@nimbus-sh/worker 0.9.0 → 0.11.0

package/dist/npm/npx-install.d.ts

@@ -73,5 +73,7 @@ export interface NpxResolveResult {
  * Callers can use describeNpxSelfInvocation()/formatNpxHelp() before calling
  * this resolver.
  */
-export declare function resolveNpxBinary(installer: NpmInstaller, vfs: CredentialedVfs, cwd: string, rawArgs: string[], log: (msg: string) => void, pid?: number): Promise<NpxResolveResult>;
+export declare function resolveNpxBinary(installer: NpmInstaller, vfs: CredentialedVfs, cwd: string, rawArgs: string[], log: (msg: string) => void, pid?: number, 
+/** The command's `NPM_REGISTRY`; the npx cache install reads from it too. */
+registry?: string): Promise<NpxResolveResult>;
 //# sourceMappingURL=npx-install.d.ts.map

package/dist/npm/npx-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npx-install.d.ts","sourceRoot":"","sources":["../../src/npm/npx-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAE5G;gFACgF;AAChF,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAoC/C,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;AA+BtE,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAE9E;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAElE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAG7D;AAED,wBAAgB,aAAa,IAAI,MAAM,CAWtC;AA6KD;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;0CACsC;IACtC,MAAM,CAAC,EAAE,YAAY,GAAG,WAAW,GAAG,eAAe,CAAC;CACvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,YAAY,EACvB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC1B,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,gBAAgB,CAAC,CAmE3B"}
+{"version":3,"file":"npx-install.d.ts","sourceRoot":"","sources":["../../src/npm/npx-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAE5G;gFACgF;AAChF,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAoC/C,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;AA+BtE,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAE9E;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAElE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAG7D;AAED,wBAAgB,aAAa,IAAI,MAAM,CAWtC;AA6KD;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,CAAC,EAAE,kBAAkB,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;0CACsC;IACtC,MAAM,CAAC,EAAE,YAAY,GAAG,WAAW,GAAG,eAAe,CAAC;CACvD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,YAAY,EACvB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC1B,GAAG,CAAC,EAAE,MAAM;AACZ,6EAA6E;AAC7E,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAoE3B"}

package/dist/npm/npx-install.js

@@ -281,7 +281,9 @@ function ensureNpxCachePackageJson(vfs, pkgName, pkgRange) {
  * Callers can use describeNpxSelfInvocation()/formatNpxHelp() before calling
  * this resolver.
  */
-export async function resolveNpxBinary(installer, vfs, cwd, rawArgs, log, pid) {
+export async function resolveNpxBinary(installer, vfs, cwd, rawArgs, log, pid, 
+/** The command's `NPM_REGISTRY`; the npx cache install reads from it too. */
+registry) {
     const parsed = parseNpxArgs(rawArgs);
     if ('error' in parsed) {
         return { ok: false, error: parsed.error };
@@ -310,6 +312,7 @@ export async function resolveNpxBinary(installer, vfs, cwd, rawArgs, log, pid) {
         const result = await installer.install(NPX_CACHE_DIR, {
             packages: [installSpec],
             pid,
+            registry,
         });
         if ((result.failed?.length || 0) > 0) {
             // Partial install — some package failed to resolve. The fix is

package/dist/npm/package-lock.d.ts

@@ -0,0 +1,32 @@
+export interface PackageLockEntry {
+    name?: unknown;
+    version?: unknown;
+    resolved?: unknown;
+    integrity?: unknown;
+    link?: unknown;
+    dev?: unknown;
+    optional?: unknown;
+    dependencies?: unknown;
+    devDependencies?: unknown;
+    optionalDependencies?: unknown;
+    peerDependencies?: unknown;
+    bin?: unknown;
+    os?: unknown;
+    cpu?: unknown;
+    libc?: unknown;
+}
+export interface PackageLock {
+    lockfileVersion: number;
+    packages: Record<string, PackageLockEntry>;
+}
+export declare function parsePackageLock(text: string, lockName: string): PackageLock;
+/**
+ * Why the lock no longer describes package.json, one line per disagreement;
+ * empty when they agree. Every declared dependency must be locked at a
+ * version its range accepts, and the lock's root must declare the same
+ * dependency set, so a dependency removed from package.json is caught too.
+ */
+export declare function packageLockMismatches(pkgJson: Record<string, unknown>, lock: PackageLock): string[];
+export declare function stringRecord(value: unknown): Record<string, string>;
+export declare function stringList(value: unknown): string[] | undefined;
+//# sourceMappingURL=package-lock.d.ts.map

package/dist/npm/package-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-lock.d.ts","sourceRoot":"","sources":["../../src/npm/package-lock.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,CAU5E;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CA2BnG;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKnE;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CAE/D"}

