@nimbus-sh/worker 0.1.0 → 0.1.2

package/dist/index.d.ts

@@ -17,16 +17,15 @@
  *      ID embedded in /s/<id>/* paths. URL → DO mapping is a stable
  *      contract delegated to {@link createNimbusHandler}.
  *
- * The fetch handler delegates to `createNimbusHandler({ auth: { mode:
- * 'auto' } })` — same shape an external embedder uses via
- * `@nimbus-sh/worker`. This file's only deploy-specific logic is the
- * W6.5 registry-event sink installed at module-load time.
+ * Application embedders import this deploy-time surface through
+ * `@nimbus-sh/sdk/worker`. This implementation package keeps the
+ * runtime and generated assets in one place.
  */
 import { NimbusSession, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub } from './session/nimbus-session.js';
 import { SupervisorRPC } from './session/supervisor-rpc.js';
 import { CirrusHmrRPC } from './facets/real-vite-hmr.js';
 export { createNimbusHandler } from './router/index.js';
-export type { NimbusHandler, NimbusHooks, NimbusHookContext, CustomRoutes, CreateNimbusHandlerOptions, AuthMode, NimbusAuthConfig, } from './router/index.js';
+export type { NimbusHandler, NimbusHooks, NimbusHookContext, CustomRoutes, CreateNimbusHandlerOptions, AuthMode, NimbusAuthConfig, NimbusRemoteApiConfig, NimbusRuntimePolicy, NimbusSandboxProfile, NimbusSdkConfig, NimbusSdkRouterConfig, } from './router/index.js';
 export { issueNimbusToken, verifyNimbusToken, NimbusAuthError, } from './auth/index.js';
 export type { NimbusAuthEnv, NimbusTokenClaims, VerifiedNimbusToken, } from './auth/index.js';
 export { NimbusSession, SupervisorRPC, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, CirrusHmrRPC, };

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EACL,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAUzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,YAAY,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,0BAA0B,EAC1B,QAAQ,EACR,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAmBzB,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACZ,YAAY,GACb,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,GAAG,CAEnC;;AAOD,wBAAqC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAUzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,YAAY,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,0BAA0B,EAC1B,QAAQ,EACR,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAmBzB,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACZ,YAAY,GACb,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,GAAG,CAEnC;;AAOD,wBAAqC"}

package/dist/index.js

@@ -17,10 +17,9 @@
  *      ID embedded in /s/<id>/* paths. URL → DO mapping is a stable
  *      contract delegated to {@link createNimbusHandler}.
  *
- * The fetch handler delegates to `createNimbusHandler({ auth: { mode:
- * 'auto' } })` — same shape an external embedder uses via
- * `@nimbus-sh/worker`. This file's only deploy-specific logic is the
- * W6.5 registry-event sink installed at module-load time.
+ * Application embedders import this deploy-time surface through
+ * `@nimbus-sh/sdk/worker`. This implementation package keeps the
+ * runtime and generated assets in one place.
  */
 import { NimbusSession, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, } from './session/nimbus-session.js';
 import { SupervisorRPC } from './session/supervisor-rpc.js';
@@ -28,16 +27,15 @@ import { CirrusHmrRPC } from './facets/real-vite-hmr.js';
 import { createNimbusHandler } from './router/index.js';
 import { getCtxExports as _getCtxExports } from './session/ctx-exports.js';
 import { setRegistryEventSink } from './facets/wasm-swap-registry.js';
-// Re-export the composable factory + companion types so embedders can
-// build their own default-export handlers. The thin path:
-//   import { createNimbusHandler, NimbusSession } from '@nimbus-sh/worker';
+// Re-export the composable factory + companion types. The SDK worker
+// subpath re-exports these for application embedders:
+//   import { createNimbusHandler, NimbusSession } from '@nimbus-sh/sdk/worker';
 //   export { NimbusSession };
 //   export default createNimbusHandler();
 export { createNimbusHandler } from './router/index.js';
 // Auth surface — embedders need `issueNimbusToken` / `verifyNimbusToken`
-// to mint tokens from custom routes. Re-exported here for the canonical
-// `@nimbus-sh/worker` entry; `@nimbus-sh/sdk/token` re-re-exports from
-// the dedicated auth subpath for non-Worker callers.
+// to mint tokens from custom routes. `@nimbus-sh/sdk/token` re-exports
+// from the dedicated auth subpath for application callers.
 export { issueNimbusToken, verifyNimbusToken, NimbusAuthError, } from './auth/index.js';
 // W6.5: install the default registry-event sink at module top so events
 // emitted from any code path (supervisor BFS, facet drain, applyW6Registry)

package/dist/loaders/generated-workers.d.ts

@@ -15,9 +15,9 @@
  * W7-frame symbols:   encodeWriteBatchStream, decodeWriteBatchStream,
  *   W7_MAGIC, W7_TRAILER.
  *
- * Generated at: 2026-06-02T20:52:06.510Z
- * Tar size: 3.84 KiB
- * W7 size:  7.77 KiB
+ * Generated at: 2026-06-04T22:29:13.391Z
+ * Tar size: 3.86 KiB
+ * W7 size:  7.78 KiB
  */
 export declare const TAR_STREAM_PREAMBLE: string;
 export declare const TAR_STREAM_PREAMBLE_SIZE: number;

