@nimbus-sh/worker 0.8.0 → 0.10.0

package/dist/npm/placement.js

@@ -0,0 +1,33 @@
+/**
+ * Placement paths: where a package lands, relative to the project's
+ * `node_modules` — `react` at root, `pkg-types/node_modules/confbox` nested
+ * under the dependent whose range root does not satisfy. Node walks
+ * `node_modules` upward from the importer, so a nested copy is found by its
+ * dependent (and what is beneath it) and by nobody else.
+ */
+const NM = '/node_modules/';
+/** `name` under `parent`; `''` is the project itself. */
+export function nestedPlacement(parent, name) {
+    return parent ? `${parent}${NM}${name}` : name;
+}
+/** The containing placement, `''` at root. */
+export function parentPlacement(placement) {
+    const i = placement.lastIndexOf(NM);
+    return i < 0 ? '' : placement.slice(0, i);
+}
+/** The package name a placement holds. */
+export function placementName(placement) {
+    const i = placement.lastIndexOf(NM);
+    return i < 0 ? placement : placement.slice(i + NM.length);
+}
+/** Placements Node's walk visits for `name` from inside `from`, nearest first, root last. */
+export function visiblePlacements(from, name) {
+    const out = [];
+    let dir = from;
+    while (dir) {
+        out.push(`${dir}${NM}${name}`);
+        dir = parentPlacement(dir);
+    }
+    out.push(name);
+    return out;
+}

package/dist/npm/r2-cache.d.ts

@@ -57,6 +57,7 @@
  *     stream directly from npm.
  *   - npm publish webhook -> cache invalidation.
  */
+import { NPM_REGISTRY_ORIGIN, npmRegistryOrigin } from '@nimbus-sh/core/substrate/lifo/commands/system/npm.js';
 import type { CacheTier, CacheKind } from '@nimbus-sh/core/_shared/cache-stats.js';
 /**
  * Per-call cache-stat event (cache metrics support). R2CacheClient
@@ -117,8 +118,9 @@ export declare const R2_CACHE_PREFIX = "v2";
  *  No data migration; existing R2 packument entries' customMetadata
  *  .expiresAt stamps remain valid against either TTL. */
 export declare const PACKUMENT_TTL_MS: number;
+export { NPM_REGISTRY_ORIGIN, npmRegistryOrigin };
 /** The registry URL a packument is read from — also what `npm http` lines report. */
-export declare function packumentUrl(name: string): string;
+export declare function packumentUrl(name: string, registry?: string): string;
 /** Cap on tarball bytes returned via this RPC. Workerd structured-clone
  *  cap is 32 MiB; we keep a comfortable margin to leave room for RPC
  *  framing + the call's own arg bytes. Tarballs above this size skip
@@ -171,7 +173,7 @@ type R2BucketLike = {
  * encodeURIComponent on the name so '@scope/pkg' becomes a single path
  * segment (R2 keys allow any UTF-8, but URL paths need encoding).
  */
-export declare function packumentL2Url(name: string): string;
+export declare function packumentL2Url(name: string, registry?: string): string;
 /** L2 cache-key URL for a tarball content address. Hex + the SRI algo
  *  name are already URL-safe, so the R2 key doubles as the URL path. */
 export declare function tarballL2Url(address: TarballAddress): string;
@@ -211,7 +213,7 @@ export declare function parseTarballAddress(integrity: string): TarballAddress |
  */
 export declare function tarballKey(address: TarballAddress): string;
 /** Compose the R2 object key for a packument. */
-export declare function packumentKey(name: string): string;
+export declare function packumentKey(name: string, registry?: string): string;
 /**
  * Per-instance counters surfaced for tests / probes. Read via
  * `R2CacheClient.stats()`. Track at the FUNCTION boundary level so a
@@ -308,7 +310,7 @@ export declare class R2CacheClient {
      * write back to L2 with a 5-min `Cache-Control: max-age=300`
      * (matching the existing R2 customMetadata.expiresAt semantic).
      */
-    getPackument(name: string): Promise<CachedPackument | null>;
+    getPackument(name: string, registry?: string): Promise<CachedPackument | null>;
     /**
      * Resolve a packument through the whole stack: cache read, and on a
      * miss (or an expired entry) the registry fetch plus the cache fill.
@@ -323,6 +325,8 @@ export declare class R2CacheClient {
      * attacker would be choosing the address too. Here, the only bytes
      * that reach `pc/<name>.json` are the ones registry.npmjs.org served
      * for that exact name, one line below the fetch that produced them.
+     * Another registry (`options.registry`) fills and reads only its own
+     * namespace of the cache, so it can neither poison nor borrow those.
      *
      * `status` is set when the registry answered 4xx (no such package);
      * `failure` when every attempt failed. Both leave `json` null.
@@ -330,6 +334,7 @@ export declare class R2CacheClient {
     readThroughPackument(name: string, options?: {
         retries?: number;
         timeoutMs?: number;
+        registry?: string;
     }): Promise<PackumentReadThrough>;
     /**
      * Write a packument JSON to R2 with a TTL stamp in customMetadata.
@@ -342,11 +347,10 @@ export declare class R2CacheClient {
      * Returns true on success, false on failure (same best-effort posture
      * as putTarball).
      */
-    putPackument(name: string, json: string): Promise<boolean>;
+    putPackument(name: string, json: string, registry?: string): Promise<boolean>;
     /** Lightweight feature-detection for callers that want to log path. */
     hasTarballBucket(): boolean;
     /** Lightweight feature-detection for callers that want to log path. */
     hasPackumentBucket(): boolean;
 }
-export {};
 //# sourceMappingURL=r2-cache.d.ts.map

