@nimbus-sh/worker 0.2.1 → 0.2.2

package/dist/session/nimbus-session.js

@@ -30,12 +30,12 @@ import { NpmInstaller } from '../npm/installer.js';
 // (was getEsbuildWasmBytes; cached) to fetchEsbuildWasmBytes (no
 // supervisor cache; goes through env.ASSETS on demand).
 import { setCtxExports } from './ctx-exports.js';
-import { NIMBUS_VERSION, DEFAULT_HOSTNAME, DEFAULT_PATH, CF_COMPAT_DATE } from '@nimbus-sh/core/constants.js';
+import { NIMBUS_VERSION, DEFAULT_MOUNT_POINTS, CF_COMPAT_DATE } from '@nimbus-sh/core/constants.js';
+import { seedBaseFilesystem } from '@nimbus-sh/core/workspace';
 import { seedProject } from '@nimbus-sh/core/vfs/seed-project.js';
 import { BASE_PATH_HEADER } from '../_shared/session-router.js';
 import { ATTACH_BOOTSTRAP_JTI_KEY_PREFIX, SESSION_DESTROYED_KEY } from './keys.js';
 import { appendScrollback } from './state-store.js';
-import { dec } from '@nimbus-sh/core/_shared/bytes.js';
 import { notifyTerminalEvent, wireProcessLogSocketBroadcast } from '../runtime/process-logs-api.js';
 // S3: tryEnableReplicas + getReplicaState extracted to ./nimbus-session-replica.ts.
 import { wireReplicasOnConstruct as _w12WireReplicasOnConstruct, getReplicaState as _w12GetReplicaState, } from './replica-routes.js';
@@ -1359,64 +1359,20 @@ export class NimbusSession extends CloudflareDurableObject {
                 fs.mkdir(dir, { recursive: true });
         }
     }
+    /**
+     * The starter content a fresh Nimbus session shows a user: the banner, the
+     * sample files, and the Vite starter app.
+     *
+     * The base the OS boots on — the mount directories, /etc/passwd, /etc/group,
+     * /etc/profile, ~/.nimbusrc — comes from the workspace's own seed, which
+     * this calls rather than restates. Both are idempotent, so the workspace
+     * re-running it when it composes the shell costs a handful of existence
+     * checks and changes nothing.
+     */
     seedFilesystem() {
+        seedBaseFilesystem(this.sqliteFs, DEFAULT_MOUNT_POINTS);
         const fs = this.sqliteFs.as(CRED_SESSION_USER);
         const rootFs = this.sqliteFs.as(CRED_KERNEL);
-        const dirs = [
-            'bin', 'home', 'home/user', 'home/user/.config',
-            'tmp', 'var', 'var/log', 'usr', 'usr/bin', 'usr/lib',
-            'usr/lib/node_modules', 'usr/share', 'usr/share/pkg',
-            'usr/share/pkg/node_modules', 'opt',
-            'home/user/projects',
-        ];
-        for (const dir of dirs) {
-            if (!fs.exists(dir))
-                fs.mkdir(dir, { recursive: true });
-        }
-        this.ensureGlobalPrefixDirs('usr/local');
-        if (!rootFs.exists('etc')) {
-            rootFs.mkdir('etc', { mode: 0o755 });
-        }
-        else {
-            const etc = rootFs.stat('etc');
-            if (etc.uid !== 0 || etc.gid !== 0)
-                rootFs.chown('etc', 0, 0);
-            if ((etc.mode & 0o7777) !== 0o755)
-                rootFs.chmod('etc', 0o755);
-        }
-        if (!rootFs.exists('etc/hostname')) {
-            rootFs.writeFile('etc/hostname', DEFAULT_HOSTNAME + '\n');
-            rootFs.chown('etc/hostname', CRED_SESSION_USER.uid, CRED_SESSION_USER.gid);
-        }
-        if (!rootFs.exists('etc/os-release')) {
-            rootFs.writeFile('etc/os-release', `NAME="Nimbus"\nVERSION="${NIMBUS_VERSION}"\nID=nimbus\n` +
-                'PRETTY_NAME="Nimbus — Cloud Dev Environment"\n');
-            rootFs.chown('etc/os-release', CRED_SESSION_USER.uid, CRED_SESSION_USER.gid);
-        }
-        const seedRootAccountFile = (path, content) => {
-            if (!rootFs.exists(path))
-                rootFs.writeFile(path, content, { mode: 0o644 });
-            const stat = rootFs.stat(path);
-            if (stat.uid !== 0 || stat.gid !== 0)
-                rootFs.chown(path, 0, 0);
-            if ((stat.mode & 0o7777) !== 0o644)
-                rootFs.chmod(path, 0o644);
-        };
-        seedRootAccountFile('etc/passwd', 'root:x:0:0:root:/root:/bin/sh\n' +
-            'user:x:1000:1000:Nimbus User:/home/user:/bin/sh\n');
-        seedRootAccountFile('etc/group', 'root:x:0:\n' +
-            'user:x:1000:user\n');
-        const defaultProfile = `export PATH=${DEFAULT_PATH}\nexport EDITOR=nano\n`;
-        if (!rootFs.exists('etc/profile')) {
-            rootFs.writeFile('etc/profile', defaultProfile);
-            rootFs.chown('etc/profile', CRED_SESSION_USER.uid, CRED_SESSION_USER.gid);
-        }
-        else if (dec.decode(rootFs.readFile('etc/profile')) === 'export PATH=/usr/bin:/bin\nexport EDITOR=nano\n') {
-            rootFs.writeFile('etc/profile', defaultProfile);
-        }
-        if (!fs.exists('home/user/.nimbusrc')) {
-            fs.writeFile('home/user/.nimbusrc', '# Nimbus shell config\nalias ll="ls -la"\nalias la="ls -a"\nalias l="ls -1"\n');
-        }
         {
             // [BANNER ALIGNMENT FIX] Always re-render the motd so existing
             // sessions whose VFS has the pre-fix mis-aligned banner get the

