@nimbus-sh/worker 0.1.1 → 0.1.3

package/dist/observability/oom-discriminator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oom-discriminator.d.ts","sourceRoot":"","sources":["../../src/observability/oom-discriminator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAOlD,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,eAAe;IACf,EAAE,EAAE,MAAM,CAAC;IACX,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,KAAK,EAAE,QAAQ,CAAC;IAChB,yDAAyD;IACzD,gBAAgB,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,YAAY,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC9B,0DAA0D;IAC1D,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,YAAY,GACpB,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAC1C,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,eAAe;IACf,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,SAAS,EAAE,YAAY,CAAC;IACxB,yBAAyB;IACzB,OAAO,EAAE,YAAY,CAAC;IACtB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB;;wDAEoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB;;;qBAGiB;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB;iEAC6D;IAC7D,sBAAsB,EAAE,MAAM,CAAC;IAC/B,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA6BD,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI,CAsBlD;AAED;mCACmC;AACnC,wBAAgB,WAAW,IAAI,WAAW,EAAE,CAE3C;AAED;mBACmB;AACnB,wBAAgB,aAAa,IAAI,IAAI,CAKpC;AAED;gDACgD;AAChD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAO1E;AAED,wBAAgB,eAAe,IAAI,QAAQ,GAAG,IAAI,CAEjD;AAED,6CAA6C;AAC7C,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAOtE;AAED,wBAAgB,cAAc,IAAI,OAAO,GAAG,IAAI,CAE/C;AAUD;0BAC0B;AAC1B,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAyB9D;AAED,0DAA0D;AAC1D,wBAAgB,iBAAiB,IAAI,iBAAiB,EAAE,CAEvD;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,CAAC,EAAE,MAAM,CAAC;IACV,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,cAAc,EAAE,iBAAiB,EAAE,CAAC;IACpC,YAAY,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAgB,kBAAkB,IAAI,YAAY,CASjD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAoCxD"}
+{"version":3,"file":"oom-discriminator.d.ts","sourceRoot":"","sources":["../../src/observability/oom-discriminator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAOlD,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,eAAe;IACf,EAAE,EAAE,MAAM,CAAC;IACX,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,KAAK,EAAE,QAAQ,CAAC;IAChB,yDAAyD;IACzD,gBAAgB,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,YAAY,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC9B,0DAA0D;IAC1D,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,YAAY,GACpB,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAC1C,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,eAAe;IACf,EAAE,EAAE,MAAM,CAAC;IACX,oBAAoB;IACpB,SAAS,EAAE,YAAY,CAAC;IACxB,yBAAyB;IACzB,OAAO,EAAE,YAAY,CAAC;IACtB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB;;wDAEoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB;;;qBAGiB;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB;iEAC6D;IAC7D,sBAAsB,EAAE,MAAM,CAAC;IAC/B,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA6BD,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI,CAsBlD;AAED;mCACmC;AACnC,wBAAgB,WAAW,IAAI,WAAW,EAAE,CAE3C;AAED;mBACmB;AACnB,wBAAgB,aAAa,IAAI,IAAI,CAKpC;AAED;gDACgD;AAChD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAO1E;AAED,wBAAgB,eAAe,IAAI,QAAQ,GAAG,IAAI,CAEjD;AAED,6CAA6C;AAC7C,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAOtE;AAED,wBAAgB,cAAc,IAAI,OAAO,GAAG,IAAI,CAE/C;AAUD;0BAC0B;AAC1B,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAyB9D;AAED,0DAA0D;AAC1D,wBAAgB,iBAAiB,IAAI,iBAAiB,EAAE,CAEvD;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,+CAA+C;IAC/C,CAAC,EAAE,MAAM,CAAC;IACV,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,cAAc,EAAE,iBAAiB,EAAE,CAAC;IACpC,YAAY,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAgB,kBAAkB,IAAI,YAAY,CASjD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAoCxD"}

package/dist/observability/oom-discriminator.js

@@ -33,8 +33,6 @@
  *   - per-facet-id: single slot, one object.
  *
  * Snapshot ≤40 KB even with both rings full. Verified by
- * audit/probes/w5/functional/ring-persistence.mjs (failures) and
- * audit/probes/c-prime/recovery-events/ (recovery — Phase 1 C'.2).
  */
 const KEY = '__NIMBUS_W5_OOM_DISC__';
 const RING_SIZE = 50;

package/dist/replica/routing.js

@@ -55,7 +55,7 @@ export function classifyReplicaPolicy(pathname, method) {
     // ── Worker / port routes — facets are owned by the primary; no
     //    replica representation. Always primary-only.
     //
-    // Primitives wave: `/__nimbus/worker/*` is the canonical route;
+    // runtime primitive support: `/__nimbus/worker/*` is the canonical route;
     // `/worker/*` is the deprecated legacy form, kept here for back-
     // compat (one release sunset; see routes.ts for the Deprecation
     // header). Both classify the same way.

