@nimbus-sh/worker 0.10.0 → 0.11.0

package/dist/replica/routing.d.ts

@@ -1,5 +1,5 @@
 /**
- * replica-routing.ts — W12 — DO read replica routing primitives.
+ * replica/routing.ts — W12 — DO read replica routing primitives.
  *
  * Pure module (no `cloudflare:workers` import) so it can be unit-tested
  * under Bun. NimbusSession wraps these helpers in its constructor and
@@ -28,10 +28,7 @@
  *     pins it near the DO; RPC into the DO is unaffected. DOs themselves
  *     don't move.
  *
- *   - ~lambros/Feedback for DO read replication API: replicas error with
- *     "Network connection lost" during high-volume writes. Mitigation:
- *     suspend replicas during npm install / git clone bursts (the
- *     suspension state lives in `replica-suspension.ts`).
+
  */
 /** Result of `classifyReplicaPolicy(pathname, method)`. */
 export type ReplicaPolicy = 
@@ -45,34 +42,12 @@ export type ReplicaPolicy =
  *  not subscribe its own hibernation handler to a stream the primary
  *  appends to. */
  | 'primary-only-ws';
-/** Eventual-consistency tolerance in ms (replica-eligible routes only). */
-export interface RoutePolicy {
-    policy: ReplicaPolicy;
-    /** Max acceptable replication lag for this route, in ms. `null` for
-     *  primary-only routes (not replicable). */
-    toleranceMs: number | null;
-}
 /**
  * Pure routing decision. Mirrors the route table in W12-plan §2.
  * Methods other than GET/HEAD on a replica-eligible route escape to
  * primary-only — read replicas only make sense for reads.
  */
 export declare function classifyReplicaPolicy(pathname: string, method: string): ReplicaPolicy;
-/**
- * Eventual-consistency tolerance per route (in ms).
- *
- * Returns `null` for primary-only routes (not replicable) and a numeric
- * tolerance for replica-eligible routes. The probe
- * `eventual-consistency-window-ms.mjs` enforces that every eligible route
- * has a tolerance ≤ 2000ms.
- *
- * The 2-second budget aligns with D1 read-replication best practice
- * (D1 docs § "Replica lag and consistency model"); DO replicas are
- * the same architectural pattern.
- */
-export declare function getEventualConsistencyToleranceMs(pathname: string): number | null;
-/** Tolerance lookup table (for diagnostics / observability surfaces). */
-export declare const REPLICA_POLICIES: Record<string, RoutePolicy>;
 export type ReplicasState = 'enabled' | 'enabled-via-configure' | 'unsupported' | 'error';
 export interface TryEnableReplicasResult {
     state: ReplicasState;
@@ -103,17 +78,6 @@ export interface ReplicaStateInspect {
  *     when the SPEC's `waitForBookmark` lands.
  */
 export declare function inspectReplicaState(ctx: any): ReplicaStateInspect;
-/**
- * Capture the current bookmark immediately after a write completes on
- * the primary. The caller (e.g. /api/write-file) can stash the result in
- * a response header / cookie so the next read-your-writes call from the
- * same client can wait for the replica to catch up before responding.
- *
- * Phase 1 of W12 surfaces this as observability only (visible via
- * /api/_diag/memory.replica.bookmark). Phase 2 (W12.5 if measured demand)
- * wires the wait-for-bookmark contract end-to-end.
- */
-export declare function captureBookmarkAfterWrite(ctx: any): string | null;
 export interface DelegationInputs {
     isReplica: boolean;
     policy: ReplicaPolicy;