package/dist/npm/package-lock.js

@@ -0,0 +1,65 @@
+/**
+ * npm's package-lock.json / npm-shrinkwrap.json (lockfileVersion 2 and 3),
+ * read for `npm ci`: the `packages` map keyed by install path, and the check
+ * that the lock still describes what package.json declares.
+ */
+import { isSemverRange, satisfiesRange } from './semver.js';
+import { parseRegistryRequest } from './resolve-one-facet.js';
+export function parsePackageLock(text, lockName) {
+    const lock = JSON.parse(text);
+    const version = typeof lock.lockfileVersion === 'number' ? lock.lockfileVersion : 0;
+    if (version < 2 || lock.packages === null || typeof lock.packages !== 'object') {
+        throw new Error(`${lockName} has lockfileVersion ${version || 'unknown'}; \`npm ci\` here reads lockfileVersion 2 or 3. ` +
+            'Run `npm install` with npm 7 or newer to upgrade it.');
+    }
+    return { lockfileVersion: version, packages: lock.packages };
+}
+const DEPENDENCY_FIELDS = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];
+/**
+ * Why the lock no longer describes package.json, one line per disagreement;
+ * empty when they agree. Every declared dependency must be locked at a
+ * version its range accepts, and the lock's root must declare the same
+ * dependency set, so a dependency removed from package.json is caught too.
+ */
+export function packageLockMismatches(pkgJson, lock) {
+    const out = [];
+    const root = lock.packages[''] ?? {};
+    for (const field of DEPENDENCY_FIELDS) {
+        const declared = stringRecord(pkgJson[field]);
+        const locked = stringRecord(root[field]);
+        for (const [name, spec] of Object.entries(declared)) {
+            if (locked[name] !== spec) {
+                out.push(`Invalid: lock file's root ${field} has ${name}@${locked[name] ?? '(none)'}, package.json has ${name}@${spec}`);
+                continue;
+            }
+            const entry = lock.packages[`node_modules/${name}`];
+            if (!entry) {
+                if (field !== 'peerDependencies' && field !== 'optionalDependencies')
+                    out.push(`Missing: ${name}@${spec} from lock file`);
+                continue;
+            }
+            const range = parseRegistryRequest(name, spec).range;
+            const version = typeof entry.version === 'string' ? entry.version : '';
+            if (isSemverRange(range) && !satisfiesRange(version, range)) {
+                out.push(`Invalid: lock file's ${name}@${version || '(none)'} does not satisfy ${name}@${spec}`);
+            }
+        }
+        for (const name of Object.keys(locked)) {
+            if (!Object.hasOwn(declared, name))
+                out.push(`Invalid: lock file's root ${field} has ${name}, which package.json does not declare`);
+        }
+    }
+    return out;
+}
+export function stringRecord(value) {
+    const out = {};
+    if (value === null || typeof value !== 'object')
+        return out;
+    for (const [key, v] of Object.entries(value))
+        if (typeof v === 'string')
+            out[key] = v;
+    return out;
+}
+export function stringList(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : undefined;
+}

package/dist/npm/placement.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Placement paths: where a package lands, relative to the project's
+ * `node_modules` — `react` at root, `pkg-types/node_modules/confbox` nested
+ * under the dependent whose range root does not satisfy. Node walks
+ * `node_modules` upward from the importer, so a nested copy is found by its
+ * dependent (and what is beneath it) and by nobody else.
+ */
+/** `name` under `parent`; `''` is the project itself. */
+export declare function nestedPlacement(parent: string, name: string): string;
+/** The containing placement, `''` at root. */
+export declare function parentPlacement(placement: string): string;
+/** The package name a placement holds. */
+export declare function placementName(placement: string): string;
+/** Placements Node's walk visits for `name` from inside `from`, nearest first, root last. */
+export declare function visiblePlacements(from: string, name: string): string[];
+//# sourceMappingURL=placement.d.ts.map

package/dist/npm/placement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"placement.d.ts","sourceRoot":"","sources":["../../src/npm/placement.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,yDAAyD;AACzD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,8CAA8C;AAC9C,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED,0CAA0C;AAC1C,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED,6FAA6F;AAC7F,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAStE"}

package/dist/npm/placement.js

@@ -0,0 +1,33 @@
+/**
+ * Placement paths: where a package lands, relative to the project's
+ * `node_modules` — `react` at root, `pkg-types/node_modules/confbox` nested
+ * under the dependent whose range root does not satisfy. Node walks
+ * `node_modules` upward from the importer, so a nested copy is found by its
+ * dependent (and what is beneath it) and by nobody else.
+ */
+const NM = '/node_modules/';
+/** `name` under `parent`; `''` is the project itself. */
+export function nestedPlacement(parent, name) {
+    return parent ? `${parent}${NM}${name}` : name;
+}
+/** The containing placement, `''` at root. */
+export function parentPlacement(placement) {
+    const i = placement.lastIndexOf(NM);
+    return i < 0 ? '' : placement.slice(0, i);
+}
+/** The package name a placement holds. */
+export function placementName(placement) {
+    const i = placement.lastIndexOf(NM);
+    return i < 0 ? placement : placement.slice(i + NM.length);
+}
+/** Placements Node's walk visits for `name` from inside `from`, nearest first, root last. */
+export function visiblePlacements(from, name) {
+    const out = [];
+    let dir = from;
+    while (dir) {
+        out.push(`${dir}${NM}${name}`);
+        dir = parentPlacement(dir);
+    }
+    out.push(name);
+    return out;
+}

