@nimbus-sh/sdk 0.1.5 → 0.3.0

package/README.md

@@ -161,6 +161,10 @@ Worker verifies the JWT, enforces `sid` pins and `sandbox:use` scope, applies
 the configured runtime policy, and delegates to the same `NimbusSession` RPC
 methods used by `Nimbus.fromEnv()`.
 
+Sandbox destruction is a separate lifecycle operation. Tokens that call
+`box.destroy()` must include `session:destroy` or `session:admin` in addition
+to the normal sandbox scope.
+
 ## Flue connector
 
 Use `@nimbus-sh/sdk/flue` when an agent runtime expects Flue's sandbox
@@ -199,14 +203,20 @@ const box = nimbus.sandbox('session-or-job-id', {
 
 await box.ready();
 await box.exec('node -e "console.log(2 + 2)"');
-await box.startProcess('node --watch /home/user/app/server.js');
+const proc = await box.startProcess('node --watch /home/user/app/server.js');
+// returns immediately with proc.pid; poll box.processes.logs(proc.pid) for
+// output and the exit record, or box.processes.kill(proc.pid) to stop it
 await box.runCode('print(2 + 2)', { language: 'python', install: 'ifMissing' });
 
 await box.files.write('/home/user/app/a.txt', 'hello');
 await box.files.read('/home/user/app/a.txt');
 await box.files.list('/home/user/app');
 await box.files.stat('/home/user/app/a.txt');
-await box.files.delete('/home/user/app/a.txt');
+await box.files.lstat('/home/user/app/link');
+await box.files.rename('/home/user/app/a.txt', '/home/user/app/b.txt');
+await box.files.chmod('/home/user/app/b.txt', 0o755);
+await box.files.readRange('/home/user/app/b.txt', 0, 64);
+await box.files.delete('/home/user/app/b.txt');
 
 await box.runtimes.available();
 await box.runtimes.installed();
@@ -222,6 +232,11 @@ const port = await box.ports.expose(3000);
 await box.ports.unexpose(3000);
 ```
 
+On deployments with a preview host suffix configured (the hosted product sets
+`NIMBUS_PREVIEW_HOST_SUFFIX=nimbus-os.dev`), `port.url` is the hostname form
+`https://<port>--<session-id>.<suffix>/` instead; the `/s/<id>/port/<n>/`
+path route works on every deployment.
+
 Runtime policy comes from the sandbox profile:
 
 - `runtimes.preinstall` is applied by `box.ready()`.
@@ -240,7 +255,7 @@ object with `tools.exec.execute`, `runCode`, `readFile`, `writeFile`,
 `provider.capabilities` is intentionally honest: Nimbus claims shell,
 JavaScript/TypeScript, npm, git, owned filesystem, outbound fetch, inbound
 HTTP-like port routing, process spawn/long-running processes, Python/Ruby
-when allowed, and clang as WASI-native. It does not claim Docker, apt, GPU,
+when allowed, and clang-backed WASI/WebAssembly execution. It does not claim Docker, apt, GPU,
 custom Linux images, native Linux ELF execution, or raw TCP listeners.
 
 ## Quickstart — mint a session token

package/dist/sandbox.d.ts

@@ -1,6 +1,7 @@
 /**
  * @nimbus-sh/sdk/sandbox - programmatic Nimbus sandbox handle.
  */
+import type { VfsCred } from '@nimbus-sh/core/runtime/os-contracts.js';
 export type RuntimeSpec = string;
 export type RuntimeName = 'node' | 'bun' | 'npm' | 'git' | 'python' | 'ruby' | 'clang' | 'shell' | (string & {});
 export interface NimbusRuntimePolicy {
@@ -22,6 +23,14 @@ export interface NimbusSandboxProfile {
 }
 export interface NimbusConfig {
     endpoint?: string;
+    /**
+     * The deployment's `NIMBUS_PREVIEW_HOST_SUFFIX`, enabling the
+     * `<port>--<sid>.<suffix>` preview origin. `Nimbus.fromEnv` reads it off
+     * the bindings, so in-Worker callers never restate it; remote clients
+     * (`Nimbus.connect`) have no bindings and must supply it to get host-form
+     * preview URLs.
+     */
+    previewHostSuffix?: string;
     sandboxes?: Record<string, NimbusSandboxProfile>;
 }
 export interface NimbusFromEnvOptions {
@@ -50,10 +59,21 @@ export interface NimbusSandboxOptions {
     root?: string;
 }
 export interface NimbusExecOptions {
+    /**
+     * Run in a named shell whose cwd and environment persist between calls, the
+     * way a terminal tab does. Omitted, the call runs on the session's one shell
+     * and remembers nothing — the behaviour every programmatic exec has had.
+     */
+    shellId?: string;
     cwd?: string;
     env?: Record<string, string>;
     timeoutMs?: number;
     stdin?: string;
+    /**
+     * Identity the command runs as. Omitted, the spawn inherits the session
+     * user, which is what every programmatic exec has always run as.
+     */
+    cred?: VfsCred;
 }
 export interface NimbusExecResult {
     command: string;
@@ -64,6 +84,10 @@ export interface NimbusExecResult {
     duration: number;
     timestamp: number;
 }
+export interface NimbusTerminalSize {
+    columns: number;
+    rows: number;
+}
 export interface NimbusDestroyOptions {
     reason?: string;
 }
@@ -73,10 +97,18 @@ export interface NimbusDestroyResult {
     destroyedAt: number;
     reason: string | null;
 }
-export interface NimbusStartResult extends NimbusExecResult {
-    pid: number | null;
-    process: NimbusProcess | null;
+/**
+ * A started background process. It is still running when `startProcess`
+ * returns, so there is no exit code or captured output here — poll
+ * `processes.logs(pid)` (which carries the exit record once it lands),
+ * `processes.list()`, or `processes.attach(pid)`.
+ */
+export interface NimbusStartResult {
+    command: string;
+    pid: number;
+    process: NimbusProcess;
     ports: NimbusPort[];
+    startedAt: number;
 }
 export interface NimbusProcess {
     pid: number;
@@ -88,11 +120,50 @@ export interface NimbusProcess {
     startTime: number;
     endTime: number | null;
     longRunning: boolean;
+    attachedTty: boolean;
+}
+export interface NimbusProcessLogChunk {
+    seq: number;
+    ts: number;
+    stream: 'stdout' | 'stderr';
+    data: string;
+    binary?: boolean;
+}
+export interface NimbusProcessExitInfo {
+    code: number;
+    at: number;
+    reason?: string;
+}
+export interface NimbusProcessLogsOptions {
+    cursor?: number;
+    lines?: number;
+    bytes?: number;
+}
+export interface NimbusProcessLogsResult {
+    pid: number;
+    chunks: NimbusProcessLogChunk[];
+    text: string;
+    cursor: number;
+    truncated: boolean;
+    exit: NimbusProcessExitInfo | null;
+}
+export interface NimbusProcessAttachOptions {
+    pollIntervalMs?: number;
+    lines?: number;
+    bytes?: number;
+    signal?: AbortSignal;
 }
 export interface NimbusPort {
     port: number;
     pid: number;
     registeredAt: number;
+    /**
+     * Bearer token for THIS port on THIS session. Presenting it on the
+     * preview route authorises that one port and nothing else, which is what
+     * lets an embedder publish a guest's dev server without publishing the
+     * session. A new registration on the port retires it.