package/dist/replica/routing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../../src/replica/routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,2DAA2D;AAC3D,MAAM,MAAM,aAAa;AACvB,iEAAiE;AAC/D,YAAY;AACd,wEAAwE;GACtE,mBAAmB;AACrB,uCAAuC;GACrC,cAAc;AAChB;;kBAEkB;GAChB,iBAAiB,CAAC;AAEtB,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,aAAa,CAAC;IACtB;gDAC4C;IAC5C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAMD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,aAAa,CAkDf;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMjF;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAaxD,CAAC;AAMF,MAAM,MAAM,aAAa,GACrB,SAAS,GACT,uBAAuB,GACvB,aAAa,GACb,OAAO,CAAC;AAEZ,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,uBAAuB,CAgBnE;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,mBAAmB,CAgBjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAEjE;AAMD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB;oEACgE;IAChE,MAAM,EAAE,OAAO,CAAC;IAChB;2DACuD;IACvD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAoBzE;AAED,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B;;qBAEiB;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB;yCACqC;IACrC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,EAAE,gBAAgB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,eAAe,CAAC,CA6B1B"}
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../../src/replica/routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,2DAA2D;AAC3D,MAAM,MAAM,aAAa;AACvB,iEAAiE;AAC/D,YAAY;AACd,wEAAwE;GACtE,mBAAmB;AACrB,uCAAuC;GACrC,cAAc;AAChB;;kBAEkB;GAChB,iBAAiB,CAAC;AAStB;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,aAAa,CAkDf;AAcD,MAAM,MAAM,aAAa,GACrB,SAAS,GACT,uBAAuB,GACvB,aAAa,GACb,OAAO,CAAC;AAEZ,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,uBAAuB,CAgBnE;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,mBAAmB,CAgBjE;AAQD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB;oEACgE;IAChE,MAAM,EAAE,OAAO,CAAC;IAChB;2DACuD;IACvD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAoBzE;AAED,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B;;qBAEiB;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB;yCACqC;IACrC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,EAAE,gBAAgB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,eAAe,CAAC,CA6B1B"}

package/dist/replica/routing.js

@@ -1,5 +1,5 @@
 /**
- * replica-routing.ts — W12 — DO read replica routing primitives.
+ * replica/routing.ts — W12 — DO read replica routing primitives.
  *
  * Pure module (no `cloudflare:workers` import) so it can be unit-tested
  * under Bun. NimbusSession wraps these helpers in its constructor and
@@ -28,14 +28,11 @@
  *     pins it near the DO; RPC into the DO is unaffected. DOs themselves
  *     don't move.
  *
- *   - ~lambros/Feedback for DO read replication API: replicas error with
- *     "Network connection lost" during high-volume writes. Mitigation:
- *     suspend replicas during npm install / git clone bursts (the
- *     suspension state lives in `replica-suspension.ts`).
+
  */
+/** Eventual-consistency tolerance in ms (replica-eligible routes only). */
 const PROCESSES_LOGS_RE = /^\/api\/processes\/\d+\/logs$/;
 const PORT_RE = /^\/port\/\d+(\/.*)?$/;
-const TWO_SECONDS = 2000;
 /**
  * Pure routing decision. Mirrors the route table in W12-plan §2.
  * Methods other than GET/HEAD on a replica-eligible route escape to
@@ -105,42 +102,6 @@ export function classifyReplicaPolicy(pathname, method) {
 function isReadMethod(method) {
     return method === 'GET' || method === 'HEAD';
 }
-/**
- * Eventual-consistency tolerance per route (in ms).
- *
- * Returns `null` for primary-only routes (not replicable) and a numeric
- * tolerance for replica-eligible routes. The probe
- * `eventual-consistency-window-ms.mjs` enforces that every eligible route
- * has a tolerance ≤ 2000ms.
- *
- * The 2-second budget aligns with D1 read-replication best practice
- * (D1 docs § "Replica lag and consistency model"); DO replicas are
- * the same architectural pattern.
- */
-export function getEventualConsistencyToleranceMs(pathname) {
-    // Re-classify with a synthetic GET to figure out replica eligibility.
-    const policy = classifyReplicaPolicy(pathname, 'GET');
-    if (policy === 'replica-ok')
-        return TWO_SECONDS;
-    if (policy === 'replica-warm-only')
-        return TWO_SECONDS;
-    return null;
-}
-/** Tolerance lookup table (for diagnostics / observability surfaces). */
-export const REPLICA_POLICIES = {
-    '/api/memory': { policy: 'replica-ok', toleranceMs: TWO_SECONDS },
-    '/api/_diag/memory': { policy: 'replica-ok', toleranceMs: TWO_SECONDS },
-    '/api/processes': { policy: 'replica-ok', toleranceMs: TWO_SECONDS },
-    '/api/stats': { policy: 'replica-ok', toleranceMs: TWO_SECONDS },
-    '/preview/': { policy: 'replica-warm-only', toleranceMs: TWO_SECONDS },
-    '/ws': { policy: 'primary-only-ws', toleranceMs: null },
-    '/api/write-file': { policy: 'primary-only', toleranceMs: null },
-    '/api/mkdir': { policy: 'primary-only', toleranceMs: null },
-    '/api/start-vite': { policy: 'primary-only', toleranceMs: null },
-    '/api/supervisor-rpc': { policy: 'primary-only', toleranceMs: null },
-    '/worker/': { policy: 'primary-only', toleranceMs: null },
-    '/__nimbus/worker/': { policy: 'primary-only', toleranceMs: null },
-};
 /**
  * Best-effort: enable read replicas on this DO instance. Safe to call from
  * the constructor — pre-GA runtimes that lack the API surface no-op.
@@ -198,19 +159,6 @@ export function inspectReplicaState(ctx) {
     catch { /* best-effort */ }
     return { isReplica, primary: isReplica ? s.primary : null, bookmark };
 }
-/**
- * Capture the current bookmark immediately after a write completes on
- * the primary. The caller (e.g. /api/write-file) can stash the result in
- * a response header / cookie so the next read-your-writes call from the
- * same client can wait for the replica to catch up before responding.
- *
- * Phase 1 of W12 surfaces this as observability only (visible via
- * /api/_diag/memory.replica.bookmark). Phase 2 (W12.5 if measured demand)
- * wires the wait-for-bookmark contract end-to-end.
- */
-export function captureBookmarkAfterWrite(ctx) {
-    return inspectReplicaState(ctx).bookmark;
-}
 /**
  * Pure decision: should this isolate forward the Request to the primary
  * via `ctx.storage.primary.fetch(request)`?

