@nimbus-sh/worker 0.9.0 → 0.11.0

package/dist/loaders/generated-workers.js

@@ -4,8 +4,9 @@
  * Produced by scripts/bundle-facet-workers.mjs from:
  *   - @nimbus-sh/core src/_shared/tarball-stream.ts (streaming tar primitives)
  *   - @nimbus-sh/platform src/w7-frame.ts (W7 streaming bulk-write encoder)
+ *   - @nimbus-sh/core src/_shared/esm-resolver.ts (Node's ESM resolver, for the node shims)
  *
- * Consumed by src/loaders/loader-pool.ts callers via the `preamble`
+ * Consumed by fabric/isolate-pool.ts callers via the `preamble`
  * option. The preamble is injected at the top of every generated
  * worker module so user functions can reference the exported
  * helpers by name.
@@ -15,8 +16,10 @@
  * W7-frame symbols:   encodeWriteBatchStream, decodeWriteBatchStream,
  *   W7_MAGIC, W7_MAX_RECORD_BYTES.
  *
- * Tar size: 4.62 KiB
- * W7 size:  29.55 KiB
+ * Tar size: 4.58 KiB
+ * W7 size:  30.14 KiB
  */
-export const TAR_STREAM_PREAMBLE = "// ../core/src/_shared/tarball-stream.ts\nvar MAX_FILE_BYTES = 2e7;\nfunction canonicalTarName(name) {\n  const out = [];\n  for (const seg of name.split(\"/\")) {\n    if (seg === \"..\") {\n      if (out.length === 0) return \"\";\n      out.pop();\n    } else if (seg !== \"\" && seg !== \".\") {\n      out.push(seg);\n    }\n  }\n  return out.join(\"/\");\n}\nfunction parseTarHeader(block) {\n  if (block[0] === 0) return null;\n  let name = \"\";\n  for (let i = 0; i < 100 && block[i] !== 0; i++) {\n    name += String.fromCharCode(block[i]);\n  }\n  let prefix = \"\";\n  for (let i = 345; i < 500 && block[i] !== 0; i++) {\n    prefix += String.fromCharCode(block[i]);\n  }\n  if (prefix) name = prefix + \"/\" + name;\n  name = canonicalTarName(name);\n  let sizeStr = \"\";\n  for (let i = 124; i < 136 && block[i] !== 0; i++) {\n    sizeStr += String.fromCharCode(block[i]);\n  }\n  const size = parseInt(sizeStr.trim(), 8) || 0;\n  const typeFlag = block[156];\n  return { name, size, typeFlag };\n}\nasync function* readableStreamToAsyncIterable(rs) {\n  const reader = rs.getReader();\n  try {\n    while (true) {\n      const { value, done } = await reader.read();\n      if (done) return;\n      if (value && value.length > 0) yield value;\n    }\n  } finally {\n    try {\n      reader.releaseLock();\n    } catch {\n    }\n  }\n}\nasync function* streamTarEntries(source, onSkip) {\n  let carry = new Uint8Array(0);\n  let state = { kind: \"header\" };\n  function concat(a, b) {\n    if (a.length === 0) return b;\n    if (b.length === 0) return a;\n    const out = new Uint8Array(a.length + b.length);\n    out.set(a, 0);\n    out.set(b, a.length);\n    return out;\n  }\n  for await (const chunkRaw of source) {\n    let buf = concat(carry, chunkRaw);\n    let cursor = 0;\n    while (true) {\n      if (state.kind === \"header\") {\n        if (buf.length - cursor < 512) break;\n        const header = buf.subarray(cursor, cursor + 512);\n        const parsed = parseTarHeader(header);\n        cursor += 512;\n        if (!parsed) return;\n        const { name, size, typeFlag } = parsed;\n        const pad = size === 0 ? 0 : (512 - size % 512) % 512;\n        const isRegularFile = typeFlag === 48 || typeFlag === 0;\n        if (size === 0) {\n          if (isRegularFile && name) {\n            yield { name, data: new Uint8Array(0) };\n          }\n          state = { kind: \"header\" };\n          continue;\n        }\n        if (!isRegularFile || !name || size > MAX_FILE_BYTES) {\n          if (onSkip) {\n            const reason = !isRegularFile ? \"non-regular\" : !name ? \"no-name\" : \"too-large\";\n            try {\n              onSkip(name, size, reason);\n            } catch {\n            }\n          }\n          state = { kind: \"skip\", remaining: size + pad };\n          continue;\n        }\n        state = {\n          kind: \"file\",\n          name,\n          remaining: size,\n          fileBuf: new Uint8Array(size),\n          fileOffset: 0,\n          pad,\n          skip: false\n        };\n        continue;\n      }\n      if (state.kind === \"file\") {\n        const avail2 = buf.length - cursor;\n        if (avail2 === 0) break;\n        if (state.remaining > 0) {\n          const take2 = Math.min(state.remaining, avail2);\n          state.fileBuf.set(buf.subarray(cursor, cursor + take2), state.fileOffset);\n          state.fileOffset += take2;\n          state.remaining -= take2;\n          cursor += take2;\n          if (state.remaining > 0) break;\n        }\n        if (state.pad > 0) {\n          const avail22 = buf.length - cursor;\n          if (avail22 === 0) break;\n          const take2 = Math.min(state.pad, avail22);\n          state.pad -= take2;\n          cursor += take2;\n          if (state.pad > 0) break;\n        }\n        yield { name: state.name, data: state.fileBuf };\n        state = { kind: \"header\" };\n        continue;\n      }\n      const avail = buf.length - cursor;\n      if (avail === 0) break;\n      const take = Math.min(state.remaining, avail);\n      cursor += take;\n      state.remaining -= take;\n      if (state.remaining > 0) break;\n      state = { kind: \"header\" };\n    }\n    if (cursor >= buf.length) {\n      carry = new Uint8Array(0);\n    } else if (cursor === 0) {\n      carry = buf;\n    } else {\n      carry = buf.slice(cursor);\n    }\n  }\n}\nasync function* streamPackageEntries(source, onSkip) {\n  let prefix = null;\n  for await (const entry of streamTarEntries(source, onSkip)) {\n    if (prefix === null) {\n      prefix = entry.name.split(\"/\", 1)[0];\n    }\n    if (entry.name === prefix) continue;\n    if (!entry.name.startsWith(prefix + \"/\")) {\n      throw new Error(\n        `package tarball is not single-rooted: entry \"${entry.name}\" sits outside \"${prefix}/\"`\n      );\n    }\n    yield { name: entry.name.slice(prefix.length + 1), data: entry.data };\n  }\n}";
-export const W7_FRAME_PREAMBLE = "// ../platform/src/limits.ts\nvar CHUNK_SIZE = 65536;\nvar MAX_TX_BLOB_BYTES = 1 * 1024 * 1024;\nvar SQLITE_MAX_STATEMENT_BYTES = 100 * 1024;\nvar MAX_RPC_SAFE_PAYLOAD_BYTES = 28 * 1024 * 1024;\nvar SUPERVISOR_HEAP_CEILING_BYTES = 64 * 1024 * 1024;\nvar SUPERVISOR_IN_FLIGHT_ALLOCATION_BUDGET_BYTES = 40 * 1024 * 1024;\nvar SUPERVISOR_READ_RESERVE_BYTES = 1024 * 1024;\nvar MAX_GLOBAL_WRITE_STREAM_CREDIT_BYTES = 8 * 1024 * 1024;\n\n// ../platform/src/w7-frame.ts\nvar W7_MAGIC = new Uint8Array([78, 87, 55, 3]);\nvar ENCODER_QUEUE_HWM = 0;\nvar MAX_METADATA_BYTES = 64 * 1024;\nvar MAX_PATH_BYTES = 64 * 1024;\nvar MAX_BATCH_ID_BYTES = 128;\nvar MAX_CONTENT_ID_BYTES = 256;\nvar W7_MAX_PATHS_PER_BATCH = 128;\nvar W7_MAX_OWNED_PATH_BYTES = 64 * 1024;\nvar W7_MAX_RECORD_BYTES = 5 + 4 + MAX_CONTENT_ID_BYTES + 8 + CHUNK_SIZE;\nvar MODE = \"path-atomic-committed-prefix\";\nfunction encodeWriteBatchStream(payload) {\n  const batchId = crypto.randomUUID();\n  const { deletes, directories, files } = preparePayload(payload, batchId);\n  const iterator = encodeRecords(batchId, deletes, directories, files);\n  let closed = false;\n  let magicEmitted = false;\n  const source = {\n    type: \"bytes\",\n    pull(controller) {\n      if (closed) return;\n      try {\n        if (!magicEmitted) {\n          magicEmitted = true;\n          controller.enqueue(W7_MAGIC.slice());\n          return;\n        }\n        const next = iterator.next();\n        if (next.done) {\n          closed = true;\n          controller.close();\n          return;\n        }\n        for (const part of next.value) controller.enqueue(part);\n      } catch (error) {\n        closed = true;\n        controller.error(error);\n      }\n    },\n    cancel() {\n      closed = true;\n      iterator.return?.(void 0);\n    }\n  };\n  return new ReadableStream(source, {\n    highWaterMark: ENCODER_QUEUE_HWM\n  });\n}\nasync function decodeWriteBatchStream(stream, options = {}) {\n  let reader;\n  try {\n    reader = stream.getReader({ mode: \"byob\" });\n  } catch {\n    throw new Error(\"w7-frame: stream must be a byte-oriented ReadableStream\");\n  }\n  const buffer = new ExactByteReader(reader, options.signal);\n  let handedOff = false;\n  try {\n    throwIfAborted(options.signal);\n    const magic = await buffer.readExact(W7_MAGIC.length, \"magic\");\n    if (!bytesEqual(magic, W7_MAGIC)) {\n      const version = magic.length === 4 && magic[0] === 78 && magic[1] === 87 && magic[2] === 55 ? magic[3] : null;\n      if (version !== null) {\n        throw new Error(`w7-frame: unsupported protocol version ${version}; expected 3`);\n      }\n      throw new Error(`w7-frame: bad magic, expected NW7\\\\x03, got ${hex(magic)}`);\n    }\n    const beginEnvelope = await readEnvelope(buffer, \"batch-begin\");\n    if (beginEnvelope.tag !== 1 /* BatchBegin */) {\n      throw new Error(`w7-frame: first record must be batch-begin, got tag ${beginEnvelope.tag}`);\n    }\n    if (beginEnvelope.length > MAX_METADATA_BYTES) {\n      throw new Error(\n        `w7-frame: batch-begin length ${beginEnvelope.length} exceeds ${MAX_METADATA_BYTES}`\n      );\n    }\n    const beginPayload = await buffer.readExact(beginEnvelope.length, \"batch-begin payload\");\n    const begin = parseBatchBegin(beginPayload);\n    const initialCheck = updateRecordCheck(CRC_SEED, beginEnvelope.header, beginPayload);\n    handedOff = true;\n    return {\n      batchId: begin.id,\n      mode: begin.mode,\n      records: decodeRecords(stream, reader, buffer, options, initialCheck)\n    };\n  } catch (error) {\n    if (!handedOff) await cancelReader(reader, error);\n    throw error;\n  }\n}\nasync function* decodeRecords(stream, reader, buffer, options, initialCheck) {\n  const ownedPaths = new PathOwnership();\n  const contentIds = /* @__PURE__ */ new Set();\n  let active = null;\n  let batchCheck = initialCheck;\n  const summary = {\n    recordCount: 1,\n    pathCount: 0,\n    deleteCount: 0,\n    directoryCount: 0,\n    fileCount: 0,\n    chunkCount: 0,\n    byteCount: 0\n  };\n  let completed = false;\n  let failure = new DOMException(\"W7 consumer cancelled\", \"AbortError\");\n  try {\n    while (true) {\n      throwIfAborted(options.signal);\n      const envelope = await readEnvelope(buffer, \"record\");\n      if (active && envelope.tag !== 5 /* FileChunk */ && envelope.tag !== 6 /* FileEnd */) {\n        throw new Error(`w7-frame: file ${active.inode.path} ended without file-end`);\n      }\n      if (envelope.tag === 5 /* FileChunk */) {\n        if (!active) throw new Error(\"w7-frame: file-chunk without active file\");\n        const prefixLength = Math.min(envelope.length, 4 + MAX_CONTENT_ID_BYTES + 8);\n        const idLengthBytes = await buffer.readExact(4, \"file-chunk content-id length\");\n        const idLength = readU32LE(idLengthBytes, 0);\n        if (idLength === 0 || idLength > MAX_CONTENT_ID_BYTES) {\n          throw new Error(`w7-frame: invalid file-chunk content-id length ${idLength}`);\n        }\n        const remainingPrefixLength = idLength + 8;\n        if (4 + remainingPrefixLength > prefixLength || 4 + remainingPrefixLength > envelope.length) {\n          throw new Error(\"w7-frame: malformed file-chunk record length\");\n        }\n        const rest = await buffer.readExact(remainingPrefixLength, \"file-chunk header\");\n        const contentId = decodeText(rest.subarray(0, idLength), \"file-chunk content id\");\n        const chunkId = readU32LE(rest, idLength);\n        const dataLength = readU32LE(rest, idLength + 4);\n        if (envelope.length !== 4 + idLength + 8 + dataLength) {\n          throw new Error(\"w7-frame: file-chunk payload length mismatch\");\n        }\n        if (contentId !== active.metadata.contentId) {\n          throw new Error(`w7-frame: file-chunk content id ${contentId} does not own ${active.inode.path}`);\n        }\n        if (chunkId !== active.nextChunkId) {\n          throw new Error(\n            `w7-frame: ${active.inode.path}: expected chunk ${active.nextChunkId}, got ${chunkId}`\n          );\n        }\n        if (chunkId >= active.inode.chunkCount) {\n          throw new Error(`w7-frame: ${active.inode.path}: chunk ${chunkId} is out of range`);\n        }\n        const expectedBytes = Math.min(\n          CHUNK_SIZE,\n          active.inode.size - chunkId * CHUNK_SIZE\n        );\n        if (dataLength !== expectedBytes || dataLength > CHUNK_SIZE) {\n          throw new Error(\n            `w7-frame: ${active.inode.path}: chunk ${chunkId} has ${dataLength} bytes; expected ${expectedBytes}`\n          );\n        }\n        const headerPayload = concatBytes(idLengthBytes, rest);\n        let retention = null;\n        try {\n          retention = options.retainChunk ? await options.retainChunk(dataLength, options.signal) : noopRetention(dataLength);\n          throwIfAborted(options.signal);\n          const data = await buffer.readExact(dataLength, \"file-chunk data\");\n          batchCheck = updateRecordCheck(batchCheck, envelope.header, headerPayload, data);\n          active.check = crc32Update(active.check, data);\n          active.nextChunkId++;\n          active.receivedBytes += dataLength;\n          summary.recordCount++;\n          summary.chunkCount++;\n          summary.byteCount += dataLength;\n          const record = {\n            type: \"file-chunk\",\n            streamContentId: contentId,\n            path: active.inode.path,\n            chunkId,\n            data,\n            retention\n          };\n          retention = null;\n          yield record;\n        } finally {\n          retention?.release();\n        }\n        continue;\n      }\n      if (envelope.length > MAX_METADATA_BYTES) {\n        throw new Error(`w7-frame: metadata record length ${envelope.length} exceeds ${MAX_METADATA_BYTES}`);\n      }\n      const payload = await buffer.readExact(envelope.length, \"record payload\");\n      if (envelope.tag !== 7 /* BatchEnd */) {\n        batchCheck = updateRecordCheck(batchCheck, envelope.header, payload);\n        summary.recordCount++;\n      }\n      switch (envelope.tag) {\n        case 2 /* Delete */: {\n          const metadata = parseDelete(payload);\n          claimPath(ownedPaths, metadata.path);\n          summary.pathCount++;\n          summary.deleteCount++;\n          yield { type: \"delete\", path: metadata.path };\n          break;\n        }\n        case 3 /* Directory */: {\n          const metadata = parseDirectory(payload);\n          claimPath(ownedPaths, metadata.path);\n          summary.pathCount++;\n          summary.directoryCount++;\n          yield { type: \"directory\", inode: directoryInode(metadata) };\n          break;\n        }\n        case 4 /* FileBegin */: {\n          const metadata = parseFileBegin(payload);\n          claimPath(ownedPaths, metadata.path);\n          if (contentIds.has(metadata.contentId)) {\n            throw new Error(`w7-frame: duplicate stream content id ${metadata.contentId}`);\n          }\n          contentIds.add(metadata.contentId);\n          const inode = fileInode(metadata);\n          summary.pathCount++;\n          summary.fileCount++;\n          active = {\n            metadata,\n            inode,\n            nextChunkId: 0,\n            receivedBytes: 0,\n            check: CRC_SEED\n          };\n          yield { type: \"file-begin\", streamContentId: metadata.contentId, inode };\n          break;\n        }\n        case 6 /* FileEnd */: {\n          if (!active) throw new Error(\"w7-frame: file-end without active file\");\n          const metadata = parseFileEnd(payload);\n          const actualCheck = crc32Finish(active.check);\n          if (metadata.contentId !== active.metadata.contentId) {\n            throw new Error(`w7-frame: file-end content id mismatch for ${active.inode.path}`);\n          }\n          if (metadata.size !== active.receivedBytes || metadata.size !== active.inode.size) {\n            throw new Error(`w7-frame: file-end byte total mismatch for ${active.inode.path}`);\n          }\n          if (metadata.chunkCount !== active.nextChunkId || metadata.chunkCount !== active.inode.chunkCount) {\n            throw new Error(`w7-frame: file-end chunk count mismatch for ${active.inode.path}`);\n          }\n          if (metadata.check !