@nimbus-sh/worker 0.9.0 → 0.11.0

package/dist/runtime/cpython-resident.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cpython-resident.d.ts","sourceRoot":"","sources":["../../src/runtime/cpython-resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAwDxE;AAeD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,GAAG,oBAAoB,CAgDjF"}
+{"version":3,"file":"cpython-resident.d.ts","sourceRoot":"","sources":["../../src/runtime/cpython-resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgDxE;AAeD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,GAAG,oBAAoB,CAgDjF"}

package/dist/runtime/cpython-resident.js

@@ -38,14 +38,6 @@ export function buildCPythonSocketProcessWorker(preamble) {
         '  if (supervisor) globalThis.__nimbusPySupervisor = supervisor;',
         '  __wasiAdoptSupervisor(supervisor);',
         '}',
-        // A resident process answers between requests, and that is the only moment
-        // "durable while running" can be made true: by the time the caller holds a
-        // response, everything the request wrote has reached the VFS.
-        'async function __nimbusParkPy(value) {',
-        '  await __wasiDrainPersist();',
-        '  await __wasiRevalidateFS();',
-        '  return value;',
-        '}',
         'async function __nimbusStartPyProcess(args) {',
         '  const result = await globalThis.__cpythonStartProcess(args || {});',
         '  const ports = await globalThis.__cpythonListeningPorts();',
@@ -59,7 +51,7 @@ export function buildCPythonSocketProcessWorker(preamble) {
         'export class NimbusProcess extends DurableObject {',
         '  async startProcess(args) {',
         '    __nimbusAdoptPySupervisor(this.env);',
-        '    return __nimbusParkPy(await __nimbusStartPyProcess(args || {}));',
+        '    return __nimbusStartPyProcess(args || {});',
         '  }',
         '  async fetch(request) {',
         '    __nimbusAdoptPySupervisor(this.env);',
@@ -70,7 +62,7 @@ export function buildCPythonSocketProcessWorker(preamble) {
         '    const hinted = Number(request.headers.get("X-Nimbus-Port") || 0);',
         '    const port = hinted || Array.from(globalThis.__nimbusVirtualSockets.listeners.keys())[0];',
         '    if (!port) return new Response("Nimbus Python process has no listening virtual socket", { status: 502 });',
-        '    return __nimbusParkPy(await globalThis.__nimbusVirtualSockets.handleHttpRequest(port, request));',
+        '    return globalThis.__nimbusVirtualSockets.handleHttpRequest(port, request);',
         '  }',
         '}',
     ].join('\n');