package/dist/npm/pre-bundle-facet.d.ts

@@ -4,7 +4,7 @@
  * Why this exists
  * ───────────────
  * Pre-bundling npm packages (the `Pre-bundling N modules…` step in
- * src/npm-installer.ts:704) used to call `EsbuildService.build(...)`
+ * src/npm/installer.ts) used to call `EsbuildService.build(...)`
  * inside the supervisor DO isolate. Each `esbuild.build` allocates
  * 30–80 MiB of WASM linear memory plus the input/output graph; against
  * the 128 MB DO heap cap this OOM-killed the supervisor on installs
@@ -104,35 +104,6 @@ export interface PrebundleResult {
     /** Non-fatal warnings the supervisor should surface. */
     warnings: string[];
 }
-/**
- * Walk node_modules to collect every file the pre-bundle of `specifier`
- * may read. Runs in the supervisor (cheap — direct VFS access).
- *
- * Algorithm:
- *   1. Compute the externals via getSharedRuntimeExternals(specifier).
- *      These are the bare specifiers esbuild will leave external; their
- *      files do NOT need to be in the slice.
- *   2. Resolve the spec's package directory and add every file beneath
- *      it to the slice.
- *   3. Read its package.json `dependencies` and recurse into each one
- *      that is NOT in the externals set. Deps that walked up are
- *      visited at most once (visited set).
- *
- * Lives here (alongside the facet function) so changes to the slice
- * shape touch one file — the supervisor caller in npm-installer.ts is
- * a thin orchestrator.
- */
-export interface BuildSliceOptions {
-    /** Cap on total bytes shipped to the facet. 24 MiB leaves headroom under
-     *  the 32 MiB workerd RPC cap. Returns `null` if the cap is exceeded so
-     *  the caller can decide whether to bail or split (bf41d1c precedent).
-     */
-    maxBytes?: number;
-}
-export declare function buildSliceForSpecifier(vfs: CredentialedVfs, specifier: string, nmDir: string): {
-    slice: SliceEntry[];
-    totalBytes: number;
-} | null;
 export declare function buildSliceForSpecifierWithCap(vfs: CredentialedVfs, specifier: string, nmDir: string, capBytes: number): {
     slice: SliceEntry[];
     totalBytes: number;

package/dist/npm/pre-bundle-facet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pre-bundle-facet.d.ts","sourceRoot":"","sources":["../../src/npm/pre-bundle-facet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAA6B,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAgBxG;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;CACd;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,IAAI,CAAC;CACb;AACD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAEhD,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,+GAA+G;IAC/G,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,+EAA+E;IAC/E,cAAc,EAAE,MAAM,CAAC;IACvB;;;8DAG0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,8BAA8B;AAC9B,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AACD,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GACZ;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAEpD;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4GpD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAEjE;AAmBD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GACvB,MAAM,aAAa,EACnB,MAAM;IACJ,UAAU,EAAE;QAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;KAAE,CAAC;CAC7D,KACA,OAAO,CAAC,eAAe,CAiazB,CAAC;AAGF,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG,eAAe,CAAC"}
+{"version":3,"file":"pre-bundle-facet.d.ts","sourceRoot":"","sources":["../../src/npm/pre-bundle-facet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAA6B,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAgBxG;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;CACd;AACD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,IAAI,CAAC;CACb;AACD,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;AAEhD,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAC;IAClB,+GAA+G;IAC/G,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,+EAA+E;IAC/E,cAAc,EAAE,MAAM,CAAC;IACvB;;;8DAG0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,8BAA8B;AAC9B,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,OAAO,CAAC;IACZ,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAQD,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CA4GpD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAEjE;AAmBD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GACvB,MAAM,aAAa,EACnB,MAAM;IACJ,UAAU,EAAE;QAAE,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;KAAE,CAAC;CAC7D,KACA,OAAO,CAAC,eAAe,CAiazB,CAAC;AAGF,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B,MAAM,MAAM,gBAAgB,GAAG,eAAe,CAAC"}

package/dist/npm/pre-bundle-facet.js

@@ -4,7 +4,7 @@
  * Why this exists
  * ───────────────
  * Pre-bundling npm packages (the `Pre-bundling N modules…` step in
- * src/npm-installer.ts:704) used to call `EsbuildService.build(...)`
+ * src/npm/installer.ts) used to call `EsbuildService.build(...)`
  * inside the supervisor DO isolate. Each `esbuild.build` allocates
  * 30–80 MiB of WASM linear memory plus the input/output graph; against
  * the 128 MB DO heap cap this OOM-killed the supervisor on installs
@@ -45,9 +45,7 @@
  * contract.
  */
 import { getSharedRuntimeExternals, BUNDLER_VERSION } from '@nimbus-sh/core/runtime/esbuild-service.js';
-export function buildSliceForSpecifier(vfs, specifier, nmDir) {
-    return buildSliceForSpecifierWithCap(vfs, specifier, nmDir, 24 * 1024 * 1024);
-}
+// ── Supervisor-side: build the slice for one specifier ──────────────────
 export function buildSliceForSpecifierWithCap(vfs, specifier, nmDir, capBytes) {
     const externals = new Set();
     for (const e of getSharedRuntimeExternals(specifier)) {
@@ -286,7 +284,7 @@ export const prebundleOne = async function prebundleOne(spec, _env) {
         initPromise = (async () => {
             // Read the WebAssembly.Module the pool registered. The key matches
             // the name passed to IsolatePool's `wasmModules` option (see
-            // src/npm-installer.ts:prebundleUsedModules dispatch site).
+            // src/npm/installer.ts:prebundleUsedModules dispatch site).
             const wasmRegistry = globalThis.__NIMBUS_WASM;
             const wasmModule = wasmRegistry && wasmRegistry['esbuild.wasm'];
             if (!wasmModule) {

