@nimbus-sh/worker 0.12.0 → 0.13.0

package/dist/node-shims-artifact.generated.js

@@ -3,19 +3,32 @@
  * scripts/bundle-node-shims.mjs. DO NOT EDIT.
  *
  * Pins the staged sources of the node-compat layer, promoted out of the worker
- * bundle: the shims, the VFS write ledger and the resident store. Each
+ * bundle: the shims, the VFS write ledger, the resident store, and the
+ * runtime-code interpreter with its host module. Each
  * <NAME>_BUILD_ID is a content-hash prefix so cache layers never serve stale
  * bytes after a rebuild; <NAME>_SHA256 is the full digest verified at fetch time.
  */
 /** dist/runtime/node-shims.js generateShimsCode() */
-export const NODE_SHIMS_ENTRY = "/_assets/runtime/node-shims-f92f16c7d7c532e9.js";
-export const NODE_SHIMS_BUILD_ID = "f92f16c7d7c532e9";
-export const NODE_SHIMS_SHA256 = "f92f16c7d7c532e9b3c3cf8f5eaebbf531cdaf3b7bb5cd86db4e7608d162eba5";
+export const NODE_SHIMS_ENTRY = "/_assets/runtime/node-shims-e3adc4576da31e6e.js";
+export const NODE_SHIMS_BUILD_ID = "e3adc4576da31e6e";
+export const NODE_SHIMS_SHA256 = "e3adc4576da31e6e03edcac52a4bf286c3bfabac2a635156b2dc728d88283c38";
 /** @nimbus-sh/core dist/_shared/vfs-write-ledger.js VFS_WRITE_LEDGER_SOURCE */
-export const VFS_WRITE_LEDGER_ENTRY = "/_assets/runtime/vfs-write-ledger-d33ee0034446c3e0.js";
-export const VFS_WRITE_LEDGER_BUILD_ID = "d33ee0034446c3e0";
-export const VFS_WRITE_LEDGER_SHA256 = "d33ee0034446c3e087350fff3067664d97a95cdc73667d0f611a558d93fed533";
+export const VFS_WRITE_LEDGER_ENTRY = "/_assets/runtime/vfs-write-ledger-9e9594591425a9b8.js";
+export const VFS_WRITE_LEDGER_BUILD_ID = "9e9594591425a9b8";
+export const VFS_WRITE_LEDGER_SHA256 = "9e9594591425a9b8e9ca4e24b32e4cc54aeff94954c30891c95976a4fd57a195";
 /** dist/vfs/facet-resident-store.js FACET_RESIDENT_STORE_SOURCE */
-export const RESIDENT_STORE_ENTRY = "/_assets/runtime/resident-store-92386265e8b306dc.js";
-export const RESIDENT_STORE_BUILD_ID = "92386265e8b306dc";
-export const RESIDENT_STORE_SHA256 = "92386265e8b306dcf276dc525ae9f7e025f4c0b7cad5b470ab674e836c8cb33c";
+export const RESIDENT_STORE_ENTRY = "/_assets/runtime/resident-store-009f39539ac989fc.js";
+export const RESIDENT_STORE_BUILD_ID = "009f39539ac989fc";
+export const RESIDENT_STORE_SHA256 = "009f39539ac989fc7d3f6489550e47a690cc6f64868955e8991c0427c145bf21";
+/** @nimbus-sh/core src/interpreter/primordials.ts, bundled by scripts/interpreter-bundle.mjs */
+export const JS_INTERPRETER_PRIMORDIALS_ENTRY = "/_assets/runtime/js-interpreter-primordials-e620a61b7e9800fa.js";
+export const JS_INTERPRETER_PRIMORDIALS_BUILD_ID = "e620a61b7e9800fa";
+export const JS_INTERPRETER_PRIMORDIALS_SHA256 = "e620a61b7e9800fad31b82c28fe64bd149c0518dc8c614e512b88dc200096f48";
+/** @nimbus-sh/core src/interpreter, bundled by scripts/interpreter-bundle.mjs */
+export const JS_INTERPRETER_ENTRY = "/_assets/runtime/js-interpreter-3c37c48024f0f651.js";
+export const JS_INTERPRETER_BUILD_ID = "3c37c48024f0f651";
+export const JS_INTERPRETER_SHA256 = "3c37c48024f0f65132e92de3564068518eaa43b24acd270357e7e9e6a36db88d";
+/** @nimbus-sh/core src/interpreter/host-ops.ts HOST_OPS_SOURCE */
+export const JS_INTERPRETER_OPS_ENTRY = "/_assets/runtime/js-interpreter-ops-2f4dfec6798e70fc.js";
+export const JS_INTERPRETER_OPS_BUILD_ID = "2f4dfec6798e70fc";
+export const JS_INTERPRETER_OPS_SHA256 = "2f4dfec6798e70fcb11871ff1f57fa56336f33bfd5f31dfb3414f10433e4914c";