== actualCheck) {\n            throw new Error(`w7-frame: file-end check mismatch for ${active.inode.path}`);\n          }\n          const record = {\n            type: \"file-end\",\n            streamContentId: metadata.contentId,\n            path: active.inode.path,\n            size: metadata.size,\n            chunkCount: metadata.chunkCount,\n            check: metadata.check\n          };\n          active = null;\n          yield record;\n          break;\n        }\n        case 7 /* BatchEnd */: {\n          if (active) throw new Error(`w7-frame: batch-end while file ${active.inode.path} is active`);\n          const actual = parseBatchEnd(payload);\n          const expected = { ...summary, check: crc32Finish(batchCheck) };\n          if (!sameSummary(actual, expected)) {\n            throw new Error(\n              `w7-frame: batch-end summary mismatch; expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`\n            );\n          }\n          await buffer.ensureEof(stream);\n          completed = true;\n          yield { type: \"batch-end\", summary: actual };\n          return;\n        }\n        case 1 /* BatchBegin */:\n          throw new Error(\"w7-frame: duplicate batch-begin\");\n        default:\n          throw new Error(`w7-frame: unknown record tag ${envelope.tag}`);\n      }\n    }\n  } catch (error) {\n    failure = error;\n    throw error;\n  } finally {\n    if (completed) {\n      try {\n        reader.releaseLock();\n      } catch {\n      }\n    } else {\n      await cancelReader(reader, failure);\n    }\n  }\n}\nfunction* encodeRecords(batchId, deletes, directories, files) {\n  const state = {\n    batchCheck: CRC_SEED,\n    summary: {\n      recordCount: 0,\n      pathCount: 0,\n      deleteCount: 0,\n      directoryCount: 0,\n      fileCount: 0,\n      chunkCount: 0,\n      byteCount: 0\n    }\n  };\n  yield encodeMetadataRecord(1 /* BatchBegin */, { id: batchId, mode: MODE }, state);\n  for (const path of deletes) {\n    state.summary.pathCount++;\n    state.summary.deleteCount++;\n    yield encodeMetadataRecord(2 /* Delete */, { path }, state);\n  }\n  for (const inode of directories) {\n    state.summary.pathCount++;\n    state.summary.directoryCount++;\n    yield encodeMetadataRecord(3 /* Directory */, {\n      ...inodeMetadata(inode),\n      kind: inode.kind\n    }, state);\n  }\n  for (const file of files) {\n    state.summary.pathCount++;\n    state.summary.fileCount++;\n    yield encodeMetadataRecord(4 /* FileBegin */, {\n      ...inodeMetadata(file.inode),\n      kind: file.inode.kind,\n      contentId: file.contentId,\n      size: file.inode.size,\n      chunkCount: file.inode.chunkCount\n    }, state);\n    let fileCheck = CRC_SEED;\n    for (const chunk of file.chunks) {\n      const data = chunk.data;\n      const contentBytes = new TextEncoder().encode(file.contentId);\n      const prefix = new Uint8Array(4 + contentBytes.length + 8);\n      writeU32LE(prefix, 0, contentBytes.length);\n      prefix.set(contentBytes, 4);\n      writeU32LE(prefix, 4 + contentBytes.length, chunk.chunkId);\n      writeU32LE(prefix, 8 + contentBytes.length, data.byteLength);\n      const header = recordHeader(5 /* FileChunk */, prefix.byteLength + data.byteLength);\n      state.batchCheck = updateRecordCheck(state.batchCheck, header, prefix, data);\n      state.summary.recordCount++;\n      state.summary.chunkCount++;\n      state.summary.byteCount += data.byteLength;\n      fileCheck = crc32Update(fileCheck, data);\n      yield [concatBytes(header, prefix), data];\n    }\n    yield encodeMetadataRecord(6 /* FileEnd */, {\n      contentId: file.contentId,\n      size: file.inode.size,\n      chunkCount: file.inode.chunkCount,\n      check: crc32Finish(fileCheck)\n    }, state);\n  }\n  const end = {\n    ...state.summary,\n    check: crc32Finish(state.batchCheck)\n  };\n  yield encodeMetadataRecord(7 /* BatchEnd */, end);\n}\nfunction encodeMetadataRecord(tag, value, state) {\n  const payload = new TextEncoder().encode(JSON.stringify(value));\n  if (payload.byteLength > MAX_METADATA_BYTES) {\n    throw new Error(`w7-frame: metadata record exceeds ${MAX_METADATA_BYTES} bytes`);\n  }\n  const header = recordHeader(tag, payload.byteLength);\n  if (state && tag !== 7 /* BatchEnd */) {\n    state.batchCheck = updateRecordCheck(state.batchCheck, header, payload);\n    state.summary.recordCount++;\n  }\n  return [concatBytes(header, payload)];\n}\nfunction preparePayload(payload, batchId) {\n  if (!payload || !Array.isArray(payload.inodes) || !Array.isArray(payload.chunks)) {\n    throw new Error(\"w7-frame: payload must contain inode and chunk arrays\");\n  }\n  const ownedPaths = new PathOwnership();\n  const deletes = [...payload.deletePaths ?? []];\n  for (const path of deletes) claimPath(ownedPaths, canonicalPath(path, \"delete path\"));\n  const chunksByPath = /* @__PURE__ */ new Map();\n  for (const chunk of payload.chunks) {\n    const path = canonicalPath(chunk.path, \"chunk path\");\n    const list = chunksByPath.get(path);\n    if (list) list.push(chunk);\n    else chunksByPath.set(path, [chunk]);\n  }\n  const directories = [];\n  const files = [];\n  let fileIndex = 0;\n  for (const inode of payload.inodes) {\n    const path = canonicalPath(inode.path, \"inode path\");\n    if (path !== inode.path) throw new Error(`w7-frame: noncanonical inode path ${inode.path}`);\n    claimPath(ownedPaths, path);\n    const normalizedInode = normalizeInode(inode);\n    const fileChunks = chunksByPath.get(path) ?? [];\n    if (normalizedInode.kind === \"directory\") {\n      if (fileChunks.length > 0) throw new Error(`w7-frame: directory ${path} has chunks`);\n      directories.push(normalizedInode);\n    } else {\n      validateChunks(normalizedInode, fileChunks);\n      files.push({\n        inode: normalizedInode,\n        contentId: `${batchId}:${fileIndex++}`,\n        chunks: fileChunks\n      });\n    }\n    chunksByPath.delete(path);\n  }\n  if (chunksByPath.size > 0) {\n    throw new Error(`w7-frame: chunk has no inode: ${chunksByPath.keys().next().value}`);\n  }\n  return { deletes, directories, files };\n}\nfunction parseBatchBegin(bytes) {\n  const value = parseObject(bytes, \"batch-begin\", [\"id\", \"mode\"]);\n  const id = boundedString(value.id, \"batch id\", MAX_BATCH_ID_BYTES);\n  if (value.mode !== MODE) throw new Error(`w7-frame: unsupported batch mode ${String(value.mode)}`);\n  return { id, mode: MODE };\n}\nfunction parseDelete(bytes) {\n  const value = parseObject(bytes, \"delete\", [\"path\"]);\n  return { path: canonicalPath(value.path, \"delete path\") };\n}\nfunction parseDirectory(bytes) {\n  const value = parseObject(bytes, \"directory\", [\"path\", \"kind\", \"mtime\", \"mode\"], [\"atime\"]);\n  if (value.kind !== \"directory\") {\n    throw new Error(`w7-frame: unsupported directory kind ${String(value.kind)}`);\n  }\n  return { ...parseInodeMetadata(value, \"directory\"), kind: \"directory\" };\n}\nfunction parseFileBegin(bytes) {\n  const value = parseObject(\n    bytes,\n    \"file-begin\",\n    [\"path\", \"kind\", \"contentId\", \"size\", \"chunkCount\", \"mtime\", \"mode\"],\n    [\"atime\"]\n  );\n  const base = parseInodeMetadata(value, \"file-begin\");\n  if (value.kind !== \"file\" && value.kind !== \"symlink\") {\n    throw new Error(`w7-frame: unsupported file-begin kind ${String(value.kind)}`);\n  }\n  const contentId = boundedString(value.contentId, \"stream content id\", MAX_CONTENT_ID_BYTES);\n  if (!/^[A-Za-z0-9._:-]+$/.test(contentId)) {\n    throw new Error(`w7-frame: invalid stream content id ${contentId}`);\n  }\n  const size = safeInteger(value.size, \"file size\");\n  const chunkCount = u32(value.chunkCount, \"file chunk count\");\n  const expected = size === 0 ? 0 : Math.ceil(size / CHUNK_SIZE);\n  if (chunkCount !== expected) {\n    throw new Error(`w7-frame: ${base.path}: expected ${expected} chunks, got ${chunkCount}`);\n  }\n  return { ...base, kind: value.kind, contentId, size, chunkCount };\n}\nfunction parseFileEnd(bytes) {\n  const value = parseObject(bytes, \"file-end\", [\"contentId\", \"size\", \"chunkCount\", \"check\"]);\n  return {\n    contentId: boundedString(value.contentId, \"stream content id\", MAX_CONTENT_ID_BYTES),\n    size: safeInteger(value.size, \"file-end size\"),\n    chunkCount: u32(value.chunkCount, \"file-end chunk count\"),\n    check: u32(value.check, \"file-end check\")\n  };\n}\nfunction parseBatchEnd(bytes) {\n  const keys = [\n    \"recordCount\",\n    \"pathCount\",\n    \"deleteCount\",\n    \"directoryCount\",\n    \"fileCount\",\n    \"chunkCount\",\n    \"byteCount\",\n    \"check\"\n  ];\n  const value = parseObject(bytes, \"batch-end\", keys);\n  return {\n    recordCount: safeInteger(value.recordCount, \"batch record count\"),\n    pathCount: safeInteger(value.pathCount, \"batch path count\"),\n    deleteCount: safeInteger(value.deleteCount, \"batch delete count\"),\n    directoryCount: safeInteger(value.directoryCount, \"batch directory count\"),\n    fileCount: safeInteger(value.fileCount, \"batch file count\"),\n    chunkCount: safeInteger(value.chunkCount, \"batch chunk count\"),\n    byteCount: safeInteger(value.byteCount, \"batch byte count\"),\n    check: u32(value.check, \"batch check\")\n  };\n}\nfunction parseInodeMetadata(value, label) {\n  return {\n    path: canonicalPath(value.path, `${label} path`),\n    ...value.atime === void 0 ? {} : { atime: safeInteger(value.atime, `${label} atime`) },\n    mtime: safeInteger(value.mtime, `${label} mtime`),\n    mode: u32(value.mode, `${label} mode`)\n  };\n}\nfunction parseObject(bytes, label, required, optional = []) {\n  let value;\n  try {\n    value = JSON.parse(decodeText(bytes, label));\n  } catch (error) {\n    if (error instanceof Error && error.message.startsWith(\"w7-frame:\")) throw error;\n    throw new Error(`w7-frame: invalid ${label} JSON: ${errorMessage(error)}`);\n  }\n  if (!isObject(value) || Array.isArray(value)) throw new Error(`w7-frame: ${label} must be an object`);\n  const allowed = /* @__PURE__ */ new Set([...required, ...optional]);\n  for (const key of required) {\n    if (!Object.hasOwn(value, key)) throw new Error(`w7-frame: ${label} missing ${key}`);\n  }\n  for (const key of Object.keys(value)) {\n    if (!allowed.has(key)) throw new Error(`w7-frame: ${label} has unknown field ${key}`);\n  }\n  return value;\n}\nfunction normalizeInode(inode) {\n  canonicalPath(inode.path, \"inode path\");\n  if (inode.parentPath !== parentPath(inode.path)) {\n    throw new Error(`w7-frame: ${inode.path}: noncanonical parent path ${inode.parentPath}`);\n  }\n  safeInteger(inode.size, `${inode.path} size`);\n  u32(inode.chunkCount, `${inode.path} chunk count`);\n  safeInteger(inode.mtime, `${inode.path} mtime`);\n  if (inode.atime !== void 0) safeInteger(inode.atime, `${inode.path} atime`);\n  u32(inode.mode, `${inode.path} mode`);\n  const rawKind = inode.kind ?? (inode.isDir ? \"directory\" : \"file\");\n  if (rawKind !== \"file\" && rawKind !== \"directory\" && rawKind !== \"symlink\") {\n    throw new Error(`w7-frame: unsupported inode kind ${String(rawKind)}`);\n  }\n  const kind = rawKind;\n  if (kind === \"directory\" && !inode.isDir) {\n    throw new Error(`w7-frame: directory inode ${inode.path} must be a directory`);\n  }\n  if (kind !== \"directory\" && inode.isDir) {\n    throw new Error(`w7-frame: ${kind} inode ${inode.path} cannot be a directory`);\n  }\n  if (kind === \"directory\" && (inode.size !== 0 || inode.chunkCount !== 0)) {\n    throw new Error(`w7-frame: directory ${inode.path} must have zero size and chunks`);\n  }\n  if (kind !== \"directory\") {\n    const expected = inode.size === 0 ? 0 : Math.ceil(inode.size / CHUNK_SIZE);\n    if (inode.chunkCount !== expected) {\n      throw new Error(`w7-frame: ${inode.path}: expected ${expected} chunks, got ${inode.chunkCount}`);\n    }\n    return { ...inode, kind, isDir: false };\n  }\n  return { ...inode, kind, isDir: true };\n}\nfunction validateChunks(inode, chunks) {\n  if (chunks.length !== inode.chunkCount) {\n    throw new Error(`w7-frame: ${inode.path}: expected ${inode.chunkCount} chunks, got ${chunks.length}`);\n  }\n  chunks.sort((left, right) => left.chunkId - right.chunkId);\n  for (let index = 0; index < chunks.length; index++) {\n    const chunk = chunks[index];\n    if (chunk.chunkId !== index) {\n      throw new Error(`w7-frame: ${inode.path}: expected chunk ${index}, got ${chunk.chunkId}`);\n    }\n    const expected = Math.min(CHUNK_SIZE, inode.size - index * CHUNK_SIZE);\n    if (!(chunk.data instanceof Uint8Array) || chunk.data.byteLength !== expected) {\n      throw new Error(`w7-frame: ${inode.path}: chunk ${index} must contain ${expected} bytes`);\n    }\n  }\n}\nfunction directoryInode(metadata) {\n  return {\n    path: metadata.path,\n    parentPath: parentPath(metadata.path),\n    kind: metadata.kind,\n    isDir: true,\n    size: 0,\n    atime: metadata.atime,\n    mtime: metadata.mtime,\n    mode: metadata.mode,\n    chunkCount: 0\n  };\n}\nfunction fileInode(metadata) {\n  return {\n    path: metadata.path,\n    parentPath: parentPath(metadata.path),\n    kind: metadata.kind,\n    isDir: false,\n    size: metadata.size,\n    atime: metadata.atime,\n    mtime: metadata.mtime,\n    mode: metadata.mode,\n    chunkCount: metadata.chunkCount\n  };\n}\nfunction inodeMetadata(inode) {\n  return {\n    path: inode.path,\n    ...inode.atime === void 0 ? {} : { atime: inode.atime },\n    mtime: inode.mtime,\n    mode: inode.mode\n  };\n}\nfunction canonicalPath(value, label) {\n  const path = boundedString(value, label, MAX_PATH_BYTES);\n  if (path.includes(\"\\0\")) throw new Error(`w7-frame: ${label} contains NUL`);\n  const normalized = normalizePath(path);\n  if (!path || normalized !== path) throw new Error(`w7-frame: noncanonical ${label}: ${path}`);\n  return path;\n}\nvar PathOwnership = class {\n  paths = /* @__PURE__ */ new Set();\n  pathBytes = 0;\n  claim(path) {\n    if (this.paths.has(path)) throw new Error(`w7-frame: duplicate path ownership: ${path}`);\n    if (this.paths.size >= W7_MAX_PATHS_PER_BATCH) {\n      throw new Error(`w7-frame: batch exceeds ${W7_MAX_PATHS_PER_BATCH} owned paths`);\n    }\n    const nextPathBytes = this.pathBytes + new TextEncoder().encode(path).byteLength;\n    if (nextPathBytes > W7_MAX_OWNED_PATH_BYTES) {\n      throw new Error(\n        `w7-frame: owned path bytes exceed ${W7_MAX_OWNED_PATH_BYTES}`\n      );\n    }\n    this.paths.add(path);\n    this.pathBytes = nextPathBytes;\n  }\n};\nfunction claimPath(paths, path) {\n  paths.claim(path);\n}\nfunction normalizePath(path) {\n  const out = [];\n  for (const segment of path.split(\"/\")) {\n    if (segment === \"..\") {\n      if (out.length > 0) out.pop();\n    } else if (segment !== \"\" && segment !== \".\") {\n      out.push(segment);\n    }\n  }\n  return out.join(\"/\");\n}\nfunction parentPath(path) {\n  const index = path.lastIndexOf(\"/\");\n  return index < 0 ? \"\" : path.slice(0, index);\n}\nfunction boundedString(value, label, maxBytes) {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new Error(`w7-frame: ${label} must be a non-empty string`);\n  }\n  const length = new TextEncoder().encode(value).byteLength;\n  if (length > maxBytes) throw new Error(`w7-frame: ${label} exceeds ${maxBytes} bytes`);\n  return value;\n}\nfunction safeInteger(value, label) {\n  if (!Number.isSafeInteger(value) || value < 0) {\n    throw new Error(`w7-frame: ${label} must be a non-negative safe integer`);\n  }\n  return value;\n}\nfunction u32(value, label) {\n  const integer = safeInteger(value, label);\n  if (integer > 4294967295) throw new Error(`w7-frame: ${label} exceeds uint32`);\n  return integer;\n}\nfunction sameSummary(left, right) {\n  return left.recordCount === right.recordCount && left.pathCount === right.pathCount && left.deleteCount === right.deleteCount && left.directoryCount === right.directoryCount && left.fileCount === right.fileCount && left.chunkCount === right.chunkCount && left.byteCount === right.byteCount && left.check === right.check;\n}\nasync function readEnvelope(buffer, label) {\n  const header = await buffer.readExact(5, `${label} header`);\n  return { tag: header[0], length: readU32LE(header, 1), header };\n}\nfunction recordHeader(tag, length) {\n  const header = new Uint8Array(5);\n  header[0] = tag;\n  writeU32LE(header, 1, length);\n  return header;\n}\nfunction writeU32LE(out, offset, value) {\n  out[offset] = value & 255;\n  out[offset + 1] = value >>> 8 & 255;\n  out[offset + 2] = value >>> 16 & 255;\n  out[offset + 3] = value >>> 24 & 255;\n}\nfunction readU32LE(bytes, offset) {\n  return (bytes[offset] | bytes[offset + 1] << 8 | bytes[offset + 2] << 16 | bytes[offset + 3] << 24) >>> 0;\n}\nfunction updateRecordCheck(seed, ...parts) {\n  let check = seed;\n  for (const part of parts) check = crc32Update(check, part);\n  return check;\n}\nvar CRC_SEED = 4294967295;\nvar crcTable = null;\nfunction crc32Update(check, bytes) {\n  crcTable ??