package/dist/npm/r2-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"r2-cache.d.ts","sourceRoot":"","sources":["../../src/npm/r2-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAE5D;;;;;;;;mBAQmB;AACnB,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yDA6ByD;AACzD,eAAO,MAAM,gBAAgB,QAAc,CAAC;AAQ5C,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKjD;AAED;;;;0DAI0D;AAC1D,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAIrD,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B;;sCAEkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb;8DAC0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd;;mCAE+B;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,sEAAsE;AACtE,KAAK,YAAY,GAAG;IAClB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACxB,QAAQ,CAAC,EAAE,IAAI,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACzC,GAAG,IAAI,CAAC,CAAC;IACV,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,MAAM,EACvC,IAAI,CAAC,EAAE;QACL,YAAY,CAAC,EAAE;YAAE,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACzC,GACA,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvC,GAAG,IAAI,CAAC;AAmBT;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;wEACwE;AACxE,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE5D;AAmDD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAsB5E;AAYD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE1D;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAID;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IAetB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAflC,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,cAAc,CAAK;IAC3B;;;;;;OAMG;IACI,YAAY,EAAE,gBAAgB,EAAE,CAAM;gBAG1B,aAAa,EAAE,YAAY,EAC3B,eAAe,EAAE,YAAY;IAGhD,OAAO,CAAC,UAAU;IAGlB,OAAO,CAAC,WAAW;IAInB,kEAAkE;IAClE,KAAK,IAAI,kBAAkB;IAS3B;;;;;;;;;;;;;;OAcG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAwE/D;;;;;;;;;OASG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBtF;;;;;;;;;;;;;;;;OAgBG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA8EjE;;;;;;;;;;;;;;;;;OAiBG;IACG,oBAAoB,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC,oBAAoB,CAAC;IA4DhC;;;;;;;;;;OAUG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAehE,uEAAuE;IACvE,gBAAgB,IAAI,OAAO;IAI3B,uEAAuE;IACvE,kBAAkB,IAAI,OAAO;CAG9B"}
+{"version":3,"file":"r2-cache.d.ts","sourceRoot":"","sources":["../../src/npm/r2-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uDAAuD,CAAC;AAC/G,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAE5D;;;;;;;;mBAQmB;AACnB,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yDA6ByD;AACzD,eAAO,MAAM,gBAAgB,QAAc,CAAC;AAI5C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;AAKlD,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA4B,GAAG,MAAM,CAKzF;AAcD;;;;0DAI0D;AAC1D,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAIrD,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B;;sCAEkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb;8DAC0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd;;mCAE+B;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,sEAAsE;AACtE,KAAK,YAAY,GAAG;IAClB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACxB,QAAQ,CAAC,EAAE,IAAI,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACzC,GAAG,IAAI,CAAC,CAAC;IACV,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,MAAM,EACvC,IAAI,CAAC,EAAE;QACL,YAAY,CAAC,EAAE;YAAE,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACzC,GACA,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvC,GAAG,IAAI,CAAC;AAmBT;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA4B,GAAG,MAAM,CAE3F;AAED;wEACwE;AACxE,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE5D;AAmDD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAsB5E;AAYD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE1D;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA4B,GAAG,MAAM,CAEzF;AAID;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IAetB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAflC,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,cAAc,CAAK;IAC3B;;;;;;OAMG;IACI,YAAY,EAAE,gBAAgB,EAAE,CAAM;gBAG1B,aAAa,EAAE,YAAY,EAC3B,eAAe,EAAE,YAAY;IAGhD,OAAO,CAAC,UAAU;IAGlB,OAAO,CAAC,WAAW;IAInB,kEAAkE;IAClE,KAAK,IAAI,kBAAkB;IAS3B;;;;;;;;;;;;;;OAcG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAwE/D;;;;;;;;;OASG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBtF;;;;;;;;;;;;;;;;OAgBG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA4B,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA8EzG;;;;;;;;;;;;;;;;;;;OAmBG;IACG,oBAAoB,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,OAAO,CAAC,oBAAoB,CAAC;IA6DhC;;;;;;;;;;OAUG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA4B,GAAG,OAAO,CAAC,OAAO,CAAC;IAexG,uEAAuE;IACvE,gBAAgB,IAAI,OAAO;IAI3B,uEAAuE;IACvE,kBAAkB,IAAI,OAAO;CAG9B"}