package/dist/npm/bin-links.d.ts

@@ -1,4 +1,4 @@
-import type { ProjectFs } from '../runtime/project-fs.js';
+import { type ProjectFs } from '../runtime/project-fs.js';
 import type { ResolvedPackage } from './resolver.js';
 /**
  * A staged-artifact bin target (`nimbus-staged:<artifact>`) is a sentinel,
@@ -30,7 +30,7 @@ export interface NpmBinResolution extends NpmBinEntry {
  * caller (see runtime/project-fs.ts), each call answered at once by the
  * engine or awaited through the caller's view of the namespace.
  */
-type VfsLike = Pick<ProjectFs, 'exists' | 'isDirectory' | 'readFileString' | 'readdir'>;
+type VfsLike = Pick<ProjectFs, 'exists' | 'isDirectory' | 'readFileString' | 'readdir' | 'lstat'>;
 type WritableVfsLike = VfsLike & Pick<ProjectFs, 'mkdir' | 'writeFile' | 'chmod'>;
 export declare function npmBinDirPath(nodeModulesPath: string): string;
 export declare function npmBinManifestPath(nodeModulesPath: string): string;
@@ -38,8 +38,11 @@ export declare function createNpmBinManifest(entries: NpmBinEntry[]): NpmBinMani
 export declare function createNpmBinShim(entry: NpmBinEntry, shimDir: string): string;
 export declare function packageBinEntries(pkg: ResolvedPackage, nodeModulesPath: string): NpmBinEntry[];
 export declare function resolveNpmBin(vfs: VfsLike, cwd: string, name: string): Promise<NpmBinResolution | null>;
-export declare function resolveNpmBinFromPath(vfs: VfsLike, cwd: string, envPath: string, name: string): Promise<NpmBinResolution | null>;
-/** A path-shaped invocation of an executable entry in a `node_modules/.bin` directory; null otherwise. */
+/**
+ * A path-shaped invocation of an npm bin shim: an executable entry of a
+ * `node_modules/.bin` directory, or one a bin directory's manifest names
+ * (where `npm i -g` links them onto PATH); null for any other file.
+ */
 export declare function resolveNpmBinPath(vfs: VfsLike & Pick<ProjectFs, 'stat'>, cwd: string, path: string): Promise<NpmBinResolution | null>;
 export declare function materializeNpmBinShims(vfs: WritableVfsLike, nodeModulesPath: string, binDir: string): Promise<number>;
 export {};

package/dist/npm/bin-links.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bin-links.d.ts","sourceRoot":"","sources":["../../src/npm/bin-links.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,gHAAgH;AAChH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAOvE;AAED,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAE5D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,wBAAwB,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,KAAK,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,aAAa,GAAG,gBAAgB,GAAG,SAAS,CAAC,CAAC;AACxF,KAAK,eAAe,GAAG,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC;AA8BlF,wBAAgB,aAAa,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,cAAc,CAI3E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAU5E;AAWD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,GAAG,WAAW,EAAE,CAY9F;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAO7G;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAMlC;AAED,0GAA0G;AAC1G,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAY3I;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAoBjB"}
+{"version":3,"file":"bin-links.d.ts","sourceRoot":"","sources":["../../src/npm/bin-links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAG5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,gHAAgH;AAChH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAOvE;AAED,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAE5D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,wBAAwB,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,KAAK,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,aAAa,GAAG,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAAC,CAAC;AAClG,KAAK,eAAe,GAAG,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,WAAW,GAAG,OAAO,CAAC,CAAC;AA8BlF,wBAAgB,aAAa,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,cAAc,CAI3E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAU5E;AAWD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,GAAG,WAAW,EAAE,CAY9F;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAO7G;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAe3I;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAoBjB"}

