@nimbus-sh/worker 0.3.0 → 0.5.0

package/dist/npm/installer.js

@@ -27,21 +27,22 @@ import { packumentUrl } from './r2-cache.js';
 import { npmAddedLine, npmHttpCacheLine, npmHttpFetchLine, npmTitleLine, } from './npm-log.js';
 import { applySwaps, findRejects, lookupSwap, lookupReject, shouldSkipPackage, shouldWarnSkipTransitive, isOptionalNativeBinding, formatSwapNotice, RegistryRejectError, emitRegistryEvent, } from '../facets/wasm-swap-registry.js';
 import { resolvePackageEntry } from '@nimbus-sh/core/_shared/exports-resolver.js';
-import { encodeWriteBatchStream } from '@nimbus-sh/core/_shared/w7-frame.js';
-import { LoaderPool } from '@nimbus-sh/fabric/loader-pool.js';
-import { FanoutPool, IN_DO_THRESHOLD } from '@nimbus-sh/fabric/fanout-pool.js';
+import { encodeWriteBatchStream } from '@nimbus-sh/platform/w7-frame.js';
+import { IsolatePool } from '@nimbus-sh/fabric/isolate-pool.js';
+import { Fanout, IN_DO_THRESHOLD } from '@nimbus-sh/fabric/fanout.js';
 import { TAR_STREAM_PREAMBLE, W7_FRAME_PREAMBLE } from '../loaders/generated-workers.js';
 import { installPackagesInFacet, } from './install-batch-facet.js';
-import { setInstallPhase, recordInstallFacetCounters, recordPreBundleSummary, recordR2RaceCounters, recordCacheStatEvents, readDiagCounters, } from '@nimbus-sh/core/observability/diag-counters.js';
-import { estimateSupervisorHeap } from '@nimbus-sh/core/observability/heap-estimate.js';
-import { describeError } from '@nimbus-sh/core/observability/oom-classify.js';
+import { setInstallPhase, recordInstallFacetCounters, recordPreBundleSummary, recordR2RaceCounters, readDiagCounters, } from '@nimbus-sh/platform/diag-counters.js';
+import { recordCacheStatEvents } from '@nimbus-sh/core/_shared/cache-stats.js';
+import { estimateSupervisorHeap } from '@nimbus-sh/platform/heap-estimate.js';
+import { describeError } from '@nimbus-sh/platform/oom-classify.js';
 import { resolveOnePackumentInFacet, } from './resolve-one-facet.js';
 import { NPM_RESOLVE_PREAMBLE } from '../loaders/npm-resolve-preamble.js';
 import { prebundleOne, buildSliceForSpecifierWithCap, externalsForSpecifier, } from './pre-bundle-facet.js';
 import { PRE_BUNDLE_PREAMBLE } from '../loaders/pre-bundle-preamble.js';
 import { fetchEsbuildWasmBytes } from '../runtime/esbuild-wasm-bytes.js';
-import { CHUNK_SIZE, PRE_BUNDLE_CONCURRENCY, PRE_BUNDLE_SLICE_CAP_BYTES, SUPERVISOR_IN_FLIGHT_ALLOCATION_BUDGET_BYTES, } from '@nimbus-sh/core/constants.js';
-import { acquireSupervisorAllocation } from '@nimbus-sh/core/observability/heavy-alloc-coord.js';
+import { CHUNK_SIZE, PRE_BUNDLE_CONCURRENCY, PRE_BUNDLE_SLICE_CAP_BYTES, SUPERVISOR_IN_FLIGHT_ALLOCATION_BUDGET_BYTES, } from '@nimbus-sh/platform/limits.js';
+import { acquireSupervisorAllocation } from '@nimbus-sh/platform/heavy-alloc-coord.js';
 import { countPackageFiles, BARREL_PKG_FILE_THRESHOLD, packageNameFromSpecifier } from '@nimbus-sh/core/runtime/barrel-detect.js';
 import { scanNamedImports, namedImportSignature, buildSyntheticEntry, buildScopedSliceForSynthetic, syntheticEntryPath, } from '../runtime/barrel-synthesizer.js';
 import { enc } from '@nimbus-sh/core/_shared/bytes.js';
@@ -146,7 +147,7 @@ export class NpmInstaller {
             phases['lock-check'] = Date.now() - phaseStart;
             // ── Phase 1: Resolve ──────────────────────────────────────────
             // Frontier-coordinator path. Each BFS layer dispatches to
-            // FanoutPool.submitMany — width <5 in-DO (in-DO fanout),
+            // Fanout.submitMany — width <5 in-DO (in-DO fanout),
             // width ≥5 peer-DO (peer-DO fanout). Per-package task body is
             // self-contained (resolveOnePackumentInFacet), supervisor builds
             // layer N+1 from layer N's edges. Missing env.LOADER throws at
@@ -222,7 +223,7 @@ export class NpmInstaller {
         setInstallPhase('fetch');
         // Fetch + extract + write new packages.
         //
-        // Single fetch path: one LoaderPool isolate (the batch facet)
+        // Single fetch path: one IsolatePool isolate (the batch facet)