package/dist/runtime/esbuild-wasm-bytes.d.ts

@@ -1,14 +1,16 @@
 /**
- * esbuild-wasm-bytes.ts — supervisor-side fetcher for the esbuild-wasm
- * binary. The bytes live in the static-assets layer (env.ASSETS); this
- * module hands them to the caller as an ArrayBuffer when needed.
+ * esbuild-wasm-bytes.ts — supervisor-side fetcher for the artifacts the
+ * esbuild facet is built from: the wasm binary, the JS adapter that drives
+ * it, and the runner of the `esbuild` command. All three live in the
+ * static-assets layer (env.ASSETS); this module hands them to the caller when
+ * needed.
  *
  * Cache strategy
  * ──────────────
  * - NO module-scope cache (would pin 16 MiB in supervisor heap; the
  *   reason this module exists, see Phase 2 A'.5 below).
  * - L2 colo cache via `caches.default` (cache-and-scrub W-D): the bytes
- *   are version-pinned by URL (`/_assets/esbuild-<ESBUILD_VERSION>.wasm`),
+ *   are version-pinned by URL (`/_assets/esbuild-<ESBUILD_VERSION>.*`),
  *   so an `immutable` cache entry is correct. The Cache API holds its
  *   OWN reference outside the supervisor heap, so this does not
  *   re-introduce the residency that A'.5 removed.
@@ -28,6 +30,14 @@
  * are stored OUTSIDE the supervisor heap (workerd manages them), so
  * adding L2 wrap doesn't undo this.
  *
+ * The JS adapter followed the wasm for the same reason at a smaller
+ * scale: the supervisor already imports esbuild-wasm's browser build as a
+ * module for its own transforms, so carrying the same 117 KiB again as a
+ * string literal for facets doubled it in the Worker bundle. The CLI runner
+ * (32 KiB of Go glue and fs shim) only ever runs in the facet, so it is
+ * staged too; its name carries a prefix of its digest, because unlike the
+ * other two it changes without an esbuild upgrade.
+ *
  * Each call to `fetchEsbuildWasmBytes(env)` now does:
  *   - one `caches.default.match()` — sub-millisecond on hit
  *   - on miss: one env.ASSETS.fetch() + one cache write-back
@@ -39,16 +49,9 @@
  * Cache lookup failure (any throw) → fall through to ASSETS.
  * ASSETS fetch returning non-200 → throw (deploy bug, surface loudly).
  * Digest mismatch on either tier → throw (the bytes are compiled as a wasm
- * module, so they are verified against ESBUILD_WASM_SHA256 before returning).
- */
-/**
- * Path inside env.ASSETS where the esbuild-wasm binary lives.
- * Versioned so a future esbuild-wasm bump produces a different asset
- * name and forces a fresh fetch (no stale-cache risk). The matching
- * file is staged at public/_assets/esbuild-<version>.wasm by
- * scripts/bundle-esbuild-wasm.mjs at predeploy time.
+ * module or evaluated as facet code, so they are verified against the
+ * digest the generator recorded before returning).
  */
-export declare const ESBUILD_WASM_ASSET_PATH = "/_assets/esbuild-0.24.2.wasm";
 /**
  * The minimal env shape this module needs. Defined narrowly so the
  * caller can pass any env with an ASSETS Fetcher binding without
@@ -60,16 +63,20 @@ export interface EsbuildWasmFetchEnv {
     };
 }
 /**
- * Synthetic L2 cache key for the esbuild-wasm asset. Versioned via
- * ESBUILD_WASM_ASSET_PATH so each esbuild upgrade lands a fresh entry
- * and old entries naturally evict on TTL.
+ * Synthetic L2 cache keys for the esbuild-wasm assets, staged at
+ * public/_assets/esbuild-<version>.{wasm,js} by scripts/bundle-esbuild-wasm.mjs
+ * at predeploy time. Versioned via the asset paths so each esbuild upgrade
+ * lands fresh entries and old ones naturally evict on TTL.
  *
  * Exported so the test endpoint at /api/_test/cache/wasm/reset can
- * purge the entry between probe runs (otherwise wrangler dev's
+ * purge the entries between probe runs (otherwise wrangler dev's
  * persistent caches.default.state preserves the L2 hit across sessions
  * and the cold path is unobservable).
  */
-export declare const ESBUILD_WASM_L2_KEY = "https://nimbus-cache.invalid/_assets/esbuild-0.24.2.wasm";
+export declare const ESBUILD_WASM_L2_KEY: string;
+export declare const ESBUILD_JS_L2_KEY: string;
+/** The CLI runner's key names its build id, so each rebuild lands a fresh entry. */
+export declare const ESBUILD_CLI_L2_KEY: string;
 /**
  * Fetch the esbuild-wasm bytes from the static-assets layer.
  *
@@ -84,4 +91,16 @@ export declare const ESBUILD_WASM_L2_KEY = "https://nimbus-cache.invalid/_assets
  * always the correct source of truth.
  */
 export declare function fetchEsbuildWasmBytes(env: EsbuildWasmFetchEnv): Promise<ArrayBuffer>;
+/**
+ * Fetch the esbuild-wasm JS adapter: the function body that, wrapped in
+ * `new Function(...)()`, returns the esbuild namespace. Facet sources
+ * splice it in verbatim, so it is verified like the wasm it drives.
+ */
+export declare function fetchEsbuildJsFnBody(env: EsbuildWasmFetchEnv): Promise<string>;
+/**
+ * Fetch the `esbuild` command's runner: Go's wasm_exec.js and the typed fs
+ * shim, a script that installs `globalThis.__esbuildCliRun` when the esbuild
+ * facet evaluates it. Verified like the adapter it sits beside.
+ */
+export declare function fetchEsbuildCliRunner(env: EsbuildWasmFetchEnv): Promise<string>;
 //# sourceMappingURL=esbuild-wasm-bytes.d.ts.map