package/dist/npm/bin-links.js

@@ -1,3 +1,4 @@
+import { projectEntryType } from '../runtime/project-fs.js';
 import { normalizeVfsPath, resolveVfsPath } from '@nimbus-sh/core/vfs/path.js';
 import { npmBinMap, npmBinName } from '@nimbus-sh/core/runtime/npm-bin-map.js';
 import { STAGED_ARTIFACT_BIN_PREFIX } from '../facets/wasm-swap-registry.js';
@@ -98,23 +99,18 @@ export async function resolveNpmBin(vfs, cwd, name) {
     }
     return null;
 }
-export async function resolveNpmBinFromPath(vfs, cwd, envPath, name) {
-    for (const binDir of candidatePathDirs(cwd, envPath)) {
-        const resolved = await resolveNpmBinInBinDir(vfs, binDir, name);
-        if (resolved)
-            return resolved;
-    }
-    return null;
-}
-/** A path-shaped invocation of an executable entry in a `node_modules/.bin` directory; null otherwise. */
+/**
+ * A path-shaped invocation of an npm bin shim: an executable entry of a
+ * `node_modules/.bin` directory, or one a bin directory's manifest names
+ * (where `npm i -g` links them onto PATH); null for any other file.
+ */
 export async function resolveNpmBinPath(vfs, cwd, path) {
     const shimPath = resolveVfsPath(path, cwd || '/home/user');
     const slash = shimPath.lastIndexOf('/');
     if (slash < 0)
         return null;
     const binDir = shimPath.slice(0, slash);
-    if (!binDir.endsWith('/node_modules/.bin'))
-        return null;
+    const name = shimPath.slice(slash + 1);
     try {
         if (((await vfs.stat(shimPath)).mode & 0o111) === 0)
             return null;
@@ -122,7 +118,11 @@ export async function resolveNpmBinPath(vfs, cwd, path) {
     catch {
         return null;
     }
-    return await resolveNpmBinInBinDir(vfs, binDir, shimPath.slice(slash + 1));
+    const nodeModulesPath = nodeModulesPathForBinDir(binDir);
+    if (nodeModulesPath?.endsWith('/node_modules'))
+        return await resolveNpmBinAt(vfs, nodeModulesPath, name);
+    const entry = await resolveFromBinDirManifest(vfs, binDir, name);
+    return entry ? { ...entry, shimPath } : null;
 }
 export async function materializeNpmBinShims(vfs, nodeModulesPath, binDir) {
     const entries = await listNpmBinEntries(vfs, normalizeVfsPath(nodeModulesPath));
@@ -162,31 +162,6 @@ async function resolveNpmBinAt(vfs, nodeModulesPath, name) {
         shimPath,
     };
 }
-async function resolveNpmBinInBinDir(vfs, binDir, name) {
-    const cleanBinDir = normalizeVfsPath(binDir);
-    if (!cleanBinDir)
-        return null;
-    const shimPath = `${cleanBinDir}/${name}`;
-    if (!await vfs.exists(shimPath) || await safeIsDirectory(vfs, shimPath))
-        return null;
-    const nodeModulesPath = nodeModulesPathForBinDir(cleanBinDir);
-    if (nodeModulesPath) {
-        const resolved = await resolveNpmBinAt(vfs, nodeModulesPath, name);
-        if (resolved)
-            return resolved;
-    }
-    const manifestEntry = await resolveFromBinDirManifest(vfs, cleanBinDir, name);
-    if (manifestEntry)
-        return { ...manifestEntry, shimPath };
-    return {
-        name,
-        packageName: name,
-        packageVersion: '',
-        packagePath: cleanBinDir,
-        targetPath: shimPath,
-        shimPath,
-    };
-}
 function candidateNodeModulesPaths(cwd) {
     const paths = [];
     let current = normalizeVfsPath(cwd || '/home/user');
@@ -199,22 +174,6 @@ function candidateNodeModulesPaths(cwd) {
     }
     return paths;
 }
-function candidatePathDirs(cwd, envPath) {
-    const dirs = [];
-    const seen = new Set();
-    for (const rawDir of (envPath || '').split(':')) {
-        if (!rawDir)
-            continue;
-        const dir = rawDir.startsWith('/')
-            ? normalizeVfsPath(rawDir)
-            : resolveVfsPath(rawDir, cwd || '/home/user');
-        if (!dir || seen.has(dir))
-            continue;
-        seen.add(dir);
-        dirs.push(dir);
-    }
-    return dirs;
-}
 function nodeModulesPathForBinDir(binDir) {
     const suffix = '/.bin';
     if (!binDir.endsWith(suffix))
@@ -284,7 +243,7 @@ async function* listPackagePaths(vfs, nodeModulesPath) {
         return;
     }
     for (const entry of entries) {
-        if (entry.type !== 'directory' || entry.name === '.bin')
+        if (entry.name === '.bin' || (await projectEntryType(vfs, nodeModulesPath, entry)) !== 'directory')
             continue;
         const path = `${nodeModulesPath}/${entry.name}`;
         if (!entry.name.startsWith('@')) {
@@ -299,7 +258,7 @@ async function* listPackagePaths(vfs, nodeModulesPath) {
             continue;
         }
         for (const scoped of scopedEntries) {
-            if (scoped.type === 'directory')
+            if ((await projectEntryType(vfs, path, scoped)) === 'directory')
                 yield `${path}/${scoped.name}`;
         }
     }

