@nimbus-sh/worker 0.12.0 → 0.13.1

package/dist/runtime/node-shims.js

@@ -43,11 +43,12 @@ import { generateSqliteShimCode } from './sqlite-shim.js';
 import { DECODE_JAVASCRIPT_STRING_LITERAL_SOURCE } from './javascript-string-literal.js';
 import { generateUndiciShimCode } from '@nimbus-sh/core/runtime/undici-shim.js';
 import { getExportsResolverJS } from '@nimbus-sh/core/_shared/exports-resolver.js';
-import { ESM_RESOLVER_PREAMBLE } from '../loaders/generated-workers.js';
+import { ESM_RESOLVER_PREAMBLE, HTTP2_MODULE_PREAMBLE } from '../loaders/generated-workers.js';
 import { getTypescriptSpecifiersJS } from '@nimbus-sh/core/_shared/typescript-specifiers.js';
 import { NIMBUS_AI_CREDENTIAL_HEADERS, NIMBUS_AI_TOKEN_ENV } from '@nimbus-sh/core/_shared/ai-egress.js';
 import { MAX_RPC_SAFE_PAYLOAD_BYTES } from '@nimbus-sh/platform/limits.js';
 import { ERRNO_DESCRIPTION } from '@nimbus-sh/core/vfs/vfs-error.js';
+import { DIRENT_TYPES } from '@nimbus-sh/core/vfs/dirent-type.js';
 import { STDIN_SYNC_READ_BYTES } from '@nimbus-sh/core/runtime/stdin-read.js';
 import { FACET_PROVIDED_PACKAGES, FS_READ_BATCH_PATH_LIMIT, FS_READ_BATCH_REQUEST_BYTES, NIMBUS_AI_GATEWAY_PORT, NODE_VERSION, NODE_VERSIONS, VFS_CAPACITY, } from '@nimbus-sh/core/constants.js';
 import { PACKAGE_ABI_POLICY } from '../facets/wasm-swap-registry.js';
@@ -973,7 +974,7 @@ const __fsMod = (() => {
       const real = __nsResolve(own && own.alias !== undefined ? own.alias : k, true);
       if (real && real !== "ELOOP") {
         for (const child of __nsChildren(real.path)) {
-          names.set(child.name, child.kind === 1 ? "directory" : child.kind === 2 ? "symlink" : "file");
+          names.set(child.name, child.kind === 1 ? "directory" : child.kind === 2 ? "symlink" : _direntTypeOfMode(child.mode, "file"));
         }
       }
     }
@@ -1048,8 +1049,9 @@ const __fsMod = (() => {
   function _noteCreation(k) {
     if (_createdHere.has(k)) return;
     const absPath = "/" + k;
-    // Known absent: the namespace names everything this credential can see.
-    if (_statLadder(absPath) !== undefined) return;
+    // Known absent: the namespace names everything this credential can see,
+    // except on a mount where the launch did not list it, which is unknown.
+    if (_statLadder(absPath) !== undefined || _nsUnlisted(absPath, true, false) !== null) return;
     _createdHere.add(k);
   }
   function _forgetCreation(k) {
@@ -2685,24 +2687,37 @@ const __fsMod = (() => {
     return stat;
   }
 
+  // Each exact dirent type's S_IFMT bits and Node predicate (core's vfs/dirent-type.ts).
+  const _direntTypes = ${JSON.stringify(DIRENT_TYPES)};
+  /** The dirent type a mode's format bits name, or \`fallback\` where they name none. */
+  function _direntTypeOfMode(mode, fallback) {
+    const format = Number(mode) & 0o170000;
+    for (const type in _direntTypes) if (_direntTypes[type].format === format) return type;
+    return fallback;
+  }
+  /** The dirent type an lstat says, for an entry the listing could not type ('unknown'). */
+  function _direntTypeOfStats(st) {
+    return _direntTypeOfMode(st.mode, st.isDirectory() ? "directory" : st.isSymbolicLink() ? "symlink" : "file");
+  }
+
   // The one Dirent shape: readdir({ withFileTypes }) sync and async, and
-  // every Dir.read(). \`parentPath\` is Node's field; \`path\` its deprecated
+  // every Dir.read(), for an entry whose type is known (an 'unknown' one is
+  // lstat'ed first). \`parentPath\` is Node's field; \`path\` its deprecated
   // alias that older callers still read.
   class __Dirent {
     constructor(name, type, parentPath) {
       this.name = name;
       this.parentPath = parentPath === undefined ? "" : String(parentPath);
       this.path = this.parentPath;
-      this._isDir = type === "directory" || type === "dir";
-      this._isSymlink = type === "symlink";
+      this._holds = _direntTypes[type === "dir" ? "directory" : type]?.node;
     }
-    isFile() { return !this._isDir && !this._isSymlink; }
-    isDirectory() { return this._isDir; }
-    isSymbolicLink() { return this._isSymlink; }
-    isBlockDevice() { return false; }
-    isCharacterDevice() { return false; }
-    isFIFO() { return false; }
-    isSocket() { return false; }
+    isFile() { return this._holds === "isFile"; }
+    isDirectory() { return this._holds === "isDirectory"; }
+    isSymbolicLink() { return this._holds === "isSymbolicLink"; }
+    isBlockDevice() { return this._holds === "isBlockDevice"; }
+    isCharacterDevice() { return this._holds === "isCharacterDevice"; }
+    isFIFO() { return this._holds === "isFIFO"; }
+    isSocket() { return this._holds === "isSocket"; }
   }
   function _direntObject(name, type, parentPath) { return new __Dirent(name, type, parentPath); }
 