package/dist/router/index.d.ts

@@ -31,6 +31,8 @@
  *   - The default `createNimbusHandler()` (zero args) is the
  *     "ship-Nimbus-as-is" case — exactly what `apps/dogfood/` does.
  */
+import { type NimbusSdkRouterConfig } from './remote-api.js';
+export type { NimbusConfig as NimbusSdkConfig, NimbusRemoteApiConfig, NimbusRuntimePolicy, NimbusSandboxProfile, NimbusSdkRouterConfig, } from './remote-api.js';
 /**
  * Lifecycle event a hook receives. Hooks should treat this as read-only.
  */
@@ -50,8 +52,8 @@ export interface NimbusHookContext {
  * NOT short-circuit the request.
  *
  * `onSessionStart` fires on the first WebSocket upgrade for a session
- * (not on every HTTP API call). `onSessionEnd` fires when the DO emits a
- * session-end event (not implemented v1; reserved).
+ * (not on every HTTP API call). `onSessionEnd` is reserved for future
+ * session lifecycle events.
  */
 export interface NimbusHooks {
     /**
@@ -110,6 +112,8 @@ export interface CreateNimbusHandlerOptions {
     routes?: CustomRoutes;
     /** Auth-mode selector. Default `'auto'`. */
     auth?: NimbusAuthConfig;
+    /** Programmatic SDK HTTP surface. Disabled unless explicitly enabled. */
+    sdk?: NimbusSdkRouterConfig;
 }
 /**
  * The shape every `default export` Workers handler must satisfy.

package/dist/router/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAsBH;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CA+Gf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAqBH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAkHf"}

package/dist/router/index.js

@@ -35,6 +35,7 @@ import { generateSessionId, isValidSessionId, } from '../_shared/session-id.js';
 import { parseSessionRoute, forwardToSession, renderInvalidSessionHtml, SESSION_ROUTE_PREFIX, LEGACY_PUBLIC_DO_SEGMENT, } from '../_shared/session-router.js';
 import { verifyRequestToken, authErrorResponse, NimbusAuthError, NimbusTokenMalformedError, } from '../auth/index.js';
 import { setCtxExports } from '../session/ctx-exports.js';
+import { handleNimbusRemoteApi, } from './remote-api.js';
 /**
  * Build a Nimbus default-export handler. The returned object is exactly
  * what `export default` expects in a Workers entry module.
@@ -94,6 +95,9 @@ export function createNimbusHandler(options = {}) {
                 }
             }
             const url = new URL(request.url);
+            const sdkResponse = await handleNimbusRemoteApi(request, env, options.sdk);
+            if (sdkResponse)
+                return sdkResponse;
             // ── /new — spawn a fresh session and redirect ───────────────────
             if (url.pathname === '/new') {
                 if (request.method !== 'POST' && request.method !== 'GET') {

package/dist/router/remote-api.d.ts

@@ -0,0 +1,44 @@
+export type NimbusRuntimeName = 'node' | 'bun' | 'npm' | 'git' | 'python' | 'ruby' | 'clang' | 'shell' | (string & {});
+export interface NimbusRuntimePolicy {
+    preinstall?: string[];
+    onDemand?: boolean;
+    allow?: NimbusRuntimeName[];
+}
+export interface NimbusSandboxProfile {
+    root?: string;
+    runtimes?: NimbusRuntimePolicy;
+    tools?: {
+        namespace?: string;
+        kind?: string;
+    };
+    preview?: {
+        baseUrl?: string;
+        pathStyle?: boolean;
+    };
+}
+export interface NimbusConfig {
+    endpoint?: string;
+    sandboxes?: Record<string, NimbusSandboxProfile>;
+}
+export interface NimbusRemoteApiConfig {
+    /** Enable the remote programmatic sandbox API. */
+    enabled?: boolean;
+    /** Route prefix. Defaults to `/api/nimbus/v1`. */
+    basePath?: string;
+    /**
+     * Permit unauthenticated remote calls when JWT_SECRET is absent. This is
+     * intended only for private development deployments.
+     */
+    allowLegacy?: boolean;
+    /**
+     * Required token scopes. Tokens without an explicit `scopes` claim keep the
+     * existing full-trust semantics.
+     */
+    requiredScopes?: string[];
+}
+export interface NimbusSdkRouterConfig {
+    remote?: boolean | NimbusRemoteApiConfig;
+    config?: NimbusConfig;
+}
+export declare function handleNimbusRemoteApi(request: Request, env: any, sdk: NimbusSdkRouterConfig | undefined): Promise<Response | null>;
+//# sourceMappingURL=remote-api.d.ts.map