+     */
+    capability: string;
 }
 export interface NimbusFileStat {
     type: 'file' | 'directory' | string;
@@ -105,12 +176,14 @@ export interface NimbusRuntimeSummary {
     name: string;
     version: string;
     root: string;
+    abi: string;
     bins: string[];
     sizeBytes: number;
     license: string;
 }
 export interface NimbusAvailableRuntime {
     name: string;
+    abi: string;
     defaultVersion: string;
     versions: Array<{
         version: string;
@@ -118,7 +191,83 @@ export interface NimbusAvailableRuntime {
         license: string;
     }>;
 }
-type NimbusSessionNamespace = DurableObjectNamespace<any>;
+interface NimbusSessionStub {
+    _rpcReady(options?: {
+        preinstall?: string[];
+    }): Promise<{
+        ok: true;
+        preinstalled: string[];
+    }>;
+    _rpcExec(command: string, options?: Record<string, unknown>): Promise<NimbusExecResult>;
+    _rpcStartProcess(command: string, options?: Record<string, unknown>): Promise<NimbusStartResult>;
+    _rpcRunCode(code: string, options?: Record<string, unknown>): Promise<NimbusExecResult>;
+    _rpcReadFile(path: string): Promise<string | null>;
+    _rpcReadFileBytes(path: string): Promise<Uint8Array | null>;
+    _rpcWriteFile(path: string, content: string | Uint8Array): Promise<void>;
+    _rpcStat(path: string): Promise<NimbusFileStat | null>;
+    _rpcLstat(path: string): Promise<NimbusFileStat | null>;
+    _rpcReaddir(path: string): Promise<{
+        name: string;
+        type: string;
+    }[]>;
+    _rpcRename(from: string, to: string): Promise<void>;
+    _rpcChmod(path: string, mode: number): Promise<void>;
+    _rpcFsReadRange(path: string, offset: number, length: number): Promise<Uint8Array | null>;
+    _rpcExists(path: string): Promise<boolean>;
+    _rpcMkdir(path: string): Promise<void>;
+    _rpcDeleteFile(path: string, options?: {
+        recursive?: boolean;
+    }): Promise<void>;
+    _rpcInstallRuntime(spec: string, options?: {
+        force?: boolean;
+    }): Promise<unknown>;
+    _rpcEnsureRuntimes(specs: string[], options?: {
+        force?: boolean;
+    }): Promise<unknown>;
+    _rpcListRuntimes(): Promise<{
+        installed: NimbusRuntimeSummary[];
+        available: NimbusAvailableRuntime[];
+    }>;
+    _rpcListProcesses(): Promise<NimbusProcess[]>;
+    _rpcKillProcess(pid: number): Promise<{
+        ok: boolean;
+        pid: number;
+    }>;
+    _rpcWriteProcessInput(pid: number, data: string): Promise<{
+        ok: boolean;
+        pid: number;
+    }>;
+    _rpcEndProcessInput(pid: number): Promise<{
+        ok: boolean;
+        pid: number;
+    }>;
+    _rpcResizeProcess(pid: number, size: NimbusTerminalSize): Promise<{
+        ok: boolean;
+        pid: number;
+    }>;
+    _rpcSignalProcess(pid: number, signal: string): Promise<{
+        ok: boolean;
+        pid: number;
+    }>;
+    _rpcProcessLogs(pid: number, options?: NimbusProcessLogsOptions): Promise<NimbusProcessLogsResult>;
+    _rpcListPorts(): Promise<NimbusPort[]>;
+    _rpcExposePort(port: number): Promise<{
+        port: number;
+        listening: boolean;
+        pid: number | null;
+        registeredAt: number | null;
+        capability: string | null;
+    }>;
+    _rpcUnexposePort(port: number): Promise<{
+        port: number;
+        ok: boolean;
+    }>;
+    _rpcDestroy(options?: NimbusDestroyOptions): Promise<NimbusDestroyResult>;
+}
+interface NimbusSessionNamespace {
+    idFromName(name: string): DurableObjectId;
+    get(id: DurableObjectId): NimbusSessionStub;
+}
 type NimbusTarget = {
     kind: 'binding';
     namespace: NimbusSessionNamespace;
@@ -165,6 +314,10 @@ export declare class NimbusSandbox {
     private remoteRpc;
     ready(): Promise<void>;
     exec(command: string, options?: NimbusExecOptions): Promise<NimbusExecResult>;
+    /**
+     * Start a command in the background. Returns as soon as the process has a
+     * pid — it does not wait for the command to finish.
+     */
     startProcess(command: string, options?: NimbusExecOptions): Promise<NimbusStartResult>;
     runCode(code: string, options?: NimbusExecOptions & {
         language?: 'javascript' | 'typescript' | 'python' | 'ruby' | 'shell';
@@ -176,6 +329,12 @@ export declare class NimbusSandbox {
         readBytes: (path: string) => Promise<Uint8Array | null>;
         write: (path: string, content: string | Uint8Array) => Promise<void>;
         stat: (path: string) => Promise<NimbusFileStat | null>;
+        /** stat without following a symlink leaf. */
+        lstat: (path: string) => Promise<NimbusFileStat | null>;
+        rename: (from: string, to: string) => Promise<void>;
+        chmod: (path: string, mode: number) => Promise<void>;
+        /** Read `length` bytes at `offset` without materializing the whole file. */
+        readRange: (path: string, offset: number, length: number) => Promise<Uint8Array | null>;
         list: (path?: string) => Promise<{
             name: string;
             type: string;
@@ -206,10 +365,24 @@ export declare class NimbusSandbox {
             ok: boolean;
             pid: number;
         }>;
-        logs: (pid: number, options?: {
-            lines?: number;
-            bytes?: number;
-        }) => Promise<unknown>;
+        write: (pid: number, data: string) => Promise<{
+            ok: boolean;
+            pid: number;
+        }>;
+        endInput: (pid: number) => Promise<{
+            ok: boolean;
+            pid: number;
+        }>;
+        resize: (pid: number, size: NimbusTerminalSize) => Promise<{
+            ok: boolean;
+            pid: number;
+        }>;
+        signal: (pid: number, signal: string) => Promise<{
+            ok: boolean;
+            pid: number;
+        }>;
+        logs: (pid: number, options?: NimbusProcessLogsOptions) => Promise<NimbusProcessLogsResult>;
+        attach: (pid: number, options?: NimbusProcessAttachOptions) => NimbusProcessAttachment;
     };
     ports: {
         list: () => Promise<NimbusPort[]>;
@@ -219,6 +392,7 @@ export declare class NimbusSandbox {
             listening: boolean;
             pid: number | null;
             registeredAt: number | null;
+            capability: string | null;
         }>;
         unexpose: (port: number) => Promise<{
             port: number;
@@ -248,7 +422,7 @@ export declare class NimbusSandbox {
                 execute: (input: unknown) => Promise<string | null>;
             };
             writeFile: {
-                execute: (input: any) => Promise<void>;
+                execute: (input: unknown) => Promise<void>;
             };
             listFiles: {
                 execute: (input?: unknown) => Promise<{
@@ -263,7 +437,7 @@ export declare class NimbusSandbox {
                 }[]>;
             };
             deleteFile: {
-                execute: (input: any) => Promise<void>;
+                execute: (input: unknown) => Promise<void>;
             };
             exists: {
                 execute: (input: unknown) => Promise<boolean>;
@@ -279,12 +453,48 @@ export declare class NimbusSandbox {
                     pid: number;
                 }>;
             };
+            writeProcessInput: {
+                execute: (input: {
+                    pid: number;
+                    data: string;
+                }) => Promise<{
+                    ok: boolean;
+                    pid: number;
+                }>;
+            };
+            endProcessInput: {
+                execute: (input: number | {
+                    pid: number;
+                }) => Promise<{
+                    ok: boolean;
+                    pid: number;
+                }>;
+            };
+            resizeProcess: {
+                execute: (input: {
+                    pid: number;
+                    columns: number;
+                    rows: number;
+                }) => Promise<{
+                    ok: boolean;
+                    pid: number;
+                }>;
+            };
+            signalProcess: {
+                execute: (input: {
+                    pid: number;
+                    signal: string;
+                }) => Promise<{
+                    ok: boolean;
+                    pid: number;
+                }>;
+            };
             logs: {
                 execute: (input: number | {
                     pid: number;
                     lines?: number;
                     bytes?: number;
-                }) => Promise<unknown>;
+                }) => Promise<NimbusProcessLogsResult>;
             };
             exposePort: {
                 execute: (input: number | {
@@ -295,6 +505,7 @@ export declare class NimbusSandbox {
                     listening: boolean;
                     pid: number | null;
                     registeredAt: number | null;
+                    capability: string | null;
                 }>;
             };
             unexposePort: {
@@ -322,7 +533,47 @@ export declare class NimbusSandbox {
     capabilities(): string[];
     private execOptions;
     private assertRuntimeAllowed;
+    /**
+     * Browser-facing URL for an exposed port, or undefined when the deployment
+     * is not addressable (no `endpoint`, no configured preview base).
+     *
+     * The URL carries NO credential. On a deployment with auth enforced it is
+     * the destination, not the ticket: the session mints a single-use attach
+     * token for it at `GET /s/<id>/api/preview-url?port=<n>`, which is what the
+     * session shell opens and what an embedder should hand to a browser.