package/dist/npm/r2-cache.js

@@ -57,6 +57,7 @@
  *     stream directly from npm.
  *   - npm publish webhook -> cache invalidation.
  */
+import { NPM_REGISTRY_ORIGIN, npmRegistryOrigin } from '@nimbus-sh/core/substrate/lifo/commands/system/npm.js';
 /** Schema version baked into every cache key. Bump to invalidate
  *  everything atomically (e.g. if the storage shape changes or a bug
  *  poisoned a class of keys).
@@ -98,16 +99,28 @@ export const R2_CACHE_PREFIX = 'v2';
  *  No data migration; existing R2 packument entries' customMetadata
  *  .expiresAt stamps remain valid against either TTL. */
 export const PACKUMENT_TTL_MS = 60 * 60_000;
-/** npm registry origin. The only host the packument cache is filled from. */
-const NPM_REGISTRY_ORIGIN = 'https://registry.npmjs.org';
+// The origin rule lives with the command that reads NPM_REGISTRY; the cache
+// keys by the same value.
+export { NPM_REGISTRY_ORIGIN, npmRegistryOrigin };
 /** Jittered backoff between packument fetch attempts. */
 const PACKUMENT_BACKOFF_MS = [500, 1500, 4500];
 /** The registry URL a packument is read from — also what `npm http` lines report. */
-export function packumentUrl(name) {
+export function packumentUrl(name, registry = NPM_REGISTRY_ORIGIN) {
     const safeName = name.startsWith('@')
         ? '@' + encodeURIComponent(name.slice(1))
         : encodeURIComponent(name);
-    return `${NPM_REGISTRY_ORIGIN}/${safeName}`;
+    return `${registry}/${safeName}`;
+}
+/**
+ * The cache path segment for a packument: `<name>.json` for the default
+ * registry (the keys warm caches already hold), and `<origin>/<name>.json`
+ * for any other, so a private registry never reads or fills the entries
+ * registry.npmjs.org served.
+ */
+function packumentCachePath(name, registry) {
+    return registry === NPM_REGISTRY_ORIGIN
+        ? `${name}.json`
+        : `${encodeURIComponent(registry)}/${name}.json`;
 }
 /** Cap on tarball bytes returned via this RPC. Workerd structured-clone
  *  cap is 32 MiB; we keep a comfortable margin to leave room for RPC
@@ -136,8 +149,8 @@ const L2_KEY_HOST = 'https://nimbus-cache.invalid';
  * encodeURIComponent on the name so '@scope/pkg' becomes a single path
  * segment (R2 keys allow any UTF-8, but URL paths need encoding).
  */
-export function packumentL2Url(name) {
-    return `${L2_KEY_HOST}/${R2_CACHE_PREFIX}/pc/${encodeURIComponent(name)}.json`;
+export function packumentL2Url(name, registry = NPM_REGISTRY_ORIGIN) {
+    return `${L2_KEY_HOST}/${R2_CACHE_PREFIX}/pc/${encodeURIComponent(packumentCachePath(name, registry))}`;
 }
 /** L2 cache-key URL for a tarball content address. Hex + the SRI algo
  *  name are already URL-safe, so the R2 key doubles as the URL path. */
@@ -253,8 +266,8 @@ export function tarballKey(address) {
     return `${R2_CACHE_PREFIX}/t/${address.algo}/${address.hex}.tgz`;
 }
 /** Compose the R2 object key for a packument. */
-export function packumentKey(name) {
-    return `${R2_CACHE_PREFIX}/pc/${name}.json`;
+export function packumentKey(name, registry = NPM_REGISTRY_ORIGIN) {
+    return `${R2_CACHE_PREFIX}/pc/${packumentCachePath(name, registry)}`;
 }
 /**
  * R2-backed npm cache client. Wraps two R2 bindings (tarballs + packuments)
@@ -437,9 +450,9 @@ export class R2CacheClient {
      * write back to L2 with a 5-min `Cache-Control: max-age=300`
      * (matching the existing R2 customMetadata.expiresAt semantic).
      */
-    async getPackument(name) {
+    async getPackument(name, registry = NPM_REGISTRY_ORIGIN) {
         // ── L2 fast path (per-colo) ───────────────────────────────────
-        const l2Key = new Request(packumentL2Url(name));
