@nimbus-sh/worker 0.2.3 → 0.4.0

package/dist/npm/installer.js

@@ -27,21 +27,22 @@ import { packumentUrl } from './r2-cache.js';
 import { npmAddedLine, npmHttpCacheLine, npmHttpFetchLine, npmTitleLine, } from './npm-log.js';
 import { applySwaps, findRejects, lookupSwap, lookupReject, shouldSkipPackage, shouldWarnSkipTransitive, isOptionalNativeBinding, formatSwapNotice, RegistryRejectError, emitRegistryEvent, } from '../facets/wasm-swap-registry.js';
 import { resolvePackageEntry } from '@nimbus-sh/core/_shared/exports-resolver.js';
-import { encodeWriteBatchStream } from '@nimbus-sh/core/_shared/w7-frame.js';
-import { NimbusLoaderPool } from '../loaders/loader-pool.js';
-import { NimbusFanoutPool, IN_DO_THRESHOLD } from '../loaders/fanout-pool.js';
+import { encodeWriteBatchStream } from '@nimbus-sh/platform/w7-frame.js';
+import { IsolatePool } from '@nimbus-sh/fabric/isolate-pool.js';
+import { Fanout, IN_DO_THRESHOLD } from '@nimbus-sh/fabric/fanout.js';
 import { TAR_STREAM_PREAMBLE, W7_FRAME_PREAMBLE } from '../loaders/generated-workers.js';
 import { installPackagesInFacet, } from './install-batch-facet.js';
-import { setInstallPhase, recordInstallFacetCounters, recordPreBundleSummary, recordR2RaceCounters, recordCacheStatEvents, readDiagCounters, } from '@nimbus-sh/core/observability/diag-counters.js';
-import { estimateSupervisorHeap } from '@nimbus-sh/core/observability/heap-estimate.js';
-import { describeError } from '@nimbus-sh/core/observability/oom-classify.js';
+import { setInstallPhase, recordInstallFacetCounters, recordPreBundleSummary, recordR2RaceCounters, readDiagCounters, } from '@nimbus-sh/platform/diag-counters.js';
+import { recordCacheStatEvents } from '@nimbus-sh/core/_shared/cache-stats.js';
+import { estimateSupervisorHeap } from '@nimbus-sh/platform/heap-estimate.js';
+import { describeError } from '@nimbus-sh/platform/oom-classify.js';
 import { resolveOnePackumentInFacet, } from './resolve-one-facet.js';
 import { NPM_RESOLVE_PREAMBLE } from '../loaders/npm-resolve-preamble.js';
 import { prebundleOne, buildSliceForSpecifierWithCap, externalsForSpecifier, } from './pre-bundle-facet.js';
 import { PRE_BUNDLE_PREAMBLE } from '../loaders/pre-bundle-preamble.js';
 import { fetchEsbuildWasmBytes } from '../runtime/esbuild-wasm-bytes.js';
-import { CHUNK_SIZE, PRE_BUNDLE_CONCURRENCY, PRE_BUNDLE_SLICE_CAP_BYTES, SUPERVISOR_IN_FLIGHT_ALLOCATION_BUDGET_BYTES, } from '@nimbus-sh/core/constants.js';
-import { acquireSupervisorAllocation } from '@nimbus-sh/core/observability/heavy-alloc-coord.js';
+import { CHUNK_SIZE, PRE_BUNDLE_CONCURRENCY, PRE_BUNDLE_SLICE_CAP_BYTES, SUPERVISOR_IN_FLIGHT_ALLOCATION_BUDGET_BYTES, } from '@nimbus-sh/platform/limits.js';
+import { acquireSupervisorAllocation } from '@nimbus-sh/platform/heavy-alloc-coord.js';
 import { countPackageFiles, BARREL_PKG_FILE_THRESHOLD, packageNameFromSpecifier } from '@nimbus-sh/core/runtime/barrel-detect.js';
 import { scanNamedImports, namedImportSignature, buildSyntheticEntry, buildScopedSliceForSynthetic, syntheticEntryPath, } from '../runtime/barrel-synthesizer.js';
 import { enc } from '@nimbus-sh/core/_shared/bytes.js';
@@ -146,7 +147,7 @@ export class NpmInstaller {
             phases['lock-check'] = Date.now() - phaseStart;
             // ── Phase 1: Resolve ──────────────────────────────────────────
             // Frontier-coordinator path. Each BFS layer dispatches to
-            // NimbusFanoutPool.submitMany — width <5 in-DO (in-DO fanout),
+            // Fanout.submitMany — width <5 in-DO (in-DO fanout),
             // width ≥5 peer-DO (peer-DO fanout). Per-package task body is
             // self-contained (resolveOnePackumentInFacet), supervisor builds
             // layer N+1 from layer N's edges. Missing env.LOADER throws at
@@ -222,7 +223,7 @@ export class NpmInstaller {
         setInstallPhase('fetch');
         // Fetch + extract + write new packages.
         //
-        // Single fetch path: one NimbusLoaderPool isolate (the batch facet)
+        // Single fetch path: one IsolatePool isolate (the batch facet)