@@ -3105,8 +3120,11 @@ const __fsMod = (() => {
         // listing does not. So it is asked for, never assumed (one lstat per
         // child directory, concurrently).
         if (opts?.withFileTypes) {
+          const base = absPath === "/" ? "" : absPath;
+          const types = await Promise.all(entries.map(async (entry) =>
+            entry.type === "unknown" ? _direntTypeOfStats(await _lstatAsync(base + "/" + entry.name)) : entry.type));
           return entries
-            .map((entry) => _direntObject(entry.name, entry.type, absPath))
+            .map((entry, i) => _direntObject(entry.name, types[i], absPath))
             .sort((a, b) => a.name.localeCompare(b.name));
         }
         return entries.map((entry) => entry.name).sort();
@@ -3152,8 +3170,12 @@ const __fsMod = (() => {
 
   async function _writeFileAsync(p, data, opts) {
     const absPath = _resolveFollow(p, "open");
-    writeFileSync(p, data, opts);
     const supervisor = _supervisor();
+    // A target this view cannot judge (on a mount, where the launch did not
+    // list it) is the authority's to answer for, as the async rename's
+    // destination is: parked and written back like any other write, and
+    // refused (and the parked bytes dropped) if the authority refuses it.
+    _parkWholeWrite(p, data, supervisor && typeof supervisor.writeFile === "function");
     if (supervisor && typeof supervisor.writeFile === "function") {
       await _announceLocalDirs(absPath, supervisor);
       // The revision comes back so the ledger can stamp the cell: an async
@@ -3574,8 +3596,17 @@ const __fsMod = (() => {
   // (the hot path for source code / package.json / user JS).
   // Anything else is stringified (Node's behaviour for e.g. numbers).
   function writeFileSync(p, data, opts) {
+    _parkWholeWrite(p, data, false);
+  }
+
+  /**
+   * A whole-file write's local effect: the bytes parked for write-back.
+   * \`live\`: the async form, whose write-back the authority answers for a
+   * target this view cannot judge (_ensureWritable).
+   */
+  function _parkWholeWrite(p, data, live) {
     const absPath = _resolveFollow(p, "open");
-    _ensureWritable(absPath, "open", p);
+    _ensureWritable(absPath, "open", p, live);
     const k = _strip(absPath);
     let cell;
     if (data instanceof Uint8Array) cell = data;
@@ -6219,31 +6250,20 @@ const __cryptoMod = (() => {
 // execution does not.  Documented in W3 retro for W3.5 follow-up
 // (a parser-based vm fallback, or pre-bundle vm-using scripts at
 // install time).
-// ── Runtime code: the async and generator Function constructors ──
+// ── Runtime code: the Function constructors ──
 //
 // A Worker generates code from strings only while its modules evaluate: at
 // request time — where every program runs — \`new Function(...)\` and its async
 // and generator siblings throw EvalError "Code generation from strings
-// disallowed for this context". The async and generator constructors here ask
-// the native one first and, refused that way, hand the arguments to the
-// launch's runtime-code service (core/_shared/commonjs-cell.ts, RUNTIME CODE),
-// which answers from this launch's module map or records the text for the next
-// launch of the command and throws EvalError code ERR_NIMBUS_CODE_NEXT_LAUNCH.
-// That is the constructor a module runner evaluates with (Vite's SSR runner:
-// \`new AsyncFunction(...)\`), reached as each kind's \`prototype.constructor\`,
-// which is how \`(async function () {}).constructor\` finds it. A facet without
-// the service (opencode's) keeps the native refusal.
-//
-// The plain \`Function\` constructor is routed differently, on evidence: code
-// probes it once and keeps the answer. TypeBox's CanEvaluate (pi 0.87.1) tries
-// \`Function("null")\`, remembers whether it worked, and then compiles every
-// schema check with \`Function\`; staging every text, the next launch staged the
-// probe's text but not the checks' — the probe said yes, the first check threw,
-// and pi's TUI died. So it answers only text an earlier launch staged, keeps
-// the native refusal otherwise, and stages a refused text only when a failed
-// launch is attributable to it (the service's plainFunction, noteFailure and
-// stageFailedLaunch): a probe answers the same in every launch, while depd's
-// wrapper (express 4) and ajv's validators (serve) run from the next launch on.
+// disallowed for this context". Each constructor here asks the native one
+// first and, refused that way, hands the arguments to the launch's
+// runtime-code service (core/_shared/commonjs-cell.ts, RUNTIME CODE), which
+// answers from this launch's module map when an earlier launch staged the
+// text, and otherwise records it for the next launch and runs it in the
+// interpreter. That is the constructor a module runner evaluates with
+// (Vite's SSR runner: \`new AsyncFunction(...)\`), reached as each kind's
+// \`prototype.constructor\`, which is how \`(async function () {}).constructor\`
+// finds it. A facet without the service (opencode's) keeps the native refusal.
 function __nimbusIsCodegenRefusal(e) {
   return e instanceof EvalError && /Code generation from strings disallowed/.test(String(e.message));
 }
@@ -6318,15 +6338,20 @@ const __nimbusDecodeStringLiteral = ${DECODE_JAVASCRIPT_STRING_LITERAL_SOURCE};
     if (Native.__nimbusNative) continue;
     const routed = function (...args) {
       try {
-        return Reflect.apply(Native, undefined, args);
+        return new.target === undefined ? Reflect.apply(Native, undefined, args) : Reflect.construct(Native, args, new.target);
       } catch (e) {
         const service = globalThis.__nimbusRuntimeCode;
         if (!__nimbusIsCodegenRefusal(e) || !service) throw e;
         const params = args.slice(0, -1).map(String);
         const body = args.length > 0 ? String(args[args.length - 1]) : "";
-        if (kind === "function") return service.plainFunction(params, body, e);
         try {
-          return service.compileFunction(kind, params, body);
+          const fn = service.compileFunction(kind, params, body);
+          // A subclass's \`new\` (\`class F extends Function\`) makes an instance of the subclass.
+          if (new.target !== undefined && new.target !== routed) {
+            const proto = new.target.prototype;
+            if (proto !== null && (typeof proto === "object" || typeof proto === "function")) Object.setPrototypeOf(fn, proto);
+          }
+          return fn;
         } catch (refusal) {
           const importAt = params.indexOf("__vite_ssr_import__");
           if (kind !== "async" || importAt < 0 || !refusal || refusal.code !== "ERR_NIMBUS_CODE_NEXT_LAUNCH") throw refusal;
@@ -6359,6 +6384,11 @@ const __nimbusDecodeStringLiteral = ${DECODE_JAVASCRIPT_STRING_LITERAL_SOURCE};
 