package/dist/npm/r2-cache.d.ts

@@ -16,6 +16,8 @@
  * Two buckets, two key shapes:
  *   tarball:    `${R2_CACHE_PREFIX}/t/<sri-algo>/<sri-digest-hex>.tgz`
  *   packument:  `${R2_CACHE_PREFIX}/pc/<name>.json  (corgi/abbreviated format)`
+ *   The tarball bucket also holds read profiles under `read-profiles/v1/`
+ *   (facets/read-profile.ts): package-relative paths per tarball integrity.
  *
  * Why two buckets:
  *   Tarballs are content-addressed and never expire. Packuments must
@@ -57,6 +59,7 @@
  *     stream directly from npm.
  *   - npm publish webhook -> cache invalidation.
  */
+import { NPM_REGISTRY_ORIGIN, npmRegistryOrigin } from '@nimbus-sh/core/substrate/lifo/commands/system/npm.js';
 import type { CacheTier, CacheKind } from '@nimbus-sh/core/_shared/cache-stats.js';
 /**
  * Per-call cache-stat event (cache metrics support). R2CacheClient
@@ -117,8 +120,9 @@ export declare const R2_CACHE_PREFIX = "v2";
  *  No data migration; existing R2 packument entries' customMetadata
  *  .expiresAt stamps remain valid against either TTL. */
 export declare const PACKUMENT_TTL_MS: number;
+export { NPM_REGISTRY_ORIGIN, npmRegistryOrigin };
 /** The registry URL a packument is read from — also what `npm http` lines report. */
-export declare function packumentUrl(name: string): string;
+export declare function packumentUrl(name: string, registry?: string): string;
 /** Cap on tarball bytes returned via this RPC. Workerd structured-clone
  *  cap is 32 MiB; we keep a comfortable margin to leave room for RPC
  *  framing + the call's own arg bytes. Tarballs above this size skip
@@ -171,7 +175,7 @@ type R2BucketLike = {
  * encodeURIComponent on the name so '@scope/pkg' becomes a single path
  * segment (R2 keys allow any UTF-8, but URL paths need encoding).
  */
-export declare function packumentL2Url(name: string): string;
+export declare function packumentL2Url(name: string, registry?: string): string;
 /** L2 cache-key URL for a tarball content address. Hex + the SRI algo
  *  name are already URL-safe, so the R2 key doubles as the URL path. */
 export declare function tarballL2Url(address: TarballAddress): string;
@@ -211,7 +215,7 @@ export declare function parseTarballAddress(integrity: string): TarballAddress |
  */
 export declare function tarballKey(address: TarballAddress): string;
 /** Compose the R2 object key for a packument. */
-export declare function packumentKey(name: string): string;
+export declare function packumentKey(name: string, registry?: string): string;
 /**
  * Per-instance counters surfaced for tests / probes. Read via
  * `R2CacheClient.stats()`. Track at the FUNCTION boundary level so a
@@ -308,7 +312,7 @@ export declare class R2CacheClient {
      * write back to L2 with a 5-min `Cache-Control: max-age=300`
      * (matching the existing R2 customMetadata.expiresAt semantic).
      */
-    getPackument(name: string): Promise<CachedPackument | null>;
+    getPackument(name: string, registry?: string): Promise<CachedPackument | null>;
     /**
      * Resolve a packument through the whole stack: cache read, and on a
      * miss (or an expired entry) the registry fetch plus the cache fill.
@@ -323,6 +327,8 @@ export declare class R2CacheClient {
      * attacker would be choosing the address too. Here, the only bytes
      * that reach `pc/<name>.json` are the ones registry.npmjs.org served
      * for that exact name, one line below the fetch that produced them.
+     * Another registry (`options.registry`) fills and reads only its own
+     * namespace of the cache, so it can neither poison nor borrow those.
      *
      * `status` is set when the registry answered 4xx (no such package);
      * `failure` when every attempt failed. Both leave `json` null.
@@ -330,6 +336,7 @@ export declare class R2CacheClient {
     readThroughPackument(name: string, options?: {
         retries?: number;
         timeoutMs?: number;
+        registry?: string;
     }): Promise<PackumentReadThrough>;
     /**
      * Write a packument JSON to R2 with a TTL stamp in customMetadata.
@@ -342,11 +349,10 @@ export declare class R2CacheClient {
      * Returns true on success, false on failure (same best-effort posture
      * as putTarball).
      */
-    putPackument(name: string, json: string): Promise<boolean>;
+    putPackument(name: string, json: string, registry?: string): Promise<boolean>;
     /** Lightweight feature-detection for callers that want to log path. */
     hasTarballBucket(): boolean;
     /** Lightweight feature-detection for callers that want to log path. */
     hasPackumentBucket(): boolean;
 }
-export {};
 //# sourceMappingURL=r2-cache.d.ts.map