= createCrcTable();\n  const table = crcTable;\n  let value = check;\n  for (const byte of bytes) value = table[(value ^ byte) & 255] ^ value >>> 8;\n  return value >>> 0;\n}\nfunction crc32Finish(check) {\n  return (check ^ 4294967295) >>> 0;\n}\nfunction createCrcTable() {\n  const table = new Uint32Array(256);\n  for (let index = 0; index < table.length; index++) {\n    let value = index;\n    for (let bit = 0; bit < 8; bit++) {\n      value = (value & 1) !== 0 ? 3988292384 ^ value >>> 1 : value >>> 1;\n    }\n    table[index] = value >>> 0;\n  }\n  return table;\n}\nfunction noopRetention(bytes) {\n  return { bytes, release() {\n  } };\n}\nfunction decodeText(bytes, label) {\n  try {\n    return new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: false }).decode(bytes);\n  } catch (error) {\n    throw new Error(`w7-frame: invalid UTF-8 in ${label}: ${errorMessage(error)}`);\n  }\n}\nfunction concatBytes(...parts) {\n  const output = new Uint8Array(parts.reduce((total, part) => total + part.byteLength, 0));\n  let offset = 0;\n  for (const part of parts) {\n    output.set(part, offset);\n    offset += part.byteLength;\n  }\n  return output;\n}\nfunction bytesEqual(left, right) {\n  return left.length === right.length && left.every((byte, index) => byte === right[index]);\n}\nfunction hex(bytes) {\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\" \");\n}\nfunction isObject(value) {\n  return typeof value === \"object\" && value !== null;\n}\nfunction errorMessage(error) {\n  return error instanceof Error ? error.message : String(error);\n}\nfunction throwIfAborted(signal) {\n  if (!signal?.aborted) return;\n  throw new DOMException(\n    signal.reason instanceof Error ? signal.reason.message : String(signal.reason ?? \"Aborted\"),\n    \"AbortError\"\n  );\n}\nasync function cancelReader(reader, reason) {\n  try {\n    await reader.cancel(reason);\n  } catch {\n  }\n  try {\n    reader.releaseLock();\n  } catch {\n  }\n}\nvar ExactByteReader = class {\n  constructor(reader, signal) {\n    this.reader = reader;\n    this.signal = signal;\n  }\n  reader;\n  signal;\n  done = false;\n  async read(read, cancel) {\n    throwIfAborted(this.signal);\n    const abort = () => {\n      void cancel().catch(() => {\n      });\n    };\n    this.signal?.addEventListener(\"abort\", abort, { once: true });\n    try {\n      const result = await read();\n      throwIfAborted(this.signal);\n      return result;\n    } finally {\n      this.signal?.removeEventListener(\"abort\", abort);\n    }\n  }\n  async readExact(length, label) {\n    if (length === 0) return new Uint8Array(0);\n    const output = new Uint8Array(length);\n    let offset = 0;\n    while (offset < length) {\n      if (this.done) {\n        throw new Error(\n          `w7-frame: stream ended ${offset} bytes into expected ${length}-byte ${label}`\n        );\n      }\n      const next = await this.read(\n        () => this.reader.read(new Uint8Array(length - offset)),\n        () => this.reader.cancel(this.signal?.reason)\n      );\n      if (next.done) this.done = true;\n      else if (next.value.byteLength > 0) {\n        output.set(next.value, offset);\n        offset += next.value.byteLength;\n      }\n    }\n    return output;\n  }\n  async ensureEof(stream) {\n    if (this.done) return;\n    this.reader.releaseLock();\n    const reader = stream.getReader();\n    try {\n      const next = await this.read(() => reader.read(), () => reader.cancel(this.signal?.reason));\n      if (!next.done && next.value.byteLength > 0) {\n        await reader.cancel(new Error(\"w7-frame: trailing bytes after batch-end\"));\n        throw new Error(\"w7-frame: trailing bytes after batch-end\");\n      }\n      this.done = true;\n    } finally {\n      try {\n        reader.releaseLock();\n      } catch {\n      }\n    }\n  }\n};";
+export const TAR_STREAM_PREAMBLE = "var MAX_FILE_BYTES = 2e7;\nfunction canonicalTarName(name) {\n  const out = [];\n  for (const seg of name.split(\"/\")) {\n    if (seg === \"..\") {\n      if (out.length === 0) return \"\";\n      out.pop();\n    } else if (seg !== \"\" && seg !== \".\") {\n      out.push(seg);\n    }\n  }\n  return out.join(\"/\");\n}\nfunction parseTarHeader(block) {\n  if (block[0] === 0) return null;\n  let name = \"\";\n  for (let i = 0; i < 100 && block[i] !== 0; i++) {\n    name += String.fromCharCode(block[i]);\n  }\n  let prefix = \"\";\n  for (let i = 345; i < 500 && block[i] !== 0; i++) {\n    prefix += String.fromCharCode(block[i]);\n  }\n  if (prefix) name = prefix + \"/\" + name;\n  name = canonicalTarName(name);\n  let sizeStr = \"\";\n  for (let i = 124; i < 136 && block[i] !== 0; i++) {\n    sizeStr += String.fromCharCode(block[i]);\n  }\n  const size = parseInt(sizeStr.trim(), 8) || 0;\n  const typeFlag = block[156];\n  return { name, size, typeFlag };\n}\nasync function* readableStreamToAsyncIterable(rs) {\n  const reader = rs.getReader();\n  try {\n    while (true) {\n      const { value, done } = await reader.read();\n      if (done) return;\n      if (value && value.length > 0) yield value;\n    }\n  } finally {\n    try {\n      reader.releaseLock();\n    } catch {\n    }\n  }\n}\nasync function* streamTarEntries(source, onSkip) {\n  let carry = new Uint8Array(0);\n  let state = { kind: \"header\" };\n  function concat(a, b) {\n    if (a.length === 0) return b;\n    if (b.length === 0) return a;\n    const out = new Uint8Array(a.length + b.length);\n    out.set(a, 0);\n    out.set(b, a.length);\n    return out;\n  }\n  for await (const chunkRaw of source) {\n    let buf = concat(carry, chunkRaw);\n    let cursor = 0;\n    while (true) {\n      if (state.kind === \"header\") {\n        if (buf.length - cursor < 512) break;\n        const header = buf.subarray(cursor, cursor + 512);\n        const parsed = parseTarHeader(header);\n        cursor += 512;\n        if (!parsed) return;\n        const { name, size, typeFlag } = parsed;\n        const pad = size === 0 ? 0 : (512 - size % 512) % 512;\n        const isRegularFile = typeFlag === 48 || typeFlag === 0;\n        if (size === 0) {\n          if (isRegularFile && name) {\n            yield { name, data: new Uint8Array(0) };\n          }\n          state = { kind: \"header\" };\n          continue;\n        }\n        if (!isRegularFile || !name || size > MAX_FILE_BYTES) {\n          if (onSkip) {\n            const reason = !isRegularFile ? \"non-regular\" : !name ? \"no-name\" : \"too-large\";\n            try {\n              onSkip(name, size, reason);\n            } catch {\n            }\n          }\n          state = { kind: \"skip\", remaining: size + pad };\n          continue;\n        }\n        state = {\n          kind: \"file\",\n          name,\n          remaining: size,\n          fileBuf: new Uint8Array(size),\n          fileOffset: 0,\n          pad,\n          skip: false\n        };\n        continue;\n      }\n      if (state.kind === \"file\") {\n        const avail2 = buf.length - cursor;\n        if (avail2 === 0) break;\n        if (state.remaining > 0) {\n          const take2 = Math.min(state.remaining, avail2);\n          state.fileBuf.set(buf.subarray(cursor, cursor + take2), state.fileOffset);\n          state.fileOffset += take2;\n          state.remaining -= take2;\n          cursor += take2;\n          if (state.remaining > 0) break;\n        }\n        if (state.pad > 0) {\n          const avail22 = buf.length - cursor;\n          if (avail22 === 0) break;\n          const take2 = Math.min(state.pad, avail22);\n          state.pad -= take2;\n          cursor += take2;\n          if (state.pad > 0) break;\n        }\n        yield { name: state.name, data: state.fileBuf };\n        state = { kind: \"header\" };\n        continue;\n      }\n      const avail = buf.length - cursor;\n      if (avail === 0) break;\n      const take = Math.min(state.remaining, avail);\n      cursor += take;\n      state.remaining -= take;\n      if (state.remaining > 0) break;\n      state = { kind: \"header\" };\n    }\n    if (cursor >= buf.length) {\n      carry = new Uint8Array(0);\n    } else if (cursor === 0) {\n      carry = buf;\n    } else {\n      carry = buf.slice(cursor);\n    }\n  }\n}\nasync function* streamPackageEntries(source, onSkip) {\n  let prefix = null;\n  for await (const entry of streamTarEntries(source, onSkip)) {\n    if (prefix === null) {\n      prefix = entry.name.split(\"/\", 1)[0];\n    }\n    if (entry.name === prefix) continue;\n    if (!entry.name.startsWith(prefix + \"/\")) {\n      throw new Error(\n        `package tarball is not single-rooted: entry \"${entry.name}\" sits outside \"${prefix}/\"`\n      );\n    }\n    yield { name: entry.name.slice(prefix.length + 1), data: entry.data };\n  }\n}";
+export const W7_FRAME_PREAMBLE = "var CRC_NATIVE_MIN_BYTES = 128;\nvar nativeCrc32 = (() => {\n  try {\n    const crc322 = globalThis.process?.getBuiltinModule?.(\"node:zlib\")?.crc32;\n    return typeof crc322 === \"function\" ? crc322 : null;\n  } catch {\n    return null;\n  }\n})();\nvar crcTables = null;\nfunction createCrcTables() {\n  const table = new Uint32Array(256 * 8);\n  for (let index = 0; index < 256; index++) {\n    let value = index;\n    for (let bit = 0; bit < 8; bit++) value = (value & 1) !== 0 ? 3988292384 ^ value >>> 1 : value >>> 1;\n    table[index] = value;\n  }\n  for (let index = 0; index < 256; index++) {\n    let value = table[index];\n    for (let k = 1; k < 8; k++) {\n      value = table[value & 255] ^ value >>> 8;\n      table[k * 256 + index] = value;\n    }\n  }\n  return table;\n}\nfunction crc32(bytes, previous = 0) {\n  if (nativeCrc32 !== null && bytes.length >= CRC_NATIVE_MIN_BYTES) return nativeCrc32(bytes, previous) >>> 0;\n  const t = crcTables ??= createCrcTables();\n  let value = ~previous;\n  const length = bytes.length;\n  const whole = length - (length & 7);\n  let i = 0;\n  for (; i < whole; i += 8) {\n    const low = value ^ (bytes[i] | bytes[i + 1] << 8 | bytes[i + 2] << 16 | bytes[i + 3] << 24);\n    const high = bytes[i + 4] | bytes[i + 5] << 8 | bytes[i + 6] << 16 | bytes[i + 7] << 24;\n    value = t[1792 + (low & 255)] ^ t[1536 + (low >>> 8 & 255)] ^ t[1280 + (low >>> 16 & 255)] ^ t[1024 + (low >>> 24)] ^ t[768 + (high & 255)] ^ t[512 + (high >>> 8 & 255)] ^ t[256 + (high >>> 16 & 255)] ^ t[high >>> 24];\n  }\n  for (; i < length; i++) value = t[(value ^ bytes[i]) & 255] ^ value >>> 8;\n  return ~value >>> 0;\n}\n\nvar CHUNK_SIZE = 65536;\nvar MAX_TX_BLOB_BYTES = 1 * 1024 * 1024;\nvar SQLITE_MAX_STATEMENT_BYTES = 100 * 1024;\nvar MAX_RPC_SAFE_PAYLOAD_BYTES = 28 * 1024 * 1024;\nvar ONE_SHOT_MODULE_MAP_MAX_BYTES = 18 * 1024 * 1024;\nvar SUPERVISOR_HEAP_CEILING_BYTES = 64 * 1024 * 1024;\nvar FACET_OWN_WRITE_MEMORY_BYTES = 32 * 1024 * 1024;\nvar SUPERVISOR_IN_FLIGHT_ALLOCATION_BUDGET_BYTES = 40 * 1024 * 1024;\nvar SUPERVISOR_READ_RESERVE_BYTES = 1024 * 1024;\nvar MAX_GLOBAL_WRITE_STREAM_CREDIT_BYTES = 8 * 1024 * 1024;\n\nvar W7_MAGIC = new Uint8Array([78, 87, 55, 3]);\nvar ENCODER_QUEUE_HWM = 0;\nvar MAX_METADATA_BYTES = 64 * 1024;\nvar MAX_PATH_BYTES = 64 * 1024;\nvar MAX_BATCH_ID_BYTES = 128;\nvar MAX_CONTENT_ID_BYTES = 256;\nvar W7_MAX_PATHS_PER_BATCH = 128;\nvar W7_MAX_OWNED_PATH_BYTES = 64 * 1024;\nvar W7_MAX_RECORD_BYTES = 5 + 4 + MAX_CONTENT_ID_BYTES + 8 + CHUNK_SIZE;\nvar MODE = \"path-atomic-committed-prefix\";\nfunction encodeWriteBatchStream(payload) {\n  const batchId = crypto.randomUUID();\n  const { deletes, directories, files } = preparePayload(payload, batchId);\n  const iterator = encodeRecords(batchId, deletes, directories, files);\n  let closed = false;\n  let magicEmitted = false;\n  const source = {\n    type: \"bytes\",\n    pull(controller) {\n      if (closed) return;\n      try {\n        if (!magicEmitted) {\n          magicEmitted = true;\n          controller.enqueue(W7_MAGIC.slice());\n          return;\n        }\n        const next = iterator.next();\n        if (next.done) {\n          closed = true;\n          controller.close();\n          return;\n        }\n        for (const part of next.value) controller.enqueue(part);\n      } catch (error) {\n        closed = true;\n        controller.error(error);\n      }\n    },\n    cancel() {\n      closed = true;\n      iterator.return?.(void 0);\n    }\n  };\n  return new ReadableStream(source, {\n    highWaterMark: ENCODER_QUEUE_HWM\n  });\n}\nasync function decodeWriteBatchStream(stream, options = {}) {\n  let reader;\n  try {\n    reader = stream.getReader({ mode: \"byob\" });\n  } catch {\n    throw new Error(\"w7-frame: stream must be a byte-oriented ReadableStream\");\n  }\n  const buffer = new ExactByteReader(reader, options.signal);\n  let handedOff = false;\n  try {\n    throwIfAborted(options.signal);\n    const magic = await buffer.readExact(W7_MAGIC.length, \"magic\");\n    if (!bytesEqual(magic, W7_MAGIC)) {\n      const version = magic.length === 4 && magic[0] === 78 && magic[1] === 87 && magic[2] === 55 ? magic[3] : null;\n      if (version !== null) {\n        throw new Error(`w7-frame: unsupported protocol version ${version}; expected 3`);\n      }\n      throw new Error(`w7-frame: bad magic, expected NW7\\\\x03, got ${hex(magic)}`);\n    }\n    const beginEnvelope = await readEnvelope(buffer, \"batch-begin\");\n    if (beginEnvelope.tag !== 1  ) {\n      throw new Error(`w7-frame: first record must be batch-begin, got tag ${beginEnvelope.tag}`);\n    }\n    if (beginEnvelope.length > MAX_METADATA_BYTES) {\n      throw new Error(\n        `w7-frame: batch-begin length ${beginEnvelope.length} exceeds ${MAX_METADATA_BYTES}`\n      );\n    }\n    const beginPayload = await buffer.readExact(beginEnvelope.length, \"batch-begin payload\");\n    const begin = parseBatchBegin(beginPayload);\n    const initialCheck = updateRecordCheck(0, beginEnvelope.header, beginPayload);\n    handedOff = true;\n    return {\n      batchId: begin.id,\n      mode: begin.mode,\n      records: decodeRecords(stream, reader, buffer, options, initialCheck)\n    };\n  } catch (error) {\n    if (!handedOff) await cancelReader(reader, error);\n    throw error;\n  }\n}\nasync function* decodeRecords(stream, reader, buffer, options, initialCheck) {\n  const ownedPaths = new PathOwnership();\n  const contentIds =   new Set();\n  let active = null;\n  let batchCheck = initialCheck;\n  const summary = {\n    recordCount: 1,\n    pathCount: 0,\n    deleteCount: 0,\n    directoryCount: 0,\n    fileCount: 0,\n    chunkCount: 0,\n    byteCount: 0\n  };\n  let completed = false;\n  let failure = new DOMException(\"W7 consumer cancelled\", \"AbortError\");\n  try {\n    while (true) {\n      throwIfAborted(options.signal);\n      const envelope = await readEnvelope(buffer, \"record\");\n      if (active && envelope.tag !== 5   && envelope.tag !== 6  ) {\n        throw new Error(`w7-frame: file ${active.inode.path} ended without file-end`);\n      }\n      if (envelope.tag === 5  ) {\n        if (!active) throw new Error(\"w7-frame: file-chunk without active file\");\n        const prefixLength = Math.min(envelope.length, 4 + MAX_CONTENT_ID_BYTES + 8);\n        const idLengthBytes = await buffer.readExact(4, \"file-chunk content-id length\");\n        const idLength = readU32LE(idLengthBytes, 0);\n        if (idLength === 0 || idLength > MAX_CONTENT_ID_BYTES) {\n          throw new Error(`w7-frame: invalid file-chunk content-id length ${idLength}`);\n        }\n        const remainingPrefixLength = idLength + 8;\n        if (4 + remainingPrefixLength > prefixLength || 4 + remainingPrefixLength > envelope.length) {\n          throw new Error(\"w7-frame: malformed file-chunk record length\");\n        }\n        const rest = await buffer.readExact(remainingPrefixLength, \"file-chunk header\");\n        const contentId = decodeText(rest.subarray(0, idLength), \"file-chunk content id\");\n        const chunkId = readU32LE(rest, idLength);\n        const dataLength = readU32LE(rest, idLength + 4);\n        if (envelope.length !