 const __vmMod = (() => {
   const real = (typeof __real_vm !== 'undefined') ? (__real_vm.default ?? __real_vm) : null;
+  // What a script's function is called with, as the launch starts: the
+  // program may later replace Reflect.apply or the globalThis property, and
+  // native vm consults neither.
+  const apply = Reflect.apply;
+  const scriptThis = globalThis;
   function honestError(method, originalErr) {
     const e = new Error(
       'vm.' + method + ': workerd does not implement runtime eval. ' +
@@ -6395,12 +6425,16 @@ const __vmMod = (() => {
     isContext: real?.isContext ?? ((o) => !!o),
     runInContext: wrapRuntimeEval('runInContext'),
     runInNewContext: wrapRuntimeEval('runInNewContext'),
-    // jiti evaluates a parenthesized (async) CommonJS wrapper expression.
-    // Stage that expression as a zero-argument function returning its value;
-    // the wrapper itself executes only when the caller invokes it. This is
-    // not a vm context or a global-script evaluator: declarations/completion
-    // values spanning statements, execution deadlines and context mutation
-    // have no equivalent here and remain unsupported.
+    // jiti evaluates a parenthesized (async) CommonJS wrapper expression
+    // statement, \`(function (exports, require, ...) { ... });\`. The service
+    // stages a script that is one expression as a zero-argument function
+    // returning its value (the script's completion value); the wrapper
+    // itself executes only when the caller invokes it. The function is
+    // called with the global object as \`this\`, which is a script's
+    // \`this\` at its top level, strict or not. This is not a vm
+    // context or a global-script evaluator: declarations/completion values
+    // spanning statements, execution deadlines and context mutation have no
+    // equivalent here and remain unsupported.
     runInThisContext: (code, options = {}) => {
       try { return wrapRuntimeEval('runInThisContext')(code, options); }
       catch (e) {
@@ -6408,7 +6442,7 @@ const __vmMod = (() => {
         if (e?.code !== 'ERR_VM_DYNAMIC_EVAL_DISALLOWED' || !service
           || options?.timeout !== undefined || options?.breakOnSigint
           || options?.importModuleDynamically || options?.cachedData) throw e;
-        return service.compileFunction("function", [], "return (\\n" + String(code) + "\\n);")();
+        return apply(service.compileExpression(String(code)), scriptThis, []);
       }
     },
     // A function of \`params\` and \`code\` is what the Function constructor
@@ -6434,45 +6468,27 @@ const __vmMod = (() => {
 })();
 
