@nimbus-sh/worker 0.12.0 → 0.13.0

package/dist/facets/vite-dev-server.d.ts

@@ -12,7 +12,7 @@
  *     ├── /*.ts,*.tsx,*.jsx    → esbuild transform → JS with import rewrites + alias resolution
  *     ├── /*.css               → serve as text/css (with @import inlining, @tailwind stripping, @apply expansion)
  *     ├── /*.css?import        → wrap CSS in JS that injects <style> tag
- *     ├── /@modules/<pkg>      → resolve from node_modules, bundle via esbuild facet (synthetic-entry for barrels)
+ *     ├── /@modules/<pkg>      → resolve from node_modules, bundle in the build facet (synthetic-entry for barrels)
  *     ├── /@vite/client        → HMR client script
  *     ├── /*.json (as module)  → export default { ... }
  *     ├── /*.svg,*.png,... (as module) → export default "/preview/path/to/asset"
@@ -22,10 +22,17 @@
  *       messages through the DO WebSocket → frontend dispatches to iframe.
  */
 import type { SqliteVFS } from '@nimbus-sh/core/vfs/sqlite-vfs.js';
+import type { VfsCred } from '@nimbus-sh/core/runtime/os-contracts.js';
 import type { EsbuildService } from '@nimbus-sh/core/runtime/esbuild-service.js';
-import type { BundlePoolProvider } from './esbuild-bundle-pool.js';
+import type { BundlePoolProvider } from './prebundle-pool.js';
 export interface ViteDevServerOptions {
     vfs: SqliteVFS;
+    /**
+     * Who the server reads and writes as: the credential of the process it
+     * runs under, the command that started it. Everything it serves, bundles
+     * or synthesizes goes through the VFS as this principal.
+     */
+    cred: VfsCred;
     esbuild: EsbuildService;
     /** Root directory in VFS (e.g. "home/user/projects") */
     root: string;
@@ -53,11 +60,11 @@ export interface ViteDevServerOptions {
     /** Durable Object state. */
     ctx?: DurableObjectState;
     /**
-     * The session's esbuild facet pool, shared with the install-time
-     * pre-bundler. When provided, /preview/@modules/<spec> misses bundle in
-     * that pool's isolate instead of the supervisor's EsbuildService.
-     * Without it, the supervisor falls back to in-process esbuild (legacy
-     * behaviour used by callers without a LOADER binding).
+     * The session's pre-bundle pool (its build facet), shared with the
+     * install-time pre-bundler. When provided, /preview/@modules/<spec>
+     * misses bundle there from a slice, rather than through the session's
+     * EsbuildService and its VFS plugin (the path callers without a LOADER
+     * binding take).
      */
     bundlePool?: BundlePoolProvider;
     /**
@@ -73,6 +80,74 @@ export interface ViteDevServerOptions {
         appendOutput(pid: number, stream: 'stdout' | 'stderr', data: string): void;
     };
 }
+/**
+ * esbuild, when bundling CJS source with `external` specifiers, leaves the
+ * `require("pkg")` calls in the output wrapped in a `__require()` helper that
+ * falls back to the global `require`. In the browser there is no global
+ * `require`, so every such call throws.
+ *
+ * The fix: detect all distinct `__require("X")` specifiers in the output,
+ * emit a top-level ESM `import * as __ns_X from "X"` for each, and replace
+ * every `__require("X")` call with a reference to that namespace (with
+ * default-export interop — `__ns_X.default ?? __ns_X`).
+ *
+ * Before:
+ *   var __require = ((x) => typeof require !== "undefined" ? require : ...);
+ *   var React = __require("react");
+ *
+ * After:
+ *   import * as __nimbus_ext__react from "react";
+ *   const __nimbus_req = (id) => {
+ *     if (id === "react") return __nimbus_ext__react.default ?? __nimbus_ext__react;
+ *     throw new Error("require: " + id);
+ *   };
+ *   var __require = ((x) => typeof require !== "undefined" ? require : ...);
+ *   var React = __nimbus_req("react");
+ *
+ * We inject `__nimbus_req` but keep esbuild's `__require` definition so we
+ * don't have to rewrite its declaration — we just replace the call-sites.
+ */
+export declare function rewriteExternalRequires(code: string, basePath: string): string;
+/**
+ * esbuild bundles CJS packages by wrapping them in __commonJS helpers.
+ * The resulting ESM bundle only has `export default require_X()` — no named
+ * exports. This breaks `import { createRoot } from "react-dom/client"`.
+ *
+ * We fix this by STATICALLY analyzing the bundled source to find CJS export
+ * patterns, then emitting named exports for each found name. We cannot use
+ * `new Function()` or `eval()` to get runtime export keys because the
+ * Cloudflare Workers runtime disallows string-to-code generation outside of
+ * module initialization.
+ *
+ * Patterns we detect (scanning the entire bundled text, not just the top level):
+ *   - `exports.NAME = ...`
+ *   - `exports["NAME"] = ...`
+ *   - `Object.defineProperty(exports, "NAME", ...)`
+ *   - `module.exports.NAME = ...`
+ *   - `module.exports = { NAME, NAME2, ... }` (object literal)
+ *
+ * Input  (esbuild output):
+ *   var require_X = __commonJS({ "...": function(exports) { exports.jsx = ...; exports.jsxs = ...; } });
+ *   export default require_X();
+ *
+ * Output (synthesized):
+ *   var require_X = __commonJS({...});
+ *   const __nimbus_ns = require_X();
+ *   export default __nimbus_ns;
+ *   export const jsx = __nimbus_ns.jsx;
+ *   export const jsxs = __nimbus_ns.jsxs;
+ *
+ * Note: we emit `export const NAME = __nimbus_ns.NAME` per key rather than
+ * `export const { NAME, ... } = __nimbus_ns` destructuring. The former
+ * preserves live binding semantics slightly better and avoids issues when
+ * a key name happens to shadow a keyword or identifier.