         // runs the entire install. The facet streams tarballs through gunzip+tar
         // and coalesces package-owned paths into shared writeBatchStream waves;
         // every owner awaits each wave it contributed to.
@@ -419,7 +420,7 @@ export class NpmInstaller {
     /**
      * F-2 frontier-coordinator path. Replaces the single-resolve-facet
      * dispatch with a per-package fanout: each BFS layer becomes ONE
-     * `NimbusFanoutPool.submitMany` call, layer N+1 builds from the
+     * `Fanout.submitMany` call, layer N+1 builds from the
      * resolved metadata of layer N.
      *
      * Topology auto-routes per layer:
@@ -486,7 +487,7 @@ export class NpmInstaller {
         const RESOLVE_PEER_CAP = 8;
         // F-2 fanout pool. One construction reused across every layer; the
         // pool is stateless across submitMany calls.
-        const fanoutPool = new NimbusFanoutPool(this.env, this.ctx, {
+        const fanoutPool = new Fanout(this.env, this.ctx, {
             tag: 'npm-resolve-fanout',
             // 5 minutes per layer is generous; typical layers complete in
             // 1-3 s. Per-task this gates each packument fetch + R2 race.
@@ -561,8 +562,8 @@ export class NpmInstaller {
                 };
                 return { key: name, args: taskSpec };
             });
-            // Dispatch the layer. NimbusFanoutPool routes:
-            //   <5 → in-DO fanout in-DO (NimbusLoaderPool), concurrency = layer.length (capped at 4)
+            // Dispatch the layer. Fanout routes:
+            //   <5 → in-DO fanout in-DO (IsolatePool), concurrency = layer.length (capped at 4)
             //   ≥5 → peer-DO fanout peer-DO, N peers = min(layer.length, 32)
             let results;
             const layerT0 = Date.now();
@@ -769,12 +770,12 @@ export class NpmInstaller {
         return { resolved, unresolved };
     }
     /**
-     * Batch install via two-tier fan-out (NimbusFanoutPool).
+     * Batch install via two-tier fan-out (Fanout).
      *
      * Shard count is `min(specs.length, INSTALL_PEER_CAP)`, and the topology
      * follows from it:
      *   shardCount <  IN_DO_THRESHOLD (5)  → in-DO fanout in-DO
-     *     1 NimbusLoaderPool with concurrency = shardCount, capped at
+     *     1 IsolatePool with concurrency = shardCount, capped at
      *     4 by V8 invariant. Each shard is one facet running its own
      *     installPackagesInFacet.
      *   shardCount >= IN_DO_THRESHOLD       → peer-DO fanout peer-DO
@@ -786,7 +787,7 @@ export class NpmInstaller {
      *   `shard-${i}` task key deterministically (tests can predict
      *   placement).
      *
-     * Pre-fix lineage: this site previously ran ONE NimbusLoaderPool
+     * Pre-fix lineage: this site previously ran ONE IsolatePool
      *   with concurrency=1, internal pLimit(3) — the explicit "collapses
      *   what was 4 concurrent dynamic workers (pool.map slots) into 1"
      *   Two-tier topology re-expands the fan-out without re-introducing
@@ -851,7 +852,7 @@ export class NpmInstaller {
         // Peer shards dispatch in bounded phases and each phase is a barrier, so
         // the phase profile is what distinguishes shard work from barrier count.
         const phaseProfile = [];
-        const fanoutPool = new NimbusFanoutPool(this.env, this.ctx, {
+        const fanoutPool = new Fanout(this.env, this.ctx, {
             tag: 'npm-install-batch',
             // Whole-batch timeout. With per-shard parallelism of N=8 peer
             // DOs each running pLimit(3), Mossaic-class 456 packages
@@ -869,7 +870,7 @@ export class NpmInstaller {
         });
         const tasks = nonEmptyShards.map((shardSpecs, shardIdx) => ({
             // Stable-id router key. Same shardIdx → same peer DO across
-            // runs. Tests can predict placement via NimbusFanoutPool's
+            // runs. Tests can predict placement via Fanout's
             // `peerSiblingId(key, peerCount)` helper.
             key: `shard-${shardIdx}`,
             args: { packages: shardSpecs, concurrency: 3 },
@@ -974,7 +975,7 @@ export class NpmInstaller {
         }
         catch (e) {