package/dist/runtime/esbuild-wasm-bytes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-wasm-bytes.d.ts","sourceRoot":"","sources":["../../src/runtime/esbuild-wasm-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAOH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,iCAA6C,CAAC;AAElF;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,6DAAyE,CAAC;AAE1G;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CA2E1F"}
+{"version":3,"file":"esbuild-wasm-bytes.d.ts","sourceRoot":"","sources":["../../src/runtime/esbuild-wasm-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAWH;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAA2D,CAAC;AAC5F,eAAO,MAAM,iBAAiB,QAAyD,CAAC;AACxF,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,QAA0D,CAAC;AAmC1F;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/E"}

package/dist/runtime/esbuild-wasm-bytes.js

@@ -1,14 +1,16 @@
 /**
- * esbuild-wasm-bytes.ts — supervisor-side fetcher for the esbuild-wasm
- * binary. The bytes live in the static-assets layer (env.ASSETS); this
- * module hands them to the caller as an ArrayBuffer when needed.
+ * esbuild-wasm-bytes.ts — supervisor-side fetcher for the artifacts the
+ * esbuild facet is built from: the wasm binary, the JS adapter that drives
+ * it, and the runner of the `esbuild` command. All three live in the
+ * static-assets layer (env.ASSETS); this module hands them to the caller when
+ * needed.
  *
  * Cache strategy
  * ──────────────
  * - NO module-scope cache (would pin 16 MiB in supervisor heap; the
  *   reason this module exists, see Phase 2 A'.5 below).
  * - L2 colo cache via `caches.default` (cache-and-scrub W-D): the bytes
- *   are version-pinned by URL (`/_assets/esbuild-<ESBUILD_VERSION>.wasm`),
+ *   are version-pinned by URL (`/_assets/esbuild-<ESBUILD_VERSION>.*`),
  *   so an `immutable` cache entry is correct. The Cache API holds its
  *   OWN reference outside the supervisor heap, so this does not
  *   re-introduce the residency that A'.5 removed.
@@ -28,6 +30,14 @@
  * are stored OUTSIDE the supervisor heap (workerd manages them), so
  * adding L2 wrap doesn't undo this.
  *
+ * The JS adapter followed the wasm for the same reason at a smaller
+ * scale: the supervisor already imports esbuild-wasm's browser build as a
+ * module for its own transforms, so carrying the same 117 KiB again as a
+ * string literal for facets doubled it in the Worker bundle. The CLI runner
+ * (32 KiB of Go glue and fs shim) only ever runs in the facet, so it is
+ * staged too; its name carries a prefix of its digest, because unlike the
+ * other two it changes without an esbuild upgrade.
+ *
  * Each call to `fetchEsbuildWasmBytes(env)` now does:
  *   - one `caches.default.match()` — sub-millisecond on hit
  *   - on miss: one env.ASSETS.fetch() + one cache write-back
@@ -39,31 +49,47 @@
  * Cache lookup failure (any throw) → fall through to ASSETS.
  * ASSETS fetch returning non-200 → throw (deploy bug, surface loudly).
  * Digest mismatch on either tier → throw (the bytes are compiled as a wasm
- * module, so they are verified against ESBUILD_WASM_SHA256 before returning).
- */
-import { ESBUILD_VERSION } from '@nimbus-sh/core/constants.js';
-import { ESBUILD_WASM_SHA256 } from '../esbuild-wasm-bundle.generated.js';
-import { disposeRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
-import { sha256Hex } from '@nimbus-sh/core/_shared/crypto.js';
-/**
- * Path inside env.ASSETS where the esbuild-wasm binary lives.
- * Versioned so a future esbuild-wasm bump produces a different asset
- * name and forces a fresh fetch (no stale-cache risk). The matching
- * file is staged at public/_assets/esbuild-<version>.wasm by
- * scripts/bundle-esbuild-wasm.mjs at predeploy time.
+ * module or evaluated as facet code, so they are verified against the