 // ═══════════════════════════════════════════════════════════════════════
-// ──  http2 module (W3: stub — non-throwing load, honest connect err) ─
+// ──  http2 module: Node's exports, no HTTP/2 transport ──────────────
 // ═══════════════════════════════════════════════════════════════════════
 //
 // axios's dist/node code does \`var http2 = require('http2')\` at top
-// level, unconditionally. Without this stub the require fails →
-// axios fails to load. The actual HTTP/2 transport is only invoked
-// when user opts in (\`httpVersion: 2\`); otherwise this shim is dormant.
-const __http2Mod = (() => {
-  function _err(op) {
-    const e = new Error('http2.' + op + ': not implemented in Nimbus. Use fetch() or HTTP/1.1.');
-    e.code = 'ERR_HTTP2_NOT_SUPPORTED';
-    return e;
-  }
-  class Http2Session extends __eventsMod {
-    constructor() { super(); this.destroyed = false; }
-    request() { throw _err('request'); }
-    close() { this.destroyed = true; this.emit('close'); }
-    destroy(err) { this.destroyed = true; if (err) this.emit('error', err); this.emit('close'); }
-    settings() {}
-  }
-  function connect(/* authority, opts, listener */) {
-    const session = new Http2Session();
-    queueMicrotask(() => session.emit('error', _err('connect')));
-    return session;
-  }
-  function createServer() { throw _err('createServer'); }
-  return {
-    connect, createServer,
-    createSecureServer: createServer,
-    Http2Session,
-    constants: {
-      NGHTTP2_NO_ERROR: 0, NGHTTP2_PROTOCOL_ERROR: 1,
-      HTTP2_HEADER_PATH: ':path', HTTP2_HEADER_METHOD: ':method',
-      HTTP2_HEADER_STATUS: ':status', HTTP2_HEADER_AUTHORITY: ':authority',
-      HTTP2_HEADER_SCHEME: ':scheme',
-    },
-    sensitiveHeaders: Symbol('nodejs.http2.sensitiveHeaders'),
-  };
-})();
+// level, unconditionally, and Astro's dev server asks
+// \`res instanceof Http2ServerResponse\` of every response: the module
+// loads with every name Node's has, and only opening HTTP/2 refuses.
+// core/_shared/http2-module.ts, compiled once by
+// scripts/bundle-facet-workers.mjs, declares createHttp2Module; the
+// substrate's node-compat imports the same function.
+${HTTP2_MODULE_PREAMBLE}
+const __http2Mod = createHttp2Module({
+  EventEmitter: __eventsMod,
+  Readable: __streamMod.Readable,
+  Stream: __streamMod,
+  Buffer: __BufferMod,
+  emitWarning: (message) => {
+    const proc = globalThis.process;
+    if (proc && typeof proc.emitWarning === "function") proc.emitWarning(message);
+  },
+});
 
 // ═══════════════════════════════════════════════════════════════════════
 // ──  repl module (W3: forward to workerd) ───────────────────────────
@@ -8145,7 +8161,6 @@ function __nimbusFailUnhandledAsync(error, kind) {
     __nimbusReportProcessExit(error.code, "");
     return;
   }
-  if (globalThis.__nimbusRuntimeCode) globalThis.__nimbusRuntimeCode.noteFailure(error);
   const label = kind === "rejection"
     ? "Unhandled promise rejection: "
     : "Uncaught exception: ";
@@ -9122,6 +9137,9 @@ builtins.undici = __undiciMod;
 // ──  require() — full Node.js module resolution ─────────────────────
 // ═══════════════════════════════════════════════════════════════════════
 const __moduleCache = new Map();
+// A module cell's evaluation when it completes later (top-level await), by
+// its evaluation key: what an import of it waits for.
+const __moduleEvaluations = new Map();
 // package → why the package ABI policy says it cannot run here (wasm-swap-registry.ts).
 const __nimbusAbiAdvisories = new Map(${ABI_ADVISORIES_LITERAL});
 