package/dist/npm/cache.d.ts

@@ -57,6 +57,12 @@ export interface EsmBundleEntry {
     esmCode: string;
     builtAt: number;
     inputHash: string;
+    /**
+     * The VFS paths the bundle was built from. The cache is the workspace's,
+     * shared by every server in it whoever started it, so a reader serves an
+     * entry only to a principal who may read every one of them.
+     */
+    sources: readonly string[];
 }
 export interface UserModuleTransformEntry {
     /** VFS path of the source module (e.g. "home/user/projects/src/App.tsx"). */

package/dist/npm/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/npm/cache.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,qBAAa,QAAQ;IACnB,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,WAAW,CAAS;gBAEhB,GAAG,EAAE,UAAU;IAM3B,YAAY,IAAI,IAAI;IA6FpB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CACwH;IAEhK,OAAO,CAAC,kBAAkB;IAkB1B;;;;;;;;mBAQe;IACf,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IA0B1E;;;;;;;;;OASG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAU1D,kDAAkD;IAClD,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAUvD,8DAA8D;IAC9D,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI;IAcjD;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IA2BtF,mFAAmF;IACnF,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,IAAI;IAsBpE;;;OAGG;IACH,oBAAoB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAS3C,0EAA0E;IAC1E,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACnC,GAAG,CAAC,EAAE,kBAAkB,GACvB,IAAI;IAmCP,wEAAwE;IACxE,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAOzC,oCAAoC;IACpC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAkBtD,sCAAsC;IACtC,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAUzC,oEAAoE;IACpE,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKxC,2DAA2D;IAC3D,eAAe,IAAI,IAAI;IAOvB;;;;;;;;OAQG;IACH,sBAAsB,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,GACrB,wBAAwB,GAAG,IAAI;IAsBlC,iFAAiF;IACjF,sBAAsB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI;IAW7D;8BAC0B;IAC1B,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAOhD,QAAQ,IAAI;QACV,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,oBAAoB,EAAE,MAAM,CAAC;KAC9B;CAaF"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/npm/cache.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,qBAAa,QAAQ;IACnB,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,WAAW,CAAS;gBAEhB,GAAG,EAAE,UAAU;IAM3B,YAAY,IAAI,IAAI;IA0GpB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CACwH;IAEhK,OAAO,CAAC,kBAAkB;IAkB1B;;;;;;;;mBAQe;IACf,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IA0B1E;;;;;;;;;OASG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAU1D,kDAAkD;IAClD,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAUvD,8DAA8D;IAC9D,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI;IAcjD;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IA2BtF,mFAAmF;IACnF,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,IAAI;IAsBpE;;;OAGG;IACH,oBAAoB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAS3C,0EAA0E;IAC1E,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACnC,GAAG,CAAC,EAAE,kBAAkB,GACvB,IAAI;IAmCP,wEAAwE;IACxE,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAOzC,oCAAoC;IACpC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAoBtD,sCAAsC;IACtC,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAUzC,oEAAoE;IACpE,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKxC,2DAA2D;IAC3D,eAAe,IAAI,IAAI;IAOvB;;;;;;;;OAQG;IACH,sBAAsB,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,GACrB,wBAAwB,GAAG,IAAI;IAsBlC,iFAAiF;IACjF,sBAAsB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI;IAW7D;8BAC0B;IAC1B,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAOhD,QAAQ,IAAI;QACV,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,oBAAoB,EAAE,MAAM,CAAC;KAC9B;CAaF"}

