@nimbus-sh/worker 0.9.0 → 0.11.0

package/scripts/build-opencode-attach-entry.mjs

@@ -110,6 +110,56 @@ function stripEmbeddedModelsCatalog(pack) {
   return pack;
 }
 
+const unicodeEscape = (code) => '\\u' + code.toString(16).padStart(4, '0');
+
+/** One regex literal with every non-ASCII code unit written as `\uXXXX`; `\…` is an identity escape of `…`. */
+function escapeRegexLiteral(literal) {
+  let out = '';
+  for (let i = 0; i < literal.length; i++) {
+    const code = literal.charCodeAt(i);
+    if (code === 0x5c && i + 1 < literal.length) {
+      const next = literal.charCodeAt(i + 1);
+      out += next > 0x7f ? unicodeEscape(next) : literal.slice(i, i + 2);
+      i++;
+    } else {
+      out += code > 0x7f ? unicodeEscape(code) : literal[i];
+    }
+  }
+  return out;
+}
+
+/**
+ * Make the attach entry pure ASCII. esbuild's default ASCII charset escapes
+ * every literal except regular expressions, so opencode's typographic-quote
+ * regexes (`/[‘’‚‛]/g`, `/…/g`) survive, and one character above U+00FF makes
+ * V8 hold the whole 14 MB source as a two-byte string: 29 MB in the session
+ * that assembles the facet's module map and again in the facet that runs it.
+ * Fails loud if non-ASCII remains anywhere else.
+ */
+function asciiOnlyAttachEntry(src) {
+  const acorn = require('acorn');
+  const parts = [];
+  let last = 0;
+  for (const token of acorn.tokenizer(src, { ecmaVersion: 'latest', sourceType: 'module' })) {
+    if (token.type !== acorn.tokTypes.regexp) continue;
+    const literal = src.slice(token.start, token.end);
+    if (!/[^\x00-\x7f]/.test(literal)) continue;
+    parts.push(src.slice(last, token.start), escapeRegexLiteral(literal));
+    last = token.end;
+  }
+  parts.push(src.slice(last));
+  const out = parts.join('');
+  const residual = out.search(/[^\x00-\x7f]/);
+  if (residual >= 0) {
+    throw new Error(
+      '[build-opencode-attach-entry] non-ASCII outside a regex literal at offset ' +
+        `${residual} (${JSON.stringify(out.slice(Math.max(0, residual - 40), residual + 10))}) — ` +
+        'escape it here, or the attach source is held as a two-byte string',
+    );
+  }
+  return out;
+}
+
 /**
  * Build the attach entry text from in-memory sources.
  * @param entry index.js source text.
@@ -178,7 +228,7 @@ export async function buildOpencodeAttachEntryFromSources(entry, packInput) {
       },
     ],
   });
-  const out = result.outputFiles[0].text;
+  const out = asciiOnlyAttachEntry(result.outputFiles[0].text);
   const residual = [...out.matchAll(/import\(\s*["'](?:\.\/)?(chunk-[a-z0-9]+\.js)["']\s*\)/g)];
   if (residual.length > 0) {
     throw new Error(