package/dist/session/programmatic.d.ts

@@ -94,7 +94,7 @@ export interface ProgrammaticHost {
     _w9WireProcessLogPersist?(): void;
     ensureSqliteFs(): void;
     ensureFacetManager(): void;
-    initSession(ws: WebSocket): void;
+    initSession(ws: WebSocket): Promise<void>;
 }
 export interface ProgrammaticReadyOptions {
     preinstall?: string[];

package/dist/session/programmatic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"programmatic.d.ts","sourceRoot":"","sources":["../../src/session/programmatic.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EAAY,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAC/F,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACjG,OAAO,EAAE,YAAY,EAAkB,MAAM,0CAA0C,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAWpF,UAAU,iBAAiB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,IAAI,MAAM,CAAC;IAClB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,+BAA+B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpG;AAED,UAAU,+BAA+B;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,UAAU,mBAAmB;IAC3B,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC;IAC1C,0EAA0E;IAC1E,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,OAAO,EAAE;QACP,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACjD,CAAC;CACH;AAED,UAAU,wBAAwB;IAChC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1C;AAED,UAAU,sBAAsB;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,IAAI,IAAI,CAAC;CACd;AAED,UAAU,wBAAwB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,GAAG,EAAE,iBAAiB,CAAC;IACvB,GAAG,EAAE,mBAAmB,CAAC;IACzB,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,SAAS,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,wBAAwB,CAAC;IACpC,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC9C,aAAa,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC7C,UAAU,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC5C,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACrC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mBAAmB,CAAC,EAAE;QAAE,KAAK,IAAI,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,EAAE,CAAC,YAAY,GAAG;QAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,IAAI,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,GAAG,IAAI,CAAC;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,wBAAwB,CAAC,IAAI,IAAI,CAAC;IAClC,cAAc,IAAI,IAAI,CAAC;IACvB,kBAAkB,IAAI,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,uBAAwB,SAAQ,wBAAwB;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;CACtB;AA2DD,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,EACtB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAwB/C;AAiFD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAoDjC;AAgCD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,uBAAuB,CAAC,CAuClC;AAqBD,wBAAsB,UAAU,CAC9B,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,uBAAuB,GAAG;IACjC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IACrE,OAAO,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;CAC5B,GACL,OAAO,CAAC,sBAAsB,CAAC,CAcjC;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,0EAIlC;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,4EAQlC;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB;;;;;;;;;;;;GAM3D;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAG3F;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/G;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAInI;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAInH;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAGvC;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAGvC;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,qBAA0B;;;;;;;GAiBpC;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAGpF;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM;;;;;GAUvE;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM;;;GAIzE;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,gBAAgB,EACtB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC,CA8EpC"}
+{"version":3,"file":"programmatic.d.ts","sourceRoot":"","sources":["../../src/session/programmatic.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EAAY,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAC/F,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,uDAAuD,CAAC;AACjG,OAAO,EAAE,YAAY,EAAkB,MAAM,0CAA0C,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAWpF,UAAU,iBAAiB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,IAAI,MAAM,CAAC;IAClB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,+BAA+B,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpG;AAED,UAAU,+BAA+B;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,UAAU,mBAAmB;IAC3B,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAAC;IAC1C,0EAA0E;IAC1E,SAAS,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,OAAO,EAAE;QACP,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACjD,CAAC;CACH;AAED,UAAU,wBAAwB;IAChC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1C;AAED,UAAU,sBAAsB;IAC9B,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,IAAI,IAAI,CAAC;CACd;AAED,UAAU,wBAAwB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,GAAG,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