+ * digest the generator recorded before returning).
  */
-export const ESBUILD_WASM_ASSET_PATH = `/_assets/esbuild-${ESBUILD_VERSION}.wasm`;
+import { ESBUILD_JS_ASSET_PATH, ESBUILD_JS_SHA256, ESBUILD_WASM_ASSET_PATH, ESBUILD_WASM_SHA256, } from '../esbuild-wasm-bundle.generated.js';
+import { ESBUILD_CLI_ASSET_PATH, ESBUILD_CLI_SHA256 } from '../esbuild-cli-artifact.generated.js';
+import { fetchStagedBytes, fetchStagedText } from './staged-source.js';
 /**
- * Synthetic L2 cache key for the esbuild-wasm asset. Versioned via
- * ESBUILD_WASM_ASSET_PATH so each esbuild upgrade lands a fresh entry
- * and old entries naturally evict on TTL.
+ * Synthetic L2 cache keys for the esbuild-wasm assets, staged at
+ * public/_assets/esbuild-<version>.{wasm,js} by scripts/bundle-esbuild-wasm.mjs
+ * at predeploy time. Versioned via the asset paths so each esbuild upgrade
+ * lands fresh entries and old ones naturally evict on TTL.
  *
  * Exported so the test endpoint at /api/_test/cache/wasm/reset can
- * purge the entry between probe runs (otherwise wrangler dev's
+ * purge the entries between probe runs (otherwise wrangler dev's
  * persistent caches.default.state preserves the L2 hit across sessions
  * and the cold path is unobservable).
  */
-export const ESBUILD_WASM_L2_KEY = `https://nimbus-cache.invalid/_assets/esbuild-${ESBUILD_VERSION}.wasm`;
+export const ESBUILD_WASM_L2_KEY = `https://nimbus-cache.invalid${ESBUILD_WASM_ASSET_PATH}`;
+export const ESBUILD_JS_L2_KEY = `https://nimbus-cache.invalid${ESBUILD_JS_ASSET_PATH}`;
+/** The CLI runner's key names its build id, so each rebuild lands a fresh entry. */
+export const ESBUILD_CLI_L2_KEY = `https://nimbus-cache.invalid${ESBUILD_CLI_ASSET_PATH}`;
+/** One esbuild artifact, verified against its pin (runtime/staged-source.ts). */
+function esbuildAsset(label, path, l2Key, sha256, contentType, stagedBy) {
+    return {
+        path,
+        l2Key,
+        sha256,
+        contentType,
+        poisonedCache: 'reject',
+        missingBinding: `Nimbus: the esbuild facet requires an env.ASSETS binding (serves ${path})`,
+        fetchFailed: (res) => `${label} asset fetch failed: ${res.status} ${res.statusText} ` +
+            `for ${path} — deploy is missing the asset`,
+        integrityFailed: (digest, from) => `${label} integrity check failed: expected ${sha256}, got ` +
+            `${digest} (${from}) for ${path} — ` +
+            'the staged asset is corrupt or out of sync; rerun ' +
+            `${stagedBy} and redeploy`,
+    };
+}
+const ESBUILD_WASM_ASSET = esbuildAsset('esbuild-wasm', ESBUILD_WASM_ASSET_PATH, ESBUILD_WASM_L2_KEY, ESBUILD_WASM_SHA256, 'application/wasm', 'scripts/bundle-esbuild-wasm.mjs');
+const ESBUILD_JS_ASSET = esbuildAsset('esbuild-wasm JS adapter', ESBUILD_JS_ASSET_PATH, ESBUILD_JS_L2_KEY, ESBUILD_JS_SHA256, 'text/javascript; charset=utf-8', 'scripts/bundle-esbuild-wasm.mjs');
+const ESBUILD_CLI_ASSET = esbuildAsset('esbuild CLI runner', ESBUILD_CLI_ASSET_PATH, ESBUILD_CLI_L2_KEY, ESBUILD_CLI_SHA256, 'text/javascript; charset=utf-8', 'scripts/bundle-facet-workers.mjs');
 /**
  * Fetch the esbuild-wasm bytes from the static-assets layer.
  *
@@ -77,74 +103,22 @@ export const ESBUILD_WASM_L2_KEY = `https://nimbus-cache.invalid/_assets/esbuild
  * to env.ASSETS and write-back. Cache failures are silent — ASSETS is
  * always the correct source of truth.
  */
-export async function fetchEsbuildWasmBytes(env) {
-    const caches = globalThis.caches;
-    // ── L2 fast path ────────────────────────────────────────────────
-    let ab = null;
-    try {
-        if (caches?.default) {
-            const hit = await caches.default.match(new Request(ESBUILD_WASM_L2_KEY));
-            if (hit && hit.ok)
-                ab = await hit.arrayBuffer();
-        }
-    }