@@ -9507,6 +9525,22 @@ function __makeLoadingExports(mod) {
  * Nothing here compiles source: request-time code generation is not
  * available in a Worker, so a file the launch did not map cannot run.
  */
+// import.meta of the module file at \`filename\`, evaluated as \`url\`: an
+// entry script's or a loaded module's. It lives on the module, not in source
+// text, so the five CommonJS arguments stay as they are, and
+// import.meta.resolve keeps its parent even when extracted and called later.
+// The registry's own import.meta cannot serve: its module URLs all live
+// under file:///bundle/, never at the file's own path. dirname and filename
+// name the file, without the URL's query or fragment.
+function __nimbusFileImportMeta(filename, url = builtins.url.pathToFileURL(filename).href) {
+  return Object.assign(Object.create(null), {
+    dirname: __pathMod.dirname(filename),
+    filename,
+    url,
+    resolve: (specifier) => globalThis.__nimbusImportMetaResolve(specifier, url),
+  });
+}
+
 function __loadModule(resolvedPath, evaluationKey = resolvedPath) {
   if (globalThis.__nimbusProfileStaged) globalThis.__nimbusProfileStaged.delete(String(resolvedPath).replace(/^\\/+/, ""));
   if (__moduleCache.has(evaluationKey)) return __moduleCache.get(evaluationKey);
@@ -9544,19 +9578,7 @@ function __loadModule(resolvedPath, evaluationKey = resolvedPath) {
   globalThis.__currentModulePath = resolvedPath;
   const moduleUrl = evaluationKey.startsWith("file:")
     ? evaluationKey : builtins.url.pathToFileURL("/" + resolvedPath).href;
-  // Evaluation metadata lives on the module, not in source text. Keeping
-  // it here preserves the five CommonJS arguments and captures the parent
-  // even when import.meta.resolve is extracted and called later. The
-  // registry's own import.meta cannot serve: its module URLs all live under
-  // file:///bundle/, never at the file's own path.
-  // dirname and filename name the file, without the URL's query or fragment.
-  const importMeta = Object.assign(Object.create(null), {
-    dirname: __pathMod.dirname("/" + resolvedPath),
-    filename: "/" + resolvedPath,
-    url: moduleUrl,
-    resolve: (specifier) => globalThis.__nimbusImportMetaResolve(specifier, moduleUrl),
-  });
-  Object.defineProperty(mod, "__nimbusImportMeta", { value: importMeta });
+  Object.defineProperty(mod, "__nimbusImportMeta", { value: __nimbusFileImportMeta("/" + resolvedPath, moduleUrl) });
   try {
     const normalizedPath = resolvedPath.replace(/^\\/+/, "");
     let cell = __nimbusModuleCell(normalizedPath);
@@ -9574,7 +9596,11 @@ function __loadModule(resolvedPath, evaluationKey = resolvedPath) {
       cell = __nimbusRuntimeModule(normalizedPath, text);
       globalThis.__nimbusModuleMisses.delete(normalizedPath);
     }
-    cell(mod.exports, scopedRequire, mod, "/" + resolvedPath, "/" + modDir);
+    const evaluation = cell(mod.exports, scopedRequire, mod, "/" + resolvedPath, "/" + modDir);
+    // A module with top-level await completes later. require() returns its
+    // exports now (static imports lowered to require cannot wait); import()
+    // waits for it (__esmLoad).
+    if (evaluation && typeof evaluation.then === "function") __moduleEvaluations.set(evaluationKey, evaluation);
   } catch (e) {
     __moduleCache.delete(evaluationKey);
     if (e && typeof e === "object" && !e.__nimbusModulePath) {
@@ -9766,21 +9792,31 @@ function __esmLoad(resolution) {
     // Canonical queryless ESM shares evaluation with require() and static
     // imports lowered to require(). Queries/fragments are distinct jobs.
     const variant = esm && (resolution.url.includes("?") || resolution.url.includes("#"));
-    const exports = __loadModule(key, variant ? resolution.url : key);
-    if (resolution.format === "json") {
-      ns = __esmNamespaceOf(["default"], () => exports);
-    } else if (esm) {
-      // The ESM→CJS transform's exports: the module's own names, live.
-      const names = exports && typeof exports === "object" ? Object.keys(exports).filter((name) => name !== "__esModule") : [];
-      ns = __esmNamespaceOf(names, (name) => exports[name]);
-    } else {
+    const evaluationKey = variant ? resolution.url : key;
+    const exports = __loadModule(key, evaluationKey);
+    const namespace = () => {
+      if (resolution.format === "json") return __esmNamespaceOf(["default"], () => exports);
+      if (esm) {
+        // The ESM→CJS transform's exports: the module's own names, live.
+        const names = exports && typeof exports === "object" ? Object.keys(exports).filter((name) => name !== "__esModule") : [];
+        return __esmNamespaceOf(names, (name) => exports[name]);
+      }
       // CommonJS: module.exports is the default, its names the named exports.
       const mod = exports;
       const names = new Set(mod && (typeof mod === "object" || typeof mod === "function") ? Object.keys(mod) : []);
       names.delete("default");
       names.add("default");
-      ns = __esmNamespaceOf(names, (name) => name === "default" ? mod : mod[name]);
-    }
+      return __esmNamespaceOf(names, (name) => name === "default" ? mod : mod[name]);
+    };
+    // A module with top-level await: the import resolves once its evaluation
+    // completes, and rejects with what it throws.
+    const evaluation = __moduleEvaluations.get(evaluationKey);
+    if (evaluation !== undefined) {
+      const pending = evaluation.then(namespace, (error) => { __esmNamespaces.delete(resolution.url); throw error; });
+      __esmNamespaces.set(resolution.url, pending);
+      return pending;
+    }
+    ns = namespace();
   }
   __esmNamespaces.set(resolution.url, ns);
   return ns;