package/dist/loaders/generated-workers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generated-workers.d.ts","sourceRoot":"","sources":["../../src/loaders/generated-workers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,mBAAmB,EAAE,MAAygI,CAAC;AAE5iI,eAAO,MAAM,wBAAwB,EAAE,MAAa,CAAC;AAErD,eAAO,MAAM,iBAAiB,EAAE,MAA+iQ,CAAC;AAEhlQ,eAAO,MAAM,sBAAsB,EAAE,MAAa,CAAC"}
+{"version":3,"file":"generated-workers.d.ts","sourceRoot":"","sources":["../../src/loaders/generated-workers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,mBAAmB,EAAE,MAAyhI,CAAC;AAE5jI,eAAO,MAAM,wBAAwB,EAAE,MAAa,CAAC;AAErD,eAAO,MAAM,iBAAiB,EAAE,MAA+jQ,CAAC;AAEhmQ,eAAO,MAAM,sBAAsB,EAAE,MAAa,CAAC"}

package/dist/loaders/generated-workers.js

@@ -15,11 +15,11 @@
  * W7-frame symbols:   encodeWriteBatchStream, decodeWriteBatchStream,
  *   W7_MAGIC, W7_TRAILER.
  *
- * Generated at: 2026-06-02T20:52:06.510Z
- * Tar size: 3.84 KiB
- * W7 size:  7.77 KiB
+ * Generated at: 2026-06-04T22:29:13.391Z
+ * Tar size: 3.86 KiB
+ * W7 size:  7.78 KiB
  */
-export const TAR_STREAM_PREAMBLE = "// src/npm/tarball-stream.ts\nvar MAX_FILE_BYTES = 2e7;\nfunction parseTarHeader(block) {\n  if (block[0] === 0) return null;\n  let name = \"\";\n  for (let i = 0; i < 100 && block[i] !== 0; i++) {\n    name += String.fromCharCode(block[i]);\n  }\n  let prefix = \"\";\n  for (let i = 345; i < 500 && block[i] !== 0; i++) {\n    prefix += String.fromCharCode(block[i]);\n  }\n  if (prefix) name = prefix + \"/\" + name;\n  name = name.replace(/^package\\//, \"\");\n  let sizeStr = \"\";\n  for (let i = 124; i < 136 && block[i] !== 0; i++) {\n    sizeStr += String.fromCharCode(block[i]);\n  }\n  const size = parseInt(sizeStr.trim(), 8) || 0;\n  const typeFlag = block[156];\n  return { name, size, typeFlag };\n}\nasync function* readableStreamToAsyncIterable(rs) {\n  const reader = rs.getReader();\n  try {\n    while (true) {\n      const { value, done } = await reader.read();\n      if (done) return;\n      if (value && value.length > 0) yield value;\n    }\n  } finally {\n    try {\n      reader.releaseLock();\n    } catch {\n    }\n  }\n}\nasync function* streamTarEntries(source, onSkip) {\n  let carry = new Uint8Array(0);\n  let state = { kind: \"header\" };\n  function concat(a, b) {\n    if (a.length === 0) return b;\n    if (b.length === 0) return a;\n    const out = new Uint8Array(a.length + b.length);\n    out.set(a, 0);\n    out.set(b, a.length);\n    return out;\n  }\n  for await (const chunkRaw of source) {\n    let buf = concat(carry, chunkRaw);\n    let cursor = 0;\n    while (true) {\n      if (state.kind === \"header\") {\n        if (buf.length - cursor < 512) break;\n        const header = buf.subarray(cursor, cursor + 512);\n        const parsed = parseTarHeader(header);\n        cursor += 512;\n        if (!parsed) return;\n        const { name, size, typeFlag } = parsed;\n        const pad = size === 0 ? 0 : (512 - size % 512) % 512;\n        const isRegularFile = typeFlag === 48 || typeFlag === 0;\n        if (size === 0) {\n          if (isRegularFile && name) {\n            yield { name, data: new Uint8Array(0) };\n          }\n          state = { kind: \"header\" };\n          continue;\n        }\n        if (!isRegularFile || !name || size > MAX_FILE_BYTES) {\n          if (onSkip) {\n            const reason = !isRegularFile ? \"non-regular\" : !name ? \"no-name\" : \"too-large\";\n            try {\n              onSkip(name, size, reason);\n            } catch {\n            }\n          }\n          state = { kind: \"skip\", remaining: size + pad };\n          continue;\n        }\n        state = {\n          kind: \"file\",\n          name,\n          remaining: size,\n          fileBuf: new Uint8Array(size),\n          fileOffset: 0,\n          pad,\n          skip: false\n        };\n        continue;\n      }\n      if (state.kind === \"file\") {\n        const avail2 = buf.length - cursor;\n        if (avail2 === 0) break;\n        if (state.remaining > 0) {\n          const take2 = Math.min(state.remaining, avail2);\n          state.fileBuf.set(buf.subarray(cursor, cursor + take2), state.fileOffset);\n          state.fileOffset += take2;\n          state.remaining -= take2;\n          cursor += take2;\n          if (state.remaining > 0) break;\n        }\n        if (state.pad > 0) {\n          const avail22 = buf.length - cursor;\n          if (avail22 === 0) break;\n          const take2 = Math.min(state.pad, avail22);\n          state.pad -= take2;\n          cursor += take2;\n          if (state.pad > 0) break;\n        }\n        yield { name: state.name, data: state.fileBuf };\n        state = { kind: \"header\" };\n        continue;\n      }\n      const avail = buf.length - cursor;\n      if (avail === 0) break;\n      const take = Math.min(state.remaining, avail);\n      cursor += take;\n      state.remaining -= take;\n      if (state.remaining > 0) break;\n      state = { kind: \"header\" };\n    }\n    if (cursor >= buf.length) {\n      carry = new Uint8Array(0);\n    } else if (cursor === 0) {\n      carry = buf;\n    } else {\n      carry = buf.slice(cursor);\n    }\n  }\n}";
-export const TAR_STREAM_PREAMBLE_SIZE = 3932;
-export const W7_FRAME_PREAMBLE = "// src/_shared/w7-frame.ts\nvar W7_MAGIC = new Uint8Array([78, 87, 55, 1]);\nvar W7_TRAILER = new Uint8Array([78, 69, 78, 68]);\nvar ENCODER_QUEUE_HWM = 256 * 1024;\nvar ENCODER_EMIT_CAP = 64 * 1024;\nvar _peakInFlight = 0;\nvar _currentInFlight = 0;\nfunction _peakInFlightBytes() {\n  return _peakInFlight;\n}\nfunction _resetPeakInFlightBytes() {\n  _peakInFlight = 0;\n  _currentInFlight = 0;\n}\nfunction _trackInFlightAdd(n) {\n  _currentInFlight += n;\n  if (_currentInFlight > _peakInFlight) _peakInFlight = _currentInFlight;\n}\nfunction _trackInFlightSub(n) {\n  _currentInFlight -= n;\n  if (_currentInFlight < 0) _currentInFlight = 0;\n}\nfunction encodeWriteBatchStream(payload) {\n  const inodes = payload.inodes ?? [];\n  const chunks = payload.chunks ?? [];\n  const deletePaths = payload.deletePaths;\n  let phase = 0;\n  let chunkIdx = 0;\n  const enc = new TextEncoder();\n  const headerBytes = enc.encode(JSON.stringify({\n    inodes,\n    deletePaths,\n    chunkCount: chunks.length\n  }));\n  const source = {\n    type: \"bytes\",\n    pull(controller) {\n      try {\n        if (phase === 0) {\n          enqueue(controller, W7_MAGIC.slice());\n          phase = 1;\n          return;\n        }\n        if (phase === 1) {\n          const hdr = new Uint8Array(4 + headerBytes.length);\n          writeU32LE(hdr, 0, headerBytes.length);\n          hdr.set(headerBytes, 4);\n          enqueue(controller, hdr);\n          phase = 2;\n          return;\n        }\n        if (phase === 2) {\n          if (chunkIdx >= chunks.length) {\n            phase = 3;\n          } else {\n            const c = chunks[chunkIdx++];\n            const pathBytes = enc.encode(c.path);\n            const data = c.data instanceof Uint8Array ? c.data : new Uint8Array(c.data);\n            const headerSize = 4 + pathBytes.length + 4 + 4;\n            const headerOut = new Uint8Array(headerSize);\n            let o = 0;\n            writeU32LE(headerOut, o, pathBytes.length);\n            o += 4;\n            headerOut.set(pathBytes, o);\n            o += pathBytes.length;\n            writeU32LE(headerOut, o, c.chunkId);\n            o += 4;\n            writeU32LE(headerOut, o, data.length);\n            o += 4;\n            enqueue(controller, headerOut);\n            if (data.length === 0) return;\n            if (data.length <= ENCODER_EMIT_CAP) {\n              enqueue(controller, data);\n            } else {\n              for (let i = 0; i < data.length; i += ENCODER_EMIT_CAP) {\n                enqueue(controller, data.subarray(i, Math.min(i + ENCODER_EMIT_CAP, data.length)));\n              }\n            }\n            return;\n          }\n        }\n        if (phase === 3) {\n          enqueue(controller, W7_TRAILER.slice());\n          phase = 4;\n          controller.close();\n          return;\n        }\n        controller.close();\n      } catch (e) {\n        controller.error(e);\n      }\n    },\n    cancel() {\n      phase = 4;\n      chunkIdx = chunks.length;\n    }\n  };\n  return new ReadableStream(source, {\n    // Byte streams (`type: 'bytes'`) MUST use the default byte-counted\n    // strategy: highWaterMark is in bytes, size is implicit. Custom\n    // `size` callbacks are forbidden — they throw at construction.