@nimbus-sh/sdk 0.1.4 → 0.2.0

package/dist/sandbox.js

@@ -1,6 +1,8 @@
 /**
  * @nimbus-sh/sdk/sandbox - programmatic Nimbus sandbox handle.
  */
+import { buildPreviewHost, isPreviewHostSafeSid, readPreviewHostSuffix, } from '@nimbus-sh/worker/preview-host';
+import { z } from 'zod/v4';
 export class NimbusRemoteError extends Error {
     status;
     code;
@@ -13,6 +15,150 @@ export class NimbusRemoteError extends Error {
         this.body = options.body;
     }
 }
+const RemoteRpcSuccessSchema = z.object({
+    ok: z.literal(true),
+    result: z.unknown().optional(),
+}).passthrough();
+const RemoteRpcFailureSchema = z.object({
+    ok: z.boolean().optional(),
+    error: z.string().optional(),
+    message: z.string().optional(),
+    code: z.string().optional(),
+}).passthrough();
+const WireBytesSchema = z.object({
+    __nimbusWireType: z.literal('bytes'),
+    base64: z.string(),
+}).passthrough();
+const UndefinedResultSchema = z.undefined();
+const UnknownResultSchema = z.unknown();
+/** `_rpcWriteFile` answers with the byte count the VFS wrote. */
+const WriteFileResultSchema = z.number();
+const StringOrNullSchema = z.string().nullable();
+const Uint8ArrayOrNullSchema = z.instanceof(Uint8Array).nullable();
+const BooleanResultSchema = z.boolean();
+const ReadyResultSchema = z.object({
+    ok: z.literal(true),
+    preinstalled: z.array(z.string()),
+});
+const ExecResultSchema = z.object({
+    command: z.string(),
+    exitCode: z.number(),
+    success: z.boolean(),
+    stdout: z.string(),
+    stderr: z.string(),
+    duration: z.number(),
+    timestamp: z.number(),
+});
+const ProcessSchema = z.object({
+    pid: z.number(),
+    command: z.string(),
+    argv: z.array(z.string()),
+    cwd: z.string(),
+    state: z.string(),
+    exitCode: z.number().nullable(),
+    startTime: z.number(),
+    endTime: z.number().nullable(),
+    longRunning: z.boolean(),
+    attachedTty: z.boolean().optional().default(false),
+});
+const PortSchema = z.object({
+    port: z.number(),
+    pid: z.number(),
+    registeredAt: z.number(),
+});
+const StartResultSchema = z.object({
+    command: z.string(),
+    pid: z.number(),
+    process: ProcessSchema,
+    ports: z.array(PortSchema),
+    startedAt: z.number(),
+});
+const FileStatSchema = z.object({
+    type: z.string(),
+    size: z.number(),
+    ctime: z.number().optional(),
+    mtime: z.number(),
+    mode: z.number(),
+});
+const DirectoryEntrySchema = z.object({
+    name: z.string(),
+    type: z.string(),
+});
+const RuntimeSummarySchema = z.object({
+    name: z.string(),
+    version: z.string(),
+    root: z.string(),
+    abi: z.string(),
+    bins: z.array(z.string()),
+    sizeBytes: z.number(),
+    license: z.string(),
+});
+const AvailableRuntimeSchema = z.object({
+    name: z.string(),
+    abi: z.string(),
+    defaultVersion: z.string(),
+    versions: z.array(z.object({
+        version: z.string(),
+        sizeBytes: z.number(),
+        license: z.string(),
+    })),
+});
+const RuntimeListSchema = z.object({
+    installed: z.array(RuntimeSummarySchema),
+    available: z.array(AvailableRuntimeSchema),
+});
+const ProcessControlResultSchema = z.object({
+    ok: z.boolean(),
+    pid: z.number(),
+});
+const ProcessLogChunkSchema = z.object({
+    seq: z.number(),
+    ts: z.number(),
+    stream: z.enum(['stdout', 'stderr']),
+    data: z.string(),
+    binary: z.boolean().optional(),
+});
+const ProcessExitInfoSchema = z.object({
+    code: z.number(),
+    at: z.number(),
+    reason: z.string().optional(),
+});
+const ProcessLogsResultSchema = z.object({
+    pid: z.number(),
+    chunks: z.array(ProcessLogChunkSchema),
+    text: z.string(),
+    cursor: z.number(),
+    truncated: z.boolean(),
+    exit: ProcessExitInfoSchema.nullable(),
+});
+const ExposedPortSchema = z.object({
+    port: z.number(),
+    listening: z.boolean(),
+    pid: z.number().nullable(),
+    registeredAt: z.number().nullable(),
+});
+const UnexposedPortSchema = z.object({
+    port: z.number(),
+    ok: z.boolean(),
+});
+const DestroyResultSchema = z.object({
+    ok: z.literal(true),
+    killed: z.number(),