             // Final catch — preserved from the pre-fix shape so the error
-            // log line shape stays consistent. NimbusFanoutPool's internal
+            // log line shape stays consistent. Fanout's internal
             // pools dispose themselves at the end of each submitMany call,
             // so no explicit dispose() is needed here.
             // The earlier inner-catch already logged + threw; if we reach
@@ -1304,7 +1305,7 @@ export class NpmInstaller {
      * JSX elements get rejected as "alien" — silent render failure.
      */
     async prebundleUsedModules(projDir, installed) {
-        // Pre-bundle now runs in NimbusLoaderPool isolates (src/pre-bundle-facet.ts);
+        // Pre-bundle now runs in IsolatePool isolates (src/pre-bundle-facet.ts);
         // each facet ships its own bundled esbuild-wasm via the preamble. The
         // supervisor's EsbuildService is no longer on the bundle path — it
         // still serves the transform path (TS/JSX → JS) which is small and
@@ -1444,7 +1445,7 @@ export class NpmInstaller {
         // C'.1 deterministic estimator. process.memoryUsage() returns 0
         // for every field inside a Durable Object class context (only
         // dynamic-worker isolates under nodejs_compat get the real
-        // implementation — see src/observability/diag-counters.ts:4 and
+        // implementation — see @nimbus-sh/platform/diag-counters.js:4 and
         // heap-estimate.ts:6). The previous "supervisor heap 0.0 MiB"
         // line was actively misleading: it printed every time, regardless
         // of what was actually in the heap, and could not be used to
@@ -1515,7 +1516,7 @@ export class NpmInstaller {
         // (where it should live). No supervisor-side caching — see
         // src/esbuild-wasm-bytes.ts for the full architectural rationale.
         //
-        // Bytes are shipped into each facet via NimbusLoaderPool's
+        // Bytes are shipped into each facet via IsolatePool's
         // `wasmModules` option which workerd registers in the LOADER
         // `modules` map as `{ wasm: ArrayBuffer }`. Workerd compiles at
         // module-load (startup phase, where wasm code generation is
@@ -1562,12 +1563,12 @@ export class NpmInstaller {
             if (wasmBytes.byteLength > maxRetainedWasmBytes) {
                 throw new RangeError(`pre-bundle wasm payload ${wasmBytes.byteLength} exceeds the ${maxRetainedWasmBytes}-byte retained budget`);
             }
-            // NimbusLoaderPool keeps the constructor-time module bytes until
+            // IsolatePool keeps the constructor-time module bytes until
             // dispose(), so retain their exact credit rather than treating
             // construction as a handoff that immediately frees the ArrayBuffer.
             setupAllocation.shrinkTo(wasmBytes.byteLength);
             try {
-                pool = new NimbusLoaderPool(this.env, this.ctx, {
+                pool = new IsolatePool(this.env, this.ctx, {
                     concurrency: PRE_BUNDLE_CONCURRENCY,
                     timeoutMs: 60_000,
                     retries: 0,
@@ -1994,7 +1995,7 @@ export class NpmInstaller {
     /**
      * P5 (production reliability) — deterministic supervisor-heap estimate in MiB.
      *
-     * Routes through observability/heap-estimate.ts which sums KNOWN
+     * Routes through @nimbus-sh/platform/heap-estimate.js which sums KNOWN
      * supervisor heap allocation sources from runtime counters that
      * ARE accurate inside a DO context (DiagCounters singleton +
      * SqliteVFS.getStats()). This replaces a previous use of
@@ -2035,7 +2036,7 @@ export class NpmInstaller {
 // process.memoryUsage() which returns 0 for every field inside a
 // Durable Object class context (only dynamic-worker isolates under
 // nodejs_compat get the real implementation — see
-// src/observability/diag-counters.ts:4). The deterministic
+// @nimbus-sh/platform/diag-counters.js:4). The deterministic
 // supervisor-heap estimator is the C'.1 replacement; see
 // NpmInstaller._estimateSupervisorHeapMiB.
 function parentOf(path) {