\n    highWaterMark: ENCODER_QUEUE_HWM\n  });\n  function enqueue(controller, bytes) {\n    _trackInFlightAdd(bytes.byteLength);\n    controller.enqueue(bytes);\n    queueMicrotask(() => _trackInFlightSub(bytes.byteLength));\n  }\n}\nasync function decodeWriteBatchStream(stream) {\n  const reader = stream.getReader();\n  const buf = new ByteBuffer(reader);\n  const magic = await buf.readExact(4, \"magic\");\n  if (!bytesEqual(magic, W7_MAGIC)) {\n    try {\n      reader.releaseLock();\n    } catch {\n    }\n    throw new Error(`w7-frame: bad magic, expected NW7\\\\x01, got ${Array.from(magic).map((b) => b.toString(16)).join(\" \")}`);\n  }\n  const hdrLenBytes = await buf.readExact(4, \"header-length\");\n  const hdrLen = readU32LE(hdrLenBytes, 0);\n  if (hdrLen < 0 || hdrLen > 64 * 1024 * 1024) {\n    throw new Error(`w7-frame: implausible header length ${hdrLen}`);\n  }\n  const hdrJson = await buf.readExact(hdrLen, \"header-json\");\n  let header;\n  try {\n    header = JSON.parse(new TextDecoder().decode(hdrJson));\n  } catch (e) {\n    throw new Error(`w7-frame: header JSON parse failed: ${e?.message || e}`);\n  }\n  if (!header || !Array.isArray(header.inodes) || typeof header.chunkCount !== \"number\") {\n    throw new Error(\"w7-frame: header missing required fields (inodes / chunkCount)\");\n  }\n  const chunkIter = {\n    [Symbol.asyncIterator]() {\n      let idx = 0;\n      let exhausted = false;\n      return {\n        async next() {\n          if (exhausted) return { value: void 0, done: true };\n          if (idx >= header.chunkCount) {\n            const trailer = await buf.readExact(4, \"trailer\");\n            if (!bytesEqual(trailer, W7_TRAILER)) {\n              throw new Error(\n                `w7-frame: bad trailer, expected NEND, got ${Array.from(trailer).map((b) => String.fromCharCode(b)).join(\"\")}`\n              );\n            }\n            try {\n              reader.releaseLock();\n            } catch {\n            }\n            exhausted = true;\n            return { value: void 0, done: true };\n          }\n          const pathLenBytes = await buf.readExact(4, \"chunk-path-length\");\n          const pathLen = readU32LE(pathLenBytes, 0);\n          if (pathLen < 0 || pathLen > 64 * 1024) {\n            throw new Error(`w7-frame: implausible path length ${pathLen} at chunk ${idx}`);\n          }\n          const pathBytes = await buf.readExact(pathLen, \"chunk-path\");\n          const path = new TextDecoder().decode(pathBytes);\n          const chunkIdBytes = await buf.readExact(4, \"chunk-id\");\n          const chunkId = readU32LE(chunkIdBytes, 0);\n          const dataLenBytes = await buf.readExact(4, \"chunk-data-length\");\n          const dataLen = readU32LE(dataLenBytes, 0);\n          if (dataLen < 0 || dataLen > 64 * 1024 * 1024) {\n            throw new Error(`w7-frame: implausible data length ${dataLen} at chunk ${idx}`);\n          }\n          const data = await buf.readExact(dataLen, \"chunk-data\");\n          idx++;\n          return { value: { path, chunkId, data }, done: false };\n        },\n        async return() {\n          exhausted = true;\n          try {\n            reader.releaseLock();\n          } catch {\n          }\n          return { value: void 0, done: true };\n        }\n      };\n    }\n  };\n  return {\n    inodes: header.inodes,\n    deletePaths: header.deletePaths,\n    chunkIter\n  };\n}\nfunction writeU32LE(out, off, n) {\n  out[off] = n & 255;\n  out[off + 1] = n >>> 8 & 255;\n  out[off + 2] = n >>> 16 & 255;\n  out[off + 3] = n >>> 24 & 255;\n}\nfunction readU32LE(buf, off) {\n  return (buf[off] | buf[off + 1] << 8 | buf[off + 2] << 16 | buf[off + 3] << 24) >>> 0;\n}\nfunction bytesEqual(a, b) {\n  if (a.length !== b.length) return false;\n  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;\n  return true;\n}\nvar ByteBuffer = class {\n  constructor(reader) {\n    this.reader = reader;\n  }\n  chunks = [];\n  avail = 0;\n  done = false;\n  async readExact(n, label) {\n    if (n === 0) return new Uint8Array(0);\n    while (this.avail < n) {\n      if (this.done) {\n        throw new Error(\n          `w7-frame: stream ended ${this.avail} bytes into expected ${n}-byte ${label}`\n        );\n      }\n      const { value, done } = await this.reader.read();\n      if (done) {\n        this.done = true;\n      } else if (value && value.length > 0) {\n        this.chunks.push(value);\n        this.avail += value.length;\n      }\n    }\n    const out = new Uint8Array(n);\n    let copied = 0;\n    while (copied < n) {\n      const head = this.chunks[0];\n      const take = Math.min(head.length, n - copied);\n      out.set(head.subarray(0, take), copied);\n      copied += take;\n      if (take === head.length) {\n        this.chunks.shift();\n      } else {\n        this.chunks[0] = head.subarray(take);\n      }\n    }\n    this.avail -= n;\n    return out;\n  }\n};";