package/dist/router/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAuCH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AA+CzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAoWf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAuCH,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AA+CzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAiXf"}

package/dist/router/index.js

@@ -36,7 +36,7 @@ import { buildPreviewHost, isPreviewHostSafeSid, parsePreviewHost, readPreviewHo
 import { parseSessionRoute, forwardToSession, renderInvalidSessionHtml, SESSION_ROUTE_PREFIX, LEGACY_PUBLIC_DO_SEGMENT, PREVIEW_CAPABILITY_HEADER, PUBLIC_BEARER_HEADER, } from '../_shared/session-router.js';
 import { issueNimbusToken, verifyNimbusToken, verifyRequestToken, requireScopes, requireSessionPin, authErrorResponse, setNimbusTokenCookie, NIMBUS_TOKEN_QUERY, NimbusAuthError, NimbusBootstrapConsumedError, NimbusTokenClaimsError, DEFAULT_TOKEN_TTL_MS, ATTACH_BOOTSTRAP_TTL_MS, } from '../auth/index.js';
 import { adoptCtxExports } from '@nimbus-sh/fabric/composition.js';
-import { handleNimbusRemoteApi, } from './remote-api.js';
+import { handleNimbusRemoteApi, remoteApiEnabled, } from './remote-api.js';
 import { parseAgentOAuthStateParam } from '../session/agent.js';
 import { publicDirectoryStub } from './public-directory.js';
 /**
@@ -231,7 +231,9 @@ export function createNimbusHandler(options = {}) {
         if (sdkResponse)
             return sdkResponse;
         if (url.pathname === '/api/nimbus/oauth/callback') {
-            const payload = parseAgentOAuthStateParam(url.searchParams.get('state'));
+            // Signed by the session that started the flow: a state this deployment
+            // did not sign never reaches a Durable Object.
+            const payload = await parseAgentOAuthStateParam(url.searchParams.get('state'), env);
             if (!payload || !isValidSessionId(payload.sessionId)) {
                 return new Response('Invalid OAuth state', { status: 400 });
             }
@@ -344,7 +346,18 @@ export function createNimbusHandler(options = {}) {
                 return Response.json({ url: previewUrl }, { headers: { 'Cache-Control': 'no-store' } });
             }
             // `/s/<id>` and `/s/<id>/` (no inner path) → serve the xterm UI shell.
+            // Only to GET and HEAD: a root DELETE is the SDK's destroy, answered by
+            // handleNimbusRemoteApi above when the remote API is enabled.
             if (route.innerPath === '/' || route.innerPath === '') {
+                if (request.method !== 'GET' && request.method !== 'HEAD') {
+                    return new Response('Method not allowed', {
+                        status: 405,
+                        headers: {
+                            Allow: remoteApiEnabled(options.sdk) ? 'GET, HEAD, DELETE' : 'GET, HEAD',
+                            'Cache-Control': 'no-store',
+                        },
+                    });
+                }
                 if (env.ASSETS) {
                     const shellUrl = new URL('/s/index.html', url.origin);
                     return env.ASSETS.fetch(new Request(shellUrl.toString(), {