,gBAAgB;IAC/B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,GAAG,EAAE,iBAAiB,CAAC;IACvB,GAAG,EAAE,mBAAmB,CAAC;IACzB,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,SAAS,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,wBAAwB,CAAC;IACpC,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC9C,aAAa,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAC7C,UAAU,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC5C,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACrC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mBAAmB,CAAC,EAAE;QAAE,KAAK,IAAI,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,EAAE,CAAC,YAAY,GAAG;QAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,IAAI,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAChF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,UAAU,CAAC,OAAO,UAAU,CAAC,GAAG,IAAI,CAAC;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,wBAAwB,CAAC,IAAI,IAAI,CAAC;IAClC,cAAc,IAAI,IAAI,CAAC;IACvB,kBAAkB,IAAI,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,wBAAwB;IACvC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,uBAAwB,SAAQ,wBAAwB;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,iBAAiB,CAAC;IAC3B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;CACtB;AA2DD,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,EACtB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAwB/C;AAiFD,wBAAsB,OAAO,CAC3B,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,sBAAsB,CAAC,CAoDjC;AAgCD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,uBAAuB,CAAC,CAuClC;AAqBD,wBAAsB,UAAU,CAC9B,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,uBAAuB,GAAG;IACjC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IACrE,OAAO,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;CAC5B,GACL,OAAO,CAAC,sBAAsB,CAAC,CAcjC;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,0EAIlC;AAED,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,4EAQlC;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB;;;;;;;;;;;;GAM3D;AAED,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAG3F;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA0B/G;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAInI;AAED,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAInH;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAGvC;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAGvC;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,qBAA0B;;;;;;;GAiBpC;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAGpF;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM;;;;;GAUvE;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM;;;GAIzE;AAED,wBAAsB,aAAa,CACjC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,wBAAsB,UAAU,CAC9B,IAAI,EAAE,gBAAgB,EACtB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,yBAAyB,CAAC,CA8EpC"}

package/dist/session/programmatic.js

@@ -79,7 +79,7 @@ function runtimeDeps(self) {
 }
 export async function ensureProgrammaticReady(self, options = {}) {
     if (!self.shell) {
-        self.initSession(makeHeadlessWebSocket());
+        await self.initSession(makeHeadlessWebSocket());
         // Programmatic boot owns no real terminal socket. Mark the session
         // drained so a later browser /ws can warm-join instead of 409ing.
         self._b4Phase = 'drained';

package/dist/session/routes.js

@@ -398,7 +398,7 @@ export async function handleFetch(self, request) {
         }
         // Cold init path — first ever /ws (or post-DO-eviction).
         try {
-            self.initSession(server);
+            await self.initSession(server);
         }
         catch (err) {
             console.error('initSession error:', err?.message, err?.stack);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/worker",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Nimbus runtime package for Cloudflare Workers, re-exported publicly through @nimbus-sh/sdk/worker.",
   "keywords": [
     "cloudflare",
@@ -84,7 +84,7 @@
   },
   "dependencies": {
     "@ai-sdk/openai-compatible": "^2.0.41",
-    "@nimbus-sh/core": "^0.2.0",
+    "@nimbus-sh/core": "^0.3.0",
     "@renovatebot/pep440": "^5.0.0",
     "ai": "^6.0.182",
     "clean-git-ref": "^2.0.1",

package/scripts/bundle-facet-workers.mjs

@@ -11,7 +11,8 @@
  *   into a self-contained source string at build time.
  *
  *   For the npm install facet we need the streaming tar parser
- *   (src/npm/tarball-stream.ts) available as a top-level named export
+ *   (@nimbus-sh/core src/_shared/tarball-stream.ts) available as a
+ *   top-level named export
  *   the user function can call. We esbuild-bundle that source file into
  *   a self-contained ES module string, and NimbusFacetPool's `preamble`
  *   option splices it into the generated module between the
@@ -261,7 +262,7 @@ async function bundleBashRunner() {
 async function main() {
   // 1. Tar-parser preamble (existing W2.5/W4 hot-path helpers).
   const tarStripped = await bundleAsPreamble(
-    join(root, 'src', 'npm', 'tarball-stream.ts'),
+    join(coreRoot, 'src', '_shared', 'tarball-stream.ts'),
     'tar-stream',
   );
 