package/dist/router/remote-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAqBD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA8D1B"}

package/dist/router/remote-api.js

@@ -0,0 +1,333 @@
+import { LEGACY_PUBLIC_DO_SEGMENT, } from '../_shared/session-router.js';
+import { requireScopes, requireSessionPin, verifyRequestToken, NimbusAuthError, NimbusTokenMalformedError, isNimbusIdComponent, } from '../auth/index.js';
+const DEFAULT_REMOTE_BASE_PATH = '/api/nimbus/v1';
+export async function handleNimbusRemoteApi(request, env, sdk) {
+    const remote = normalizeRemoteConfig(sdk?.remote);
+    if (!remote.enabled)
+        return null;
+    const url = new URL(request.url);
+    const match = matchRemoteRpc(url.pathname, remote.basePath);
+    if (!match)
+        return null;
+    if (request.method === 'OPTIONS')
+        return corsResponse(null, 204);
+    if (request.method !== 'POST') {
+        return remoteJson({ ok: false, error: 'Method not allowed', code: 'E_METHOD_NOT_ALLOWED' }, 405);
+    }
+    if (!env?.NIMBUS_SESSION) {
+        return remoteJson({ ok: false, error: 'NIMBUS_SESSION binding is missing', code: 'E_NIMBUS_BINDING_MISSING' }, 500);
+    }
+    if (!isNimbusIdComponent(match.sandboxId)) {
+        return remoteJson({ ok: false, error: 'Invalid sandbox id', code: 'E_SANDBOX_ID' }, 400);
+    }
+    let body;
+    try {
+        body = decodeWire(await request.json());
+    }
+    catch (e) {
+        return remoteJson({ ok: false, error: `Invalid JSON body: ${e?.message || e}`, code: 'E_BAD_JSON' }, 400);
+    }
+    const tenantSegment = await resolveRemoteTenantSegment(request, env, remote, match.sandboxId);
+    if (tenantSegment instanceof Response)
+        return tenantSegment;
+    const profileName = body.profile ?? 'default';
+    const profile = sdk?.config?.sandboxes?.[profileName]
+        ?? sdk?.config?.sandboxes?.default
+        ?? {};
+    const root = body.root ?? profile.root ?? '/home/user';
+    const doName = `${tenantSegment}:${match.sandboxId}`;
+    const id = env.NIMBUS_SESSION.idFromName(doName);
+    const stub = env.NIMBUS_SESSION.get(id);
+    const ctx = {
+        env,
+        stub,
+        body,
+        profileName,
+        profile,
+        root,
+    };
+    try {
+        const result = await dispatchRemoteRpc(ctx);
+        return remoteJson({ ok: true, result });
+    }
+    catch (e) {
+        return remoteJson({
+            ok: false,
+            error: e?.message || String(e),
+            code: e?.code || 'E_NIMBUS_REMOTE_RPC',
+        }, e?.httpStatus || 500);
+    }
+}
+function normalizeRemoteConfig(remote) {
+    const value = typeof remote === 'object' ? remote : {};
+    return {
+        enabled: remote === true || value.enabled === true,
+        basePath: normalizeBasePath(value.basePath ?? DEFAULT_REMOTE_BASE_PATH),
+        allowLegacy: value.allowLegacy === true,
+        requiredScopes: value.requiredScopes ?? ['sandbox:use'],
+    };
+}
+function matchRemoteRpc(pathname, basePath) {
+    const prefix = `${basePath}/sandboxes/`;
+    if (!pathname.startsWith(prefix) || !pathname.endsWith('/rpc'))
+        return null;
+    const raw = pathname.slice(prefix.length, -'/rpc'.length);
+    if (!raw || raw.includes('/'))
+        return null;
+    try {
+        return { sandboxId: decodeURIComponent(raw) };
+    }
+    catch {
+        return null;
+    }
+}
+async function resolveRemoteTenantSegment(request, env, remote, sandboxId) {
+    const hasSecret = typeof env?.JWT_SECRET === 'string' && env.JWT_SECRET.length > 0;
+    if (!hasSecret) {
+        if (remote.allowLegacy)
+            return LEGACY_PUBLIC_DO_SEGMENT;
+        return remoteJson({
+            ok: false,
+            error: 'Remote Nimbus sandbox API requires JWT_SECRET',
+            code: 'E_AUTH_CONFIG_MISSING',
+        }, 500);
+    }
+    try {
+        const verified = await verifyRequestToken(request, env);
+        requireScopes(verified, remote.requiredScopes);
+        requireSessionPin(verified, sandboxId);
+        return verified.doInstanceName;
+    }
+    catch (e) {
+        if (e instanceof NimbusAuthError || e instanceof NimbusTokenMalformedError) {
+            return remoteJson({ ok: false, error: e.message, code: e.code }, e.httpStatus);