== 4 + idLength + 8 + dataLength) {\n          throw new Error(\"w7-frame: file-chunk payload length mismatch\");\n        }\n        if (contentId !== active.metadata.contentId) {\n          throw new Error(`w7-frame: file-chunk content id ${contentId} does not own ${active.inode.path}`);\n        }\n        if (chunkId !== active.nextChunkId) {\n          throw new Error(\n            `w7-frame: ${active.inode.path}: expected chunk ${active.nextChunkId}, got ${chunkId}`\n          );\n        }\n        if (chunkId >= active.inode.chunkCount) {\n          throw new Error(`w7-frame: ${active.inode.path}: chunk ${chunkId} is out of range`);\n        }\n        const expectedBytes = Math.min(\n          CHUNK_SIZE,\n          active.inode.size - chunkId * CHUNK_SIZE\n        );\n        if (dataLength !== expectedBytes || dataLength > CHUNK_SIZE) {\n          throw new Error(\n            `w7-frame: ${active.inode.path}: chunk ${chunkId} has ${dataLength} bytes; expected ${expectedBytes}`\n          );\n        }\n        const headerPayload = concatBytes(idLengthBytes, rest);\n        let retention = null;\n        try {\n          retention = options.retainChunk ? await options.retainChunk(dataLength, options.signal) : noopRetention(dataLength);\n          throwIfAborted(options.signal);\n          const data = await buffer.readExact(dataLength, \"file-chunk data\");\n          batchCheck = updateRecordCheck(batchCheck, envelope.header, headerPayload, data);\n          active.check = crc32(data, active.check);\n          active.nextChunkId++;\n          active.receivedBytes += dataLength;\n          summary.recordCount++;\n          summary.chunkCount++;\n          summary.byteCount += dataLength;\n          const record = {\n            type: \"file-chunk\",\n            streamContentId: contentId,\n            path: active.inode.path,\n            chunkId,\n            data,\n            retention\n          };\n          retention = null;\n          yield record;\n        } finally {\n          retention?.release();\n        }\n        continue;\n      }\n      if (envelope.length > MAX_METADATA_BYTES) {\n        throw new Error(`w7-frame: metadata record length ${envelope.length} exceeds ${MAX_METADATA_BYTES}`);\n      }\n      const payload = await buffer.readExact(envelope.length, \"record payload\");\n      if (envelope.tag !== 7  ) {\n        batchCheck = updateRecordCheck(batchCheck, envelope.header, payload);\n        summary.recordCount++;\n      }\n      switch (envelope.tag) {\n        case 2  : {\n          const metadata = parseDelete(payload);\n          claimPath(ownedPaths, metadata.path);\n          summary.pathCount++;\n          summary.deleteCount++;\n          yield { type: \"delete\", path: metadata.path };\n          break;\n        }\n        case 3  : {\n          const metadata = parseDirectory(payload);\n          claimPath(ownedPaths, metadata.path);\n          summary.pathCount++;\n          summary.directoryCount++;\n          yield { type: \"directory\", inode: directoryInode(metadata) };\n          break;\n        }\n        case 4  : {\n          const metadata = parseFileBegin(payload);\n          claimPath(ownedPaths, metadata.path);\n          if (contentIds.has(metadata.contentId)) {\n            throw new Error(`w7-frame: duplicate stream content id ${metadata.contentId}`);\n          }\n          contentIds.add(metadata.contentId);\n          const inode = fileInode(metadata);\n          summary.pathCount++;\n          summary.fileCount++;\n          active = {\n            metadata,\n            inode,\n            nextChunkId: 0,\n            receivedBytes: 0,\n            check: 0\n          };\n          yield { type: \"file-begin\", streamContentId: metadata.contentId, inode };\n          break;\n        }\n        case 6  : {\n          if (!active) throw new Error(\"w7-frame: file-end without active file\");\n          const metadata = parseFileEnd(payload);\n          const actualCheck = active.check;\n          if (metadata.contentId !== active.metadata.contentId) {\n            throw new Error(`w7-frame: file-end content id mismatch for ${active.inode.path}`);\n          }\n          if (metadata.size !== active.receivedBytes || metadata.size !== active.inode.size) {\n            throw new Error(`w7-frame: file-end byte total mismatch for ${active.inode.path}`);\n          }\n          if (metadata.chunkCount !== active.nextChunkId || metadata.chunkCount !== active.inode.chunkCount) {\n            throw new Error(`w7-frame: file-end chunk count mismatch for ${active.inode.path}`);\n          }\n          if (metadata.check !== actualCheck) {\n            throw new Error(`w7-frame: file-end check mismatch for ${active.inode.path}`);\n          }\n          const record = {\n            type: \"file-end\",\n            streamContentId: metadata.contentId,\n            path: active.inode.path,\n            size: metadata.size,\n            chunkCount: metadata.chunkCount,\n            check: metadata.check\n          };\n          active = null;\n          yield record;\n          break;\n        }\n        case 7  : {\n          if (active) throw new Error(`w7-frame: batch-end while file ${active.inode.path} is active`);\n          const actual = parseBatchEnd(payload);\n          const expected = { ...summary, check: batchCheck };\n          if (!sameSummary(actual, expected)) {\n            throw new Error(\n              `w7-frame: batch-end summary mismatch; expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`\n            );\n          }\n          await buffer.ensureEof(stream);\n          completed = true;\n          yield { type: \"batch-end\", summary: actual };\n          return;\n        }\n        case 1  :\n          throw new Error(\"w7-frame: duplicate batch-begin\");\n        default:\n          throw new Error(`w7-frame: unknown record tag ${envelope.tag}`);\n      }\n    }\n  } catch (error) {\n    failure = error;\n    throw error;\n  } finally {\n    if (completed) {\n      try {\n        reader.releaseLock();\n      } catch {\n      }\n    } else {\n      await cancelReader(reader, failure);\n    }\n  }\n}\nfunction* encodeRecords(batchId, deletes, directories, files) {\n  const state = {\n    batchCheck: 0,\n    summary: {\n      recordCount: 0,\n      pathCount: 0,\n      deleteCount: 0,\n      directoryCount: 0,\n      fileCount: 0,\n      chunkCount: 0,\n      byteCount: 0\n    }\n  };\n  yield encodeMetadataRecord(1  , { id: batchId, mode: MODE }, state);\n  for (const path of deletes) {\n    state.summary.pathCount++;\n    state.summary.deleteCount++;\n    yield encodeMetadataRecord(2  , { path }, state);\n  }\n  for (const inode of directories) {\n    state.summary.pathCount++;\n    state.summary.directoryCount++;\n    yield encodeMetadataRecord(3  , {\n      ...inodeMetadata(inode),\n      kind: inode.kind\n    }, state);\n  }\n  for (const file of files) {\n    state.summary.pathCount++;\n    state.summary.fileCount++;\n    yield encodeMetadataRecord(4  , {\n      ...inodeMetadata(file.inode),\n      kind: file.inode.kind,\n      contentId: file.contentId,\n      size: file.inode.size,\n      chunkCount: file.inode.chunkCount\n    }, state);\n    let fileCheck = 0;\n    for (const chunk of file.chunks) {\n      const data = chunk.data;\n      const contentBytes = new TextEncoder().encode(file.contentId);\n      const prefix = new Uint8Array(4 + contentBytes.length + 8);\n      writeU32LE(prefix, 0, contentBytes.length);\n      prefix.set(contentBytes, 4);\n      writeU32LE(prefix, 4 + contentBytes.length, chunk.chunkId);\n      writeU32LE(prefix, 8 + contentBytes.length, data.byteLength);\n      const header = recordHeader(5  , prefix.byteLength + data.byteLength);\n      state.batchCheck = updateRecordCheck(state.batchCheck, header, prefix, data);\n      state.summary.recordCount++;\n      state.summary.chunkCount++;\n      state.summary.byteCount += data.byteLength;\n      fileCheck = crc32(data, fileCheck);\n      yield [concatBytes(header, prefix), data];\n    }\n    yield encodeMetadataRecord(6  , {\n      contentId: file.contentId,\n      size: file.inode.size,\n      chunkCount: file.inode.chunkCount,\n      check: fileCheck\n    }, state);\n  }\n  const end = {\n    ...state.summary,\n    check: state.batchCheck\n  };\n  yield encodeMetadataRecord(7  , end);\n}\nfunction encodeMetadataRecord(tag, value, state) {\n  const payload = new TextEncoder().encode(JSON.stringify(value));\n  if (payload.byteLength > MAX_METADATA_BYTES) {\n    throw new Error(`w7-frame: metadata record exceeds ${MAX_METADATA_BYTES} bytes`);\n  }\n  const header = recordHeader(tag, payload.byteLength);\n  if (state && tag !== 7  ) {\n    state.batchCheck = updateRecordCheck(state.batchCheck, header, payload);\n    state.summary.recordCount++;\n  }\n  return [concatBytes(header, payload)];\n}\nfunction preparePayload(payload, batchId) {\n  if (!payload || !Array.isArray(payload.inodes) || !Array.isArray(payload.chunks)) {\n    throw new Error(\"w7-frame: payload must contain inode and chunk arrays\");\n  }\n  const ownedPaths = new PathOwnership();\n  const deletes = [...payload.deletePaths ?? []];\n  for (const path of deletes) claimPath(ownedPaths, canonicalPath(path, \"delete path\"));\n  const chunksByPath =   new Map();\n  for (const chunk of payload.chunks) {\n    const path = canonicalPath(chunk.path, \"chunk path\");\n    const list = chunksByPath.get(path);\n    if (list) list.push(chunk);\n    else chunksByPath.set(path, [chunk]);\n  }\n  const directories = [];\n  const files = [];\n  let fileIndex = 0;\n  for (const inode of payload.inodes) {\n    const path = canonicalPath(inode.path, \"inode path\");\n    if (path !== inode.path) throw new Error(`w7-frame: noncanonical inode path ${inode.path}`);\n    claimPath(ownedPaths, path);\n    const normalizedInode = normalizeInode(inode);\n    const fileChunks = chunksByPath.get(path) ?? [];\n    if (normalizedInode.kind === \"directory\") {\n      if (fileChunks.length > 0) throw new Error(`w7-frame: directory ${path} has chunks`);\n      directories.push(normalizedInode);\n    } else {\n      validateChunks(normalizedInode, fileChunks);\n      files.push({\n        inode: normalizedInode,\n        contentId: `${batchId}:${fileIndex++}`,\n        chunks: fileChunks\n      });\n    }\n    chunksByPath.delete(path);\n  }\n  if (chunksByPath.size > 0) {\n    throw new Error(`w7-frame: chunk has no inode: ${chunksByPath.keys().next().value}`);\n  }\n  return { deletes, directories, files };\n}\nfunction parseBatchBegin(bytes) {\n  const value = parseObject(bytes, \"batch-begin\", [\"id\", \"mode\"]);\n  const id = boundedString(value.id, \"batch id\", MAX_BATCH_ID_BYTES);\n  if (value.mode !== MODE) throw new Error(`w7-frame: unsupported batch mode ${String(value.mode)}`);\n  return { id, mode: MODE };\n}\nfunction parseDelete(bytes) {\n  const value = parseObject(bytes, \"delete\", [\"path\"]);\n  return { path: canonicalPath(value.path, \"delete path\") };\n}\nfunction parseDirectory(bytes) {\n  const value = parseObject(bytes, \"directory\", [\"path\", \"kind\", \"mtime\", \"mode\"], [\"atime\"]);\n  if (value.kind !== \"directory\") {\n    throw new Error(`w7-frame: unsupported directory kind ${String(value.kind)}`);\n  }\n  return { ...parseInodeMetadata(value, \"directory\"), kind: \"directory\" };\n}\nfunction parseFileBegin(bytes) {\n  const value = parseObject(\n    bytes,\n    \"file-begin\",\n    [\"path\", \"kind\", \"contentId\", \"size\", \"chunkCount\", \"mtime\", \"mode\"],\n    [\"atime\"]\n  );\n  const base = parseInodeMetadata(value, \"file-begin\");\n  if (value.kind !== \"file\" && value.kind !== \"symlink\") {\n    throw new Error(`w7-frame: unsupported file-begin kind ${String(value.kind)}`);\n  }\n  const contentId = boundedString(value.contentId, \"stream content id\", MAX_CONTENT_ID_BYTES);\n  if (!/^[A-Za-z0-9._:-]+$/.test(contentId)) {\n    throw new Error(`w7-frame: invalid stream content id ${contentId}`);\n  }\n  const size = safeInteger(value.size, \"file size\");\n  const chunkCount = u32(value.chunkCount, \"file chunk count\");\n  const expected = size === 0 ? 0 : Math.ceil(size / CHUNK_SIZE);\n  if (chunkCount !== expected) {\n    throw new Error(`w7-frame: ${base.path}: expected ${expected} chunks, got ${chunkCount}`);\n  }\n  return { ...base, kind: value.kind, contentId, size, chunkCount };\n}\nfunction parseFileEnd(bytes) {\n  const value = parseObject(bytes, \"file-end\", [\"contentId\", \"size\", \"chunkCount\", \"check\"]);\n  return {\n    contentId: boundedString(value.contentId, \"stream content id\", MAX_CONTENT_ID_BYTES),\n    size: safeInteger(value.size, \"file-end size\"),\n    chunkCount: u32(value.chunkCount, \"file-end chunk count\"),\n    check: u32(value.check, \"file-end check\")\n  };\n}\nfunction parseBatchEnd(bytes) {\n  const keys = [\n    \"recordCount\",\n    \"pathCount\",\n    \"deleteCount\",\n    \"directoryCount\",\n    \"fileCount\",\n    \"chunkCount\",\n    \"byteCount\",\n    \"check\"\n  ];\n  const value = parseObject(bytes, \"batch-end\", keys);\n  return {\n    recordCount: safeInteger(value.recordCount, \"batch record count\"),\n    pathCount: safeInteger(value.pathCount, \"batch path count\"),\n    deleteCount: safeInteger(value.deleteCount, \"batch delete count\"),\n    directoryCount: safeInteger(value.directoryCount, \"batch directory count\"),\n    fileCount: safeInteger(value.fileCount, \"batch file count\"),\n    chunkCount: safeInteger(value.chunkCount, \"batch chunk count\"),\n    byteCount: safeInteger(value.byteCount, \"batch byte count\"),\n    check: u32(value.check, \"batch check\")\n  };\n}\nfunction parseInodeMetadata(value, label) {\n  return {\n    path: canonicalPath(value.path, `${label} path`),\n    ...value.atime === void 0 ? {} : { atime: safeInteger(value.atime, `${label} atime`) },\n    mtime: safeInteger(value.mtime, `${label} mtime`),\n    mode: u32(value.mode, `${label} mode`)\n  };\n}\nfunction parseObject(bytes, label, required, optional = []) {\n  let value;\n  try {\n    value = JSON.parse(decodeText(bytes, label));\n  } catch (error) {\n    if (error instanceof Error && error.message.startsWith(\"w7-frame:\")) throw error;\n    throw new Error(`w7-frame: invalid ${label} JSON: ${errorMessage(error)}`);\n  }\n  if (!isObject(value) || Array.isArray(value)) throw new Error(`w7-frame: ${label} must be an object`);\n  const allowed =   new Set([...required, ...optional]);\n  for (const key of required) {\n    if (!Object.hasOwn(value, key)) throw new Error(`w7-frame: ${label} missing ${key}`);\n  }\n  for (const key of Object.keys(value)) {\n    if (!allowed.has(key)) throw new Error(`w7-frame: ${label} has unknown field ${key}`);\n  }\n  return value;\n}\nfunction normalizeInode(inode) {\n  canonicalPath(inode.path, \"inode path\");\n  if (inode.parentPath !== parentPath(inode.path)) {\n    throw new Error(`w7-frame: ${inode.path}: noncanonical parent path ${inode.parentPath}`);\n  }\n  safeInteger(inode.size, `${inode.path} size`);\n  u32(inode.chunkCount, `${inode.path} chunk count`);\n  safeInteger(inode.mtime, `${inode.path} mtime`);\n  if (inode.atime !== void 0) safeInteger(inode.atime, `${inode.path} atime`);\n  u32(inode.mode, `${inode.path} mode`);\n  const rawKind = inode.kind ?? (inode.isDir ? \"directory\" : \"file\");\n  if (rawKind !== \"file\" && rawKind !== \"directory\" && rawKind !== \"symlink\") {\n    throw new Error(`w7-frame: unsupported inode kind ${String(rawKind)}`);\n  }\n  const kind = rawKind;\n  if (kind === \"directory\" && !inode.isDir) {\n    throw new Error(`w7-frame: directory inode ${inode.path} must be a directory`);\n  }\n  if (kind !== \"directory\" && inode.isDir) {\n    throw new Error(`w7-frame: ${kind} inode ${inode.path} cannot be a directory`);\n  }\n  if (kind === \"directory\" && (inode.size !