package/dist/npm/cache.js

@@ -83,12 +83,32 @@ export class NpmCache {
       hoisted_path TEXT NOT NULL DEFAULT '',
       PRIMARY KEY (project_path, name)
     )`);
+        // A bundle is served only to a principal who may read what it was built
+        // from, so a row that does not say is of no use: a table predating the
+        // `sources` column is dropped and recreated, and its bundles rebuild on
+        // first request, as user_module_transforms' do below.
+        let hasSourcesColumn = true;
+        try {
+            const cols = [...this.sql.exec(`PRAGMA table_info(pkg_esm_bundles)`)];
+            if (cols.length > 0)
+                hasSourcesColumn = cols.some((r) => String(r.name) === 'sources');
+        }
+        catch {
+            hasSourcesColumn = true; /* table absent — CREATE below handles it */
+        }
+        if (!hasSourcesColumn) {
+            try {
+                this.sql.exec(`DROP TABLE pkg_esm_bundles`);
+            }
+            catch { /* non-fatal */ }
+        }
         this.sql.exec(`CREATE TABLE IF NOT EXISTS pkg_esm_bundles (
       specifier   TEXT PRIMARY KEY,
       bundle_hash TEXT NOT NULL,
       esm_code    TEXT NOT NULL,
       built_at    INTEGER NOT NULL DEFAULT 0,
-      input_hash  TEXT NOT NULL DEFAULT ''
+      input_hash  TEXT NOT NULL DEFAULT '',
+      sources     TEXT NOT NULL DEFAULT '[]'
     )`);
         // A transform is keyed by (vfs_path, base): the served output bakes the
         // mount base, so one source served under two mounts is two rows. The
@@ -303,24 +323,26 @@ export class NpmCache {
     /** Get a pre-bundled ESM module. */
     getEsmBundle(specifier) {
         this.ensureSchema();
-        const rows = [...this.sql.exec(`SELECT specifier, bundle_hash, esm_code, built_at, input_hash
+        const rows = [...this.sql.exec(`SELECT specifier, bundle_hash, esm_code, built_at, input_hash, sources
        FROM pkg_esm_bundles WHERE specifier = ?`, specifier)];
         if (rows.length === 0)
             return null;
         const r = rows[0];
+        const sources = JSON.parse(String(r.sources));
         return {
             specifier: String(r.specifier),
             bundleHash: String(r.bundle_hash),
             esmCode: String(r.esm_code),
             builtAt: Number(r.built_at),
             inputHash: String(r.input_hash),
+            sources: Array.isArray(sources) ? sources.map(String) : [],
         };
     }
     /** Store a pre-bundled ESM module. */
     putEsmBundle(entry) {
         this.ensureSchema();
-        this.sql.exec(`INSERT OR REPLACE INTO pkg_esm_bundles (specifier, bundle_hash, esm_code, built_at, input_hash)
-       VALUES (?, ?, ?, ?, ?)`, entry.specifier, entry.bundleHash, entry.esmCode, entry.builtAt, entry.inputHash);
+        this.sql.exec(`INSERT OR REPLACE INTO pkg_esm_bundles (specifier, bundle_hash, esm_code, built_at, input_hash, sources)
+       VALUES (?, ?, ?, ?, ?, ?)`, entry.specifier, entry.bundleHash, entry.esmCode, entry.builtAt, entry.inputHash, JSON.stringify(entry.sources));
     }
     /** Delete a pre-bundled ESM module (e.g., after package update). */
     deleteEsmBundle(specifier) {

package/dist/npm/installer.d.ts

@@ -29,7 +29,7 @@ import type { EsbuildService } from '@nimbus-sh/core/runtime/esbuild-service.js'
 import { NpmCache } from './cache.js';
 import { type FetchFn } from './resolver.js';
 import { type NpmLogEmitter } from '@nimbus-sh/core/substrate/lifo/commands/system/npm-log.js';
-import type { BundlePoolProvider } from '../facets/esbuild-bundle-pool.js';
+import type { BundlePoolProvider } from '../facets/prebundle-pool.js';
 import type { InstallPhase } from '@nimbus-sh/platform/install-phase.js';
 export interface InstallProgress {
     phase: InstallPhase;