+        }
+        console.error('[nimbus] remote API auth error:', e);
+        return remoteJson({ ok: false, error: 'Internal auth error', code: 'E_AUTH_UNKNOWN' }, 500);
+    }
+}
+async function dispatchRemoteRpc(ctx) {
+    const op = ctx.body.op;
+    const args = Array.isArray(ctx.body.args) ? ctx.body.args : [];
+    switch (op) {
+        case 'ready': {
+            const options = objectArg(args[0]);
+            const preinstall = configuredPreinstall(ctx.profile, options.preinstall);
+            for (const spec of preinstall)
+                assertRuntimeAllowed(ctx, spec, 'preinstall');
+            return ctx.stub._rpcReady({ preinstall });
+        }
+        case 'exec':
+            return ctx.stub._rpcExec(stringArg(args[0], 'command'), execOptions(ctx, args[1]));
+        case 'startProcess':
+            return ctx.stub._rpcStartProcess(stringArg(args[0], 'command'), execOptions(ctx, args[1]));
+        case 'runCode': {
+            const options = execOptions(ctx, args[1]);
+            const language = typeof options.language === 'string' ? options.language : 'javascript';
+            assertRuntimeForLanguage(ctx, language, options.install);
+            return ctx.stub._rpcRunCode(stringArg(args[0], 'code'), options);
+        }
+        case 'readFile':
+            return ctx.stub._rpcReadFile(stringArg(args[0], 'path'));
+        case 'readFileBytes':
+            return ctx.stub._rpcReadFileBytes(stringArg(args[0], 'path'));
+        case 'writeFile':
+            return ctx.stub._rpcWriteFile(stringArg(args[0], 'path'), args[1]);
+        case 'readdir':
+            return ctx.stub._rpcReaddir(stringArg(args[0], 'path'));
+        case 'exists':
+            return ctx.stub._rpcExists(stringArg(args[0], 'path'));
+        case 'mkdir':
+            return ctx.stub._rpcMkdir(stringArg(args[0], 'path'));
+        case 'deleteFile':
+            return ctx.stub._rpcDeleteFile(stringArg(args[0], 'path'), objectArg(args[1]));
+        case 'installRuntime': {
+            const spec = stringArg(args[0], 'spec');
+            assertRuntimeAllowed(ctx, spec, 'onDemand');
+            return ctx.stub._rpcInstallRuntime(spec, objectArg(args[1]));
+        }
+        case 'ensureRuntimes': {
+            const specs = arrayArg(args[0], 'specs').map((s) => String(s));
+            for (const spec of specs)
+                assertRuntimeAllowed(ctx, spec, 'onDemand');
+            return ctx.stub._rpcEnsureRuntimes(specs, objectArg(args[1]));
+        }
+        case 'listRuntimes':
+            return ctx.stub._rpcListRuntimes();
+        case 'listProcesses':
+            return ctx.stub._rpcListProcesses();
+        case 'killProcess':
+            return ctx.stub._rpcKillProcess(numberArg(args[0], 'pid'));
+        case 'processLogs':
+            return ctx.stub._rpcProcessLogs(numberArg(args[0], 'pid'), objectArg(args[1]));
+        case 'listPorts':
+            return ctx.stub._rpcListPorts();
+        case 'exposePort':
+            return ctx.stub._rpcExposePort(numberArg(args[0], 'port'));
+        case 'unexposePort':
+            return ctx.stub._rpcUnexposePort(numberArg(args[0], 'port'));
+        default:
+            throw apiError(`Unknown Nimbus sandbox operation: ${String(op)}`, 'E_REMOTE_OP', 400);
+    }
+}
+function execOptions(ctx, value) {
+    const options = objectArg(value);
+    return {
+        ...options,
+        cwd: typeof options.cwd === 'string' ? options.cwd : ctx.root,
+    };
+}
+function configuredPreinstall(profile, requested) {
+    if (Array.isArray(profile.runtimes?.preinstall))
+        return profile.runtimes.preinstall;
+    return Array.isArray(requested) ? requested.map((s) => String(s)) : [];
+}
+function assertRuntimeForLanguage(ctx, language, install) {
+    if (language === 'python' || language === 'ruby') {
+        assertRuntimeAllowed(ctx, language, install === 'ifMissing' ? 'onDemand' : 'use');
+    }
+    else if (language === 'shell') {
+        assertRuntimeAllowed(ctx, 'shell', 'use');
+    }
+    else if (language === 'javascript' || language === 'typescript') {
+        assertRuntimeAllowed(ctx, 'node', 'use');
+    }
+}
