@nimbus-sh/worker 0.5.0 → 0.7.0

package/README.md

@@ -216,8 +216,8 @@ config })`. The route requires a valid Nimbus JWT and `sandbox:use` scope.
 For an app server, start the process and expose its virtual port:
 
 ```ts
-await box.files.write('/home/user/app/server.js', serverSource);
-const proc = await box.startProcess('node --watch /home/user/app/server.js');
+await box.files.write('/home/user/example-app/server.js', serverSource);
+const proc = await box.startProcess('node --watch /home/user/example-app/server.js');
 const port = await box.ports.expose(3000);
 // proc.pid is live immediately: box.processes.logs(proc.pid) streams output,
 // box.processes.kill(proc.pid) stops it

package/dist/_shared/preview-host.d.ts

@@ -10,25 +10,36 @@
  * `buildPreviewHost` and `parsePreviewHost` are exact inverses: every
  * `(sid, port)` has exactly ONE valid origin. Without that bijection a cookie
  * set on the canonical host is missing from an equivalent-but-different one.
+ *
+ * The middle label may be a NAME instead of a port — `<name>--<sid>` and
+ * `<cap>--<name>--<sid>` — for an application whose reservation carries a
+ * name alias. A numeric label is a port; anything else that is a DNS label
+ * is a name. The scoped name form is resolved to a port inside the session
+ * (its reservation records); the public name form through the directory.
  */
 export interface PreviewHost {
-    port: number;
+    /** The port, on the port forms. Absent on a name form — the name resolves to it. */
+    port?: number;
+    /** The name alias, on the name forms `<name>--<sid>` / `<cap>--<name>--<sid>`. */
+    name?: string;
     sid: string;
     /**
-     * Present only on the public capability form `<cap>--<port>--<sid>`: the
-     * bearer is the capability itself, so the request skips session-attach
-     * auth entirely — the session decides by the port's stored visibility.
+     * Present only on the public capability forms `<cap>--<port>--<sid>` and
+     * `<cap>--<name>--<sid>`: the bearer is the capability itself, so the
+     * request skips session-attach auth entirely — the session decides by the
+     * port's stored visibility.
      */
     capability?: string;
 }
-export declare function buildPreviewHost(sid: string, port: number, suffix: string): string;
+/** `<port>--<sid>` or `<name>--<sid>`: the middle label is a port number or a name alias. */
+export declare function buildPreviewHost(sid: string, target: number | string, suffix: string): string;
 /**
- * `<capability>--<port>--<sid>.<suffix>` — the unauthenticated sibling of
- * `buildPreviewHost`, for applications whose visibility is `public`. The
+ * `<capability>--<port|name>--<sid>.<suffix>` — the unauthenticated sibling
+ * of `buildPreviewHost`, for applications whose visibility is `public`. The
  * capability is the bearer: 24 lowercase hex, the same shape the port
  * registry mints.
  */
-export declare function buildPublicPreviewHost(sid: string, port: number, capability: string, suffix: string): string;
+export declare function buildPublicPreviewHost(sid: string, target: number | string, capability: string, suffix: string): string;
 export declare function isPreviewHostSafeSid(sid: string): boolean;
 /**
  * Read the configured preview-host suffix out of a bindings env.
@@ -39,6 +50,13 @@ export declare function isPreviewHostSafeSid(sid: string): boolean;
  */
 export declare function readPreviewHostSuffix(env: unknown): string | null;
 export declare function parsePreviewHost(host: string, suffix: string | undefined | null): PreviewHost | null;
+/**
+ * A name label: a DNS label that is neither a port (all digits) nor a
+ * capability (24 lowercase hex), and contains no `--` host-label separator.
+ * The same rule the session applies when it stores a
+ * name on a reservation, so every name it accepts is a host it can parse.
+ */
+export declare function isPreviewHostName(label: string): boolean;
 /**
  * True when `url` addresses a port preview. Embedders MUST test this BEFORE
  * their own route table: a preview host serves untrusted user code at the

package/dist/_shared/preview-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preview-host.d.ts","sourceRoot":"","sources":["../../src/_shared/preview-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAcH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAElF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGjE;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAChC,WAAW,GAAG,IAAI,CAgCpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAEpE"}
+{"version":3,"file":"preview-host.d.ts","sourceRoot":"","sources":["../../src/_shared/preview-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkBH,MAAM,WAAW,WAAW;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GAAG,MAAM,EACvB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGjE;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAChC,WAAW,GAAG,IAAI,CA8CpB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAKxD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAEpE"}

package/dist/_shared/preview-host.js

@@ -10,28 +10,39 @@
  * `buildPreviewHost` and `parsePreviewHost` are exact inverses: every
  * `(sid, port)` has exactly ONE valid origin. Without that bijection a cookie
  * set on the canonical host is missing from an equivalent-but-different one.