package/dist/npm/r2-cache.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"r2-cache.d.ts","sourceRoot":"","sources":["../../src/npm/r2-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAE5D;;;;;;;;mBAQmB;AACnB,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yDA6ByD;AACzD,eAAO,MAAM,gBAAgB,QAAc,CAAC;AAQ5C,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKjD;AAED;;;;0DAI0D;AAC1D,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAIrD,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B;;sCAEkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb;8DAC0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd;;mCAE+B;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,sEAAsE;AACtE,KAAK,YAAY,GAAG;IAClB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACxB,QAAQ,CAAC,EAAE,IAAI,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACzC,GAAG,IAAI,CAAC,CAAC;IACV,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,MAAM,EACvC,IAAI,CAAC,EAAE;QACL,YAAY,CAAC,EAAE;YAAE,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACzC,GACA,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvC,GAAG,IAAI,CAAC;AAmBT;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;wEACwE;AACxE,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE5D;AAmDD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAsB5E;AAYD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE1D;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAID;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IAetB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAflC,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,cAAc,CAAK;IAC3B;;;;;;OAMG;IACI,YAAY,EAAE,gBAAgB,EAAE,CAAM;gBAG1B,aAAa,EAAE,YAAY,EAC3B,eAAe,EAAE,YAAY;IAGhD,OAAO,CAAC,UAAU;IAGlB,OAAO,CAAC,WAAW;IAInB,kEAAkE;IAClE,KAAK,IAAI,kBAAkB;IAS3B;;;;;;;;;;;;;;OAcG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAwE/D;;;;;;;;;OASG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBtF;;;;;;;;;;;;;;;;OAgBG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA8EjE;;;;;;;;;;;;;;;;;OAiBG;IACG,oBAAoB,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC,oBAAoB,CAAC;IA4DhC;;;;;;;;;;OAUG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAehE,uEAAuE;IACvE,gBAAgB,IAAI,OAAO;IAI3B,uEAAuE;IACvE,kBAAkB,IAAI,OAAO;CAG9B"}
+{"version":3,"file":"r2-cache.d.ts","sourceRoot":"","sources":["../../src/npm/r2-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,uDAAuD,CAAC;AAC/G,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AAE5D;;;;;;;;mBAQmB;AACnB,eAAO,MAAM,eAAe,OAAO,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yDA6ByD;AACzD,eAAO,MAAM,gBAAgB,QAAc,CAAC;AAI5C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;AAKlD,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA4B,GAAG,MAAM,CAKzF;AAcD;;;;0DAI0D;AAC1D,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAIrD,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;IAC/B,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B;;sCAEkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb;8DAC0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd;;mCAE+B;IAC/B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,sEAAsE;AACtE,KAAK,YAAY,GAAG;IAClB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,WAAW,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACxB,QAAQ,CAAC,EAAE,IAAI,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACzC,GAAG,IAAI,CAAC,CAAC;IACV,GAAG,CACD,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,MAAM,EACvC,IAAI,CAAC,EAAE;QACL,YAAY,CAAC,EAAE;YAAE,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACxC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACzC,GACA,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvC,GAAG,IAAI,CAAC;AAmBT;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA4B,GAAG,MAAM,CAE3F;AAED;wEACwE;AACxE,wBAAgB,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE5D;AAmDD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAsB5E;AAYD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAE1D;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA4B,GAAG,MAAM,CAEzF;AAID;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IAetB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAflC,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,cAAc,CAAK;IAC3B;;;;;;OAMG;IACI,YAAY,EAAE,gBAAgB,EAAE,CAAM;gBAG1B,aAAa,EAAE,YAAY,EAC3B,eAAe,EAAE,YAAY;IAGhD,OAAO,CAAC,UAAU;IAGlB,OAAO,CAAC,WAAW;IAInB,kEAAkE;IAClE,KAAK,IAAI,kBAAkB;IAS3B;;;;;;;;;;;;;;OAcG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAwE/D;;;;;;;;;OASG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBtF;;;;;;;;;;;;;;;;OAgBG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA4B,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA8EzG;;;;;;;;;;;;;;;;;;;OAmBG;IACG,oBAAoB,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,OAAO,CAAC,oBAAoB,CAAC;IA6DhC;;;;;;;;;;OAUG;IACG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA4B,GAAG,OAAO,CAAC,OAAO,CAAC;IAexG,uEAAuE;IACvE,gBAAgB,IAAI,OAAO;IAI3B,uEAAuE;IACvE,kBAAkB,IAAI,OAAO;CAG9B"}

