@nimbus-sh/worker 0.6.0 → 0.8.0

package/README.md

@@ -216,8 +216,8 @@ config })`. The route requires a valid Nimbus JWT and `sandbox:use` scope.
 For an app server, start the process and expose its virtual port:
 
 ```ts
-await box.files.write('/home/user/app/server.js', serverSource);
-const proc = await box.startProcess('node --watch /home/user/app/server.js');
+await box.files.write('/home/user/example-app/server.js', serverSource);
+const proc = await box.startProcess('node --watch /home/user/example-app/server.js');
 const port = await box.ports.expose(3000);
 // proc.pid is live immediately: box.processes.logs(proc.pid) streams output,
 // box.processes.kill(proc.pid) stops it

package/dist/cirrus-npm-cjs.generated.d.ts

@@ -6,7 +6,7 @@
  * (react, react-dom, scheduler). Ships as a static Worker asset alongside
  * cirrus-plugin-react.
  * Consumed by src/cirrus-real.ts — injected as LOADER modules, and
- * the Vite resolver's output (e.g. /home/user/app/node_modules/react/index.js)
+ * the Vite resolver's output (e.g. /home/user/example-app/node_modules/react/index.js)
  * is rewritten to point at one of these bundles at request time.
  */
 import { type AssetsFetcher } from '@nimbus-sh/core/runtime/assets-loader.js';

package/dist/cirrus-npm-cjs.generated.js

@@ -6,7 +6,7 @@
  * (react, react-dom, scheduler). Ships as a static Worker asset alongside
  * cirrus-plugin-react.
  * Consumed by src/cirrus-real.ts — injected as LOADER modules, and
- * the Vite resolver's output (e.g. /home/user/app/node_modules/react/index.js)
+ * the Vite resolver's output (e.g. /home/user/example-app/node_modules/react/index.js)
  * is rewritten to point at one of these bundles at request time.
  */
 import { loadAssetText } from '@nimbus-sh/core/runtime/assets-loader.js';

package/dist/facets/cirrus-real.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cirrus-real.d.ts","sourceRoot":"","sources":["../../src/facets/cirrus-real.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAyBH,OAAO,EACL,SAAS,EAIV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAmBtF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACrD,UAAU,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,mBAAmB,CAAC,GAAG,SAAS,CAAC;CACpF,GAAG,OAAO,CAiBV;AA0cD,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,SAAS,CAAyB;IAC1C,OAAO,CAAC,gBAAgB,CAAgB;IACxC,OAAO,CAAC,mBAAmB,CAAyB;IAEpD,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,UAAU,CAAa;IAC/B;6BACyB;IACzB,OAAO,CAAC,UAAU,CAAuB;IACzC;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,CAAgD;IAC7D;;;;4CAIwC;IACxC,OAAO,CAAC,gBAAgB,CAAa;IACrC;2BACuB;IACvB,OAAO,CAAC,YAAY,CAAa;IACjC,OAAO,CAAC,cAAc,CAON;IAEhB,kEAAkE;IAC3D,GAAG,EAAE,SAAS,CAAmB;IAExC,6CAA6C;IAC7C,OAAO,CAAC,SAAS,CAA6B;gBAElC,IAAI,EAAE;QAChB,GAAG,EAAE,GAAG,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,SAAS,CAAC;QACf,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;QACnC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9C;IAWD,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBnC;IAED;;;iEAG6D;IAC7D,OAAO,CAAC,YAAY,CAAc;IAE5B,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmQhE,IAAI,CAAC,GAAG,CAAC,EAAE,kBAAkB,GAAG,IAAI;IAqBpC;;;;OAIG;IACH,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM;IAItC,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIjC,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAItD;;;;OAIG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA8C1E;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAsBzD"}
+{"version":3,"file":"cirrus-real.d.ts","sourceRoot":"","sources":["../../src/facets/cirrus-real.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAyBH,OAAO,EACL,SAAS,EAIV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAmBtF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE;IACtC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACrD,UAAU,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,mBAAmB,CAAC,GAAG,SAAS,CAAC;CACpF,GAAG,OAAO,CAiBV;AA0cD,qBAAa,UAAU;IACrB,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,GAAG,CAAkB;IAC7B,OAAO,CAAC,SAAS,CAAyB;IAC1C,OAAO,CAAC,gBAAgB,CAAgB;IACxC,OAAO,CAAC,mBAAmB,CAAyB;IAEpD,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,UAAU,CAAa;IAC/B;6BACyB;IACzB,OAAO,CAAC,UAAU,CAAuB;IACzC;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,CAAgD;IAC7D;;;;4CAIwC;IACxC,OAAO,CAAC,gBAAgB,CAAa;IACrC;2BACuB;IACvB,OAAO,CAAC,YAAY,CAAa;IACjC,OAAO,CAAC,cAAc,CAON;IAEhB,kEAAkE;IAC3D,GAAG,EAAE,SAAS,CAAmB;IAExC,6CAA6C;IAC7C,OAAO,CAAC,SAAS,CAA6B;gBAElC,IAAI,EAAE;QAChB,GAAG,EAAE,GAAG,CAAC;QACT,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,SAAS,CAAC;QACf,SAAS,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;QACnC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9C;IAWD,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgBnC;IAED;;;iEAG6D;IAC7D,OAAO,CAAC,YAAY,CAAc;IAE5B,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoQhE,IAAI,CAAC,GAAG,CAAC,EAAE,kBAAkB,GAAG,IAAI;IAqBpC;;;;OAIG;IACH,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM;IAItC,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIjC,uBAAuB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI;IAItD;;;;OAIG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IA8C1E;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAsBzD"}

package/dist/facets/cirrus-real.js

@@ -741,11 +741,12 @@ export class CirrusReal {
         // [D'.1] Spawn cirrus-real as a DO Facet, not a Worker.