-export const W7_FRAME_PREAMBLE_SIZE = 7954;
+export const TAR_STREAM_PREAMBLE = "// packages/worker/src/npm/tarball-stream.ts\nvar MAX_FILE_BYTES = 2e7;\nfunction parseTarHeader(block) {\n  if (block[0] === 0) return null;\n  let name = \"\";\n  for (let i = 0; i < 100 && block[i] !== 0; i++) {\n    name += String.fromCharCode(block[i]);\n  }\n  let prefix = \"\";\n  for (let i = 345; i < 500 && block[i] !== 0; i++) {\n    prefix += String.fromCharCode(block[i]);\n  }\n  if (prefix) name = prefix + \"/\" + name;\n  name = name.replace(/^package\\//, \"\");\n  let sizeStr = \"\";\n  for (let i = 124; i < 136 && block[i] !== 0; i++) {\n    sizeStr += String.fromCharCode(block[i]);\n  }\n  const size = parseInt(sizeStr.trim(), 8) || 0;\n  const typeFlag = block[156];\n  return { name, size, typeFlag };\n}\nasync function* readableStreamToAsyncIterable(rs) {\n  const reader = rs.getReader();\n  try {\n    while (true) {\n      const { value, done } = await reader.read();\n      if (done) return;\n      if (value && value.length > 0) yield value;\n    }\n  } finally {\n    try {\n      reader.releaseLock();\n    } catch {\n    }\n  }\n}\nasync function* streamTarEntries(source, onSkip) {\n  let carry = new Uint8Array(0);\n  let state = { kind: \"header\" };\n  function concat(a, b) {\n    if (a.length === 0) return b;\n    if (b.length === 0) return a;\n    const out = new Uint8Array(a.length + b.length);\n    out.set(a, 0);\n    out.set(b, a.length);\n    return out;\n  }\n  for await (const chunkRaw of source) {\n    let buf = concat(carry, chunkRaw);\n    let cursor = 0;\n    while (true) {\n      if (state.kind === \"header\") {\n        if (buf.length - cursor < 512) break;\n        const header = buf.subarray(cursor, cursor + 512);\n        const parsed = parseTarHeader(header);\n        cursor += 512;\n        if (!parsed) return;\n        const { name, size, typeFlag } = parsed;\n        const pad = size === 0 ? 0 : (512 - size % 512) % 512;\n        const isRegularFile = typeFlag === 48 || typeFlag === 0;\n        if (size === 0) {\n          if (isRegularFile && name) {\n            yield { name, data: new Uint8Array(0) };\n          }\n          state = { kind: \"header\" };\n          continue;\n        }\n        if (!isRegularFile || !name || size > MAX_FILE_BYTES) {\n          if (onSkip) {\n            const reason = !isRegularFile ? \"non-regular\" : !name ? \"no-name\" : \"too-large\";\n            try {\n              onSkip(name, size, reason);\n            } catch {\n            }\n          }\n          state = { kind: \"skip\", remaining: size + pad };\n          continue;\n        }\n        state = {\n          kind: \"file\",\n          name,\n          remaining: size,\n          fileBuf: new Uint8Array(size),\n          fileOffset: 0,\n          pad,\n          skip: false\n        };\n        continue;\n      }\n      if (state.kind === \"file\") {\n        const avail2 = buf.length - cursor;\n        if (avail2 === 0) break;\n        if (state.remaining > 0) {\n          const take2 = Math.min(state.remaining, avail2);\n          state.fileBuf.set(buf.subarray(cursor, cursor + take2), state.fileOffset);\n          state.fileOffset += take2;\n          state.remaining -= take2;\n          cursor += take2;\n          if (state.remaining > 0) break;\n        }\n        if (state.pad > 0) {\n          const avail22 = buf.length - cursor;\n          if (avail22 === 0) break;\n          const take2 = Math.min(state.pad, avail22);\n          state.pad -= take2;\n          cursor += take2;\n          if (state.pad > 0) break;\n        }\n        yield { name: state.name, data: state.fileBuf };\n        state = { kind: \"header\" };\n        continue;\n      }\n      const avail = buf.length - cursor;\n      if (avail === 0) break;\n      const take = Math.min(state.remaining, avail);\n      cursor += take;\n      state.remaining -= take;\n      if (state.remaining > 0) break;\n      state = { kind: \"header\" };\n    }\n    if (cursor >= buf.length) {\n      carry = new Uint8Array(0);\n    } else if (cursor === 0) {\n      carry = buf;\n    } else {\n      carry = buf.slice(cursor);\n    }\n  }\n}";