package/scripts/bundle-esbuild-wasm.mjs

@@ -10,8 +10,10 @@
  * than the supervisor's. The facet needs two pieces of esbuild-wasm
  * at module-load time:
  *
- *   1. The JS adapter (`esbuild-wasm/esm/browser.js`) — small, stays
- *      in the worker bundle as a string constant.
+ *   1. The JS adapter (`esbuild-wasm/esm/browser.js`, ~117 KiB), rewritten
+ *      into a function body. The supervisor already imports the same
+ *      build as a module for its own transforms, so the adapter is staged
+ *      beside the wasm rather than embedded a second time as a string.
  *
  *   2. The wasm binary (`esbuild.wasm`) — 12 MiB. Lives in the
  *      static-assets layer (Workers ASSETS binding) at
@@ -48,11 +50,15 @@
  * Output:
  *   src/esbuild-wasm-bundle.generated.ts
  *     export const ESBUILD_WASM_VERSION: string;
+ *     export const ESBUILD_WASM_ASSET_PATH: string;  // /_assets/esbuild-<version>.wasm
+ *     export const ESBUILD_JS_ASSET_PATH: string;    // /_assets/esbuild-<version>.js
  *     export const ESBUILD_WASM_SHA256: string;      // staged wasm digest
- *     export const ESBUILD_WASM_JS_FN_BODY: string;  // ESM browser source
+ *     export const ESBUILD_JS_SHA256: string;        // staged adapter digest
  *
  *   public/_assets/esbuild-<version>.wasm
  *     The raw wasm, picked up by the wrangler ASSETS binding.
+ *   public/_assets/esbuild-<version>.js
+ *     The adapter as a function body, same binding.
  *
  * Run via:
  *   node scripts/bundle-esbuild-wasm.mjs
@@ -144,8 +150,8 @@ async function main() {
   // The ASSETS binding picks up everything under `assets.directory`
   // (./public per wrangler.jsonc). We version-name the file so a
   // future esbuild-wasm bump produces a different asset filename and
-  // forces a fresh fetch (no stale-cache risk; cf. ESBUILD_WASM_ASSET_PATH
-  // in src/esbuild-wasm-bytes.ts).
+  // forces a fresh fetch (no stale-cache risk; the generated module names
+  // the path and src/runtime/esbuild-wasm-bytes.ts reads it).
   await fs.mkdir(OUT_ASSETS_DIR, { recursive: true });
   const assetName = `esbuild-${version}.wasm`;
   const assetOut = path.join(OUT_ASSETS_DIR, assetName);
@@ -155,53 +161,48 @@ async function main() {
   console.log(
     `[bundle-esbuild-wasm] copied esbuild.wasm → ${path.relative(ROOT, assetOut)} (${(wasmBytes.length / (1024 * 1024)).toFixed(1)} MiB)`,
   );
+  // The JS adapter is staged the same way. Facets splice it into their
+  // source as a string; the supervisor imports esbuild-wasm as a module
+  // for its own transforms, so carrying the adapter inline as well
+  // shipped it twice in the Worker bundle.
+  const jsAssetName = `esbuild-${version}.js`;
+  const jsAssetOut = path.join(OUT_ASSETS_DIR, jsAssetName);
+  const jsBytes = Buffer.from(jsFn, 'utf8');
+  await fs.writeFile(jsAssetOut, jsBytes);
+  const jsSha256 = createHash('sha256').update(jsBytes).digest('hex');
+  console.log(
+    `[bundle-esbuild-wasm] wrote JS adapter → ${path.relative(ROOT, jsAssetOut)} (${(jsBytes.length / 1024).toFixed(1)} KiB)`,
+  );
 
   // ── 3. Clean up any stale-versioned wasm assets in public/_assets/ ──
   // Keeps the deploy lean: a developer who bumped the esbuild-wasm
   // version locally won't accidentally ship two copies.
   for (const entry of await fs.readdir(OUT_ASSETS_DIR)) {
-    if (entry.startsWith('esbuild-') && entry.endsWith('.wasm') && entry !== assetName) {
+    if (entry.startsWith('esbuild-') && (entry.endsWith('.wasm') || entry.endsWith('.js'))
+      && entry !== assetName && entry !== jsAssetName) {
       const stale = path.join(OUT_ASSETS_DIR, entry);
       await fs.unlink(stale);
       console.log(`[bundle-esbuild-wasm] removed stale asset: ${entry}`);
     }
   }
 