package/dist/npm/installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/npm/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAWH,OAAO,EAAwC,KAAK,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAC7G,OAAO,EAAa,KAAK,YAAY,EAAoB,MAAM,0CAA0C,CAAC;AAI1G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAEjF,OAAO,EAAE,QAAQ,EAAsB,MAAM,YAAY,CAAC;AAC1D,OAAO,EAEiC,KAAK,OAAO,EACnD,MAAM,eAAe,CAAC;AAKvB,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,2DAA2D,CAAC;AAUnE,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AA4DvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAEzE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAoCD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAID,qBAAa,YAAY;IACvB,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAe;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,qFAAqF;IACrF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,KAAK,CAAW;IACxB,OAAO,CAAC,OAAO,CAAwB;IACvC,mFAAmF;IACnF,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,GAAG,CAAiC;IAC5C,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,UAAU,CAAsC;IACxD;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,CAAsB;IACrC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAA2B;gBAGvC,UAAU,EAAE,YAAY,EACxB,GAAG,EAAE,UAAU,EACf,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,UAAU,CAAC,EAAE,kBAAkB,CAAC;QAChC,GAAG,CAAC,EAAE,kBAAkB,CAAC;QACzB,GAAG,CAAC,EAAE,GAAG,CAAC;QACV,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QACnC,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB;IAaH,4EAA4E;IAC5E,IAAI,QAAQ,IAAI,QAAQ,CAAuB;IAI/C;;;;;OAKG;IACG,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,CAAC,EAAE,aAAa,CAAC;QACvB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC,gBAAgB,CAAC;YAuBd,aAAa;IA0Z3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;YACW,oBAAoB;IAsYlC;;;;;;;;;;;;;;OAcG;YACW,kBAAkB;IA6NhC;;;;;;;;OAQG;YACW,cAAc;IA4D5B,wGAAwG;IACxG,OAAO,CAAC,YAAY;IAYpB,4FAA4F;YAC9E,WAAW;IAQzB;;;;;;;OAOG;YACW,mBAAmB;IA0CjC,gIAAgI;YAClH,kBAAkB;YAMlB,UAAU;IAyDxB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,eAAe;IA2BvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAgDvB;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAsB1B;;;;;OAKG;YACW,eAAe;IA0C7B,yGAAyG;YAC3F,YAAY;IAO1B;;;;;;OAMG;YACW,mBAAmB;IA6HjC,4FAA4F;IAC5F,OAAO,CAAC,kBAAkB;IAkC1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAqBrB;;;;;OAKG;YACW,QAAQ;YAwER,kBAAkB;YAgBlB,iBAAiB;IAuC/B;;;;;;;;;;OAUG;YACW,oBAAoB;IAmiBlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,eAAe;IAgFvB;;OAEG;IACH;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAsD/B,2EAA2E;IAC3E,OAAO,CAAC,kBAAkB;IAI1B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,0BAA0B;CAenC"}
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../../src/npm/installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAWH,OAAO,EAAwC,KAAK,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAC7G,OAAO,EAAa,KAAK,YAAY,EAAoB,MAAM,0CAA0C,CAAC;AAK1G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAEjF,OAAO,EAAE,QAAQ,EAAsB,MAAM,YAAY,CAAC;AAC1D,OAAO,EAEiC,KAAK,OAAO,EACnD,MAAM,eAAe,CAAC;AAKvB,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,2DAA2D,CAAC;AAUnE,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AA4DlF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAC;AAEzE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAoCD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAID,qBAAa,YAAY;IACvB,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAe;IAC1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAY;IAClC,qFAAqF;IACrF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,KAAK,CAAW;IACxB,OAAO,CAAC,OAAO,CAAwB;IACvC,mFAAmF;IACnF,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,GAAG,CAAiC;IAC5C,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,UAAU,CAAsC;IACxD;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,CAAsB;IACrC;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAA2B;gBAGvC,UAAU,EAAE,YAAY,EACxB,GAAG,EAAE,UAAU,EACf,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,cAAc,CAAC;QACzB,UAAU,CAAC,EAAE,kBAAkB,CAAC;QAChC,GAAG,CAAC,EAAE,kBAAkB,CAAC;QACzB,GAAG,CAAC,EAAE,GAAG,CAAC;QACV,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QACnC,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB;IAaH,4EAA4E;IAC5E,IAAI,QAAQ,IAAI,QAAQ,CAAuB;IAI/C;;;;;OAKG;IACG,OAAO,CACX,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE;QACJ,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,CAAC,EAAE,aAAa,CAAC;QACvB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GACA,OAAO,CAAC,gBAAgB,CAAC;YAuBd,aAAa;IA0Z3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;YACW,oBAAoB;IAsYlC;;;;;;;;;;;;;;OAcG;YACW,kBAAkB;IA6NhC;;;;;;;;OAQG;YACW,cAAc;IA4D5B,wGAAwG;IACxG,OAAO,CAAC,YAAY;IAYpB,4FAA4F;YAC9E,WAAW;IAQzB;;;;;;;OAOG;YACW,mBAAmB;IA0CjC,gIAAgI;YAClH,kBAAkB;YAMlB,UAAU;IAyDxB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,eAAe;IA2BvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAgDvB;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAsB1B;;;;;OAKG;YACW,eAAe;IA0C7B,yGAAyG;YAC3F,YAAY;IAO1B;;;;;;OAMG;YACW,mBAAmB;IA6HjC,4FAA4F;IAC5F,OAAO,CAAC,kBAAkB;IAkC1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAqBrB;;;;;OAKG;YACW,QAAQ;YAwER,kBAAkB;YAgBlB,iBAAiB;IAuC/B;;;;;;;;;;OAUG;YACW,oBAAoB;IAogBlC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,eAAe;IAgFvB;;OAEG;IACH;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAsD/B,2EAA2E;IAC3E,OAAO,CAAC,kBAAkB;IAI1B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,0BAA0B;CAenC"}