-    catch { /* fall through to ASSETS */ }
-    const fromCache = ab !== null;
-    if (!ab) {
-        // ── L4 path (env.ASSETS) ──────────────────────────────────────
-        // Construct a synthetic request — env.ASSETS routes by pathname only;
-        // the host is ignored. Using `.invalid` per RFC-2606 makes it
-        // unambiguous that this URL is internal-binding-only.
-        const url = `https://nimbus-internal.invalid${ESBUILD_WASM_ASSET_PATH}`;
-        const res = await env.ASSETS.fetch(new Request(url));
-        try {
-            if (!res.ok) {
-                throw new Error(`esbuild-wasm asset fetch failed: ${res.status} ${res.statusText} ` +
-                    `for ${ESBUILD_WASM_ASSET_PATH} — deploy is missing the wasm asset`);
-            }
-            // Read the bytes once (Response body is a one-shot stream). The
-            // caller needs the ArrayBuffer to hand to workerd's LOADER; we
-            // also use it to write through to L2.
-            ab = await res.arrayBuffer();
-        }
-        finally {
-            disposeRpcResource(res);
-        }
-    }
-    const digest = await sha256Hex(ab);
-    if (digest !== ESBUILD_WASM_SHA256) {
-        throw new Error(`esbuild-wasm integrity check failed: expected ${ESBUILD_WASM_SHA256}, got ` +
-            `${digest} (${fromCache ? 'L2 cache' : 'ASSETS'}) for ${ESBUILD_WASM_ASSET_PATH} — ` +
-            'the staged asset is corrupt or out of sync; rerun ' +
-            'scripts/bundle-esbuild-wasm.mjs and redeploy');
-    }
-    if (!fromCache) {
-        // ── L2 write-back ────────────────────────────────────────────
-        // Eternal immutable TTL: the URL is version-pinned so a new
-        // ESBUILD_VERSION lands a fresh cache entry; the old one naturally
-        // evicts on TTL. The cache layer holds its own copy (workerd
-        // structured-clones the body during put), so the supervisor's
-        // reference to `ab` is unaffected.
-        // Best-effort: a write failure does NOT block the caller.
-        try {
-            if (caches?.default) {
-                // We pass a fresh Uint8Array view over the same buffer; the
-                // cache stores a copy at put time. Returning `ab` to the
-                // caller stays valid because Response constructor doesn't
-                // detach the buffer (only ReadableStream consumption would).
-                const writeBack = new Response(new Uint8Array(ab), {
-                    headers: {
-                        'Content-Type': 'application/wasm',
-                        'Cache-Control': 'public, max-age=31536000, immutable',
-                    },
-                });
-                // Awaited so subsequent reads strictly hit L2 (no
-                // double-fetch race). The wasm payload is 12 MiB; workerd
-                // structured-clones it into the cache, ~1-5 ms locally.
-                await caches.default.put(new Request(ESBUILD_WASM_L2_KEY), writeBack);
-            }
-        }
-        catch { /* silent */ }
-    }
-    return ab;
+export function fetchEsbuildWasmBytes(env) {
+    return fetchStagedBytes(env, ESBUILD_WASM_ASSET);
+}
+/**
+ * Fetch the esbuild-wasm JS adapter: the function body that, wrapped in
+ * `new Function(...)()`, returns the esbuild namespace. Facet sources
+ * splice it in verbatim, so it is verified like the wasm it drives.
+ */
+export function fetchEsbuildJsFnBody(env) {
+    return fetchStagedText(env, ESBUILD_JS_ASSET);
+}
+/**
+ * Fetch the `esbuild` command's runner: Go's wasm_exec.js and the typed fs
+ * shim, a script that installs `globalThis.__esbuildCliRun` when the esbuild
+ * facet evaluates it. Verified like the adapter it sits beside.
+ */
+export function fetchEsbuildCliRunner(env) {
+    return fetchStagedText(env, ESBUILD_CLI_ASSET);
 }