== 0 || inode.chunkCount !== 0)) {\n    throw new Error(`w7-frame: directory ${inode.path} must have zero size and chunks`);\n  }\n  if (kind !== \"directory\") {\n    const expected = inode.size === 0 ? 0 : Math.ceil(inode.size / CHUNK_SIZE);\n    if (inode.chunkCount !== expected) {\n      throw new Error(`w7-frame: ${inode.path}: expected ${expected} chunks, got ${inode.chunkCount}`);\n    }\n    return { ...inode, kind, isDir: false };\n  }\n  return { ...inode, kind, isDir: true };\n}\nfunction validateChunks(inode, chunks) {\n  if (chunks.length !== inode.chunkCount) {\n    throw new Error(`w7-frame: ${inode.path}: expected ${inode.chunkCount} chunks, got ${chunks.length}`);\n  }\n  chunks.sort((left, right) => left.chunkId - right.chunkId);\n  for (let index = 0; index < chunks.length; index++) {\n    const chunk = chunks[index];\n    if (chunk.chunkId !== index) {\n      throw new Error(`w7-frame: ${inode.path}: expected chunk ${index}, got ${chunk.chunkId}`);\n    }\n    const expected = Math.min(CHUNK_SIZE, inode.size - index * CHUNK_SIZE);\n    if (!(chunk.data instanceof Uint8Array) || chunk.data.byteLength !== expected) {\n      throw new Error(`w7-frame: ${inode.path}: chunk ${index} must contain ${expected} bytes`);\n    }\n  }\n}\nfunction directoryInode(metadata) {\n  return {\n    path: metadata.path,\n    parentPath: parentPath(metadata.path),\n    kind: metadata.kind,\n    isDir: true,\n    size: 0,\n    atime: metadata.atime,\n    mtime: metadata.mtime,\n    mode: metadata.mode,\n    chunkCount: 0\n  };\n}\nfunction fileInode(metadata) {\n  return {\n    path: metadata.path,\n    parentPath: parentPath(metadata.path),\n    kind: metadata.kind,\n    isDir: false,\n    size: metadata.size,\n    atime: metadata.atime,\n    mtime: metadata.mtime,\n    mode: metadata.mode,\n    chunkCount: metadata.chunkCount\n  };\n}\nfunction inodeMetadata(inode) {\n  return {\n    path: inode.path,\n    ...inode.atime === void 0 ? {} : { atime: inode.atime },\n    mtime: inode.mtime,\n    mode: inode.mode\n  };\n}\nfunction canonicalPath(value, label) {\n  const path = boundedString(value, label, MAX_PATH_BYTES);\n  if (path.includes(\"\\0\")) throw new Error(`w7-frame: ${label} contains NUL`);\n  const normalized = normalizePath(path);\n  if (!path || normalized !== path) throw new Error(`w7-frame: noncanonical ${label}: ${path}`);\n  return path;\n}\nvar PathOwnership = class {\n  paths =   new Set();\n  pathBytes = 0;\n  claim(path) {\n    if (this.paths.has(path)) throw new Error(`w7-frame: duplicate path ownership: ${path}`);\n    if (this.paths.size >= W7_MAX_PATHS_PER_BATCH) {\n      throw new Error(`w7-frame: batch exceeds ${W7_MAX_PATHS_PER_BATCH} owned paths`);\n    }\n    const nextPathBytes = this.pathBytes + new TextEncoder().encode(path).byteLength;\n    if (nextPathBytes > W7_MAX_OWNED_PATH_BYTES) {\n      throw new Error(\n        `w7-frame: owned path bytes exceed ${W7_MAX_OWNED_PATH_BYTES}`\n      );\n    }\n    this.paths.add(path);\n    this.pathBytes = nextPathBytes;\n  }\n};\nfunction claimPath(paths, path) {\n  paths.claim(path);\n}\nfunction normalizePath(path) {\n  const out = [];\n  for (const segment of path.split(\"/\")) {\n    if (segment === \"..\") {\n      if (out.length > 0) out.pop();\n    } else if (segment !== \"\" && segment !== \".\") {\n      out.push(segment);\n    }\n  }\n  return out.join(\"/\");\n}\nfunction parentPath(path) {\n  const index = path.lastIndexOf(\"/\");\n  return index < 0 ? \"\" : path.slice(0, index);\n}\nfunction boundedString(value, label, maxBytes) {\n  if (typeof value !== \"string\" || value.length === 0) {\n    throw new Error(`w7-frame: ${label} must be a non-empty string`);\n  }\n  const length = new TextEncoder().encode(value).byteLength;\n  if (length > maxBytes) throw new Error(`w7-frame: ${label} exceeds ${maxBytes} bytes`);\n  return value;\n}\nfunction safeInteger(value, label) {\n  if (!Number.isSafeInteger(value) || value < 0) {\n    throw new Error(`w7-frame: ${label} must be a non-negative safe integer`);\n  }\n  return value;\n}\nfunction u32(value, label) {\n  const integer = safeInteger(value, label);\n  if (integer > 4294967295) throw new Error(`w7-frame: ${label} exceeds uint32`);\n  return integer;\n}\nfunction sameSummary(left, right) {\n  return left.recordCount === right.recordCount && left.pathCount === right.pathCount && left.deleteCount === right.deleteCount && left.directoryCount === right.directoryCount && left.fileCount === right.fileCount && left.chunkCount === right.chunkCount && left.byteCount === right.byteCount && left.check === right.check;\n}\nasync function readEnvelope(buffer, label) {\n  const header = await buffer.readExact(5, `${label} header`);\n  return { tag: header[0], length: readU32LE(header, 1), header };\n}\nfunction recordHeader(tag, length) {\n  const header = new Uint8Array(5);\n  header[0] = tag;\n  writeU32LE(header, 1, length);\n  return header;\n}\nfunction writeU32LE(out, offset, value) {\n  out[offset] = value & 255;\n  out[offset + 1] = value >>> 8 & 255;\n  out[offset + 2] = value >>> 16 & 255;\n  out[offset + 3] = value >>> 24 & 255;\n}\nfunction readU32LE(bytes, offset) {\n  return (bytes[offset] | bytes[offset + 1] << 8 | bytes[offset + 2] << 16 | bytes[offset + 3] << 24) >>> 0;\n}\nfunction updateRecordCheck(seed, ...parts) {\n  let check = seed;\n  for (const part of parts) check = crc32(part, check);\n  return check;\n}\nfunction noopRetention(bytes) {\n  return { bytes, release() {\n  } };\n}\nfunction decodeText(bytes, label) {\n  try {\n    return new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: false }).decode(bytes);\n  } catch (error) {\n    throw new Error(`w7-frame: invalid UTF-8 in ${label}: ${errorMessage(error)}`);\n  }\n}\nfunction concatBytes(...parts) {\n  const output = new Uint8Array(parts.reduce((total, part) => total + part.byteLength, 0));\n  let offset = 0;\n  for (const part of parts) {\n    output.set(part, offset);\n    offset += part.byteLength;\n  }\n  return output;\n}\nfunction bytesEqual(left, right) {\n  return left.length === right.length && left.every((byte, index) => byte === right[index]);\n}\nfunction hex(bytes) {\n  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, \"0\")).join(\" \");\n}\nfunction isObject(value) {\n  return typeof value === \"object\" && value !== null;\n}\nfunction errorMessage(error) {\n  return error instanceof Error ? error.message : String(error);\n}\nfunction throwIfAborted(signal) {\n  if (!signal?.aborted) return;\n  throw new DOMException(\n    signal.reason instanceof Error ? signal.reason.message : String(signal.reason ?? \"Aborted\"),\n    \"AbortError\"\n  );\n}\nasync function cancelReader(reader, reason) {\n  try {\n    await reader.cancel(reason);\n  } catch {\n  }\n  try {\n    reader.releaseLock();\n  } catch {\n  }\n}\nvar ExactByteReader = class {\n  constructor(reader, signal) {\n    this.reader = reader;\n    this.signal = signal;\n  }\n  reader;\n  signal;\n  done = false;\n  async read(read, cancel) {\n    throwIfAborted(this.signal);\n    const abort = () => {\n      void cancel().catch(() => {\n      });\n    };\n    this.signal?.addEventListener(\"abort\", abort, { once: true });\n    try {\n      const result = await read();\n      throwIfAborted(this.signal);\n      return result;\n    } finally {\n      this.signal?.removeEventListener(\"abort\", abort);\n    }\n  }\n  async readExact(length, label) {\n    if (length === 0) return new Uint8Array(0);\n    const output = new Uint8Array(length);\n    let offset = 0;\n    while (offset < length) {\n      if (this.done) {\n        throw new Error(\n          `w7-frame: stream ended ${offset} bytes into expected ${length}-byte ${label}`\n        );\n      }\n      const next = await this.read(\n        () => this.reader.read(new Uint8Array(length - offset)),\n        () => this.reader.cancel(this.signal?.reason)\n      );\n      if (next.done) this.done = true;\n      else if (next.value.byteLength > 0) {\n        output.set(next.value, offset);\n        offset += next.value.byteLength;\n      }\n    }\n    return output;\n  }\n  async ensureEof(stream) {\n    if (this.done) return;\n    this.reader.releaseLock();\n    const reader = stream.getReader();\n    try {\n      const next = await this.read(() => reader.read(), () => reader.cancel(this.signal?.reason));\n      if (!next.done && next.value.byteLength > 0) {\n        await reader.cancel(new Error(\"w7-frame: trailing bytes after batch-end\"));\n        throw new Error(\"w7-frame: trailing bytes after batch-end\");\n      }\n      this.done = true;\n    } finally {\n      try {\n        reader.releaseLock();\n      } catch {\n      }\n    }\n  }\n};";
+/** Declares `function createEsmResolver(host)`; the node shims call it. */
+export const ESM_RESOLVER_PREAMBLE = "function createEsmResolver(host) {\n  const conditions =   new Set([\"node\", \"import\", \"module-sync\"]);\n  const ask = {\n    *kind(path) {\n      const kind = yield host.kind(path);\n      return kind === \"file\" || kind === \"directory\" ? kind : null;\n    },\n    *readText(path) {\n      const text = yield host.readText(path);\n      return typeof text === \"string\" ? text : null;\n    },\n    *realpath(path) {\n      const real = yield host.realpath(path);\n      return typeof real === \"string\" ? real : path;\n    },\n    *cjsResolve(specifier, parentPath) {\n      const found = yield host.cjsResolve(specifier, parentPath);\n      return typeof found === \"string\" ? found : null;\n    }\n  };\n  function codedError(Ctor, code, message) {\n    return Object.assign(new Ctor(message), { code });\n  }\n  const codeOf = (error) => error !== null && typeof error === \"object\" && \"code\" in error ? error.code : void 0;\n  const filePath = (url) => decodeURIComponent(new URL(String(url)).pathname);\n  const fileUrl = (path) => {\n    const url = new URL(\"file://\");\n    url.pathname = path;\n    return url;\n  };\n  function isRelativeSpecifier(specifier) {\n    if (specifier[0] !== \".\") return false;\n    if (specifier.length === 1 || specifier[1] === \"/\") return true;\n    return specifier[1] === \".\" && (specifier.length === 2 || specifier[2] === \"/\");\n  }\n  const isRelativeOrAbsolute = (specifier) => specifier !== \"\" && (specifier[0] === \"/\" || isRelativeSpecifier(specifier));\n  function* readPackageConfig(pjsonPath, specifier, base) {\n    const text = (yield* ask.kind(pjsonPath)) === \"file\" ? yield* ask.readText(pjsonPath) : null;\n    if (text === null) return { exists: false, pjsonPath, type: \"none\" };\n    let parsed;\n    try {\n      parsed = JSON.parse(text);\n    } catch {\n      throw codedError(\n        Error,\n        \"ERR_INVALID_PACKAGE_CONFIG\",\n        `Invalid package config ${pjsonPath}` + (base ? ` while importing ${JSON.stringify(specifier)} from ${base}` : \"\") + \".\"\n      );\n    }\n    const config = { exists: true, pjsonPath, type: \"none\" };\n    if (parsed === null || typeof parsed !== \"object\") return config;\n    if (typeof parsed.name === \"string\") config.name = parsed.name;\n    if (typeof parsed.main === \"string\") config.main = parsed.main;\n    if (\"exports\" in parsed) config.exports = parsed.exports;\n    if (parsed.imports !== null && typeof parsed.imports === \"object\") config.imports = parsed.imports;\n    if (parsed.type === \"module\" || parsed.type === \"commonjs\") config.type = parsed.type;\n    return config;\n  }\n  function* packageScopeConfig(resolved) {\n    let pjsonUrl = new URL(\"./package.json\", resolved);\n    while (true) {\n      if (pjsonUrl.pathname.endsWith(\"node_modules/package.json\")) break;\n      const config = yield* readPackageConfig(filePath(pjsonUrl), resolved.href, void 0);\n      if (config.exists) return config;\n      const last = pjsonUrl;\n      pjsonUrl = new URL(\"../package.json\", pjsonUrl);\n      if (pjsonUrl.pathname === last.pathname) break;\n    }\n    return { exists: false, pjsonPath: filePath(pjsonUrl), type: \"none\" };\n  }\n  function invalidPackageTarget(key, target, pjsonUrl, internal, base) {\n    const text = typeof target === \"object\" && target !== null ? JSON.stringify(target, null, \"\") : `${target}`;\n    const pkgPath = filePath(new URL(\".\", pjsonUrl));\n    const related = !internal && text.length > 0 && !text.startsWith(\"./\");\n    const tail = `in the package config ${pkgPath}package.json imported from ${base}${related ? '; targets must start with \"./\"' : \"\"}`;\n    return codedError(\n      Error,\n      \"ERR_INVALID_PACKAGE_TARGET\",\n      key === \".\" ? `Invalid \"exports\" main target ${JSON.stringify(text)} defined ${tail}` : `Invalid \"${internal ? \"imports\" : \"exports\"}\" target ${JSON.stringify(text)} defined for '${key}' ${tail}`\n    );\n  }\n  const invalidSegment = /(^|\\\\|\\/)((\\.|%2e)(\\.|%2e)?|(n|%6e|%4e)(o|%6f|%4f)(d|%64|%44)(e|%65|%45)(_|%5f)(m|%6d|%4d)(o|%6f|%4f)(d|%64|%44)(u|%75|%55)(l|%6c|%4c)(e|%65|%45)(s|%73|%53))?(\\\\|\\/|$)/i;\n  const deprecatedInvalidSegment = /(^|\\\\|\\/)((\\.|%2e)(\\.|%2e)?|(n|%6e|%4e)(o|%6f|%4f)(d|%64|%44)(e|%65|%45)(_|%5f)(m|%6d|%4d)(o|%6f|%4f)(d|%64|%44)(u|%75|%55)(l|%6c|%4c)(e|%65|%45)(s|%73|%53))(\\\\|\\/|$)/i;\n  function* resolveTargetString(target, subpath, match, pjsonUrl, base, pattern, internal, isPathMap) {\n    if (subpath !== \"\" && !pattern && target[target.length - 1] !== \"/\") {\n      throw invalidPackageTarget(match, target, pjsonUrl, internal, base);\n    }\n    if (!target.startsWith(\"./\")) {\n      if (internal && !target.startsWith(\"../\") && !target.startsWith(\"/\")) {\n        let isUrl = false;\n        try {\n          new URL(target);\n          isUrl = true;\n        } catch {\n        }\n        if (!isUrl) {\n          const exportTarget = pattern ? target.replace(/\\*/g, () => subpath) : target + subpath;\n          return yield* packageResolve(exportTarget, pjsonUrl.href);\n        }\n      }\n      throw invalidPackageTarget(match, target, pjsonUrl, internal, base);\n    }\n    if (invalidSegment.test(target.slice(2)) && deprecatedInvalidSegment.test(target.slice(2))) {\n      throw invalidPackageTarget(match, target, pjsonUrl, internal, base);\n    }\n    const resolved = new URL(target, pjsonUrl);\n    if (!resolved.pathname.startsWith(new URL(\".\", pjsonUrl).pathname)) {\n      throw invalidPackageTarget(match, target, pjsonUrl, internal, base);\n    }\n    if (subpath === \"\") return resolved;\n    if (invalidSegment.test(subpath) && deprecatedInvalidSegment.test(subpath) && !isPathMap) {\n      const request = pattern ? match.replace(\"*\", () => subpath) : match + subpath;\n      throw codedError(\n        TypeError,\n        \"ERR_INVALID_MODULE_SPECIFIER\",\n        `Invalid module \"${request}\" request is not a valid match in pattern \"${match}\" for the \"${internal ? \"imports\" : \"exports\"}\" resolution of ${filePath(pjsonUrl)} imported from ${base}`\n      );\n    }\n    if (pattern) return new URL(resolved.href.replace(/\\*/g, () => subpath));\n    return new URL(subpath, resolved);\n  }\n  function* resolveTarget(pjsonUrl, target, subpath, key, base, pattern, internal, isPathMap) {\n    if (typeof target === \"string\") {\n      return yield* resolveTargetString(target, subpath, key, pjsonUrl, base, pattern, internal, isPathMap);\n    }\n    if (Array.isArray(target)) {\n      if (target.length === 0) return null;\n      let lastException;\n      for (const item of target) {\n        let result;\n        try {\n          result = yield* resolveTarget(pjsonUrl, item, subpath, key, base, pattern, internal, isPathMap);\n        } catch (error) {\n          lastException = error;\n          if (codeOf(error) === \"ERR_INVALID_PACKAGE_TARGET\") continue;\n          throw error;\n        }\n        if (result === void 0) continue;\n        if (result === null) {\n          lastException = null;\n          continue;\n        }\n        return result;\n      }\n      if (lastException === void 0 || lastException === null) return lastException;\n      throw lastException;\n    }\n    if (typeof target === \"object\" && target !