+ *
+ * The middle label may be a NAME instead of a port — `<name>--<sid>` and
+ * `<cap>--<name>--<sid>` — for an application whose reservation carries a
+ * name alias. A numeric label is a port; anything else that is a DNS label
+ * is a name. The scoped name form is resolved to a port inside the session
+ * (its reservation records); the public name form through the directory.
  */
 const PREVIEW_HOST_SAFE_SID_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
 /** Canonical port form only: no leading zeros, so `03000--x` is not a host. */
 const PREVIEW_HOST_LABEL_RE = /^(0|[1-9]\d*)--(.+)$/;
+/** The scoped name form: a non-numeric DNS label in the port's place. */
+const PREVIEW_NAME_HOST_LABEL_RE = /^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)--([a-z0-9-]{1,63})$/;
 // The public capability form: the bearer is the capability itself, no
 // attach token and no embedder credential ever crosses this hostname.
 // The label carries everything a request needs — which port, which
 // session, and which token — so it works with no server-side lookup.
 const PREVIEW_CAPABILITY_HOST_LABEL_RE = /^([a-f0-9]{24})--(\d{1,5})--([a-z0-9-]{1,63})$/;
+/** The public name form: the capability names the session in the directory, the name is verified there. */
+const PREVIEW_CAPABILITY_NAME_HOST_LABEL_RE = /^([a-f0-9]{24})--([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)--([a-z0-9-]{1,63})$/;
 /** Binding that carries the deployment's preview-host suffix. */
 const PREVIEW_HOST_SUFFIX_BINDING = 'NIMBUS_PREVIEW_HOST_SUFFIX';
-export function buildPreviewHost(sid, port, suffix) {
-    return `${port}--${sid}.${suffix}`;
+/** `<port>--<sid>` or `<name>--<sid>`: the middle label is a port number or a name alias. */
+export function buildPreviewHost(sid, target, suffix) {
+    return `${target}--${sid}.${suffix}`;
 }
 /**
- * `<capability>--<port>--<sid>.<suffix>` — the unauthenticated sibling of
- * `buildPreviewHost`, for applications whose visibility is `public`. The
+ * `<capability>--<port|name>--<sid>.<suffix>` — the unauthenticated sibling
+ * of `buildPreviewHost`, for applications whose visibility is `public`. The
  * capability is the bearer: 24 lowercase hex, the same shape the port
  * registry mints.
  */
-export function buildPublicPreviewHost(sid, port, capability, suffix) {
-    return `${capability}--${port}--${sid}.${suffix}`;
+export function buildPublicPreviewHost(sid, target, capability, suffix) {
+    return `${capability}--${target}--${sid}.${suffix}`;
 }
 export function isPreviewHostSafeSid(sid) {
     return sid.length <= 56 && PREVIEW_HOST_SAFE_SID_RE.test(sid);
@@ -71,14 +82,43 @@ export function parsePreviewHost(host, suffix) {
             return null;
         return { port, sid, capability };
     }
+    const capabilityNameMatch = label.match(PREVIEW_CAPABILITY_NAME_HOST_LABEL_RE);
+    if (capabilityNameMatch) {
+        const capability = capabilityNameMatch[1];
+        const name = capabilityNameMatch[2];
+        const sid = capabilityNameMatch[4];
+        if (!isPreviewHostName(name) || !isPreviewHostSafeSid(sid))
+            return null;
+        return { name, sid, capability };
+    }
     const match = label.match(PREVIEW_HOST_LABEL_RE);
-    if (!match)
+    if (match) {
+        const port = Number(match[1]);
+        const sid = match[2];
+        if (port < 1 || port > 65535 || !isPreviewHostSafeSid(sid))
+            return null;
+        return { port, sid };
+    }
+    const nameMatch = label.match(PREVIEW_NAME_HOST_LABEL_RE);
+    if (!nameMatch)
         return null;
-    const port = Number(match[1]);
-    const sid = match[2];
-    if (port < 1 || port > 65535 || !isPreviewHostSafeSid(sid))
+    const name = nameMatch[1];
+    const sid = nameMatch[3];
+    if (!isPreviewHostName(name) || !isPreviewHostSafeSid(sid))
         return null;
-    return { port, sid };
+    return { name, sid };
+}
+/**
+ * A name label: a DNS label that is neither a port (all digits) nor a
+ * capability (24 lowercase hex), and contains no `--` host-label separator.