package/dist/runtime/opencode-facet-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"opencode-facet-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/opencode-facet-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAgBjE,wDAAwD;AACxD,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAwIzE;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAUrG;AAkCD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAsBpC,CAAC;AAqBF,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAElE,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,oBAAoB,CAAC;AAE1D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAevC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAmOjC,CAAC;AA2BF;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CAuuB9E"}
+{"version":3,"file":"opencode-facet-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/opencode-facet-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAMH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAgBjE,wDAAwD;AACxD,eAAO,MAAM,2BAA2B,uBAAuB,CAAC;AAGhE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,gBAAgB,CAAC;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,8BAA8B,CAAC;AAwIzE;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAUrG;AAkCD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,OAAO,EAAE,gBAAgB,CAAC;IAC1B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAsBpC,CAAC;AAqBF,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAElE,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,oBAAoB,CAAC;AAE1D;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAevC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAmOjC,CAAC;AA2BF;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,qBAAqB,GAAG,MAAM,CA0uB9E"}

package/dist/runtime/opencode-facet-runner.js

@@ -37,6 +37,7 @@
  */
 import { generateSqliteFacetPreamble } from './sqlite-shim.js';
 import { VFS_CURSOR_SEED_SOURCE } from '@nimbus-sh/core/_shared/facet-vfs-cursor.js';
+import { SUPERVISOR_ANSWERING_SRC } from '@nimbus-sh/core/runtime/supervisor-answering.generated.js';
 import { getRealNodeSharedImportsCode } from '@nimbus-sh/core/_shared/real-node-imports.js';
 import { ONE_SHOT_STORE_MEMORY_BYTES } from '../vfs/facet-resident-limits.js';
 import { OPENTUI_BACKEND_FACET_SRC, OPENTUI_BACKEND_GLOBAL, OPENTUI_WASM_MODULE_NAME, generateOpenTUIBackendBootCode, } from './opentui-facet-backend.js';
@@ -688,6 +689,9 @@ let stdout = "";
 let stderr = "";
 let exitCode = 0;
 let __supervisor = null;
+// The SUPERVISOR binding's filesystem calls answer a refusal as a value
+// (core vfs-supervisor.ts answeringSupervisor).
+${SUPERVISOR_ANSWERING_SRC}
 // The process's view of the filesystem: the same store and namespace a node
 // process boots on (vfs/facet-resident-store.ts), in this facet's heap and
 // bounded there. An opencode facet has no storage allowance of the session's
@@ -1198,7 +1202,7 @@ async function __ocBootStore() {
 
 export class NimbusProcess extends __NimbusDurableObject {
   async startProcess() {
-    __supervisor = (this.env && this.env.SUPERVISOR) || null;
+    __supervisor = this.env && this.env.SUPERVISOR ? globalThis.__nimbusAnsweringSupervisor(this.env.SUPERVISOR) : null;
     const __bootFailure = await __ocBootStore();
     if (__bootFailure) throw new Error(__bootFailure);
     // Run the resident lifecycle and hold THIS RPC open until it exits — the
@@ -1282,7 +1286,7 @@ async function __ocRunServe() {
 }
 
 async function __ocOneShotFetch(request, workerEnv) {
-    __supervisor = (workerEnv && workerEnv.SUPERVISOR) || null;
+    __supervisor = workerEnv && workerEnv.SUPERVISOR ? globalThis.__nimbusAnsweringSupervisor(workerEnv.SUPERVISOR) : null;
     const __bootFailure = await __ocBootStore();
     if (__bootFailure) {
       return __ocHostResponse.json({ exitCode: 1, stdout: "", stderr: __bootFailure + "\\n" });

package/dist/runtime/oxc-wasm-bytes.d.ts

@@ -0,0 +1,19 @@
+/**
+ * oxc-wasm-bytes.ts — supervisor-side fetcher for what the transform facet is
+ * built from: the Oxc wasm (scripts/bundle-oxc-wasm.mjs) and the facet's
+ * runtime script (scripts/bundle-facet-workers.mjs). Both are staged in the
+ * static-assets layer under names carrying a prefix of their digest, read
+ * through the colo cache (runtime/staged-source.ts), and verified against
+ * their pins before the loader compiles or evaluates them.
+ *
+ * Neither is kept in module scope: they are read only when the facet's
+ * loader has no worker cached under the facet's id, and that loader holds
+ * the only long-lived copy, as compiled code. The host Worker never compiles
+ * the wasm.
+ */
+import { type StagedSourceEnv } from './staged-source.js';
+/** The Oxc wasm's bytes, for the transform facet's module map. */
+export declare function fetchOxcWasmBytes(env: StagedSourceEnv): Promise<ArrayBuffer>;
+/** The transform facet's runtime: a script that installs the globals its class reads. */
+export declare function fetchOxcFacetRuntime(env: StagedSourceEnv): Promise<string>;
+//# sourceMappingURL=oxc-wasm-bytes.d.ts.map

package/dist/runtime/oxc-wasm-bytes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxc-wasm-bytes.d.ts","sourceRoot":"","sources":["../../src/runtime/oxc-wasm-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAuD,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAuB/G,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAE5E;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1E"}

