@nimbus-sh/worker 0.1.1 → 0.1.2

package/dist/index.d.ts

@@ -25,7 +25,7 @@ import { NimbusSession, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, Ni
 import { SupervisorRPC } from './session/supervisor-rpc.js';
 import { CirrusHmrRPC } from './facets/real-vite-hmr.js';
 export { createNimbusHandler } from './router/index.js';
-export type { NimbusHandler, NimbusHooks, NimbusHookContext, CustomRoutes, CreateNimbusHandlerOptions, AuthMode, NimbusAuthConfig, } from './router/index.js';
+export type { NimbusHandler, NimbusHooks, NimbusHookContext, CustomRoutes, CreateNimbusHandlerOptions, AuthMode, NimbusAuthConfig, NimbusRemoteApiConfig, NimbusRuntimePolicy, NimbusSandboxProfile, NimbusSdkConfig, NimbusSdkRouterConfig, } from './router/index.js';
 export { issueNimbusToken, verifyNimbusToken, NimbusAuthError, } from './auth/index.js';
 export type { NimbusAuthEnv, NimbusTokenClaims, VerifiedNimbusToken, } from './auth/index.js';
 export { NimbusSession, SupervisorRPC, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, CirrusHmrRPC, };

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAUzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,YAAY,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,0BAA0B,EAC1B,QAAQ,EACR,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAmBzB,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACZ,YAAY,GACb,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,GAAG,CAEnC;;AAOD,wBAAqC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAUzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,YAAY,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,0BAA0B,EAC1B,QAAQ,EACR,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AAmBzB,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACZ,YAAY,GACb,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,GAAG,CAEnC;;AAOD,wBAAqC"}

package/dist/loaders/generated-workers.d.ts

@@ -15,9 +15,9 @@
  * W7-frame symbols:   encodeWriteBatchStream, decodeWriteBatchStream,
  *   W7_MAGIC, W7_TRAILER.
  *
- * Generated at: 2026-06-04T21:03:19.350Z
- * Tar size: 3.84 KiB
- * W7 size:  7.77 KiB
+ * Generated at: 2026-06-04T22:29:13.391Z
+ * Tar size: 3.86 KiB
+ * W7 size:  7.78 KiB
  */
 export declare const TAR_STREAM_PREAMBLE: string;
 export declare const TAR_STREAM_PREAMBLE_SIZE: number;

package/dist/loaders/generated-workers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generated-workers.d.ts","sourceRoot":"","sources":["../../src/loaders/generated-workers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,mBAAmB,EAAE,MAAygI,CAAC;AAE5iI,eAAO,MAAM,wBAAwB,EAAE,MAAa,CAAC;AAErD,eAAO,MAAM,iBAAiB,EAAE,MAA+iQ,CAAC;AAEhlQ,eAAO,MAAM,sBAAsB,EAAE,MAAa,CAAC"}
+{"version":3,"file":"generated-workers.d.ts","sourceRoot":"","sources":["../../src/loaders/generated-workers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,eAAO,MAAM,mBAAmB,EAAE,MAAyhI,CAAC;AAE5jI,eAAO,MAAM,wBAAwB,EAAE,MAAa,CAAC;AAErD,eAAO,MAAM,iBAAiB,EAAE,MAA+jQ,CAAC;AAEhmQ,eAAO,MAAM,sBAAsB,EAAE,MAAa,CAAC"}

