@nimbus-sh/worker 0.1.0 → 0.1.2

package/README.md

@@ -1,14 +1,18 @@
 # @nimbus-sh/worker
 
-The Nimbus runtime — Durable Object + router + facet machinery — packaged
-for embedding in any Cloudflare Workers project.
+The Nimbus runtime package: Durable Object, router, assets, VFS, runtime
+manager, and facet machinery.
+
+Application code should import the deploy-time API through
+`@nimbus-sh/sdk/worker`. This package is still installed because it carries
+the runtime implementation and static assets used by the SDK entrypoint.
 
 ## Install
 
 ```bash
-npm install @nimbus-sh/worker
+npm install @nimbus-sh/sdk @nimbus-sh/worker @nimbus-sh/config
 # or
-bun add @nimbus-sh/worker
+bun add @nimbus-sh/sdk @nimbus-sh/worker @nimbus-sh/config
 ```
 
 ## Quickstart
@@ -27,7 +31,8 @@ import {
   NimbusDOStub,
   CirrusHmrRPC,
   createNimbusHandler,
-} from '@nimbus-sh/worker';
+} from '@nimbus-sh/sdk/worker';
+import { defineNimbusConfig } from '@nimbus-sh/config';
 
 // Re-export the DO + every RPC class so wrangler's `class_name` lookup +
 // `enable_ctx_exports` find them in your Worker's main-module exports.
@@ -43,7 +48,22 @@ export {
   CirrusHmrRPC,
 };
 
-export default createNimbusHandler();
+const nimbusConfig = defineNimbusConfig({
+  sandboxes: {
+    default: {
+      root: '/home/user',
+      runtimes: { preinstall: ['python'], onDemand: true },
+      tools: { namespace: 'sandbox', kind: 'sandbox' },
+    },
+  },
+});
+
+export default createNimbusHandler({
+  sdk: {
+    remote: true,
+    config: nimbusConfig,
+  },
+});
 ```
 
 `wrangler.jsonc` (use `@nimbus-sh/config` to generate, or adapt
@@ -59,7 +79,7 @@ export default createNimbusHandler();
   "assets": {
     "directory": "node_modules/@nimbus-sh/worker/public",
     "binding": "ASSETS",
-    "run_worker_first": ["/s/*", "/new"]
+    "run_worker_first": ["/api/*", "/s/*", "/new"]
   },
   "alias": {
     "@lifo-sh/ui": "./node_modules/@nimbus-sh/worker/dist/stubs/lifo-ui.js",
@@ -89,10 +109,14 @@ export default createNimbusHandler();
 Then:
 
 ```bash
-wrangler secret put JWT_SECRET     # 32+ hex chars
-wrangler deploy
+CLOUDFLARE_ACCOUNT_ID=<account-id> npx @nimbus-sh/cli setup cloudflare --name my-nimbus
+npx wrangler secret put JWT_SECRET     # 32+ hex chars
+npx wrangler deploy
 ```
 
+If setup reports Cloudflare R2 error `10042`, enable R2 in the
+Cloudflare Dashboard once for the account, then rerun the setup command.
+
 `JWT_SECRET` is required for token-enforced deployments. Legacy-public
 single-tenant demos can set `NIMBUS_LEGACY_PUBLIC=1` and rely on URL
 possession instead.
@@ -109,6 +133,10 @@ possession instead.
     onSessionEnd?:   (ctx) => void | Promise<void>;  // reserved v0.2
   };
   routes?: (request, env, ctx) => Response | null | Promise<Response | null>;
+  sdk?: {
+    remote?: boolean | { enabled?: boolean; basePath?: string; allowLegacy?: boolean };
+    config?: NimbusConfig;
+  };
 }
 ```
 
@@ -136,7 +164,7 @@ export default createNimbusHandler({
 Programmatic sandbox route:
 
 ```ts
-import { Nimbus } from '@nimbus-sh/sdk/sandbox';
+import { Nimbus } from '@nimbus-sh/sdk';
 
 export default createNimbusHandler({
   routes: async (req, env) => {
@@ -163,6 +191,21 @@ export default createNimbusHandler({
 });
 ```
 
+Remote SDK API:
+
+```ts
+export default createNimbusHandler({
+  sdk: {
+    remote: true,
+    config: nimbusConfig,
+  },
+});
+```
+
+Remote calls use `POST /api/nimbus/v1/sandboxes/<id>/rpc` internally.
+Applications normally call it through `Nimbus.connect({ endpoint, token,
+config })`. The route requires a valid Nimbus JWT and `sandbox:use` scope.
+
 For long-running app servers, start an explicit long-running process and
 expose the virtual port:
 