+        const l2Key = new Request(packumentL2Url(name, registry));
         const l2Hit = await l2Get(l2Key);
         if (l2Hit) {
             this._l2HitsPackument++;
@@ -475,7 +488,7 @@ export class R2CacheClient {
             return null;
         }
         this._l3GetsPackument++;
-        const obj = await this.packumentBucket.get(packumentKey(name));
+        const obj = await this.packumentBucket.get(packumentKey(name, registry));
         if (!obj) {
             this._recordMiss('L3', 'packument');
             return null;
@@ -528,16 +541,19 @@ export class R2CacheClient {
      * attacker would be choosing the address too. Here, the only bytes
      * that reach `pc/<name>.json` are the ones registry.npmjs.org served
      * for that exact name, one line below the fetch that produced them.
+     * Another registry (`options.registry`) fills and reads only its own
+     * namespace of the cache, so it can neither poison nor borrow those.
      *
      * `status` is set when the registry answered 4xx (no such package);
      * `failure` when every attempt failed. Both leave `json` null.
      */
     async readThroughPackument(name, options) {
-        const cached = await this.getPackument(name);
+        const registry = options?.registry ?? NPM_REGISTRY_ORIGIN;
+        const cached = await this.getPackument(name, registry);
         if (cached && !cached.expired && cached.json) {
             return { json: cached.json, source: 'r2-cache' };
         }
-        const url = packumentUrl(name);
+        const url = packumentUrl(name, registry);
         const retries = Math.max(0, options?.retries ?? 3);
         const timeoutMs = options?.timeoutMs ?? 15_000;
         let lastErr;
@@ -566,7 +582,7 @@ export class R2CacheClient {
                     this._recordHit('L4', 'packument', json.length);
                     // Best-effort fill, awaited so a follow-up read in the same
                     // install sees it.
-                    await this.putPackument(name, json);
+                    await this.putPackument(name, json, registry);
                     return { json, source: 'network' };
                 }
                 if (resp.status >= 400 && resp.status < 500) {
@@ -605,12 +621,12 @@ export class R2CacheClient {
      * Returns true on success, false on failure (same best-effort posture
      * as putTarball).
      */
-    async putPackument(name, json) {
+    async putPackument(name, json, registry = NPM_REGISTRY_ORIGIN) {
         if (!this.packumentBucket)
             return false;
         const expiresAt = Date.now() + PACKUMENT_TTL_MS;
         try {
-            await this.packumentBucket.put(packumentKey(name), json, {
+            await this.packumentBucket.put(packumentKey(name, registry), json, {
                 httpMetadata: { contentType: 'application/json' },
                 customMetadata: { expiresAt: String(expiresAt) },
             });

package/dist/npm/resolve-one-facet.d.ts

@@ -80,6 +80,8 @@ export interface ResolveOneSpec {
     fetchTimeoutMs: number;
     /** Retries for transient failures. Default 3. */
     retries: number;
+    /** Registry origin the packument is read from (the install's `NPM_REGISTRY`). */
+    registry: string;
 }
 export interface ResolveOneResult {
     /** Resolved package, or null if a registry policy filtered it out. */
@@ -201,6 +203,7 @@ export declare const resolveOnePackumentInFacet: (spec: ResolveOneSpec, env: {
         getPackument: (name: string, options: {
             retries: number;
             timeoutMs: number;
+            registry: string;
         }) => Promise<{
             json: string | null;
             source: "r2-cache" | "network";