+function assertRuntimeAllowed(ctx, spec, action) {
+    const policy = ctx.profile.runtimes;
+    const name = runtimeName(spec);
+    if (policy?.allow && !policy.allow.includes(name)) {
+        throw apiError(`Nimbus runtime '${name}' is not allowed by sandbox profile '${ctx.profileName}'`, 'E_RUNTIME_NOT_ALLOWED', 403);
+    }
+    if (action !== 'onDemand' || policy?.onDemand !== false)
+        return;
+    const preinstalled = new Set((policy.preinstall ?? []).map(runtimeName));
+    if (!preinstalled.has(name)) {
+        throw apiError(`Nimbus runtime '${name}' is not preinstalled and on-demand runtime installs are disabled by sandbox profile '${ctx.profileName}'`, 'E_RUNTIME_ON_DEMAND_DISABLED', 403);
+    }
+}
+function runtimeName(spec) {
+    return String(spec).split('@')[0];
+}
+function objectArg(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : {};
+}
+function arrayArg(value, name) {
+    if (!Array.isArray(value))
+        throw apiError(`${name} must be an array`, 'E_ARG_SHAPE', 400);
+    return value;
+}
+function stringArg(value, name) {
+    if (typeof value !== 'string')
+        throw apiError(`${name} must be a string`, 'E_ARG_SHAPE', 400);
+    return value;
+}
+function numberArg(value, name) {
+    const number = Number(value);
+    if (!Number.isFinite(number))
+        throw apiError(`${name} must be a number`, 'E_ARG_SHAPE', 400);
+    return number;
+}
+function apiError(message, code, status) {
+    const err = new Error(message);
+    err.code = code;
+    err.httpStatus = status;
+    return err;
+}
+function normalizeBasePath(path) {
+    const trimmed = trimSlashes(String(path || DEFAULT_REMOTE_BASE_PATH));
+    return `/${trimmed}`;
+}
+function trimSlashes(value) {
+    let start = 0;
+    let end = value.length;
+    while (start < end && value[start] === '/')
+        start++;
+    while (end > start && value[end - 1] === '/')
+        end--;
+    return value.slice(start, end);
+}
+function remoteJson(value, status = 200) {
+    return corsResponse(JSON.stringify(encodeWire(value)), status, {
+        'Content-Type': 'application/json',
+    });
+}
+function corsResponse(body, status, headers = {}) {
+    return new Response(body, {
+        status,
+        headers: {
+            ...headers,
+            'Cache-Control': 'no-store',
+            'Access-Control-Allow-Origin': '*',
+            'Access-Control-Allow-Methods': 'POST, OPTIONS',
+            'Access-Control-Allow-Headers': 'Authorization, Content-Type',
+        },
+    });
+}
+function encodeWire(value) {
+    if (value instanceof Uint8Array) {
+        return {
+            __nimbusWireType: 'bytes',
+            base64: bytesToBase64(value),
+        };
+    }
+    if (value instanceof ArrayBuffer) {
+        return {
+            __nimbusWireType: 'bytes',
+            base64: bytesToBase64(new Uint8Array(value)),
+        };
+    }
+    if (ArrayBuffer.isView(value)) {
+        const view = value;
+        return {
+            __nimbusWireType: 'bytes',
+            base64: bytesToBase64(new Uint8Array(view.buffer, view.byteOffset, view.byteLength)),
+        };
+    }
+    if (Array.isArray(value))
+        return value.map(encodeWire);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [key, item] of Object.entries(value)) {
+            if (item !== undefined)
+                out[key] = encodeWire(item);
+        }
+        return out;
+    }
+    return value;
+}
+function decodeWire(value) {
+    if (value
+        && typeof value === 'object'
+        && value.__nimbusWireType === 'bytes'
+        && typeof value.base64 === 'string') {
+        return base64ToBytes(value.base64);
+    }
+    if (Array.isArray(value))
+        return value.map(decodeWire);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [key, item] of Object.entries(value)) {
+            out[key] = decodeWire(item);
+        }
+        return out;
+    }
+    return value;
+}
+function bytesToBase64(bytes) {
+    let binary = '';
+    const chunk = 0x8000;
+    for (let i = 0; i < bytes.length; i += chunk) {
+        binary += String.fromCharCode(...bytes.subarray(i, i + chunk));
+    }
+    return btoa(binary);
+}
+function base64ToBytes(base64) {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}