package/dist/npm/installer.js

@@ -27,6 +27,7 @@ import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
 import { engineKey } from '@nimbus-sh/core/runtime/process-files.js';
 import { npmBinMap } from '@nimbus-sh/core/runtime/npm-bin-map.js';
 import { isVfsError } from '@nimbus-sh/core/vfs/vfs-error.js';
+import { direntTypeIn } from '@nimbus-sh/core/vfs/dirent-type.js';
 import { handKernelArtifact, projectFs } from '../runtime/project-fs.js';
 import { BUNDLER_VERSION } from '@nimbus-sh/core/runtime/esbuild-service.js';
 import { NpmCache } from './cache.js';
@@ -48,7 +49,8 @@ import { estimateSupervisorHeap } from '@nimbus-sh/platform/heap-estimate.js';
 import { describeError } from '@nimbus-sh/platform/oom-classify.js';
 import { resolveOnePackumentInFacet, parseRegistryRequest, } from './resolve-one-facet.js';
 import { NPM_RESOLVE_PREAMBLE } from '../loaders/npm-resolve-preamble.js';
-import { prebundleOne, buildSliceForSpecifierWithCap, externalsForSpecifier, } from './pre-bundle-facet.js';
+import { buildSliceForSpecifierWithCap, externalsForSpecifier, } from './pre-bundle-facet.js';
+import { sliceSources } from '@nimbus-sh/core/runtime/prebundle-slice.js';
 import { CHUNK_SIZE, PRE_BUNDLE_CONCURRENCY, PRE_BUNDLE_SLICE_CAP_BYTES, } from '@nimbus-sh/platform/limits.js';
 import { acquireSupervisorAllocation } from '@nimbus-sh/platform/heavy-alloc-coord.js';
 import { countPackageFiles, BARREL_PKG_FILE_THRESHOLD, packageNameFromSpecifier } from '@nimbus-sh/core/runtime/barrel-detect.js';
@@ -1863,11 +1865,9 @@ export class NpmInstaller {
      * JSX elements get rejected as "alien" — silent render failure.
      */
     async prebundleUsedModules(projDir, installed, fs) {
-        // Pre-bundle now runs in IsolatePool isolates (src/pre-bundle-facet.ts);
-        // each facet ships its own bundled esbuild-wasm via the preamble. The
-        // supervisor's EsbuildService is no longer on the bundle path — it
-        // still serves the transform path (TS/JSX → JS) which is small and
-        // fits in the supervisor's heap.
+        // Pre-bundle runs in the session's build facet (facets/prebundle-pool.ts),
+        // from slices the supervisor walks (npm/pre-bundle-facet.ts); the
+        // supervisor never holds a bundler.
         //
         // We gate on this.esbuild presence purely as a feature flag: a caller
         // that constructs the installer without esbuild (e.g. minimal
@@ -2064,33 +2064,11 @@ export class NpmInstaller {
         //     lucide-react is barrel-skipped at af8de12 and the cap
         //     mostly applies to non-barrel large packages.)
         //
-        // esbuild's WASM linear memory is per-FACET (~30–80 MiB) and lives
-        // outside the supervisor. Per-slot try/catch handles failures —
-        // /preview/@modules/ on-demand bundling recovers.
-        // The esbuild-wasm bytes ride in the session's shared bundle pool
-        // (facets/esbuild-bundle-pool.ts), constructed once per session and
-        // disposed with the installer and dev server — not per pre-bundle
-        // phase — so the supervisor retains one copy, leased once from the
-        // shared allocation budget. See src/esbuild-wasm-bytes.ts for why
-        // the bytes are never cached supervisor-side beyond that.
-        //
-        // Bytes are shipped into each facet via IsolatePool's
-        // `wasmModules` option which workerd registers in the LOADER
-        // `modules` map as `{ wasm: ArrayBuffer }`. Workerd compiles at
-        // module-load (startup phase, where wasm code generation is
-        // permitted), and the pool's generated worker.js exposes the
-        // resulting WebAssembly.Module on globalThis.__NIMBUS_WASM
-        // for the user fn (prebundleOne) to read at request time.
-        //
-        // Why this works when previous attempts didn't:
-        //   - inlining bytes in preamble: 16 MiB per dispatch OOM'd
-        //     supervisor (commit dead0e3 fixed by removing it)
-        //   - WebAssembly.compile at request time: blocked by workerd
-        //     ("Wasm code generation disallowed by embedder")
-        //   - RPC of pre-compiled WebAssembly.Module: structured-clone
-        //     refuses ("Unable to deserialize cloned data")
-        //   - LOADER modules-map: bytes ride INSIDE the worker code blob
-        //     before workerd compiles it; bypasses all three failure modes.
+        // The bundler's wasm memory lives in the session's build facet
+        // (facets/prebundle-pool.ts → build-facet.ts `prebundle`), outside the
+        // supervisor; its staged parts load into the facet's module map once
+        // per isolate, so the supervisor keeps no copy. Per-spec try/catch
+        // handles failures — /preview/@modules/ on-demand bundling recovers.
         //
         // Defensive logger: onProgress is user-supplied and can throw
         // (downstream WS write, JSON.stringify on a circular value, etc.).
@@ -2110,9 +2088,9 @@ export class NpmInstaller {
                 catch { }
             }
         };
-        // Acquired BEFORE any per-slice lease below: first construction