package/dist/npm/r2-cache.js

@@ -16,6 +16,8 @@
  * Two buckets, two key shapes:
  *   tarball:    `${R2_CACHE_PREFIX}/t/<sri-algo>/<sri-digest-hex>.tgz`
  *   packument:  `${R2_CACHE_PREFIX}/pc/<name>.json  (corgi/abbreviated format)`
+ *   The tarball bucket also holds read profiles under `read-profiles/v1/`
+ *   (facets/read-profile.ts): package-relative paths per tarball integrity.
  *
  * Why two buckets:
  *   Tarballs are content-addressed and never expire. Packuments must
@@ -57,6 +59,7 @@
  *     stream directly from npm.
  *   - npm publish webhook -> cache invalidation.
  */
+import { NPM_REGISTRY_ORIGIN, npmRegistryOrigin } from '@nimbus-sh/core/substrate/lifo/commands/system/npm.js';
 /** Schema version baked into every cache key. Bump to invalidate
  *  everything atomically (e.g. if the storage shape changes or a bug
  *  poisoned a class of keys).
@@ -98,16 +101,28 @@ export const R2_CACHE_PREFIX = 'v2';
  *  No data migration; existing R2 packument entries' customMetadata
  *  .expiresAt stamps remain valid against either TTL. */
 export const PACKUMENT_TTL_MS = 60 * 60_000;
-/** npm registry origin. The only host the packument cache is filled from. */
-const NPM_REGISTRY_ORIGIN = 'https://registry.npmjs.org';
+// The origin rule lives with the command that reads NPM_REGISTRY; the cache
+// keys by the same value.
+export { NPM_REGISTRY_ORIGIN, npmRegistryOrigin };
 /** Jittered backoff between packument fetch attempts. */
 const PACKUMENT_BACKOFF_MS = [500, 1500, 4500];
 /** The registry URL a packument is read from — also what `npm http` lines report. */
-export function packumentUrl(name) {
+export function packumentUrl(name, registry = NPM_REGISTRY_ORIGIN) {
     const safeName = name.startsWith('@')
         ? '@' + encodeURIComponent(name.slice(1))
         : encodeURIComponent(name);
-    return `${NPM_REGISTRY_ORIGIN}/${safeName}`;
+    return `${registry}/${safeName}`;
+}
+/**
+ * The cache path segment for a packument: `<name>.json` for the default
+ * registry (the keys warm caches already hold), and `<origin>/<name>.json`
+ * for any other, so a private registry never reads or fills the entries
+ * registry.npmjs.org served.
+ */
+function packumentCachePath(name, registry) {
+    return registry === NPM_REGISTRY_ORIGIN
+        ? `${name}.json`
+        : `${encodeURIComponent(registry)}/${name}.json`;
 }
 /** Cap on tarball bytes returned via this RPC. Workerd structured-clone
  *  cap is 32 MiB; we keep a comfortable margin to leave room for RPC
@@ -136,8 +151,8 @@ const L2_KEY_HOST = 'https://nimbus-cache.invalid';
  * encodeURIComponent on the name so '@scope/pkg' becomes a single path
  * segment (R2 keys allow any UTF-8, but URL paths need encoding).
  */
-export function packumentL2Url(name) {
-    return `${L2_KEY_HOST}/${R2_CACHE_PREFIX}/pc/${encodeURIComponent(name)}.json`;
+export function packumentL2Url(name, registry = NPM_REGISTRY_ORIGIN) {
+    return `${L2_KEY_HOST}/${R2_CACHE_PREFIX}/pc/${encodeURIComponent(packumentCachePath(name, registry))}`;
 }
 /** L2 cache-key URL for a tarball content address. Hex + the SRI algo
  *  name are already URL-safe, so the R2 key doubles as the URL path. */
@@ -253,8 +268,8 @@ export function tarballKey(address) {
     return `${R2_CACHE_PREFIX}/t/${address.algo}/${address.hex}.tgz`;
 }
 /** Compose the R2 object key for a packument. */
-export function packumentKey(name) {
-    return `${R2_CACHE_PREFIX}/pc/${name}.json`;
+export function packumentKey(name, registry = NPM_REGISTRY_ORIGIN) {
+    return `${R2_CACHE_PREFIX}/pc/${packumentCachePath(name, registry)}`;
 }
 /**
  * R2-backed npm cache client. Wraps two R2 bindings (tarballs + packuments)
@@ -437,9 +452,9 @@ export class R2CacheClient {
      * write back to L2 with a 5-min `Cache-Control: max-age=300`
      * (matching the existing R2 customMetadata.expiresAt semantic).
      */
-    async getPackument(name) {
+    async getPackument(name, registry = NPM_REGISTRY_ORIGIN) {
         // ── L2 fast path (per-colo) ───────────────────────────────────
-        const l2Key = new Request(packumentL2Url(name));
+        const l2Key = new Request(packumentL2Url(name, registry));
         const l2Hit = await l2Get(l2Key);
         if (l2Hit) {
             this._l2HitsPackument++;
@@ -475,7 +490,7 @@ export class R2CacheClient {
             return null;
         }
         this._l3GetsPackument++;
-        const obj = await this.packumentBucket.get(packumentKey(name));
+        const obj = await this.packumentBucket.get(packumentKey(name, registry));
         if (!obj) {
             this._recordMiss('L3', 'packument');
             return null;
@@ -528,16 +543,19 @@ export class R2CacheClient {
      * attacker would be choosing the address too. Here, the only bytes
      * that reach `pc/<name>.json` are the ones registry.npmjs.org served
      * for that exact name, one line below the fetch that produced them.
+     * Another registry (`options.registry`) fills and reads only its own
+     * namespace of the cache, so it can neither poison nor borrow those.
      *
      * `status` is set when the registry answered 4xx (no such package);
      * `failure` when every attempt failed. Both leave `json` null.
      */
     async readThroughPackument(name, options) {
-        const cached = await this.getPackument(name);
+        const registry = options?.registry ?? NPM_REGISTRY_ORIGIN;
+        const cached = await this.getPackument(name, registry);
         if (cached && !cached.expired && cached.json) {
             return { json: cached.json, source: 'r2-cache' };
         }
-        const url = packumentUrl(name);
+        const url = packumentUrl(name, registry);
         const retries = Math.max(0, options?.retries ?? 3);
         const timeoutMs = options?.timeoutMs ?? 15_000;
         let lastErr;
@@ -566,7 +584,7 @@ export class R2CacheClient {
                     this._recordHit('L4', 'packument', json.length);
                     // Best-effort fill, awaited so a follow-up read in the same
                     // install sees it.
-                    await this.putPackument(name, json);
+                    await this.putPackument(name, json, registry);
                     return { json, source: 'network' };
                 }
                 if (resp.status >= 400 && resp.status < 500) {
@@ -605,12 +623,12 @@ export class R2CacheClient {
      * Returns true on success, false on failure (same best-effort posture
      * as putTarball).
      */
-    async putPackument(name, json) {
+    async putPackument(name, json, registry = NPM_REGISTRY_ORIGIN) {
         if (!this.packumentBucket)
             return false;
         const expiresAt = Date.now() + PACKUMENT_TTL_MS;
         try {
-            await this.packumentBucket.put(packumentKey(name), json, {
+            await this.packumentBucket.put(packumentKey(name, registry), json, {
                 httpMetadata: { contentType: 'application/json' },
                 customMetadata: { expiresAt: String(expiresAt) },
             });