         // runs the entire install. The facet streams tarballs through gunzip+tar
         // and coalesces package-owned paths into shared writeBatchStream waves;
         // every owner awaits each wave it contributed to.
@@ -419,7 +420,7 @@ export class NpmInstaller {
     /**
      * F-2 frontier-coordinator path. Replaces the single-resolve-facet
      * dispatch with a per-package fanout: each BFS layer becomes ONE
-     * `FanoutPool.submitMany` call, layer N+1 builds from the
+     * `Fanout.submitMany` call, layer N+1 builds from the
      * resolved metadata of layer N.
      *
      * Topology auto-routes per layer:
@@ -486,7 +487,7 @@ export class NpmInstaller {
         const RESOLVE_PEER_CAP = 8;
         // F-2 fanout pool. One construction reused across every layer; the
         // pool is stateless across submitMany calls.
-        const fanoutPool = new FanoutPool(this.env, this.ctx, {
+        const fanoutPool = new Fanout(this.env, this.ctx, {
             tag: 'npm-resolve-fanout',
             // 5 minutes per layer is generous; typical layers complete in
             // 1-3 s. Per-task this gates each packument fetch + R2 race.
@@ -561,8 +562,8 @@ export class NpmInstaller {
                 };
                 return { key: name, args: taskSpec };
             });
-            // Dispatch the layer. FanoutPool routes:
-            //   <5 → in-DO fanout in-DO (LoaderPool), concurrency = layer.length (capped at 4)
+            // Dispatch the layer. Fanout routes:
+            //   <5 → in-DO fanout in-DO (IsolatePool), concurrency = layer.length (capped at 4)
             //   ≥5 → peer-DO fanout peer-DO, N peers = min(layer.length, 32)
             let results;
             const layerT0 = Date.now();
@@ -769,12 +770,12 @@ export class NpmInstaller {
         return { resolved, unresolved };
     }
     /**
-     * Batch install via two-tier fan-out (FanoutPool).
+     * Batch install via two-tier fan-out (Fanout).
      *
      * Shard count is `min(specs.length, INSTALL_PEER_CAP)`, and the topology
      * follows from it:
      *   shardCount <  IN_DO_THRESHOLD (5)  → in-DO fanout in-DO
-     *     1 LoaderPool with concurrency = shardCount, capped at
+     *     1 IsolatePool with concurrency = shardCount, capped at
      *     4 by V8 invariant. Each shard is one facet running its own
      *     installPackagesInFacet.
      *   shardCount >= IN_DO_THRESHOLD       → peer-DO fanout peer-DO
@@ -786,7 +787,7 @@ export class NpmInstaller {
      *   `shard-${i}` task key deterministically (tests can predict
      *   placement).
      *
-     * Pre-fix lineage: this site previously ran ONE LoaderPool
+     * Pre-fix lineage: this site previously ran ONE IsolatePool
      *   with concurrency=1, internal pLimit(3) — the explicit "collapses
      *   what was 4 concurrent dynamic workers (pool.map slots) into 1"
      *   Two-tier topology re-expands the fan-out without re-introducing
@@ -851,7 +852,7 @@ export class NpmInstaller {
         // Peer shards dispatch in bounded phases and each phase is a barrier, so
         // the phase profile is what distinguishes shard work from barrier count.
         const phaseProfile = [];
-        const fanoutPool = new FanoutPool(this.env, this.ctx, {
+        const fanoutPool = new Fanout(this.env, this.ctx, {
             tag: 'npm-install-batch',
             // Whole-batch timeout. With per-shard parallelism of N=8 peer
             // DOs each running pLimit(3), Mossaic-class 456 packages
@@ -869,7 +870,7 @@ export class NpmInstaller {
         });
         const tasks = nonEmptyShards.map((shardSpecs, shardIdx) => ({
             // Stable-id router key. Same shardIdx → same peer DO across
-            // runs. Tests can predict placement via FanoutPool's
+            // runs. Tests can predict placement via Fanout's
             // `peerSiblingId(key, peerCount)` helper.
             key: `shard-${shardIdx}`,
             args: { packages: shardSpecs, concurrency: 3 },
@@ -974,7 +975,7 @@ export class NpmInstaller {
         }
         catch (e) {