+    destroyedAt: z.number(),
+    reason: z.string().nullable(),
+});
+const ToolPathInputSchema = z.object({
+    path: z.string().optional(),
+}).passthrough();
+const ToolWriteFileInputSchema = z.object({
+    path: z.string().optional(),
+    content: z.union([z.string(), z.instanceof(Uint8Array)]).optional(),
+    data: z.union([z.string(), z.instanceof(Uint8Array)]).optional(),
+}).passthrough();
+const ToolDeleteFileInputSchema = z.object({
+    path: z.string().optional(),
+    recursive: z.boolean().optional(),
+}).passthrough();
 export class Nimbus {
     config;
     static fromEnv(env, config = {}, options = {}) {
@@ -24,6 +170,9 @@ export class Nimbus {
         return new Nimbus({ kind: 'binding', namespace: binding }, {
             ...config,
             endpoint: options.endpoint ?? config.endpoint,
+            // The binding is the deployment's own answer for whether port previews
+            // have a host suffix, so in-Worker callers never restate it in config.
+            previewHostSuffix: readPreviewHostSuffix(env) ?? config.previewHostSuffix,
         });
     }
     static connect(options) {
@@ -88,35 +237,49 @@ export class NimbusSandbox {
     stub() {
         if (this.target.kind === 'remote')
             return this.remoteStub();
-        const namespace = this.target.namespace;
-        const id = namespace.idFromName(this.doName);
-        return namespace.get(id);
+        const id = this.target.namespace.idFromName(this.doName);
+        return this.target.namespace.get(id);
     }
     remoteStub() {
         return {
-            _rpcReady: (options) => this.remoteRpc('ready', [options]),
-            _rpcExec: (command, options) => this.remoteRpc('exec', [command, options]),
-            _rpcStartProcess: (command, options) => this.remoteRpc('startProcess', [command, options]),
-            _rpcRunCode: (code, options) => this.remoteRpc('runCode', [code, options]),
-            _rpcReadFile: (path) => this.remoteRpc('readFile', [path]),
-            _rpcReadFileBytes: (path) => this.remoteRpc('readFileBytes', [path]),
-            _rpcWriteFile: (path, content) => this.remoteRpc('writeFile', [path, content]),
-            _rpcReaddir: (path) => this.remoteRpc('readdir', [path]),
-            _rpcExists: (path) => this.remoteRpc('exists', [path]),
-            _rpcMkdir: (path) => this.remoteRpc('mkdir', [path]),
-            _rpcDeleteFile: (path, options) => this.remoteRpc('deleteFile', [path, options]),
-            _rpcInstallRuntime: (spec, options) => this.remoteRpc('installRuntime', [spec, options]),
-            _rpcEnsureRuntimes: (specs, options) => this.remoteRpc('ensureRuntimes', [specs, options]),
-            _rpcListRuntimes: () => this.remoteRpc('listRuntimes', []),
-            _rpcListProcesses: () => this.remoteRpc('listProcesses', []),
-            _rpcKillProcess: (pid) => this.remoteRpc('killProcess', [pid]),
-            _rpcProcessLogs: (pid, options) => this.remoteRpc('processLogs', [pid, options]),
-            _rpcListPorts: () => this.remoteRpc('listPorts', []),
-            _rpcExposePort: (port) => this.remoteRpc('exposePort', [port]),
-            _rpcUnexposePort: (port) => this.remoteRpc('unexposePort', [port]),
+            _rpcReady: (options) => this.remoteRpc('ready', [options], ReadyResultSchema),
+            _rpcExec: (command, options) => this.remoteRpc('exec', [command, options], ExecResultSchema),
+            _rpcStartProcess: (command, options) => this.remoteRpc('startProcess', [command, options], StartResultSchema),
+            _rpcRunCode: (code, options) => this.remoteRpc('runCode', [code, options], ExecResultSchema),
+            _rpcReadFile: (path) => this.remoteRpc('readFile', [path], StringOrNullSchema),
+            _rpcReadFileBytes: (path) => this.remoteRpc('readFileBytes', [path], Uint8ArrayOrNullSchema),
+            _rpcWriteFile: async (path, content) => {
+                // The byte count is the wire contract but not part of the public
+                // `files.write` surface, so it is validated and dropped. Declaring
+                // this `undefined` made every remote write throw after succeeding.