@@ -289,7 +290,7 @@ async function main() {
     ' * generated-workers.ts — AUTO-GENERATED. DO NOT EDIT.',
     ' *',
     ' * Produced by scripts/bundle-facet-workers.mjs from:',
-    ' *   - src/npm/tarball-stream.ts (streaming tar primitives)',
+    ' *   - @nimbus-sh/core src/_shared/tarball-stream.ts (streaming tar primitives)',
     ' *   - @nimbus-sh/core src/_shared/w7-frame.ts (W7 streaming bulk-write encoder)',
     ' *',
     ' * Consumed by src/loaders/loader-pool.ts callers via the `preamble`',

package/scripts/bundle-runtime.mjs

@@ -7,6 +7,13 @@
  *   node scripts/bundle-runtime.mjs clang binji-2020 [--bucket nimbus-runtime-cache]
  *   node scripts/bundle-runtime.mjs python 0.29.4 [--bucket nimbus-runtime-cache]
  *   node scripts/bundle-runtime.mjs --pin-catalog        (read-only; publishes nothing)
+ *   node scripts/bundle-runtime.mjs bash 5.2.37 --npm-package <dir>   (local; no R2)
+ *
+ * `--npm-package` is the SECOND publisher for the same artifacts: it stages
+ * exactly what the R2 path stages, composes the same manifest bytes, and lays
+ * the blobs out under the same content-addressed keys — into a directory that
+ * `npm publish` takes, for the embedders who have npm and no bucket. It reads
+ * nothing from Cloudflare and writes nothing to it. See §--npm-package below.
  *
  * Per `2026-05-10-true-os/plan.md` §2.4:
  *   - Blobs are content-addressed under `blobs/<name>-<version>/<sha256>/<file>`.
@@ -45,10 +52,6 @@ import { tmpdir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
 
 const ACCOUNT = process.env.CLOUDFLARE_ACCOUNT_ID;
-if (!ACCOUNT) {
-  console.error('ERROR: CLOUDFLARE_ACCOUNT_ID env var required');
-  process.exit(1);
-}
 // Resolve the wrangler bin from either the package-local or the
 // repo-root node_modules (this script runs from packages/worker but
 // the bin is hoisted to the workspace root).
@@ -62,6 +65,7 @@ const PYODIDE_WORKERD_ADAPTER = JSON.parse(
 
 const USAGE =
   'usage: bundle-runtime.mjs <name> <version> [--bucket <bucket>]\n' +
+  '       bundle-runtime.mjs <name> <version> --npm-package <dir>\n' +
   '       bundle-runtime.mjs --pin-catalog [--bucket <bucket>]';
 
 /** The bucket the deployed Worker's NIMBUS_RUNTIME_CACHE binding points at.
@@ -74,12 +78,25 @@ const rawArgs = process.argv.slice(2);
 const positionalArgs = [];
 let BUCKET = process.env.NIMBUS_RUNTIME_BUCKET || PRODUCTION_BUCKET;
 let PIN_ONLY = false;
+let NPM_OUT_DIR = null;
 for (let i = 0; i < rawArgs.length; i++) {
   const arg = rawArgs[i];
   if (arg === '--pin-catalog') {
     PIN_ONLY = true;
     continue;
   }
+  if (arg === '--npm-package') {
+    NPM_OUT_DIR = rawArgs[++i];
+    if (!NPM_OUT_DIR) {
+      console.error(USAGE);
+      process.exit(2);
+    }
+    continue;
+  }
+  if (arg.startsWith('--npm-package=')) {
+    NPM_OUT_DIR = arg.slice('--npm-package='.length);
+    continue;
+  }
   if (arg === '--bucket') {
     const value = rawArgs[++i];
     if (!value) {
@@ -96,6 +113,12 @@ for (let i = 0; i < rawArgs.length; i++) {
   positionalArgs.push(arg);
 }
 