@@ -196,9 +239,10 @@ export default createNimbusHandler({
 
 | Subpath | What |
 |---|---|
-| `@nimbus-sh/worker` | `NimbusSession`, `SupervisorRPC` + other RPC classes, `createNimbusHandler`, auth types. |
-| `@nimbus-sh/worker/router` | `createNimbusHandler`, hooks types. |
-| `@nimbus-sh/worker/auth` | HS256 JWT issue/verify, typed errors. |
+| `@nimbus-sh/sdk/worker` | Public Worker embedder API: `NimbusSession`, RPC classes, `createNimbusHandler`, auth helpers. |
+| `@nimbus-sh/worker` | Runtime implementation package used by the SDK entrypoint. |
+| `@nimbus-sh/worker/router` | Runtime router implementation and hook types. |
+| `@nimbus-sh/worker/auth` | Runtime auth implementation re-exported by `@nimbus-sh/sdk/token`. |
 
 ## Required bindings
 

package/dist/_shared/session-id.d.ts

@@ -1,7 +1,8 @@
 /**
  * session-id.ts — Friendly human-readable session identifiers.
  *
- * Format: `adjective-noun-NNNN` (e.g. `nimble-otter-4271`).
+ * Generated format: `adjective-noun-NNNN` (e.g. `nimble-otter-4271`).
+ * Programmatic callers may also use explicit IDs like `job-123`.
  *
  * Why friendly IDs rather than opaque crypto strings?
  *   - Shareable over voice/chat without character-by-character dictation.
@@ -16,15 +17,16 @@
  * sessions ≈ 0.12%. Acceptable for v1. If we ever push past that scale,
  * widen the suffix to 6 digits (≈ 4 × 10¹⁰).
  *
- * Validation is strict: lowercase ASCII only, exact shape enforced.
- * `idFromName` is case-sensitive, so accepting mixed-case would fragment
- * sessions. Reject anything non-conforming with 400 before touching a DO.
+ * Validation rejects empty, overly long, slash-bearing, or colon-bearing
+ * values before touching a DO. Colon remains reserved for tenant/sub/session
+ * DO-name composition.
  */
 /**
- * Validate a session ID before touching a DO. Returns true iff the string
- * matches the exact `adjective-noun-NNNN` shape. Length bounds on each part
- * are deliberately looser than our own word lists so future list growth
- * doesn't invalidate bookmarked URLs.
+ * Validate a session ID before touching a DO.
+ *
+ * Browser-created sessions use the friendly generated shape. SDK-created
+ * sandboxes can choose stable job IDs, so this also accepts the same compact
+ * identifier class used by Nimbus JWT `sid`.
  */
 export declare function isValidSessionId(id: string | null | undefined): boolean;
 /**

package/dist/_shared/session-id.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-id.d.ts","sourceRoot":"","sources":["../../src/_shared/session-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAiFH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAIvE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAO1C"}
+{"version":3,"file":"session-id.d.ts","sourceRoot":"","sources":["../../src/_shared/session-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAmFH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGvE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAO1C"}

package/dist/_shared/session-id.js

@@ -1,7 +1,8 @@
 /**
  * session-id.ts — Friendly human-readable session identifiers.
  *
- * Format: `adjective-noun-NNNN` (e.g. `nimble-otter-4271`).
+ * Generated format: `adjective-noun-NNNN` (e.g. `nimble-otter-4271`).
+ * Programmatic callers may also use explicit IDs like `job-123`.
  *
  * Why friendly IDs rather than opaque crypto strings?
  *   - Shareable over voice/chat without character-by-character dictation.
@@ -16,10 +17,11 @@
  * sessions ≈ 0.12%. Acceptable for v1. If we ever push past that scale,
  * widen the suffix to 6 digits (≈ 4 × 10¹⁰).
  *
- * Validation is strict: lowercase ASCII only, exact shape enforced.
- * `idFromName` is case-sensitive, so accepting mixed-case would fragment
- * sessions. Reject anything non-conforming with 400 before touching a DO.
+ * Validation rejects empty, overly long, slash-bearing, or colon-bearing
+ * values before touching a DO. Colon remains reserved for tenant/sub/session
+ * DO-name composition.
  */
+import { isNimbusIdComponent } from '../auth/index.js';
 // Curated single-word adjectives. Lowercase ASCII, no profanity, no numbers,
 // no compounds. Sort order doesn't matter — we index randomly.
 const ADJECTIVES = [
@@ -94,20 +96,19 @@ const NOUNS = [
     'wheat', 'whippet', 'willow', 'wisp', 'wolf', 'wombat', 'woodland',
     'woodpecker', 'yak', 'yew', 'zebra', 'zinnia',
 ];
-/** Strict shape check. Rejects empty, uppercase, missing-parts, extra-parts. */
+/** Friendly ID shape emitted by {@link generateSessionId}. */
 const SESSION_ID_RE = /^[a-z]{3,14}-[a-z]{3,14}-\d{4}$/;
 /**
- * Validate a session ID before touching a DO. Returns true iff the string
- * matches the exact `adjective-noun-NNNN` shape. Length bounds on each part
- * are deliberately looser than our own word lists so future list growth
- * doesn't invalidate bookmarked URLs.
+ * Validate a session ID before touching a DO.
+ *
+ * Browser-created sessions use the friendly generated shape. SDK-created
+ * sandboxes can choose stable job IDs, so this also accepts the same compact
+ * identifier class used by Nimbus JWT `sid`.
  */
 export function isValidSessionId(id) {
     if (typeof id !== 'string')
         return false;
-    if (id.length < 9 || id.length > 40)
-        return false;
-    return SESSION_ID_RE.test(id);
+    return SESSION_ID_RE.test(id) || isNimbusIdComponent(id);
 }
 /**
  * Generate a fresh session ID. Uses crypto.getRandomValues for uniform