package/dist/loaders/generated-workers.js

@@ -15,11 +15,11 @@
  * W7-frame symbols:   encodeWriteBatchStream, decodeWriteBatchStream,
  *   W7_MAGIC, W7_TRAILER.
  *
- * Generated at: 2026-06-04T21:03:19.350Z
- * Tar size: 3.84 KiB
- * W7 size:  7.77 KiB
+ * Generated at: 2026-06-04T22:29:13.391Z
+ * Tar size: 3.86 KiB
+ * W7 size:  7.78 KiB
  */
-export const TAR_STREAM_PREAMBLE = "// src/npm/tarball-stream.ts\nvar MAX_FILE_BYTES = 2e7;\nfunction parseTarHeader(block) {\n  if (block[0] === 0) return null;\n  let name = \"\";\n  for (let i = 0; i < 100 && block[i] !== 0; i++) {\n    name += String.fromCharCode(block[i]);\n  }\n  let prefix = \"\";\n  for (let i = 345; i < 500 && block[i] !== 0; i++) {\n    prefix += String.fromCharCode(block[i]);\n  }\n  if (prefix) name = prefix + \"/\" + name;\n  name = name.replace(/^package\\//, \"\");\n  let sizeStr = \"\";\n  for (let i = 124; i < 136 && block[i] !== 0; i++) {\n    sizeStr += String.fromCharCode(block[i]);\n  }\n  const size = parseInt(sizeStr.trim(), 8) || 0;\n  const typeFlag = block[156];\n  return { name, size, typeFlag };\n}\nasync function* readableStreamToAsyncIterable(rs) {\n  const reader = rs.getReader();\n  try {\n    while (true) {\n      const { value, done } = await reader.read();\n      if (done) return;\n      if (value && value.length > 0) yield value;\n    }\n  } finally {\n    try {\n      reader.releaseLock();\n    } catch {\n    }\n  }\n}\nasync function* streamTarEntries(source, onSkip) {\n  let carry = new Uint8Array(0);\n  let state = { kind: \"header\" };\n  function concat(a, b) {\n    if (a.length === 0) return b;\n    if (b.length === 0) return a;\n    const out = new Uint8Array(a.length + b.length);\n    out.set(a, 0);\n    out.set(b, a.length);\n    return out;\n  }\n  for await (const chunkRaw of source) {\n    let buf = concat(carry, chunkRaw);\n    let cursor = 0;\n    while (true) {\n      if (state.kind === \"header\") {\n        if (buf.length - cursor < 512) break;\n        const header = buf.subarray(cursor, cursor + 512);\n        const parsed = parseTarHeader(header);\n        cursor += 512;\n        if (!parsed) return;\n        const { name, size, typeFlag } = parsed;\n        const pad = size === 0 ? 0 : (512 - size % 512) % 512;\n        const isRegularFile = typeFlag === 48 || typeFlag === 0;\n        if (size === 0) {\n          if (isRegularFile && name) {\n            yield { name, data: new Uint8Array(0) };\n          }\n          state = { kind: \"header\" };\n          continue;\n        }\n        if (!isRegularFile || !name || size > MAX_FILE_BYTES) {\n          if (onSkip) {\n            const reason = !isRegularFile ? \"non-regular\" : !name ? \"no-name\" : \"too-large\";\n            try {\n              onSkip(name, size, reason);\n            } catch {\n            }\n          }\n          state = { kind: \"skip\", remaining: size + pad };\n          continue;\n        }\n        state = {\n          kind: \"file\",\n          name,\n          remaining: size,\n          fileBuf: new Uint8Array(size),\n          fileOffset: 0,\n          pad,\n          skip: false\n        };\n        continue;\n      }\n      if (state.kind === \"file\") {\n        const avail2 = buf.length - cursor;\n        if (avail2 === 0) break;\n        if (state.remaining > 0) {\n          const take2 = Math.min(state.remaining, avail2);\n          state.fileBuf.set(buf.subarray(cursor, cursor + take2), state.fileOffset);\n          state.fileOffset += take2;\n          state.remaining -= take2;\n          cursor += take2;\n          if (state.remaining > 0) break;\n        }\n        if (state.pad > 0) {\n          const avail22 = buf.length - cursor;\n          if (avail22 === 0) break;\n          const take2 = Math.min(state.pad, avail22);\n          state.pad -= take2;\n          cursor += take2;\n          if (state.pad > 0) break;\n        }\n        yield { name: state.name, data: state.fileBuf };\n        state = { kind: \"header\" };\n        continue;\n      }\n      const avail = buf.length - cursor;\n      if (avail === 0) break;\n      const take = Math.min(state.remaining, avail);\n      cursor += take;\n      state.remaining -= take;\n      if (state.remaining > 0) break;\n      state = { kind: \"header\" };\n    }\n    if (cursor >= buf.length) {\n      carry = new Uint8Array(0);\n    } else if (cursor === 0) {\n      carry = buf;\n    } else {\n      carry = buf.slice(cursor);\n    }\n  }\n}";
-export const TAR_STREAM_PREAMBLE_SIZE = 3932;
-export const W7_FRAME_PREAMBLE = "// src/_shared/w7-frame.ts\nvar W7_MAGIC = new Uint8Array([78, 87, 55, 1]);\nvar W7_TRAILER = new Uint8Array([78, 69, 78, 68]);\nvar ENCODER_QUEUE_HWM = 256 * 1024;\nvar ENCODER_EMIT_CAP = 64 * 1024;\nvar _peakInFlight = 0;\nvar _currentInFlight = 0;\nfunction _peakInFlightBytes() {\n  return _peakInFlight;\n}\nfunction _resetPeakInFlightBytes() {\n  _peakInFlight = 0;\n  _currentInFlight = 0;\n}\nfunction _trackInFlightAdd(n) {\n  _currentInFlight += n;\n  if (_currentInFlight > _peakInFlight) _peakInFlight = _currentInFlight;\n}\nfunction _trackInFlightSub(n) {\n  _currentInFlight -= n;\n  if (_currentInFlight < 0) _currentInFlight = 0;\n}\nfunction encodeWriteBatchStream(payload) {\n  const inodes = payload.inodes ?? [];\n  const chunks = payload.chunks ?? [];\n  const deletePaths = payload.deletePaths;\n  let phase = 0;\n  let chunkIdx = 0;\n  const enc = new TextEncoder();\n  const headerBytes = enc.encode(JSON.stringify({\n    inodes,\n    deletePaths,\n    chunkCount: chunks.length\n  }));\n  const source = {\n    type: \"bytes\",\n    pull(controller) {\n      try {\n        if (phase === 0) {\n          enqueue(controller, W7_MAGIC.slice());\n          phase = 1;\n          return;\n        }\n        if (phase === 1) {\n          const hdr = new Uint8Array(4 + headerBytes.length);\n          writeU32LE(hdr, 0, headerBytes.length);\n          hdr.set(headerBytes, 4);\n          enqueue(controller, hdr);\n          phase = 2;\n          return;\n        }\n        if (phase === 2) {\n          if (chunkIdx >= chunks.length) {\n            phase = 3;\n          } else {\n            const c = chunks[chunkIdx++];\n            const pathBytes = enc.encode(c.path);\n            const data = c.data instanceof Uint8Array ? c.data : new