package/dist/npm/resolve-one-facet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-one-facet.d.ts","sourceRoot":"","sources":["../../src/npm/resolve-one-facet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AA4B/E;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC;+EAC2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,GAAG,EAAE,eAAe,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;OAIG;IACH,WAAW,EAAE,GAAG,EAAE,CAAC;IACnB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sDAAsD;IACtD,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B;;;OAGG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IAClE;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,KAAK,CACnB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAChF;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,WAAW,CAAA;KAAE,CACrE,CAAC;IACF;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,EACF;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACrE;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;EAsB/D;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,GACrC,MAAM,cAAc,EACpB,KAAK;IACH,UAAU,EAAE;QACV;;;;WAIG;QACH,YAAY,EAAE,CACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,KAC5C,OAAO,CAAC;YACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;YAC/B,MAAM,EAAE,KAAK,CACT;gBAAE,IAAI,EAAE,KAAK,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAA;aAAE,GAC/D;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAA;aAAE,CACpD,CAAC;YACF,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC,CAAC;KACJ,CAAC;CACH,KACA,OAAO,CAAC,gBAAgB,CAqW1B,CAAC"}
+{"version":3,"file":"resolve-one-facet.d.ts","sourceRoot":"","sources":["../../src/npm/resolve-one-facet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AA4B/E;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC;+EAC2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,GAAG,EAAE,eAAe,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;OAIG;IACH,WAAW,EAAE,GAAG,EAAE,CAAC;IACnB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sDAAsD;IACtD,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B;;;OAGG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IAClE;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,KAAK,CACnB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAChF;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,WAAW,CAAA;KAAE,CACrE,CAAC;IACF;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,EACF;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACrE;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;EAsB/D;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,GACrC,MAAM,cAAc,EACpB,KAAK;IACH,UAAU,EAAE;QACV;;;;WAIG;QACH,YAAY,EAAE,CACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,KAC9D,OAAO,CAAC;YACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;YAC/B,MAAM,EAAE,KAAK,CACT;gBAAE,IAAI,EAAE,KAAK,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAA;aAAE,GAC/D;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAA;aAAE,CACpD,CAAC;YACF,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC,CAAC;KACJ,CAAC;CACH,KACA,OAAO,CAAC,gBAAgB,CAsW1B,CAAC"}

package/dist/npm/resolve-one-facet.js

@@ -282,6 +282,7 @@ export const resolveOnePackumentInFacet = async function resolveOnePackumentInFa
         const result = await __nimbusUseRpcResult(env.SUPERVISOR.getPackument(effName, {
             retries: Math.max(0, spec.retries ?? 3),
             timeoutMs: spec.fetchTimeoutMs ?? 15_000,
+            registry: spec.registry,
         }), (r) => ({ json: r.json, source: r.source, events: r.events, status: r.status, failure: r.failure }));
         packumentElapsedMs = Date.now() - packumentStart;
         // Splice the supervisor's per-tier events into our accumulator.

package/dist/npm/resolver.d.ts

@@ -32,18 +32,23 @@ export interface ResolvedPackage {
 export interface HoistPlan {
     /** Root-level hoisted packages: name → ResolvedPackage. */
     root: Map<string, ResolvedPackage>;
-    /**
-     * Packages that could not be hoisted due to version conflicts.
-     * Key: "parentName/childName", value: ResolvedPackage.
-     */
+    /** Packages nested under a dependent root does not satisfy, by placement path (placement.ts). */
     nested: Map<string, ResolvedPackage>;
 }
+/** One package at one placement: the unit diff, fetch and lockfile work in. */
+export interface PackagePlacement {
+    /** Placement path relative to the project's `node_modules`. */
+    placement: string;
+    pkg: ResolvedPackage;
+}
 /**
  * Serialize a resolved package into the registry-cache row shape. Facet task
  * bodies keep inline literals of this shape because `fn.toString()` isolates
  * cannot import supervisor modules.
  */
 export declare function registryEntryFromResolved(pkg: ResolvedPackage): RegistryCacheEntry;
-/** Compute the flat hoist plan used by the current one-version-per-name resolver. */
-export declare function computeHoistPlan(resolved: Map<string, ResolvedPackage>): HoistPlan;
+/** The walk's placement decisions carried forward: first version per name at root, the rest nested. */
+export declare function computeHoistPlan(resolved: Map<string, ResolvedPackage>, nested?: Map<string, ResolvedPackage>): HoistPlan;
+/** Every placement in the plan, root first. */
+export declare function hoistPlacements(plan: HoistPlan): PackagePlacement[];
 //# sourceMappingURL=resolver.d.ts.map