+ *
+ * Returns the original code unchanged if:
+ *   - The bundle already has named exports (not a CJS-only bundle)
+ *   - No `export default` pattern found
+ *   - No CJS export patterns found in the bundle source
+ */
+export declare function synthesizeCjsNamedExports(code: string): string;
 /**
  * Importer context for `#X` subpath-import resolution. The dev-server
  * passes this through `rewriteAllImports` whenever it knows the source
@@ -132,7 +207,7 @@ export declare class ViteDevServer {
     private injectBasename;
     private env;
     private ctx;
-    /** The session's esbuild facet pool; null = legacy in-supervisor esbuild. */
+    /** The session's pre-bundle pool; null = bundle through the EsbuildService. */
     private readonly bundlePool;
     /**
      * In-flight on-demand-bundle coalescing map. When the browser fires
@@ -162,11 +237,11 @@ export declare class ViteDevServer {
     private logSink;
     constructor(opts: ViteDevServerOptions);
     /**
-     * The session's shared esbuild pool for on-demand bundling of
+     * The session's pre-bundle pool for on-demand bundling of
      * /preview/@modules/<spec> requests that miss both the in-memory and
-     * pkg_esm_bundles caches. Null when no pool was provided (legacy
-     * in-supervisor fallback). Acquired BEFORE the slice lease — see
-     * EsbuildBundlePool.acquire.
+     * pkg_esm_bundles caches. Null when no pool was provided (the
+     * EsbuildService fallback). Acquired BEFORE the slice lease — see
+     * PrebundlePool.acquire.
      */
     private ensureOnDemandPool;
     /** Detect TailwindCSS usage in the project */
@@ -182,6 +257,8 @@ export declare class ViteDevServer {
     private baseUrlValue;
     /** esbuild define set for a request served under `base`. */
     private defineFor;
+    /** Whether this server's principal may read `path`. */
+    private mayRead;
     /**
      * Module-cache key for `key` under mount base `base`. The transformed text
      * embeds the base (module URLs, <base href>, BASE_URL, router basename), so

package/dist/facets/vite-dev-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-dev-server.d.ts","sourceRoot":"","sources":["../../src/facets/vite-dev-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAGpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAOjF,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAsB/E,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,SAAS,CAAC;IACf,OAAO,EAAE,cAAc,CAAC;IACxB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IACjC,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qFAAqF;IACrF,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yDAAyD;IACzD,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,4BAA4B;IAC5B,GAAG,CAAC,EAAE,kBAAkB,CAAC;IACzB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE;QAAE,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC5F;AAmeD;;;;;GAKG;AACH,UAAU,aAAa;IACrB,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB;6CACyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb;kCAC8B;IAC9B,GAAG,EAAE;QAAE,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;CACxE;AAgDD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,QAAQ,CAAC,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,aAAa,GAC1B,MAAM,CAYR;AA+jBD,qBAAa,aAAa;IACxB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAA8G;IACjI,OAAO,CAAC,QAAQ,CAA6B;IAC7C,4EAA4E;IAC5E,OAAO,CAAC,YAAY,CAAS;IAC7B,+DAA+D;IAC/D,OAAO,CAAC,OAAO,CAAyB;IACxC,wEAAwE;IACxE,OAAO,CAAC,MAAM,CAAyB;IACvC,4CAA4C;IAC5C,OAAO,CAAC,WAAW,CAAS;IAC5B,oDAAoD;IACpD,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,wDAAwD;IACxD,OAAO,CAAC,QAAQ,CAAyB;IACzC,oEAAoE;IACpE,OAAO,CAAC,cAAc,CAAU;IAChC,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,GAAG,CAAmC;IAC9C,6EAA6E;IAC7E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc,CAAwC;IAE9D;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,OAAO,CAA+F;gBAElG,IAAI,EAAE,oBAAoB;IA6CtC;;;;;;OAMG;YACW,kBAAkB;IAKhC,8CAA8C;IAC9C,OAAO,CAAC,cAAc;IAmCtB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAKhB,+EAA+E;IAC/E,OAAO,CAAC,YAAY;IAIpB,4DAA4D;IAC5D,OAAO,CAAC,SAAS;IAIjB;;;;;OAKG;IACH,OAAO,CAAC,EAAE;IAIV;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAaxB,8DAA8D;IAC9D,KAAK,IAAI,IAAI;IAWb,2BAA2B;IAC3B,IAAI,IAAI,IAAI;IAMZ,IAAI,SAAS,YAA2B;IAExC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,GAAG;IAYX,8CAA8C;IAC9C,OAAO,CAAC,eAAe;IAoEvB,sEAAsE;IACtE,OAAO,CAAC,YAAY;IASpB;;;;;;;;;;OAUG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;YAkBhF,mBAAmB;IAqFjC,OAAO,CAAC,cAAc;IAuEtB,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,8BAA8B;YAQxB,WAAW;IAwEzB;;;;;;;;;OASG;YACW,eAAe;IA6W7B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,cAAc;IAyFtB,OAAO,CAAC,cAAc;IAyBtB;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,oBAAoB;IAkE5B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,eAAe;YAoDT,SAAS;YAkKT,gBAAgB;IAoH9B,IAAI,KAAK;;;;;;;MASR;CACF"}