Uint8Array(c.data);\n            const headerSize = 4 + pathBytes.length + 4 + 4;\n            const headerOut = new Uint8Array(headerSize);\n            let o = 0;\n            writeU32LE(headerOut, o, pathBytes.length);\n            o += 4;\n            headerOut.set(pathBytes, o);\n            o += pathBytes.length;\n            writeU32LE(headerOut, o, c.chunkId);\n            o += 4;\n            writeU32LE(headerOut, o, data.length);\n            o += 4;\n            enqueue(controller, headerOut);\n            if (data.length === 0) return;\n            if (data.length <= ENCODER_EMIT_CAP) {\n              enqueue(controller, data);\n            } else {\n              for (let i = 0; i < data.length; i += ENCODER_EMIT_CAP) {\n                enqueue(controller, data.subarray(i, Math.min(i + ENCODER_EMIT_CAP, data.length)));\n              }\n            }\n            return;\n          }\n        }\n        if (phase === 3) {\n          enqueue(controller, W7_TRAILER.slice());\n          phase = 4;\n          controller.close();\n          return;\n        }\n        controller.close();\n      } catch (e) {\n        controller.error(e);\n      }\n    },\n    cancel() {\n      phase = 4;\n      chunkIdx = chunks.length;\n    }\n  };\n  return new ReadableStream(source, {\n    // Byte streams (`type: 'bytes'`) MUST use the default byte-counted\n    // strategy: highWaterMark is in bytes, size is implicit. Custom\n    // `size` callbacks are forbidden — they throw at construction.\n    highWaterMark: ENCODER_QUEUE_HWM\n  });\n  function enqueue(controller, bytes) {\n    _trackInFlightAdd(bytes.byteLength);\n    controller.enqueue(bytes);\n    queueMicrotask(() => _trackInFlightSub(bytes.byteLength));\n  }\n}\nasync function decodeWriteBatchStream(stream) {\n  const reader = stream.getReader();\n  const buf = new ByteBuffer(reader);\n  const magic = await buf.readExact(4, \"magic\");\n  if (!bytesEqual(magic, W7_MAGIC)) {\n    try {\n      reader.releaseLock();\n    } catch {\n    }\n    throw new Error(`w7-frame: bad magic, expected NW7\\\\x01, got ${Array.from(magic).map((b) => b.toString(16)).join(\" \")}`);\n  }\n  const hdrLenBytes = await buf.readExact(4, \"header-length\");\n  const hdrLen = readU32LE(hdrLenBytes, 0);\n  if (hdrLen < 0 || hdrLen > 64 * 1024 * 1024) {\n    throw new Error(`w7-frame: implausible header length ${hdrLen}`);\n  }\n  const hdrJson = await buf.readExact(hdrLen, \"header-json\");\n  let header;\n  try {\n    header = JSON.parse(new TextDecoder().decode(hdrJson));\n  } catch (e) {\n    throw new Error(`w7-frame: header JSON parse failed: ${e?.message || e}`);\n  }\n  if (!header || !Array.isArray(header.inodes) || typeof header.chunkCount !== \"number\") {\n    throw new Error(\"w7-frame: header missing required fields (inodes / chunkCount)\");\n  }\n  const chunkIter = {\n    [Symbol.asyncIterator]() {\n      let idx = 0;\n      let exhausted = false;\n      return {\n        async next() {\n          if (exhausted) return { value: void 0, done: true };\n          if (idx >= header.chunkCount) {\n            const trailer = await buf.readExact(4, \"trailer\");\n            if (!bytesEqual(trailer, W7_TRAILER)) {\n              throw new Error(\n                `w7-frame: bad trailer, expected NEND, got ${Array.from(trailer).map((b) => String.fromCharCode(b)).join(\"\")}`\n              );\n            }\n            try {\n              reader.releaseLock();\n            } catch {\n            }\n            exhausted = true;\n            return { value: void 0, done: true };\n          }\n          const pathLenBytes = await buf.readExact(4, \"chunk-path-length\");\n          const pathLen = readU32LE(pathLenBytes, 0);\n          if (pathLen < 0 || pathLen > 64 * 1024) {\n            throw new Error(`w7-frame: implausible path length ${pathLen} at chunk ${idx}`);\n          }\n          const pathBytes = await buf.readExact(pathLen, \"chunk-path\");\n          const path = new TextDecoder().decode(pathBytes);\n          const chunkIdBytes = await buf.readExact(4, \"chunk-id\");\n          const chunkId = readU32LE(chunkIdBytes, 0);\n          const dataLenBytes = await buf.readExact(4, \"chunk-data-length\");\n          const dataLen = readU32LE(dataLenBytes, 0);\n          if (dataLen < 0 || dataLen > 64 * 1024 * 1024) {\n            throw new Error(`w7-frame: implausible data length ${dataLen} at chunk ${idx}`);\n          }\n          const data = await buf.readExact(dataLen, \"chunk-data\");\n          idx++;\n          return { value: { path, chunkId, data }, done: false };\n        },\n        async return() {\n          exhausted = true;\n          try {\n            reader.releaseLock();\n          } catch {\n          }\n          return { value: void 0, done: true };\n        }\n      };\n    }\n  };\n  return {\n    inodes: header.inodes,\n    deletePaths: header.deletePaths,\n    chunkIter\n  };\n}\nfunction writeU32LE(out, off, n) {\n  out[off] = n & 255;\n  out[off + 1] = n >>> 8 & 255;\n  out[off + 2] = n >>> 16 & 255;\n  out[off + 3] = n >>> 24 & 255;\n}\nfunction readU32LE(buf, off) {\n  return (buf[off] | buf[off + 1] << 8 | buf[off + 2] << 16 | buf[off + 3] << 24) >>> 0;\n}\nfunction bytesEqual(a, b) {\n  if (a.length !== b.length) return false;\n  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;\n  return true;\n}\nvar ByteBuffer = class {\n  constructor(reader) {\n    this.reader = reader;\n  }\n  chunks = [];\n  avail = 0;\n  done = false;\n  async readExact(n, label) {\n    if (n === 0) return new Uint8Array(0);\n    while (this.avail < n) {\n      if (this.done) {\n        throw new Error(\n          `w7-frame: stream ended ${this.avail} bytes into expected ${n}-byte ${label}`\n        );\n      }\n      const { value, done } = await this.reader.read();\n      if (done) {\n        this.done = true;\n      } else if (value && value.length > 0) {\n        this.chunks.push(value);\n        this.avail += value.length;\n      }\n    }\n    const out = new Uint8Array(n);\n    let copied = 0;\n    while (copied < n) {\n      const head = this.chunks[0];\n      const take = Math.min(head.length, n - copied);\n      out.set(head.subarray(0, take), copied);\n      copied += take;\n      if (take === head.length) {\n        this.chunks.shift();\n      } else {\n        this.chunks[0] = head.subarray(take);\n      }\n    }\n    this.avail -= n;\n    return out;\n  }\n};";