package/dist/npm/pre-bundle-facet.d.ts

@@ -1,5 +1,5 @@
 /**
- * pre-bundle-facet.ts — NimbusLoaderPool entry for esbuild pre-bundling.
+ * pre-bundle-facet.ts — IsolatePool entry for esbuild pre-bundling.
  *
  * Why this exists
  * ───────────────
@@ -14,7 +14,7 @@
  * the previous isolate.
  *
  * The fix is to dispatch each per-specifier `esbuild.build` to a
- * NimbusLoaderPool isolate. Each facet has its own 128 MB budget and
+ * IsolatePool isolate. Each facet has its own 128 MB budget and
  * stable-slot reuse keeps the warm-up cost amortized across the 8
  * concurrent specs of a typical install. The install-batch facet uses
  * the same isolate boundary for tarball extraction.

package/dist/npm/pre-bundle-facet.js

@@ -1,5 +1,5 @@
 /**
- * pre-bundle-facet.ts — NimbusLoaderPool entry for esbuild pre-bundling.
+ * pre-bundle-facet.ts — IsolatePool entry for esbuild pre-bundling.
  *
  * Why this exists
  * ───────────────
@@ -14,7 +14,7 @@
  * the previous isolate.
  *
  * The fix is to dispatch each per-specifier `esbuild.build` to a
- * NimbusLoaderPool isolate. Each facet has its own 128 MB budget and
+ * IsolatePool isolate. Each facet has its own 128 MB budget and
  * stable-slot reuse keeps the warm-up cost amortized across the 8
  * concurrent specs of a typical install. The install-batch facet uses
  * the same isolate boundary for tarball extraction.
@@ -181,7 +181,7 @@ export function externalsForSpecifier(specifier) {
 }
 // ── Facet function ──────────────────────────────────────────────────────
 //
-// `prebundleOne` runs inside a NimbusLoaderPool isolate. cloudflare-parallel
+// `prebundleOne` runs inside a IsolatePool isolate. cloudflare-parallel
 // serialises it via fn.toString(); the helpers it references at module
 // scope (ESBUILD_WASM_JS_FN_BODY, resolvePackageEntry) are NOT in the
 // facet's lexical scope at runtime. Instead they're injected by the
@@ -250,7 +250,7 @@ export const prebundleOne = async function prebundleOne(spec, _env) {
     //    runs that at module-load time (where eval is permitted) and
     //    stashes the result on the module-scope const __NIMBUS_ESBUILD_NS.
     //
-    //    The WASM module is shipped into the facet via NimbusLoaderPool's
+    //    The WASM module is shipped into the facet via IsolatePool's
     //    `wasmModules` option, registered in the LOADER's modules map as
     //    { wasm: ArrayBuffer }. Workerd compiles it during the worker's
     //    module-load phase (eval permitted there), and the pool's
@@ -285,7 +285,7 @@ export const prebundleOne = async function prebundleOne(spec, _env) {
     if (!initPromise) {
         initPromise = (async () => {
             // Read the WebAssembly.Module the pool registered. The key matches
-            // the name passed to NimbusLoaderPool's `wasmModules` option (see
+            // the name passed to IsolatePool's `wasmModules` option (see
             // src/npm-installer.ts:prebundleUsedModules dispatch site).
             const wasmRegistry = globalThis.__NIMBUS_WASM;
             const wasmModule = wasmRegistry && wasmRegistry['esbuild.wasm'];

package/dist/npm/r2-cache.d.ts

@@ -220,7 +220,7 @@ export declare function packumentKey(name: string): string;
  * proving the L2 layer is functional even when local-dev wall-clock
  * latency is too noisy to demonstrate 5×.
  *
- * Diag counters (src/observability/diag-counters.ts) bump for the
+ * Diag counters (@nimbus-sh/platform/diag-counters.js) bump for the
  * SupervisorRPC layer (RPC-perspective hit/miss). These per-instance
  * counters bump for the R2CacheClient call surface itself (L2 vs L3
  * vs miss), independent of who's calling.

package/dist/npm/resolve-facet.d.ts

@@ -1,7 +1,7 @@
 /**
  * resolve-facet.ts — shared wire types for the per-packument resolver facet.
  *
- * The npm resolver phase runs inside a NimbusLoaderPool isolate so the
+ * The npm resolver phase runs inside a IsolatePool isolate so the
  * supervisor DO heap stays flat while large packuments are decoded. The
  * per-packument task body lives in resolve-one-facet.ts; this module holds
  * the types exchanged between supervisor and facet over RPC.

package/dist/npm/resolve-facet.js

@@ -1,7 +1,7 @@
 /**
  * resolve-facet.ts — shared wire types for the per-packument resolver facet.
  *
- * The npm resolver phase runs inside a NimbusLoaderPool isolate so the
+ * The npm resolver phase runs inside a IsolatePool isolate so the
  * supervisor DO heap stays flat while large packuments are decoded. The
  * per-packument task body lives in resolve-one-facet.ts; this module holds
  * the types exchanged between supervisor and facet over RPC.

package/dist/npm/resolve-one-facet.d.ts

@@ -7,10 +7,10 @@
  * independent fanout tasks. This file is the per-task body: one packument
  * fetch, one version pick, and edge extraction.
  *
- * Each task runs inside a Worker Loader isolate (NimbusFanoutPool routes
+ * Each task runs inside a Worker Loader isolate (Fanout routes
  * automatically: <5 = in-DO, ≥5 = peer-DO). The isolate is short-lived;
  * task body has its own ~128 MiB envelope. Parallelism = layer width
- * (capped at 32 by NimbusFanoutPool's MAX_PEER_FANOUT).
+ * (capped at 32 by Fanout's MAX_PEER_FANOUT).
  *
  * Stability invariants (cloudflare-parallel serialises via fn.toString)
  * ───────────────────────────────────────────────────────────────────
@@ -180,13 +180,13 @@ export interface ResolveOneResult {
 }
 /**
  * Per-package fanout task body. Serialised via fn.toString() and
- * dispatched by NimbusFanoutPool.submitMany — see installer.ts
+ * dispatched by Fanout.submitMany — see installer.ts
  * resolveTreeViaFanout.
  *
- * Function signature MUST be `(spec, env)` so NimbusFanoutPool's
+ * Function signature MUST be `(spec, env)` so Fanout's
  * submitMany invocation `fn(item, env)` lines up.
  *
- * `env` is the loader-isolate env supplied by NimbusFanoutPool.
+ * `env` is the loader-isolate env supplied by Fanout.
  * `env.SUPERVISOR` is the supervisor-rpc binding (putRegistryEntries,
  * getPackument).
  */