+ * The same rule the session applies when it stores a
+ * name on a reservation, so every name it accepts is a host it can parse.
+ */
+export function isPreviewHostName(label) {
+    return /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/.test(label)
+        && !label.includes('--')
+        && !/^\d+$/.test(label)
+        && !/^[a-f0-9]{24}$/.test(label);
 }
 /**
  * True when `url` addresses a port preview. Embedders MUST test this BEFORE

package/dist/cirrus-npm-cjs.generated.d.ts

@@ -6,7 +6,7 @@
  * (react, react-dom, scheduler). Ships as a static Worker asset alongside
  * cirrus-plugin-react.
  * Consumed by src/cirrus-real.ts — injected as LOADER modules, and
- * the Vite resolver's output (e.g. /home/user/app/node_modules/react/index.js)
+ * the Vite resolver's output (e.g. /home/user/example-app/node_modules/react/index.js)
  * is rewritten to point at one of these bundles at request time.
  */
 import { type AssetsFetcher } from '@nimbus-sh/core/runtime/assets-loader.js';

package/dist/cirrus-npm-cjs.generated.js

@@ -6,7 +6,7 @@
  * (react, react-dom, scheduler). Ships as a static Worker asset alongside
  * cirrus-plugin-react.
  * Consumed by src/cirrus-real.ts — injected as LOADER modules, and
- * the Vite resolver's output (e.g. /home/user/app/node_modules/react/index.js)
+ * the Vite resolver's output (e.g. /home/user/example-app/node_modules/react/index.js)
  * is rewritten to point at one of these bundles at request time.
  */
 import { loadAssetText } from '@nimbus-sh/core/runtime/assets-loader.js';

package/dist/facets/cirrus-real.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cirrus-real.d.ts","sourceRoot":"","sources":["../../src/facets/cirrus-real.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAyBH,OAAO,EACL,SAAS,EAIV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAmBtF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACrD,UAAU,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,mBAAmB,CAAC,GAAG,SAAS,CAAC;CACpF,GAAG,OAAO,CAiBV;AA0cD,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,SAAS,CAAyB;IAC1C,OAAO,CAAC,gBAAgB,CAAgB;IACxC,OAAO,CAAC,mBAAmB,CAAyB;IAEpD,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,UAAU,CAAa;IAC/B;6BACyB;IACzB,OAAO,CAAC,UAAU,CAAuB;IACzC;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,CAAgD;IAC7D;;;;4CAIwC;IACxC,OAAO,CAAC,gBAAgB,CAAa;IACrC;2BACuB;IACvB,OAAO,CAAC,YAAY,CAAa;IACjC,OAAO,CAAC,cAAc,CAON;IAEhB,kEAAkE;IAC3D,GAAG,EAAE,SAAS,CAAmB;IAExC,6CAA6C;IAC7C,OAAO,CAAC,SAAS,CAA6B;gBAElC,IAAI,EAAE;QAChB,GAAG,EAAE,GAAG,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,SAAS,CAAC;QACf,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;QACnC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9C;IAWD,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBnC;IAED;;;iEAG6D;IAC7D,OAAO,CAAC,YAAY,CAAc;IAE5B,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmQhE,IAAI,CAAC,GAAG,CAAC,EAAE,kBAAkB,GAAG,IAAI;IAqBpC;;;;OAIG;IACH,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM;IAItC,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIjC,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAItD;;;;OAIG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA8C1E;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAsBzD"}
+{"version":3,"file":"cirrus-real.d.ts","sourceRoot":"","sources":["../../src/facets/cirrus-real.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAyBH,OAAO,EACL,SAAS,EAIV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAmBtF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACrD,UAAU,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,mBAAmB,CAAC,GAAG,SAAS,CAAC;CACpF,GAAG,OAAO,CAiBV;AA0cD,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,SAAS,CAAyB;IAC1C,OAAO,CAAC,gBAAgB,CAAgB;IACxC,OAAO,CAAC,mBAAmB,CAAyB;IAEpD,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,UAAU,CAAa;IAC/B;6BACyB;IACzB,OAAO,CAAC,UAAU,CAAuB;IACzC;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,CAAgD;IAC7D;;;;4CAIwC;IACxC,OAAO,CAAC,gBAAgB,CAAa;IACrC;2BACuB;IACvB,OAAO,CAAC,YAAY,CAAa;IACjC,OAAO,CAAC,cAAc,CAON;IAEhB,kEAAkE;IAC3D,GAAG,EAAE,SAAS,CAAmB;IAExC,6CAA6C;IAC7C,OAAO,CAAC,SAAS,CAA6B;gBAElC,IAAI,EAAE;QAChB,GAAG,EAAE,GAAG,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,SAAS,CAAC;QACf,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;QACnC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9C;IAWD,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBnC;IAED;;;iEAG6D;IAC7D,OAAO,CAAC,YAAY,CAAc;IAE5B,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoQhE,IAAI,CAAC,GAAG,CAAC,EAAE,kBAAkB,GAAG,IAAI;IAqBpC;;;;OAIG;IACH,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM;IAItC,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIjC,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAItD;;;;OAIG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA8C1E;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAsBzD"}

package/dist/facets/cirrus-real.js

@@ -741,11 +741,12 @@ export class CirrusReal {
         // [D'.1] Spawn cirrus-real as a DO Facet, not a Worker.