package/dist/npm/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/npm/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,sEAAsE;IACtE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,GAAG,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnC;;;OAGG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,eAAe,GAAG,kBAAkB,CAgBlF;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GACrC,SAAS,CAKX"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/npm/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,sEAAsE;IACtE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,GAAG,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnC,iGAAiG;IACjG,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACtC;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,eAAe,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,eAAe,GAAG,kBAAkB,CAgBlF;AAED,uGAAuG;AACvG,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,EACtC,MAAM,GAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAa,GAC/C,SAAS,CAKX;AAED,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,GAAG,gBAAgB,EAAE,CAKnE"}

package/dist/npm/resolver.js

@@ -26,10 +26,19 @@ export function registryEntryFromResolved(pkg) {
         fetchedAt: Date.now(),
     };
 }
-/** Compute the flat hoist plan used by the current one-version-per-name resolver. */
-export function computeHoistPlan(resolved) {
+/** The walk's placement decisions carried forward: first version per name at root, the rest nested. */
+export function computeHoistPlan(resolved, nested = new Map()) {
     return {
         root: new Map(resolved),
-        nested: new Map(),
+        nested: new Map(nested),
     };
 }
+/** Every placement in the plan, root first. */
+export function hoistPlacements(plan) {
+    const out = [];
+    for (const [name, pkg] of plan.root)
+        out.push({ placement: name, pkg });
+    for (const [placement, pkg] of plan.nested)
+        out.push({ placement, pkg });
+    return out;
+}

package/dist/runtime/bash-repl.d.ts

@@ -1,16 +1,18 @@
 import type { FacetManager } from '../facets/manager.js';
 import type { WebSocketTerminal } from '../facets/ws-terminal.js';
-import type { SqliteVFS } from '@nimbus-sh/core/vfs/sqlite-vfs.js';
 import type { Shell } from '@nimbus-sh/core/substrate/lifo/shell/Shell.js';
-import type { VfsCred } from '@nimbus-sh/core/runtime/os-contracts.js';
+import { type VfsCred, type RuntimeFsBridge, type NimbusFilesystemAuthority } from '@nimbus-sh/core/runtime/os-contracts.js';
 import type { RuntimeManifest } from '@nimbus-sh/core/runtime/runtime-manifest.js';
 export interface BashReplDeps {
     facetMgr: FacetManager;
-    vfs: SqliteVFS;
+    /** Owns the installed runtime blobs the session is instantiated from. */
+    authority: NimbusFilesystemAuthority;
     terminal: WebSocketTerminal;
     installRoot: string;
     manifest: RuntimeManifest;
     cred: VfsCred;
+    pid: number;
+    filesystem: RuntimeFsBridge;
     env: Record<string, string>;
     cwd: string;
     shell?: Pick<Shell, 'env' | 'cwd' | 'takeQueuedInput'>;

package/dist/runtime/bash-repl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bash-repl.d.ts","sourceRoot":"","sources":["../../src/runtime/bash-repl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,+CAA+C,CAAC;AAE3E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAUnF,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,SAAS,CAAC;IACf,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,iBAAiB,CAAC,CAAC;CACxD;AA4LD,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrE"}
+{"version":3,"file":"bash-repl.d.ts","sourceRoot":"","sources":["../../src/runtime/bash-repl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,+CAA+C,CAAC;AAE3E,OAAO,EAAe,KAAK,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AAE1I,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6CAA6C,CAAC;AAUnF,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB,yEAAyE;IACzE,SAAS,EAAE,yBAAyB,CAAC;IACrC,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,eAAe,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,iBAAiB,CAAC,CAAC;CACxD;AA+LD,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAGrE"}

package/dist/runtime/bash-repl.js

@@ -1,4 +1,6 @@
 import { formatShellPrompt } from '@nimbus-sh/core/substrate/lifo/shell/Shell.js';
+import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
+import { withHostFilesystem } from '@nimbus-sh/core/shell/execution-fs.js';
 import { createBashFacetSession } from '@nimbus-sh/core/runtime/bash-runner.js';
 import { facetHostForManager } from './facet-loader-host.js';
 import { ReplSession, } from './repl-session.js';
@@ -82,9 +84,12 @@ class BashReplAdapter {
     async ensureSession(signal) {
         if (this.session)
             return null;
-        this.session = await createBashFacetSession({
+        this.session = await withHostFilesystem(this.deps.authority, CRED_KERNEL, (artifacts) => createBashFacetSession({
             facets: facetHostForManager(this.deps.facetMgr),
-            vfs: this.deps.vfs.as(this.deps.cred),
+            artifacts,
+            filesystem: this.deps.filesystem,
+            pid: this.deps.pid,
+            cred: this.deps.cred,
             manifest: this.deps.manifest,
             installRoot: this.deps.installRoot,
             argv: ['bash', '--noediting', '-i'],
@@ -98,7 +103,7 @@ class BashReplAdapter {
             stdinClosed: false,
             stdinTty: true,
             signal,
-        });
+        }));
         const initial = this.session.initial;
         if (initial.state !== 'need-input')
             return this.consumeSlice(initial, '');