+// Every mode but `--npm-package` reads or writes R2 through wrangler.
+if (!NPM_OUT_DIR && !ACCOUNT) {
+  console.error('ERROR: CLOUDFLARE_ACCOUNT_ID env var required');
+  process.exit(1);
+}
+
 // `--pin-catalog` regenerates the build-time root of trust from the catalog
 // already in R2. Read-only: it publishes nothing, so it is safe to run at any
 // time, including while another ingest is in flight against a different bucket.
@@ -127,6 +150,15 @@ const SPECS = {
     license: 'Apache-2.0-with-LLVM-exception',
     wasi_namespace: 'wasi_unstable',
     upstream_base: 'https://raw.githubusercontent.com/binji/wasm-clang/master',
+    npm: {
+      name: '@nimbus-sh/runtime-clang',
+      summary: 'clang 8.0.1 and wasm-ld for wasm32-wasi, with a wasi-libc sysroot',
+      // npm demands semver and this runtime's Nimbus version is a channel
+      // name, so the compiler's own version is what the package carries. The
+      // two namespaces stay separate: the manifest still says `binji-2020`,
+      // and that is what the install root under ~/.nimbus/runtimes is named.
+      version: '8.0.1',
+    },
     files: [
       { src: 'clang',       vfs: 'bin/clang',                  mode: 'exec',   runner: 'clang-runner', binName: 'clang' },
       { src: 'lld',         vfs: 'bin/wasm-ld',                mode: 'exec',   runner: 'clang-runner', binName: 'wasm-ld', kind: 'linker' },
@@ -154,6 +186,10 @@ const SPECS = {
     license: 'Ruby+BSD-2-Clause',
     wasi_namespace: 'wasi_snapshot_preview1',
     upstream_base: 'https://registry.npmjs.org/@ruby/3.3-wasm-wasi/-/3.3-wasm-wasi-2.9.3-2.9.4.tgz',
+    npm: {
+      name: '@nimbus-sh/runtime-ruby',
+      summary: 'Ruby 3.3.4 (ruby.wasm) for wasm32-wasi, with its stdlib packed in',
+    },
     tarball_extract: 'package/dist',  // strip this prefix from src paths inside the tarball
     files: [
       // The Ruby wasm — includes Ruby 3.3.x interpreter + stdlib packed
@@ -194,6 +230,10 @@ const SPECS = {
     license: 'GPL-3.0-or-later AND GPL-2.0-only',
     wasi_namespace: 'wasi_snapshot_preview1',
     local_base: '../wasm/bash',
+    npm: {
+      name: '@nimbus-sh/runtime-bash',
+      summary: 'GNU bash 5.2.37 and BusyBox 1.37.0, cross-compiled to wasm32-wasi',
+    },
     files: [
       { src: 'bash.async.wasm',           vfs: 'share/bash/bash.async.wasm' },
       { src: 'coreutils/busybox.wasm',    vfs: 'share/bash/coreutils/busybox.wasm' },
@@ -271,6 +311,10 @@ const SPECS = {
     license: 'PSF-2.0',
     wasi_namespace: 'wasi_snapshot_preview1',
     local_base: '../wasm/python',
+    npm: {
+      name: '@nimbus-sh/runtime-cpython',
+      summary: 'CPython 3.13.14, cross-compiled to wasm32-wasi, with its stdlib',
+    },
     files: [
       { src: 'python.wasm',   vfs: 'share/cpython/python.wasm' },
       // The same interpreter with numpy and markupsafe's C speedups linked in,
@@ -383,6 +427,19 @@ if (!spec) {
   console.error(`known: ${Object.keys(SPECS).join(', ')}`);
   process.exit(2);
 }
+// Checked before anything is staged: which runtimes we publish to npm is a
+// decision, and a spec that has not made it should cost nothing to find out.
+if (NPM_OUT_DIR) {
+  if (!spec.npm) {
+    console.error(`ERROR: ${key} declares no npm package in its spec.`);
+    console.error('       Add an `npm: { name, summary }` entry to publish it that way.');
+    process.exit(2);
+  }
+  if (spec.ingest_only) {
+    console.error(`ERROR: ${key} is ingest_only — it has no manifest to publish.`);
+    process.exit(2);
+  }
+}
 
 const workDir = join(tmpdir(), `bundle-runtime-${RUNTIME}-${VERSION}`);
 rmSync(workDir, { recursive: true, force: true });
@@ -390,8 +447,12 @@ mkdirSync(workDir, { recursive: true });
 