             // Final catch — preserved from the pre-fix shape so the error
-            // log line shape stays consistent. FanoutPool's internal
+            // log line shape stays consistent. Fanout's internal
             // pools dispose themselves at the end of each submitMany call,
             // so no explicit dispose() is needed here.
             // The earlier inner-catch already logged + threw; if we reach
@@ -1304,7 +1305,7 @@ export class NpmInstaller {
      * JSX elements get rejected as "alien" — silent render failure.
      */
     async prebundleUsedModules(projDir, installed) {
-        // Pre-bundle now runs in LoaderPool isolates (src/pre-bundle-facet.ts);
+        // Pre-bundle now runs in IsolatePool isolates (src/pre-bundle-facet.ts);
         // each facet ships its own bundled esbuild-wasm via the preamble. The
         // supervisor's EsbuildService is no longer on the bundle path — it
         // still serves the transform path (TS/JSX → JS) which is small and
@@ -1444,7 +1445,7 @@ export class NpmInstaller {
         // C'.1 deterministic estimator. process.memoryUsage() returns 0
         // for every field inside a Durable Object class context (only
         // dynamic-worker isolates under nodejs_compat get the real
-        // implementation — see src/observability/diag-counters.ts:4 and
+        // implementation — see @nimbus-sh/platform/diag-counters.js:4 and
         // heap-estimate.ts:6). The previous "supervisor heap 0.0 MiB"
         // line was actively misleading: it printed every time, regardless
         // of what was actually in the heap, and could not be used to
@@ -1515,7 +1516,7 @@ export class NpmInstaller {
         // (where it should live). No supervisor-side caching — see
         // src/esbuild-wasm-bytes.ts for the full architectural rationale.
         //
-        // Bytes are shipped into each facet via LoaderPool's
+        // Bytes are shipped into each facet via IsolatePool's
         // `wasmModules` option which workerd registers in the LOADER
         // `modules` map as `{ wasm: ArrayBuffer }`. Workerd compiles at
         // module-load (startup phase, where wasm code generation is
@@ -1562,12 +1563,12 @@ export class NpmInstaller {
             if (wasmBytes.byteLength > maxRetainedWasmBytes) {
                 throw new RangeError(`pre-bundle wasm payload ${wasmBytes.byteLength} exceeds the ${maxRetainedWasmBytes}-byte retained budget`);
             }
-            // LoaderPool keeps the constructor-time module bytes until
+            // IsolatePool keeps the constructor-time module bytes until
             // dispose(), so retain their exact credit rather than treating
             // construction as a handoff that immediately frees the ArrayBuffer.
             setupAllocation.shrinkTo(wasmBytes.byteLength);
             try {
-                pool = new LoaderPool(this.env, this.ctx, {
+                pool = new IsolatePool(this.env, this.ctx, {
                     concurrency: PRE_BUNDLE_CONCURRENCY,
                     timeoutMs: 60_000,
                     retries: 0,
@@ -1994,7 +1995,7 @@ export class NpmInstaller {
     /**
      * P5 (production reliability) — deterministic supervisor-heap estimate in MiB.
      *
-     * Routes through observability/heap-estimate.ts which sums KNOWN
+     * Routes through @nimbus-sh/platform/heap-estimate.js which sums KNOWN
      * supervisor heap allocation sources from runtime counters that
      * ARE accurate inside a DO context (DiagCounters singleton +
      * SqliteVFS.getStats()). This replaces a previous use of
@@ -2035,7 +2036,7 @@ export class NpmInstaller {
 // process.memoryUsage() which returns 0 for every field inside a
 // Durable Object class context (only dynamic-worker isolates under
 // nodejs_compat get the real implementation — see
-// src/observability/diag-counters.ts:4). The deterministic
+// @nimbus-sh/platform/diag-counters.js:4). The deterministic
 // supervisor-heap estimator is the C'.1 replacement; see
 // NpmInstaller._estimateSupervisorHeapMiB.
 function parentOf(path) {