package/dist/runtime/oxc-wasm-bytes.js

@@ -0,0 +1,39 @@
+/**
+ * oxc-wasm-bytes.ts — supervisor-side fetcher for what the transform facet is
+ * built from: the Oxc wasm (scripts/bundle-oxc-wasm.mjs) and the facet's
+ * runtime script (scripts/bundle-facet-workers.mjs). Both are staged in the
+ * static-assets layer under names carrying a prefix of their digest, read
+ * through the colo cache (runtime/staged-source.ts), and verified against
+ * their pins before the loader compiles or evaluates them.
+ *
+ * Neither is kept in module scope: they are read only when the facet's
+ * loader has no worker cached under the facet's id, and that loader holds
+ * the only long-lived copy, as compiled code. The host Worker never compiles
+ * the wasm.
+ */
+import { OXC_WASM_ASSET_PATH, OXC_WASM_SHA256 } from '../oxc-wasm-artifact.generated.js';
+import { OXC_FACET_ASSET_PATH, OXC_FACET_SHA256 } from '../oxc-facet-artifact.generated.js';
+import { fetchStagedBytes, fetchStagedText } from './staged-source.js';
+function oxcAsset(label, path, sha256, contentType, stagedBy) {
+    return {
+        path,
+        l2Key: `https://nimbus-cache.invalid${path}`,
+        sha256,
+        contentType,
+        poisonedCache: 'reject',
+        missingBinding: `Nimbus: the transform facet requires an env.ASSETS binding (serves ${path})`,
+        fetchFailed: (res) => `${label} asset fetch failed: ${res.status} ${res.statusText} for ${path} — deploy is missing the asset`,
+        integrityFailed: (digest, from) => `${label} integrity check failed: expected ${sha256}, got ${digest} (${from}) for ${path} — ` +
+            `the staged asset is corrupt or out of sync; rerun ${stagedBy} and redeploy`,
+    };
+}
+const OXC_WASM_ASSET = oxcAsset('Oxc wasm', OXC_WASM_ASSET_PATH, OXC_WASM_SHA256, 'application/wasm', 'scripts/bundle-oxc-wasm.mjs');
+const OXC_FACET_ASSET = oxcAsset('transform facet runtime', OXC_FACET_ASSET_PATH, OXC_FACET_SHA256, 'text/javascript; charset=utf-8', 'scripts/bundle-facet-workers.mjs');
+/** The Oxc wasm's bytes, for the transform facet's module map. */
+export function fetchOxcWasmBytes(env) {
+    return fetchStagedBytes(env, OXC_WASM_ASSET);
+}
+/** The transform facet's runtime: a script that installs the globals its class reads. */
+export function fetchOxcFacetRuntime(env) {
+    return fetchStagedText(env, OXC_FACET_ASSET);
+}

package/dist/runtime/package-manager.js

@@ -30,7 +30,7 @@ export async function installRuntimeProgrammatic(deps, spec, opts = {}) {
         pid: 0,
         get cred() { return programmaticCred; },
         setUmask: (umask) => { programmaticCred = { ...programmaticCred, umask }; },
-        runAs: async () => 126,
+        runAs: async () => ({ status: 126, signal: null }),
         args: [],
         env: {},
         cwd: deps.getHome(),

package/dist/runtime/process-logs-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process-logs-api.d.ts","sourceRoot":"","sources":["../../src/runtime/process-logs-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AAEtG;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,wBAAwB,CAAC;IACpC;;;;OAIG;IACH,GAAG,EAAE;QACH,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;KACvD,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,SAAS,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,GAAG,IAAI,EAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,IAAI,CAON;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,iBAAiB,GACtB,QAAQ,CA8EV;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,wBAAwB,EACnC,GAAG,EAAE;IAAE,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAAA;CAAE,GACjD,IAAI,CA8CN;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,wBAAwB,GAClC,QAAQ,CAsCV;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7D"}
+{"version":3,"file":"process-logs-api.d.ts","sourceRoot":"","sources":["../../src/runtime/process-logs-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AAGtG;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,wBAAwB,CAAC;IACpC;;;;OAIG;IACH,GAAG,EAAE;QACH,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;KACvD,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,SAAS,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,YAAY,GAAG,IAAI,EAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,IAAI,CAON;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,iBAAiB,GACtB,QAAQ,CA8EV;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,wBAAwB,EACnC,GAAG,EAAE;IAAE,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAAA;CAAE,GACjD,IAAI,CA8CN;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,wBAAwB,GAClC,QAAQ,CAyCV;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7D"}

package/dist/runtime/process-logs-api.js

@@ -14,6 +14,7 @@
  * The ring buffer keeps state for 10 min post-exit so a tab that's still
  * open after a crash continues to show the final output.
  */
+import { execIdField } from '@nimbus-sh/core/runtime/process-table.js';
 /**
  * Send a structured JSON event to the main terminal WebSocket, if one is
  * attached. Used for out-of-band process lifecycle notifications
@@ -218,6 +219,7 @@ export function handleProcessesListRequest(processes) {
             hasLogs: !!snap && snap.chunks > 0,
             logBytes: snap?.bytes ?? 0,
             startTime: p.startTime,
+            ...execIdField(p),
         });
     }
     // Reaped processes with lingering log buffers (exited >60s ago, not