+export const TAR_STREAM_PREAMBLE_SIZE = 3948;
+export const W7_FRAME_PREAMBLE = "// packages/worker/src/_shared/w7-frame.ts\nvar W7_MAGIC = new Uint8Array([78, 87, 55, 1]);\nvar W7_TRAILER = new Uint8Array([78, 69, 78, 68]);\nvar ENCODER_QUEUE_HWM = 256 * 1024;\nvar ENCODER_EMIT_CAP = 64 * 1024;\nvar _peakInFlight = 0;\nvar _currentInFlight = 0;\nfunction _peakInFlightBytes() {\n  return _peakInFlight;\n}\nfunction _resetPeakInFlightBytes() {\n  _peakInFlight = 0;\n  _currentInFlight = 0;\n}\nfunction _trackInFlightAdd(n) {\n  _currentInFlight += n;\n  if (_currentInFlight > _peakInFlight) _peakInFlight = _currentInFlight;\n}\nfunction _trackInFlightSub(n) {\n  _currentInFlight -= n;\n  if (_currentInFlight < 0) _currentInFlight = 0;\n}\nfunction encodeWriteBatchStream(payload) {\n  const inodes = payload.inodes ?? [];\n  const chunks = payload.chunks ?? [];\n  const deletePaths = payload.deletePaths;\n  let phase = 0;\n  let chunkIdx = 0;\n  const enc = new TextEncoder();\n  const headerBytes = enc.encode(JSON.stringify({\n    inodes,\n    deletePaths,\n    chunkCount: chunks.length\n  }));\n  const source = {\n    type: \"bytes\",\n    pull(controller) {\n      try {\n        if (phase === 0) {\n          enqueue(controller, W7_MAGIC.slice());\n          phase = 1;\n          return;\n        }\n        if (phase === 1) {\n          const hdr = new Uint8Array(4 + headerBytes.length);\n          writeU32LE(hdr, 0, headerBytes.length);\n          hdr.set(headerBytes, 4);\n          enqueue(controller, hdr);\n          phase = 2;\n          return;\n        }\n        if (phase === 2) {\n          if (chunkIdx >= chunks.length) {\n            phase = 3;\n          } else {\n            const c = chunks[chunkIdx++];\n            const pathBytes = enc.encode(c.path);\n            const data = c.data instanceof Uint8Array ? c.data : new Uint8Array(c.data);\n            const headerSize = 4 + pathBytes.length + 4 + 4;\n            const headerOut = new Uint8Array(headerSize);\n            let o = 0;\n            writeU32LE(headerOut, o, pathBytes.length);\n            o += 4;\n            headerOut.set(pathBytes, o);\n            o += pathBytes.length;\n            writeU32LE(headerOut, o, c.chunkId);\n            o += 4;\n            writeU32LE(headerOut, o, data.length);\n            o += 4;\n            enqueue(controller, headerOut);\n            if (data.length === 0) return;\n            if (data.length <= ENCODER_EMIT_CAP) {\n              enqueue(controller, data);\n            } else {\n              for (let i = 0; i < data.length; i += ENCODER_EMIT_CAP) {\n                enqueue(controller, data.subarray(i, Math.min(i + ENCODER_EMIT_CAP, data.length)));\n              }\n            }\n            return;\n          }\n        }\n        if (phase === 3) {\n          enqueue(controller, W7_TRAILER.slice());\n          phase = 4;\n          controller.close();\n          return;\n        }\n        controller.close();\n      } catch (e) {\n        controller.error(e);\n      }\n    },\n    cancel() {\n      phase = 4;\n      chunkIdx = chunks.length;\n    }\n  };\n  return new ReadableStream(source, {\n    // Byte streams (`type: 'bytes'`) MUST use the default byte-counted\n    // strategy: highWaterMark is in bytes, size is implicit. Custom\n    // `size` callbacks are forbidden — they throw at construction.\n    highWaterMark: ENCODER_QUEUE_HWM\n  });\n  function enqueue(controller, bytes) {\n    _trackInFlightAdd(bytes.byteLength);\n    controller.enqueue(bytes);\n    queueMicrotask(() => _trackInFlightSub(bytes.byteLength));\n  }\n}\nasync function decodeWriteBatchStream(stream) {\n  const reader = stream.getReader();\n  const buf = new ByteBuffer(reader);\n  const magic = await buf.readExact(4, \"magic\");\n  if (!bytesEqual(magic, W7_MAGIC)) {\n    try {\n      reader.releaseLock();\n    } catch {\n    }\n    throw new Error(`w7-frame: bad magic, expected NW7\\\\x01, got ${Array.from(magic).map((b) => b.toString(16)).join(\" \")}`);\n  }\n  const hdrLenBytes = await buf.readExact(4, \"header-length\");\n  const hdrLen = readU32LE(hdrLenBytes, 0);\n  if (hdrLen < 0 || hdrLen > 64 * 1024 * 1024) {\n    throw new Error(`w7-frame: implausible header length ${hdrLen}`);\n  }\n  const hdrJson = await buf.readExact(hdrLen, \"header-json\");\n  let header;\n  try {\n    header = JSON.parse(new TextDecoder().decode(hdrJson));\n  } catch (e) {\n    throw new Error(`w7-frame: header JSON parse failed: ${e?.message || e}`);\n  }\n  if (!header || !Array.isArray(header.inodes) || typeof header.chunkCount !