package/dist/npm/pre-bundle-facet.d.ts

@@ -1,5 +1,5 @@
 /**
- * pre-bundle-facet.ts — LoaderPool entry for esbuild pre-bundling.
+ * pre-bundle-facet.ts — IsolatePool entry for esbuild pre-bundling.
  *
  * Why this exists
  * ───────────────
@@ -14,7 +14,7 @@
  * the previous isolate.
  *
  * The fix is to dispatch each per-specifier `esbuild.build` to a
- * LoaderPool isolate. Each facet has its own 128 MB budget and
+ * IsolatePool isolate. Each facet has its own 128 MB budget and
  * stable-slot reuse keeps the warm-up cost amortized across the 8
  * concurrent specs of a typical install. The install-batch facet uses
  * the same isolate boundary for tarball extraction.

package/dist/npm/pre-bundle-facet.js

@@ -1,5 +1,5 @@
 /**
- * pre-bundle-facet.ts — LoaderPool entry for esbuild pre-bundling.
+ * pre-bundle-facet.ts — IsolatePool entry for esbuild pre-bundling.
  *
  * Why this exists
  * ───────────────
@@ -14,7 +14,7 @@
  * the previous isolate.
  *
  * The fix is to dispatch each per-specifier `esbuild.build` to a
- * LoaderPool isolate. Each facet has its own 128 MB budget and
+ * IsolatePool isolate. Each facet has its own 128 MB budget and
  * stable-slot reuse keeps the warm-up cost amortized across the 8
  * concurrent specs of a typical install. The install-batch facet uses
  * the same isolate boundary for tarball extraction.
@@ -181,7 +181,7 @@ export function externalsForSpecifier(specifier) {
 }
 // ── Facet function ──────────────────────────────────────────────────────
 //
-// `prebundleOne` runs inside a LoaderPool isolate. cloudflare-parallel
+// `prebundleOne` runs inside a IsolatePool isolate. cloudflare-parallel
 // serialises it via fn.toString(); the helpers it references at module
 // scope (ESBUILD_WASM_JS_FN_BODY, resolvePackageEntry) are NOT in the
 // facet's lexical scope at runtime. Instead they're injected by the
@@ -250,7 +250,7 @@ export const prebundleOne = async function prebundleOne(spec, _env) {
     //    runs that at module-load time (where eval is permitted) and
     //    stashes the result on the module-scope const __NIMBUS_ESBUILD_NS.
     //
-    //    The WASM module is shipped into the facet via LoaderPool's
+    //    The WASM module is shipped into the facet via IsolatePool's
     //    `wasmModules` option, registered in the LOADER's modules map as
     //    { wasm: ArrayBuffer }. Workerd compiles it during the worker's
     //    module-load phase (eval permitted there), and the pool's
@@ -285,7 +285,7 @@ export const prebundleOne = async function prebundleOne(spec, _env) {
     if (!initPromise) {
         initPromise = (async () => {
             // Read the WebAssembly.Module the pool registered. The key matches
-            // the name passed to LoaderPool's `wasmModules` option (see
+            // the name passed to IsolatePool's `wasmModules` option (see
             // src/npm-installer.ts:prebundleUsedModules dispatch site).
             const wasmRegistry = globalThis.__NIMBUS_WASM;
             const wasmModule = wasmRegistry && wasmRegistry['esbuild.wasm'];