package/dist/runtime/facet-loader-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"facet-loader-host.d.ts","sourceRoot":"","sources":["../../src/runtime/facet-loader-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAS,SAAS,EAAa,MAAM,uCAAuC,CAAC;AAEzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,GAAG,SAAS,CAuBhF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,YAAY,GACrB;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,CAM3C;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,GAAG,SAAS,CAGrE"}
+{"version":3,"file":"facet-loader-host.d.ts","sourceRoot":"","sources":["../../src/runtime/facet-loader-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAS,SAAS,EAAa,MAAM,uCAAuC,CAAC;AACzF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGzD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,kBAAkB,GAAG,SAAS,CAiBhF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,YAAY,GACrB;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,CAM3C;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,YAAY,GAAG,SAAS,CAGrE"}

package/dist/runtime/facet-loader-host.js

@@ -1,16 +1,9 @@
-import { manifestVfs } from '@nimbus-sh/core/runtime/vfs-manifest.js';
 import { IsolatePool } from '@nimbus-sh/fabric/isolate-pool.js';
 export function loaderFacetHost(env, ctx) {
     return {
         // workerd suspends a guest through JSPI, which is what lets a syscall reach
         // back to the session mid-instruction.
         parking: 'jspi',
-        /**
-         * A manifest, not a copy: sizes and modes, with the facet demand-loading
-         * whatever the program opens through its supervisor. It has to be — the
-         * whole seed crosses one RPC, and a session filesystem does not fit in one.
-         */
-        seedFilesystem(vfs, root, options) { return manifestVfs(vfs, options.cred, root, options); },
         open(spec) {
             return new IsolatePool(env, ctx, {
                 tag: spec.tag,

package/dist/runtime/git-bundle-artifact.d.ts

@@ -0,0 +1,17 @@
+/**
+ * git-bundle-artifact.ts — supervisor-side fetcher for the staged git module
+ * the git network facet imports as `git-bundle.js`.
+ *
+ * scripts/bundle-git.mjs builds one module: vendor/git.generated.mjs, which the
+ * supervisor imports, and a byte-identical copy staged under
+ * public/_assets/runtime/ for the facet, which only receives modules as source
+ * text. Staging keeps that text out of the Worker bundle's size gate.
+ */
+import { type StagedSourceEnv } from './staged-source.js';
+/**
+ * The git module's source text for the network facet's `modules` record.
+ * Memoized per isolate; a failed fetch clears the memo so the next git
+ * operation retries instead of pinning the error.
+ */
+export declare const fetchGitBundleSource: (env: StagedSourceEnv) => Promise<string>;
+//# sourceMappingURL=git-bundle-artifact.d.ts.map

package/dist/runtime/git-bundle-artifact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-bundle-artifact.d.ts","sourceRoot":"","sources":["../../src/runtime/git-bundle-artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAW5B;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CACO,CAAC"}

package/dist/runtime/git-bundle-artifact.js

@@ -0,0 +1,25 @@
+/**
+ * git-bundle-artifact.ts — supervisor-side fetcher for the staged git module
+ * the git network facet imports as `git-bundle.js`.
+ *
+ * scripts/bundle-git.mjs builds one module: vendor/git.generated.mjs, which the
+ * supervisor imports, and a byte-identical copy staged under
+ * public/_assets/runtime/ for the facet, which only receives modules as source
+ * text. Staging keeps that text out of the Worker bundle's size gate.
+ */
+import { GIT_BUNDLE_BUILD_ID, GIT_BUNDLE_ENTRY, GIT_BUNDLE_SHA256 } from '../git-bundle.generated.js';
+import { fetchStagedText, memoizeUntilRejected, stagedRuntimeSource, } from './staged-source.js';
+const GIT_BUNDLE = stagedRuntimeSource({
+    label: 'git-bundle',
+    entry: GIT_BUNDLE_ENTRY,
+    buildId: GIT_BUNDLE_BUILD_ID,
+    sha256: GIT_BUNDLE_SHA256,
+    stagedBy: 'scripts/bundle-git.mjs',
+    requiredBy: 'the git network facet',
+});
+/**
+ * The git module's source text for the network facet's `modules` record.
+ * Memoized per isolate; a failed fetch clears the memo so the next git
+ * operation retries instead of pinning the error.
+ */
+export const fetchGitBundleSource = memoizeUntilRejected((env) => fetchStagedText(env, GIT_BUNDLE));

package/dist/runtime/node-repl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-repl.d.ts","sourceRoot":"","sources":["../../src/runtime/node-repl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAKlE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AA2RD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrE"}
+{"version":3,"file":"node-repl.d.ts","sourceRoot":"","sources":["../../src/runtime/node-repl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAKlE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAuQD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAIrE"}

