@nimbus-sh/sdk 0.1.0 → 0.1.1

package/README.md

@@ -1,7 +1,7 @@
 # @nimbus-sh/sdk
 
-SDK for Nimbus — programmatic sandbox handles, token mint/verify, typed
-errors, and session URL helpers.
+SDK for Nimbus — Worker embedder, programmatic sandbox handles,
+token mint/verify, typed errors, and session URL helpers.
 
 ## Install
 
@@ -9,6 +9,11 @@ errors, and session URL helpers.
 npm install @nimbus-sh/sdk @nimbus-sh/worker @nimbus-sh/config
 ```
 
+Use `@nimbus-sh/sdk/worker` as the public Worker embedder entrypoint.
+`@nimbus-sh/worker` is still installed because it carries the runtime assets
+and Durable Object implementation, but application code imports the
+deploy-time API through the SDK.
+
 The sandbox SDK is meant to run inside the Worker or Durable Object that owns
 the `NIMBUS_SESSION` binding. A minimal project setup is:
 
@@ -16,8 +21,40 @@ the `NIMBUS_SESSION` binding. A minimal project setup is:
 npx @nimbus-sh/cli init my-nimbus-worker
 cd my-nimbus-worker
 npm install
-wrangler secret put JWT_SECRET
-wrangler deploy
+CLOUDFLARE_ACCOUNT_ID=<account-id> npx @nimbus-sh/cli setup cloudflare --name my-nimbus-worker
+npx wrangler secret put JWT_SECRET
+npx wrangler deploy
+```
+
+`src/index.ts`:
+
+```ts
+import {
+  NimbusSession,
+  SupervisorRPC,
+  NimbusAssetsRPC,
+  NimbusLoaderRPC,
+  NimbusLoadedWorker,
+  NimbusLoadedEntrypoint,
+  NimbusDurableObjectNamespace,
+  NimbusDOStub,
+  CirrusHmrRPC,
+  createNimbusHandler,
+} from '@nimbus-sh/sdk/worker';
+
+export {
+  NimbusSession,
+  SupervisorRPC,
+  NimbusAssetsRPC,
+  NimbusLoaderRPC,
+  NimbusLoadedWorker,
+  NimbusLoadedEntrypoint,
+  NimbusDurableObjectNamespace,
+  NimbusDOStub,
+  CirrusHmrRPC,
+};
+
+export default createNimbusHandler();
 ```
 
 From this repository, use the source CLI:
@@ -26,8 +63,9 @@ From this repository, use the source CLI:
 bun packages/cli/src/bin.ts init my-nimbus-worker
 cd my-nimbus-worker
 bun install
-wrangler secret put JWT_SECRET
-wrangler deploy
+CLOUDFLARE_ACCOUNT_ID=<account-id> bun ../packages/cli/src/bin.ts setup cloudflare --name my-nimbus-worker
+npx wrangler secret put JWT_SECRET
+npx wrangler deploy
 ```
 
 ## Programmatic sandbox quickstart
@@ -213,6 +251,7 @@ const { token, url } = await mintAndAttach(
 | `@nimbus-sh/sdk/errors` | `NimbusAuthError` class hierarchy. |
 | `@nimbus-sh/sdk/session` | `sessionAttachUrl`, `mintAndAttach`. |
 | `@nimbus-sh/sdk/sandbox` | `Nimbus`, `NimbusSandbox`, programmatic exec/files/runtimes/processes/ports/tools. |
+| `@nimbus-sh/sdk/worker` | Worker embedder entrypoint: `NimbusSession`, RPC classes, `createNimbusHandler`, auth helpers. |
 
 ## Token wire format
 

package/dist/index.d.ts

@@ -1,14 +1,14 @@
 /**
- * @nimbus-sh/sdk — Client SDK for Nimbus.
+ * @nimbus-sh/sdk — Public SDK for Nimbus.
  *
- * The SDK is the **environment-agnostic** half of Nimbus: token mint /
- * verify, typed errors, session-handle types, and the HTTP fallback for
- * non-Worker consumers. Everything in this package is safe to import
- * from a Node SSR layer, a Worker, an Edge function, or a browser
- * build.
+ * The SDK is the public surface for Nimbus applications: token mint /
+ * verify, typed errors, session-handle helpers, programmatic sandboxes,
+ * and the Worker embedder subpath.
  *
- * For the Worker runtime itself (the Durable Object, the router, the
- * facet machinery), see `@nimbus-sh/worker`.
+ * Import the deployed Worker embedder from `@nimbus-sh/sdk/worker`.
+ * The Durable Object, router, assets, VFS, and facet implementation live
+ * in `@nimbus-sh/worker` and are re-exported through that public SDK
+ * subpath.
  *
  * @example mint a token in your Worker's `/api/auth/mint` route
  * ```ts