         //
         // Step A: LOADER.get(stableId, configCb) → DynamicWorker stub. The
-        //   stable ID per-(supervisor-DO + cirrus-real-version) makes the
+        //   stable ID per-(supervisor-DO + cirrus-real-version + pid) makes the
         //   loader cache the bundled vite + plugin code across hibernation.
-        //   Two restarts within the same supervisor isolate hit the warm
-        //   cache; a different DO ID gets a fresh slot.
-        //
+        //   The pid is in the key because env.SUPERVISOR bakes it — a wake
+        //   strides pids, and a warm worker credentialed to the dead pid
+        //   would fail every supervisor RPC with "process pid … does not
+        //   exist". Two restarts on the same pid hit the warm cache.
         // Step B: worker.getDurableObjectClass('CirrusRealVite') → the
         //   class constructor from the dynamic worker's exports. Same
         //   pattern facet-manager.ts uses for NodeProcess.
@@ -756,7 +757,7 @@ export class CirrusReal {
         //   DO so eviction is coherent. The same name returns the same
         //   facet on subsequent calls — that's what makes the cookie
         //   persist across supervisor reconnects.
-        const stableLoaderId = `${ctx.id.toString()}:cirrus-real-vite:${REAL_VITE_VERSION}`;
+        const stableLoaderId = `${ctx.id.toString()}:cirrus-real-vite:${REAL_VITE_VERSION}:${pid}`;
         const facetName = 'cirrus-real-vite';
         try {
             const worker = this.env.LOADER.get(stableLoaderId, async () => ({

package/dist/facets/compose.d.ts

@@ -0,0 +1,148 @@
+/**
+ * facets/compose.ts — the one composition of a FacetManager.
+ *
+ * A FacetManager is the session's spawn path for every resident process —
+ * `spawnWorker`, `spawnNode`, the launch journal, `_redrive`, cold-start
+ * recovery and the paced launch pump — and until this module it was
+ * constructed in exactly one place, inside NimbusSession, with hooks that
+ * closed over the session. An embedder that composes NimbusWorkspace as a
+ * library over its own Durable Object has no session and must not boot one
+ * over its filesystem (a second process table hands out pids whose write
+ * authority the filesystem already revoked), so everything behind the
+ * manager was closed to it.
+ *
+ * `composeFacetManager` is that construction, taking exactly what an
+ * embedder can supply: the Durable Object's ctx and env, its process
+ * supervisor, port registry and SQLite filesystem, an optional shared
+ * esbuild service, and the hooks a host has to answer. NimbusSession's own
+ * `ensureFacetManager` calls this same factory — there is one path — and
+ * keeps only what is session-specific (terminal writes, scrollback notices,
+ * the alarm that grants launch turns) inside its hook implementations.
+ *
+ * What the factory owns and the host does not:
+ *
+ *   - `transformLargeEsm`: the isolated esbuild transform for module text
+ *     past the in-isolate size bound. It needs `env.LOADER`, `env.ASSETS`
+ *     and `ctx.facets` and nothing of any host, so it is the factory's
+ *     default rather than every host's copy.
+ *   - `resolveWorkerLaunchFallback`: the durable image-store resolver a
+ *     self-owned worker launch (the session's python/ruby residents, or an
+ *     embedder spawn that let the manager persist its image) re-drives
+ *     from. It needs only the filesystem. An embedder that keeps its own
+ *     content store answers `resolveWorkerLaunch` and this is never reached
+ *     for its recipes (see `WorkerRecipe.resident`).