+     */
     private portUrl;
+    private rpc;
+}
+export declare class NimbusProcessAttachment implements AsyncIterable<NimbusProcessLogChunk> {
+    private readonly sandbox;
+    readonly pid: number;
+    private readonly options;
+    private cursor;
+    constructor(sandbox: NimbusSandbox, pid: number, options?: NimbusProcessAttachOptions);
+    write(data: string): Promise<{
+        ok: boolean;
+        pid: number;
+    }>;
+    endInput(): Promise<{
+        ok: boolean;
+        pid: number;
+    }>;
+    resize(size: NimbusTerminalSize): Promise<{
+        ok: boolean;
+        pid: number;
+    }>;
+    signal(signal: string): Promise<{
+        ok: boolean;
+        pid: number;
+    }>;
+    kill(): Promise<{
+        ok: boolean;
+        pid: number;
+    }>;
+    logs(options?: NimbusProcessLogsOptions): Promise<NimbusProcessLogsResult>;
+    stream(options?: NimbusProcessAttachOptions): AsyncIterable<NimbusProcessLogChunk>;
+    [Symbol.asyncIterator](): AsyncIterator<NimbusProcessLogChunk>;
 }
 export {};
 //# sourceMappingURL=sandbox.d.ts.map

package/dist/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AACjC,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAE/C,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,iBAAkB,SAAQ,gBAAgB;IACzD,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E;AA2BD,KAAK,sBAAsB,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;AAE1D,KAAK,YAAY,GACb;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,sBAAsB,CAAA;CAAE,GACtD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,OAAO,KAAK,CAAC;CACrB,CAAC;AAEN,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE;CAOxF;AAED,qBAAa,MAAM;IA2Cf,OAAO,CAAC,QAAQ,CAAC,MAAM;IA1CzB,MAAM,CAAC,OAAO,CACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,MAAM,GAAE,YAAiB,EACzB,OAAO,GAAE,oBAAyB,GACjC,MAAM;IAYT,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM;IAsBrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;gBAGpC,MAAM,EAAE,sBAAsB,GAAG,YAAY,EAC5B,MAAM,GAAE,YAAiB;IAO5C,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,aAAa;CAGvE;AAED,qBAAa,aAAa;IAOtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,YAAY,CAA8B;gBAG/B,MAAM,EAAE,YAAY,EACrC,EAAE,EAAE,MAAM,EACO,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,YAAY;IAOvC,OAAO,KAAK,aAAa,GAIxB;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,UAAU;YA2BJ,SAAS;IAqDjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAStB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKjF,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAK1F,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,iBAAiB,GAAG;QAC3B,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;QACrE,OAAO,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;KAC5B,GACL,OAAO,CAAC,gBAAgB,CAAC;IAatB,OAAO,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK/E,KAAK;qBACgB,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;0BAI1B,MAAM,KAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;sBAIvC,MAAM,WAAW,MAAM,GAAG,UAAU,KAAG,OAAO,CAAC,IAAI,CAAC;qBAIrD,MAAM,KAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;iCAI1B,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;sBAIrD,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;uBAIrB,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;uBAIzB,MAAM,YAAW;YAAE,SAAS,CAAC,EAAE,OAAO,CAAA;SAAE,KAAQ,OAAO,CAAC,IAAI,CAAC;MAIlF;IAEF,QAAQ;yBACe,OAAO,CAAC,sBAAsB,EAAE,CAAC;yBAIjC,OAAO,CAAC,oBAAoB,EAAE,CAAC;;uBArSb,oBAAoB,EAAE;uBAAa,sBAAsB,EAAE;;wBA6S5E,WAAW,YAAW;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE;wBAKzC,WAAW,GAAG,WAAW,EAAE,YAAW;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE;MAM/E;IAEF,SAAS;oBACS,OAAO,CAAC,aAAa,EAAE,CAAC;oBAItB,MAAM;gBA7TkB,OAAO;iBAAO,MAAM;;oBAiU5C,MAAM,YAAW;YAAE,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE;MAIrE;IAEF,KAAK;oBACa,OAAO,CAAC,UAAU,EAAE,CAAC;uBAIhB,MAAM;;kBAzUiB,MAAM;uBAAa,OAAO;iBAAO,MAAM,GAAG,IAAI;0BAAgB,MAAM,GAAG,IAAI;;yBA8UhG,MAAM;kBA7UiB,MAAM;gBAAM,OAAO;;oBAiVrD,MAAM,KAAG,MAAM,GAAG,SAAS;MACvC;IAEF,KAAK,CAAC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO;;;;;;;;;mCAavC,MAAM,SAAS,iBAAiB;;;gCAChC,MAAM,SAAS,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;;;iCACpD,OAAO;;;iCACN,GAAG;;;kCACH,OAAO;0BA7FO,MAAM;0BAAQ,MAAM;;;;kCA8FpC,OAAO;0BA9FS,MAAM;0BAAQ,MAAM;;;;iCA+FjC,GAAG;;;iCACP,OAAO;;;mCACC,MAAM,SAAS,iBAAiB;;;iCACnC,MAAM,GAAG;oBAAE,GAAG,EAAE,MAAM,CAAA;iBAAE;wBA9WlB,OAAO;yBAAO,MAAM;;;;iCA+WjC,MAAM,GAAG;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,KAAK,CAAC,EAAE,MAAM,CAAC;oBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;iBAAE;;;iCAElD,MAAM,GAAG;oBAAE,IAAI,EAAE,MAAM,CAAA;iBAAE;;0BA9WhB,MAAM;+BAAa,OAAO;yBAAO,MAAM,GAAG,IAAI;kCAAgB,MAAM,GAAG,IAAI;;;;iCA+WlF,MAAM,GAAG;oBAAE,IAAI,EAAE,MAAM,CAAA;iBAAE;0BA9WhB,MAAM;wBAAM,OAAO;;;;;;;gCAgX3B,WAAW;;;;+BAtXV,oBAAoB,EAAE;+BAAa,sBAAsB,EAAE;;;;;IA4XpG,YAAY,IAAI,MAAM,EAAE;IAoBxB,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,oBAAoB;IAgB5B,OAAO,CAAC,OAAO;CAUhB"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAGvE,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC;AACjC,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,WAAW,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAE/C,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uFAAuF;IACvF,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC1E;AAED,UAAU,iBAAiB;IACzB,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC9F,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxF,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACxF,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACnD,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC5D,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACxD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACrE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC1F,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrF,gBAAgB,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC;QAAC,SAAS,EAAE,sBAAsB,EAAE,CAAA;KAAE,CAAC,CAAC;IACxG,iBAAiB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC9C,