package/dist/npm/resolve-one-facet.js

@@ -7,10 +7,10 @@
  * independent fanout tasks. This file is the per-task body: one packument
  * fetch, one version pick, and edge extraction.
  *
- * Each task runs inside a Worker Loader isolate (NimbusFanoutPool routes
+ * Each task runs inside a Worker Loader isolate (Fanout routes
  * automatically: <5 = in-DO, ≥5 = peer-DO). The isolate is short-lived;
  * task body has its own ~128 MiB envelope. Parallelism = layer width
- * (capped at 32 by NimbusFanoutPool's MAX_PEER_FANOUT).
+ * (capped at 32 by Fanout's MAX_PEER_FANOUT).
  *
  * Stability invariants (cloudflare-parallel serialises via fn.toString)
  * ───────────────────────────────────────────────────────────────────
@@ -61,13 +61,13 @@
  */
 /**
  * Per-package fanout task body. Serialised via fn.toString() and
- * dispatched by NimbusFanoutPool.submitMany — see installer.ts
+ * dispatched by Fanout.submitMany — see installer.ts
  * resolveTreeViaFanout.
  *
- * Function signature MUST be `(spec, env)` so NimbusFanoutPool's
+ * Function signature MUST be `(spec, env)` so Fanout's
  * submitMany invocation `fn(item, env)` lines up.
  *
- * `env` is the loader-isolate env supplied by NimbusFanoutPool.
+ * `env` is the loader-isolate env supplied by Fanout.
  * `env.SUPERVISOR` is the supervisor-rpc binding (putRegistryEntries,
  * getPackument).
  */

package/dist/router/index.js

@@ -35,7 +35,7 @@ import { generateSessionId, isValidSessionId, } from '../_shared/session-id.js';
 import { buildPreviewHost, isPreviewHostSafeSid, parsePreviewHost, readPreviewHostSuffix, } from '../_shared/preview-host.js';
 import { parseSessionRoute, forwardToSession, renderInvalidSessionHtml, SESSION_ROUTE_PREFIX, LEGACY_PUBLIC_DO_SEGMENT, } from '../_shared/session-router.js';
 import { issueNimbusToken, verifyNimbusToken, verifyRequestToken, requireScopes, requireSessionPin, authErrorResponse, setNimbusTokenCookie, NIMBUS_TOKEN_QUERY, NimbusAuthError, NimbusBootstrapConsumedError, NimbusTokenClaimsError, DEFAULT_TOKEN_TTL_MS, ATTACH_BOOTSTRAP_TTL_MS, } from '../auth/index.js';
-import { setCtxExports } from '../session/ctx-exports.js';
+import { adoptCtxExports } from '@nimbus-sh/fabric/composition.js';
 import { handleNimbusRemoteApi, } from './remote-api.js';
 import { parseAgentOAuthStateParam } from '../session/agent.js';
 /**
@@ -82,7 +82,7 @@ export function createNimbusHandler(options = {}) {
     async function route(request, env, ctx) {
         // Capture ctx.exports on first call (loopback bindings for facets).
         if (ctx?.exports)
-            setCtxExports(ctx.exports);
+            adoptCtxExports(ctx.exports);
         const url = new URL(request.url);
         const previewSuffix = readPreviewHostSuffix(env);
         // ── <port>--<sid>.<suffix> — port preview ───────────────────────

package/dist/router/remote-api.js

@@ -1,7 +1,7 @@
 import { LEGACY_PUBLIC_DO_SEGMENT, } from '../_shared/session-router.js';
 import { z } from 'zod/v4';
 import { requireScopes, requireSessionPin, verifyRequestToken, NimbusAuthError, isNimbusIdComponent, } from '../auth/index.js';
-import { useRpcResource } from '@nimbus-sh/core/_shared/rpc-dispose.js';
+import { useRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 const DEFAULT_REMOTE_BASE_PATH = '/api/nimbus/v1';
 const RemoteRpcBodySchema = z.object({
     profile: z.string().optional(),
@@ -242,6 +242,14 @@ function requireAnyScope(ctx, scopes) {
 }
 function execOptions(ctx, value) {
     const options = objectArg(value);
+    // The remote boundary authenticates a SESSION, not a user inside it, so a
+    // token holder does not get to name the uid its command runs as. Refused
+    // rather than dropped: silently running as somebody other than the caller
+    // asked for is worse than an error. A colocated embedder holds the DO stub
+    // and is trusted with `cred` the same way it is trusted with kernel writes.
+    if (options.cred !== undefined) {
+        throw apiError('cred is not accepted over the remote API', 'E_ARG_SHAPE', 400);
+    }
     return {
         ...options,
         cwd: typeof options.cwd === 'string' ? options.cwd : ctx.root,