-export const W7_FRAME_PREAMBLE_SIZE = 7954;
+export const TAR_STREAM_PREAMBLE = "// packages/worker/src/npm/tarball-stream.ts\nvar MAX_FILE_BYTES = 2e7;\nfunction parseTarHeader(block) {\n  if (block[0] === 0) return null;\n  let name = \"\";\n  for (let i = 0; i < 100 && block[i] !== 0; i++) {\n    name += String.fromCharCode(block[i]);\n  }\n  let prefix = \"\";\n  for (let i = 345; i < 500 && block[i] !== 0; i++) {\n    prefix += String.fromCharCode(block[i]);\n  }\n  if (prefix) name = prefix + \"/\" + name;\n  name = name.replace(/^package\\//, \"\");\n  let sizeStr = \"\";\n  for (let i = 124; i < 136 && block[i] !== 0; i++) {\n    sizeStr += String.fromCharCode(block[i]);\n  }\n  const size = parseInt(sizeStr.trim(), 8) || 0;\n  const typeFlag = block[156];\n  return { name, size, typeFlag };\n}\nasync function* readableStreamToAsyncIterable(rs) {\n  const reader = rs.getReader();\n  try {\n    while (true) {\n      const { value, done } = await reader.read();\n      if (done) return;\n      if (value && value.length > 0) yield value;\n    }\n  } finally {\n    try {\n      reader.releaseLock();\n    } catch {\n    }\n  }\n}\nasync function* streamTarEntries(source, onSkip) {\n  let carry = new Uint8Array(0);\n  let state = { kind: \"header\" };\n  function concat(a, b) {\n    if (a.length === 0) return b;\n    if (b.length === 0) return a;\n    const out = new Uint8Array(a.length + b.length);\n    out.set(a, 0);\n    out.set(b, a.length);\n    return out;\n  }\n  for await (const chunkRaw of source) {\n    let buf = concat(carry, chunkRaw);\n    let cursor = 0;\n    while (true) {\n      if (state.kind === \"header\") {\n        if (buf.length - cursor < 512) break;\n        const header = buf.subarray(cursor, cursor + 512);\n        const parsed = parseTarHeader(header);\n        cursor += 512;\n        if (!parsed) return;\n        const { name, size, typeFlag } = parsed;\n        const pad = size === 0 ? 0 : (512 - size % 512) % 512;\n        const isRegularFile = typeFlag === 48 || typeFlag === 0;\n        if (size === 0) {\n          if (isRegularFile && name) {\n            yield { name, data: new Uint8Array(0) };\n          }\n          state = { kind: \"header\" };\n          continue;\n        }\n        if (!isRegularFile || !name || size > MAX_FILE_BYTES) {\n          if (onSkip) {\n            const reason = !isRegularFile ? \"non-regular\" : !name ? \"no-name\" : \"too-large\";\n            try {\n              onSkip(name, size, reason);\n            } catch {\n            }\n          }\n          state = { kind: \"skip\", remaining: size + pad };\n          continue;\n        }\n        state = {\n          kind: \"file\",\n          name,\n          remaining: size,\n          fileBuf: new Uint8Array(size),\n          fileOffset: 0,\n          pad,\n          skip: false\n        };\n        continue;\n      }\n      if (state.kind === \"file\") {\n        const avail2 = buf.length - cursor;\n        if (avail2 === 0) break;\n        if (state.remaining > 0) {\n          const take2 = Math.min(state.remaining, avail2);\n          state.fileBuf.set(buf.subarray(cursor, cursor + take2), state.fileOffset);\n          state.fileOffset += take2;\n          state.remaining -= take2;\n          cursor += take2;\n          if (state.remaining > 0) break;\n        }\n        if (state.pad > 0) {\n          const avail22 = buf.length - cursor;\n          if (avail22 === 0) break;\n          const take2 = Math.min(state.pad, avail22);\n          state.pad -= take2;\n          cursor += take2;\n          if (state.pad > 0) break;\n        }\n        yield { name: state.name, data: state.fileBuf };\n        state = { kind: \"header\" };\n        continue;\n      }\n      const avail = buf.length - cursor;\n      if (avail === 0) break;\n      const take = Math.min(state.remaining, avail);\n      cursor += take;\n      state.remaining -= take;\n      if (state.remaining > 0) break;\n      state = { kind: \"header\" };\n    }\n    if (cursor >= buf.length) {\n      carry = new Uint8Array(0);\n    } else if (cursor === 0) {\n      carry = buf;\n    } else {\n      carry = buf.slice(cursor);\n    }\n  }\n}";
+export const TAR_STREAM_PREAMBLE_SIZE = 3948;
+export const W7_FRAME_PREAMBLE = "// packages/worker/src/_shared/w7-frame.ts\nvar W7_MAGIC = new Uint8Array([78, 87, 55, 1]);\nvar W7_TRAILER = new Uint8Array([78, 69, 78, 68]);\nvar ENCODER_QUEUE_HWM = 256 * 1024;\nvar ENCODER_EMIT_CAP = 64 * 1024;\nvar _peakInFlight = 0;\nvar _currentInFlight = 0;\nfunction _peakInFlightBytes() {\n  return _peakInFlight;\n}\nfunction _resetPeakInFlightBytes() {\n  _peakInFlight = 0;\n  _currentInFlight = 0;\n}\nfunction _trackInFlightAdd(n) {\n  _currentInFlight += n;\n  if (_currentInFlight > _peakInFlight) _peakInFlight = _currentInFlight;\n}\nfunction _trackInFlightSub(n) {\n  _currentInFlight -= n;\n  if (_currentInFlight < 0) _currentInFlight = 0;\n}\nfunction encodeWriteBatchStream(payload) {\n  const inodes = payload.inodes ?? [];\n  const chunks = payload.chunks ?? [];\n  const deletePaths = payload.deletePaths;\n  let phase = 0;\n  let chunkIdx = 0;\n  const enc = new TextEncoder();\n  const headerBytes = enc.encode(JSON.stringify({\n    inodes,\n    deletePaths,\n    chunkCount: chunks.length\n  }));\n  const source = {\n    type: \"bytes\",\n    pull(controller) {\n      try {\n        if (phase === 0) {\n          enqueue(controller, W7_MAGIC.slice());\n          phase = 1;\n          return;\n        }\n        if (phase === 1) {\n          const hdr = new Uint8Array(4 + headerBytes.length);\n          writeU32LE(hdr, 0, headerBytes.length);\n          hdr.set(headerBytes, 4);\n          enqueue(controller, hdr);\n          phase = 2;\n          return;\n        }\n        if (phase === 2) {\n          if (chunkIdx >= chunks.length) {\n            phase = 3;\n          } else {\n            const c = chunks[chunkIdx++];\n            const pathBytes = enc.encode(c.path);\n            const data = c.data instanceof Uint8Array ? c.data : new Uint8Array(c.data);\n            const headerSize = 4 + pathBytes.length + 4 + 4;\n            const headerOut = new Uint8Array(headerSize);\n            let o = 0;\n            writeU32LE(headerOut, o, pathBytes.length);\n            o += 4;\n            headerOut.set(pathBytes, o);\n            o += pathBytes.length;\n            writeU32LE(headerOut, o, c.chunkId);\n            o += 4;\n            writeU32LE(headerOut, o, data.length);\n            o += 4;\n            enqueue(controller, headerOut);\n            if (data.length === 0) return;\n            if (data.length <= ENCODER_EMIT_CAP) {\n              enqueue(controller, data);\n            } else {\n              for (let i = 0; i < data.length; i += ENCODER_EMIT_CAP) {\n                enqueue(controller, data.subarray(i, Math.min(i + ENCODER_EMIT_CAP, data.length)));\n              }\n            }\n            return;\n          }\n        }\n        if (phase === 3) {\n          enqueue(controller, W7_TRAILER.slice());\n          phase = 4;\n          controller.close();\n          return;\n        }\n        controller.close();\n      } catch (e) {\n        controller.error(e);\n      }\n    },\n    cancel() {\n      phase = 4;\n      chunkIdx = chunks.length;\n    }\n  };\n  return new ReadableStream(source, {\n    // Byte streams (`type: 'bytes'`) MUST use the default byte-counted\n    // strategy: highWaterMark is in bytes, size is implicit. Custom\n    // `size` callbacks are forbidden — they throw at construction.\n    highWaterMark: ENCODER_QUEUE_HWM\n  });\n  function enqueue(controller, bytes) {\n    _trackInFlightAdd(bytes.byteLength);\n    controller.enqueue(bytes);\n    queueMicrotask(() => _trackInFlightSub(bytes.byteLength));\n  }\n}\nasync function decodeWriteBatchStream(stream) {\n  const reader = stream.getReader();\n  const buf = new ByteBuffer(reader);\n  const magic = await buf.readExact(4, \"magic\");\n  if (!bytesEqual(magic, W7_MAGIC)) {\n    try {\n      reader.releaseLock();\n    } catch {\n    }\n    throw new Error(`w7-frame: bad magic, expected NW7\\\\x01, got ${Array.from(magic).map((b) => b.toString(16)).join(\" \")}`);\n  }\n  const hdrLenBytes = await buf.readExact(4, \"header-length\");\n  const hdrLen = readU32LE(hdrLenBytes, 0);\n  if (hdrLen < 0 || hdrLen > 64 * 1024 * 1024) {\n    throw new Error(`w7-frame: implausible header length ${hdrLen}`);\n  }\n  const hdrJson = await buf.readExact(hdrLen, \"header-json\");\n  let header;\n  try {\n    header = JSON.parse(new TextDecoder().decode(hdrJson));\n  } catch (e) {\n    throw new Error(`w7-frame: header JSON parse failed: ${e?.message || e}`);\n  }\n  if (!header || !Array.isArray(header.inodes) || typeof header.chunkCount !== \"number\") {\n    throw new Error(\"w7-frame: header missing required fields (inodes / chunkCount)\");\n  }\n  const chunkIter = {\n    [Symbol.asyncIterator]() {\n      let idx = 0;\n      let exhausted = false;\n      return {\n        async next() {\n          if (exhausted) return { value: void 0, done: true };\n          if (idx >= header.chunkCount) {\n            const trailer = await buf.readExact(4, \"trailer\");\n            if (!bytesEqual(trailer, W7_TRAILER)) {\n              throw new Error(\n                `w7-frame: bad trailer, expected NEND, got ${Array.from(trailer).map((b) => String.fromCharCode(b)).join(\"\")}`\n              );\n            }\n            try {\n              reader.releaseLock();\n            } catch {\n            }\n            exhausted = true;\n            return { value: void 0, done: true };\n          }\n          const pathLenBytes = await buf.readExact(4, \"chunk-path-length\");\n          const pathLen = readU32LE(pathLenBytes, 0);\n          if (pathLen < 0 || pathLen > 64 * 1024) {\n            throw new Error(`w7-frame: implausible path length ${pathLen} at chunk ${idx}`);\n          }\n          const pathBytes = await buf.readExact(pathLen, \"chunk-path\");\n          const path = new TextDecoder().decode(pathBytes);\n          const chunkIdBytes = await buf.readExact(4, \"chunk-id\");\n          const chunkId = readU32LE(chunkIdBytes, 0);\n          const dataLenBytes = await buf.readExact(4, \"chunk-data-length\");\n          const dataLen = readU32LE(dataLenBytes, 0);\n          if (dataLen < 0 || dataLen > 64 * 1024 * 1024) {\n            throw new Error(`w7-frame: implausible data length ${dataLen} at chunk ${idx}`);\n          }\n          const data = await buf.readExact(dataLen, \"chunk-data\");\n          idx++;\n          return { value: { path, chunkId, data }, done: false };\n        },\n        async return() {\n          exhausted = true;\n          try {\n            reader.releaseLock();\n          } catch {\n          }\n          return { value: void 0, done: true };\n        }\n      };\n    }\n  };\n  return {\n    inodes: header.inodes,\n    deletePaths: header.deletePaths,\n    chunkIter\n  };\n}\nfunction writeU32LE(out, off, n) {\n  out[off] = n & 255;\n  out[off + 1] = n >>> 8 & 255;\n  out[off + 2] = n >>> 16 & 255;\n  out[off + 3] = n >>> 24 & 255;\n}\nfunction readU32LE(buf, off) {\n  return (buf[off] | buf[off + 1] << 8 | buf[off + 2] << 16 | buf[off + 3] << 24) >>> 0;\n}\nfunction bytesEqual(a, b) {\n  if (a.length !== b.length) return false;\n  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;\n  return true;\n}\nvar ByteBuffer = class {\n  constructor(reader) {\n    this.reader = reader;\n  }\n  chunks = [];\n  avail = 0;\n  done = false;\n  async readExact(n, label) {\n    if (n === 0) return new Uint8Array(0);\n    while (this.avail < n) {\n      if (this.done) {\n        throw new Error(\n          `w7-frame: stream ended ${this.avail} bytes into expected ${n}-byte ${label}`\n        );\n      }\n      const { value, done } = await this.reader.read();\n      if (done) {\n        this.done = true;\n      } else if (value && value.length > 0) {\n        this.chunks.push(value);\n        this.avail += value.length;\n      }\n    }\n    const out = new Uint8Array(n);\n    let copied = 0;\n    while (copied < n) {\n      const head = this.chunks[0];\n      const take = Math.min(head.length, n - copied);\n      out.set(head.subarray(0, take), copied);\n      copied += take;\n      if (take === head.length) {\n        this.chunks.shift();\n      } else {\n        this.chunks[0] = head.subarray(take);\n      }\n    }\n    this.avail -= n;\n    return out;\n  }\n};";
+export const W7_FRAME_PREAMBLE_SIZE = 7970;