+                await this.remoteRpc('writeFile', [path, content], WriteFileResultSchema);
+            },
+            _rpcStat: (path) => this.remoteRpc('stat', [path], FileStatSchema.nullable()),
+            _rpcLstat: (path) => this.remoteRpc('lstat', [path], FileStatSchema.nullable()),
+            _rpcRename: (from, to) => this.remoteRpc('rename', [from, to], UndefinedResultSchema),
+            _rpcChmod: (path, mode) => this.remoteRpc('chmod', [path, mode], UndefinedResultSchema),
+            _rpcFsReadRange: (path, offset, length) => this.remoteRpc('readRange', [path, offset, length], Uint8ArrayOrNullSchema),
+            _rpcReaddir: (path) => this.remoteRpc('readdir', [path], z.array(DirectoryEntrySchema)),
+            _rpcExists: (path) => this.remoteRpc('exists', [path], BooleanResultSchema),
+            _rpcMkdir: (path) => this.remoteRpc('mkdir', [path], UndefinedResultSchema),
+            _rpcDeleteFile: (path, options) => this.remoteRpc('deleteFile', [path, options], UndefinedResultSchema),
+            _rpcInstallRuntime: (spec, options) => this.remoteRpc('installRuntime', [spec, options], UnknownResultSchema),
+            _rpcEnsureRuntimes: (specs, options) => this.remoteRpc('ensureRuntimes', [specs, options], UnknownResultSchema),
+            _rpcListRuntimes: () => this.remoteRpc('listRuntimes', [], RuntimeListSchema),
+            _rpcListProcesses: () => this.remoteRpc('listProcesses', [], z.array(ProcessSchema)),
+            _rpcKillProcess: (pid) => this.remoteRpc('killProcess', [pid], ProcessControlResultSchema),
+            _rpcWriteProcessInput: (pid, data) => this.remoteRpc('writeProcessInput', [pid, data], ProcessControlResultSchema),
+            _rpcEndProcessInput: (pid) => this.remoteRpc('endProcessInput', [pid], ProcessControlResultSchema),
+            _rpcResizeProcess: (pid, size) => this.remoteRpc('resizeProcess', [pid, size], ProcessControlResultSchema),
+            _rpcSignalProcess: (pid, signal) => this.remoteRpc('signalProcess', [pid, signal], ProcessControlResultSchema),
+            _rpcProcessLogs: (pid, options) => this.remoteRpc('processLogs', [pid, options], ProcessLogsResultSchema),
+            _rpcListPorts: () => this.remoteRpc('listPorts', [], z.array(PortSchema)),
+            _rpcExposePort: (port) => this.remoteRpc('exposePort', [port], ExposedPortSchema),
+            _rpcUnexposePort: (port) => this.remoteRpc('unexposePort', [port], UnexposedPortSchema),
+            _rpcDestroy: (options) => this.remoteRpc('destroy', [options], DestroyResultSchema),
         };
     }
-    async remoteRpc(op, args) {
+    async remoteRpc(op, args, resultSchema) {
         if (this.target.kind !== 'remote') {
             throw new Error('Nimbus internal error: remoteRpc called on non-remote target');
         }
@@ -151,32 +314,40 @@ export class NimbusSandbox {
                 });
             }
         }
-        if (!response.ok || payload?.ok !== true) {
-            const message = payload?.error ?? payload?.message ?? `Nimbus remote API request failed (${response.status})`;
+        const success = RemoteRpcSuccessSchema.safeParse(payload);
+        if (!response.ok || !success.success) {
+            const failure = RemoteRpcFailureSchema.safeParse(payload);
+            const message = failure.success
+                ? failure.data.error ?? failure.data.message ?? `Nimbus remote API request failed (${response.status})`
+                : `Nimbus remote API request failed (${response.status})`;
             throw new NimbusRemoteError(message, {
                 status: response.status,
-                code: payload?.code,
+                code: failure.success ? failure.data.code : undefined,
                 body: payload,
             });
         }
-        return decodeWire(payload.result);
+        return resultSchema.parse(decodeWire(success.data.result));
     }
     async ready() {
         if (!this.readyPromise) {
             const preinstall = this.profile.runtimes?.preinstall ?? [];