+ */
+import type { SqliteVFS } from '@nimbus-sh/core/vfs/sqlite-vfs.js';
+import type { PortRegistry } from '@nimbus-sh/core/runtime/port-registry.js';
+import type { SessionProcessSupervisor } from '@nimbus-sh/core/runtime/session-process-supervisor.js';
+import type { EsbuildService } from '@nimbus-sh/core/runtime/esbuild-service.js';
+import { FacetManager, type FacetManagerHooks } from './manager.js';
+import { type PortVisibility } from '../session/port-capability.js';
+export type { FacetManagerHooks, LongRunningWorkerSpawnOptions, ResidentSpawnOptions, ResolvedWorkerLaunch, ResidentAppSummary, ResidentIdentity, ResidentRestartPolicy, SpawnedWorker, WorkerFacet, WorkerRecipe, } from './manager.js';
+export { FacetManager, DEFAULT_WORKER_MAIN_MODULE } from './manager.js';
+/**
+ * The hooks a host answers. Names and types are the FacetManager's own
+ * (`FacetManagerHooks`); the three a host cannot do without are required
+ * here because a manager composed without them loses launches silently —
+ * a launch turn nobody grants never resumes, an exit nobody hears leaves a
+ * process table lying, a notice nobody shows is a reset the user never
+ * learns about.
+ */
+export interface FacetManagerHostHooks {
+    onExternalExit: NonNullable<FacetManagerHooks['onExternalExit']>;
+    notify: NonNullable<FacetManagerHooks['notify']>;
+    requestLaunchTurn: NonNullable<FacetManagerHooks['requestLaunchTurn']>;
+    onSpawn?: FacetManagerHooks['onSpawn'];
+    resolveWorkerLaunch?: FacetManagerHooks['resolveWorkerLaunch'];
+}
+/** Everything a FacetManager is composed over. */
+export interface FacetManagerDeps {
+    ctx: DurableObjectState;
+    /** The Worker's bindings: `LOADER` is required, `ASSETS` serves the esbuild wasm. */
+    env: unknown;
+    processes: SessionProcessSupervisor;
+    portRegistry: PortRegistry;
+    vfs: SqliteVFS;
+    /** A host's already-warm esbuild, shared so the wasm is initialized once. */
+    esbuild?: EsbuildService;
+    hooks: FacetManagerHostHooks;
+}
+/** What `composeFacetManager` hands back. */
+export interface ComposedFacetManager {
+    manager: FacetManager;
+    /**
+     * The paced launch pump — the manager's own `pumpResidentLaunches`, not a
+     * second one. The host drives it from the turn `hooks.requestLaunchTurn`
+     * arranged (the session: its `'resident-launch'` alarm); the first pump on
+     * a fresh incarnation also drains cold-start recovery of the launch
+     * journal (fabric's `FencedWork.recoverInterrupted`, registered on the
+     * manager's `onColdStart`), so it is the cold-start recovery entry too:
+     * the session calls it once from initSession for exactly that reason.
+     */
+    pumpLaunches: () => Promise<void>;
+    /**
+     * The durable-application verbs a host answers for its embedder — the
+     * session answers the same four through its `_rpc*` surface. Each is a
+     * short composition of the exported port-capability primitives
+     * (`@nimbus-sh/worker/port-capability`) and the manager's own methods, so
+     * an embedder that wants a different composition has every piece; what is
+     * NOT here is what only the session has (dev-server restore, HMR sockets,
+     * the self-refreshing "starting" page).
+     */
+    apps: {
+        /**
+         * Reserve (or re-answer) the port `owner` holds, minting the capability
+         * its URL is built on — minted here, stored on the reservation, so a URL
+         * handed out before the application has ever booted is the one its
+         * eventual binding re-adopts, and the one a reset re-adopts again.
+         */
+        ensureDurableApp(input: {
+            owner: string;
+            preferredPort?: number;
+            visibility?: PortVisibility;
+            name?: string;
+        }): Promise<{
+            port: number;
+            capability: string | null;
+            visibility: PortVisibility;
+        }>;
+        /**
+         * End a durable application's contract: every launch the owner claims is
+         * killed, its journal rows purged, its port released and its durable slot
+         * freed. `port` is the address that was held; `removed` is false only
+         * when no durable application held that owner at all.
+         */
+        removeDurableApp(owner: string): Promise<{
+            owner: string;
+            removed: boolean;
+            port: number | null;
+        }>;
+        /**
+         * Every registered port with its live capability, persisted at the
+         * moment the embedder is told it — a capability nobody has been handed
+         * does not need to survive anything.
+         */
+        listPorts(): Promise<Array<{
+            port: number;
+            pid: number;
+            registeredAt: number;
+            capability: string;
+        }>>;
+        /**
+         * Route a request carrying a port capability to the process on `port`:
+         * a durable application a reset left dead is re-driven first
+         * (`manager.ensureDurableAppOnPort`), the persisted capability is
+         * re-adopted, and a wrong capability is a 404 — never a 403, which would
+         * confirm the port is listening. 503 with `Retry-After` while a re-drive
+         * is mid-launch; 502 when nothing serves the port. WebSocket upgrades
+         * keep fetch semantics through the registered facet.