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxF,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChG,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtF,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACnG,aAAa,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACvC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACxJ,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACvE,WAAW,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC3E;AAED,UAAU,sBAAsB;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,iBAAiB,CAAC;CAC7C;AAED,KAAK,YAAY,GACb;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,sBAAsB,CAAA;CAAE,GACtD;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,OAAO,KAAK,CAAC;CACrB,CAAC;AAEN,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;gBAEX,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE;CAOxF;AA4KD,qBAAa,MAAM;IA8Cf,OAAO,CAAC,QAAQ,CAAC,MAAM;IA7CzB,MAAM,CAAC,OAAO,CACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,MAAM,GAAE,YAAiB,EACzB,OAAO,GAAE,oBAAyB,GACjC,MAAM;IAeT,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM;IAsBrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;gBAGpC,MAAM,EAAE,sBAAsB,GAAG,YAAY,EAC5B,MAAM,GAAE,YAAiB;IAO5C,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,aAAa;CAGvE;AAED,qBAAa,aAAa;IAOtB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuB;IAC/C,OAAO,CAAC,YAAY,CAA8B;gBAG/B,MAAM,EAAE,YAAY,EACrC,EAAE,EAAE,MAAM,EACO,OAAO,EAAE,oBAAoB,EAC7B,MAAM,EAAE,YAAY;IAOvC,OAAO,KAAK,aAAa,GAIxB;IAED,OAAO,KAAK,MAAM,GAEjB;IAED,OAAO,KAAK,IAAI,GAEf;IAED,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,UAAU;YAyCJ,SAAS;IAyDjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAStB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKvF;;;OAGG;IACG,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAK1F,OAAO,CACX,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,iBAAiB,GAAG;QAC3B,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;QACrE,OAAO,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;KAC5B,GACL,OAAO,CAAC,gBAAgB,CAAC;IAatB,OAAO,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK/E,KAAK;qBACgB,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;0BAI1B,MAAM,KAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;sBAIvC,MAAM,WAAW,MAAM,GAAG,UAAU,KAAG,OAAO,CAAC,IAAI,CAAC;qBAIrD,MAAM,KAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;QAI1D,6CAA6C;sBACzB,MAAM,KAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;uBAItC,MAAM,MAAM,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;sBAInC,MAAM,QAAQ,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;QAIxD,4EAA4E;0BACpD,MAAM,UAAU,MAAM,UAAU,MAAM,KAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;iCAI3D,OAAO,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;sBAIrD,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;uBAIrB,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;uBAIzB,MAAM,YAAW;YAAE,SAAS,CAAC,EAAE,OAAO,CAAA;SAAE,KAAQ,OAAO,CAAC,IAAI,CAAC;MAIlF;IAEF,QAAQ;yBACe,OAAO,CAAC,sBAAsB,EAAE,CAAC;yBAIjC,OAAO,CAAC,oBAAoB,EAAE,CAAC;;uBAhgBb,oBAAoB,EAAE;uBAAa,sBAAsB,EAAE;;wBAwgB5E,WAAW,YAAW;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE;wBAKzC,WAAW,GAAG,WAAW,EAAE,YAAW;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE;MAM/E;IAEF,SAAS;oBACS,OAAO,CAAC,aAAa,EAAE,CAAC;oBAItB,MAAM;gBAxhBkB,OAAO;iBAAO,MAAM;;qBA4hB3C,MAAM,QAAQ,MAAM;gBA3hBuB,OAAO;iBAAO,MAAM;;wBA+hB5D,MAAM;gBA9hBkB,OAAO;iBAAO,MAAM;;sBAkiB9C,MAAM,QAAQ,kBAAkB;gBAjiBkB,OAAO;iBAAO,MAAM;;sBAqiBtE,MAAM,UAAU,MAAM;gBApiBkB,OAAO;iBAAO,MAAM;;oBAwiB9D,MAAM,YAAW,wBAAwB,KAAQ,OAAO,CAAC,uBAAuB,CAAC;sBAIrF,MAAM,YAAW,0BAA0B,KAAQ,uBAAuB;MAGxF;IAEF,KAAK;oBACa,OAAO,CAAC,UAAU,EAAE,CAAC;uBAIhB,MAAM;;kBAnjBiB,MAAM;uBAAa,OAAO;iBAAO,MAAM,GAAG,IAAI;0BAAgB,MAAM,GAAG,IAAI;wBAAc,MAAM,GAAG,IAAI;;yBAwjB3H,MAAM;kBAvjBiB,MAAM;gBAAM,OAAO;;oBA2jBrD,MAAM,KAAG,MAAM,GAAG,SAAS;MACvC;IAEF,KAAK,CAAC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO;;;;;;;;;mCA2BvC,MAAM,SAAS,iBAAiB;;;gCAChC,MAAM,SAAS,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;;;iCACpD,OAAO;;;iCACN,OAAO;;;kCAIP,OAAO;0BAjIO,MAAM;0BAAQ,MAAM;;;;kCAkIpC,OAAO;0BAlIS,MAAM;0BAAQ,MAAM;;;;iCAmIjC,OAAO;;;iCAIX,OAAO;;;mCACC,MAAM,SAAS,iBAAiB;;;iCACnC,MAAM,GAAG;oBAAE,GAAG,EAAE,MAAM,CAAA;iBAAE;wBAhnBlB,OAAO;yBAAO,MAAM;;;;iCAinBpB;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,IAAI,EAAE,MAAM,CAAA;iBAAE;wBAhnBT,OAAO;yBAAO,MAAM;;;;iCAinB1C,MAAM,GAAG;oBAAE,GAAG,EAAE,MAAM,CAAA;iBAAE;wBAhnBlB,OAAO;yBAAO,MAAM;;;;iCAinB5B;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,OAAO,EAAE,MAAM,CAAC;oBAAC,IAAI,EAAE,MAAM,CAAA;iBAAE;wBAhnBd,OAAO;yBAAO,MAAM;;;;iCAinBpD;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,MAAM,EAAE,MAAM,CAAA;iBAAE;wBAhnBT,OAAO;yBAAO,MAAM;;;;iCAinBnD,MAAM,GAAG;oBAAE,GAAG,EAAE,MAAM,CAAC;oBAAC,KAAK,CAAC,EAAE,MAAM,CAAC;oBAAC,KAAK,CAAC,EAAE,MAAM,CAAA;iBAAE;;;iCAElD,MAAM,GAAG;oBAAE,IAAI,EAAE,MAAM,CAAA;iBAAE;;0BAhnBhB,MAAM;+BAAa,OAAO;yBAAO,MAAM,GAAG,IAAI;kCAAgB,MAAM,GAAG,IAAI;gCAAc,MAAM,GAAG,IAAI;;;;iCAinB7G,MAAM,GAAG;oBAAE,IAAI,EAAE,MAAM,CAAA;iBAAE;0BAhnBhB,MAAM;wBAAM,OAAO;;;;;;;gCAknB3B,WAAW;;;;+BA5nBV,oBAAoB,EAAE;+BAAa,sBAAsB,EAAE;;;;;IAkoBpG,YAAY,IAAI,MAAM,EAAE;IAwBxB,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,oBAAoB;IAgB5B;;;;;;;;OAQG;IACH,OAAO,CAAC,OAAO;YAeD,GAAG;CAKlB;AAED,qBAAa,uBAAwB,YAAW,aAAa,CAAC,qBAAqB,CAAC;IAIhF,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,MAAM,CAAuB;gBAGlB,OAAO,EAAE,aAAa,EAC9B,GAAG,EAAE,MAAM,EACH,OAAO,GAAE,0BAA+B;IAGrD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAI1D,QAAQ,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAIjD,MAAM,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAIvE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAI7D,IAAI,IAAI,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAI7C,IAAI,CAAC,OAAO,GAAE,wBAA6B,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAMpF,MAAM,CAAC,OAAO,GAAE,0BAA+B,GAAG,aAAa,CAAC,qBAAqB,CAAC;IAkCtF,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,qBAAqB,CAAC;CAG/D"}

package/dist/sandbox.js

@@ -1,6 +1,8 @@
 /**
  * @nimbus-sh/sdk/sandbox - programmatic Nimbus sandbox handle.