         //
         // Step A: LOADER.get(stableId, configCb) → DynamicWorker stub. The
-        //   stable ID per-(supervisor-DO + cirrus-real-version) makes the
+        //   stable ID per-(supervisor-DO + cirrus-real-version + pid) makes the
         //   loader cache the bundled vite + plugin code across hibernation.
-        //   Two restarts within the same supervisor isolate hit the warm
-        //   cache; a different DO ID gets a fresh slot.
-        //
+        //   The pid is in the key because env.SUPERVISOR bakes it — a wake
+        //   strides pids, and a warm worker credentialed to the dead pid
+        //   would fail every supervisor RPC with "process pid … does not
+        //   exist". Two restarts on the same pid hit the warm cache.
         // Step B: worker.getDurableObjectClass('CirrusRealVite') → the
         //   class constructor from the dynamic worker's exports. Same
         //   pattern facet-manager.ts uses for NodeProcess.
@@ -756,7 +757,7 @@ export class CirrusReal {
         //   DO so eviction is coherent. The same name returns the same
         //   facet on subsequent calls — that's what makes the cookie
         //   persist across supervisor reconnects.
-        const stableLoaderId = `${ctx.id.toString()}:cirrus-real-vite:${REAL_VITE_VERSION}`;
+        const stableLoaderId = `${ctx.id.toString()}:cirrus-real-vite:${REAL_VITE_VERSION}:${pid}`;
         const facetName = 'cirrus-real-vite';
         try {
             const worker = this.env.LOADER.get(stableLoaderId, async () => ({

package/dist/facets/compose.d.ts

@@ -0,0 +1,148 @@
+/**
+ * facets/compose.ts — the one composition of a FacetManager.
+ *
+ * A FacetManager is the session's spawn path for every resident process —
+ * `spawnWorker`, `spawnNode`, the launch journal, `_redrive`, cold-start
+ * recovery and the paced launch pump — and until this module it was
+ * constructed in exactly one place, inside NimbusSession, with hooks that
+ * closed over the session. An embedder that composes NimbusWorkspace as a
+ * library over its own Durable Object has no session and must not boot one
+ * over its filesystem (a second process table hands out pids whose write
+ * authority the filesystem already revoked), so everything behind the
+ * manager was closed to it.
+ *
+ * `composeFacetManager` is that construction, taking exactly what an
+ * embedder can supply: the Durable Object's ctx and env, its process
+ * supervisor, port registry and SQLite filesystem, an optional shared
+ * esbuild service, and the hooks a host has to answer. NimbusSession's own
+ * `ensureFacetManager` calls this same factory — there is one path — and
+ * keeps only what is session-specific (terminal writes, scrollback notices,
+ * the alarm that grants launch turns) inside its hook implementations.
+ *
+ * What the factory owns and the host does not:
+ *
+ *   - `transformLargeEsm`: the isolated esbuild transform for module text
+ *     past the in-isolate size bound. It needs `env.LOADER`, `env.ASSETS`
+ *     and `ctx.facets` and nothing of any host, so it is the factory's
+ *     default rather than every host's copy.
+ *   - `resolveWorkerLaunchFallback`: the durable image-store resolver a
+ *     self-owned worker launch (the session's python/ruby residents, or an
+ *     embedder spawn that let the manager persist its image) re-drives
+ *     from. It needs only the filesystem. An embedder that keeps its own
+ *     content store answers `resolveWorkerLaunch` and this is never reached
+ *     for its recipes (see `WorkerRecipe.resident`).