package/dist/runtime/bun-repl.d.ts

@@ -7,7 +7,7 @@
  * functions / imports persist.
  *
  * Design:
- *   - One child-facet per REPL session (NimbusLoaderPool with
+ *   - One child-facet per REPL session (IsolatePool with
  *     concurrency=1, omitSupervisor=true).
  *   - Facet-side: globalThis.__nimbus_bun_ctx caches a vm.createContext()
  *     dict; each push() runs vm.runInContext(line, ctx) and returns

package/dist/runtime/bun-repl.js

@@ -7,7 +7,7 @@
  * functions / imports persist.
  *
  * Design:
- *   - One child-facet per REPL session (NimbusLoaderPool with
+ *   - One child-facet per REPL session (IsolatePool with
  *     concurrency=1, omitSupervisor=true).
  *   - Facet-side: globalThis.__nimbus_bun_ctx caches a vm.createContext()
  *     dict; each push() runs vm.runInContext(line, ctx) and returns
@@ -125,8 +125,8 @@ class BunReplAdapter {
         // Preamble: install the Bun shim global at facet startup so the
         // REPL context has Bun.* available like real Bun does.
         const preamble = BUN_SHIM_PREAMBLE;
-        const { NimbusLoaderPool } = await import('../loaders/loader-pool.js');
-        this.pool = new NimbusLoaderPool(env, ctx, {
+        const { IsolatePool } = await import('@nimbus-sh/fabric/isolate-pool.js');
+        this.pool = new IsolatePool(env, ctx, {
             tag: 'bun-repl',
             concurrency: 1,
             omitSupervisor: true,

package/dist/runtime/esbuild-wasm-bytes.js

@@ -43,7 +43,7 @@
  */
 import { ESBUILD_VERSION } from '@nimbus-sh/core/constants.js';
 import { ESBUILD_WASM_SHA256 } from '../esbuild-wasm-bundle.generated.js';
-import { disposeRpcResource } from '@nimbus-sh/core/_shared/rpc-dispose.js';
+import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { sha256Hex } from '@nimbus-sh/core/_shared/crypto.js';
 /**
  * Path inside env.ASSETS where the esbuild-wasm binary lives.

package/dist/runtime/facet-loader-host.d.ts

@@ -1,7 +1,7 @@
 /**
  * The workerd {@link FacetHost}: a facet is a dynamic worker.
  *
- * The whole adapter is the option renames below, because `NimbusLoaderPool`
+ * The whole adapter is the option renames below, because `IsolatePool`
  * already IS the port's shape — `submit` and `dispose`, with the same meanings.
  * The one thing it spells differently is the supervisor capability, which it
  * takes as a pid plus a separate flag saying whether to bind one at all; the
@@ -13,13 +13,10 @@ import type { FacetHost } from '@nimbus-sh/core/runtime/facet-host.js';
 import type { FacetManager } from '../facets/manager.js';
 export declare function loaderFacetHost(env: unknown, ctx: DurableObjectState): FacetHost;
 /**
- * The two objects a NimbusLoaderPool needs from a FacetManager.
- *
- * FacetManager does not expose its `env` and `ctx` in its type, but a loader
- * pool is constructed from exactly those, so every runtime that spawns facets
- * needs the same reach-through. Reflect.get rather than a cast: the shape is
- * checked here once, and a FacetManager built on something other than a
- * DurableObjectState fails with a sentence instead of at the first RPC.
+ * The two objects a IsolatePool needs from a FacetManager, via the manager's
+ * own `loaderHost()` accessor. The runtime guard stays: harnesses build
+ * FacetManagers on mock contexts, and one built on something other than a
+ * DurableObjectState should fail with a sentence instead of at the first RPC.
  */
 export declare function getFacetManagerLoaderHost(facetMgr: FacetManager): {
     env: unknown;

package/dist/runtime/facet-loader-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facet-loader-host.d.ts","sourceRoot":"","sources":["../../src/runtime/facet-loader-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAIV,SAAS,EAEV,MAAM,uCAAuC,CAAC;AAG/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,GAAG,SAAS,CA6BhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,YAAY,GACrB;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,CAO3C;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,GAAG,SAAS,CAGrE"}
+{"version":3,"file":"facet-loader-host.d.ts","sourceRoot":"","sources":["../../src/runtime/facet-loader-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAIV,SAAS,EAEV,MAAM,uCAAuC,CAAC;AAG/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,GAAG,SAAS,CA6BhF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,YAAY,GACrB;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,CAM3C;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,GAAG,SAAS,CAGrE"}