package/dist/runtime/cpython-resident.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cpython-resident.d.ts","sourceRoot":"","sources":["../../src/runtime/cpython-resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAwDxE;AAeD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,GAAG,oBAAoB,CAgDjF"}
+{"version":3,"file":"cpython-resident.d.ts","sourceRoot":"","sources":["../../src/runtime/cpython-resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgDxE;AAeD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,GAAG,oBAAoB,CAgDjF"}

package/dist/runtime/cpython-resident.js

@@ -38,14 +38,6 @@ export function buildCPythonSocketProcessWorker(preamble) {
         '  if (supervisor) globalThis.__nimbusPySupervisor = supervisor;',
         '  __wasiAdoptSupervisor(supervisor);',
         '}',
-        // A resident process answers between requests, and that is the only moment
-        // "durable while running" can be made true: by the time the caller holds a
-        // response, everything the request wrote has reached the VFS.
-        'async function __nimbusParkPy(value) {',
-        '  await __wasiDrainPersist();',
-        '  await __wasiRevalidateFS();',
-        '  return value;',
-        '}',
         'async function __nimbusStartPyProcess(args) {',
         '  const result = await globalThis.__cpythonStartProcess(args || {});',
         '  const ports = await globalThis.__cpythonListeningPorts();',
@@ -59,7 +51,7 @@ export function buildCPythonSocketProcessWorker(preamble) {
         'export class NimbusProcess extends DurableObject {',
         '  async startProcess(args) {',
         '    __nimbusAdoptPySupervisor(this.env);',
-        '    return __nimbusParkPy(await __nimbusStartPyProcess(args || {}));',
+        '    return __nimbusStartPyProcess(args || {});',
         '  }',
         '  async fetch(request) {',
         '    __nimbusAdoptPySupervisor(this.env);',
@@ -70,7 +62,7 @@ export function buildCPythonSocketProcessWorker(preamble) {
         '    const hinted = Number(request.headers.get("X-Nimbus-Port") || 0);',
         '    const port = hinted || Array.from(globalThis.__nimbusVirtualSockets.listeners.keys())[0];',
         '    if (!port) return new Response("Nimbus Python process has no listening virtual socket", { status: 502 });',
-        '    return __nimbusParkPy(await globalThis.__nimbusVirtualSockets.handleHttpRequest(port, request));',
+        '    return globalThis.__nimbusVirtualSockets.handleHttpRequest(port, request);',
         '  }',
         '}',
     ].join('\n');