-        // reserves the full supervisor budget while the wasm bytes are
-        // fetched, so a slice lease taken first would wait on itself.
+        // Acquired BEFORE any slice is built: acquiring loads the build facet,
+        // whose staged parts pass through the supervisor once, so they are
+        // gone again before a slice lease is held beside them.
         let pool;
         try {
             pool = await this.bundlePool.acquire();
@@ -2149,9 +2127,8 @@ export class NpmInstaller {
                     attempted++;
                     // Build slice for THIS spec only. Released by explicit nulling
                     // at the end of every code path through this iteration so the
-                    // bytes are GC-eligible before pool.submit's RPC layer has
-                    // finished tearing down its own references for the previous
-                    // slot. With concurrency=1 and 28 MiB caps, peak supervisor
+                    // bytes are GC-eligible before the RPC layer has finished
+                    // tearing down its own references for the previous spec. With concurrency=1 and 28 MiB caps, peak supervisor
                     // slice memory is ~34 MiB (slice + spec metadata).
                     //
                     // Defensive: buildSliceForSpecifierWithCap performs sync VFS
@@ -2221,6 +2198,9 @@ export class NpmInstaller {
                         errorsByModule[next.specifier] = msg;
                         continue;
                     }
+                    // What the bundle can have read, recorded with it: the cache is
+                    // shared, and a server serves it only to a principal who may read it all.
+                    const sources = sliceSources(slice.slice);
                     let spec = {
                         specifier: next.specifier,
                         entryPath: next.entryPath,
@@ -2234,12 +2214,7 @@ export class NpmInstaller {
                     slice = null;
                     let result = null;
                     try {
-                        // pool.submit is per-task (no auto slot pinning). All slots
-                        // share slot index 0 in the underlying #dispatchSlot — that's
-                        // fine for our use (we don't need stable warm slots beyond
-                        // "esbuild compiled once per slot's lifetime"; for pre-bundle
-                        // the slot HAS to compile esbuild on first call regardless).
-                        result = await pool.submit(prebundleOne, spec);
+                        result = await pool.prebundle(spec);
                     }
                     catch (e) {
                         const msg = describeError(e);
@@ -2250,11 +2225,9 @@ export class NpmInstaller {
                     finally {
                         // Drop the spec reference (which transitively held slice.slice)
                         // immediately after the RPC settles, regardless of outcome.
-                        // pool.submit's facet-pool fix (timer leak) ensures the rejected
-                        // promise's `args` aren't pinned by a 60s timer; this finally
-                        // releases our supervisor-side handle the moment the await
-                        // resolves so the next iteration starts from a low-water-mark
-                        // heap. Combined defense — see commit msg.
+                        // This finally releases our supervisor-side handle the moment
+                        // the await resolves so the next iteration starts from a
+                        // low-water-mark heap.
                         spec = null;
                     }
                     if (!result || !result.ok) {
@@ -2287,6 +2260,7 @@ export class NpmInstaller {
                             esmCode: result.esmCode,
                             builtAt: Date.now(),
                             inputHash: next.inputHash ?? '',
+                            sources,
                         });
                         okCount++;
                     }
@@ -2309,7 +2283,7 @@ export class NpmInstaller {
         try {
             // Promise.all rejects on the first slot rejection. Every per-slot
             // failure mode that can throw inside runSlot is caught above
-            // (slice walk, externals, pool.submit, putEsmBundle) — but a
+            // (slice walk, externals, pool.prebundle, putEsmBundle) — but a
             // future regression that adds an unguarded throw to runSlot
             // would bubble out here. The outer try/finally guarantees the
             // diag counters get updated for whatever partial run completed;
@@ -2621,7 +2595,7 @@ async function nodeModulesNames(view, dir) {
     for (const entry of await view.readdir(dir)) {
         if (entry.name.startsWith(COPY_PREFIX))
             continue;
-        if (entry.type !== 'directory' || !entry.name.startsWith('@')) {
+        if (!entry.name.startsWith('@') || (await direntTypeIn(view, dir, entry)) !== 'directory') {
             names.push(entry.name);
             continue;
         }