  */
+import { buildPreviewHost, isPreviewHostSafeSid, readPreviewHostSuffix, } from '@nimbus-sh/worker/preview-host';
+import { z } from 'zod/v4';
 export class NimbusRemoteError extends Error {
     status;
     code;
@@ -13,6 +15,152 @@ export class NimbusRemoteError extends Error {
         this.body = options.body;
     }
 }
+const RemoteRpcSuccessSchema = z.object({
+    ok: z.literal(true),
+    result: z.unknown().optional(),
+}).passthrough();
+const RemoteRpcFailureSchema = z.object({
+    ok: z.boolean().optional(),
+    error: z.string().optional(),
+    message: z.string().optional(),
+    code: z.string().optional(),
+}).passthrough();
+const WireBytesSchema = z.object({
+    __nimbusWireType: z.literal('bytes'),
+    base64: z.string(),
+}).passthrough();
+const UndefinedResultSchema = z.undefined();
+const UnknownResultSchema = z.unknown();
+/** `_rpcWriteFile` answers with the byte count the VFS wrote. */
+const WriteFileResultSchema = z.number();
+const StringOrNullSchema = z.string().nullable();
+const Uint8ArrayOrNullSchema = z.instanceof(Uint8Array).nullable();
+const BooleanResultSchema = z.boolean();
+const ReadyResultSchema = z.object({
+    ok: z.literal(true),
+    preinstalled: z.array(z.string()),
+});
+const ExecResultSchema = z.object({
+    command: z.string(),
+    exitCode: z.number(),
+    success: z.boolean(),
+    stdout: z.string(),
+    stderr: z.string(),
+    duration: z.number(),
+    timestamp: z.number(),
+});
+const ProcessSchema = z.object({
+    pid: z.number(),
+    command: z.string(),
+    argv: z.array(z.string()),
+    cwd: z.string(),
+    state: z.string(),
+    exitCode: z.number().nullable(),
+    startTime: z.number(),
+    endTime: z.number().nullable(),
+    longRunning: z.boolean(),
+    attachedTty: z.boolean().optional().default(false),
+});
+const PortSchema = z.object({
+    port: z.number(),
+    pid: z.number(),
+    registeredAt: z.number(),
+    capability: z.string(),
+});
+const StartResultSchema = z.object({
+    command: z.string(),
+    pid: z.number(),
+    process: ProcessSchema,
+    ports: z.array(PortSchema),
+    startedAt: z.number(),
+});
+const FileStatSchema = z.object({
+    type: z.string(),
+    size: z.number(),
+    ctime: z.number().optional(),
+    mtime: z.number(),
+    mode: z.number(),
+});
+const DirectoryEntrySchema = z.object({
+    name: z.string(),
+    type: z.string(),
+});
+const RuntimeSummarySchema = z.object({
+    name: z.string(),
+    version: z.string(),
+    root: z.string(),
+    abi: z.string(),
+    bins: z.array(z.string()),
+    sizeBytes: z.number(),
+    license: z.string(),
+});
+const AvailableRuntimeSchema = z.object({
+    name: z.string(),
+    abi: z.string(),
+    defaultVersion: z.string(),
+    versions: z.array(z.object({
+        version: z.string(),
+        sizeBytes: z.number(),
+        license: z.string(),
+    })),
+});
+const RuntimeListSchema = z.object({
+    installed: z.array(RuntimeSummarySchema),
+    available: z.array(AvailableRuntimeSchema),
+});
+const ProcessControlResultSchema = z.object({
+    ok: z.boolean(),
+    pid: z.number(),
+});
+const ProcessLogChunkSchema = z.object({
+    seq: z.number(),
+    ts: z.number(),
+    stream: z.enum(['stdout', 'stderr']),
+    data: z.string(),
+    binary: z.boolean().optional(),
+});
+const ProcessExitInfoSchema = z.object({
+    code: z.number(),
+    at: z.number(),
+    reason: z.string().optional(),
+});
+const ProcessLogsResultSchema = z.object({
+    pid: z.number(),
+    chunks: z.array(ProcessLogChunkSchema),
+    text: z.string(),
+    cursor: z.number(),
+    truncated: z.boolean(),
+    exit: ProcessExitInfoSchema.nullable(),
+});
+const ExposedPortSchema = z.object({
+    port: z.number(),
+    listening: z.boolean(),
+    pid: z.number().nullable(),
+    registeredAt: z.number().nullable(),
+    capability: z.string().nullable(),
+});
+const UnexposedPortSchema = z.object({
+    port: z.number(),
+    ok: z.boolean(),
+});
+const DestroyResultSchema = z.object({
+    ok: z.literal(true),
+    killed: z.number(),
+    destroyedAt: z.number(),
+    reason: z.string().nullable(),
+});
+const ToolPathInputSchema = z.object({
+    path: z.string().optional(),
+}).passthrough();
+const ToolWriteFileInputSchema = z.object({
+    path: z.string().optional(),
+    content: z.union([z.string(), z.instanceof(Uint8Array)]).optional(),
+    data: z.union([z.string(), z.instanceof(Uint8Array)]).optional(),
+}).passthrough();
+const ToolDeleteFileInputSchema = z.object({
+    path: z.string().optional(),
+    recursive: z.boolean().optional(),
+}).passthrough();
 export class Nimbus {
     config;
     static fromEnv(env, config = {}, options = {}) {
@@ -24,6 +172,9 @@ export class Nimbus {
         return new Nimbus({ kind: 'binding', namespace: binding }, {
             ...config,
             endpoint: options.endpoint ?? config.endpoint,
+            // The binding is the deployment's own answer for whether port previews
+            // have a host suffix, so in-Worker callers never restate it in config.
+            previewHostSuffix: readPreviewHostSuffix(env) ?? config.previewHostSuffix,
         });
     }
     static connect(options) {
@@ -88,37 +239,49 @@ export class NimbusSandbox {
     stub() {
         if (this.target.kind === 'remote')
             return this.remoteStub();
-        const namespace = this.target.namespace;
-        const id = namespace.idFromName(this.doName);
-        return namespace.get(id);
+        const id = this.target.namespace.idFromName(this.doName);
+        return this.target.namespace.get(id);
     }
     remoteStub() {
         return {
-            _rpcReady: (options) => this.remoteRpc('ready', [options]),
-            _rpcExec: (command, options) => this.remoteRpc('exec', [command, options]),
-            _rpcStartProcess: (command, options) => this.remoteRpc('startProcess', [command, options]),
-            _rpcRunCode: (code, options) => this.remoteRpc('runCode', [code, options]),
-            _rpcReadFile: (path) => this.remoteRpc('readFile', [path]),
-            _rpcReadFileBytes: (path) => this.remoteRpc('readFileBytes', [path]),
-            _rpcWriteFile: (path, content) => this.remoteRpc('writeFile', [path, content]),
-            _rpcStat: (path) => this.remoteRpc('stat', [path]),
-            _rpcReaddir: (path) => this.remoteRpc('readdir', [path]),
-            _rpcExists: (path) => this.remoteRpc('exists', [path]),
-            _rpcMkdir: (path) => this.remoteRpc('mkdir', [path]),
-            _rpcDeleteFile: (path, options) => this.remoteRpc('deleteFile', [path, options]),
-            _rpcInstallRuntime: (spec, options) => this.remoteRpc('installRuntime', [spec, options]),
-            _rpcEnsureRuntimes: (specs, options) => this.remoteRpc('ensureRuntimes', [specs, options]),
-            _rpcListRuntimes: () => this.remoteRpc('listRuntimes', []),
-            _rpcListProcesses: () => this.remoteRpc('listProcesses', []),
-            _rpcKillProcess: (pid) => this.remoteRpc('killProcess', [pid]),
-            _rpcProcessLogs: (pid, options) => this.remoteRpc('processLogs', [pid, options]),
-            _rpcListPorts: () => this.remoteRpc('listPorts', []),
-            _rpcExposePort: (port) => this.remoteRpc('exposePort', [port]),
-            _rpcUnexposePort: (port) => this.remoteRpc('unexposePort', [port]),
-            _rpcDestroy: (options) => this.remoteRpc('destroy', [options]),
+            _rpcReady: (options) => this.remoteRpc('ready', [options], ReadyResultSchema),
+            _rpcExec: (command, options) => this.remoteRpc('exec', [command, options], ExecResultSchema),
+            _rpcStartProcess: (command, options) => this.remoteRpc('startProcess', [command, options], StartResultSchema),
+            _rpcRunCode: (code, options) => this.remoteRpc('runCode', [code, options], ExecResultSchema),
+            _rpcReadFile: (path) => this.remoteRpc('readFile', [path], StringOrNullSchema),
+            _rpcReadFileBytes: (path) => this.remoteRpc('readFileBytes', [path], Uint8ArrayOrNullSchema),
+            _rpcWriteFile: async (path, content) => {
+                // The byte count is the wire contract but not part of the public
+                // `files.write` surface, so it is validated and dropped. Declaring
+                // this `undefined` made every remote write throw after succeeding.