package/dist/runtime/project-fs.d.ts

@@ -9,7 +9,9 @@
 import { type VfsCred } from '@nimbus-sh/core/runtime/os-contracts.js';
 import { type ProcessFiles, type ProcessView } from '@nimbus-sh/core/runtime/process-files.js';
 import type { CredentialedVfs } from '@nimbus-sh/core/vfs/sqlite-vfs.js';
-type ProjectFsOp = 'exists' | 'isFile' | 'isDirectory' | 'stat' | 'lstat' | 'readFile' | 'readFileString' | 'readdir' | 'writeFile' | 'mkdir' | 'unlink' | 'rmdir' | 'removeRecursive' | 'symlink' | 'readlink' | 'chmod';
+import type { Awaitable, VfsDirent } from '@nimbus-sh/core/vfs/vfs.js';
+import { type KnownDirentType } from '@nimbus-sh/core/vfs/dirent-type.js';
+type ProjectFsOp = 'exists' | 'isFile' | 'isDirectory' | 'stat' | 'lstat' | 'readFile' | 'readFileString' | 'writeFile' | 'mkdir' | 'unlink' | 'rmdir' | 'removeRecursive' | 'symlink' | 'readlink' | 'chmod';
 /**
  * A tool's calls on its tree in the engine's call shape (keys with or
  * without the leading slash, a stat that throws when absent, failures
@@ -18,7 +20,12 @@ type ProjectFsOp = 'exists' | 'isFile' | 'isDirectory' | 'stat' | 'lstat' | 'rea
  */
 export type ProjectFs = {
     [K in ProjectFsOp]: (...args: Parameters<CredentialedVfs[K]>) => ReturnType<CredentialedVfs[K]> | Promise<ReturnType<CredentialedVfs[K]>>;
+} & {
+    /** A directory's entries, typed as the namespace types them: a mount's may name a device, or say it cannot tell. */
+    readdir(key: string): Awaitable<Array<Pick<VfsDirent, 'name' | 'type'>>>;
 };
+/** The exact type of `entry` in `dir`, lstat'ing it where its listing could not type it; null when it has gone. */
+export declare function projectEntryType(fs: Pick<ProjectFs, 'lstat'>, dir: string, entry: Pick<VfsDirent, 'name' | 'type'>): Promise<KnownDirentType | null>;
 /** The principal's `view` in the engine's call shape. */
 export declare function projectFs(view: ProcessView): ProjectFs;
 /**

package/dist/runtime/project-fs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-fs.d.ts","sourceRoot":"","sources":["../../src/runtime/project-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAe,KAAK,OAAO,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAa,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAC1G,OAAO,KAAK,EAAE,eAAe,EAAW,MAAM,mCAAmC,CAAC;AAIlF,KAAK,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,gBAAgB,GAAG,SAAS,GACjH,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,iBAAiB,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;AAEtG;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG;KACrB,CAAC,IAAI,WAAW,GAAG,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;CAC1I,CAAC;AAEF,yDAAyD;AACzD,wBAAgB,SAAS,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,CAgCtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAahI"}
+{"version":3,"file":"project-fs.d.ts","sourceRoot":"","sources":["../../src/runtime/project-fs.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAe,KAAK,OAAO,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAa,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,0CAA0C,CAAC;AAC1G,OAAO,KAAK,EAAE,eAAe,EAAW,MAAM,mCAAmC,CAAC;AAClF,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,EAAgB,KAAK,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAGxF,KAAK,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,gBAAgB,GACrG,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,iBAAiB,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;AAEtG;;;;;GAKG;AACH,MAAM,MAAM,SAAS,GAAG;KACrB,CAAC,IAAI,WAAW,GAAG,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;CAC1I,GAAG;IACF,oHAAoH;IACpH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;CAC1E,CAAC;AAEF,mHAAmH;AACnH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC,GACtC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CASjC;AAED,yDAAyD;AACzD,wBAAgB,SAAS,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,CAgCtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAahI"}

package/dist/runtime/project-fs.js

@@ -8,8 +8,22 @@
  */
 import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
 import { engineKey } from '@nimbus-sh/core/runtime/process-files.js';
-import { syscallError } from '@nimbus-sh/core/vfs/vfs-error.js';
+import { isVfsError, syscallError } from '@nimbus-sh/core/vfs/vfs-error.js';
+import { direntTypeOf } from '@nimbus-sh/core/vfs/dirent-type.js';
 import { normalizeVfsPath } from '@nimbus-sh/core/vfs/path.js';
+/** The exact type of `entry` in `dir`, lstat'ing it where its listing could not type it; null when it has gone. */
+export function projectEntryType(fs, dir, entry) {
+    return direntTypeOf(entry, async () => {
+        try {
+            return await fs.lstat(`${dir}/${entry.name}`);
+        }
+        catch (error) {
+            if (isVfsError(error, 'ENOENT'))
+                return null;
+            throw error;
+        }
+    });
+}
 /** The principal's `view` in the engine's call shape. */
 export function projectFs(view) {
     const at = (key) => '/' + normalizeVfsPath(key);