+ */
+import type { SqliteVFS } from '@nimbus-sh/core/vfs/sqlite-vfs.js';
+import type { PortRegistry } from '@nimbus-sh/core/runtime/port-registry.js';
+import type { SessionProcessSupervisor } from '@nimbus-sh/core/runtime/session-process-supervisor.js';
+import type { EsbuildService } from '@nimbus-sh/core/runtime/esbuild-service.js';
+import { FacetManager, type FacetManagerHooks } from './manager.js';
+import { type PortVisibility } from '../session/port-capability.js';
+export type { FacetManagerHooks, LongRunningWorkerSpawnOptions, ResidentSpawnOptions, ResolvedWorkerLaunch, ResidentAppSummary, ResidentIdentity, ResidentRestartPolicy, SpawnedWorker, WorkerFacet, WorkerRecipe, } from './manager.js';
+export { FacetManager, DEFAULT_WORKER_MAIN_MODULE } from './manager.js';
+/**
+ * The hooks a host answers. Names and types are the FacetManager's own
+ * (`FacetManagerHooks`); the three a host cannot do without are required
+ * here because a manager composed without them loses launches silently —
+ * a launch turn nobody grants never resumes, an exit nobody hears leaves a
+ * process table lying, a notice nobody shows is a reset the user never
+ * learns about.
+ */
+export interface FacetManagerHostHooks {
+    onExternalExit: NonNullable<FacetManagerHooks['onExternalExit']>;
+    notify: NonNullable<FacetManagerHooks['notify']>;
+    requestLaunchTurn: NonNullable<FacetManagerHooks['requestLaunchTurn']>;
+    onSpawn?: FacetManagerHooks['onSpawn'];
+    resolveWorkerLaunch?: FacetManagerHooks['resolveWorkerLaunch'];
+}
+/** Everything a FacetManager is composed over. */
+export interface FacetManagerDeps {
+    ctx: DurableObjectState;
+    /** The Worker's bindings: `LOADER` is required, `ASSETS` serves the esbuild wasm. */
+    env: unknown;
+    processes: SessionProcessSupervisor;
+    portRegistry: PortRegistry;
+    vfs: SqliteVFS;
+    /** A host's already-warm esbuild, shared so the wasm is initialized once. */
+    esbuild?: EsbuildService;
+    hooks: FacetManagerHostHooks;
+}
+/** What `composeFacetManager` hands back. */
+export interface ComposedFacetManager {
+    manager: FacetManager;
+    /**
+     * The paced launch pump — the manager's own `pumpResidentLaunches`, not a
+     * second one. The host drives it from the turn `hooks.requestLaunchTurn`
+     * arranged (the session: its `'resident-launch'` alarm); the first pump on
+     * a fresh incarnation also drains cold-start recovery of the launch
+     * journal (fabric's `FencedWork.recoverInterrupted`, registered on the
+     * manager's `onColdStart`), so it is the cold-start recovery entry too:
+     * the session calls it once from initSession for exactly that reason.
+     */
+    pumpLaunches: () => Promise<void>;
+    /**
+     * The durable-application verbs a host answers for its embedder — the
+     * session answers the same four through its `_rpc*` surface. Each is a
+     * short composition of the exported port-capability primitives
+     * (`@nimbus-sh/worker/port-capability`) and the manager's own methods, so
+     * an embedder that wants a different composition has every piece; what is
+     * NOT here is what only the session has (dev-server restore, HMR sockets,
+     * the self-refreshing "starting" page).
+     */
+    apps: {
+        /**
+         * Reserve (or re-answer) the port `owner` holds, minting the capability
+         * its URL is built on — minted here, stored on the reservation, so a URL
+         * handed out before the application has ever booted is the one its
+         * eventual binding re-adopts, and the one a reset re-adopts again.
+         */
+        ensureDurableApp(input: {
+            owner: string;
+            preferredPort?: number;
+            visibility?: PortVisibility;
+            name?: string;
+        }): Promise<{
+            port: number;
+            capability: string | null;
+            visibility: PortVisibility;
+        }>;
+        /**
+         * End a durable application's contract: every launch the owner claims is
+         * killed, its journal rows purged, its port released and its durable slot
+         * freed. `port` is the address that was held; `removed` is false only
+         * when no durable application held that owner at all.
+         */
+        removeDurableApp(owner: string): Promise<{
+            owner: string;
+            removed: boolean;
+            port: number | null;
+        }>;
+        /**
+         * Every registered port with its live capability, persisted at the
+         * moment the embedder is told it — a capability nobody has been handed
+         * does not need to survive anything.