== null) {\n      const keys = Object.getOwnPropertyNames(target);\n      for (const condition of keys) {\n        if (/^\\d+$/.test(condition) && String(Number(condition)) === condition && Number(condition) < 4294967295) {\n          throw codedError(\n            Error,\n            \"ERR_INVALID_PACKAGE_CONFIG\",\n            `Invalid package config ${filePath(pjsonUrl)} while importing ${fileUrl(base).href}. \"exports\" cannot contain numeric property keys.`\n          );\n        }\n      }\n      for (const condition of keys) {\n        if (condition !== \"default\" && !conditions.has(condition)) continue;\n        const result = yield* resolveTarget(\n          pjsonUrl,\n          Reflect.get(target, condition),\n          subpath,\n          key,\n          base,\n          pattern,\n          internal,\n          isPathMap\n        );\n        if (result === void 0) continue;\n        return result;\n      }\n      return void 0;\n    }\n    if (target === null) return null;\n    throw invalidPackageTarget(key, target, pjsonUrl, internal, base);\n  }\n  function patternKeyCompare(a, b) {\n    const aStar = a.indexOf(\"*\");\n    const bStar = b.indexOf(\"*\");\n    const baseA = aStar === -1 ? a.length : aStar + 1;\n    const baseB = bStar === -1 ? b.length : bStar + 1;\n    if (baseA > baseB) return -1;\n    if (baseB > baseA) return 1;\n    if (aStar === -1) return 1;\n    if (bStar === -1) return -1;\n    if (a.length > b.length) return -1;\n    if (b.length > a.length) return 1;\n    return 0;\n  }\n  function bestPattern(map, name) {\n    let best = \"\";\n    let bestSubpath = \"\";\n    for (const key of Object.getOwnPropertyNames(map)) {\n      const star = key.indexOf(\"*\");\n      if (star === -1 || !name.startsWith(key.slice(0, star))) continue;\n      const trailer = key.slice(star + 1);\n      if (name.length >= key.length && name.endsWith(trailer) && patternKeyCompare(best, key) === 1 && key.lastIndexOf(\"*\") === star) {\n        best = key;\n        bestSubpath = name.slice(star, name.length - trailer.length);\n      }\n    }\n    return best ? { key: best, subpath: bestSubpath } : null;\n  }\n  function exportsNotFound(subpath, pjsonUrl, base) {\n    const pkgPath = filePath(new URL(\".\", pjsonUrl));\n    return codedError(\n      Error,\n      \"ERR_PACKAGE_PATH_NOT_EXPORTED\",\n      subpath === \".\" ? `No \"exports\" main defined in ${pkgPath}package.json imported from ${base}` : `Package subpath '${subpath}' is not defined by \"exports\" in ${pkgPath}package.json imported from ${base}`\n    );\n  }\n  function* packageExportsResolve(pjsonUrl, subpath, config, base) {\n    let exports = config.exports;\n    const isSugar = (() => {\n      if (typeof exports === \"string\" || Array.isArray(exports)) return true;\n      if (typeof exports !== \"object\" || exports === null) return false;\n      let sugar = false;\n      let i = 0;\n      for (const key of Object.getOwnPropertyNames(exports)) {\n        const current = key === \"\" || key[0] !== \".\";\n        if (i++ === 0) sugar = current;\n        else if (sugar !== current) {\n          throw codedError(\n            Error,\n            \"ERR_INVALID_PACKAGE_CONFIG\",\n            `Invalid package config ${filePath(pjsonUrl)} while importing ${fileUrl(base).href}. \"exports\" cannot contain some keys starting with '.' and some not. The exports object must either be an object of package subpath keys or an object of main entry condition name keys only.`\n          );\n        }\n      }\n      return sugar;\n    })();\n    if (isSugar) exports = { \".\": exports };\n    const map = exports;\n    if (Object.prototype.hasOwnProperty.call(map, subpath) && !subpath.includes(\"*\") && !subpath.endsWith(\"/\")) {\n      const result = yield* resolveTarget(pjsonUrl, map[subpath], \"\", subpath, base, false, false, false);\n      if (result == null) throw exportsNotFound(subpath, pjsonUrl, base);\n      return result;\n    }\n    const best = bestPattern(map, subpath);\n    if (best) {\n      const result = yield* resolveTarget(pjsonUrl, map[best.key], best.subpath, best.key, base, true, false, subpath.endsWith(\"/\"));\n      if (result == null) throw exportsNotFound(subpath, pjsonUrl, base);\n      return result;\n    }\n    throw exportsNotFound(subpath, pjsonUrl, base);\n  }\n  function* packageImportsResolve(name, baseUrl) {\n    const base = filePath(baseUrl);\n    if (name === \"#\" || name.startsWith(\"#/\") || name.endsWith(\"/\")) {\n      throw codedError(TypeError, \"ERR_INVALID_MODULE_SPECIFIER\", `Invalid module \"${name}\" is not a valid internal imports specifier name imported from ${base}`);\n    }\n    const config = yield* packageScopeConfig(new URL(baseUrl));\n    let pjsonUrl;\n    if (config.exists) {\n      pjsonUrl = fileUrl(config.pjsonPath);\n      const imports = config.imports;\n      if (imports) {\n        if (Object.prototype.hasOwnProperty.call(imports, name) && !name.includes(\"*\")) {\n          const result = yield* resolveTarget(pjsonUrl, imports[name], \"\", name, base, false, true, false);\n          if (result != null) return result;\n        } else {\n          const best = bestPattern(imports, name);\n          if (best) {\n            const result = yield* resolveTarget(pjsonUrl, imports[best.key], best.subpath, best.key, base, true, true, false);\n            if (result != null) return result;\n          }\n        }\n      }\n    }\n    const where = pjsonUrl ? ` in package ${filePath(new URL(\".\", pjsonUrl))}package.json` : \"\";\n    throw codedError(TypeError, \"ERR_PACKAGE_IMPORT_NOT_DEFINED\", `Package import specifier \"${name}\" is not defined${where} imported from ${base}`);\n  }\n  function* legacyMainResolve(pjsonUrl, config, base) {\n    const tries = [];\n    if (config.main !== void 0) {\n      for (const suffix of [\"\", \".js\", \".json\", \".node\", \"/index.js\", \"/index.json\", \"/index.node\"]) tries.push(`./${config.main}${suffix}`);\n    }\n    tries.push(\"./index.js\", \"./index.json\", \"./index.node\");\n    for (const candidate of tries) {\n      const url = new URL(candidate, pjsonUrl);\n      if ((yield* ask.kind(filePath(url))) === \"file\") return url;\n    }\n    const dir = fileUrl(filePath(new URL(\".\", pjsonUrl)).replace(/\\/+/g, \"/\"));\n    const missing = filePath(new URL(config.main ?? \"index.js\", dir));\n    throw codedError(Error, \"ERR_MODULE_NOT_FOUND\", `Cannot find package '${missing}' imported from ${base}`);\n  }\n  function* packageResolve(specifier, baseUrl) {\n    if (host.isBuiltin(specifier)) return new URL(\"node:\" + specifier);\n    const base = filePath(baseUrl);\n    let separator = specifier.indexOf(\"/\");\n    let valid = true;\n    let scoped = false;\n    if (specifier[0] === \"@\") {\n      scoped = true;\n      if (separator === -1 || specifier.length === 0) valid = false;\n      else separator = specifier.indexOf(\"/\", separator + 1);\n    }\n    const name = separator === -1 ? specifier : specifier.slice(0, separator);\n    if (/^\\.|%|\\\\/.test(name)) valid = false;\n    if (!valid) {\n      throw codedError(TypeError, \"ERR_INVALID_MODULE_SPECIFIER\", `Invalid module \"${specifier}\" is not a valid package name imported from ${base}`);\n    }\n    const subpath = \".\" + (separator === -1 ? \"\" : specifier.slice(separator));\n    const self = yield* packageScopeConfig(new URL(baseUrl));\n    if (self.exists && self.exports != null && self.name === name) {\n      return yield* packageExportsResolve(fileUrl(self.pjsonPath), subpath, self, base);\n    }\n    let pjsonUrl = new URL(\"./node_modules/\" + name + \"/package.json\", baseUrl);\n    let pjsonPath = filePath(pjsonUrl);\n    let lastPath;\n    do {\n      if ((yield* ask.kind(pjsonPath.slice(0, pjsonPath.length - 13))) !== \"directory\") {\n        lastPath = pjsonPath;\n        pjsonUrl = new URL((scoped ? \"../../../../node_modules/\" : \"../../../node_modules/\") + name + \"/package.json\", pjsonUrl);\n        pjsonPath = filePath(pjsonUrl);\n        continue;\n      }\n      const config = yield* readPackageConfig(pjsonPath, specifier, base);\n      if (config.exports != null) return yield* packageExportsResolve(pjsonUrl, subpath, config, base);\n      if (subpath === \".\") return yield* legacyMainResolve(pjsonUrl, config, base);\n      return new URL(subpath, pjsonUrl);\n    } while (pjsonPath.length !== lastPath.length);\n    throw codedError(Error, \"ERR_MODULE_NOT_FOUND\", `Cannot find package '${name}' imported from ${base}`);\n  }\n  function* formatOf(url, path) {\n    const base = path.slice(path.lastIndexOf(\"/\") + 1);\n    const dot = base.lastIndexOf(\".\");\n    const ext = dot > 0 ? base.slice(dot) : \"\";\n    if (ext === \".mjs\" || ext === \".mts\") return \"module\";\n    if (ext === \".cjs\" || ext === \".cts\") return \"commonjs\";\n    if (ext === \".json\") return \"json\";\n    if (ext === \".js\" || ext === \".ts\" || ext === \"\") {\n      const type = (yield* packageScopeConfig(url)).type;\n      if (type === \"module\") return \"module\";\n      if (type === \"commonjs\") return \"commonjs\";\n      return \"detect\";\n    }\n    throw codedError(TypeError, \"ERR_UNKNOWN_FILE_EXTENSION\", `Unknown file extension \"${ext}\" for ${path}`);\n  }\n  function* finalizeResolution(resolved, baseUrl) {\n    const base = filePath(baseUrl);\n    if (/%2f|%5c/i.test(resolved.pathname)) {\n      throw codedError(\n        TypeError,\n        \"ERR_INVALID_MODULE_SPECIFIER\",\n        `Invalid module \"${resolved.pathname}\" must not include encoded \"/\" or \"\\\\\" characters imported from ${base}`\n      );\n    }\n    const path = filePath(resolved);\n    const kind = path.endsWith(\"/\") ? \"directory\" : yield* ask.kind(path);\n    if (kind === \"directory\") {\n      throw Object.assign(\n        codedError(Error, \"ERR_UNSUPPORTED_DIR_IMPORT\", `Directory import '${path}' is not supported resolving ES modules imported from ${base}`),\n        { url: resolved.href }\n      );\n    }\n    if (kind !== \"file\") {\n      throw Object.assign(\n        codedError(Error, \"ERR_MODULE_NOT_FOUND\", `Cannot find module '${path}' imported from ${base}`),\n        { url: resolved.href }\n      );\n    }\n    const real = yield* ask.realpath(path);\n    const url = fileUrl(real);\n    url.search = resolved.search;\n    url.hash = resolved.hash;\n    return { url: url.href, path: real };\n  }\n  function* moduleResolve(specifier, parentUrl) {\n    let resolved;\n    if (isRelativeOrAbsolute(specifier)) resolved = new URL(specifier, parentUrl);\n    else if (specifier[0] === \"#\") resolved = yield* packageImportsResolve(specifier, parentUrl);\n    else {\n      try {\n        resolved = new URL(specifier);\n      } catch {\n        resolved = yield* packageResolve(specifier, parentUrl);\n      }\n    }\n    if (resolved.protocol === \"node:\") return { url: \"node:\" + resolved.pathname, builtin: resolved.pathname };\n    if (resolved.protocol !== \"file:\") return { url: resolved.href };\n    return yield* finalizeResolution(resolved, parentUrl);\n  }\n  function* loadable(resolved) {\n    if (resolved.builtin !== void 0) {\n      if (!host.isBuiltin(\"node:\" + resolved.builtin)) {\n        throw codedError(Error, \"ERR_UNKNOWN_BUILTIN_MODULE\", `No such built-in module: node:${resolved.builtin}`);\n      }\n      return { url: resolved.url, builtin: resolved.builtin, format: \"builtin\" };\n    }\n    if (resolved.url.startsWith(\"data:\")) return { url: resolved.url, format: \"data\" };\n    if (resolved.path === void 0) {\n      throw codedError(\n        Error,\n        \"ERR_UNSUPPORTED_ESM_URL_SCHEME\",\n        `Only URLs with a scheme in: file and data are supported by the default ESM loader. Received protocol '${new URL(resolved.url).protocol}'`\n      );\n    }\n    return { url: resolved.url, path: resolved.path, format: yield* formatOf(new URL(resolved.url), resolved.path) };\n  }\n  function* commonJsHint(specifier, parentUrl) {\n    let found = yield* ask.cjsResolve(specifier, filePath(parentUrl));\n    if (found === null) return null;\n    if (isRelativeSpecifier(specifier)) {\n      const from = parentUrl.slice(\"file://\".length, parentUrl.lastIndexOf(\"/\")).split(\"/\").filter(Boolean);\n      const to = fileUrl(found).pathname.split(\"/\").filter(Boolean);\n      let common = 0;\n      while (common < from.length && common < to.length && from[common] === to[common]) common++;\n      found = [...from.slice(common).map(() => \"..\"), ...to.slice(common)].join(\"/\");\n      if (!found.startsWith(\"../\")) found = `./${found}`;\n    } else if (specifier[0] && specifier[0] !== \"/\" && specifier[0] !== \".\") {\n      const slash = specifier.indexOf(\"/\");\n      const pkg = slash === -1 ? specifier : specifier.slice(0, slash);\n      const needle = `/node_modules/${pkg}/`;\n      const at = found.lastIndexOf(needle);\n      found = at !== -1 ? pkg + \"/\" + found.slice(at + needle.length).split(\"/\").map(encodeURIComponent).join(\"/\") : fileUrl(found).href;\n    }\n    return found;\n  }\n  function* resolveWithHint(specifier, parentUrl) {\n    try {\n      return yield* moduleResolve(specifier, parentUrl);\n    } catch (error) {\n      const code = codeOf(error);\n      if (error instanceof Error && (code === \"ERR_MODULE_NOT_FOUND\" || code === \"ERR_UNSUPPORTED_DIR_IMPORT\")) {\n        const asGiven = specifier.startsWith(\"file://\") ? filePath(specifier) : specifier;\n        const found = yield* commonJsHint(asGiven, parentUrl);\n        if (found && found !== asGiven) error.message += `\nDid you mean to import ${JSON.stringify(found)}?`;\n      }\n      throw error;\n    }\n  }\n  function* importTarget(specifier, parentUrl) {\n    return yield* loadable(yield* resolveWithHint(specifier, parentUrl));\n  }\n  function* metaResolve(specifier, parentUrl) {\n    try {\n      return (yield* moduleResolve(specifier, parentUrl)).url;\n    } catch (error) {\n      const code = codeOf(error);\n      if ((code === \"ERR_MODULE_NOT_FOUND\" || code === \"ERR_UNSUPPORTED_DIR_IMPORT\") && error !== null && typeof error === \"object\" && \"url\" in error && typeof error.url === \"string\") return error.url;\n      throw error;\n    }\n  }\n  function runSync(steps) {\n    let next = steps.next();\n    while (!next.done) {\n      if (next.value instanceof Promise) throw new Error(\"resolveSync: the host answered asynchronously\");\n      next = steps.next(next.value);\n    }\n    return next.value;\n  }\n  return {\n    async resolve(specifier, parentUrl) {\n      const steps = importTarget(specifier, parentUrl);\n      let next = steps.next();\n      while (!next.done) {\n        let answer;\n        try {\n          answer = await next.value;\n        } catch (error) {\n          next = steps.throw(error);\n          continue;\n        }\n        next = steps.next(answer);\n      }\n      return next.value;\n    },\n    resolveSync: (specifier, parentUrl) => runSync(importTarget(specifier, parentUrl)),\n    metaResolveSync: (specifier, parentUrl) => runSync(metaResolve(specifier, parentUrl)),\n    validateAttributes(url, format, attributes) {\n      for (const key of Object.keys(attributes)) {\n        if (key !== \"type\") {\n          throw codedError(TypeError, \"ERR_IMPORT_ATTRIBUTE_UNSUPPORTED\", `Import attribute \"${key}\" with value \"${attributes[key]}\" is not supported in ${url}`);\n        }\n      }\n      const type = attributes.type;\n      if (format === \"json\" || format === \"data\" && /^data:application\\/json(?:;[^,]*)?,/.test(url)) {\n        if (type === \"json\") return;\n        if (!(\"type\" in attributes)) {\n          throw codedError(TypeError, \"ERR_IMPORT_ATTRIBUTE_MISSING\", `Module \"${url}\" needs an import attribute of \"type: json\"`);\n        }\n      } else if (type == null) {\n        return;\n      }\n      if (typeof type !== \"string\") {\n        throw codedError(TypeError, \"ERR_INVALID_ARG_TYPE\", `The \"type\" argument must be of type string. Received ${typeof type}`);\n      }\n      if (type !== \"json\") {\n        throw codedError(TypeError, \"ERR_IMPORT_ATTRIBUTE_UNSUPPORTED\", `Import attribute \"type\" with value \"${type}\" is not supported in ${url}`);\n      }\n      throw codedError(TypeError, \"ERR_IMPORT_ATTRIBUTE_TYPE_INCOMPATIBLE\", `Module \"${url}\" is not of type \"json\"`);\n    }\n  };\n}";