+{"version":3,"file":"vite-dev-server.d.ts","sourceRoot":"","sources":["../../src/facets/vite-dev-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAEvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AASjF,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAuB1E,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,SAAS,CAAC;IACf;;;;OAIG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,cAAc,CAAC;IACxB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC;IACjC,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qFAAqF;IACrF,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yDAAyD;IACzD,GAAG,CAAC,EAAE,GAAG,CAAC;IACV,4BAA4B;IAC5B,GAAG,CAAC,EAAE,kBAAkB,CAAC;IACzB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE;QAAE,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC5F;AAoHD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CA0C9E;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA8B9D;AAiOD;;;;;GAKG;AACH,UAAU,aAAa;IACrB,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB;6CACyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb;kCAC8B;IAC9B,GAAG,EAAE;QAAE,MAAM,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;CACxE;AAgDD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,QAAQ,CAAC,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,aAAa,GAC1B,MAAM,CAYR;AA+jBD,qBAAa,aAAa;IACxB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,SAAS,CAAsB;IACvC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,WAAW,CAA8G;IACjI,OAAO,CAAC,QAAQ,CAA6B;IAC7C,4EAA4E;IAC5E,OAAO,CAAC,YAAY,CAAS;IAC7B,+DAA+D;IAC/D,OAAO,CAAC,OAAO,CAAyB;IACxC,wEAAwE;IACxE,OAAO,CAAC,MAAM,CAAyB;IACvC,4CAA4C;IAC5C,OAAO,CAAC,WAAW,CAAS;IAC5B,oDAAoD;IACpD,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,wDAAwD;IACxD,OAAO,CAAC,QAAQ,CAAyB;IACzC,oEAAoE;IACpE,OAAO,CAAC,cAAc,CAAU;IAChC,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,GAAG,CAAmC;IAC9C,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,cAAc,CAAwC;IAE9D;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,OAAO,CAA+F;gBAElG,IAAI,EAAE,oBAAoB;IA6CtC;;;;;;OAMG;YACW,kBAAkB;IAKhC,8CAA8C;IAC9C,OAAO,CAAC,cAAc;IAmCtB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ;IAKhB,+EAA+E;IAC/E,OAAO,CAAC,YAAY;IAIpB,4DAA4D;IAC5D,OAAO,CAAC,SAAS;IAIjB,uDAAuD;IACvD,OAAO,CAAC,OAAO;IASf;;;;;OAKG;IACH,OAAO,CAAC,EAAE;IAIV;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAaxB,8DAA8D;IAC9D,KAAK,IAAI,IAAI;IAWb,2BAA2B;IAC3B,IAAI,IAAI,IAAI;IAMZ,IAAI,SAAS,YAA2B;IAExC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,GAAG;IAYX,8CAA8C;IAC9C,OAAO,CAAC,eAAe;IAoEvB,sEAAsE;IACtE,OAAO,CAAC,YAAY;IASpB;;;;;;;;;;OAUG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;YAkBhF,mBAAmB;IA8FjC,OAAO,CAAC,cAAc;IAuEtB,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,8BAA8B;YAQxB,WAAW;IA8EzB;;;;;;;;;OASG;YACW,eAAe;IAsX7B;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,cAAc;IAyFtB,OAAO,CAAC,cAAc;IAyBtB;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,oBAAoB;IAkE5B;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,eAAe;YAoDT,SAAS;YAsJT,gBAAgB;IAoH9B,IAAI,KAAK;;;;;;;MASR;CACF"}

package/dist/facets/vite-dev-server.js

@@ -12,7 +12,7 @@
  *     ├── /*.ts,*.tsx,*.jsx    → esbuild transform → JS with import rewrites + alias resolution
  *     ├── /*.css               → serve as text/css (with @import inlining, @tailwind stripping, @apply expansion)
  *     ├── /*.css?import        → wrap CSS in JS that injects <style> tag
- *     ├── /@modules/<pkg>      → resolve from node_modules, bundle via esbuild facet (synthetic-entry for barrels)
+ *     ├── /@modules/<pkg>      → resolve from node_modules, bundle in the build facet (synthetic-entry for barrels)
  *     ├── /@vite/client        → HMR client script
  *     ├── /*.json (as module)  → export default { ... }
  *     ├── /*.svg,*.png,... (as module) → export default "/preview/path/to/asset"
@@ -21,8 +21,9 @@
  * HMR: VFS events → ViteDevServer detects changes → sends {type:'hmr'}
  *       messages through the DO WebSocket → frontend dispatches to iframe.
  */
-import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
-import { getSharedRuntimeExternals, BUNDLER_VERSION } from '@nimbus-sh/core/runtime/esbuild-service.js';
+import { getSharedRuntimeExternals, BUNDLER_VERSION, vfsBuildInputs } from '@nimbus-sh/core/runtime/esbuild-service.js';
+import { sliceSources } from '@nimbus-sh/core/runtime/prebundle-slice.js';
+import { R_OK } from '@nimbus-sh/core/runtime/process-files.js';
 import { NpmCache } from '../npm/cache.js';
 import { sha256Base64Url } from '@nimbus-sh/core/_shared/crypto.js';
 import { LruMap } from '@nimbus-sh/core/_shared/lru-map.js';
@@ -32,6 +33,7 @@ import { countPackageFiles, BARREL_PKG_FILE_THRESHOLD, packageNameFromSpecifier
 import { scanNamedImports, namedImportSignature, buildSyntheticEntry, buildScopedSliceForSynthetic, syntheticEntryPath, } from '../runtime/barrel-synthesizer.js';
 import { resolvePackageEntry, resolveExports } from '@nimbus-sh/core/_shared/exports-resolver.js';
 import { injectRouterBasename, shouldProcessForRouter } from '@nimbus-sh/core/runtime/router-basename.js';
+import { devStylesheet } from './dev-stylesheet.js';
 import { rewriteJavaScriptModuleSource } from '@nimbus-sh/core/runtime/module-source-rewriter.js';
 import { normalizeVfsPath, stripLeadingSlashes } from '@nimbus-sh/core/vfs/path.js';
 import { getTailwindPlayBundle, TAILWIND_PLAY_VERSION, } from '../tailwind-play.generated.js';
@@ -162,7 +164,7 @@ const ASSET_EXTS = new Set([
  * We inject `__nimbus_req` but keep esbuild's `__require` definition so we
  * don't have to rewrite its declaration — we just replace the call-sites.