package/dist/runtime/facet-loader-host.js

@@ -1,5 +1,5 @@
 import { manifestVfs } from '@nimbus-sh/core/runtime/vfs-manifest.js';
-import { NimbusLoaderPool } from '../loaders/loader-pool.js';
+import { IsolatePool } from '@nimbus-sh/fabric/isolate-pool.js';
 export function loaderFacetHost(env, ctx) {
     return {
         // workerd suspends a guest through JSPI, which is what lets a syscall reach
@@ -14,7 +14,7 @@ export function loaderFacetHost(env, ctx) {
             return manifestVfs(vfs, root, options);
         },
         open(spec) {
-            return new NimbusLoaderPool(env, ctx, {
+            return new IsolatePool(env, ctx, {
                 tag: spec.tag,
                 concurrency: spec.concurrency,
                 preamble: spec.preamble,
@@ -27,17 +27,13 @@ export function loaderFacetHost(env, ctx) {
     };
 }
 /**
- * The two objects a NimbusLoaderPool needs from a FacetManager.
- *
- * FacetManager does not expose its `env` and `ctx` in its type, but a loader
- * pool is constructed from exactly those, so every runtime that spawns facets
- * needs the same reach-through. Reflect.get rather than a cast: the shape is
- * checked here once, and a FacetManager built on something other than a
- * DurableObjectState fails with a sentence instead of at the first RPC.
+ * The two objects a IsolatePool needs from a FacetManager, via the manager's
+ * own `loaderHost()` accessor. The runtime guard stays: harnesses build
+ * FacetManagers on mock contexts, and one built on something other than a
+ * DurableObjectState should fail with a sentence instead of at the first RPC.
  */
 export function getFacetManagerLoaderHost(facetMgr) {
-    const env = Reflect.get(facetMgr, 'env');
-    const ctx = Reflect.get(facetMgr, 'ctx');
+    const { env, ctx } = facetMgr.loaderHost();
     if (!isDurableObjectState(ctx)) {
         throw new Error('a loader-backed runtime requires a FacetManager with DurableObjectState context');
     }

package/dist/runtime/node-repl.js

@@ -113,8 +113,8 @@ class NodeReplAdapter {
         const { facetMgr } = this.deps;
         const env = facetMgr.env;
         const ctx = facetMgr.ctx;
-        const { NimbusLoaderPool } = await import('../loaders/loader-pool.js');
-        this.pool = new NimbusLoaderPool(env, ctx, {
+        const { IsolatePool } = await import('@nimbus-sh/fabric/isolate-pool.js');
+        this.pool = new IsolatePool(env, ctx, {
             tag: 'node-repl',
             concurrency: 1,
             omitSupervisor: true,

package/dist/runtime/node-shims-artifact.js

@@ -16,7 +16,7 @@
  * facet with no node-compat layer.
  */
 import { NODE_SHIMS_BUILD_ID, NODE_SHIMS_ENTRY, NODE_SHIMS_SHA256, } from '../node-shims-artifact.generated.js';
-import { disposeRpcResource } from '@nimbus-sh/core/_shared/rpc-dispose.js';
+import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { sha256Hex } from '@nimbus-sh/core/_shared/crypto.js';
 const L2_KEY = `https://nimbus-cache.invalid${NODE_SHIMS_ENTRY}?build=${NODE_SHIMS_BUILD_ID}`;
 const ASSET_URL = `https://nimbus-internal.invalid${NODE_SHIMS_ENTRY}`;

package/dist/runtime/node-shims.js

@@ -41,7 +41,8 @@ import { generateUndiciShimCode } from '@nimbus-sh/core/runtime/undici-shim.js';
 import { getExportsResolverJS } from '@nimbus-sh/core/_shared/exports-resolver.js';
 import { getTypescriptSpecifiersJS } from '@nimbus-sh/core/_shared/typescript-specifiers.js';
 import { NIMBUS_AI_CREDENTIAL_HEADERS, NIMBUS_AI_TOKEN_ENV } from '@nimbus-sh/core/_shared/ai-egress.js';
-import { FACET_PROVIDED_PACKAGES, FS_READ_BATCH_PATH_LIMIT, FS_READ_BATCH_REQUEST_BYTES, MAX_RPC_SAFE_PAYLOAD_BYTES, NIMBUS_AI_GATEWAY_PORT, NODE_VERSION, NODE_VERSIONS, } from '@nimbus-sh/core/constants.js';
+import { MAX_RPC_SAFE_PAYLOAD_BYTES } from '@nimbus-sh/platform/limits.js';
+import { FACET_PROVIDED_PACKAGES, FS_READ_BATCH_PATH_LIMIT, FS_READ_BATCH_REQUEST_BYTES, NIMBUS_AI_GATEWAY_PORT, NODE_VERSION, NODE_VERSIONS, } from '@nimbus-sh/core/constants.js';
 const STREAMS_CODE = generateStreamsCode();
 const SQLITE_SHIM_CODE = generateSqliteShimCode();
 const UNDICI_SHIM_CODE = generateUndiciShimCode();

package/dist/runtime/opencode-artifact.js

@@ -20,7 +20,7 @@
  * (see OPENCODE_TREE_SITTER_WASMS and FacetManager.treeSitterModuleEntries).
  */
 import { OPENCODE_ARTIFACT_BUILD_ID, OPENCODE_ARTIFACT_DIGESTS, OPENCODE_ARTIFACT_PRESENT, OPENCODE_ARTIFACT_VERSION, } from '../opencode-artifact.generated.js';
-import { disposeRpcResource } from '@nimbus-sh/core/_shared/rpc-dispose.js';
+import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { sha256Hex } from '@nimbus-sh/core/_shared/crypto.js';
 /** Base asset path of the staged opencode bundle directory. */
 const OPENCODE_ASSET_BASE = `/_assets/opencode/${OPENCODE_ARTIFACT_VERSION}`;