             for (const spec of preinstall)
                 this.assertRuntimeAllowed(spec, 'preinstall');
-            this.readyPromise = this.stub()._rpcReady({ preinstall }).then(() => undefined);
+            this.readyPromise = this.rpc(this.stub()._rpcReady({ preinstall })).then(() => undefined);
         }
         return this.readyPromise;
     }
     async exec(command, options = {}) {
         await this.ready();
-        return this.stub()._rpcExec(command, this.execOptions(options));
+        return this.rpc(this.stub()._rpcExec(command, this.execOptions(options)));
     }
+    /**
+     * Start a command in the background. Returns as soon as the process has a
+     * pid — it does not wait for the command to finish.
+     */
     async startProcess(command, options = {}) {
         await this.ready();
-        return this.stub()._rpcStartProcess(command, this.execOptions(options));
+        return this.rpc(this.stub()._rpcStartProcess(command, this.execOptions(options)));
     }
     async runCode(code, options = {}) {
         const language = options.language ?? 'javascript';
@@ -184,102 +355,164 @@ export class NimbusSandbox {
             this.assertRuntimeAllowed(language, options.install === 'ifMissing' ? 'onDemand' : 'use');
         }
         await this.ready();
-        return this.stub()._rpcRunCode(code, {
+        return this.rpc(this.stub()._rpcRunCode(code, {
             ...this.execOptions(options),
             language,
             install: options.install ?? 'never',
-        });
+        }));
+    }
+    async destroy(options = {}) {
+        this.readyPromise = null;
+        return this.rpc(this.stub()._rpcDestroy(options));
     }
     files = {
         read: async (path) => {
             await this.ready();
-            return this.stub()._rpcReadFile(path);
+            return this.rpc(this.stub()._rpcReadFile(path));
         },
         readBytes: async (path) => {
             await this.ready();
-            return this.stub()._rpcReadFileBytes(path);
+            return this.rpc(this.stub()._rpcReadFileBytes(path));
         },
         write: async (path, content) => {
             await this.ready();
-            return this.stub()._rpcWriteFile(path, content);
+            return this.rpc(this.stub()._rpcWriteFile(path, content));
+        },
+        stat: async (path) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcStat(path));
+        },
+        /** stat without following a symlink leaf. */
+        lstat: async (path) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcLstat(path));
+        },
+        rename: async (from, to) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcRename(from, to));
+        },
+        chmod: async (path, mode) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcChmod(path, mode));
+        },
+        /** Read `length` bytes at `offset` without materializing the whole file. */
+        readRange: async (path, offset, length) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcFsReadRange(path, offset, length));
         },
         list: async (path = this.root) => {
             await this.ready();
-            return this.stub()._rpcReaddir(path);
+            return this.rpc(this.stub()._rpcReaddir(path));
         },
         mkdir: async (path) => {
             await this.ready();
-            return this.stub()._rpcMkdir(path);
+            return this.rpc(this.stub()._rpcMkdir(path));
         },
         exists: async (path) => {
             await this.ready();
-            return this.stub()._rpcExists(path);
+            return this.rpc(this.stub()._rpcExists(path));
         },
         delete: async (path, options = {}) => {
             await this.ready();
-            return this.stub()._rpcDeleteFile(path, options);
+            return this.rpc(this.stub()._rpcDeleteFile(path, options));
         },
     };
     runtimes = {
         available: async () => {
             await this.ready();
-            return (await this.stub()._rpcListRuntimes()).available;