package/dist/router/public-directory.d.ts

@@ -47,6 +47,24 @@ export declare function publicDirectoryStub(env: unknown): {
     unbind(capability: string): Promise<void>;
     resolve(capability: string): Promise<PublicDirectoryEntry | null>;
 } | null;
+/**
+ * `{ tenantSegment, sid }` for the session DO this host is, read off its own
+ * DO name — `tn:sub:sid` (or `legacy:public:_:sid`), no request header
+ * needed. A host without a DO id (a unit-test stub) may carry the fields on
+ * itself.
+ */
+export declare function sessionIdentity(host: {
+    ctx?: {
+        id?: {
+            name?: unknown;
+        };
+    };
+    tenantSegment?: string;
+    sessionId?: string;
+}): {
+    tenantSegment: string;
+    sid: string;
+} | null;
 /**
  * Publish a public port's capability to the routing directory. A legacy-
  * public deployment needs no directory — its DO name is already the one

package/dist/router/public-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-directory.d.ts","sourceRoot":"","sources":["../../src/router/public-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;yEACqE;IACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD,oEAAoE;AACpE,qBAAa,oBAAoB;IACnB,OAAO,CAAC,GAAG;gBAAH,GAAG,EAAE;QAAE,OAAO,EAAE;YAClC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YACtD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SACvC,CAAA;KAAE;IAEG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC,IAAI,CAAC;IAoBV,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;CAKxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG;IACjD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACnE,GAAG,IAAI,CAUP;AA6BD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,oEAAoE;AACpE,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf"}
+{"version":3,"file":"public-directory.d.ts","sourceRoot":"","sources":["../../src/router/public-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;yEACqE;IACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD,oEAAoE;AACpE,qBAAa,oBAAoB;IACnB,OAAO,CAAC,GAAG;gBAAH,GAAG,EAAE;QAAE,OAAO,EAAE;YAClC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YACtD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SACvC,CAAA;KAAE;IAEG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC,IAAI,CAAC;IAoBV,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;CAKxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG;IACjD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACnE,GAAG,IAAI,CAUP;AAMD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAWhD;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,oEAAoE;AACpE,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/router/public-directory.js

@@ -70,7 +70,7 @@ import { LEGACY_PUBLIC_DO_SEGMENT } from '../_shared/session-router.js';
  * needed. A host without a DO id (a unit-test stub) may carry the fields on
  * itself.
  */
-function sessionIdentity(host) {
+export function sessionIdentity(host) {
     const name = host.ctx?.id?.name;
     if (typeof name === 'string' && name.length > 0) {
         const cut = name.lastIndexOf(':');

package/dist/router/remote-api.d.ts

@@ -48,7 +48,7 @@ interface NimbusSessionRpcStub {
         preinstall?: string[];
     }): Promise<unknown>;
     _rpcBootProbe(): Promise<unknown>;
-    _rpcExec(command: string, options?: Record<string, unknown>): Promise<unknown>;
+    _rpcExecStream(command: string, options?: Record<string, unknown>): Promise<ReadableStream<Uint8Array>>;
     _rpcStartProcess(command: string, options?: Record<string, unknown>): Promise<unknown>;
     _rpcRunCode(code: string, options?: Record<string, unknown>): Promise<unknown>;
     _rpcReadFile(path: string): Promise<unknown>;
@@ -119,5 +119,7 @@ interface NimbusRemoteEnv extends Partial<NimbusAuthEnv> {
     NIMBUS_SESSION?: NimbusSessionNamespace;
 }
 export declare function handleNimbusRemoteApi(request: Request, env: NimbusRemoteEnv, sdk: NimbusSdkRouterConfig | undefined): Promise<Response | null>;
+/** Whether the remote API (and with it `DELETE /s/<id>/`) is served. */
+export declare function remoteApiEnabled(sdk: NimbusSdkRouterConfig | undefined): boolean;
 export {};
 //# sourceMappingURL=remote-api.d.ts.map