  */
-function rewriteExternalRequires(code, basePath) {
+export function rewriteExternalRequires(code, basePath) {
     // Find all `__require("specifier")` calls where the specifier is bare
     // (not a relative/absolute path). Bare specifiers are the only ones that
     // can be external.
@@ -238,7 +240,7 @@ function rewriteExternalRequires(code, basePath) {
  *   - No `export default` pattern found
  *   - No CJS export patterns found in the bundle source
  */
-function synthesizeCjsNamedExports(code) {
+export function synthesizeCjsNamedExports(code) {
     // Quick check: does the bundle already have named exports?
     if (/(^|\n)\s*export\s+(?:const|let|var|function|class|\{|\*)\b/.test(code)) {
         return code;
@@ -1170,7 +1172,7 @@ export class ViteDevServer {
     injectBasename;
     env;
     ctx = null;
-    /** The session's esbuild facet pool; null = legacy in-supervisor esbuild. */
+    /** The session's pre-bundle pool; null = bundle through the EsbuildService. */
     bundlePool;
     /**
      * In-flight on-demand-bundle coalescing map. When the browser fires
@@ -1199,7 +1201,7 @@ export class ViteDevServer {
     logPid = null;
     logSink = null;
     constructor(opts) {
-        this.vfs = opts.vfs.as(CRED_KERNEL);
+        this.vfs = opts.vfs.as(opts.cred);
         this.vfsEvents = opts.vfs.events;
         this.esbuild = opts.esbuild;
         this.injectBasename = opts.injectBasename !== false;
@@ -1243,11 +1245,11 @@ export class ViteDevServer {
         this.detectTailwind();
     }
     /**
-     * The session's shared esbuild pool for on-demand bundling of
+     * The session's pre-bundle pool for on-demand bundling of
      * /preview/@modules/<spec> requests that miss both the in-memory and
-     * pkg_esm_bundles caches. Null when no pool was provided (legacy
-     * in-supervisor fallback). Acquired BEFORE the slice lease — see
-     * EsbuildBundlePool.acquire.
+     * pkg_esm_bundles caches. Null when no pool was provided (the
+     * EsbuildService fallback). Acquired BEFORE the slice lease — see
+     * PrebundlePool.acquire.
      */
     async ensureOnDemandPool() {
         if (!this.bundlePool)
@@ -1310,6 +1312,16 @@ export class ViteDevServer {
     defineFor(base) {
         return { ...this.define, 'import.meta.env.BASE_URL': this.baseUrlValue(base) };
     }
+    /** Whether this server's principal may read `path`. */
+    mayRead(path) {
+        try {
+            this.vfs.access(path, R_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * Module-cache key for `key` under mount base `base`. The transformed text
      * embeds the base (module URLs, <base href>, BASE_URL, router basename), so
@@ -1555,7 +1567,8 @@ export class ViteDevServer {
                         return new Response(null, { status: 302, headers: { ...headers, 'Location': resolved } });
                     }
                 }
-                return this.serveModule(specifier, headers, base);
+                // Awaited, so a package its principal may not enter answers 403 below.
+                return await this.serveModule(specifier, headers, base);
             }
             // / → serve index.html
             if (pathname === '/' || pathname === '/index.html') {
@@ -1570,10 +1583,18 @@ export class ViteDevServer {
                     headers: { ...headers, 'Content-Type': MIME_TYPES[ext] || 'application/octet-stream' },
                 });
             }
-            // Serve from VFS (with transforms for TS/TSX/JSX)
-            return this.serveFile(request, pathname, query, headers, base);
+            // Serve from VFS (with transforms for TS/TSX/JSX). Awaited, so a
+            // read the server's principal is refused lands in the catch below.
+            return await this.serveFile(request, pathname, query, headers, base);
         }
         catch (e) {
+            // The server reads as the principal who started it: a file that
+            // principal may not read is forbidden, not an error of the server's.
+            if (e?.code === 'EACCES' || e?.code === 'EPERM') {
+                return new Response('403 Forbidden: ' + pathname, {
+                    status: 403, headers: { ...headers, 'Content-Type': 'text/plain' },
+                });
+            }
             return new Response(`500 Internal Server Error: ${e?.message}`, {
                 status: 500, headers: { ...headers, 'Content-Type': 'text/plain' },
             });
@@ -1688,9 +1709,15 @@ export class ViteDevServer {
             // Only use cached bundles built with the current bundler version.
             // Stale bundles (from older bundler versions) are treated as missing
             // and re-bundled on the cold path.