package/dist/npm/resolve-one-facet.d.ts

@@ -80,6 +80,8 @@ export interface ResolveOneSpec {
     fetchTimeoutMs: number;
     /** Retries for transient failures. Default 3. */
     retries: number;
+    /** Registry origin the packument is read from (the install's `NPM_REGISTRY`). */
+    registry: string;
 }
 export interface ResolveOneResult {
     /** Resolved package, or null if a registry policy filtered it out. */
@@ -201,6 +203,7 @@ export declare const resolveOnePackumentInFacet: (spec: ResolveOneSpec, env: {
         getPackument: (name: string, options: {
             retries: number;
             timeoutMs: number;
+            registry: string;
         }) => Promise<{
             json: string | null;
             source: "r2-cache" | "network";

package/dist/npm/resolve-one-facet.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-one-facet.d.ts","sourceRoot":"","sources":["../../src/npm/resolve-one-facet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AA4B/E;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC;+EAC2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,GAAG,EAAE,eAAe,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;OAIG;IACH,WAAW,EAAE,GAAG,EAAE,CAAC;IACnB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sDAAsD;IACtD,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B;;;OAGG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IAClE;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,KAAK,CACnB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAChF;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,WAAW,CAAA;KAAE,CACrE,CAAC;IACF;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,EACF;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACrE;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;EAsB/D;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,GACrC,MAAM,cAAc,EACpB,KAAK;IACH,UAAU,EAAE;QACV;;;;WAIG;QACH,YAAY,EAAE,CACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,KAC5C,OAAO,CAAC;YACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;YAC/B,MAAM,EAAE,KAAK,CACT;gBAAE,IAAI,EAAE,KAAK,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAA;aAAE,GAC/D;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAA;aAAE,CACpD,CAAC;YACF,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC,CAAC;KACJ,CAAC;CACH,KACA,OAAO,CAAC,gBAAgB,CAqW1B,CAAC"}
+{"version":3,"file":"resolve-one-facet.d.ts","sourceRoot":"","sources":["../../src/npm/resolve-one-facet.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AA4B/E;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAClC;+EAC2E;IAC3E,UAAU,EAAE,OAAO,CAAC;IACpB,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,GAAG,EAAE,eAAe,GAAG,IAAI,CAAC;IAC5B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C;;;;OAIG;IACH,WAAW,EAAE,GAAG,EAAE,CAAC;IACnB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sDAAsD;IACtD,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B;;;OAGG;IACH,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IAClE;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,EAAE,KAAK,CACnB;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAChF;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,WAAW,CAAA;KAAE,CACrE,CAAC;IACF;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,EACF;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACrE;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;EAsB/D;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,0BAA0B,GACrC,MAAM,cAAc,EACpB,KAAK;IACH,UAAU,EAAE;QACV;;;;WAIG;QACH,YAAY,EAAE,CACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,KAC9D,OAAO,CAAC;YACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YACpB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;YAC/B,MAAM,EAAE,KAAK,CACT;gBAAE,IAAI,EAAE,KAAK,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,CAAA;aAAE,GAC/D;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAA;aAAE,CACpD,CAAC;YACF,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC,CAAC;KACJ,CAAC;CACH,KACA,OAAO,CAAC,gBAAgB,CAiX1B,CAAC"}