+                await this.remoteRpc('writeFile', [path, content], WriteFileResultSchema);
+            },
+            _rpcStat: (path) => this.remoteRpc('stat', [path], FileStatSchema.nullable()),
+            _rpcLstat: (path) => this.remoteRpc('lstat', [path], FileStatSchema.nullable()),
+            _rpcRename: (from, to) => this.remoteRpc('rename', [from, to], UndefinedResultSchema),
+            _rpcChmod: (path, mode) => this.remoteRpc('chmod', [path, mode], UndefinedResultSchema),
+            _rpcFsReadRange: (path, offset, length) => this.remoteRpc('readRange', [path, offset, length], Uint8ArrayOrNullSchema),
+            _rpcReaddir: (path) => this.remoteRpc('readdir', [path], z.array(DirectoryEntrySchema)),
+            _rpcExists: (path) => this.remoteRpc('exists', [path], BooleanResultSchema),
+            _rpcMkdir: (path) => this.remoteRpc('mkdir', [path], UndefinedResultSchema),
+            _rpcDeleteFile: (path, options) => this.remoteRpc('deleteFile', [path, options], UndefinedResultSchema),
+            _rpcInstallRuntime: (spec, options) => this.remoteRpc('installRuntime', [spec, options], UnknownResultSchema),
+            _rpcEnsureRuntimes: (specs, options) => this.remoteRpc('ensureRuntimes', [specs, options], UnknownResultSchema),
+            _rpcListRuntimes: () => this.remoteRpc('listRuntimes', [], RuntimeListSchema),
+            _rpcListProcesses: () => this.remoteRpc('listProcesses', [], z.array(ProcessSchema)),
+            _rpcKillProcess: (pid) => this.remoteRpc('killProcess', [pid], ProcessControlResultSchema),
+            _rpcWriteProcessInput: (pid, data) => this.remoteRpc('writeProcessInput', [pid, data], ProcessControlResultSchema),
+            _rpcEndProcessInput: (pid) => this.remoteRpc('endProcessInput', [pid], ProcessControlResultSchema),
+            _rpcResizeProcess: (pid, size) => this.remoteRpc('resizeProcess', [pid, size], ProcessControlResultSchema),
+            _rpcSignalProcess: (pid, signal) => this.remoteRpc('signalProcess', [pid, signal], ProcessControlResultSchema),
+            _rpcProcessLogs: (pid, options) => this.remoteRpc('processLogs', [pid, options], ProcessLogsResultSchema),
+            _rpcListPorts: () => this.remoteRpc('listPorts', [], z.array(PortSchema)),
+            _rpcExposePort: (port) => this.remoteRpc('exposePort', [port], ExposedPortSchema),
+            _rpcUnexposePort: (port) => this.remoteRpc('unexposePort', [port], UnexposedPortSchema),
+            _rpcDestroy: (options) => this.remoteRpc('destroy', [options], DestroyResultSchema),
         };
     }
-    async remoteRpc(op, args) {
+    async remoteRpc(op, args, resultSchema) {
         if (this.target.kind !== 'remote') {
             throw new Error('Nimbus internal error: remoteRpc called on non-remote target');
         }
@@ -153,32 +316,40 @@ export class NimbusSandbox {
                 });
             }
         }
-        if (!response.ok || payload?.ok !== true) {
-            const message = payload?.error ?? payload?.message ?? `Nimbus remote API request failed (${response.status})`;
+        const success = RemoteRpcSuccessSchema.safeParse(payload);
+        if (!response.ok || !success.success) {
+            const failure = RemoteRpcFailureSchema.safeParse(payload);
+            const message = failure.success
+                ? failure.data.error ?? failure.data.message ?? `Nimbus remote API request failed (${response.status})`
+                : `Nimbus remote API request failed (${response.status})`;
             throw new NimbusRemoteError(message, {
                 status: response.status,
-                code: payload?.code,
+                code: failure.success ? failure.data.code : undefined,
                 body: payload,
             });
         }
-        return decodeWire(payload.result);
+        return resultSchema.parse(decodeWire(success.data.result));
     }
     async ready() {
         if (!this.readyPromise) {
             const preinstall = this.profile.runtimes?.preinstall ?? [];
             for (const spec of preinstall)
                 this.assertRuntimeAllowed(spec, 'preinstall');
-            this.readyPromise = this.stub()._rpcReady({ preinstall }).then(() => undefined);
+            this.readyPromise = this.rpc(this.stub()._rpcReady({ preinstall })).then(() => undefined);
         }
         return this.readyPromise;
     }
     async exec(command, options = {}) {
         await this.ready();
-        return this.stub()._rpcExec(command, this.execOptions(options));
+        return this.rpc(this.stub()._rpcExec(command, this.execOptions(options)));
     }
+    /**
+     * Start a command in the background. Returns as soon as the process has a
+     * pid — it does not wait for the command to finish.
+     */
     async startProcess(command, options = {}) {
         await this.ready();
-        return this.stub()._rpcStartProcess(command, this.execOptions(options));
+        return this.rpc(this.stub()._rpcStartProcess(command, this.execOptions(options)));
     }
     async runCode(code, options = {}) {
         const language = options.language ?? 'javascript';
@@ -186,110 +357,164 @@ export class NimbusSandbox {
             this.assertRuntimeAllowed(language, options.install === 'ifMissing' ? 'onDemand' : 'use');
         }
         await this.ready();
-        return this.stub()._rpcRunCode(code, {
+        return this.rpc(this.stub()._rpcRunCode(code, {
             ...this.execOptions(options),
             language,
             install: options.install ?? 'never',
-        });
+        }));
     }
     async destroy(options = {}) {
         this.readyPromise = null;
-        return this.stub()._rpcDestroy(options);
+        return this.rpc(this.stub()._rpcDestroy(options));
     }
     files = {
         read: async (path) => {
             await this.ready();
-            return this.stub()._rpcReadFile(path);
+            return this.rpc(this.stub()._rpcReadFile(path));
         },
         readBytes: async (path) => {
             await this.ready();
-            return this.stub()._rpcReadFileBytes(path);
+            return this.rpc(this.stub()._rpcReadFileBytes(path));
         },
         write: async (path, content) => {
             await this.ready();
-            return this.stub()._rpcWriteFile(path, content);
+            return this.rpc(this.stub()._rpcWriteFile(path, content));
         },
         stat: async (path) => {
             await this.ready();
-            return this.stub()._rpcStat(path);
+            return this.rpc(this.stub()._rpcStat(path));
+        },
+        /** stat without following a symlink leaf. */
+        lstat: async (path) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcLstat(path));
+        },
+        rename: async (from, to) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcRename(from, to));
+        },
+        chmod: async (path, mode) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcChmod(path, mode));
+        },
+        /** Read `length` bytes at `offset` without materializing the whole file. */
+        readRange: async (path, offset, length) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcFsReadRange(path, offset, length));
         },
         list: async (path = this.root) => {
             await this.ready();
-            return this.stub()._rpcReaddir(path);
+            return this.rpc(this.stub()._rpcReaddir(path));
         },
         mkdir: async (path) => {
             await this.ready();
-            return this.stub()._rpcMkdir(path);
+            return this.rpc(this.stub()._rpcMkdir(path));
         },
         exists: async (path) => {
             await this.ready();
-            return this.stub()._rpcExists(path);
+            return this.rpc(this.stub()._rpcExists(path));
         },
         delete: async (path, options = {}) => {
             await this.ready();
-            return this.stub()._rpcDeleteFile(path, options);
+            return this.rpc(this.stub()._rpcDeleteFile(path, options));
         },
     };
     runtimes = {
         available: async () => {
             await this.ready();
-            return (await this.stub()._rpcListRuntimes()).available;
+            return (await this.rpc(this.stub()._rpcListRuntimes())).available;
         },
         installed: async () => {
             await this.ready();
-            return (await this.stub()._rpcListRuntimes()).installed;
+            return (await this.rpc(this.stub()._rpcListRuntimes())).installed;
         },
         list: async () => {
             await this.ready();
-            return this.stub()._rpcListRuntimes();
+            return this.rpc(this.stub()._rpcListRuntimes());
         },
         install: async (spec, options = {}) => {
             this.assertRuntimeAllowed(spec, 'onDemand');
             await this.ready();
-            return this.stub()._rpcInstallRuntime(spec, options);
+            return this.rpc(this.stub()._rpcInstallRuntime(spec, options));
         },
         ensure: async (specs, options = {}) => {
             const list = Array.isArray(specs) ? specs : [specs];
             for (const spec of list)
                 this.assertRuntimeAllowed(spec, 'onDemand');
             await this.ready();
-            return this.stub()._rpcEnsureRuntimes(list, options);
+            return this.rpc(this.stub()._rpcEnsureRuntimes(list, options));
         },
     };
     processes = {
         list: async () => {
             await this.ready();
-            return this.stub()._rpcListProcesses();
+            return this.rpc(this.stub()._rpcListProcesses());
         },
         kill: async (pid) => {
             await this.ready();
-            return this.stub()._rpcKillProcess(pid);
+            return this.rpc(this.stub()._rpcKillProcess(pid));
+        },
+        write: async (pid, data) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcWriteProcessInput(pid, data));
+        },
+        endInput: async (pid) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcEndProcessInput(pid));
+        },
+        resize: async (pid, size) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcResizeProcess(pid, size));
+        },
+        signal: async (pid, signal) => {
+            await this.ready();
+            return this.rpc(this.stub()._rpcSignalProcess(pid, signal));
         },
         logs: async (pid, options = {}) => {
             await this.ready();
-            return this.stub()._rpcProcessLogs(pid, options);
+            return this.rpc(this.stub()._rpcProcessLogs(pid, options));
+        },
+        attach: (pid, options = {}) => {
+            return new NimbusProcessAttachment(this, pid, options);
         },
     };
     ports = {
         list: async () => {
             await this.ready();
-            return this.stub()._rpcListPorts();