+         */
+        listPorts(): Promise<Array<{
+            port: number;
+            pid: number;
+            registeredAt: number;
+            capability: string;
+        }>>;
+        /**
+         * Route a request carrying a port capability to the process on `port`:
+         * a durable application a reset left dead is re-driven first
+         * (`manager.ensureDurableAppOnPort`), the persisted capability is
+         * re-adopted, and a wrong capability is a 404 — never a 403, which would
+         * confirm the port is listening. 503 with `Retry-After` while a re-drive
+         * is mid-launch; 502 when nothing serves the port. WebSocket upgrades
+         * keep fetch semantics through the registered facet.
+         */
+        routeCapabilityPort(port: number, capability: string, request: Request, innerPath: string): Promise<Response>;
+    };
+}
+/**
+ * Compose a FacetManager over a host's own ctx, env, process supervisor, port
+ * registry and filesystem. See the module comment for what is defaulted.
+ */
+export declare function composeFacetManager(deps: FacetManagerDeps): ComposedFacetManager;
+//# sourceMappingURL=compose.d.ts.map

package/dist/facets/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/facets/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAEjF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAqB,MAAM,cAAc,CAAC;AAGvF,OAAO,EAML,KAAK,cAAc,EACpB,MAAM,+BAA+B,CAAC;AASvC,YAAY,EACV,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,WAAW,EACX,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,WAAW,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC,mBAAmB,CAAC,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;CAChE;AAED,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,kBAAkB,CAAC;IACxB,qFAAqF;IACrF,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,wBAAwB,CAAC;IACpC,YAAY,EAAE,YAAY,CAAC;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,6EAA6E;IAC7E,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,qBAAqB,CAAC;CAC9B;AAED,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,YAAY,CAAC;IACtB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;;;;;;;;OAQG;IACH,IAAI,EAAE;QACJ;;;;;WAKG;QACH,gBAAgB,CAAC,KAAK,EAAE;YACtB,KAAK,EAAE,MAAM,CAAC;YACd,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,UAAU,CAAC,EAAE,cAAc,CAAC;YAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;SACf,GAAG,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,UAAU,EAAE,cAAc,CAAA;SAAE,CAAC,CAAC;QACrF;;;;;WAKG;QACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QACnG;;;;WAIG;QACH,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC,CAAC;QACrG;;;;;;;;WAQG;QACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC/G,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,oBAAoB,CA8EhF"}

package/dist/facets/compose.js

@@ -0,0 +1,146 @@
+/**
+ * facets/compose.ts — the one composition of a FacetManager.
+ *
+ * A FacetManager is the session's spawn path for every resident process —
+ * `spawnWorker`, `spawnNode`, the launch journal, `_redrive`, cold-start
+ * recovery and the paced launch pump — and until this module it was
+ * constructed in exactly one place, inside NimbusSession, with hooks that
+ * closed over the session. An embedder that composes NimbusWorkspace as a
+ * library over its own Durable Object has no session and must not boot one
+ * over its filesystem (a second process table hands out pids whose write
+ * authority the filesystem already revoked), so everything behind the
+ * manager was closed to it.
+ *
+ * `composeFacetManager` is that construction, taking exactly what an
+ * embedder can supply: the Durable Object's ctx and env, its process
+ * supervisor, port registry and SQLite filesystem, an optional shared
+ * esbuild service, and the hooks a host has to answer. NimbusSession's own
+ * `ensureFacetManager` calls this same factory — there is one path — and
+ * keeps only what is session-specific (terminal writes, scrollback notices,
+ * the alarm that grants launch turns) inside its hook implementations.
+ *
+ * What the factory owns and the host does not:
+ *
+ *   - `transformLargeEsm`: the isolated esbuild transform for module text
+ *     past the in-isolate size bound. It needs `env.LOADER`, `env.ASSETS`
+ *     and `ctx.facets` and nothing of any host, so it is the factory's
+ *     default rather than every host's copy.
+ *   - `resolveWorkerLaunchFallback`: the durable image-store resolver a
+ *     self-owned worker launch (the session's python/ruby residents, or an
+ *     embedder spawn that let the manager persist its image) re-drives
+ *     from. It needs only the filesystem. An embedder that keeps its own
+ *     content store answers `resolveWorkerLaunch` and this is never reached
+ *     for its recipes (see `WorkerRecipe.resident`).