package/dist/router/remote-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAIA,OAAO,EAML,KAAK,aAAa,EAEnB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,UAAU,oBAAoB;IAC5B,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,oBAAoB,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5H,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxH,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,4FAA4F;AAC5F,KAAK,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnH,UAAU,sBAAsB;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,oBAAoB,CAAC;CAChD;AAED,UAAU,eAAgB,SAAQ,OAAO,CAAC,aAAa,CAAC;IACtD,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAmCD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA2E1B"}
+{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAOA,OAAO,EAML,KAAK,aAAa,EAEnB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,UAAU,oBAAoB;IAC5B,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,oBAAoB,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5H,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxH,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,4FAA4F;AAC5F,KAAK,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnH,UAAU,sBAAsB;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,oBAAoB,CAAC;CAChD;AAED,UAAU,eAAgB,SAAQ,OAAO,CAAC,aAAa,CAAC;IACtD,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAgCD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA6F1B;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,GAAG,SAAS,GAAG,OAAO,CAEhF"}

package/dist/router/remote-api.js

@@ -1,7 +1,10 @@
-import { LEGACY_PUBLIC_DO_SEGMENT, } from '../_shared/session-router.js';
+import { LEGACY_PUBLIC_DO_SEGMENT, parseSessionRoute, } from '../_shared/session-router.js';
+import { isValidSessionId } from '../_shared/session-id.js';
 import { z } from 'zod/v4';
+import { WireEncoder, WireDecoder } from '@nimbus-sh/core/_shared/wire-codec.js';
 import { requireScopes, requireSessionPin, verifyRequestToken, NimbusAuthError, isNimbusIdComponent, } from '../auth/index.js';
 import { useRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
+import { EXEC_STREAM_CONTENT_TYPE, collectExecStream, decodeExecStream } from '@nimbus-sh/core/runtime/exec-stream.js';
 const DEFAULT_REMOTE_BASE_PATH = '/api/nimbus/v1';
 const RemoteRpcBodySchema = z.object({
     profile: z.string().optional(),
@@ -11,35 +14,43 @@ const RemoteRpcBodySchema = z.object({
     op: z.string().optional(),
     args: z.array(z.unknown()).optional(),
 }).passthrough();
-const WireBytesSchema = z.object({
-    __nimbusWireType: z.literal('bytes'),
-    base64: z.string(),
-}).passthrough();
 export async function handleNimbusRemoteApi(request, env, sdk) {
     const remote = normalizeRemoteConfig(sdk?.remote);
     if (!remote.enabled)
         return null;
     const url = new URL(request.url);
-    const match = matchRemoteRpc(url.pathname, remote.basePath);
+    // `DELETE /s/<id>/` is the session's own address for `box.destroy()`: the
+    // same operation, under the same authorization, as the RPC below.
+    const sessionRoot = request.method === 'DELETE' ? parseSessionRoute(url.pathname) : null;
+    const destroyingRoot = sessionRoot !== null && sessionRoot.innerPath === '/';
+    const match = destroyingRoot ? { sandboxId: sessionRoot.sessionId } : matchRemoteRpc(url.pathname, remote.basePath);
     if (!match)
         return null;
-    if (request.method === 'OPTIONS')
-        return corsResponse(null, 204);
-    if (request.method !== 'POST') {
-        return remoteJson({ ok: false, error: 'Method not allowed', code: 'E_METHOD_NOT_ALLOWED' }, 405);
+    if (!destroyingRoot) {
+        if (request.method === 'OPTIONS')
+            return corsResponse(null, 204);
+        if (request.method !== 'POST') {
+            return remoteJson({ ok: false, error: 'Method not allowed', code: 'E_METHOD_NOT_ALLOWED' }, 405);
+        }
     }
     if (!env?.NIMBUS_SESSION) {
         return remoteJson({ ok: false, error: 'NIMBUS_SESSION binding is missing', code: 'E_NIMBUS_BINDING_MISSING' }, 500);
     }
-    if (!isNimbusIdComponent(match.sandboxId)) {
+    if (!isNimbusIdComponent(match.sandboxId) || (destroyingRoot && !isValidSessionId(match.sandboxId))) {
         return remoteJson({ ok: false, error: 'Invalid sandbox id', code: 'E_SANDBOX_ID' }, 400);
     }
     let body;
-    try {
-        body = RemoteRpcBodySchema.parse(decodeWire(await request.json()));
+    if (destroyingRoot) {
+        const reason = request.headers.get('X-Nimbus-Cleanup-Reason');
+        body = { op: 'destroy', args: [reason === null ? {} : { reason }] };
     }
-    catch (e) {
-        return remoteJson({ ok: false, error: `Invalid JSON body: ${errorMessage(e)}`, code: 'E_BAD_JSON' }, 400);
+    else {
+        try {
+            body = RemoteRpcBodySchema.parse(WireDecoder.parse(await request.json()));
+        }
+        catch (e) {