+            // The cache is the workspace's, shared by every server whoever started
+            // it: a bundle is served only to a principal who may read everything it
+            // was built from, so one that names nothing it was built from is never
+            // served. Otherwise this server builds its own, as itself.
             if (esmBundle &&
                 esmBundle.bundleHash === BUNDLER_VERSION &&
-                this.cachedModuleMatchesBarrelInput(esmBundle.inputHash, barrelInfo)) {
+                this.cachedModuleMatchesBarrelInput(esmBundle.inputHash, barrelInfo) &&
+                esmBundle.sources.length > 0 &&
+                esmBundle.sources.every((path) => this.mayRead(path))) {
                 let code = esmBundle.esmCode;
                 // The persisted bundle is base-independent raw esbuild output; the
                 // base-dependent rewrites (module URLs) are applied here, per request.
@@ -1747,13 +1774,12 @@ export class ViteDevServer {
         // supervisor isolate. For large modules (lucide-react, ~18 MiB
         // unpacked) that OOM'd the supervisor and surfaced as CF error
         // 1101 on /preview/@modules/lucide-react, taking down the entire
-        // preview. We now dispatch the bundle work to the session's shared
-        // esbuild IsolatePool — the same pool, isolate and 128 MiB heap the
-        // install-time pre-bundler uses. Supervisor never bundles esbuild
-        // for any path.
+        // preview. We now dispatch the bundle work to the session's build
+        // facet from a slice — the same pool and isolate the install-time
+        // pre-bundler uses. The supervisor never runs a bundler.
         //
-        // Falls back to in-supervisor esbuild ONLY if no bundle pool was
-        // provided (legacy callers / tests).
+        // Falls back to the EsbuildService (its build host) ONLY if no bundle
+        // pool was provided (legacy callers / tests).
         const resolved = this.resolvePackage(specifier);
         // Barrel packages (lucide-react, @phosphor-icons/react, react-icons,
         // @mui/icons-material, …) ship hundreds/thousands of tiny re-export
@@ -1777,6 +1803,11 @@ export class ViteDevServer {
             //                  re-exports just the named imports the user's
             //                  source uses. esbuild tree-shakes the rest.
             let bundleEntryPath = resolved;
+            // A module its principal may not read is refused (403), not bundled
+            // from whatever of its package the principal can see.
+            this.vfs.access(resolved, R_OK);
+            // What the bundle was built from, recorded with it in the shared cache.
+            let bundledSources = [];
             let synthetic = false;
             let syntheticReferencedFiles = null;
             if (isBarrel) {
@@ -1850,9 +1881,9 @@ export class ViteDevServer {
             let sliceLease = null;
             try {
                 if (onDemandPool) {
-                    // Facet path — supervisor stays at 0 esbuild bytes.
+                    // Facet path — the supervisor holds no bundler.
                     try {
-                        const { buildSliceForSpecifierWithCap, prebundleOne, BUNDLER_VERSION, } = await import('../npm/pre-bundle-facet.js');
+                        const { buildSliceForSpecifierWithCap, BUNDLER_VERSION, } = await import('../npm/pre-bundle-facet.js');
                         const SLICE_CAP_BYTES = ON_DEMAND_SLICE_CAP_BYTES;
                         const projDir = this.root;
                         const nmDir = projDir + '/node_modules';
@@ -1906,6 +1937,7 @@ export class ViteDevServer {
                             // completes. Mirrors the install-time runSlot pattern (see
                             // commit 40cfc01); the lease above keeps every other budget
                             // owner from allocating beside it until the Response exists.
+                            const sources = sliceSources(slice.slice);
                             let spec = {
                                 specifier,
                                 entryPath: bundleEntryPath,
@@ -1920,13 +1952,14 @@ export class ViteDevServer {
                             slice = null;
                             let result = null;
                             try {
-                                result = await onDemandPool.submit(prebundleOne, spec);
+                                result = await onDemandPool.prebundle(spec);
                             }
                             finally {
                                 spec = null;
                             }
                             if (result && result.ok && result.esmCode) {
                                 bundled = result.esmCode;
+                                bundledSources = sources;
                             }
                             else if (result && result.errorText) {
                                 this.log('error', '[vite-dev] facet bundle failed for ' + specifier + ': ' + result.errorText);
@@ -1942,8 +1975,8 @@ export class ViteDevServer {
                     }
                 }
                 else {
-                    // Legacy fallback — in-supervisor esbuild. Used only when no
-                    // bundle pool was provided.
+                    // Fallback — the EsbuildService's build (its build host). Used
+                    // only when no bundle pool was provided.
                     try {
                         const result = await this.esbuild.build([bundleEntryPath], {
                             bundle: true,
@@ -1953,9 +1986,11 @@ export class ViteDevServer {
                             // Base-neutral (see the pooled build above).
                             define: this.defineFor(''),
                             external: externals.length > 0 ? externals : undefined,
+                            fs: this.vfs,
                         });
                         if (result.outputFiles?.length) {
                             bundled = result.outputFiles[0].contents;
+                            bundledSources = vfsBuildInputs(result.metafile);
                         }
                     }
                     catch (e) {
@@ -1970,7 +2005,8 @@ export class ViteDevServer {
                     // post-rewrite text instead would pin the bundle to whichever base
                     // built it first and 404 the other. Cache ONLY successful bundles;
                     // a failed build left `bundled` null and never reaches here.
-                    if (this.npmCache) {
+                    // A bundle whose sources are unknown would never be served from the cache.