+ */
+import { createPortCapability } from '@nimbus-sh/core/runtime/port-registry.js';
+import { FacetManager } from './manager.js';
+import { processHostFor } from '../loaders/process-host.js';
+import { resolveDurableWorkerImage } from './durable-images.js';
+import { persistPortCapability, readPortReservation, readPortReservationByOwner, reservePort, routeCapabilityPort, } from '../session/port-capability.js';
+import { bindPublicPortCapability } from '../router/public-directory.js';
+import { ESBUILD_TRANSFORM_WORKER_ID, esbuildTransformWorkerCode, } from './esbuild-transform.js';
+import { fetchEsbuildWasmBytes } from '../runtime/esbuild-wasm-bytes.js';
+export { FacetManager, DEFAULT_WORKER_MAIN_MODULE } from './manager.js';
+/**
+ * Compose a FacetManager over a host's own ctx, env, process supervisor, port
+ * registry and filesystem. See the module comment for what is defaulted.
+ */
+export function composeFacetManager(deps) {
+    const { ctx, env, vfs } = deps;
+    const hooks = {
+        onExternalExit: deps.hooks.onExternalExit,
+        notify: deps.hooks.notify,
+        requestLaunchTurn: deps.hooks.requestLaunchTurn,
+        ...(deps.hooks.onSpawn !== undefined ? { onSpawn: deps.hooks.onSpawn } : {}),
+        ...(deps.hooks.resolveWorkerLaunch !== undefined
+            ? { resolveWorkerLaunch: deps.hooks.resolveWorkerLaunch }
+            : {}),
+        transformLargeEsm: isolatedEsmTransform(ctx, env),
+        resolveWorkerLaunchFallback: (recipe) => resolveDurableWorkerImage(vfs, recipe),
+    };
+    const manager = new FacetManager(ctx, env, deps.processes, deps.portRegistry, processHostFor, hooks);
+    manager.setVfs(vfs);
+    if (deps.esbuild)
+        manager.setEsbuildService(deps.esbuild);
+    const { portRegistry } = deps;
+    const capabilityHost = { ctx, portRegistry };
+    return {
+        manager,
+        pumpLaunches: () => manager.pumpResidentLaunches(),
+        apps: {
+            async ensureDurableApp(input) {
+                if (typeof input.owner !== 'string' || input.owner.length === 0) {
+                    throw new Error('ensureDurableApp: owner must be a non-empty string');
+                }
+                const occupied = new Set(portRegistry.getAll().map((entry) => entry.port));
+                const port = await reservePort(ctx, {
+                    owner: input.owner,
+                    preferredPort: input.preferredPort,
+                    occupiedPorts: occupied,
+                    capability: createPortCapability(),
+                    ...(input.visibility !== undefined ? { visibility: input.visibility } : {}),
+                    ...(input.name !== undefined ? { name: input.name } : {}),
+                });
+                const record = await readPortReservation(ctx, port);
+                if (record?.visibility === 'public' && record.capability !== null) {
+                    // A no-op for a host whose Durable Object is not a session (the
+                    // public directory keys on the session name); loud when it is a
+                    // session without the binding.
+                    await bindPublicPortCapability({ env, ctx }, record.capability, port, input.name);
+                }
+                return {
+                    port,
+                    capability: record?.capability ?? null,
+                    visibility: record?.visibility ?? 'scoped',
+                };
+            },
+            async removeDurableApp(owner) {
+                if (typeof owner !== 'string' || owner.length === 0) {
+                    throw new Error('removeDurableApp: owner must be a non-empty string');
+                }
+                const held = await readPortReservationByOwner(ctx, owner);
+                const removed = await manager.removeDurableApp(owner);
+                return { owner, removed, port: held?.port ?? null };
+            },
+            async listPorts() {
+                const entries = portRegistry.getAll();
+                await Promise.all(entries.map((entry) => persistPortCapability(capabilityHost, entry.port, entry.capability)));
+                return entries.map((entry) => ({
+                    port: Number(entry.port),
+                    pid: Number(entry.pid),
+                    registeredAt: Number(entry.registeredAt),
+                    capability: String(entry.capability),
+                }));
+            },
+            routeCapabilityPort(port, capability, request, innerPath) {
+                // The session's routeToSessionPort is the one implementation —
+                // the capability gate AND the public-bearer visibility gate live
+                // there; a copy here dropped the latter. Session-only concerns
+                // (dev-server restore, the vite-shim branch) no-op on this host.