-  // ── 4. Emit the JS-only generated TS module ──────────────────────────
-  // No ESBUILD_WASM_BASE64 export. The base64 string was 16 MiB and
-  // sat in supervisor module scope for the isolate's lifetime; A'.5
-  // moved the bytes to env.ASSETS to drop that residency.
+  // ── 4. Emit the generated TS module: versions and digests only ──────
+  // Neither artifact is inline. The base64 wasm string was 16 MiB and
+  // sat in supervisor module scope for the isolate's lifetime (A'.5
+  // moved it to env.ASSETS); the JS adapter followed so the bundle
+  // carries esbuild-wasm once, as the module the supervisor imports.
   const header = `/**
  * esbuild-wasm-bundle.generated.ts — AUTO-GENERATED by scripts/bundle-esbuild-wasm.mjs
  * DO NOT EDIT.
  *
- * Bundled esbuild-wasm ${version} adapter for use inside NimbusIsolatePool
- * isolates. Only the JS adapter is bundled here (~117 KiB); the wasm
- * binary itself lives in the static-assets layer at
- * public/_assets/esbuild-${version}.wasm and is fetched on demand by
- * src/esbuild-wasm-bytes.ts.
+ * Digests of the staged esbuild-wasm ${version} artifacts. Both live in
+ * the static-assets layer, public/_assets/esbuild-${version}.{wasm,js},
+ * and are fetched on demand and verified by src/runtime/esbuild-wasm-bytes.ts.
  *
- * Phase 2 A'.5 moved the base64 wasm string OUT of the supervisor
- * bundle (was 16 MiB UTF-8 → 21 MiB UTF-16 in JS string overhead).
- * If you're reading this and wondering where the bytes are: env.ASSETS.
- */
-
-export const ESBUILD_WASM_VERSION: string = ${JSON.stringify(version)};
-
-/**
- * SHA-256 of the staged public/_assets/esbuild-${version}.wasm bytes.
- * src/runtime/esbuild-wasm-bytes.ts verifies every fetch against it — the L2
- * (caches.default) tier included — before the bytes reach workerd's loader.
- */
-export const ESBUILD_WASM_SHA256: string = ${JSON.stringify(wasmSha256)};
-
-/**
- * Function body that, when wrapped in \`new Function(...)()\`, returns
- * the esbuild-wasm namespace (build, transform, initialize, ...).
- *
- * Source: node_modules/esbuild-wasm/esm/browser.js with the trailing
- * \`export { ... }\` rewritten to \`return { ... };\`. Why the browser
- * build:
+ * The JS adapter is node_modules/esbuild-wasm/esm/browser.js with the
+ * trailing \`export { ... }\` rewritten to \`return { ... };\`, so that
+ * \`new Function(body)()\` yields the esbuild namespace inside a facet.
+ * Why the browser build:
  *   - Pure ESM with no \`createRequire\`, no \`require("fs")\`, and
  *     no \`process.binding\` — safe to evaluate inside a workerd
  *     dynamic-worker isolate.
@@ -219,13 +220,28 @@ export const ESBUILD_WASM_SHA256: string = ${JSON.stringify(wasmSha256)};
  * patterns (createRequire / dynamic node-builtin require / process.binding)
  * and bails loud if a future release reintroduces them.
  */
-export const ESBUILD_WASM_JS_FN_BODY: string = ${JSON.stringify(jsFn)};
+export const ESBUILD_WASM_VERSION: string = ${JSON.stringify(version)};
+/**
+ * Where the artifacts live inside env.ASSETS. Version-named, so a bump
+ * lands under a new name and never serves a stale cache entry. Naming them
+ * here is what puts them under scripts/dist-integrity.mjs's staged-asset
+ * check, which discovers asset paths by value in generated modules.
+ */
+export const ESBUILD_WASM_ASSET_PATH: string = ${JSON.stringify('/_assets/' + assetName)};
+export const ESBUILD_JS_ASSET_PATH: string = ${JSON.stringify('/_assets/' + jsAssetName)};
+/**
+ * SHA-256 of the staged public/_assets/esbuild-${version}.wasm bytes.
+ * src/runtime/esbuild-wasm-bytes.ts verifies every fetch against it — the L2
+ * (caches.default) tier included — before the bytes reach workerd's loader.
+ */
+export const ESBUILD_WASM_SHA256: string = ${JSON.stringify(wasmSha256)};
+/** SHA-256 of the staged public/_assets/esbuild-${version}.js adapter, checked the same way. */
+export const ESBUILD_JS_SHA256: string = ${JSON.stringify(jsSha256)};
 `;
-
   await fs.writeFile(OUT_TS, header, 'utf8');
   const stat = await fs.stat(OUT_TS);
   console.log(
-    `[bundle-esbuild-wasm] wrote ${path.relative(ROOT, OUT_TS)} (${(stat.size / 1024).toFixed(1)} KiB — JS adapter only)`,
+    `[bundle-esbuild-wasm] wrote ${path.relative(ROOT, OUT_TS)} (${(stat.size / 1024).toFixed(1)} KiB — digests only)`,
   );
 }
 

package/scripts/bundle-facet-workers.mjs

@@ -39,20 +39,69 @@
  *       WASI_INSTANCE_BODY_SRC: string
  *   @nimbus-sh/core src/runtime/bash-runner.generated.ts — exports
  *       BASH_RUNNER_BODY_SRC: string
+ *   public/_assets/runtime/esbuild-cli-<buildId>.js — the `esbuild` command's
+ *       runner, which only the session's esbuild facet evaluates. Staged as an
+ *       asset rather than a string in the Worker bundle, like the esbuild
+ *       adapter and the node shims; src/esbuild-cli-artifact.generated.ts
+ *       exports ESBUILD_CLI_ASSET_PATH, ESBUILD_CLI_BUILD_ID, ESBUILD_CLI_SHA256.
  *
  * Runs as a postinstall + predev + predeploy step via package.json.
  */
 
 import { build } from 'esbuild';
-import { writeFileSync, mkdirSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
+// core's own parser dependency, reached through the workspace hoist; the
+// script runs under plain node at postinstall, so nothing here is TypeScript.
+import { parse } from 'acorn';
+
+import { resolvePackageDir } from './resolve-package-dir.mjs';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const root = join(__dirname, '..');
 const coreRoot = join(root, '..', 'core');
 const platformRoot = join(root, '..', 'platform');
 