+            return this.rpc(this.stub()._rpcListPorts());
         },
         expose: async (port) => {
             await this.ready();
-            const result = await this.stub()._rpcExposePort(port);
+            const result = await this.rpc(this.stub()._rpcExposePort(port));
             return { ...result, url: this.portUrl(port) };
         },
         unexpose: async (port) => {
             await this.ready();
-            return this.stub()._rpcUnexposePort(port);
+            return this.rpc(this.stub()._rpcUnexposePort(port));
         },
         url: (port) => this.portUrl(port),
     };
     tools(options = {}) {
         const namespace = options.namespace ?? this.profile.tools?.namespace ?? 'nimbus';
         const kind = options.kind ?? this.profile.tools?.kind ?? 'nimbus';
-        const callPath = (input) => typeof input === 'string' ? input : String(input?.path ?? '');
+        const callPath = (input) => {
+            if (typeof input === 'string')
+                return input;
+            return ToolPathInputSchema.parse(input).path ?? '';
+        };
+        const writeFileInput = (input) => {
+            const parsed = ToolWriteFileInputSchema.parse(input);
+            return {
+                path: parsed.path ?? '',
+                content: parsed.content ?? parsed.data ?? '',
+            };
+        };
+        const deleteFileInput = (input) => {
+            if (typeof input === 'string')
+                return { path: input, recursive: false };
+            const parsed = ToolDeleteFileInputSchema.parse(input);
+            return { path: parsed.path ?? '', recursive: parsed.recursive === true };
+        };
         return {
             name: options.name ?? namespace,
             kind,
@@ -301,13 +526,23 @@ export class NimbusSandbox {
                 exec: { execute: (command, opts) => this.exec(command, opts) },
                 runCode: { execute: (code, opts) => this.runCode(code, opts) },
                 readFile: { execute: (input) => this.files.read(callPath(input)) },
-                writeFile: { execute: (input) => this.files.write(callPath(input), input.content ?? input.data ?? '') },
+                writeFile: { execute: (input) => {
+                        const parsed = writeFileInput(input);
+                        return this.files.write(parsed.path, parsed.content);
+                    } },
                 listFiles: { execute: (input = this.root) => this.files.list(callPath(input) || this.root) },
                 readdir: { execute: (input = this.root) => this.files.list(callPath(input) || this.root) },
-                deleteFile: { execute: (input) => this.files.delete(callPath(input), { recursive: !!input?.recursive }) },
+                deleteFile: { execute: (input) => {
+                        const parsed = deleteFileInput(input);
+                        return this.files.delete(parsed.path, { recursive: parsed.recursive });
+                    } },
                 exists: { execute: (input) => this.files.exists(callPath(input)) },
                 startProcess: { execute: (command, opts) => this.startProcess(command, opts) },
                 killProcess: { execute: (input) => this.processes.kill(typeof input === 'number' ? input : input.pid) },
+                writeProcessInput: { execute: (input) => this.processes.write(input.pid, input.data) },
+                endProcessInput: { execute: (input) => this.processes.endInput(typeof input === 'number' ? input : input.pid) },
+                resizeProcess: { execute: (input) => this.processes.resize(input.pid, { columns: input.columns, rows: input.rows }) },
+                signalProcess: { execute: (input) => this.processes.signal(input.pid, input.signal) },
                 logs: { execute: (input) => this.processes.logs(typeof input === 'number' ? input : input.pid, typeof input === 'number' ? {} : input) },
                 exposePort: { execute: (input) => this.ports.expose(typeof input === 'number' ? input : input.port) },
                 unexposePort: { execute: (input) => this.ports.unexpose(typeof input === 'number' ? input : input.port) },
@@ -331,18 +566,29 @@ export class NimbusSandbox {
             'net_inbound',
             'process_spawn',
             'process_long',
+            'process_attached_stdio',
+            'terminal_resize',
+            'ansi_output',
         ];
         if (hasRuntime('python'))
             caps.push('python');
+        if (hasRuntime('ruby'))
+            caps.push('ruby');
         if (hasRuntime('clang'))
-            caps.push('native_binary');
+            caps.push('wasi', 'clang_wasi');
         return caps;
     }
     execOptions(options) {
-        return {
-            ...options,
-            cwd: options.cwd ?? this.root,
-        };
+        const normalized = { ...options };
+        if (normalized.shellId) {
+            // A named shell owns its cwd, so defaulting one here would reset it on
+            // every call. The sandbox root is only where a NEW shell starts.
+            normalized.shellRoot = this.root;
+        }
+        else {
+            normalized.cwd ??= this.root;
+        }
+        return normalized;
     }
     assertRuntimeAllowed(spec, action) {
         const policy = this.profile.runtimes;
@@ -358,7 +604,20 @@ export class NimbusSandbox {
             throw new Error(`Nimbus runtime '${name}' is not preinstalled and on-demand runtime installs are disabled by sandbox profile '${this.profileName}'`);
         }
     }
+    /**
+     * Browser-facing URL for an exposed port, or undefined when the deployment
+     * is not addressable (no `endpoint`, no configured preview base).
+     *
+     * The URL carries NO credential. On a deployment with auth enforced it is
+     * the destination, not the ticket: the session mints a single-use attach
+     * token for it at `GET /s/<id>/api/preview-url?port=<n>`, which is what the
+     * session shell opens and what an embedder should hand to a browser.
+     */
     portUrl(port) {
+        const hostSuffix = this.config.previewHostSuffix;
+        if (hostSuffix && !this.profile.preview?.pathStyle && isPreviewHostSafeSid(this.id)) {
+            return `https://${buildPreviewHost(this.id, port, hostSuffix)}/`;
+        }
         const explicit = this.profile.preview?.baseUrl;
         if (explicit) {
             const base = trimTrailingSlashes(explicit.replace('{sessionId}', encodeURIComponent(this.id)));
@@ -369,6 +628,81 @@ export class NimbusSandbox {
             return undefined;
         return `${endpoint}/s/${encodeURIComponent(this.id)}/port/${port}/`;
     }
+    async rpc(promise) {
+        const value = await promise;
+        disposeSdkRpcResult(value);
+        return value;
+    }
+}
+export class NimbusProcessAttachment {
+    sandbox;
+    pid;
+    options;
+    cursor = null;
+    constructor(sandbox, pid, options = {}) {
+        this.sandbox = sandbox;
+        this.pid = pid;
+        this.options = options;
+    }
+    async write(data) {
+        return this.sandbox.processes.write(this.pid, data);
+    }
+    async endInput() {
+        return this.sandbox.processes.endInput(this.pid);
+    }
+    async resize(size) {
+        return this.sandbox.processes.resize(this.pid, size);
+    }
+    async signal(signal) {
+        return this.sandbox.processes.signal(this.pid, signal);
+    }
+    async kill() {
+        return this.sandbox.processes.kill(this.pid);
+    }
+    async logs(options = {}) {
+        const result = await this.sandbox.processes.logs(this.pid, options);
+        this.cursor = result.cursor;
+        return result;
+    }
+    stream(options = {}) {
+        const attach = this;
+        const pollIntervalMs = boundedPollInterval(options.pollIntervalMs ?? this.options.pollIntervalMs);
+        const signal = options.signal ?? this.options.signal;
+        const initialLines = options.lines ?? this.options.lines;
+        const initialBytes = options.bytes ?? this.options.bytes;
+        return {
+            async *[Symbol.asyncIterator]() {
+                if (signal?.aborted)
+                    return;
+                let cursor = attach.cursor;
+                if (cursor === null) {
+                    const initial = await attach.logs({
+                        ...(initialBytes !== undefined ? { bytes: initialBytes } : {}),
+                        ...(initialBytes === undefined && initialLines !== undefined ? { lines: initialLines } : {}),
+                    });
+                    cursor = initial.cursor;
+                    for (const chunk of initial.chunks)
+                        yield chunk;
+                    if (initial.exit || signal?.aborted)
+                        return;
+                }
+                while (!signal?.aborted) {
+                    await sleep(pollIntervalMs, signal);
+                    if (signal?.aborted)
+                        return;
+                    const next = await attach.logs({ cursor });
+                    cursor = next.cursor;
+                    for (const chunk of next.chunks)
+                        yield chunk;
+                    if (next.exit)
+                        return;
+                }
+            },
+        };
+    }
+    [Symbol.asyncIterator]() {
+        return this.stream()[Symbol.asyncIterator]();
+    }
 }
 function idComponent(value, field) {
     const text = String(value);
@@ -391,6 +725,29 @@ function isIdComponent(value) {
     }
     return true;
 }
+function boundedPollInterval(value) {
+    if (!Number.isFinite(value))
+        return 100;
+    return Math.max(25, Math.min(5000, Math.floor(Number(value))));
+}
+function sleep(ms, signal) {
+    if (signal?.aborted)
+        return Promise.resolve();
+    return new Promise((resolve) => {
+        let done = false;
+        let timer;
+        const finish = () => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', finish);
+            resolve();
+        };
+        timer = setTimeout(finish, ms);
+        signal?.addEventListener('abort', finish, { once: true });
+    });
+}
 function isNimbusTarget(value) {
     return !!value && typeof value === 'object' && 'kind' in value;
 }
@@ -413,6 +770,22 @@ function trimTrailingSlashes(value) {
         end--;
     return value.slice(0, end);
 }
+function disposeSdkRpcResult(value) {
+    if ((typeof value !== 'object' && typeof value !== 'function') || value === null)
+        return;
+    const disposerKey = Symbol.dispose;
+    if (!disposerKey)
+        return;
+    const disposer = Reflect.get(value, disposerKey);
+    if (typeof disposer !== 'function')
+        return;
+    try {
+        Reflect.apply(disposer, value, []);
+    }
+    catch {
+        // Disposal only releases Worker RPC bookkeeping. Preserve SDK behavior.