package/dist/auth/index.d.ts

@@ -12,5 +12,5 @@
  */
 export { issueNimbusToken, verifyNimbusToken, type NimbusAuthEnv, } from './token.js';
 export { extractBearerToken, verifyRequestToken, requireScopes, requireSessionPin, setNimbusTokenCookie, authErrorResponse, NIMBUS_TOKEN_COOKIE, NIMBUS_TOKEN_QUERY, } from './middleware.js';
-export { NimbusAuthError, NimbusAuthConfigError, NimbusTokenMalformedError, NimbusTokenSignatureError, NimbusTokenClaimsError, NimbusTokenExpiredError, NimbusTokenTtlError, NimbusScopeError, NimbusSessionPinError, DEFAULT_TOKEN_TTL_MS, MAX_TOKEN_TTL_MS, ID_COMPONENT_RE, type NimbusTokenClaims, type VerifiedNimbusToken, type IssueTokenOptions, } from './types.js';
+export { NimbusAuthError, NimbusAuthConfigError, NimbusTokenMalformedError, NimbusTokenSignatureError, NimbusTokenClaimsError, NimbusTokenExpiredError, NimbusTokenTtlError, NimbusScopeError, NimbusSessionPinError, DEFAULT_TOKEN_TTL_MS, MAX_TOKEN_TTL_MS, ID_COMPONENT_RE, isNimbusIdComponent, type NimbusTokenClaims, type VerifiedNimbusToken, type IssueTokenOptions, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC"}

package/dist/auth/index.js

@@ -12,4 +12,4 @@
  */
 export { issueNimbusToken, verifyNimbusToken, } from './token.js';
 export { extractBearerToken, verifyRequestToken, requireScopes, requireSessionPin, setNimbusTokenCookie, authErrorResponse, NIMBUS_TOKEN_COOKIE, NIMBUS_TOKEN_QUERY, } from './middleware.js';
-export { NimbusAuthError, NimbusAuthConfigError, NimbusTokenMalformedError, NimbusTokenSignatureError, NimbusTokenClaimsError, NimbusTokenExpiredError, NimbusTokenTtlError, NimbusScopeError, NimbusSessionPinError, DEFAULT_TOKEN_TTL_MS, MAX_TOKEN_TTL_MS, ID_COMPONENT_RE, } from './types.js';
+export { NimbusAuthError, NimbusAuthConfigError, NimbusTokenMalformedError, NimbusTokenSignatureError, NimbusTokenClaimsError, NimbusTokenExpiredError, NimbusTokenTtlError, NimbusScopeError, NimbusSessionPinError, DEFAULT_TOKEN_TTL_MS, MAX_TOKEN_TTL_MS, ID_COMPONENT_RE, isNimbusIdComponent, } from './types.js';