+/**
+ * The bundle without its comments. esbuild keeps every comment that sits
+ * inside an expression or object literal, plus its own `// path` module
+ * markers, and nothing reads any of them: the strings are evaluated, never
+ * shown, mapped or `toString()`ed. The comment ranges come from a real
+ * parse of the output, so a `//` inside a string, template or regex is
+ * untouched; only comments go, and a line that held nothing but a comment
+ * goes with it. Every other character, identifier and line stays put.
+ */
+function withoutComments(text) {
+  const comments = [];
+  parse(text, { ecmaVersion: 'latest', sourceType: 'module', allowAwaitOutsideFunction: true, onComment: comments });
+  let out = '';
+  let cursor = 0;
+  for (const { start, end } of comments) {
+    if (start < cursor) continue;
+    const lineStart = text.lastIndexOf('\n', start - 1) + 1;
+    const lineEndAt = text.indexOf('\n', end);
+    const lineEnd = lineEndAt < 0 ? text.length : lineEndAt;
+    const leading = text.slice(lineStart, start);
+    const trailing = text.slice(end, lineEnd);
+    if (leading.trim() === '' && trailing.trim() === '') {
+      // The comment is the whole line (or lines): drop them, newline included.
+      out += text.slice(cursor, lineStart);
+      cursor = lineEndAt < 0 ? text.length : lineEnd + 1;
+    } else if (trailing.trim() === '') {
+      // Trailing comment: drop it and the blank that led to it.
+      out += text.slice(cursor, start).replace(/[ \t]+$/, '');
+      cursor = end;
+    } else {
+      // Mid-line block comment: one space keeps the tokens on either side apart.
+      out += `${text.slice(cursor, start)} `;
+      cursor = end;
+    }
+  }
+  return out + text.slice(cursor);
+}
+
 /**
  * Bundle one TS source into a self-contained ESM string suitable for
  * inlining as a facet preamble. Strips the leading `export` on
@@ -76,7 +125,7 @@ async function bundleAsPreamble(entryPath, label) {
   if (!result.outputFiles || result.outputFiles.length === 0) {
     throw new Error(`[bundle-facet-workers/${label}] esbuild produced no output`);
   }
-  let stripped = result.outputFiles[0].text;
+  let stripped = withoutComments(result.outputFiles[0].text);
   stripped = stripped.replace(/^export\s+(async\s+function|function|const|class)\b/gm, '$1');
   stripped = stripped.replace(/\n?export\s*\{[^}]*\}\s*;\s*$/g, '');
   return stripped;
@@ -112,7 +161,7 @@ async function bundleVirtualSocketKernel() {
   if (!result.outputFiles || result.outputFiles.length === 0) {
     throw new Error('[bundle-facet-workers/virtual-socket-kernel] esbuild produced no output');
   }
-  return result.outputFiles[0].text;
+  return withoutComments(result.outputFiles[0].text);
 }
 
 /**
@@ -126,10 +175,7 @@ const WASI_REQUIRED_TOP_LEVEL = [
   '__wasiMakeImports',
   '__wasiRunStart',
   '__wasiRunStartAsync',
-  '__wasiReadFilesB64',
   '__wasiAdoptSupervisor',
-  '__wasiDrainPersist',
-  '__wasiRevalidateFS',
   'fdTable',
 ];
 