package/dist/runtime/barrel-synthesizer.js

@@ -222,7 +222,7 @@ export function buildSyntheticEntry(vfs, nmDir, pkgName, names) {
             // `default` (default re-export with no rename) is rare; skip.
         }
     }
-    // Primitives wave (P6) — `export * from './x.js'` support.
+    // barrel fallback support — `export * from './x.js'` support.
     //
     // Many barrel packages (date-fns, several utility libraries, some
     // icon kits) use `export *` aggregation instead of per-name

package/dist/runtime/clang-runner.d.ts

@@ -1,7 +1,7 @@
 /**
- * clang-runner.ts — Wave-3 v1.1: full hello-world.
+ * clang-runner.ts — compile, link, and execute C programs as wasm32-wasi.
  *
- * v1.1 architecture (compile-link-run, TWO facet calls):
+ * Architecture (compile-link-run, two facet calls):
  *
  *   compile  : clang.wasm + memfs.wasm + sysroot subset for C includes
  *              + user .c → produces .o bytes (returned to supervisor).
@@ -11,8 +11,7 @@
  *   write    : final .wasm flushed to user VFS at the requested path.
  *
  * Splitting compile and link into separate LOADER calls keeps each
- * call under the empirical ~32 MiB per-call ceiling (verdict.md §3
- * path B). Each ships:
+ * call under the empirical loader payload ceiling. Each ships:
  *
  *   - compile: 31 MiB clang.wasm + 0.35 MiB memfs + ~1.3 MiB sysroot
  *              subset (C includes) = ~32.6 MiB.
@@ -23,8 +22,8 @@
  * parser. The full 9.3 MiB sysroot.tar is parsed once per compile;
  * only the files matching the role's prefix-allowlist are forwarded.
  *
- * Anti-reqs from plan §8.1: no setTimeout / no retry / no
- * defensive-catch in dispatch.
+ * Dispatch stays direct: no sleeps, no caller-side retries, and no
+ * catch-and-continue around loader failures.
  */
 import type { RuntimeManifest } from './runtime-catalog.js';
 import type { SqliteVFS } from '../vfs/sqlite-vfs.js';

package/dist/runtime/clang-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clang-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/clang-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,SAAS,CAAC;CAChB,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,KAC7F,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,CAqShC;AAqZD,eAAO,MAAM,qBAAqB,imXA4UjC,CAAC"}
+{"version":3,"file":"clang-runner.d.ts","sourceRoot":"","sources":["../../src/runtime/clang-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,YAAY,CAAC;IACvB,GAAG,EAAE,SAAS,CAAC;CAChB,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,KAC7F,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,CAqShC;AAqZD,eAAO,MAAM,qBAAqB,imXA4UjC,CAAC"}