+            return (await this.rpc(this.stub()._rpcListRuntimes())).available;
         },
         installed: async () => {
             await this.ready();
-            return (await this.stub()._rpcListRuntimes()).installed;
+            return (await this.rpc(this.stub()._rpcListRuntimes())).installed;
         },
         list: async () => {
             await this.ready();
-            return this.stub()._rpcListRuntimes();
+            return this.rpc(this.stub()._rpcListRuntimes());
         },
         install: async (spec, options = {}) => {
             this.assertRuntimeAllowed(spec, 'onDemand');
             await this.ready();
-            return this.stub()._rpcInstallRuntime(spec, options);
+            return this.rpc(this.stub()._rpcInstallRuntime(spec, options));
         },
         ensure: async (specs, options = {}) => {
             const list = Array.isArray(specs) ? specs : [specs];
             for (const spec of list)
                 this.assertRuntimeAllowed(spec, 'onDemand');
             await this.ready();
-            return this.stub()._rpcEnsureRuntimes(list, options);
+            return this.rpc(this.stub()._rpcEnsureRuntimes(list, options));
         },
     };
     processes = {
         list: async () => {
             await this.ready();
-            return this.stub()._rpcListProcesses();
+            return this.rpc(this.stub()._rpcListProcesses());
         },
         kill: async (pid) => {
             await this.ready();
-            return this.stub()._rpcKillProcess(pid);
+            return this.rpc(this.stub()._rpcKillProcess(pid));
+        },
+        write: async (pid, data) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcWriteProcessInput(pid, data));
+        },
+        endInput: async (pid) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcEndProcessInput(pid));
+        },
+        resize: async (pid, size) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcResizeProcess(pid, size));
+        },
+        signal: async (pid, signal) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcSignalProcess(pid, signal));
         },
         logs: async (pid, options = {}) => {
             await this.ready();
-            return this.stub()._rpcProcessLogs(pid, options);
+            return this.rpc(this.stub()._rpcProcessLogs(pid, options));
+        },
+        attach: (pid, options = {}) => {
+            return new NimbusProcessAttachment(this, pid, options);
         },
     };
     ports = {
         list: async () => {
             await this.ready();
-            return this.stub()._rpcListPorts();
+            return this.rpc(this.stub()._rpcListPorts());
         },
         expose: async (port) => {
             await this.ready();
-            const result = await this.stub()._rpcExposePort(port);
+            const result = await this.rpc(this.stub()._rpcExposePort(port));
             return { ...result, url: this.portUrl(port) };
         },
         unexpose: async (port) => {
             await this.ready();
-            return this.stub()._rpcUnexposePort(port);
+            return this.rpc(this.stub()._rpcUnexposePort(port));
         },
         url: (port) => this.portUrl(port),
     };
     tools(options = {}) {
         const namespace = options.namespace ?? this.profile.tools?.namespace ?? 'nimbus';
         const kind = options.kind ?? this.profile.tools?.kind ?? 'nimbus';
-        const callPath = (input) => typeof input === 'string' ? input : String(input?.path ?? '');
+        const callPath = (input) => {
+            if (typeof input === 'string')
+                return input;
+            return ToolPathInputSchema.parse(input).path ?? '';
+        };
+        const writeFileInput = (input) => {
+            const parsed = ToolWriteFileInputSchema.parse(input);
+            return {
+                path: parsed.path ?? '',
+                content: parsed.content ?? parsed.data ?? '',
+            };
+        };
+        const deleteFileInput = (input) => {