@@ -168,7 +214,7 @@ async function bundleWasiInstance() {
   if (!result.outputFiles || result.outputFiles.length === 0) {
     throw new Error('[bundle-facet-workers/wasi-instance] esbuild produced no output');
   }
-  let src = result.outputFiles[0].text;
+  let src = withoutComments(result.outputFiles[0].text);
   // The body is spliced into another module; a re-export block there is a
   // syntax error, and callers append their own `export { … }`.
   src = src.replace(/^export\s+(async\s+function|function|const|let|var|class)\b/gm, '$1');
@@ -233,7 +279,7 @@ async function bundleBashRunner() {
   if (!result.outputFiles || result.outputFiles.length === 0) {
     throw new Error('[bundle-facet-workers/bash-runner] esbuild produced no output');
   }
-  const src = result.outputFiles[0].text;
+  const src = withoutComments(result.outputFiles[0].text);
   for (const name of ['__bashBoot', '__bashFeed']) {
     if (!new RegExp(`^\\s*globalThis\\.${name}\\s*=`, 'm').test(src)) {
       throw new Error(
@@ -260,6 +306,87 @@ async function bundleBashRunner() {
   return src;
 }
 
+/**
+ * The `esbuild` command's runner: Go's own js/wasm glue from the installed
+ * esbuild-wasm (the package whose esbuild.wasm is staged to ASSETS, so the glue
+ * always matches the binary), wrapped so each run hands it its own global and
+ * `fs`, followed by the typed runner as an IIFE that installs
+ * globalThis.__esbuildCliRun. wasm_exec.js is spliced in verbatim, license
+ * header included.
+ */
+async function bundleEsbuildCli() {
+  const result = await build({
+    entryPoints: [join(coreRoot, 'src', 'runtime', 'esbuild-cli', 'preamble.ts')],
+    bundle: true,
+    format: 'iife',
+    target: 'esnext',
+    platform: 'neutral',
+    absWorkingDir: root,
+    write: false,
+    logLevel: 'warning',
+    legalComments: 'none',
+  });
+  if (!result.outputFiles || result.outputFiles.length === 0) {
+    throw new Error('[bundle-facet-workers/esbuild-cli] esbuild produced no output');
+  }
+  const runner = withoutComments(result.outputFiles[0].text);
+  if (!/^\s*globalThis\.__esbuildCliRun\s*=/m.test(runner)) {
+    throw new Error(
+      '[bundle-facet-workers/esbuild-cli] the bundle no longer assigns globalThis.__esbuildCliRun — ' +
+      'every esbuild command would fail inside the esbuild facet',
+    );
+  }
+  if (/^\s*(?:import|export)\b/m.test(runner)) {
+    throw new Error('[bundle-facet-workers/esbuild-cli] an import/export survived bundling');
+  }
+  const glue = readFileSync(join(resolvePackageDir('esbuild-wasm', { start: root }), 'wasm_exec.js'), 'utf8');
+  if (!/globalThis\.Go\s*=\s*class\b/.test(glue)) {
+    throw new Error('[bundle-facet-workers/esbuild-cli] esbuild-wasm/wasm_exec.js no longer defines globalThis.Go');
+  }
+  return `const __esbuildGoRuntime = function (globalThis, fs) {\n${glue}\nreturn globalThis.Go;\n};\n${runner}`;
+}
+
+/**
+ * Stage the esbuild CLI runner under public/_assets/runtime/, named by a
+ * prefix of its own digest so no cache layer can serve another build's bytes
+ * under its name, and pin it in src/esbuild-cli-artifact.generated.ts.
+ */
+function stageEsbuildCli(src) {
+  const sha256 = createHash('sha256').update(src, 'utf8').digest('hex');
+  const buildId = sha256.slice(0, 16);
+  const assetDir = join(root, 'public', '_assets', 'runtime');
+  const assetName = `esbuild-cli-${buildId}.js`;
+  mkdirSync(assetDir, { recursive: true });
+  for (const entry of readdirSync(assetDir)) {
+    if (entry.startsWith('esbuild-cli-') && entry !== assetName) unlinkSync(join(assetDir, entry));
+  }
+  writeFileSync(join(assetDir, assetName), src, 'utf8');
+  const assetPath = `/_assets/runtime/${assetName}`;
+  const generatedPath = join(root, 'src', 'esbuild-cli-artifact.generated.ts');
+  writeFileSync(generatedPath, [
+    '/**',
+    ' * esbuild-cli-artifact.generated.ts — AUTO-GENERATED by',
+    ' * scripts/bundle-facet-workers.mjs. DO NOT EDIT.',
+    ' *',
+    ' * Pins the staged runner of the `esbuild` command: esbuild-wasm/wasm_exec.js',
+    ' * (Go js/wasm glue, as __esbuildGoRuntime) followed by @nimbus-sh/core',
+    ' * src/runtime/esbuild-cli/preamble.ts as an IIFE. Only the session\'s esbuild',
+    ' * facet evaluates it, so src/runtime/esbuild-wasm-bytes.ts fetches it from',
+    ' * ASSETS when that facet is built, instead of the Worker bundle carrying it.',
+    ' * ESBUILD_CLI_BUILD_ID is a content-hash prefix, ESBUILD_CLI_SHA256 the',
+    ' * digest every fetch is verified against.',
+    ' *',
+    ` * Size: ${(src.length / 1024).toFixed(2)} KiB`,
+    ' */',
+    '',
+    `export const ESBUILD_CLI_ASSET_PATH: string = ${JSON.stringify(assetPath)};`,
+    `export const ESBUILD_CLI_BUILD_ID: string = ${JSON.stringify(buildId)};`,
+    `export const ESBUILD_CLI_SHA256: string = ${JSON.stringify(sha256)};`,
+    '',
+  ].join('\n'));
+  return { assetPath, generatedPath };
+}
+
 async function main() {
   // 1. Tar-parser preamble (existing W2.5/W4 hot-path helpers).
   const tarStripped = await bundleAsPreamble(
@@ -279,6 +406,17 @@ async function main() {
     'w7-frame',
   );
 