+    }
+}
 async function resolveHeaders(input) {
     if (!input)
         return undefined;
@@ -451,12 +824,9 @@ function encodeWire(value) {
     return value;
 }
 function decodeWire(value) {
-    if (value
-        && typeof value === 'object'
-        && value.__nimbusWireType === 'bytes'
-        && typeof value.base64 === 'string') {
-        return base64ToBytes(value.base64);
-    }
+    const bytes = WireBytesSchema.safeParse(value);
+    if (bytes.success)
+        return base64ToBytes(bytes.data.base64);
     if (Array.isArray(value))
         return value.map(decodeWire);
     if (value && typeof value === 'object') {

package/dist/worker.d.ts

@@ -6,6 +6,6 @@
  * should import through the SDK so the interactive app and programmatic
  * sandbox APIs share one public package surface.
  */
-export { NimbusSession, SupervisorRPC, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, CirrusHmrRPC, base64Utf8, base64Url, base64UrlDecode, createNimbusHandler, decodeJsonBase64Url, encodeJsonBase64Url, generateSessionId, isValidSessionId, issueNimbusToken, pkceChallenge, randomBase64Url, sealJson, sha256Base64Url, unsealJson, verifyNimbusToken, NimbusAuthError, } from '@nimbus-sh/worker';
-export type { NimbusHandler, NimbusHooks, NimbusHookContext, CustomRoutes, CreateNimbusHandlerOptions, NimbusRemoteApiConfig, NimbusRuntimePolicy, NimbusSandboxProfile, NimbusSdkConfig, NimbusSdkRouterConfig, AuthMode, NimbusAuthConfig, NimbusAuthEnv, NimbusTokenClaims, VerifiedNimbusToken, } from '@nimbus-sh/worker';
+export { NimbusSession, SupervisorRPC, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, CirrusHmrRPC, base64Utf8, base64Url, base64UrlDecode, clearNimbusAgentOAuthCookie, createNimbusHandler, createNimbusAgentOAuthCookie, decodeJsonBase64Url, encodeJsonBase64Url, fetchNimbusCloudflareAccounts, fetchNimbusCloudflareUserInfo, generateSessionId, isNimbusCloudflareAccountId, isNimbusTenantSegment, isPreviewHostRequest, isValidSessionId, issueNimbusToken, loadNimbusAgentOAuthFromRequest, nimbusAgentAuthCookiePath, nimbusAgentRouteContext, NIMBUS_AGENT_AUTH_COOKIE, NIMBUS_AGENT_AUTH_COOKIE_PURPOSE, NIMBUS_AGENT_AUTH_COOKIE_TTL_SECONDS, NIMBUS_CF_OAUTH_AUTH_URL, NIMBUS_CF_OAUTH_TOKEN_URL, NIMBUS_CF_OAUTH_USERINFO_URL, NIMBUS_CLOUDFLARE_API, pkceChallenge, randomBase64Url, readNimbusAgentCookieSecret, readNimbusCookie, requestNimbusCloudflareOAuthToken, sealJson, serializeNimbusCookie, sha256Base64Url, unsealJson, verifyNimbusToken, NimbusAuthError, } from '@nimbus-sh/worker';
+export type { NimbusHandler, NimbusHooks, NimbusHookContext, CustomRoutes, CreateNimbusHandlerOptions, NimbusRemoteApiConfig, NimbusRuntimePolicy, NimbusSandboxProfile, NimbusSdkConfig, NimbusSdkRouterConfig, AuthMode, NimbusAuthConfig, NimbusAuthEnv, NimbusAgentOAuthCookie, NimbusCloudflareAccount, NimbusTokenClaims, VerifiedNimbusToken, } from '@nimbus-sh/worker';
 //# sourceMappingURL=worker.d.ts.map

package/dist/worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,QAAQ,EACR,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACZ,YAAY,EACZ,UAAU,EACV,SAAS,EACT,eAAe,EACf,2BAA2B,EAC3B,mBAAmB,EACnB,4BAA4B,EAC5B,mBAAmB,EACnB,mBAAmB,EACnB,6BAA6B,EAC7B,6BAA6B,EAC7B,iBAAiB,EACjB,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,gCAAgC,EAChC,oCAAoC,EACpC,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,2BAA2B,EAC3B,gBAAgB,EAChB,iCAAiC,EACjC,QAAQ,EACR,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,EACrB,QAAQ,EACR,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC"}

package/dist/worker.js

@@ -6,4 +6,4 @@
  * should import through the SDK so the interactive app and programmatic
  * sandbox APIs share one public package surface.
  */
-export { NimbusSession, SupervisorRPC, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, CirrusHmrRPC, base64Utf8, base64Url, base64UrlDecode, createNimbusHandler, decodeJsonBase64Url, encodeJsonBase64Url, generateSessionId, isValidSessionId, issueNimbusToken, pkceChallenge, randomBase64Url, sealJson, sha256Base64Url, unsealJson, verifyNimbusToken, NimbusAuthError, } from '@nimbus-sh/worker';
+export { NimbusSession, SupervisorRPC, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, CirrusHmrRPC, base64Utf8, base64Url, base64UrlDecode, clearNimbusAgentOAuthCookie, createNimbusHandler, createNimbusAgentOAuthCookie, decodeJsonBase64Url, encodeJsonBase64Url, fetchNimbusCloudflareAccounts, fetchNimbusCloudflareUserInfo, generateSessionId, isNimbusCloudflareAccountId, isNimbusTenantSegment, isPreviewHostRequest, isValidSessionId, issueNimbusToken, loadNimbusAgentOAuthFromRequest, nimbusAgentAuthCookiePath, nimbusAgentRouteContext, NIMBUS_AGENT_AUTH_COOKIE, NIMBUS_AGENT_AUTH_COOKIE_PURPOSE, NIMBUS_AGENT_AUTH_COOKIE_TTL_SECONDS, NIMBUS_CF_OAUTH_AUTH_URL, NIMBUS_CF_OAUTH_TOKEN_URL, NIMBUS_CF_OAUTH_USERINFO_URL, NIMBUS_CLOUDFLARE_API, pkceChallenge, randomBase64Url, readNimbusAgentCookieSecret, readNimbusCookie, requestNimbusCloudflareOAuthToken, sealJson, serializeNimbusCookie, sha256Base64Url, unsealJson, verifyNimbusToken, NimbusAuthError, } from '@nimbus-sh/worker';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/sdk",
-  "version": "0.1.5",
+  "version": "0.3.0",
   "description": "Nimbus SDK — Worker embedder, programmatic sandboxes, token mint, and client helpers.",
   "keywords": [
     "cloudflare",
@@ -72,14 +72,18 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@nimbus-sh/worker": "^0.1.6"
+    "@nimbus-sh/core": "^0.5.0",
+    "@nimbus-sh/worker": "^0.3.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20250327.0",
-    "@nimbus-sh/worker": "^0.1.6",
+    "@nimbus-sh/worker": "^0.3.0",
     "typescript": "^5.7.0"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "dependencies": {
+    "zod": "^4.4.3"
   }
 }