+         */
+        routeCapabilityPort(port: number, capability: string, request: Request, innerPath: string): Promise<Response>;
+    };
+}
+/**
+ * Compose a FacetManager over a host's own ctx, env, process supervisor, port
+ * registry and filesystem. See the module comment for what is defaulted.
+ */
+export declare function composeFacetManager(deps: FacetManagerDeps): ComposedFacetManager;
+//# sourceMappingURL=compose.d.ts.map

package/dist/facets/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/facets/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACtG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4CAA4C,CAAC;AAEjF,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAqB,MAAM,cAAc,CAAC;AAGvF,OAAO,EAML,KAAK,cAAc,EACpB,MAAM,+BAA+B,CAAC;AASvC,YAAY,EACV,iBAAiB,EACjB,6BAA6B,EAC7B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,WAAW,EACX,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,WAAW,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACjE,MAAM,EAAE,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjD,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACvC,mBAAmB,CAAC,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,CAAC;CAChE;AAED,kDAAkD;AAClD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,kBAAkB,CAAC;IACxB,qFAAqF;IACrF,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,wBAAwB,CAAC;IACpC,YAAY,EAAE,YAAY,CAAC;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,6EAA6E;IAC7E,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,qBAAqB,CAAC;CAC9B;AAED,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,YAAY,CAAC;IACtB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;;;;;;;;OAQG;IACH,IAAI,EAAE;QACJ;;;;;WAKG;QACH,gBAAgB,CAAC,KAAK,EAAE;YACtB,KAAK,EAAE,MAAM,CAAC;YACd,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,UAAU,CAAC,EAAE,cAAc,CAAC;YAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;SACf,GAAG,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,UAAU,EAAE,cAAc,CAAA;SAAE,CAAC,CAAC;QACrF;;;;;WAKG;QACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,CAAC;YAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QACnG;;;;WAIG;QACH,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC,CAAC;QACrG;;;;;;;;WAQG;QACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC/G,CAAC;CACH;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,GAAG,oBAAoB,CA8EhF"}

package/dist/facets/compose.js

@@ -0,0 +1,146 @@
+/**
+ * facets/compose.ts — the one composition of a FacetManager.
+ *
+ * A FacetManager is the session's spawn path for every resident process —
+ * `spawnWorker`, `spawnNode`, the launch journal, `_redrive`, cold-start
+ * recovery and the paced launch pump — and until this module it was
+ * constructed in exactly one place, inside NimbusSession, with hooks that
+ * closed over the session. An embedder that composes NimbusWorkspace as a
+ * library over its own Durable Object has no session and must not boot one
+ * over its filesystem (a second process table hands out pids whose write
+ * authority the filesystem already revoked), so everything behind the
+ * manager was closed to it.
+ *
+ * `composeFacetManager` is that construction, taking exactly what an
+ * embedder can supply: the Durable Object's ctx and env, its process
+ * supervisor, port registry and SQLite filesystem, an optional shared
+ * esbuild service, and the hooks a host has to answer. NimbusSession's own
+ * `ensureFacetManager` calls this same factory — there is one path — and
+ * keeps only what is session-specific (terminal writes, scrollback notices,
+ * the alarm that grants launch turns) inside its hook implementations.
+ *
+ * What the factory owns and the host does not:
+ *
+ *   - `transformLargeEsm`: the isolated esbuild transform for module text
+ *     past the in-isolate size bound. It needs `env.LOADER`, `env.ASSETS`
+ *     and `ctx.facets` and nothing of any host, so it is the factory's
+ *     default rather than every host's copy.
+ *   - `resolveWorkerLaunchFallback`: the durable image-store resolver a
+ *     self-owned worker launch (the session's python/ruby residents, or an
+ *     embedder spawn that let the manager persist its image) re-drives
+ *     from. It needs only the filesystem. An embedder that keeps its own
+ *     content store answers `resolveWorkerLaunch` and this is never reached
+ *     for its recipes (see `WorkerRecipe.resident`).
+ */
+import { createPortCapability } from '@nimbus-sh/core/runtime/port-registry.js';
+import { FacetManager } from './manager.js';
+import { processHostFor } from '../loaders/process-host.js';
+import { resolveDurableWorkerImage } from './durable-images.js';
+import { persistPortCapability, readPortReservation, readPortReservationByOwner, reservePort, routeCapabilityPort, } from '../session/port-capability.js';
+import { bindPublicPortCapability } from '../router/public-directory.js';
+import { ESBUILD_TRANSFORM_WORKER_ID, esbuildTransformWorkerCode, } from './esbuild-transform.js';
+import { fetchEsbuildWasmBytes } from '../runtime/esbuild-wasm-bytes.js';
+export { FacetManager, DEFAULT_WORKER_MAIN_MODULE } from './manager.js';
+/**
+ * Compose a FacetManager over a host's own ctx, env, process supervisor, port
+ * registry and filesystem. See the module comment for what is defaulted.
