content-hash prefix
@@ -51,6 +56,8 @@ const ROOT = path.resolve(__dirname, '..');
 const { generateShimsCode } = await import(path.join(ROOT, 'dist/runtime/node-shims.js'));
 const { FACET_RESIDENT_STORE_SOURCE } = await import(path.join(ROOT, 'dist/vfs/facet-resident-store.js'));
 const { VFS_WRITE_LEDGER_SOURCE } = await import('@nimbus-sh/core/_shared/vfs-write-ledger.js');
+const { bundleInterpreter } = await import('./interpreter-bundle.mjs');
+const interpreter = await bundleInterpreter({ start: ROOT });
 
 const shims = generateShimsCode();
 if (typeof shims !== 'string' || shims.length < 100_000) {
@@ -75,6 +82,24 @@ const SOURCES = [
     source: FACET_RESIDENT_STORE_SOURCE,
     from: 'dist/vfs/facet-resident-store.js FACET_RESIDENT_STORE_SOURCE',
   },
+  {
+    name: 'JS_INTERPRETER_PRIMORDIALS',
+    family: 'js-interpreter-primordials',
+    source: interpreter.primordials,
+    from: '@nimbus-sh/core src/interpreter/primordials.ts, bundled by scripts/interpreter-bundle.mjs',
+  },
+  {
+    name: 'JS_INTERPRETER',
+    family: 'js-interpreter',
+    source: interpreter.interpreter,
+    from: '@nimbus-sh/core src/interpreter, bundled by scripts/interpreter-bundle.mjs',
+  },
+  {
+    name: 'JS_INTERPRETER_OPS',
+    family: 'js-interpreter-ops',
+    source: interpreter.ops,
+    from: '@nimbus-sh/core src/interpreter/host-ops.ts HOST_OPS_SOURCE',
+  },
 ];
 
 const assetDir = path.join(ROOT, 'public/_assets/runtime');
@@ -90,8 +115,9 @@ for (const { name, family, source, from } of SOURCES) {
   const assetName = `${family}-${buildId}.js`;
   // Remove stale same-family assets so the directory carries exactly one blob
   // per family (the entry constant pins which one a deploy serves).
+  const isFamily = (f) => /^[0-9a-f]{16}\.js$/.test(f.slice(family.length + 1)) && f.startsWith(`${family}-`);
   for (const f of existing) {
-    if (f.startsWith(`${family}-`) && f !== assetName) await fs.unlink(path.join(assetDir, f));
+    if (isFamily(f) && f !== assetName) await fs.unlink(path.join(assetDir, f));
   }
   await fs.writeFile(path.join(assetDir, assetName), source, 'utf8');
   pins.push(
@@ -109,7 +135,8 @@ const generated = `/**
  * scripts/bundle-node-shims.mjs. DO NOT EDIT.
  *
  * Pins the staged sources of the node-compat layer, promoted out of the worker
- * bundle: the shims, the VFS write ledger and the resident store. Each
+ * bundle: the shims, the VFS write ledger, the resident store, and the
+ * runtime-code interpreter with its host module. Each
  * <NAME>_BUILD_ID is a content-hash prefix so cache layers never serve stale
  * bytes after a rebuild; <NAME>_SHA256 is the full digest verified at fetch time.
  */