package/dist/router/index.d.ts

@@ -31,6 +31,8 @@
  *   - The default `createNimbusHandler()` (zero args) is the
  *     "ship-Nimbus-as-is" case — exactly what `apps/dogfood/` does.
  */
+import { type NimbusSdkRouterConfig } from './remote-api.js';
+export type { NimbusConfig as NimbusSdkConfig, NimbusRemoteApiConfig, NimbusRuntimePolicy, NimbusSandboxProfile, NimbusSdkRouterConfig, } from './remote-api.js';
 /**
  * Lifecycle event a hook receives. Hooks should treat this as read-only.
  */
@@ -50,8 +52,8 @@ export interface NimbusHookContext {
  * NOT short-circuit the request.
  *
  * `onSessionStart` fires on the first WebSocket upgrade for a session
- * (not on every HTTP API call). `onSessionEnd` fires when the DO emits a
- * session-end event (not implemented v1; reserved).
+ * (not on every HTTP API call). `onSessionEnd` is reserved for future
+ * session lifecycle events.
  */
 export interface NimbusHooks {
     /**
@@ -110,6 +112,8 @@ export interface CreateNimbusHandlerOptions {
     routes?: CustomRoutes;
     /** Auth-mode selector. Default `'auto'`. */
     auth?: NimbusAuthConfig;
+    /** Programmatic SDK HTTP surface. Disabled unless explicitly enabled. */
+    sdk?: NimbusSdkRouterConfig;
 }
 /**
  * The shape every `default export` Workers handler must satisfy.

package/dist/router/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAsBH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CA+Gf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAqBH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAkHf"}

package/dist/router/index.js

@@ -35,6 +35,7 @@ import { generateSessionId, isValidSessionId, } from '../_shared/session-id.js';
 import { parseSessionRoute, forwardToSession, renderInvalidSessionHtml, SESSION_ROUTE_PREFIX, LEGACY_PUBLIC_DO_SEGMENT, } from '../_shared/session-router.js';
 import { verifyRequestToken, authErrorResponse, NimbusAuthError, NimbusTokenMalformedError, } from '../auth/index.js';
 import { setCtxExports } from '../session/ctx-exports.js';
+import { handleNimbusRemoteApi, } from './remote-api.js';
 /**
  * Build a Nimbus default-export handler. The returned object is exactly
  * what `export default` expects in a Workers entry module.
@@ -94,6 +95,9 @@ export function createNimbusHandler(options = {}) {
                 }
             }
             const url = new URL(request.url);
+            const sdkResponse = await handleNimbusRemoteApi(request, env, options.sdk);
+            if (sdkResponse)
+                return sdkResponse;
             // ── /new — spawn a fresh session and redirect ───────────────────
             if (url.pathname === '/new') {
                 if (request.method !== 'POST' && request.method !== 'GET') {

package/dist/router/remote-api.d.ts

@@ -0,0 +1,44 @@
+export type NimbusRuntimeName = 'node' | 'bun' | 'npm' | 'git' | 'python' | 'ruby' | 'clang' | 'shell' | (string & {});
+export interface NimbusRuntimePolicy {
+    preinstall?: string[];
+    onDemand?: boolean;
+    allow?: NimbusRuntimeName[];
+}
+export interface NimbusSandboxProfile {
+    root?: string;
+    runtimes?: NimbusRuntimePolicy;
+    tools?: {
+        namespace?: string;
+        kind?: string;
+    };
+    preview?: {
+        baseUrl?: string;
+        pathStyle?: boolean;
+    };
+}
+export interface NimbusConfig {
+    endpoint?: string;
+    sandboxes?: Record<string, NimbusSandboxProfile>;
+}
+export interface NimbusRemoteApiConfig {
+    /** Enable the remote programmatic sandbox API. */
+    enabled?: boolean;
+    /** Route prefix. Defaults to `/api/nimbus/v1`. */
+    basePath?: string;
+    /**
+     * Permit unauthenticated remote calls when JWT_SECRET is absent. This is
+     * intended only for private development deployments.
+     */
+    allowLegacy?: boolean;
+    /**
+     * Required token scopes. Tokens without an explicit `scopes` claim keep the
+     * existing full-trust semantics.
+     */
+    requiredScopes?: string[];
+}
+export interface NimbusSdkRouterConfig {
+    remote?: boolean | NimbusRemoteApiConfig;
+    config?: NimbusConfig;
+}
+export declare function handleNimbusRemoteApi(request: Request, env: any, sdk: NimbusSdkRouterConfig | undefined): Promise<Response | null>;
+//# sourceMappingURL=remote-api.d.ts.map

package/dist/router/remote-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAqBD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA8D1B"}