+ */
+export function composeFacetManager(deps) {
+    const { ctx, env, vfs } = deps;
+    const hooks = {
+        onExternalExit: deps.hooks.onExternalExit,
+        notify: deps.hooks.notify,
+        requestLaunchTurn: deps.hooks.requestLaunchTurn,
+        ...(deps.hooks.onSpawn !== undefined ? { onSpawn: deps.hooks.onSpawn } : {}),
+        ...(deps.hooks.resolveWorkerLaunch !== undefined
+            ? { resolveWorkerLaunch: deps.hooks.resolveWorkerLaunch }
+            : {}),
+        transformLargeEsm: isolatedEsmTransform(ctx, env),
+        resolveWorkerLaunchFallback: (recipe) => resolveDurableWorkerImage(vfs, recipe),
+    };
+    const manager = new FacetManager(ctx, env, deps.processes, deps.portRegistry, processHostFor, hooks);
+    manager.setVfs(vfs);
+    if (deps.esbuild)
+        manager.setEsbuildService(deps.esbuild);
+    const { portRegistry } = deps;
+    const capabilityHost = { ctx, portRegistry };
+    return {
+        manager,
+        pumpLaunches: () => manager.pumpResidentLaunches(),
+        apps: {
+            async ensureDurableApp(input) {
+                if (typeof input.owner !== 'string' || input.owner.length === 0) {
+                    throw new Error('ensureDurableApp: owner must be a non-empty string');
+                }
+                const occupied = new Set(portRegistry.getAll().map((entry) => entry.port));
+                const port = await reservePort(ctx, {
+                    owner: input.owner,
+                    preferredPort: input.preferredPort,
+                    occupiedPorts: occupied,
+                    capability: createPortCapability(),
+                    ...(input.visibility !== undefined ? { visibility: input.visibility } : {}),
+                    ...(input.name !== undefined ? { name: input.name } : {}),
+                });
+                const record = await readPortReservation(ctx, port);
+                if (record?.visibility === 'public' && record.capability !== null) {
+                    // A no-op for a host whose Durable Object is not a session (the
+                    // public directory keys on the session name); loud when it is a
+                    // session without the binding.
+                    await bindPublicPortCapability({ env, ctx }, record.capability, port, input.name);
+                }
+                return {
+                    port,
+                    capability: record?.capability ?? null,
+                    visibility: record?.visibility ?? 'scoped',
+                };
+            },
+            async removeDurableApp(owner) {
+                if (typeof owner !== 'string' || owner.length === 0) {
+                    throw new Error('removeDurableApp: owner must be a non-empty string');
+                }
+                const held = await readPortReservationByOwner(ctx, owner);
+                const removed = await manager.removeDurableApp(owner);
+                return { owner, removed, port: held?.port ?? null };
+            },
+            async listPorts() {
+                const entries = portRegistry.getAll();
+                await Promise.all(entries.map((entry) => persistPortCapability(capabilityHost, entry.port, entry.capability)));
+                return entries.map((entry) => ({
+                    port: Number(entry.port),
+                    pid: Number(entry.pid),
+                    registeredAt: Number(entry.registeredAt),
+                    capability: String(entry.capability),
+                }));
+            },
+            routeCapabilityPort(port, capability, request, innerPath) {
+                // The session's routeToSessionPort is the one implementation —
+                // the capability gate AND the public-bearer visibility gate live
+                // there; a copy here dropped the latter. Session-only concerns
+                // (dev-server restore, the vite-shim branch) no-op on this host.
+                return routeCapabilityPort({ ctx, portRegistry, ensureDurableAppOnPort: (p) => manager.ensureDurableAppOnPort(p) }, port, capability, request, innerPath);
+            },
+        },
+    };
+}
+/**
+ * The isolated esbuild transform: module text past the in-isolate bound is
+ * transformed in a loader-backed facet that owns the esbuild wasm heap, so the
+ * host isolate never pays for it. Session-independent by construction —
+ * `env.LOADER`, `env.ASSETS` and `ctx.facets` are all it reads.
+ */
+function isolatedEsmTransform(ctx, env) {
+    return async (code, options) => {
+        const loader = Reflect.get(Object(env), 'LOADER');
+        if (!loader || typeof loader.get !== 'function') {
+            throw new Error('Nimbus: env.LOADER unavailable for isolated esbuild transform');
+        }
+        const assets = Reflect.get(Object(env), 'ASSETS');
+        if (!assets || typeof assets.fetch !== 'function') {
+            throw new Error('Nimbus: env.ASSETS unavailable for isolated esbuild transform');
+        }
+        const worker = await loader.get(ESBUILD_TRANSFORM_WORKER_ID, async () => esbuildTransformWorkerCode(await fetchEsbuildWasmBytes({ ASSETS: assets })));
+        const transformClass = worker.getDurableObjectClass('EsbuildTransformFacet');
+        const facet = ctx.facets.get(`esbuild-transform-${ESBUILD_TRANSFORM_WORKER_ID}`, async () => ({ class: transformClass }));
+        return facet.transform(code, options);
+    };
+}

package/dist/facets/durable-images.d.ts

@@ -12,11 +12,12 @@
  * durable spawn exists to survive. Durable images are kept for the
  * application's life and released only by explicit removal.