package/dist/loaders/npm-resolve-preamble.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm-resolve-preamble.d.ts","sourceRoot":"","sources":["../../src/loaders/npm-resolve-preamble.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAsBH,eAAO,MAAM,oBAAoB,EAAE,MAmFlC,CAAC"}
+{"version":3,"file":"npm-resolve-preamble.d.ts","sourceRoot":"","sources":["../../src/loaders/npm-resolve-preamble.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAsBH,eAAO,MAAM,oBAAoB,EAAE,MAwDlC,CAAC"}

package/dist/loaders/npm-resolve-preamble.js

@@ -61,9 +61,6 @@ function NATIVE_EXECUTABLE_REJECT(pkg) {
 function NATIVE_PLATFORM_REJECT(pkg) {
   return __policyNativePlatformReject(__NIMBUS_PACKAGE_ABI_POLICY, pkg);
 }
-function NATIVE_BIN_ADVISORY(pkg) {
-  return __policyNativeBinAdvisory(__NIMBUS_PACKAGE_ABI_POLICY, pkg);
-}
 function IS_OPTIONAL_NATIVE_BINDING(pkg) {
   return __policyIsOptionalNativeBinding(__NIMBUS_PACKAGE_ABI_POLICY, pkg);
 }
@@ -75,30 +72,6 @@ function STAGED_ARTIFACT_APPLY(pkg, entry) {
   __policyApplyStagedArtifact(pkg, entry, STAGED_ARTIFACT_BIN_PREFIX);
 }
 
-// ── Registry telemetry: facet-side event collection ──────────────────────
-// The facet cannot import the registry's emitRegistryEvent (preamble has
-// no import surface). Instead, decision sites push into a shared
-// __pendingEvents array which resolveOnePackumentInFacet returns inside
-// ResolveOneResult.events. The supervisor drains it and flushes via
-// emitRegistryEvent (npm-installer.ts).
-//
-// Shape of each entry:
-//   { type: 'swap',            from, to,                     ctx: 'transitive' }
-//   { type: 'reject',          from, reason, suggest?,       ctx: 'transitive' }
-//   { type: 'transitive-skip', from, reason }
-//
-// Note: ctx is always 'transitive' from this path (the supervisor's
-// applyW6Registry handles 'top'-ctx events directly without the facet).
-const __pendingEvents = [];
-function __EMIT_EVENT(e) { __pendingEvents.push(e); }
-function __DRAIN_EVENTS() {
-  // Hand ownership to caller; reset for next run (defensive — facet
-  // function bodies are re-instantiated per run anyway).
-  const out = __pendingEvents.slice();
-  __pendingEvents.length = 0;
-  return out;
-}
-
 // ── Semver (embedded from src/npm/semver.ts) ────────────────────────────
 // Generated — do not edit here. npm/semver.ts is the single implementation;
 // tests/unit/npm-semver.mjs asserts the embedded functions answer exactly as

package/dist/loaders/pre-bundle-preamble.d.ts

@@ -10,7 +10,10 @@
  * Specifically prebundleOne references:
  *   - ESBUILD_WASM_JS_FN_BODY — function-body string (~117 KiB) that,
  *                               when run via new Function(...)(), returns
- *                               the esbuild namespace. SMALL — kept inline.
+ *                               the esbuild namespace. Staged beside the
+ *                               wasm and fetched by the supervisor at
+ *                               pool construction (fetchEsbuildJsFnBody),
+ *                               then spliced in here.
  *   - resolvePackageEntry     — the npm-resolver helper used by the
  *                               bare-specifier resolver
  *
@@ -35,7 +38,7 @@
 /**
  * Preamble string injected ahead of the prebundleOne function in every
  * pre-bundle facet isolate. Must be passed via IsolatePool's
- * `preamble` option.
+ * `preamble` option. `jsFnBody` is the staged esbuild adapter.
  */
-export declare const PRE_BUNDLE_PREAMBLE: string;
+export declare function preBundlePreamble(jsFnBody: string): string;
 //# sourceMappingURL=pre-bundle-preamble.d.ts.map

package/dist/loaders/pre-bundle-preamble.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pre-bundle-preamble.d.ts","sourceRoot":"","sources":["../../src/loaders/pre-bundle-preamble.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAyCH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAqCjC,CAAC"}
+{"version":3,"file":"pre-bundle-preamble.d.ts","sourceRoot":"","sources":["../../src/loaders/pre-bundle-preamble.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAsCH;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAuC1D"}

package/dist/loaders/pre-bundle-preamble.js

@@ -10,7 +10,10 @@
  * Specifically prebundleOne references:
  *   - ESBUILD_WASM_JS_FN_BODY — function-body string (~117 KiB) that,
  *                               when run via new Function(...)(), returns
- *                               the esbuild namespace. SMALL — kept inline.
+ *                               the esbuild namespace. Staged beside the
+ *                               wasm and fetched by the supervisor at
+ *                               pool construction (fetchEsbuildJsFnBody),
+ *                               then spliced in here.
  *   - resolvePackageEntry     — the npm-resolver helper used by the
  *                               bare-specifier resolver
  *
@@ -32,7 +35,7 @@
  * fine — esbuild boot is the dominant cost and re-paying it once on a
  * deploy is acceptable.
  */
-import { ESBUILD_WASM_JS_FN_BODY, ESBUILD_WASM_VERSION, } from '../esbuild-wasm-bundle.generated.js';
+import { ESBUILD_WASM_VERSION } from '../esbuild-wasm-bundle.generated.js';
 import { getExportsResolverJS } from '@nimbus-sh/core/_shared/exports-resolver.js';
 // NOTE: wasm BYTES deliberately NOT in this preamble. They live in
 // env.ASSETS at /_assets/esbuild-<version>.wasm and are fetched by
@@ -69,16 +72,17 @@ const RESOLVER_HELPERS_SRC = getExportsResolverJS();
 /**
  * Preamble string injected ahead of the prebundleOne function in every
  * pre-bundle facet isolate. Must be passed via IsolatePool's
- * `preamble` option.
+ * `preamble` option. `jsFnBody` is the staged esbuild adapter.
  */
-export const PRE_BUNDLE_PREAMBLE = `
+export function preBundlePreamble(jsFnBody) {
+    return `
 // ── pre-bundle facet preamble (auto-generated) ──────────────────────────
 // Esbuild JS helpers (small ~117 KiB). The wasm BYTES are NOT here —
-// they're fetched at facet boot via env.SUPERVISOR.getEsbuildWasm() to
-// keep the per-dispatch worker module source under ~120 KiB instead of
-// ~16 MiB. See this file's header for why.
+// they ride IsolatePool's wasmModules option to keep the per-dispatch
+// worker module source under ~120 KiB instead of ~16 MiB. See this
+// file's header for why.
 const ESBUILD_WASM_VERSION = ${JSON.stringify(ESBUILD_WASM_VERSION)};
-const ESBUILD_WASM_JS_FN_BODY = ${JSON.stringify(ESBUILD_WASM_JS_FN_BODY)};
+const ESBUILD_WASM_JS_FN_BODY = ${JSON.stringify(jsFnBody)};
 