+                return routeCapabilityPort({ ctx, portRegistry, ensureDurableAppOnPort: (p) => manager.ensureDurableAppOnPort(p) }, port, capability, request, innerPath);
+            },
+        },
+    };
+}
+/**
+ * The isolated esbuild transform: module text past the in-isolate bound is
+ * transformed in a loader-backed facet that owns the esbuild wasm heap, so the
+ * host isolate never pays for it. Session-independent by construction —
+ * `env.LOADER`, `env.ASSETS` and `ctx.facets` are all it reads.
+ */
+function isolatedEsmTransform(ctx, env) {
+    return async (code, options) => {
+        const loader = Reflect.get(Object(env), 'LOADER');
+        if (!loader || typeof loader.get !== 'function') {
+            throw new Error('Nimbus: env.LOADER unavailable for isolated esbuild transform');
+        }
+        const assets = Reflect.get(Object(env), 'ASSETS');
+        if (!assets || typeof assets.fetch !== 'function') {
+            throw new Error('Nimbus: env.ASSETS unavailable for isolated esbuild transform');
+        }
+        const worker = await loader.get(ESBUILD_TRANSFORM_WORKER_ID, async () => esbuildTransformWorkerCode(await fetchEsbuildWasmBytes({ ASSETS: assets })));
+        const transformClass = worker.getDurableObjectClass('EsbuildTransformFacet');
+        const facet = ctx.facets.get(`esbuild-transform-${ESBUILD_TRANSFORM_WORKER_ID}`, async () => ({ class: transformClass }));
+        return facet.transform(code, options);
+    };
+}

package/dist/facets/durable-images.d.ts

@@ -12,17 +12,26 @@
  * durable spawn exists to survive. Durable images are kept for the
  * application's life and released only by explicit removal.
  *
- * Two blobs per launch: `runner` is the worker.js source text, `application`
- * is a JSON payload of `{ modules, env, vfsWasmModules }`. The digests in the
- * journal's `recipe.image` are sha256 hashes of those two payloads, and a
- * self-owned spawn mints them at spawn time; an embedder-owned spawn is given
- * them by its own bookkeeping instead.
+ * Two blobs per launch: `runner` is the main module's source text,
+ * `application` is a JSON payload of `{ modules, env, vfsWasmModules }` plus,
+ * when the launch set them, `vfsTextModules`, `mainModule` and `startArgs`.
+ * The digests in the journal's `recipe.image` are sha256 hashes of those two
+ * payloads, and a self-owned spawn mints them at spawn time; an
+ * embedder-owned spawn is given them by its own bookkeeping instead.
  */
 import type { SqliteVFS } from '@nimbus-sh/core/vfs/sqlite-vfs.js';
 import type { ResidentCodeSpec } from '@nimbus-sh/fabric/process-fabric.js';
 import type { ResolvedWorkerLaunch, WorkerRecipe } from './manager.js';
 /** The directory every durable application's image blobs live under. */
 export declare const DURABLE_IMAGE_DIR = ".nimbus/images";
+/** Remove only the owner's blobs that no other retained recipe references. */
+export declare function purgeDurableWorkerImages(vfs: SqliteVFS, owned: Iterable<{
+    runner: string;
+    application: string;
+}>, retained: Iterable<{
+    runner: string;
+    application: string;
+}>): number;
 /**
  * Persist a launch's image blobs, minting their digests, for a self-owned
  * durable spawn. Reads and writes as CRED_KERNEL: the directory is session
@@ -35,6 +44,10 @@ export declare function persistDurableWorkerImage(vfs: SqliteVFS, workerCode: st
     }>;
     env?: ResidentCodeSpec['env'];
     vfsWasmModules?: Record<string, string>;
+    vfsTextModules?: Record<string, string>;
+    /** Recorded only when the launch named one; absent means `worker.js`. */
+    mainModule?: string;
+    startArgs?: unknown;
 }): Promise<{
     runner: string;
     application: string;

package/dist/facets/durable-images.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"durable-images.d.ts","sourceRoot":"","sources":["../../src/facets/durable-images.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvE,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AASlD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,SAAS,EACd,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IACP,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IACxD,GAAG,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACzC,GACA,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAalD;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAwBtC"}
+{"version":3,"file":"durable-images.d.ts","sourceRoot":"","sources":["../../src/facets/durable-images.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvE,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAIlD,8EAA8E;AAC9E,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,EACxD,QAAQ,EAAE,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,GAC1D,MAAM,CAaR;AAOD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,SAAS,EACd,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IACP,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IACxD,GAAG,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBlD;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAiCtC"}