  *
- * Two blobs per launch: `runner` is the worker.js source text, `application`
- * is a JSON payload of `{ modules, env, vfsWasmModules }`. The digests in the
- * journal's `recipe.image` are sha256 hashes of those two payloads, and a
- * self-owned spawn mints them at spawn time; an embedder-owned spawn is given
- * them by its own bookkeeping instead.
+ * Two blobs per launch: `runner` is the main module's source text,
+ * `application` is a JSON payload of `{ modules, env, vfsWasmModules }` plus,
+ * when the launch set them, `vfsTextModules`, `mainModule` and `startArgs`.
+ * The digests in the journal's `recipe.image` are sha256 hashes of those two
+ * payloads, and a self-owned spawn mints them at spawn time; an
+ * embedder-owned spawn is given them by its own bookkeeping instead.
  */
 import type { SqliteVFS } from '@nimbus-sh/core/vfs/sqlite-vfs.js';
 import type { ResidentCodeSpec } from '@nimbus-sh/fabric/process-fabric.js';
@@ -43,6 +44,9 @@ export declare function persistDurableWorkerImage(vfs: SqliteVFS, workerCode: st
     }>;
     env?: ResidentCodeSpec['env'];
     vfsWasmModules?: Record<string, string>;
+    vfsTextModules?: Record<string, string>;
+    /** Recorded only when the launch named one; absent means `worker.js`. */
+    mainModule?: string;
     startArgs?: unknown;
 }): Promise<{
     runner: string;

package/dist/facets/durable-images.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"durable-images.d.ts","sourceRoot":"","sources":["../../src/facets/durable-images.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvE,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAIlD,8EAA8E;AAC9E,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,EACxD,QAAQ,EAAE,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,GAC1D,MAAM,CAaR;AAOD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,SAAS,EACd,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IACP,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IACxD,GAAG,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAclD;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA0BtC"}
+{"version":3,"file":"durable-images.d.ts","sourceRoot":"","sources":["../../src/facets/durable-images.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEvE,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,mBAAmB,CAAC;AAIlD,8EAA8E;AAC9E,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,EACxD,QAAQ,EAAE,QAAQ,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,GAC1D,MAAM,CAaR;AAOD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,SAAS,EACd,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IACP,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IACxD,GAAG,CAAC,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBlD;AAED;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,SAAS,EACd,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAiCtC"}

package/dist/facets/durable-images.js

@@ -12,11 +12,12 @@
  * durable spawn exists to survive. Durable images are kept for the
  * application's life and released only by explicit removal.
  *
- * Two blobs per launch: `runner` is the worker.js source text, `application`
- * is a JSON payload of `{ modules, env, vfsWasmModules }`. The digests in the
- * journal's `recipe.image` are sha256 hashes of those two payloads, and a
- * self-owned spawn mints them at spawn time; an embedder-owned spawn is given
- * them by its own bookkeeping instead.
+ * Two blobs per launch: `runner` is the main module's source text,
+ * `application` is a JSON payload of `{ modules, env, vfsWasmModules }` plus,
+ * when the launch set them, `vfsTextModules`, `mainModule` and `startArgs`.
+ * The digests in the journal's `recipe.image` are sha256 hashes of those two
+ * payloads, and a self-owned spawn mints them at spawn time; an
+ * embedder-owned spawn is given them by its own bookkeeping instead.
  */
 import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
 /** The directory every durable application's image blobs live under. */
@@ -54,10 +55,14 @@ export async function persistDurableWorkerImage(vfs, workerCode, payload) {
     kernel.mkdir(DURABLE_IMAGE_DIR, { recursive: true });
     const runner = await sha256Hex(workerCode);
     kernel.writeFile(imagePath(runner), workerCode);
+    // Optional members are omitted rather than written null so an unchanged
+    // launch keeps the digest it had before the member existed.
     const applicationPayload = JSON.stringify({
         modules: payload.modules,
         env: payload.env ?? null,
         vfsWasmModules: payload.vfsWasmModules ?? null,
+        ...(payload.vfsTextModules !== undefined ? { vfsTextModules: payload.vfsTextModules } : {}),
+        ...(payload.mainModule !== undefined ? { mainModule: payload.mainModule } : {}),
         ...(payload.startArgs !== undefined ? { startArgs: payload.startArgs } : {}),
     });
     const application = await sha256Hex(applicationPayload);
@@ -83,12 +88,17 @@ export async function resolveDurableWorkerImage(vfs, recipe) {
         return null;
     }
     const runner = new TextDecoder().decode(runnerBytes);
-    const { modules = {}, env = null, vfsWasmModules = undefined, startArgs } = JSON.parse(new TextDecoder().decode(applicationBytes));
+    const { modules = {}, env = null, vfsWasmModules = undefined, vfsTextModules, mainModule, startArgs, } = JSON.parse(new TextDecoder().decode(applicationBytes));
+    // The recipe's own record of the main module wins when the blob predates
+    // the member; both say the same thing for any launch written since.