== \"number\") {\n    throw new Error(\"w7-frame: header missing required fields (inodes / chunkCount)\");\n  }\n  const chunkIter = {\n    [Symbol.asyncIterator]() {\n      let idx = 0;\n      let exhausted = false;\n      return {\n        async next() {\n          if (exhausted) return { value: void 0, done: true };\n          if (idx >= header.chunkCount) {\n            const trailer = await buf.readExact(4, \"trailer\");\n            if (!bytesEqual(trailer, W7_TRAILER)) {\n              throw new Error(\n                `w7-frame: bad trailer, expected NEND, got ${Array.from(trailer).map((b) => String.fromCharCode(b)).join(\"\")}`\n              );\n            }\n            try {\n              reader.releaseLock();\n            } catch {\n            }\n            exhausted = true;\n            return { value: void 0, done: true };\n          }\n          const pathLenBytes = await buf.readExact(4, \"chunk-path-length\");\n          const pathLen = readU32LE(pathLenBytes, 0);\n          if (pathLen < 0 || pathLen > 64 * 1024) {\n            throw new Error(`w7-frame: implausible path length ${pathLen} at chunk ${idx}`);\n          }\n          const pathBytes = await buf.readExact(pathLen, \"chunk-path\");\n          const path = new TextDecoder().decode(pathBytes);\n          const chunkIdBytes = await buf.readExact(4, \"chunk-id\");\n          const chunkId = readU32LE(chunkIdBytes, 0);\n          const dataLenBytes = await buf.readExact(4, \"chunk-data-length\");\n          const dataLen = readU32LE(dataLenBytes, 0);\n          if (dataLen < 0 || dataLen > 64 * 1024 * 1024) {\n            throw new Error(`w7-frame: implausible data length ${dataLen} at chunk ${idx}`);\n          }\n          const data = await buf.readExact(dataLen, \"chunk-data\");\n          idx++;\n          return { value: { path, chunkId, data }, done: false };\n        },\n        async return() {\n          exhausted = true;\n          try {\n            reader.releaseLock();\n          } catch {\n          }\n          return { value: void 0, done: true };\n        }\n      };\n    }\n  };\n  return {\n    inodes: header.inodes,\n    deletePaths: header.deletePaths,\n    chunkIter\n  };\n}\nfunction writeU32LE(out, off, n) {\n  out[off] = n & 255;\n  out[off + 1] = n >>> 8 & 255;\n  out[off + 2] = n >>> 16 & 255;\n  out[off + 3] = n >>> 24 & 255;\n}\nfunction readU32LE(buf, off) {\n  return (buf[off] | buf[off + 1] << 8 | buf[off + 2] << 16 | buf[off + 3] << 24) >>> 0;\n}\nfunction bytesEqual(a, b) {\n  if (a.length !== b.length) return false;\n  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;\n  return true;\n}\nvar ByteBuffer = class {\n  constructor(reader) {\n    this.reader = reader;\n  }\n  chunks = [];\n  avail = 0;\n  done = false;\n  async readExact(n, label) {\n    if (n === 0) return new Uint8Array(0);\n    while (this.avail < n) {\n      if (this.done) {\n        throw new Error(\n          `w7-frame: stream ended ${this.avail} bytes into expected ${n}-byte ${label}`\n        );\n      }\n      const { value, done } = await this.reader.read();\n      if (done) {\n        this.done = true;\n      } else if (value && value.length > 0) {\n        this.chunks.push(value);\n        this.avail += value.length;\n      }\n    }\n    const out = new Uint8Array(n);\n    let copied = 0;\n    while (copied < n) {\n      const head = this.chunks[0];\n      const take = Math.min(head.length, n - copied);\n      out.set(head.subarray(0, take), copied);\n      copied += take;\n      if (take === head.length) {\n        this.chunks.shift();\n      } else {\n        this.chunks[0] = head.subarray(take);\n      }\n    }\n    this.avail -= n;\n    return out;\n  }\n};";
+export const W7_FRAME_PREAMBLE_SIZE = 7970;