+  // 3. Node's ESM resolver, which the node shims embed as source (their
+  //    process's import() loader). One compile of it, here, so the shims'
+  //    copy is the same text whatever toolchain later evaluates the shims.
+  const esmResolver = await bundleAsPreamble(
+    join(coreRoot, 'src', '_shared', 'esm-resolver.ts'),
+    'esm-resolver',
+  );
+  if (!/^function createEsmResolver\(/m.test(esmResolver)) {
+    throw new Error('[bundle-facet-workers/esm-resolver] the bundle no longer declares function createEsmResolver');
+  }
+
   const tarEncoded = JSON.stringify(tarStripped);
   const w7Encoded = JSON.stringify(w7Stripped);
   const outPath = join(root, 'src', 'loaders', 'generated-workers.ts');
@@ -290,8 +428,9 @@ async function main() {
     ' * Produced by scripts/bundle-facet-workers.mjs from:',
     ' *   - @nimbus-sh/core src/_shared/tarball-stream.ts (streaming tar primitives)',
     ' *   - @nimbus-sh/platform src/w7-frame.ts (W7 streaming bulk-write encoder)',
+    ' *   - @nimbus-sh/core src/_shared/esm-resolver.ts (Node\'s ESM resolver, for the node shims)',
     ' *',
-    ' * Consumed by src/loaders/loader-pool.ts callers via the `preamble`',
+    ' * Consumed by fabric/isolate-pool.ts callers via the `preamble`',
     ' * option. The preamble is injected at the top of every generated',
     ' * worker module so user functions can reference the exported',
     ' * helpers by name.',
@@ -309,6 +448,9 @@ async function main() {
     '',
     `export const W7_FRAME_PREAMBLE: string = ${w7Encoded};`,
     '',
+    '/** Declares `function createEsmResolver(host)`; the node shims call it. */',
+    `export const ESM_RESOLVER_PREAMBLE: string = ${JSON.stringify(esmResolver)};`,
+    '',
   ].join('\n');
 
   mkdirSync(dirname(outPath), { recursive: true });
@@ -380,6 +522,9 @@ async function main() {
     '',
   ].join('\n'));
 
+  const esbuildCliSrc = await bundleEsbuildCli();
+  const esbuildCli = stageEsbuildCli(esbuildCliSrc);
+
   console.log(
     `[bundle-facet-workers] wrote ${kernelOutPath} ` +
     `(kernel=${(kernelSrc.length / 1024).toFixed(2)} KiB)`,
@@ -392,13 +537,17 @@ async function main() {
     `[bundle-facet-workers] wrote ${bashOutPath} ` +
     `(bash=${(bashSrc.length / 1024).toFixed(2)} KiB)`,
   );
+  console.log(
+    `[bundle-facet-workers] staged ${esbuildCli.assetPath} and wrote ${esbuildCli.generatedPath} ` +
+    `(esbuild-cli=${(esbuildCliSrc.length / 1024).toFixed(2)} KiB)`,
+  );
 }
 
 // The bundle functions are exported so the parity test can re-derive the
 // generated files from source and compare, rather than restating the esbuild
 // settings — a second copy of those settings is exactly the drift such a test
 // exists to catch. main() therefore runs only when this file is the entry point.
-export { bundleWasiInstance, bundleBashRunner };
+export { bundleWasiInstance, bundleBashRunner, bundleEsbuildCli };
 
 if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
   main().catch((e) => {