+    const main = mainModule ?? recipe.mainModule ?? 'worker.js';
     return {
         env: env ?? null,
         globalOutbound: undefined,
-        modules: { 'worker.js': runner, ...modules },
+        modules: { ...modules, [main]: runner },
+        mainModule: main,
         ...(startArgs !== undefined ? { startArgs } : {}),
         ...(vfsWasmModules !== null ? { vfsWasmModules } : {}),
+        ...(vfsTextModules !== undefined ? { vfsTextModules } : {}),
     };
 }

package/dist/facets/esbuild-bundle-pool.d.ts

@@ -0,0 +1,49 @@
+/**
+ * EsbuildBundlePool — the session's single esbuild facet pool.
+ *
+ * Install-time pre-bundling and on-demand /@modules/ bundling dispatch the
+ * same worker (PRE_BUNDLE_PREAMBLE + esbuild.wasm, one slot). When each
+ * pipeline built its own IsolatePool the supervisor retained two copies of
+ * the ~12 MiB wasm bytes and warmed two loader slots per session, and the
+ * two pools never queued behind each other. One pool, owned by the session,
+ * holds one wasm copy — leased once from the shared supervisor allocation
+ * budget, the way the pre-bundler already accounted for its own — for as
+ * long as the installer and dev server live, and is disposed with them.
+ *
+ * Construction is lazy and everything heavy is imported on first use so
+ * the fabric/preamble/wasm subgraph stays out of the cold script-eval
+ * graph of sessions that never bundle.
+ */
+import type { IsolatePool } from '@nimbus-sh/fabric/isolate-pool.js';
+/** The pool surface both bundling pipelines dispatch through. */
+export type BundlePool = Pick<IsolatePool, 'submit'>;
+/** What a bundling pipeline receives from its host. */
+export interface BundlePoolProvider {
+    /** The session's pool, constructed on first call. */
+    acquire(): Promise<BundlePool>;
+}
+export declare class EsbuildBundlePool implements BundlePoolProvider {
+    private readonly env;
+    private readonly ctx;
+    private pool;
+    private pending;
+    /** Releases the wasm bytes' supervisor credit; held until dispose(). */
+    private releaseWasmCredit;
+    /** Bumped by dispose() so a construction it interrupted tears itself down. */
+    private generation;
+    constructor(env: unknown, ctx: DurableObjectState);
+    /**
+     * Callers MUST acquire the pool before taking any slice lease: the
+     * first construction reserves the full supervisor budget while the wasm
+     * bytes are fetched, so a caller already holding slice credit would
+     * wait on itself.
+     */
+    acquire(): Promise<IsolatePool>;
+    private construct;
+    /**
+     * Tear the pool down with its host. A later acquire() constructs a fresh
+     * pool, so a session that installs again after a teardown still bundles.
+     */
+    dispose(): void;
+}
+//# sourceMappingURL=esbuild-bundle-pool.d.ts.map

package/dist/facets/esbuild-bundle-pool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"esbuild-bundle-pool.d.ts","sourceRoot":"","sources":["../../src/facets/esbuild-bundle-pool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AASrE,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AAErD,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,qDAAqD;IACrD,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;CAChC;AAQD,qBAAa,iBAAkB,YAAW,kBAAkB;IASxD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,GAAG;IATtB,OAAO,CAAC,IAAI,CAA4B;IACxC,OAAO,CAAC,OAAO,CAAqC;IACpD,wEAAwE;IACxE,OAAO,CAAC,iBAAiB,CAA6B;IACtD,8EAA8E;IAC9E,OAAO,CAAC,UAAU,CAAK;gBAGJ,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,kBAAkB;IAG1C;;;;;OAKG;IACH,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC;YAqBjB,SAAS;IAmDvB;;;OAGG;IACH,OAAO,IAAI,IAAI;CAYhB"}

package/dist/facets/esbuild-bundle-pool.js

@@ -0,0 +1,122 @@
+import { acquireResidentSupervisorAllocation } from '@nimbus-sh/platform/heavy-alloc-coord.js';
+import { PRE_BUNDLE_CONCURRENCY, PRE_BUNDLE_SLICE_CAP_BYTES, SUPERVISOR_IN_FLIGHT_ALLOCATION_BUDGET_BYTES, } from '@nimbus-sh/platform/limits.js';
+function hasAssetsFetcher(env) {
+    if (typeof env !== 'object' || env === null)
+        return false;
+    const assets = Reflect.get(env, 'ASSETS');
+    return typeof assets === 'object' && assets !== null && typeof Reflect.get(assets, 'fetch') === 'function';
+}
+export class EsbuildBundlePool {
+    env;
+    ctx;
+    pool = null;
+    pending = null;
+    /** Releases the wasm bytes' supervisor credit; held until dispose(). */
+    releaseWasmCredit = null;
+    /** Bumped by dispose() so a construction it interrupted tears itself down. */
+    generation = 0;
+    constructor(env, ctx) {
+        this.env = env;
+        this.ctx = ctx;
+    }
+    /**
+     * Callers MUST acquire the pool before taking any slice lease: the
+     * first construction reserves the full supervisor budget while the wasm
+     * bytes are fetched, so a caller already holding slice credit would
+     * wait on itself.