+                    if (this.npmCache && bundledSources.length > 0) {
                         try {
                             this.npmCache.putEsmBundle({
                                 specifier,
@@ -1978,6 +2014,7 @@ export class ViteDevServer {
                                 esmCode: bundled,
                                 builtAt: Date.now(),
                                 inputHash: barrelInfo?.inputHash ?? '',
+                                sources: bundledSources,
                             });
                         }
                         catch { /* non-fatal */ }
@@ -2413,22 +2450,8 @@ export class ViteDevServer {
         }
         // CSS handling
         if (ext === '.css') {
-            let css = this.vfs.readFileString(vfsPath);
-            // Resolve @import "./other.css" (but pass through @import url(...) for Google Fonts etc.)
-            const cssDir = vfsPath.includes('/') ? vfsPath.substring(0, vfsPath.lastIndexOf('/')) : this.root;
-            css = css.replace(/@import\s+["']([^"']+)["']\s*;/g, (_match, importPath) => {
-                if (importPath.startsWith('http'))
-                    return _match;
-                const resolvedPath = importPath.startsWith('/')
-                    ? this.root + importPath
-                    : cssDir + '/' + importPath;
-                try {
-                    return this.vfs.readFileString(resolvedPath);
-                }
-                catch {
-                    return `/* @import "${importPath}" not found */`;
-                }
-            });
+            // Its @imports inlined by the CSS layer `vite build` uses, its url()s rooted at `base`.
+            let css = await devStylesheet(this.vfs, this.root, base, vfsPath);
             // Process Tailwind CSS directives if project uses Tailwind
             if (this.hasTailwind) {
                 css = processTailwindCss(css);

package/dist/hosted/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/hosted/commands.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAyB5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,oFAAoF;AACpF,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,eAAe,EACnD,oBAAoB,GAAG,gBAAgB,GAAG,cAAc,GAAG,eAAe,GAAG,YAAY,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,cAAc,GAAG,cAAc,GAAG,WAAW,GAAG,iBAAiB,GAAG,UAAU,GAAG,cAAc,GAAG,eAAe,GAAG,0BAA0B,CAClV,GAAG;IACF,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAChC,aAAa,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC;IAChD,sBAAsB,EAAE,eAAe,CAAC,wBAAwB,CAAC,CAAC;CACnE,CAAC;AAEF,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAshDhH"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/hosted/commands.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AA2B5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAI9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,oFAAoF;AACpF,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,eAAe,EACnD,oBAAoB,GAAG,gBAAgB,GAAG,cAAc,GAAG,eAAe,GAAG,YAAY,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,cAAc,GAAG,cAAc,GAAG,WAAW,GAAG,iBAAiB,GAAG,UAAU,GAAG,cAAc,GAAG,eAAe,GAAG,0BAA0B,CAClV,GAAG;IACF,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC;IAChC,aAAa,EAAE,eAAe,CAAC,eAAe,CAAC,CAAC;IAChD,sBAAsB,EAAE,eAAe,CAAC,wBAAwB,CAAC,CAAC;CACnE,CAAC;AAEF,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAqiDhH"}

package/dist/hosted/commands.js

@@ -7,9 +7,11 @@ import { engineKey, ProcessView } from '@nimbus-sh/core/runtime/process-files.js
 import { handKernelArtifact, projectFs } from '../runtime/project-fs.js';
 import { makeEsbuildCommand } from '@nimbus-sh/core/runtime/esbuild-cli.js';
 import { runEsbuildCli, supervisorEsbuildService } from '../facets/esbuild-transform.js';
+import { prewarmBuildFacet } from '../facets/build-facet.js';
 import { runFresh } from '../runtime/node-runner.js';
 import { runBunScript, BUN_VERSION } from '../runtime/bun-runner.js';
 import { buildRuntimeHandler, resolveRuntimeScriptPath } from '@nimbus-sh/core/runtime/runtime-registry.js';
+import { resolveContext } from '@nimbus-sh/core/substrate/lifo/commands/registry.js';
 import { normalizeVfsPath, resolveVfsPath } from '@nimbus-sh/core/vfs/path.js';
 import { NimbusWrangler } from '../wrangler/nimbus-wrangler.js';
 import { filterWranglerFlags, detectBundlerBin, checkNodeModulesGuard, detectUnsupportedWranglerConfig, refusedNextSubcommand, NEXT_REFUSAL_MESSAGE } from '../session/helpers.js';
@@ -24,7 +26,7 @@ import { rpcExposeApp, rpcListApps, rpcRemoveApp, rpcRotateLink } from '../sessi
 import { listInstalledRuntimes } from '@nimbus-sh/core/runtime/installed-runtimes.js';
 import { notifyTerminalEvent } from '../runtime/process-logs-api.js';
 import { stripAnsi } from '@nimbus-sh/core/runtime/process-logs.js';
-import { NODE_VERSION } from '@nimbus-sh/core/constants.js';
+import { DEFAULT_HOME, NODE_VERSION } from '@nimbus-sh/core/constants.js';
 import { VITE_CONFIG_KEY } from '../session/keys.js';
 import { isJsonObject } from '../npm/package-lock.js';
 import { HeadlessTerminal } from '@nimbus-sh/core/substrate/lifo/index.js';
@@ -139,6 +141,7 @@ export async function registerHostedCommands(self, workspace) {
                 authority: workspace.filesystem,
                 terminal: terminal,
                 installRoot,
+                home: ctx.env?.HOME || shell.getEnv().HOME || DEFAULT_HOME,
                 manifest,
                 // REPL-R7-1: thread the shell so ReplSession can drain
                 // shell.pasteQueue on attach (multi-line WS frames like
@@ -147,6 +150,7 @@ export async function registerHostedCommands(self, workspace) {
                 // The supervisor derives the write credential from this; without
                 // it the prompt cannot write to the session filesystem.
                 pid: ctx.pid,
+                start: { cwd: ctx.cwd || shell.getCwd(), binName },
             });
         }
         // Args present (one-shot mode: -c, script, -m, -). Fall through
@@ -177,6 +181,11 @@ export async function registerHostedCommands(self, workspace) {
                 authority: workspace.filesystem,
                 terminal: terminal,
                 installRoot,
+                // The caller's filesystem and credential, from its working directory.