package/dist/router/remote-api.js

@@ -0,0 +1,333 @@
+import { LEGACY_PUBLIC_DO_SEGMENT, } from '../_shared/session-router.js';
+import { requireScopes, requireSessionPin, verifyRequestToken, NimbusAuthError, NimbusTokenMalformedError, isNimbusIdComponent, } from '../auth/index.js';
+const DEFAULT_REMOTE_BASE_PATH = '/api/nimbus/v1';
+export async function handleNimbusRemoteApi(request, env, sdk) {
+    const remote = normalizeRemoteConfig(sdk?.remote);
+    if (!remote.enabled)
+        return null;
+    const url = new URL(request.url);
+    const match = matchRemoteRpc(url.pathname, remote.basePath);
+    if (!match)
+        return null;
+    if (request.method === 'OPTIONS')
+        return corsResponse(null, 204);
+    if (request.method !== 'POST') {
+        return remoteJson({ ok: false, error: 'Method not allowed', code: 'E_METHOD_NOT_ALLOWED' }, 405);
+    }
+    if (!env?.NIMBUS_SESSION) {
+        return remoteJson({ ok: false, error: 'NIMBUS_SESSION binding is missing', code: 'E_NIMBUS_BINDING_MISSING' }, 500);
+    }
+    if (!isNimbusIdComponent(match.sandboxId)) {
+        return remoteJson({ ok: false, error: 'Invalid sandbox id', code: 'E_SANDBOX_ID' }, 400);
+    }
+    let body;
+    try {
+        body = decodeWire(await request.json());
+    }
+    catch (e) {
+        return remoteJson({ ok: false, error: `Invalid JSON body: ${e?.message || e}`, code: 'E_BAD_JSON' }, 400);
+    }
+    const tenantSegment = await resolveRemoteTenantSegment(request, env, remote, match.sandboxId);
+    if (tenantSegment instanceof Response)
+        return tenantSegment;
+    const profileName = body.profile ?? 'default';
+    const profile = sdk?.config?.sandboxes?.[profileName]
+        ?? sdk?.config?.sandboxes?.default
+        ?? {};
+    const root = body.root ?? profile.root ?? '/home/user';
+    const doName = `${tenantSegment}:${match.sandboxId}`;
+    const id = env.NIMBUS_SESSION.idFromName(doName);
+    const stub = env.NIMBUS_SESSION.get(id);
+    const ctx = {
+        env,
+        stub,
+        body,
+        profileName,
+        profile,
+        root,
+    };
+    try {
+        const result = await dispatchRemoteRpc(ctx);
+        return remoteJson({ ok: true, result });
+    }
+    catch (e) {
+        return remoteJson({
+            ok: false,
+            error: e?.message || String(e),
+            code: e?.code || 'E_NIMBUS_REMOTE_RPC',
+        }, e?.httpStatus || 500);
+    }
+}
+function normalizeRemoteConfig(remote) {
+    const value = typeof remote === 'object' ? remote : {};
+    return {
+        enabled: remote === true || value.enabled === true,
+        basePath: normalizeBasePath(value.basePath ?? DEFAULT_REMOTE_BASE_PATH),
+        allowLegacy: value.allowLegacy === true,
+        requiredScopes: value.requiredScopes ?? ['sandbox:use'],
+    };
+}
+function matchRemoteRpc(pathname, basePath) {
+    const prefix = `${basePath}/sandboxes/`;
+    if (!pathname.startsWith(prefix) || !pathname.endsWith('/rpc'))
+        return null;
+    const raw = pathname.slice(prefix.length, -'/rpc'.length);
+    if (!raw || raw.includes('/'))
+        return null;
+    try {
+        return { sandboxId: decodeURIComponent(raw) };
+    }
+    catch {
+        return null;
+    }
+}
+async function resolveRemoteTenantSegment(request, env, remote, sandboxId) {
+    const hasSecret = typeof env?.JWT_SECRET === 'string' && env.JWT_SECRET.length > 0;
+    if (!hasSecret) {
+        if (remote.allowLegacy)
+            return LEGACY_PUBLIC_DO_SEGMENT;
+        return remoteJson({
+            ok: false,
+            error: 'Remote Nimbus sandbox API requires JWT_SECRET',
+            code: 'E_AUTH_CONFIG_MISSING',
+        }, 500);
+    }
+    try {
+        const verified = await verifyRequestToken(request, env);
+        requireScopes(verified, remote.requiredScopes);
+        requireSessionPin(verified, sandboxId);
+        return verified.doInstanceName;
+    }
+    catch (e) {
+        if (e instanceof NimbusAuthError || e instanceof NimbusTokenMalformedError) {
+            return remoteJson({ ok: false, error: e.message, code: e.code }, e.httpStatus);
+        }
+        console.error('[nimbus] remote API auth error:', e);
+        return remoteJson({ ok: false, error: 'Internal auth error', code: 'E_AUTH_UNKNOWN' }, 500);
+    }
+}
+async function dispatchRemoteRpc(ctx) {
+    const op = ctx.body.op;
+    const args = Array.isArray(ctx.body.args) ? ctx.body.args : [];
+    switch (op) {
+        case 'ready': {
+            const options = objectArg(args[0]);
+            const preinstall = configuredPreinstall(ctx.profile, options.preinstall);
+            for (const spec of preinstall)
+                assertRuntimeAllowed(ctx, spec, 'preinstall');
+            return ctx.stub._rpcReady({ preinstall });
+        }
+        case 'exec':
+            return ctx.stub._rpcExec(stringArg(args[0], 'command'), execOptions(ctx, args[1]));
+        case 'startProcess':
+            return ctx.stub._rpcStartProcess(stringArg(args[0], 'command'), execOptions(ctx, args[1]));
+        case 'runCode': {
+            const options = execOptions(ctx, args[1]);
+            const language = typeof options.language === 'string' ? options.language : 'javascript';
+            assertRuntimeForLanguage(ctx, language, options.install);
+            return ctx.stub._rpcRunCode(stringArg(args[0], 'code'), options);
+        }
+        case 'readFile':
+            return ctx.stub._rpcReadFile(stringArg(args[0], 'path'));
+        case 'readFileBytes':
+            return ctx.stub._rpcReadFileBytes(stringArg(args[0], 'path'));
+        case 'writeFile':
+            return ctx.stub._rpcWriteFile(stringArg(args[0], 'path'), args[1]);
+        case 'readdir':
+            return ctx.stub._rpcReaddir(stringArg(args[0], 'path'));
+        case 'exists':
+            return ctx.stub._rpcExists(stringArg(args[0], 'path'));
+        case 'mkdir':
+            return ctx.stub._rpcMkdir(stringArg(args[0], 'path'));
+        case 'deleteFile':
+            return ctx.stub._rpcDeleteFile(stringArg(args[0], 'path'), objectArg(args[1]));
+        case 'installRuntime': {
+            const spec = stringArg(args[0], 'spec');
+            assertRuntimeAllowed(ctx, spec, 'onDemand');
+            return ctx.stub._rpcInstallRuntime(spec, objectArg(args[1]));
+        }
+        case 'ensureRuntimes': {
+            const specs = arrayArg(args[0], 'specs').map((s) => String(s));
+            for (const spec of specs)