+            return remoteJson({ ok: false, error: `Invalid JSON body: ${errorMessage(e)}`, code: 'E_BAD_JSON' }, 400);
+        }
     }
     const remoteAuth = await resolveRemoteAuth(request, env, remote, match.sandboxId);
     if (remoteAuth instanceof Response)
@@ -70,6 +81,13 @@ export async function handleNimbusRemoteApi(request, env, sdk) {
         // `rpcMs` only when the caller sets `diag`, so the normal SDK envelope
         // is unchanged.
         const wantDiag = body.diag === true;
+        // The one op whose answer is a stream: the body is the encoded exec
+        // stream itself, so output flows under the client's own backpressure.
+        if (body.op === 'execStream') {
+            const args = body.args ?? [];
+            const wire = await ctx.stub._rpcExecStream(stringArg(args[0], 'command'), execOptions(ctx, args[1]));
+            return corsResponse(wire, 200, { 'Content-Type': EXEC_STREAM_CONTENT_TYPE });
+        }
         const t0 = Date.now();
         return await useRpcResource(dispatchRemoteRpc(ctx), (result) => remoteJson(wantDiag ? { ok: true, result, rpcMs: Date.now() - t0 } : { ok: true, result }));
     }
@@ -82,6 +100,10 @@ export async function handleNimbusRemoteApi(request, env, sdk) {
         }, err.httpStatus);
     }
 }
+/** Whether the remote API (and with it `DELETE /s/<id>/`) is served. */
+export function remoteApiEnabled(sdk) {
+    return normalizeRemoteConfig(sdk?.remote).enabled;
+}
 function normalizeRemoteConfig(remote) {
     const value = typeof remote === 'object' ? remote : {};
     return {
@@ -154,7 +176,7 @@ async function dispatchRemoteRpc(ctx) {
         case 'bootProbe':
             return ctx.stub._rpcBootProbe();
         case 'exec':
-            return ctx.stub._rpcExec(stringArg(args[0], 'command'), execOptions(ctx, args[1]));
+            return collectExecStream(decodeExecStream(await ctx.stub._rpcExecStream(stringArg(args[0], 'command'), execOptions(ctx, args[1]))));
         case 'startProcess':
             return ctx.stub._rpcStartProcess(stringArg(args[0], 'command'), execOptions(ctx, args[1]));
         case 'runCode': {
@@ -311,6 +333,9 @@ function execOptions(ctx, value) {
     if (options.cred !== undefined) {
         throw apiError('cred is not accepted over the remote API', 'E_ARG_SHAPE', 400);
     }
+    // A named shell owns its cwd; defaulting one here reset it on every call.
+    if (options.shellId !== undefined && options.cwd === undefined)
+        return options;
     return {
         ...options,
         cwd: typeof options.cwd === 'string' ? options.cwd : ctx.root,
@@ -433,7 +458,7 @@ function trimSlashes(value) {
     return value.slice(start, end);
 }
 function remoteJson(value, status = 200) {
-    return corsResponse(JSON.stringify(encodeWire(value)), status, {
+    return corsResponse(JSON.stringify(WireEncoder.parse(value)), status, {
         'Content-Type': 'application/json',
     });
 }
@@ -449,65 +474,3 @@ function corsResponse(body, status, headers = {}) {
         },
     });
 }
-function encodeWire(value) {
-    if (value instanceof Uint8Array) {
-        return {
-            __nimbusWireType: 'bytes',
-            base64: bytesToBase64(value),
-        };
-    }
-    if (value instanceof ArrayBuffer) {
-        return {
-            __nimbusWireType: 'bytes',
-            base64: bytesToBase64(new Uint8Array(value)),
-        };
-    }
-    if (ArrayBuffer.isView(value)) {
-        const view = value;
-        return {
-            __nimbusWireType: 'bytes',
-            base64: bytesToBase64(new Uint8Array(view.buffer, view.byteOffset, view.byteLength)),
-        };
-    }
-    if (Array.isArray(value))
-        return value.map(encodeWire);
-    if (value && typeof value === 'object') {
-        const out = {};
-        for (const [key, item] of Object.entries(value)) {
-            if (item !== undefined)
-                out[key] = encodeWire(item);
-        }
-        return out;
-    }
-    return value;
-}
-function decodeWire(value) {
-    const bytes = WireBytesSchema.safeParse(value);
-    if (bytes.success)
-        return base64ToBytes(bytes.data.base64);
-    if (Array.isArray(value))
-        return value.map(decodeWire);
-    if (value && typeof value === 'object') {
-        const out = {};
-        for (const [key, item] of Object.entries(value)) {
-            out[key] = decodeWire(item);
-        }
-        return out;
-    }
-    return value;
-}
-function bytesToBase64(bytes) {
-    let binary = '';
-    const chunk = 0x8000;
-    for (let i = 0; i < bytes.length; i += chunk) {
-        binary += String.fromCharCode(...bytes.subarray(i, i + chunk));
-    }
-    return btoa(binary);
-}
-function base64ToBytes(base64) {
-    const binary = atob(base64);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++)
-        bytes[i] = binary.charCodeAt(i);
-    return bytes;
-}