+            if (typeof input === 'string')
+                return { path: input, recursive: false };
+            const parsed = ToolDeleteFileInputSchema.parse(input);
+            return { path: parsed.path ?? '', recursive: parsed.recursive === true };
+        };
         return {
             name: options.name ?? namespace,
             kind,
@@ -291,13 +524,23 @@ export class NimbusSandbox {
                 exec: { execute: (command, opts) => this.exec(command, opts) },
                 runCode: { execute: (code, opts) => this.runCode(code, opts) },
                 readFile: { execute: (input) => this.files.read(callPath(input)) },
-                writeFile: { execute: (input) => this.files.write(callPath(input), input.content ?? input.data ?? '') },
+                writeFile: { execute: (input) => {
+                        const parsed = writeFileInput(input);
+                        return this.files.write(parsed.path, parsed.content);
+                    } },
                 listFiles: { execute: (input = this.root) => this.files.list(callPath(input) || this.root) },
                 readdir: { execute: (input = this.root) => this.files.list(callPath(input) || this.root) },
-                deleteFile: { execute: (input) => this.files.delete(callPath(input), { recursive: !!input?.recursive }) },
+                deleteFile: { execute: (input) => {
+                        const parsed = deleteFileInput(input);
+                        return this.files.delete(parsed.path, { recursive: parsed.recursive });
+                    } },
                 exists: { execute: (input) => this.files.exists(callPath(input)) },
                 startProcess: { execute: (command, opts) => this.startProcess(command, opts) },
                 killProcess: { execute: (input) => this.processes.kill(typeof input === 'number' ? input : input.pid) },
+                writeProcessInput: { execute: (input) => this.processes.write(input.pid, input.data) },
+                endProcessInput: { execute: (input) => this.processes.endInput(typeof input === 'number' ? input : input.pid) },
+                resizeProcess: { execute: (input) => this.processes.resize(input.pid, { columns: input.columns, rows: input.rows }) },
+                signalProcess: { execute: (input) => this.processes.signal(input.pid, input.signal) },
                 logs: { execute: (input) => this.processes.logs(typeof input === 'number' ? input : input.pid, typeof input === 'number' ? {} : input) },
                 exposePort: { execute: (input) => this.ports.expose(typeof input === 'number' ? input : input.port) },
                 unexposePort: { execute: (input) => this.ports.unexpose(typeof input === 'number' ? input : input.port) },
@@ -321,11 +564,16 @@ export class NimbusSandbox {
             'net_inbound',
             'process_spawn',
             'process_long',
+            'process_attached_stdio',
+            'terminal_resize',
+            'ansi_output',
         ];
         if (hasRuntime('python'))
             caps.push('python');
+        if (hasRuntime('ruby'))
+            caps.push('ruby');
         if (hasRuntime('clang'))
-            caps.push('native_binary');
+            caps.push('wasi', 'clang_wasi');
         return caps;
     }
     execOptions(options) {
@@ -348,7 +596,20 @@ export class NimbusSandbox {
             throw new Error(`Nimbus runtime '${name}' is not preinstalled and on-demand runtime installs are disabled by sandbox profile '${this.profileName}'`);
         }
     }
+    /**
+     * Browser-facing URL for an exposed port, or undefined when the deployment
+     * is not addressable (no `endpoint`, no configured preview base).
+     *
+     * The URL carries NO credential. On a deployment with auth enforced it is
+     * the destination, not the ticket: the session mints a single-use attach
+     * token for it at `GET /s/<id>/api/preview-url?port=<n>`, which is what the
+     * session shell opens and what an embedder should hand to a browser.