package/dist/runtime/clang-runner.js

@@ -1,7 +1,7 @@
 /**
- * clang-runner.ts — Wave-3 v1.1: full hello-world.
+ * clang-runner.ts — compile, link, and execute C programs as wasm32-wasi.
  *
- * v1.1 architecture (compile-link-run, TWO facet calls):
+ * Architecture (compile-link-run, two facet calls):
  *
  *   compile  : clang.wasm + memfs.wasm + sysroot subset for C includes
  *              + user .c → produces .o bytes (returned to supervisor).
@@ -11,8 +11,7 @@
  *   write    : final .wasm flushed to user VFS at the requested path.
  *
  * Splitting compile and link into separate LOADER calls keeps each
- * call under the empirical ~32 MiB per-call ceiling (verdict.md §3
- * path B). Each ships:
+ * call under the empirical loader payload ceiling. Each ships:
  *
  *   - compile: 31 MiB clang.wasm + 0.35 MiB memfs + ~1.3 MiB sysroot
  *              subset (C includes) = ~32.6 MiB.
@@ -23,8 +22,8 @@
  * parser. The full 9.3 MiB sysroot.tar is parsed once per compile;
  * only the files matching the role's prefix-allowlist are forwarded.
  *
- * Anti-reqs from plan §8.1: no setTimeout / no retry / no
- * defensive-catch in dispatch.
+ * Dispatch stays direct: no sleeps, no caller-side retries, and no
+ * catch-and-continue around loader failures.
  */
 /** Build the runner factory. Closes over facetMgr + vfs. */
 export function makeClangRunnerFactory(deps) {

package/dist/runtime/esbuild-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-service.d.ts","sourceRoot":"","sources":["../../src/runtime/esbuild-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAItD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC;AAIpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CA4DrE;AA4qBD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;IAC3C,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;CAC9C;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAA8B;IACjD,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAA+B;gBAEnC,GAAG,EAAE,SAAS;IAI1B;;;;;;OAMG;YACW,UAAU;IAmExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0DG;IACG,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,CAAC;QACtD,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;QAChC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;QAC5C,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,GAAG,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC;QAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,GACA,OAAO,CAAC,eAAe,CAAC;IAsF3B;;OAEG;IACG,KAAK,CACT,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;QAChC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;QAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;QAC5C,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,GACA,OAAO,CAAC,WAAW,CAAC;IA0CvB;;;;OAIG;IACH,OAAO,CAAC,aAAa;IA4UrB,IAAI,aAAa,YAA+B;CACjD"}
+{"version":3,"file":"esbuild-service.d.ts","sourceRoot":"","sources":["../../src/runtime/esbuild-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAItD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,eAAe,OAAO,CAAC;AAIpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CA4DrE;AA0qBD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;IAC3C,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,GAAG,CAAA;KAAE,EAAE,CAAC;CAC9C;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,WAAW,CAA8B;IACjD,kFAAkF;IAClF,OAAO,CAAC,QAAQ,CAA+B;gBAEnC,GAAG,EAAE,SAAS;IAI1B;;;;;;OAMG;YACW,UAAU;IAmExB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0DG;IACG,SAAS,CACb,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,CAAC;QACtD,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;QAChC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;QAC5C,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,GAAG,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC;QAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,GACA,OAAO,CAAC,eAAe,CAAC;IAqF3B;;OAEG;IACG,KAAK,CACT,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;QAChC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;QAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,UAAU,CAAC;QAC5C,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,GACA,OAAO,CAAC,WAAW,CAAC;IA0CvB;;;;OAIG;IACH,OAAO,CAAC,aAAa;IA4UrB,IAAI,aAAa,YAA+B;CACjD"}

package/dist/runtime/esbuild-service.js

@@ -537,7 +537,6 @@ function convertEsmImportsToRequire(src) {
     // CLASSIFY (is this an import line?) and the original line to
     // EXTRACT the actual import shape (specifier, bindings).
     //
-    // See .seal-internal/2026-05-11-sk-mjs-fix/audit.md.
     const strippedLines = stripCommentsAndStrings(src).split('\n');
     const requires = [];
     const bodyLines = [];
@@ -629,7 +628,6 @@ function convertEsmImportsToRequire(src) {
     // SyntaxError "Unexpected token 'export'" at facet pre-compile.
     //
     // Rewrite each top-level export to a CJS-compatible equivalent (see
-    // .seal-internal/2026-05-11-sk-exports-fix/audit.md for shape table).
     // Same defences as imports:
     //   - String-content masking (template-literal exports don't trigger)
     //   - $-aware identifier regex ([\w$]+, esbuild emits foo$1 ids)
@@ -1003,7 +1001,6 @@ export class EsbuildService {
                 // user code has no .catch() (e.g. create-astro.mjs's
                 // `import('./dist/index.js').then(({main}) => main())`), the
                 // rejection is unhandled and the facet exits silently
-                // exitCode=0. See .seal-internal/2026-05-11-astro-silent-exit/audit.md.
                 supported: { 'dynamic-import': false },
             });
             const { requires, body } = convertEsmImportsToRequire(pass1.code);