package/dist/runtime/opentui-wasm-bytes.js

@@ -16,7 +16,7 @@
  * the backend.
  */
 import { OPENTUI_WASM_BUILD_ID, OPENTUI_WASM_ENTRY, OPENTUI_WASM_SHA256, } from '../opentui-wasm-artifact.generated.js';
-import { disposeRpcResource } from '@nimbus-sh/core/_shared/rpc-dispose.js';
+import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { sha256Hex } from '@nimbus-sh/core/_shared/crypto.js';
 /**
  * Synthetic L2 cache key for the OpenTUI wasm asset. Build-id-pinned so a

package/dist/runtime/python-repl.js

@@ -207,7 +207,7 @@ class PythonReplAdapter {
         snapshot.files[stdlibPath.replace(/^\/+/, '')] = btoa(bin);
         this.fsSnapshot = snapshot;
         this.pythonHome = `/${installRoot.replace(/^\/+/, '')}`;
-        const { NimbusLoaderPool } = await import('../loaders/loader-pool.js');
+        const { IsolatePool } = await import('@nimbus-sh/fabric/isolate-pool.js');
         const host = getFacetManagerLoaderHost(facetMgr);
         // A prompt where `open(path, "w")` silently does nothing is worse than one
         // that refuses to start, so the pid decides which pool this is. Written as
@@ -225,11 +225,11 @@ class PythonReplAdapter {
         };
         const pid = this.deps.pid;
         this.pool = (typeof pid === 'number' && pid > 0
-            ? new NimbusLoaderPool(host.env, host.ctx, { ...base, supervisorPid: pid })
+            ? new IsolatePool(host.env, host.ctx, { ...base, supervisorPid: pid })
             // The install-time warm-up has no invoking process. It boots the
             // interpreter and never touches a file, so it asks for no supervisor
             // rather than binding one it cannot authenticate to.
-            : new NimbusLoaderPool(host.env, host.ctx, { ...base, omitSupervisor: true }));
+            : new IsolatePool(host.env, host.ctx, { ...base, omitSupervisor: true }));
     }
     async submit(userCode) {
         const result = await this.pool.submit(pythonReplStepFacetFn, {

package/dist/runtime/ruby-repl.js

@@ -156,10 +156,10 @@ class RubyReplAdapter {
         // drifted (it lacked the language-prelude const __rubyRun requires, so
         // every REPL eval died on boot) — compose it in exactly one place.
         const preamble = buildRubyPreamble();
-        const { NimbusLoaderPool } = await import('../loaders/loader-pool.js');
+        const { IsolatePool } = await import('@nimbus-sh/fabric/isolate-pool.js');
         const env = facetMgr.env;
         const ctx = facetMgr.ctx;
-        this.pool = new NimbusLoaderPool(env, ctx, {
+        this.pool = new IsolatePool(env, ctx, {
             tag: 'ruby-repl',
             concurrency: 1,
             omitSupervisor: true,

package/dist/runtime/ruby-resident.js

@@ -48,7 +48,7 @@ export function rubyResidentStart(facetMgr) {
         }
         const boot = parsed.data;
         if (boot.state === 'listening' && typeof boot.port === 'number' && boot.port > 0) {
-            facetMgr.registerPort(spawned.pid, Number(boot.port));
+            await facetMgr.registerPort(spawned.pid, Number(boot.port));
             const routeablePorts = await facetMgr.waitForRouteablePorts(spawned.pid);
             const routeablePort = routeablePorts.includes(Number(boot.port)) ? Number(boot.port) : routeablePorts[0];
             if (!routeablePort) {

package/dist/runtime/sqlite-wasm-bytes.js

@@ -17,7 +17,7 @@
  */
 import { SQLJS_VERSION } from '@nimbus-sh/core/constants.js';
 import { SQLITE_WASM_SHA256 } from '../sqlite-wasm-bundle.generated.js';
-import { disposeRpcResource } from '@nimbus-sh/core/_shared/rpc-dispose.js';
+import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
 import { sha256Hex } from '@nimbus-sh/core/_shared/crypto.js';
 /**
  * Path inside env.ASSETS where the sql.js wasm binary lives. Versioned so

package/dist/session/diag.js

@@ -16,7 +16,7 @@
  *
  * Per DEFECT-D1: ctx is taken as a separate explicit arg.
  */
-import { rehydrateFromStorage, snapshotForStorage, getFailures, } from '@nimbus-sh/core/observability/oom-discriminator.js';
+import { rehydrateFromStorage, snapshotForStorage, getFailures, } from '@nimbus-sh/platform/oom-discriminator.js';
 import { W5_RING_STORAGE_KEY } from './keys.js';
 export function readNodeMem() {
     try {