package/dist/auth/types.d.ts

@@ -136,6 +136,7 @@ export declare class NimbusSessionPinError extends NimbusAuthError {
     readonly attempted: string;
     constructor(pinnedTo: string, attempted: string);
 }
-/** Regex used to validate the `tn` and `sub` shape (per Mossaic §7.1). */
+/** Compact identifier rule for tenants, subjects, session pins, and SDK sandbox IDs. */
 export declare const ID_COMPONENT_RE: RegExp;
+export declare function isNimbusIdComponent(value: unknown): value is string;
 //# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,KAAK,EAAE,QAAQ,CAAC;IAChB,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,kFAAkF;IAClF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,QAAiB,CAAC;AAEnD,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,MAAM,EAAE,iBAAiB,CAAC;IAC1B,8EAA8E;IAC9E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAChB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,MAAY;CAMpE;AAED,sEAAsE;AACtE,qBAAa,qBAAsB,SAAQ,eAAe;gBAC5C,OAAO,GAAE,MAAuC;CAI7D;AAED,kFAAkF;AAClF,qBAAa,yBAA0B,SAAQ,eAAe;gBAChD,MAAM,EAAE,MAAM;CAI3B;AAED,yEAAyE;AACzE,qBAAa,yBAA0B,SAAQ,eAAe;;CAK7D;AAED,8EAA8E;AAC9E,qBAAa,sBAAuB,SAAQ,eAAe;gBAC7C,MAAM,EAAE,MAAM;CAI3B;AAED,gFAAgF;AAChF,qBAAa,uBAAwB,SAAQ,eAAe;IAC1D,kDAAkD;IAClD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,aAAa,EAAE,MAAM;CAKlC;AAED,mEAAmE;AACnE,qBAAa,mBAAoB,SAAQ,eAAe;gBAC1C,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAQzC;AAED,oEAAoE;AACpE,qBAAa,gBAAiB,SAAQ,eAAe;IACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,aAAa,EAAE,MAAM;CAKlC;AAED,2EAA2E;AAC3E,qBAAa,qBAAsB,SAAQ,eAAe;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBACf,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAUhD;AAED,0EAA0E;AAC1E,eAAO,MAAM,eAAe,QAA4B,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,KAAK,EAAE,QAAQ,CAAC;IAChB,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,kFAAkF;IAClF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,QAAiB,CAAC;AAEnD,oFAAoF;AACpF,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,MAAM,EAAE,iBAAiB,CAAC;IAC1B,8EAA8E;IAC9E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAChB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,MAAY;CAMpE;AAED,sEAAsE;AACtE,qBAAa,qBAAsB,SAAQ,eAAe;gBAC5C,OAAO,GAAE,MAAuC;CAI7D;AAED,kFAAkF;AAClF,qBAAa,yBAA0B,SAAQ,eAAe;gBAChD,MAAM,EAAE,MAAM;CAI3B;AAED,yEAAyE;AACzE,qBAAa,yBAA0B,SAAQ,eAAe;;CAK7D;AAED,8EAA8E;AAC9E,qBAAa,sBAAuB,SAAQ,eAAe;gBAC7C,MAAM,EAAE,MAAM;CAI3B;AAED,gFAAgF;AAChF,qBAAa,uBAAwB,SAAQ,eAAe;IAC1D,kDAAkD;IAClD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,aAAa,EAAE,MAAM;CAKlC;AAED,mEAAmE;AACnE,qBAAa,mBAAoB,SAAQ,eAAe;gBAC1C,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;CAQzC;AAED,oEAAoE;AACpE,qBAAa,gBAAiB,SAAQ,eAAe;IACnD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,aAAa,EAAE,MAAM;CAKlC;AAED,2EAA2E;AAC3E,qBAAa,qBAAsB,SAAQ,eAAe;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBACf,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAUhD;AAED,wFAAwF;AACxF,eAAO,MAAM,eAAe,QAA4B,CAAC;AAEzD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEnE"}

package/dist/auth/types.js

@@ -110,5 +110,8 @@ export class NimbusSessionPinError extends NimbusAuthError {
         this.attempted = attempted;
     }
 }
-/** Regex used to validate the `tn` and `sub` shape (per Mossaic §7.1). */
+/** Compact identifier rule for tenants, subjects, session pins, and SDK sandbox IDs. */
 export const ID_COMPONENT_RE = /^[A-Za-z0-9._-]{1,128}$/;
+export function isNimbusIdComponent(value) {
+    return typeof value === 'string' && ID_COMPONENT_RE.test(value);
+}

package/dist/git-bundle.generated.d.ts

@@ -8,9 +8,9 @@
  * Consumed by git-network-facet.ts: passed to LOADER.load()'s
  * `modules` record so the facet can `import` isomorphic-git.
  *
- * Generated at: 2026-06-02T20:52:06.468Z
- * Size: 492.0 KiB
+ * Generated at: 2026-06-04T22:29:13.356Z
+ * Size: 465.8 KiB
  */
 export declare const GIT_BUNDLE_CODE: string;
-export declare const GIT_BUNDLE_SIZE = 503839;
+export declare const GIT_BUNDLE_SIZE = 476954;
 //# sourceMappingURL=git-bundle.generated.d.ts.map

package/dist/git-bundle.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-bundle.generated.d.ts","sourceRoot":"","sources":["../src/git-bundle.generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,eAAe,EAAE,MAAi4/f,CAAC;AAEh6/f,eAAO,MAAM,eAAe,SAAS,CAAC"}
+{"version":3,"file":"git-bundle.generated.d.ts","sourceRoot":"","sources":["../src/git-bundle.generated.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,eAAe,EAAE,MAA8jre,CAAC;AAE7lre,eAAO,MAAM,eAAe,SAAS,CAAC"}