+                assertRuntimeAllowed(ctx, spec, 'onDemand');
+            return ctx.stub._rpcEnsureRuntimes(specs, objectArg(args[1]));
+        }
+        case 'listRuntimes':
+            return ctx.stub._rpcListRuntimes();
+        case 'listProcesses':
+            return ctx.stub._rpcListProcesses();
+        case 'killProcess':
+            return ctx.stub._rpcKillProcess(numberArg(args[0], 'pid'));
+        case 'processLogs':
+            return ctx.stub._rpcProcessLogs(numberArg(args[0], 'pid'), objectArg(args[1]));
+        case 'listPorts':
+            return ctx.stub._rpcListPorts();
+        case 'exposePort':
+            return ctx.stub._rpcExposePort(numberArg(args[0], 'port'));
+        case 'unexposePort':
+            return ctx.stub._rpcUnexposePort(numberArg(args[0], 'port'));
+        default:
+            throw apiError(`Unknown Nimbus sandbox operation: ${String(op)}`, 'E_REMOTE_OP', 400);
+    }
+}
+function execOptions(ctx, value) {
+    const options = objectArg(value);
+    return {
+        ...options,
+        cwd: typeof options.cwd === 'string' ? options.cwd : ctx.root,
+    };
+}
+function configuredPreinstall(profile, requested) {
+    if (Array.isArray(profile.runtimes?.preinstall))
+        return profile.runtimes.preinstall;
+    return Array.isArray(requested) ? requested.map((s) => String(s)) : [];
+}
+function assertRuntimeForLanguage(ctx, language, install) {
+    if (language === 'python' || language === 'ruby') {
+        assertRuntimeAllowed(ctx, language, install === 'ifMissing' ? 'onDemand' : 'use');
+    }
+    else if (language === 'shell') {
+        assertRuntimeAllowed(ctx, 'shell', 'use');
+    }
+    else if (language === 'javascript' || language === 'typescript') {
+        assertRuntimeAllowed(ctx, 'node', 'use');
+    }
+}
+function assertRuntimeAllowed(ctx, spec, action) {
+    const policy = ctx.profile.runtimes;
+    const name = runtimeName(spec);
+    if (policy?.allow && !policy.allow.includes(name)) {
+        throw apiError(`Nimbus runtime '${name}' is not allowed by sandbox profile '${ctx.profileName}'`, 'E_RUNTIME_NOT_ALLOWED', 403);
+    }
+    if (action !== 'onDemand' || policy?.onDemand !== false)
+        return;
+    const preinstalled = new Set((policy.preinstall ?? []).map(runtimeName));
+    if (!preinstalled.has(name)) {
+        throw apiError(`Nimbus runtime '${name}' is not preinstalled and on-demand runtime installs are disabled by sandbox profile '${ctx.profileName}'`, 'E_RUNTIME_ON_DEMAND_DISABLED', 403);
+    }
+}
+function runtimeName(spec) {
+    return String(spec).split('@')[0];
+}
+function objectArg(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function arrayArg(value, name) {
+    if (!Array.isArray(value))
+        throw apiError(`${name} must be an array`, 'E_ARG_SHAPE', 400);
+    return value;
+}
+function stringArg(value, name) {
+    if (typeof value !== 'string')
+        throw apiError(`${name} must be a string`, 'E_ARG_SHAPE', 400);
+    return value;
+}
+function numberArg(value, name) {
+    const number = Number(value);
+    if (!Number.isFinite(number))
+        throw apiError(`${name} must be a number`, 'E_ARG_SHAPE', 400);
+    return number;
+}
+function apiError(message, code, status) {
+    const err = new Error(message);
+    err.code = code;
+    err.httpStatus = status;
+    return err;
+}
+function normalizeBasePath(path) {
+    const trimmed = trimSlashes(String(path || DEFAULT_REMOTE_BASE_PATH));
+    return `/${trimmed}`;
+}
+function trimSlashes(value) {
+    let start = 0;
+    let end = value.length;
+    while (start < end && value[start] === '/')
+        start++;
+    while (end > start && value[end - 1] === '/')
+        end--;
+    return value.slice(start, end);
+}
+function remoteJson(value, status = 200) {
+    return corsResponse(JSON.stringify(encodeWire(value)), status, {
+        'Content-Type': 'application/json',
+    });
+}
+function corsResponse(body, status, headers = {}) {
+    return new Response(body, {
+        status,
+        headers: {
+            ...headers,
+            'Cache-Control': 'no-store',
+            'Access-Control-Allow-Origin': '*',
+            'Access-Control-Allow-Methods': 'POST, OPTIONS',
+            'Access-Control-Allow-Headers': 'Authorization, Content-Type',
+        },
+    });
+}
+function encodeWire(value) {
+    if (value instanceof Uint8Array) {
+        return {
+            __nimbusWireType: 'bytes',
+            base64: bytesToBase64(value),
+        };
+    }
+    if (value instanceof ArrayBuffer) {
+        return {
+            __nimbusWireType: 'bytes',
+            base64: bytesToBase64(new Uint8Array(value)),
+        };
+    }
+    if (ArrayBuffer.isView(value)) {
+        const view = value;
+        return {
+            __nimbusWireType: 'bytes',
+            base64: bytesToBase64(new Uint8Array(view.buffer, view.byteOffset, view.byteLength)),
+        };
+    }
+    if (Array.isArray(value))
+        return value.map(encodeWire);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [key, item] of Object.entries(value)) {
+            if (item !== undefined)
+                out[key] = encodeWire(item);
+        }
+        return out;
+    }
+    return value;
+}
+function decodeWire(value) {
+    if (value
+        && typeof value === 'object'
+        && value.__nimbusWireType === 'bytes'
+        && typeof value.base64 === 'string') {
+        return base64ToBytes(value.base64);
+    }
+    if (Array.isArray(value))
+        return value.map(decodeWire);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [key, item] of Object.entries(value)) {
+            out[key] = decodeWire(item);
+        }
+        return out;
+    }
+    return value;
+}
+function bytesToBase64(bytes) {
+    let binary = '';
+    const chunk = 0x8000;
+    for (let i = 0; i < bytes.length; i += chunk) {
+        binary += String.fromCharCode(...bytes.subarray(i, i + chunk));
+    }
+    return btoa(binary);
+}
+function base64ToBytes(base64) {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/worker",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Nimbus runtime package for Cloudflare Workers, re-exported publicly through @nimbus-sh/sdk/worker.",
   "homepage": "https://github.com/AshishKumar4/Nimbus",
   "repository": {
@@ -30,6 +30,7 @@
       "types": "./dist/auth/index.d.ts",
       "import": "./dist/auth/index.js"
     },
+    "./runtime-sync-helper": "./scripts/bundle-runtime.mjs",
     "./public/*": "./public/*",
     "./package.json": "./package.json"
   },