+                pid: ctx.pid,
+                home: ctx.env?.HOME || shell.getEnv().HOME || DEFAULT_HOME,
+                cwd: ctx.cwd || shell.getCwd(),
+                binName,
             });
         }
         const { makeRubyRunnerFactory } = await import('@nimbus-sh/core/runtime/ruby-runner.js');
@@ -187,6 +196,7 @@ export async function registerHostedCommands(self, workspace) {
             filesystem: workspace.filesystem,
             registry,
             startResident: rubyResidentStart(facetMgr),
+            getHome: () => workspace.shell.getEnv().HOME ?? DEFAULT_HOME,
         })(manifest, installRoot, binName, binKind);
         return runner(ctx);
     });
@@ -256,7 +266,7 @@ export async function registerHostedCommands(self, workspace) {
                         pid,
                         cred,
                         setUmask: (mask) => ctx.setUmask(mask),
-                        runAs: (targetCred, argv) => ctx.runAs(targetCred, argv),
+                        runAs: (targetCred, argv, options) => ctx.runAs(targetCred, argv, options),
                         vfs: new ProcessView(workspace.filesystem.bind({ pid, cred })),
                         signal: new AbortController().signal,
                         stdout,
@@ -271,6 +281,7 @@ export async function registerHostedCommands(self, workspace) {
                     facetMgr,
                     authority: workspace.filesystem,
                     installRoot: target.root,
+                    home: ctx.env?.HOME || shell.getEnv().HOME || DEFAULT_HOME,
                     manifest: target.manifest,
                 });
                 ctx.stdout.write('[python] ready\n');
@@ -453,6 +464,9 @@ export async function registerHostedCommands(self, workspace) {
                             env: ctx.env,
                             onStdout: textSink((d) => ctx.stdout.write(d)),
                             onStderr: textSink((d) => ctx.stderr.write(d)),
+                            // The script runs as the process that ran `bun run`, as an
+                            // `npm run` script does, not as the workspace shell.
+                            commandContext: { pid: ctx.pid, cred: ctx.cred, setUmask: ctx.setUmask },
                         });
                         return shellResult.exitCode;
                     }
@@ -590,11 +604,13 @@ export async function registerHostedCommands(self, workspace) {
             ctx.stderr.write(`Unknown command: ${args[0]}. Use "${invokedAs} dev" or "${invokedAs} --help".\n`);
             return 1;
         }
+        // Its first build waits on the build facet: start loading it now.
+        prewarmBuildFacet(self.ctx, self.env);
         // First-run banner — only when invoked as `wrangler`, and only once
         // per session. Makes it OBVIOUS to the user that they're not running
         // real wrangler, and that Nimbus is doing something different.
         if (invokedAs === 'wrangler' && !self.wranglerAliasBannerShown) {
-            ctx.stdout.write('\x1b[2m\u2388  wrangler (Nimbus DO-in-DO mode) — bundling via esbuild-wasm, running via env.LOADER\x1b[0m\n');
+            ctx.stdout.write('\x1b[2m\u2388  wrangler (Nimbus DO-in-DO mode) — bundling via rolldown, running via env.LOADER\x1b[0m\n');
             self.wranglerAliasBannerShown = true;
         }
         // Report ignored flags (also one-shot — if user sees it once per
@@ -1279,7 +1295,7 @@ export async function registerHostedCommands(self, workspace) {
         }
         const cmd = getNpxCommandWord(npxArgs);
         // Check if it's a built-in command (vite, esbuild, etc.)
-        const resolved = cmd ? await registry.resolve(cmd, { cwd: ctx.cwd }) : null;
+        const resolved = cmd ? await registry.resolve(cmd, resolveContext(ctx.cwd, ctx.env, ctx.vfs)) : null;
         if (resolved) {
             return await resolved({ ...ctx, args: getNpxCommandArgs(npxArgs) });
         }

package/dist/hosted/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/hosted/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,EAA6B,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAElG,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AACvE,OAAO,EAAqD,KAAK,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAG1I,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AASxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAQ7D,OAAO,KAAK,UAAU,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAK3B,QAAA,MAAM,UAAU;;;;;EAAgF,CAAC;AACjG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE3D,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,GAAG,EAAE,kBAAkB,CAAC;IACxB,GAAG,EAAE,QAAQ,CAAC,gBAAgB,CAAC;IAC/B,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,sBAAsB,CAAC;IAClC,mBAAmB,CAAC,EAAE,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mGAAmG;AACnG,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG;IAAE,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAAA;CAAE,CAAC;AAqU7E,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB;6BA2C3C,oBAAoB;IAC7C,sGAAsG;sBACrF,kBAAkB;wBAIf,iBAAiB;wBACjB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAjCV,MAAM,YAAY,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAiBrC,SAAS;wBACV,SAAS,WAAW,MAAM,GAAG,WAAW;;;;;GAkB/D;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/hosted/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