package/dist/runtime/bash-repl.js

@@ -1,6 +1,6 @@
 import { formatShellPrompt } from '@nimbus-sh/core/substrate/lifo/shell/Shell.js';
 import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
-import { withHostFilesystem } from '@nimbus-sh/core/shell/execution-fs.js';
+import { withHostView } from '@nimbus-sh/core/runtime/process-files.js';
 import { createBashFacetSession } from '@nimbus-sh/core/runtime/bash-runner.js';
 import { facetHostForManager } from './facet-loader-host.js';
 import { ReplSession, } from './repl-session.js';
@@ -84,7 +84,7 @@ class BashReplAdapter {
     async ensureSession(signal) {
         if (this.session)
             return null;
-        this.session = await withHostFilesystem(this.deps.authority, CRED_KERNEL, (artifacts) => createBashFacetSession({
+        this.session = await withHostView(this.deps.authority, CRED_KERNEL, (artifacts) => createBashFacetSession({
             facets: facetHostForManager(this.deps.facetMgr),
             artifacts,
             filesystem: this.deps.filesystem,

package/dist/runtime/bun-repl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bun-repl.d.ts","sourceRoot":"","sources":["../../src/runtime/bun-repl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAKlE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAiTD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAInE"}
+{"version":3,"file":"bun-repl.d.ts","sourceRoot":"","sources":["../../src/runtime/bun-repl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAKlE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AA6RD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAInE"}