package/dist/runtime/esbuild-wasm-bytes.d.ts

@@ -1,14 +1,15 @@
 /**
- * esbuild-wasm-bytes.ts — supervisor-side fetcher for the esbuild-wasm
- * binary. The bytes live in the static-assets layer (env.ASSETS); this
- * module hands them to the caller as an ArrayBuffer when needed.
+ * esbuild-wasm-bytes.ts — supervisor-side fetcher for the two esbuild-wasm
+ * artifacts a transform facet is built from: the wasm binary and the JS
+ * adapter that drives it. Both live in the static-assets layer
+ * (env.ASSETS); this module hands them to the caller when needed.
  *
  * Cache strategy
  * ──────────────
  * - NO module-scope cache (would pin 16 MiB in supervisor heap; the
  *   reason this module exists, see Phase 2 A'.5 below).
  * - L2 colo cache via `caches.default` (cache-and-scrub W-D): the bytes
- *   are version-pinned by URL (`/_assets/esbuild-<ESBUILD_VERSION>.wasm`),
+ *   are version-pinned by URL (`/_assets/esbuild-<ESBUILD_VERSION>.*`),
  *   so an `immutable` cache entry is correct. The Cache API holds its
  *   OWN reference outside the supervisor heap, so this does not
  *   re-introduce the residency that A'.5 removed.
@@ -28,6 +29,11 @@
  * are stored OUTSIDE the supervisor heap (workerd manages them), so
  * adding L2 wrap doesn't undo this.
  *
+ * The JS adapter followed the wasm for the same reason at a smaller
+ * scale: the supervisor already imports esbuild-wasm's browser build as a
+ * module for its own transforms, so carrying the same 117 KiB again as a
+ * string literal for facets doubled it in the Worker bundle.
+ *
  * Each call to `fetchEsbuildWasmBytes(env)` now does:
  *   - one `caches.default.match()` — sub-millisecond on hit
  *   - on miss: one env.ASSETS.fetch() + one cache write-back
@@ -39,16 +45,9 @@
  * Cache lookup failure (any throw) → fall through to ASSETS.
  * ASSETS fetch returning non-200 → throw (deploy bug, surface loudly).
  * Digest mismatch on either tier → throw (the bytes are compiled as a wasm
- * module, so they are verified against ESBUILD_WASM_SHA256 before returning).
- */
-/**
- * Path inside env.ASSETS where the esbuild-wasm binary lives.
- * Versioned so a future esbuild-wasm bump produces a different asset
- * name and forces a fresh fetch (no stale-cache risk). The matching
- * file is staged at public/_assets/esbuild-<version>.wasm by
- * scripts/bundle-esbuild-wasm.mjs at predeploy time.
+ * module or evaluated as facet code, so they are verified against the
+ * digest the generator recorded before returning).
  */
-export declare const ESBUILD_WASM_ASSET_PATH = "/_assets/esbuild-0.24.2.wasm";
 /**
  * The minimal env shape this module needs. Defined narrowly so the
  * caller can pass any env with an ASSETS Fetcher binding without
@@ -60,16 +59,18 @@ export interface EsbuildWasmFetchEnv {
     };
 }
 /**
- * Synthetic L2 cache key for the esbuild-wasm asset. Versioned via
- * ESBUILD_WASM_ASSET_PATH so each esbuild upgrade lands a fresh entry
- * and old entries naturally evict on TTL.
+ * Synthetic L2 cache keys for the esbuild-wasm assets, staged at
+ * public/_assets/esbuild-<version>.{wasm,js} by scripts/bundle-esbuild-wasm.mjs
+ * at predeploy time. Versioned via the asset paths so each esbuild upgrade
+ * lands fresh entries and old ones naturally evict on TTL.
  *
  * Exported so the test endpoint at /api/_test/cache/wasm/reset can
- * purge the entry between probe runs (otherwise wrangler dev's
+ * purge the entries between probe runs (otherwise wrangler dev's
  * persistent caches.default.state preserves the L2 hit across sessions
  * and the cold path is unobservable).
  */
-export declare const ESBUILD_WASM_L2_KEY = "https://nimbus-cache.invalid/_assets/esbuild-0.24.2.wasm";
+export declare const ESBUILD_WASM_L2_KEY: string;
+export declare const ESBUILD_JS_L2_KEY: string;
 /**
  * Fetch the esbuild-wasm bytes from the static-assets layer.
  *
@@ -84,4 +85,10 @@ export declare const ESBUILD_WASM_L2_KEY = "https://nimbus-cache.invalid/_assets
  * always the correct source of truth.
  */
 export declare function fetchEsbuildWasmBytes(env: EsbuildWasmFetchEnv): Promise<ArrayBuffer>;
+/**
+ * Fetch the esbuild-wasm JS adapter: the function body that, wrapped in
+ * `new Function(...)()`, returns the esbuild namespace. Facet sources
+ * splice it in verbatim, so it is verified like the wasm it drives.
+ */
+export declare function fetchEsbuildJsFnBody(env: EsbuildWasmFetchEnv): Promise<string>;
 //# sourceMappingURL=esbuild-wasm-bytes.d.ts.map

package/dist/runtime/esbuild-wasm-bytes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-wasm-bytes.d.ts","sourceRoot":"","sources":["../../src/runtime/esbuild-wasm-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAOH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,iCAA6C,CAAC;AAElF;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,6DAAyE,CAAC;AAE1G;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CA2E1F"}
+{"version":3,"file":"esbuild-wasm-bytes.d.ts","sourceRoot":"","sources":["../../src/runtime/esbuild-wasm-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAWH;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAA2D,CAAC;AAC5F,eAAO,MAAM,iBAAiB,QAAyD,CAAC;AA0BxF;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAEpF;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpF"}