 console.log(`[bundle-runtime] ${RUNTIME} ${VERSION}`);
 console.log(`[bundle-runtime] work dir: ${workDir}`);
-console.log(`[bundle-runtime] bucket:   ${BUCKET}`);
-console.log(`[bundle-runtime] account:  ${ACCOUNT}`);
+if (NPM_OUT_DIR) {
+  console.log(`[bundle-runtime] target:   ${NPM_OUT_DIR} (npm package; R2 is not read or written)`);
+} else {
+  console.log(`[bundle-runtime] bucket:   ${BUCKET}`);
+  console.log(`[bundle-runtime] account:  ${ACCOUNT}`);
+}
 
 // ── 0. Optional repackage step (sysroot-prep wave) ──────────────────
 // Runs BEFORE the fetch loop. Produces one or more local files inside
@@ -480,6 +541,19 @@ if (!spec.ingest_only) {
   console.log(`[bundle-runtime]   LICENSE → ${licenseBytes.length} bytes sha256=${licenseSha256.slice(0, 16)}…`);
 }
 
+const totalMb = (downloaded.reduce((a, f) => a + f.size, 0) / 1024 / 1024).toFixed(2);
+
+// ── --npm-package: the same artifacts, published through npm ────────
+// Everything above this line is the staging the R2 path performs, and
+// everything below it is Cloudflare. A runtime package is the staged blobs
+// under their content-addressed keys plus the manifest that names them, which
+// is the R2 bucket's shape for one runtime, in a directory `npm publish`
+// takes. Nothing here reads or writes R2.
+if (NPM_OUT_DIR) {
+  writeNpmPackage(NPM_OUT_DIR, composeManifest(downloaded, packageRuntimeArtifacts), downloaded);
+  process.exit(0);
+}
+
 // ── 2. Upload each file as a content-addressed blob (deduped) ──────
 // Content path: blobs/<name>-<version>/<sha256>/<src-name>. Multiple
 // manifest entries pointing at identical content share one R2 upload.
@@ -497,8 +571,6 @@ for (const f of downloaded) {
 // ── 3 + 4. Manifest + catalog. Skipped in ingest_only mode (the swap
 // wave composes those at manifest-compose time; this prep pass only
 // stages the upstream blobs).
-const totalMb = (downloaded.reduce((a, f) => a + f.size, 0) / 1024 / 1024).toFixed(2);
-
 if (spec.ingest_only) {
   console.log(`\n[bundle-runtime] DONE (ingest_only)`);
   console.log(`[bundle-runtime] uploaded ${downloaded.length} file(s) (${totalMb} MiB) for ${RUNTIME}@${VERSION}`);
@@ -507,43 +579,8 @@ if (spec.ingest_only) {
   console.log(`[bundle-runtime] catalog:  UNCHANGED (swap wave will flip default)`);
 } else {
   // ── 3. Write the per-version manifest ────────────────────────────
-  const runtimeArtifacts = downloaded
-    .filter((f) => f.transformMetadata)
-    .map((f) => ({
-      path: f.vfs,
-      kind: f.transformMetadata.kind,
-      id: f.transformMetadata.id,
-      source_sha256: f.transformMetadata.source_sha256,
-      sha256: f.sha256,
-    }));
-  runtimeArtifacts.push(...packageRuntimeArtifacts);
-
-  const manifest = {
-    name: RUNTIME,
-    version: VERSION,
-    license: spec.license,
-    wasi_namespace: spec.wasi_namespace || null,
-    files: downloaded.map((f) => ({
-      path: f.vfs,
-      content: f.r2Key,
-      sha256: f.sha256,
-      size: f.size,
-      ...(f.mode ? { mode: f.mode } : {}),
-    })),
-    entrypoints: spec.files
-      .filter((f) => f.runner)
-      .map((f) => ({
-        binName: f.binName,
-        runner: f.runner,
-        args: [],
-        ...(f.kind ? { kind: f.kind } : {}),
-      })),
-    ...(runtimeArtifacts.length ? { runtime_artifacts: runtimeArtifacts } : {}),
-  };
-
   const manifestLocal = join(workDir, 'manifest.json');
-  const manifestText = JSON.stringify(manifest, null, 2);
-  writeFileSync(manifestLocal, manifestText);
+  writeFileSync(manifestLocal, manifestText(composeManifest(downloaded, packageRuntimeArtifacts)));
   // Digest of the exact bytes uploaded below. The catalog carries it so the
   // supervisor can verify a manifest the same way a manifest lets it verify
   // a blob — see the trust-model note in src/runtime/runtime-catalog.ts.
@@ -788,6 +825,201 @@ function pinCatalogFromR2() {
   }
 }
 