package/dist/runtime/bun-repl.js

@@ -31,7 +31,7 @@
  * thrown by vm bubble up; we surface them as stderr via the runtime
  * stderr capture.
  */
-import { ReplSession } from './repl-session.js';
+import { ReplSession, replPushResult } from './repl-session.js';
 import { BUN_SHIM_PREAMBLE, BUN_VERSION } from './bun-runner.js';
 class BunReplAdapter {
     pool = null;
@@ -93,18 +93,7 @@ class BunReplAdapter {
         catch (e) {
             return { kind: 'error', stderr: `[bun-repl] push dispatch failed: ${e?.message || e}\n` };
         }
-        if (result.exit) {
-            return {
-                kind: 'exit',
-                exitCode: result.exitCode || 0,
-                stdout: result.stdout,
-                stderr: result.stderr,
-            };
-        }
-        if (result.incomplete) {
-            return { kind: 'incomplete' };
-        }
-        return { kind: 'output', stdout: result.stdout || '', stderr: result.stderr || '' };
+        return replPushResult(result);
     }
     async close() {
         if (this.pool) {

package/dist/runtime/esbuild-wasm-bytes.d.ts

@@ -1,8 +1,9 @@
 /**
- * esbuild-wasm-bytes.ts — supervisor-side fetcher for the two esbuild-wasm
- * artifacts a transform facet is built from: the wasm binary and the JS
- * adapter that drives it. Both live in the static-assets layer
- * (env.ASSETS); this module hands them to the caller when needed.
+ * esbuild-wasm-bytes.ts — supervisor-side fetcher for the artifacts the
+ * esbuild facet is built from: the wasm binary, the JS adapter that drives
+ * it, and the runner of the `esbuild` command. All three live in the
+ * static-assets layer (env.ASSETS); this module hands them to the caller when
+ * needed.
  *
  * Cache strategy
  * ──────────────
@@ -32,7 +33,10 @@
  * The JS adapter followed the wasm for the same reason at a smaller
  * scale: the supervisor already imports esbuild-wasm's browser build as a
  * module for its own transforms, so carrying the same 117 KiB again as a
- * string literal for facets doubled it in the Worker bundle.
+ * string literal for facets doubled it in the Worker bundle. The CLI runner
+ * (32 KiB of Go glue and fs shim) only ever runs in the facet, so it is
+ * staged too; its name carries a prefix of its digest, because unlike the
+ * other two it changes without an esbuild upgrade.
  *
  * Each call to `fetchEsbuildWasmBytes(env)` now does:
  *   - one `caches.default.match()` — sub-millisecond on hit
@@ -71,6 +75,8 @@ export interface EsbuildWasmFetchEnv {
  */
 export declare const ESBUILD_WASM_L2_KEY: string;
 export declare const ESBUILD_JS_L2_KEY: string;
+/** The CLI runner's key names its build id, so each rebuild lands a fresh entry. */
+export declare const ESBUILD_CLI_L2_KEY: string;
 /**
  * Fetch the esbuild-wasm bytes from the static-assets layer.
  *
@@ -91,4 +97,10 @@ export declare function fetchEsbuildWasmBytes(env: EsbuildWasmFetchEnv): Promise
  * splice it in verbatim, so it is verified like the wasm it drives.
  */
 export declare function fetchEsbuildJsFnBody(env: EsbuildWasmFetchEnv): Promise<string>;
+/**
+ * Fetch the `esbuild` command's runner: Go's wasm_exec.js and the typed fs
+ * shim, a script that installs `globalThis.__esbuildCliRun` when the esbuild
+ * facet evaluates it. Verified like the adapter it sits beside.
+ */
+export declare function fetchEsbuildCliRunner(env: EsbuildWasmFetchEnv): Promise<string>;
 //# sourceMappingURL=esbuild-wasm-bytes.d.ts.map

package/dist/runtime/esbuild-wasm-bytes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-wasm-bytes.d.ts","sourceRoot":"","sources":["../../src/runtime/esbuild-wasm-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAWH;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAA2D,CAAC;AAC5F,eAAO,MAAM,iBAAiB,QAAyD,CAAC;AA0BxF;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAEpF;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpF"}
+{"version":3,"file":"esbuild-wasm-bytes.d.ts","sourceRoot":"","sources":["../../src/runtime/esbuild-wasm-bytes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAWH;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAA2D,CAAC;AAC5F,eAAO,MAAM,iBAAiB,QAAyD,CAAC;AACxF,oFAAoF;AACpF,eAAO,MAAM,kBAAkB,QAA0D,CAAC;AAmC1F;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE9E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/E"}