+     */
     portUrl(port) {
+        const hostSuffix = this.config.previewHostSuffix;
+        if (hostSuffix && !this.profile.preview?.pathStyle && isPreviewHostSafeSid(this.id)) {
+            return `https://${buildPreviewHost(this.id, port, hostSuffix)}/`;
+        }
         const explicit = this.profile.preview?.baseUrl;
         if (explicit) {
             const base = trimTrailingSlashes(explicit.replace('{sessionId}', encodeURIComponent(this.id)));
@@ -359,6 +620,81 @@ export class NimbusSandbox {
             return undefined;
         return `${endpoint}/s/${encodeURIComponent(this.id)}/port/${port}/`;
     }
+    async rpc(promise) {
+        const value = await promise;
+        disposeSdkRpcResult(value);
+        return value;
+    }
+}
+export class NimbusProcessAttachment {
+    sandbox;
+    pid;
+    options;
+    cursor = null;
+    constructor(sandbox, pid, options = {}) {
+        this.sandbox = sandbox;
+        this.pid = pid;
+        this.options = options;
+    }
+    async write(data) {
+        return this.sandbox.processes.write(this.pid, data);
+    }
+    async endInput() {
+        return this.sandbox.processes.endInput(this.pid);
+    }
+    async resize(size) {
+        return this.sandbox.processes.resize(this.pid, size);
+    }
+    async signal(signal) {
+        return this.sandbox.processes.signal(this.pid, signal);
+    }
+    async kill() {
+        return this.sandbox.processes.kill(this.pid);
+    }
+    async logs(options = {}) {
+        const result = await this.sandbox.processes.logs(this.pid, options);
+        this.cursor = result.cursor;
+        return result;
+    }
+    stream(options = {}) {
+        const attach = this;
+        const pollIntervalMs = boundedPollInterval(options.pollIntervalMs ?? this.options.pollIntervalMs);
+        const signal = options.signal ?? this.options.signal;
+        const initialLines = options.lines ?? this.options.lines;
+        const initialBytes = options.bytes ?? this.options.bytes;
+        return {
+            async *[Symbol.asyncIterator]() {
+                if (signal?.aborted)
+                    return;
+                let cursor = attach.cursor;
+                if (cursor === null) {
+                    const initial = await attach.logs({
+                        ...(initialBytes !== undefined ? { bytes: initialBytes } : {}),
+                        ...(initialBytes === undefined && initialLines !== undefined ? { lines: initialLines } : {}),
+                    });
+                    cursor = initial.cursor;
+                    for (const chunk of initial.chunks)
+                        yield chunk;
+                    if (initial.exit || signal?.aborted)
+                        return;
+                }
+                while (!signal?.aborted) {
+                    await sleep(pollIntervalMs, signal);
+                    if (signal?.aborted)
+                        return;
+                    const next = await attach.logs({ cursor });
+                    cursor = next.cursor;
+                    for (const chunk of next.chunks)
+                        yield chunk;
+                    if (next.exit)
+                        return;
+                }
+            },
+        };
+    }
+    [Symbol.asyncIterator]() {
+        return this.stream()[Symbol.asyncIterator]();
+    }
 }
 function idComponent(value, field) {
     const text = String(value);
@@ -381,6 +717,29 @@ function isIdComponent(value) {
     }
     return true;
 }
+function boundedPollInterval(value) {
+    if (!Number.isFinite(value))
+        return 100;
+    return Math.max(25, Math.min(5000, Math.floor(Number(value))));
+}
+function sleep(ms, signal) {
+    if (signal?.aborted)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        let done = false;
+        let timer;
+        const finish = () => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', finish);
+            resolve();
+        };
+        timer = setTimeout(finish, ms);
+        signal?.addEventListener('abort', finish, { once: true });
+    });
+}
 function isNimbusTarget(value) {
     return !!value && typeof value === 'object' && 'kind' in value;
 }
@@ -403,6 +762,22 @@ function trimTrailingSlashes(value) {
         end--;
     return value.slice(0, end);
 }
+function disposeSdkRpcResult(value) {
+    if ((typeof value !== 'object' && typeof value !== 'function') || value === null)
+        return;
+    const disposerKey = Symbol.dispose;
+    if (!disposerKey)
+        return;
+    const disposer = Reflect.get(value, disposerKey);
+    if (typeof disposer !== 'function')
+        return;
+    try {
+        Reflect.apply(disposer, value, []);
+    }
+    catch {
+        // Disposal only releases Worker RPC bookkeeping. Preserve SDK behavior.
+    }
+}
 async function resolveHeaders(input) {
     if (!input)
         return undefined;
@@ -441,12 +816,9 @@ function encodeWire(value) {
     return value;
 }
 function decodeWire(value) {
-    if (value
-        && typeof value === 'object'
-        && value.__nimbusWireType === 'bytes'
-        && typeof value.base64 === 'string') {
-        return base64ToBytes(value.base64);
-    }
+    const bytes = WireBytesSchema.safeParse(value);
+    if (bytes.success)
+        return base64ToBytes(bytes.data.base64);
     if (Array.isArray(value))
         return value.map(decodeWire);
     if (value && typeof value === 'object') {