package/dist/npm/resolve-one-facet.js

@@ -175,9 +175,19 @@ export const resolveOnePackumentInFacet = async function resolveOnePackumentInFa
         });
     };
     // 1. Registry policy.
+    //
+    // A swap is an npm alias the policy declares for the package: the
+    // packument comes from the swap target, the package installs under the
+    // requested name (`request.installName`) — exactly the shape an explicit
+    // `name@npm:target@range` spec already has. Policy applies to the
+    // REGISTRY identity, placement to the declared name: a top-level swap the
+    // supervisor already rewrote (applySwaps, which also announced it)
+    // arrives naming the WASM target and is not swapped again, while a user's
+    // explicit alias to the native package (`build@npm:esbuild`) still needs
+    // its target swapped — and keeps its own install name.
     let effName = request.registryName;
     // @ts-ignore — preamble.
-    const __swap = SHOULD_SWAP(spec.name);
+    const __swap = SHOULD_SWAP(request.registryName);
     if (__swap) {
         messages.push(`[npm] \x1b[33m[swap]\x1b[0m ${__swap.from} → ${__swap.to}`);
         events.push({ type: 'swap', from: __swap.from, to: __swap.to, ctx: 'transitive' });
@@ -185,9 +195,10 @@ export const resolveOnePackumentInFacet = async function resolveOnePackumentInFa
     }
     else {
         // @ts-ignore — preamble.
-        const __fail = SHOULD_REJECT_FAIL(spec.name);
+        const __fail = SHOULD_REJECT_FAIL(request.registryName);
         // A listed package resolves and installs — npm parity; the
-        // advisory names the reason it cannot run here.
+        // advisory names the reason it cannot run here. An alias of a listed
+        // package (`img@npm:sharp`) is that package.
         if (__fail)
             emitAdvisory(__fail);
     }
@@ -282,6 +293,7 @@ export const resolveOnePackumentInFacet = async function resolveOnePackumentInFa
         const result = await __nimbusUseRpcResult(env.SUPERVISOR.getPackument(effName, {
             retries: Math.max(0, spec.retries ?? 3),
             timeoutMs: spec.fetchTimeoutMs ?? 15_000,
+            registry: spec.registry,
         }), (r) => ({ json: r.json, source: r.source, events: r.events, status: r.status, failure: r.failure }));
         packumentElapsedMs = Date.now() - packumentStart;
         // Splice the supervisor's per-tier events into our accumulator.

package/dist/npm/resolver.d.ts

@@ -4,7 +4,6 @@
  * Registry resolution runs in fanout facets; this module contains only the
  * supervisor-side contracts and computations consumed after resolution.
  */
-import type { RegistryCacheEntry } from './cache.js';
 /**
  * Injectable fetch function used by the installer's facet-backed registry
  * transport.
@@ -32,18 +31,17 @@ export interface ResolvedPackage {
 export interface HoistPlan {
     /** Root-level hoisted packages: name → ResolvedPackage. */
     root: Map<string, ResolvedPackage>;
-    /**
-     * Packages that could not be hoisted due to version conflicts.
-     * Key: "parentName/childName", value: ResolvedPackage.
-     */
+    /** Packages nested under a dependent root does not satisfy, by placement path (placement.ts). */
     nested: Map<string, ResolvedPackage>;
 }
-/**
- * Serialize a resolved package into the registry-cache row shape. Facet task
- * bodies keep inline literals of this shape because `fn.toString()` isolates
- * cannot import supervisor modules.
- */
-export declare function registryEntryFromResolved(pkg: ResolvedPackage): RegistryCacheEntry;
-/** Compute the flat hoist plan used by the current one-version-per-name resolver. */
-export declare function computeHoistPlan(resolved: Map<string, ResolvedPackage>): HoistPlan;
+/** One package at one placement: the unit diff, fetch and lockfile work in. */
+export interface PackagePlacement {
+    /** Placement path relative to the project's `node_modules`. */
+    placement: string;
+    pkg: ResolvedPackage;
+}
+/** The walk's placement decisions carried forward: first version per name at root, the rest nested. */
+export declare function computeHoistPlan(resolved: Map<string, ResolvedPackage>, nested?: Map<string, ResolvedPackage>): HoistPlan;
+/** Every placement in the plan, root first. */
+export declare function hoistPlacements(plan: HoistPlan): PackagePlacement[];
 //# sourceMappingURL=resolver.d.ts.map