package/dist/runtime/framework-detect.d.ts

@@ -28,7 +28,6 @@
  * Bare `@remix-run/react` without `@remix-run/dev` falls through to step 7
  * — it's a runtime dep alone, not a Remix v2 vite-plugin project.
  *
- * See audit/sections/W11-plan.md §4 for the full spec + rationale.
  */
 export type Framework = 'next' | 'astro' | 'nuxt' | 'remix' | 'sveltekit' | 'vite' | 'wrangler' | 'unknown';
 export type DevCommand = 'next-cli' | 'astro-cli' | 'nuxt-cli' | 'remix-cli' | 'sveltekit-vite' | 'vite-real' | 'wrangler-dev' | 'generic';

package/dist/runtime/framework-detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework-detect.d.ts","sourceRoot":"","sources":["../../src/runtime/framework-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,OAAO,GACP,MAAM,GACN,OAAO,GACP,WAAW,GACX,MAAM,GACN,UAAU,GACV,SAAS,CAAC;AAEd,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,gBAAgB,GAChB,WAAW,GACX,cAAc,GACd,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE;QACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF,2EAA2E;IAC3E,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,SAAS,CAAC;IACrB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,UAAU,EAAE,UAAU,CAAC;CACxB;AA2BD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,CAsBhE;AAwGD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAK3D"}
+{"version":3,"file":"framework-detect.d.ts","sourceRoot":"","sources":["../../src/runtime/framework-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,OAAO,GACP,MAAM,GACN,OAAO,GACP,WAAW,GACX,MAAM,GACN,UAAU,GACV,SAAS,CAAC;AAEd,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,WAAW,GACX,UAAU,GACV,WAAW,GACX,gBAAgB,GAChB,WAAW,GACX,cAAc,GACd,SAAS,CAAC;AAEd,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE;QACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAClC,CAAC;IACF,2EAA2E;IAC3E,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,SAAS,CAAC;IACrB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,UAAU,EAAE,UAAU,CAAC;CACxB;AA2BD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,YAAY,CAsBhE;AAwGD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAK3D"}

package/dist/runtime/framework-detect.js

@@ -28,7 +28,6 @@
  * Bare `@remix-run/react` without `@remix-run/dev` falls through to step 7
  * — it's a runtime dep alone, not a Remix v2 vite-plugin project.
  *
- * See audit/sections/W11-plan.md §4 for the full spec + rationale.
  */
 const WRANGLER_CONFIG_FILES = ['wrangler.toml', 'wrangler.jsonc', 'wrangler.json'];
 const VITE_CONFIG_FILES = ['vite.config.ts', 'vite.config.js', 'vite.config.mjs', 'vite.config.cjs'];

package/dist/runtime/node-runner.d.ts

@@ -103,7 +103,7 @@ export interface RunFreshOpts {
  */
 export declare function runFresh(facetMgr: FacetManager, code: string, opts: RunFreshOpts): Promise<RunFreshResult>;
 /**
- * BACKWARD-COMPAT shim. The arch-gaps wave's `runNodeScript` is now an
+ * BACKWARD-COMPAT shim. The child-process isolation design's `runNodeScript` is now an
  * alias for `runFresh` so the call sites in src/session/init.ts don't
  * need to change in this commit.
  */

package/dist/runtime/node-runner.js

@@ -187,7 +187,7 @@ export async function runFresh(facetMgr, code, opts) {
     };
 }
 /**
- * BACKWARD-COMPAT shim. The arch-gaps wave's `runNodeScript` is now an
+ * BACKWARD-COMPAT shim. The child-process isolation design's `runNodeScript` is now an
  * alias for `runFresh` so the call sites in src/session/init.ts don't
  * need to change in this commit.
  */

package/dist/runtime/node-shims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-shims.d.ts","sourceRoot":"","sources":["../../src/runtime/node-shims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA2BH,wBAAgB,iBAAiB,IAAI,MAAM,CA65F1C"}
+{"version":3,"file":"node-shims.d.ts","sourceRoot":"","sources":["../../src/runtime/node-shims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA2BH,wBAAgB,iBAAiB,IAAI,MAAM,CAu4F1C"}