+     */
+    acquire() {
+        if (this.pool)
+            return Promise.resolve(this.pool);
+        if (this.pending)
+            return this.pending;
+        const generation = this.generation;
+        const pending = this.construct().then(({ pool, releaseWasmCredit }) => {
+            if (this.generation !== generation) {
+                // dispose() ran while the wasm bytes were in flight.
+                try {
+                    pool.dispose();
+                }
+                catch { /* best-effort */ }
+                releaseWasmCredit();
+                throw new Error('EsbuildBundlePool: disposed during construction');
+            }
+            this.pool = pool;
+            this.releaseWasmCredit = releaseWasmCredit;
+            return pool;
+        }).finally(() => {
+            if (this.pending === pending)
+                this.pending = null;
+        });
+        this.pending = pending;
+        return pending;
+    }
+    async construct() {
+        if (!hasAssetsFetcher(this.env)) {
+            throw new Error('EsbuildBundlePool: env.ASSETS binding missing — the esbuild wasm asset cannot be fetched');
+        }
+        const env = this.env;
+        const [{ IsolatePool }, { PRE_BUNDLE_PREAMBLE }, { fetchEsbuildWasmBytes }] = await Promise.all([
+            import('@nimbus-sh/fabric/isolate-pool.js'),
+            import('../loaders/pre-bundle-preamble.js'),
+            import('../runtime/esbuild-wasm-bytes.js'),
+        ]);
+        // Resident, and sized to what the pool will KEEP — not the whole budget.
+        //
+        // The full-budget claim this used to make is grantable exactly once: the
+        // lease it shrinks to becomes a permanent floor, so a second pool
+        // construction asked for 40 MiB against 28.1 MiB that could ever be free
+        // and parked in the FIFO with no error and no CPU. Measured on a
+        // deployed worker: capacity 41,943,040, resident 11,907,565, queued 1 for
+        // 222 s with the isolate healthy the whole time — and because the queue
+        // refuses everyone behind a waiter, the whole session stopped making
+        // progress. The bound below is the same one the payload is checked
+        // against, so the slice cap stays free for the work the pool exists for.
+        const maxRetainedWasmBytes = SUPERVISOR_IN_FLIGHT_ALLOCATION_BUDGET_BYTES - PRE_BUNDLE_SLICE_CAP_BYTES;
+        const setupAllocation = await acquireResidentSupervisorAllocation(maxRetainedWasmBytes);
+        let retained = false;
+        try {
+            const wasmBytes = await fetchEsbuildWasmBytes(env);
+            if (wasmBytes.byteLength > maxRetainedWasmBytes) {
+                throw new RangeError(`esbuild wasm payload ${wasmBytes.byteLength} exceeds the ${maxRetainedWasmBytes}-byte retained budget`);
+            }
+            // IsolatePool keeps the constructor-time module bytes until dispose(),
+            // so retain their exact credit rather than treating construction as a
+            // handoff that immediately frees the ArrayBuffer.
+            setupAllocation.shrinkTo(wasmBytes.byteLength);
+            const pool = new IsolatePool(env, this.ctx, {
+                concurrency: PRE_BUNDLE_CONCURRENCY,
+                timeoutMs: 60_000,
+                retries: 0,
+                tag: 'esbuild-bundle',
+                preamble: PRE_BUNDLE_PREAMBLE,
+                wasmModules: { 'esbuild.wasm': wasmBytes },
+            });
+            retained = true;
+            return { pool, releaseWasmCredit: setupAllocation.release };
+        }
+        finally {
+            if (!retained)
+                setupAllocation.release();
+        }
+    }
+    /**
+     * Tear the pool down with its host. A later acquire() constructs a fresh
+     * pool, so a session that installs again after a teardown still bundles.
+     */
+    dispose() {
+        this.generation++;
+        const pool = this.pool;
+        this.pool = null;
+        this.pending = null;
+        if (pool) {
+            try {
+                pool.dispose();
+            }
+            catch { /* best-effort */ }
+        }
+        const release = this.releaseWasmCredit;
+        this.releaseWasmCredit = null;
+        release?.();
+    }
+}