+// ── The manifest ─────────────────────────────────────────────────────
+//
+// What a runtime IS: the files it is made of, the digest of each, and the
+// commands they answer. Both publishers compose it here so an embedder who
+// installed the npm package and a session that ran `nimbus install` are
+// holding the same description of the same runtime, byte for byte.
+
+function composeManifest(downloaded, packageRuntimeArtifacts) {
+  const runtimeArtifacts = downloaded
+    .filter((f) => f.transformMetadata)
+    .map((f) => ({
+      path: f.vfs,
+      kind: f.transformMetadata.kind,
+      id: f.transformMetadata.id,
+      source_sha256: f.transformMetadata.source_sha256,
+      sha256: f.sha256,
+    }));
+  runtimeArtifacts.push(...packageRuntimeArtifacts);
+
+  return {
+    name: RUNTIME,
+    version: VERSION,
+    license: spec.license,
+    wasi_namespace: spec.wasi_namespace || null,
+    files: downloaded.map((f) => ({
+      path: f.vfs,
+      content: f.r2Key,
+      sha256: f.sha256,
+      size: f.size,
+      ...(f.mode ? { mode: f.mode } : {}),
+    })),
+    entrypoints: spec.files
+      .filter((f) => f.runner)
+      .map((f) => ({
+        binName: f.binName,
+        runner: f.runner,
+        args: [],
+        ...(f.kind ? { kind: f.kind } : {}),
+      })),
+    ...(runtimeArtifacts.length ? { runtime_artifacts: runtimeArtifacts } : {}),
+  };
+}
+
+function manifestText(manifest) {
+  return JSON.stringify(manifest, null, 2);
+}
+
+// ── --npm-package ────────────────────────────────────────────────────
+
+/**
+ * Write the runtime as a directory `npm publish` accepts.
+ *
+ * The blobs keep the keys the manifest already names — `blobs/<name>-<version>/
+ * <sha256>/<file>`, the R2 object keys — so the manifest needs no npm-specific
+ * rewrite and comes out byte-identical to the one in the bucket. That is the
+ * point rather than a coincidence: `content` is documented as the publisher's
+ * key for a blob, and for this publisher a path inside its own tarball IS that
+ * key. There is one manifest format and one layout, and `readBlob` below is
+ * the whole of what distinguishes the two publishers.
+ */
+function writeNpmPackage(outDir, manifest, downloaded) {
+  rmSync(outDir, { recursive: true, force: true });
+  mkdirSync(outDir, { recursive: true });
+
+  const written = new Set();
+  let unpackedBytes = 0;
+  for (const f of downloaded) {
+    if (written.has(f.r2Key)) continue;
+    written.add(f.r2Key);
+    unpackedBytes += f.size;
+    const dest = join(outDir, f.r2Key);
+    mkdirSync(dirname(dest), { recursive: true });
+    writeFileSync(dest, f.bytes);
+  }
+
+  writeFileSync(join(outDir, 'manifest.json'), manifestText(manifest));
+  writeFileSync(join(outDir, 'LICENSE'), spec.license_text);
+  writeFileSync(join(outDir, 'index.js'), runtimePackageEntry());
+  writeFileSync(join(outDir, 'index.d.ts'), runtimePackageTypes());
+  writeFileSync(join(outDir, 'README.md'), runtimePackageReadme());
+  const npmVersion = spec.npm.version ?? VERSION;
+  writeFileSync(join(outDir, 'package.json'), `${JSON.stringify({
+    name: spec.npm.name,
+    version: npmVersion,
+    description: `${spec.npm.summary}, as a Nimbus runtime package.`,
+    keywords: ['nimbus', 'wasm', 'wasi', 'runtime', RUNTIME],
+    homepage: 'https://github.com/AshishKumar4/Nimbus',
+    // No `directory`: the package is built from the runtime spec and the wasm
+    // build tree, and has no source directory of its own to point at.
+    repository: { type: 'git', url: 'git+https://github.com/AshishKumar4/Nimbus.git' },
+    bugs: 'https://github.com/AshishKumar4/Nimbus/issues',
+    license: spec.license,
+    type: 'module',
+    main: './index.js',
+    types: './index.d.ts',
+    exports: {
+      '.': { types: './index.d.ts', import: './index.js' },