package/dist/index.js

@@ -1,14 +1,14 @@
 /**
- * @nimbus-sh/sdk — Client SDK for Nimbus.
+ * @nimbus-sh/sdk — Public SDK for Nimbus.
  *
- * The SDK is the **environment-agnostic** half of Nimbus: token mint /
- * verify, typed errors, session-handle types, and the HTTP fallback for
- * non-Worker consumers. Everything in this package is safe to import
- * from a Node SSR layer, a Worker, an Edge function, or a browser
- * build.
+ * The SDK is the public surface for Nimbus applications: token mint /
+ * verify, typed errors, session-handle helpers, programmatic sandboxes,
+ * and the Worker embedder subpath.
  *
- * For the Worker runtime itself (the Durable Object, the router, the
- * facet machinery), see `@nimbus-sh/worker`.
+ * Import the deployed Worker embedder from `@nimbus-sh/sdk/worker`.
+ * The Durable Object, router, assets, VFS, and facet implementation live
+ * in `@nimbus-sh/worker` and are re-exported through that public SDK
+ * subpath.
  *
  * @example mint a token in your Worker's `/api/auth/mint` route
  * ```ts

package/dist/token.d.ts

@@ -5,10 +5,9 @@
  * Why a re-export and not a copy? The auth module is the single source
  * of truth — both Worker (verify) and SDK (mint) call the same code
  * paths so wire-format drift is structurally impossible. The
- * `@nimbus-sh/worker` peer-dependency is OPTIONAL (declared in
- * package.json#peerDependenciesMeta); consumers who only mint tokens
- * outside a Worker can install just `@nimbus-sh/sdk` and the
- * worker peer-dep is tree-shaken to its auth subpath.
+ * `@nimbus-sh/worker` provides the shared auth implementation. The SDK
+ * package depends on that single source of truth so token wire-format
+ * drift is structurally impossible.
  *
  * @example mint
  * ```ts

package/dist/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC"}

package/dist/token.js

@@ -5,10 +5,9 @@
  * Why a re-export and not a copy? The auth module is the single source
  * of truth — both Worker (verify) and SDK (mint) call the same code
  * paths so wire-format drift is structurally impossible. The
- * `@nimbus-sh/worker` peer-dependency is OPTIONAL (declared in
- * package.json#peerDependenciesMeta); consumers who only mint tokens
- * outside a Worker can install just `@nimbus-sh/sdk` and the
- * worker peer-dep is tree-shaken to its auth subpath.
+ * `@nimbus-sh/worker` provides the shared auth implementation. The SDK
+ * package depends on that single source of truth so token wire-format
+ * drift is structurally impossible.
  *
  * @example mint
  * ```ts

package/dist/worker.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @nimbus-sh/sdk/worker - Cloudflare Worker embedder surface.
+ *
+ * This is the public entrypoint for deploying Nimbus itself inside a
+ * Worker. The implementation is provided by @nimbus-sh/worker, but apps
+ * should import through the SDK so the interactive app and programmatic
+ * sandbox APIs share one public package surface.
+ */
+export { NimbusSession, SupervisorRPC, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, CirrusHmrRPC, createNimbusHandler, issueNimbusToken, verifyNimbusToken, NimbusAuthError, } from '@nimbus-sh/worker';
+export type { NimbusHandler, NimbusHooks, NimbusHookContext, CustomRoutes, CreateNimbusHandlerOptions, AuthMode, NimbusAuthConfig, NimbusAuthEnv, NimbusTokenClaims, VerifiedNimbusToken, } from '@nimbus-sh/worker';
+//# sourceMappingURL=worker.d.ts.map

package/dist/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,0BAA0B,EAC1B,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC"}

package/dist/worker.js

@@ -0,0 +1,9 @@
+/**
+ * @nimbus-sh/sdk/worker - Cloudflare Worker embedder surface.
+ *
+ * This is the public entrypoint for deploying Nimbus itself inside a
+ * Worker. The implementation is provided by @nimbus-sh/worker, but apps
+ * should import through the SDK so the interactive app and programmatic
+ * sandbox APIs share one public package surface.
+ */
+export { NimbusSession, SupervisorRPC, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, CirrusHmrRPC, createNimbusHandler, issueNimbusToken, verifyNimbusToken, NimbusAuthError, } from '@nimbus-sh/worker';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nimbus-sh/sdk",
-  "version": "0.1.0",
-  "description": "Nimbus SDK — programmatic sandboxes, token mint, types, and Worker client helpers.",
+  "version": "0.1.1",
+  "description": "Nimbus SDK — Worker embedder, programmatic sandboxes, token mint, and client helpers.",
   "homepage": "https://github.com/AshishKumar4/Nimbus",
   "repository": {
     "type": "git",
@@ -35,6 +35,11 @@
       "types": "./dist/sandbox.d.ts",
       "import": "./dist/sandbox.js"
     },
+    "./worker": {
+      "workspace": "./src/worker.ts",
+      "types": "./dist/worker.d.ts",
+      "import": "./dist/worker.js"
+    },
     "./errors": {
       "workspace": "./src/errors.ts",
       "types": "./dist/errors.d.ts",
@@ -52,14 +57,11 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@nimbus-sh/worker": "^0.1.0"
-  },
-  "peerDependenciesMeta": {
-    "@nimbus-sh/worker": { "optional": true }
+    "@nimbus-sh/worker": "^0.1.1"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20250327.0",
-    "@nimbus-sh/worker": "^0.1.0",
+    "@nimbus-sh/worker": "^0.1.1",
     "typescript": "^5.7.0"
   },
   "publishConfig": {