package/dist/runtime/node-repl.js

@@ -21,7 +21,7 @@
  *   - Tab-completion
  *   - History pickling
  */
-import { ReplSession } from './repl-session.js';
+import { ReplSession, replPushResult } from './repl-session.js';
 import { NODE_VERSION } from '@nimbus-sh/core/constants.js';
 class NodeReplAdapter {
     pool = null;
@@ -84,18 +84,7 @@ class NodeReplAdapter {
         catch (e) {
             return { kind: 'error', stderr: `[node-repl] push dispatch failed: ${e?.message || e}\n` };
         }
-        if (result.exit) {
-            return {
-                kind: 'exit',
-                exitCode: result.exitCode || 0,
-                stdout: result.stdout,
-                stderr: result.stderr,
-            };
-        }
-        if (result.incomplete) {
-            return { kind: 'incomplete' };
-        }
-        return { kind: 'output', stdout: result.stdout || '', stderr: result.stderr || '' };
+        return replPushResult(result);
     }
     async close() {
         if (this.pool) {

package/dist/runtime/node-shims-artifact.d.ts

@@ -1,30 +1,29 @@
 /**
- * node-shims-artifact.ts — supervisor-side fetcher for the staged node-compat
- * shim source.
+ * node-shims-artifact.ts — supervisor-side fetcher for the staged sources of
+ * the node-compat layer: the shims, the VFS write ledger and the resident store.
  *
- * The ~230 KiB generateShimsCode() output is staged as a static asset by
- * scripts/bundle-node-shims.mjs (promoted out of the worker bundle for the
- * ≤6 MiB bundle gate). Every node facet's generated worker text interpolates
- * it, so this fetch sits on the exec hot path: the result is memoized at
- * module scope (one fetch per isolate), fronted by L2 (caches.default) keyed
- * on the content-hash build id, with ASSETS as the source of truth and a
- * sha-256 integrity check so a stale or partial asset can never reach a facet.
- *
- * Mirrors opencode-artifact.ts / sqlite-wasm-bytes.ts. ASSETS is already a
- * mandatory embed binding (it serves the shell, sqlite wasm, opencode
- * artifacts); a missing binding fails loud here rather than producing a
- * facet with no node-compat layer.
+ * All three are staged as static assets by scripts/bundle-node-shims.mjs and
+ * promoted out of the worker bundle for its size gate: only a node facet ever
+ * runs them, and every node facet's generated worker text splices them. This
+ * fetch therefore sits on the exec hot path: the result is memoized at module
+ * scope (one fetch per isolate); each source is read and verified by
+ * runtime/staged-source.ts. A missing ASSETS binding fails loud rather than
+ * producing a facet with no node-compat layer.
  */
-/** Minimal env shape — any env with an ASSETS Fetcher binding. */
-export interface NodeShimsAssetEnv {
-    ASSETS?: {
-        fetch(req: Request): Promise<Response>;
-    };
+import { type StagedSourceEnv } from './staged-source.js';
+/** What a node facet's generated worker text splices around the program. */
+export interface NodeFacetSources {
+    /** The node-compat shims: node-shims.ts generateShimsCode(). */
+    shims: string;
+    /** The write ledger the shims' filesystem writes go through: core VFS_WRITE_LEDGER_SOURCE. */
+    ledger: string;
+    /** A resident facet's SQLite-backed resident set: vfs/facet-resident-store.ts FACET_RESIDENT_STORE_SOURCE. */
+    residentStore: string;
 }
 /**
- * The node-compat shim source for facet worker codegen. Memoized per isolate;
- * a failed fetch clears the memo so the next exec retries instead of pinning
- * the error.
+ * The node-compat layer's sources for facet worker codegen. Memoized per
+ * isolate; a failed fetch clears the memo so the next exec retries instead of
+ * pinning the error.
  */
-export declare function fetchNodeShimsCode(env: NodeShimsAssetEnv): Promise<string>;
+export declare const fetchNodeFacetSources: (env: StagedSourceEnv) => Promise<NodeFacetSources>;
 //# sourceMappingURL=node-shims-artifact.d.ts.map

package/dist/runtime/node-shims-artifact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-shims-artifact.d.ts","sourceRoot":"","sources":["../../src/runtime/node-shims-artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,kEAAkE;AAClE,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACrD;AAgED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ1E"}
+{"version":3,"file":"node-shims-artifact.d.ts","sourceRoot":"","sources":["../../src/runtime/node-shims-artifact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,oBAAoB,CAAC;AAE5B,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,MAAM,EAAE,MAAM,CAAC;IACf,8GAA8G;IAC9G,aAAa,EAAE,MAAM,CAAC;CACvB;AA8BD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAQlF,CAAC"}