package/dist/router/index.d.ts

@@ -1,11 +1,11 @@
 /**
  * router/index.ts — `createNimbusHandler` factory.
  *
- * The Worker entry's `default { fetch }` is now a thin call into this
- * factory. The factory is the **composable surface** an embedder gets via
- * `@nimbus-sh/worker`:
+ * The Worker entry's `default { fetch }` is a thin call into this
+ * factory. Application embedders get the composable surface via
+ * `@nimbus-sh/sdk/worker`:
  *
- *   import { NimbusSession, createNimbusHandler } from '@nimbus-sh/worker';
+ *   import { NimbusSession, createNimbusHandler } from '@nimbus-sh/sdk/worker';
  *   export { NimbusSession };
  *   export default createNimbusHandler({
  *     // Optional embedder hooks (all default no-op):
@@ -31,6 +31,8 @@
  *   - The default `createNimbusHandler()` (zero args) is the
  *     "ship-Nimbus-as-is" case — exactly what `apps/dogfood/` does.
  */
+import { type NimbusSdkRouterConfig } from './remote-api.js';
+export type { NimbusConfig as NimbusSdkConfig, NimbusRemoteApiConfig, NimbusRuntimePolicy, NimbusSandboxProfile, NimbusSdkRouterConfig, } from './remote-api.js';
 /**
  * Lifecycle event a hook receives. Hooks should treat this as read-only.
  */
@@ -50,8 +52,8 @@ export interface NimbusHookContext {
  * NOT short-circuit the request.
  *
  * `onSessionStart` fires on the first WebSocket upgrade for a session
- * (not on every HTTP API call). `onSessionEnd` fires when the DO emits a
- * session-end event (not implemented v1; reserved).
+ * (not on every HTTP API call). `onSessionEnd` is reserved for future
+ * session lifecycle events.
  */
 export interface NimbusHooks {
     /**
@@ -110,6 +112,8 @@ export interface CreateNimbusHandlerOptions {
     routes?: CustomRoutes;
     /** Auth-mode selector. Default `'auto'`. */
     auth?: NimbusAuthConfig;
+    /** Programmatic SDK HTTP surface. Disabled unless explicitly enabled. */
+    sdk?: NimbusSdkRouterConfig;
 }
 /**
  * The shape every `default export` Workers handler must satisfy.
@@ -124,14 +128,14 @@ export interface NimbusHandler {
  *
  * @example minimal embedder
  * ```ts
- * import { NimbusSession, createNimbusHandler } from '@nimbus-sh/worker';
+ * import { NimbusSession, createNimbusHandler } from '@nimbus-sh/sdk/worker';
  * export { NimbusSession };
  * export default createNimbusHandler();
  * ```
  *
  * @example embedder with auth + a custom route
  * ```ts
- * import { NimbusSession, createNimbusHandler } from '@nimbus-sh/worker';
+ * import { NimbusSession, createNimbusHandler } from '@nimbus-sh/sdk/worker';
  * import { issueNimbusToken } from '@nimbus-sh/sdk/token';
  *
  * export { NimbusSession };

package/dist/router/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAsBH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CA+Gf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAqBH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAkHf"}

package/dist/router/index.js

@@ -1,11 +1,11 @@
 /**
  * router/index.ts — `createNimbusHandler` factory.
  *
- * The Worker entry's `default { fetch }` is now a thin call into this
- * factory. The factory is the **composable surface** an embedder gets via
- * `@nimbus-sh/worker`:
+ * The Worker entry's `default { fetch }` is a thin call into this
+ * factory. Application embedders get the composable surface via
+ * `@nimbus-sh/sdk/worker`:
  *
- *   import { NimbusSession, createNimbusHandler } from '@nimbus-sh/worker';
+ *   import { NimbusSession, createNimbusHandler } from '@nimbus-sh/sdk/worker';
  *   export { NimbusSession };
  *   export default createNimbusHandler({
  *     // Optional embedder hooks (all default no-op):
@@ -35,20 +35,21 @@ import { generateSessionId, isValidSessionId, } from '../_shared/session-id.js';
 import { parseSessionRoute, forwardToSession, renderInvalidSessionHtml, SESSION_ROUTE_PREFIX, LEGACY_PUBLIC_DO_SEGMENT, } from '../_shared/session-router.js';
 import { verifyRequestToken, authErrorResponse, NimbusAuthError, NimbusTokenMalformedError, } from '../auth/index.js';
 import { setCtxExports } from '../session/ctx-exports.js';
+import { handleNimbusRemoteApi, } from './remote-api.js';
 /**
  * Build a Nimbus default-export handler. The returned object is exactly
  * what `export default` expects in a Workers entry module.
  *
  * @example minimal embedder
  * ```ts
- * import { NimbusSession, createNimbusHandler } from '@nimbus-sh/worker';
+ * import { NimbusSession, createNimbusHandler } from '@nimbus-sh/sdk/worker';
  * export { NimbusSession };
  * export default createNimbusHandler();
  * ```
  *
  * @example embedder with auth + a custom route
  * ```ts
- * import { NimbusSession, createNimbusHandler } from '@nimbus-sh/worker';
+ * import { NimbusSession, createNimbusHandler } from '@nimbus-sh/sdk/worker';
  * import { issueNimbusToken } from '@nimbus-sh/sdk/token';
  *
  * export { NimbusSession };
@@ -94,6 +95,9 @@ export function createNimbusHandler(options = {}) {
                 }
             }
             const url = new URL(request.url);
+            const sdkResponse = await handleNimbusRemoteApi(request, env, options.sdk);
+            if (sdkResponse)
+                return sdkResponse;
             // ── /new — spawn a fresh session and redirect ───────────────────
             if (url.pathname === '/new') {
                 if (request.method !== 'POST' && request.method !== 'GET') {

package/dist/router/remote-api.d.ts

@@ -0,0 +1,44 @@
+export type NimbusRuntimeName = 'node' | 'bun' | 'npm' | 'git' | 'python' | 'ruby' | 'clang' | 'shell' | (string & {});
+export interface NimbusRuntimePolicy {
+    preinstall?: string[];
+    onDemand?: boolean;
+    allow?: NimbusRuntimeName[];
+}
+export interface NimbusSandboxProfile {
+    root?: string;
+    runtimes?: NimbusRuntimePolicy;
+    tools?: {
+        namespace?: string;
+        kind?: string;
+    };
+    preview?: {
+        baseUrl?: string;
+        pathStyle?: boolean;
+    };
+}
+export interface NimbusConfig {
+    endpoint?: string;
+    sandboxes?: Record<string, NimbusSandboxProfile>;
+}
+export interface NimbusRemoteApiConfig {
+    /** Enable the remote programmatic sandbox API. */
+    enabled?: boolean;
+    /** Route prefix. Defaults to `/api/nimbus/v1`. */
+    basePath?: string;
+    /**
+     * Permit unauthenticated remote calls when JWT_SECRET is absent. This is
+     * intended only for private development deployments.
+     */
+    allowLegacy?: boolean;
+    /**
+     * Required token scopes. Tokens without an explicit `scopes` claim keep the
+     * existing full-trust semantics.
+     */
+    requiredScopes?: string[];
+}
+export interface NimbusSdkRouterConfig {
+    remote?: boolean | NimbusRemoteApiConfig;
+    config?: NimbusConfig;
+}
+export declare function handleNimbusRemoteApi(request: Request, env: any, sdk: NimbusSdkRouterConfig | undefined): Promise<Response | null>;
+//# sourceMappingURL=remote-api.d.ts.map

package/dist/router/remote-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAqBD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA8D1B"}