+      './manifest.json': './manifest.json',
+      './package.json': './package.json',
+    },
+    files: ['index.js', 'index.d.ts', 'manifest.json', 'blobs', 'LICENSE', 'README.md'],
+    // The runtime is inert without the half that installs and runs it, and
+    // `index.d.ts` types itself against that package's exports.
+    peerDependencies: { '@nimbus-sh/core': '>=0.2.0' },
+    publishConfig: { access: 'public' },
+  }, null, 2)}\n`);
+
+  console.log(`\n[bundle-runtime] DONE (npm package)`);
+  console.log(`[bundle-runtime] ${spec.npm.name}@${npmVersion} → ${outDir}`);
+  console.log(`[bundle-runtime] ${written.size} blobs, ${(unpackedBytes / 1024 / 1024).toFixed(2)} MiB unpacked`);
+  console.log(`[bundle-runtime] publish with: npm publish ${outDir}`);
+  console.log(`[bundle-runtime] R2: UNTOUCHED (nothing was read from or written to Cloudflare)`);
+}
+
+/**
+ * The package entry point, identical in every runtime package.
+ *
+ * It is the `RuntimePackage` port from `@nimbus-sh/core`: a manifest, and the
+ * bytes it names. Core verifies every blob against the manifest before it
+ * reaches a filesystem, so this side neither hashes nor validates — it reads.
+ */
+function runtimePackageEntry() {
+  return `/**
+ * A Nimbus runtime package: a manifest, and the content-addressed blobs it
+ * names. Pass the default export to \`NimbusWorkspace.create({ runtimes })\`
+ * and the runtime installs into the workspace filesystem, digest-verified,
+ * at the same path \`nimbus install\` uses on Cloudflare.
+ *
+ * Generated by packages/worker/scripts/bundle-runtime.mjs. Do not edit.
+ */
+
+import { readFileSync } from 'node:fs';
+
+const root = new URL('./', import.meta.url);
+
+export const manifest = JSON.parse(readFileSync(new URL('manifest.json', root), 'utf8'));
+
+/** The bytes of one manifest file entry, by the publisher key it carries. */
+export function readBlob(file) {
+  // Copied rather than handed over: readFileSync returns a pooled Buffer for
+  // small files, whose backing ArrayBuffer holds other files' bytes too.
+  return new Uint8Array(readFileSync(new URL(file.content, root)));
+}
+
+export default { manifest, readBlob };
+`;
+}
+
+function runtimePackageTypes() {
+  return `import type { ManifestFile, RuntimeManifest, RuntimePackage } from '@nimbus-sh/core';
+
+export declare const manifest: RuntimeManifest;
+export declare function readBlob(file: ManifestFile): Uint8Array;
+
+declare const runtimePackage: RuntimePackage;
+export default runtimePackage;
+`;
+}
+
+function runtimePackageReadme() {
+  return `# ${spec.npm.name}
+
+${spec.npm.summary}, packaged for [Nimbus](https://github.com/AshishKumar4/Nimbus).
+
+This package is data: the runtime's wasm and support files, content-addressed,
+plus the manifest that describes them. It does nothing on its own —
+[\`@nimbus-sh/core\`](https://www.npmjs.com/package/@nimbus-sh/core) installs it
+into a workspace filesystem and runs it.
+
+\`\`\`bash
+npm install @nimbus-sh/core ${spec.npm.name}
+\`\`\`
+
+\`\`\`js
+import { NimbusWorkspace, localFacetHost } from '@nimbus-sh/core';
+import ${RUNTIME} from '${spec.npm.name}';
+
+const workspace = await NimbusWorkspace.create({
+  sql,                       // your SQLite, through the SqlDatabase port
+  facets: localFacetHost(),
+  runtimes: [${RUNTIME}],
+});
+\`\`\`
+
+Every file is verified against the manifest's SHA-256 before it reaches the
+filesystem. The same bytes are served to Cloudflare deployments from R2 by
+\`nimbus install ${RUNTIME}\`, under the same manifest.
+
+## Licence
+
+${spec.license}. See the bundled \`LICENSE\` for the notice and where to find
+the full text and corresponding source.
+`;
+}
+
 // ── Runtime transforms ───────────────────────────────────────────────
 
 function runtimeBlobKey(src, sha256) {