,EAA6B,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAElG,OAAO,EAAE,WAAW,EAAE,MAAM,0CAA0C,CAAC;AACvE,OAAO,EAAqD,KAAK,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAG1I,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AASxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAQ7D,OAAO,KAAK,UAAU,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAK3B,QAAA,MAAM,UAAU;;;;;EAAgF,CAAC;AACjG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAE3D,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,eAAe,CAAC;IAC3B,GAAG,EAAE,kBAAkB,CAAC;IACxB,GAAG,EAAE,QAAQ,CAAC,gBAAgB,CAAC;IAC/B,KAAK,EAAE,YAAY,CAAC;IACpB,SAAS,EAAE,sBAAsB,CAAC;IAClC,mBAAmB,CAAC,EAAE,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,mGAAmG;AACnG,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG;IAAE,EAAE,CAAC,IAAI,EAAE,OAAO,GAAG,YAAY,CAAA;CAAE,CAAC;AA0U7E,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB;6BA2C3C,oBAAoB;IAC7C,sGAAsG;sBACrF,kBAAkB;wBAIf,iBAAiB;wBACjB,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBAjCV,MAAM,YAAY,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAiBrC,SAAS;wBACV,SAAS,WAAW,MAAM,GAAG,WAAW;;;;;GAkB/D;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC"}

package/dist/hosted/runtime.js

@@ -3,7 +3,7 @@ import { ProcessView } from '@nimbus-sh/core/runtime/process-files.js';
 import { SUPERVISOR_OP_ROUTES, createSupervisorBridgeStore } from '@nimbus-sh/core/workspace/supervisor-op.js';
 import { openSupervisorDeliveries } from '@nimbus-sh/core/workspace/supervisor-delivery.js';
 import { WebSocketTerminal } from '../facets/ws-terminal.js';
-import { buildSessionSupervisorOps } from '../session/supervisor-op.js';
+import { answerSupervisorOp, buildSessionSupervisorOps } from '../session/supervisor-op.js';
 import { armLogJanitor, armResidentKeepalive, installLogPersistence, logJanitorFired, noteResidentClient, residentKeepaliveFired } from '../session/hibernation.js';
 import { takeLegacyResetNotice } from '../session/legacy-reset.js';
 import { appendScrollback, ensureSessionStateSchema, loadScrollback, loadShellState, persistShellState } from '../session/state-store.js';
@@ -26,7 +26,7 @@ class RuntimeOwner {
     options;
     terminal;
     _cpRegistry;
-    _programmaticShellQueues = new Map();
+    _storedShellsAdopted;
     _hostedProcesses = new Map();
     _hostedProcessWaiters = new Map();
     _cirrusHmrWsClients = new Map();
@@ -92,6 +92,7 @@ class RuntimeOwner {
     get ctx() { return this.options.ctx; }
     get _w1SessionDestroyed() { return this.closing !== null; }
     get env() { return this.options.env; }
+    get runtimeWorkspace() { return this.options.workspace; }
     get sqliteFs() { return this.options.workspace.vfs; }
     get kernel() { return this.options.workspace.kernel; }
     get shell() { return this.options.workspace.shell; }
@@ -186,7 +187,11 @@ class RuntimeOwner {
         })));
         return this.supervisor;
     }
+    /** What host stubs call: an answer leaving the runtime, counted (answerSupervisorOp). */
     supervisorOp(envelope) {
+        return answerSupervisorOp((served) => this.serveSupervisorOp(served), envelope);
+    }
+    serveSupervisorOp(envelope) {
         this.assertOpen();
         return this.supervisorOps().dispatch(envelope);
     }

package/dist/hosted/services.d.ts

@@ -1,6 +1,6 @@
 import { type ComposedFacetManager, type FacetManagerHostHooks } from "../facets/compose.js";
 import { type NimbusFilesystemAuthority } from "@nimbus-sh/core/runtime/os-contracts.js";
-import { EsbuildBundlePool } from "../facets/esbuild-bundle-pool.js";
+import { PrebundlePool } from "../facets/prebundle-pool.js";
 import type { NpmInstaller } from "../npm/installer.js";
 import { WebSocketRelay } from "../session/ws-relay.js";
 import type { SessionInternal } from '../session/internal.js';
@@ -28,7 +28,7 @@ export interface RuntimeServiceContext {
     /** The host's own authority: a session has exactly one, and this is it. */
     filesystem: () => NimbusFilesystemAuthority;
 }
-export declare function ensureBundlePool(self: RuntimeServiceHost, runtimeContext: RuntimeServiceContext): EsbuildBundlePool;
+export declare function ensureBundlePool(self: RuntimeServiceHost, runtimeContext: RuntimeServiceContext): PrebundlePool;
 export declare function ensureFacetManager(self: RuntimeServiceHost, runtimeContext: RuntimeServiceContext): ComposedFacetManager;
 export declare function _ensureWebSocketRelay(self: RuntimeServiceHost, runtimeContext: RuntimeServiceContext): WebSocketRelay;
 export declare function _ensureFacetProcessManager(self: RuntimeServiceHost, runtimeContext: RuntimeServiceContext): any;
@@ -38,7 +38,7 @@ export declare function ensureNpmInstaller(self: RuntimeServiceHost, runtimeCont
 export declare function _envFlagDefaultOn(self: RuntimeServiceHost, runtimeContext: RuntimeServiceContext, name: string): boolean;
 export declare function ensureGlobalPrefixDirs(self: RuntimeServiceHost, runtimeContext: RuntimeServiceContext, prefix: string): void;
 export declare function bindRuntimeServices(host: RuntimeServiceHost, context: RuntimeServiceContext): {
-    ensureBundlePool: () => EsbuildBundlePool;
+    ensureBundlePool: () => PrebundlePool;
     ensureFacetManager: () => ComposedFacetManager;
     _ensureWebSocketRelay: () => WebSocketRelay;
     _ensureFacetProcessManager: () => any;