 // ── Materialise esbuild namespace at MODULE STARTUP ─────────────────────
 // workerd's deployed config disallows \"Code generation from strings\" at
@@ -109,3 +113,4 @@ try {
 ${RESOLVER_HELPERS_SRC}
 // ── end pre-bundle facet preamble ───────────────────────────────────────
 `;
+}

package/dist/node-shims-artifact.generated.d.ts

@@ -2,12 +2,21 @@
  * node-shims-artifact.generated.ts — AUTO-GENERATED by
  * scripts/bundle-node-shims.mjs. DO NOT EDIT.
  *
- * Pins the staged node-compat shim asset (the generateShimsCode() output
- * promoted out of the worker bundle). NODE_SHIMS_BUILD_ID is a content-hash
- * prefix so cache layers never serve stale bytes after a rebuild;
- * NODE_SHIMS_SHA256 is the full digest verified at fetch time.
+ * Pins the staged sources of the node-compat layer, promoted out of the worker
+ * bundle: the shims, the VFS write ledger and the resident store. Each
+ * <NAME>_BUILD_ID is a content-hash prefix so cache layers never serve stale
+ * bytes after a rebuild; <NAME>_SHA256 is the full digest verified at fetch time.
  */
+/** dist/runtime/node-shims.js generateShimsCode() */
 export declare const NODE_SHIMS_ENTRY: string;
 export declare const NODE_SHIMS_BUILD_ID: string;
 export declare const NODE_SHIMS_SHA256: string;
+/** @nimbus-sh/core dist/_shared/vfs-write-ledger.js VFS_WRITE_LEDGER_SOURCE */
+export declare const VFS_WRITE_LEDGER_ENTRY: string;
+export declare const VFS_WRITE_LEDGER_BUILD_ID: string;
+export declare const VFS_WRITE_LEDGER_SHA256: string;
+/** dist/vfs/facet-resident-store.js FACET_RESIDENT_STORE_SOURCE */
+export declare const RESIDENT_STORE_ENTRY: string;
+export declare const RESIDENT_STORE_BUILD_ID: string;
+export declare const RESIDENT_STORE_SHA256: string;
 //# sourceMappingURL=node-shims-artifact.generated.d.ts.map

package/dist/node-shims-artifact.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-shims-artifact.generated.d.ts","sourceRoot":"","sources":["../src/node-shims-artifact.generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,gBAAgB,EAAE,MAA0D,CAAC;AAC1F,eAAO,MAAM,mBAAmB,EAAE,MAA2B,CAAC;AAC9D,eAAO,MAAM,iBAAiB,EAAE,MAA2E,CAAC"}
+{"version":3,"file":"node-shims-artifact.generated.d.ts","sourceRoot":"","sources":["../src/node-shims-artifact.generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,qDAAqD;AACrD,eAAO,MAAM,gBAAgB,EAAE,MAA0D,CAAC;AAC1F,eAAO,MAAM,mBAAmB,EAAE,MAA2B,CAAC;AAC9D,eAAO,MAAM,iBAAiB,EAAE,MAA2E,CAAC;AAE5G,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,EAAE,MAAgE,CAAC;AACtG,eAAO,MAAM,yBAAyB,EAAE,MAA2B,CAAC;AACpE,eAAO,MAAM,uBAAuB,EAAE,MAA2E,CAAC;AAElH,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,EAAE,MAA8D,CAAC;AAClG,eAAO,MAAM,uBAAuB,EAAE,MAA2B,CAAC;AAClE,eAAO,MAAM,qBAAqB,EAAE,MAA2E,CAAC"}

package/dist/node-shims-artifact.generated.js

@@ -2,11 +2,20 @@
  * node-shims-artifact.generated.ts — AUTO-GENERATED by
  * scripts/bundle-node-shims.mjs. DO NOT EDIT.
  *
- * Pins the staged node-compat shim asset (the generateShimsCode() output
- * promoted out of the worker bundle). NODE_SHIMS_BUILD_ID is a content-hash
- * prefix so cache layers never serve stale bytes after a rebuild;
- * NODE_SHIMS_SHA256 is the full digest verified at fetch time.
+ * Pins the staged sources of the node-compat layer, promoted out of the worker
+ * bundle: the shims, the VFS write ledger and the resident store. Each
+ * <NAME>_BUILD_ID is a content-hash prefix so cache layers never serve stale
+ * bytes after a rebuild; <NAME>_SHA256 is the full digest verified at fetch time.
  */
-export const NODE_SHIMS_ENTRY = "/_assets/runtime/node-shims-acaa037e6d26ec0d.js";
-export const NODE_SHIMS_BUILD_ID = "acaa037e6d26ec0d";
-export const NODE_SHIMS_SHA256 = "acaa037e6d26ec0da144c015269c2c0a61cade7a9b82caabcc63a29161e8aac5";
+/** dist/runtime/node-shims.js generateShimsCode() */
+export const NODE_SHIMS_ENTRY = "/_assets/runtime/node-shims-06565b121555c194.js";
+export const NODE_SHIMS_BUILD_ID = "06565b121555c194";
+export const NODE_SHIMS_SHA256 = "06565b121555c1941ec754f7ff2b44f71846c1e9bcc7cf3489e150abd41ab1f1";
+/** @nimbus-sh/core dist/_shared/vfs-write-ledger.js VFS_WRITE_LEDGER_SOURCE */
+export const VFS_WRITE_LEDGER_ENTRY = "/_assets/runtime/vfs-write-ledger-e501e8fc793bc2c1.js";
+export const VFS_WRITE_LEDGER_BUILD_ID = "e501e8fc793bc2c1";
+export const VFS_WRITE_LEDGER_SHA256 = "e501e8fc793bc2c11d7762b7d50e277a1f10e9c4215a03fd34ea99f2266475d1";
+/** dist/vfs/facet-resident-store.js FACET_RESIDENT_STORE_SOURCE */
+export const RESIDENT_STORE_ENTRY = "/_assets/runtime/resident-store-6ffb1939c53d982f.js";
+export const RESIDENT_STORE_BUILD_ID = "6ffb1939c53d982f";
+export const RESIDENT_STORE_SHA256 = "6ffb1939c53d982f364ec3c42098ac13c171ee1a1145fc4123609639f7c8e28a";

package/dist/npm/bin-links.d.ts

@@ -28,10 +28,12 @@ type WritableVfsLike = VfsLike & Pick<CredentialedVfs, 'mkdir' | 'writeFile' | '
 export declare function npmBinDirPath(nodeModulesPath: string): string;
 export declare function npmBinManifestPath(nodeModulesPath: string): string;
 export declare function createNpmBinManifest(entries: NpmBinEntry[]): NpmBinManifest;
-export declare function createNpmBinShim(entry: NpmBinEntry): string;
+export declare function createNpmBinShim(entry: NpmBinEntry, shimDir: string): string;
 export declare function packageBinEntries(pkg: ResolvedPackage, nodeModulesPath: string): NpmBinEntry[];
 export declare function resolveNpmBin(vfs: VfsLike, cwd: string, name: string): NpmBinResolution | null;
 export declare function resolveNpmBinFromPath(vfs: VfsLike, cwd: string, envPath: string, name: string): NpmBinResolution | null;
+/** A path-shaped invocation of an executable entry in a `node_modules/.bin` directory; null otherwise. */
+export declare function resolveNpmBinPath(vfs: VfsLike & Pick<CredentialedVfs, 'stat'>, cwd: string, path: string): NpmBinResolution | null;
 export declare function materializeNpmBinShims(vfs: WritableVfsLike, nodeModulesPath: string, binDir: string): number;
 export {};
 //# sourceMappingURL=bin-links.d.ts.map

package/dist/npm/bin-links.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bin-links.d.ts","sourceRoot":"","sources":["../../src/npm/bin-links.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAE5D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,wBAAwB,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,KAAK,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,aAAa,GAAG,gBAAgB,GAAG,SAAS,CAAC,CAAC;AAC9F,KAAK,eAAe,GAAG,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,WAAW,GAAG,OAAO,CAAC,CAAA;AA8BvF,wBAAgB,aAAa,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,cAAc,CAI3E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAa3D;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,GAAG,WAAW,EAAE,CAqB9F;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAO9F;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,gBAAgB,GAAG,IAAI,CAMzB;AAED,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,eAAe,EACpB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,MAAM,CAoBR"}
+{"version":3,"file":"bin-links.d.ts","sourceRoot":"","sources":["../../src/npm/bin-links.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIrD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,qBAAqB,yBAAyB,CAAC;AAE5D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,wBAAwB,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,KAAK,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,QAAQ,GAAG,aAAa,GAAG,gBAAgB,GAAG,SAAS,CAAC,CAAC;AAC9F,KAAK,eAAe,GAAG,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,WAAW,GAAG,OAAO,CAAC,CAAA;AA8BvF,wBAAgB,aAAa,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,cAAc,CAI3E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAU5E;AAWD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,GAAG,WAAW,EAAE,CAqB9F;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAO9F;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,gBAAgB,GAAG,IAAI,CAMzB;AAED,0GAA0G;AAC1G,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAYlI;AAED,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,eAAe,EACpB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,MAAM,CAoBR"}

package/dist/npm/bin-links.js

@@ -45,19 +45,25 @@ export function createNpmBinManifest(entries) {
         bins[entry.name] = entry;
     return { version: NPM_BIN_MANIFEST_VERSION, bins };
 }
-export function createNpmBinShim(entry) {
+export function createNpmBinShim(entry, shimDir) {
     if (isStagedArtifactTarget(entry.targetPath)) {
         // The runnable bundle is staged in the assets layer; the shell dispatches
         // it through the staged-artifact runtime by recognizing the sentinel in
         // the bin manifest. The shim body is only a marker for PATH discovery.
         return `#!/usr/bin/env node\n// nimbus staged artifact: ${entry.targetPath}\n`;
     }
-    // targetPath is a normalized VFS path with no leading slash. require()
-    // must receive it as absolute (leading "/"), otherwise the runtime's
-    // resolver treats "home/user/…" as a bare specifier and fails the
-    // node_modules lookup. Matches how npm-bin-entrypoints runs the manifest
-    // target ("/" + targetPath).
-    return `#!/usr/bin/env node\nrequire(${JSON.stringify('/' + entry.targetPath)});\n`;
+    // Relative to the shim, as npm's .bin symlinks are, so a node_modules
+    // tree that is moved (a staged install renamed into place) still runs.
+    return `#!/usr/bin/env node\nrequire(${JSON.stringify(relativeRequest(shimDir, entry.targetPath))});\n`;
+}
+function relativeRequest(fromDir, target) {
+    const from = normalizeVfsPath(fromDir).split('/').filter(Boolean);
+    const to = normalizeVfsPath(target).split('/').filter(Boolean);
+    let common = 0;
+    while (common < from.length && common < to.length - 1 && from[common] === to[common])
+        common++;
+    const rel = [...from.slice(common).map(() => '..'), ...to.slice(common)].join('/');
+    return rel.startsWith('../') ? rel : `./${rel}`;
 }
 export function packageBinEntries(pkg, nodeModulesPath) {
     const packagePath = normalizeVfsPath(`${nodeModulesPath}/${pkg.name}`);
@@ -99,6 +105,24 @@ export function resolveNpmBinFromPath(vfs, cwd, envPath, name) {
     }
     return null;
 }
+/** A path-shaped invocation of an executable entry in a `node_modules/.bin` directory; null otherwise. */
+export function resolveNpmBinPath(vfs, cwd, path) {
+    const shimPath = resolveVfsPath(path, cwd || '/home/user');
+    const slash = shimPath.lastIndexOf('/');
+    if (slash < 0)
+        return null;
+    const binDir = shimPath.slice(0, slash);
+    if (!binDir.endsWith('/node_modules/.bin'))
+        return null;
+    try {
+        if ((vfs.stat(shimPath).mode & 0o111) === 0)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return resolveNpmBinInBinDir(vfs, binDir, shimPath.slice(slash + 1));
+}
 export function materializeNpmBinShims(vfs, nodeModulesPath, binDir) {
     const entries = listNpmBinEntries(vfs, normalizeVfsPath(nodeModulesPath));
     if (entries.length === 0)
@@ -107,7 +131,7 @@ export function materializeNpmBinShims(vfs, nodeModulesPath, binDir) {
     vfs.mkdir(targetBinDir, { recursive: true });
     for (const entry of entries) {
         const shimPath = `${targetBinDir}/${entry.name}`;
-        vfs.writeFile(shimPath, createNpmBinShim(entry));
+        vfs.writeFile(shimPath, createNpmBinShim(entry, targetBinDir));
         // writeFile creates files 0o644; a bin shim on PATH must be executable
         // or the shell rejects it ("command not found"). Match the 0o755 the
         // Phase-6 .bin linker uses. chmod (not a mode arg) so a re-install over

package/dist/npm/cache.d.ts

@@ -39,6 +39,11 @@ export interface RegistryCacheEntry {
     optionalDepsJson?: string;
     fetchedAt: number;
 }
+/**
+ * One placement in a project's lockfile. The Map key is the placement path
+ * (`name` at root, `<dependent>/node_modules/<name>` nested); it is what the
+ * `name` column of `pkg_lockfile` holds, whose primary key predates nesting.
+ */
 export interface LockfileEntry {
     name: string;
     resolvedVer: string;
@@ -121,8 +126,13 @@ export declare class NpmCache {
         written: number;
         failed: number;
     };
-    /** Read the lockfile for a project. Returns null if not found. */
+    /** Read the lockfile for a project, keyed by placement path. Null if not found. */
     readLockfile(projectPath: string): Map<string, LockfileEntry> | null;
+    /**
+     * Every installed package directory (namespace key, no leading slash) and
+     * the integrity its tarball was pinned to, across projects.
+     */
+    installedIntegrities(): Map<string, string>;
     /** Write/overwrite the lockfile for a project. Atomic via transaction. */
     writeLockfile(projectPath: string, entries: Map<string, LockfileEntry>, ctx?: DurableObjectState): void;
     /** Delete lockfile for a project (e.g., after package.json changes). */

package/dist/npm/cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/npm/cache.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,qBAAa,QAAQ;IACnB,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,WAAW,CAAS;gBAEhB,GAAG,EAAE,UAAU;IAM3B,YAAY,IAAI,IAAI;IA6FpB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CACwH;IAEhK,OAAO,CAAC,kBAAkB;IAkB1B;;;;;;;;mBAQe;IACf,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IA0B1E;;;;;;;;;OASG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAU1D,kDAAkD;IAClD,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAUvD,8DAA8D;IAC9D,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI;IAcjD;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IA2BtF,kEAAkE;IAClE,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,IAAI;IAqBpE,0EAA0E;IAC1E,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACnC,GAAG,CAAC,EAAE,kBAAkB,GACvB,IAAI;IAmCP,wEAAwE;IACxE,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAOzC,oCAAoC;IACpC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAkBtD,sCAAsC;IACtC,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAUzC,oEAAoE;IACpE,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKxC,2DAA2D;IAC3D,eAAe,IAAI,IAAI;IAOvB;;;;;;;;OAQG;IACH,sBAAsB,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,GACrB,wBAAwB,GAAG,IAAI;IAsBlC,iFAAiF;IACjF,sBAAsB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI;IAW7D;8BAC0B;IAC1B,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAOhD,QAAQ,IAAI;QACV,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,oBAAoB,EAAE,MAAM,CAAC;KAC9B;CAaF"}
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/npm/cache.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,qBAAa,QAAQ;IACnB,OAAO,CAAC,GAAG,CAAa;IACxB,OAAO,CAAC,WAAW,CAAS;gBAEhB,GAAG,EAAE,UAAU;IAM3B,YAAY,IAAI,IAAI;IA6FpB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CACwH;IAEhK,OAAO,CAAC,kBAAkB;IAkB1B;;;;;;;;mBAQe;IACf,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IA0B1E;;;;;;;;;OASG;IACH,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAU1D,kDAAkD;IAClD,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAUvD,8DAA8D;IAC9D,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI;IAcjD;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;IA2BtF,mFAAmF;IACnF,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,IAAI;IAsBpE;;;OAGG;IACH,oBAAoB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAS3C,0EAA0E;IAC1E,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,EACnC,GAAG,CAAC,EAAE,kBAAkB,GACvB,IAAI;IAmCP,wEAAwE;IACxE,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IAOzC,oCAAoC;IACpC,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAkBtD,sCAAsC;IACtC,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAUzC,oEAAoE;IACpE,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKxC,2DAA2D;IAC3D,eAAe,IAAI,IAAI;IAOvB;;;;;;;;OAQG;IACH,sBAAsB,CACpB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,GACrB,wBAAwB,GAAG,IAAI;IAsBlC,iFAAiF;IACjF,sBAAsB,CAAC,KAAK,EAAE,wBAAwB,GAAG,IAAI;IAW7D;8BAC0B;IAC1B,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAOhD,QAAQ,IAAI;QACV,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,oBAAoB,EAAE,MAAM,CAAC;KAC9B;CAaF"}