package/dist/npm/r2-cache.d.ts

@@ -220,7 +220,7 @@ export declare function packumentKey(name: string): string;
  * proving the L2 layer is functional even when local-dev wall-clock
  * latency is too noisy to demonstrate 5×.
  *
- * Diag counters (src/observability/diag-counters.ts) bump for the
+ * Diag counters (@nimbus-sh/platform/diag-counters.js) bump for the
  * SupervisorRPC layer (RPC-perspective hit/miss). These per-instance
  * counters bump for the R2CacheClient call surface itself (L2 vs L3
  * vs miss), independent of who's calling.

package/dist/npm/resolve-facet.d.ts

@@ -1,7 +1,7 @@
 /**
  * resolve-facet.ts — shared wire types for the per-packument resolver facet.
  *
- * The npm resolver phase runs inside a LoaderPool isolate so the
+ * The npm resolver phase runs inside a IsolatePool isolate so the
  * supervisor DO heap stays flat while large packuments are decoded. The
  * per-packument task body lives in resolve-one-facet.ts; this module holds
  * the types exchanged between supervisor and facet over RPC.

package/dist/npm/resolve-facet.js

@@ -1,7 +1,7 @@
 /**
  * resolve-facet.ts — shared wire types for the per-packument resolver facet.
  *
- * The npm resolver phase runs inside a LoaderPool isolate so the
+ * The npm resolver phase runs inside a IsolatePool isolate so the
  * supervisor DO heap stays flat while large packuments are decoded. The
  * per-packument task body lives in resolve-one-facet.ts; this module holds
  * the types exchanged between supervisor and facet over RPC.

package/dist/npm/resolve-one-facet.d.ts

@@ -7,10 +7,10 @@
  * independent fanout tasks. This file is the per-task body: one packument
  * fetch, one version pick, and edge extraction.
  *
- * Each task runs inside a Worker Loader isolate (FanoutPool routes
+ * Each task runs inside a Worker Loader isolate (Fanout routes
  * automatically: <5 = in-DO, ≥5 = peer-DO). The isolate is short-lived;
  * task body has its own ~128 MiB envelope. Parallelism = layer width
- * (capped at 32 by FanoutPool's MAX_PEER_FANOUT).
+ * (capped at 32 by Fanout's MAX_PEER_FANOUT).
  *
  * Stability invariants (cloudflare-parallel serialises via fn.toString)
  * ───────────────────────────────────────────────────────────────────
@@ -180,13 +180,13 @@ export interface ResolveOneResult {
 }
 /**
  * Per-package fanout task body. Serialised via fn.toString() and
- * dispatched by FanoutPool.submitMany — see installer.ts
+ * dispatched by Fanout.submitMany — see installer.ts
  * resolveTreeViaFanout.
  *
- * Function signature MUST be `(spec, env)` so FanoutPool's
+ * Function signature MUST be `(spec, env)` so Fanout's
  * submitMany invocation `fn(item, env)` lines up.
  *
- * `env` is the loader-isolate env supplied by FanoutPool.
+ * `env` is the loader-isolate env supplied by Fanout.
  * `env.SUPERVISOR` is the supervisor-rpc binding (putRegistryEntries,
  * getPackument).
  */

package/dist/npm/resolve-one-facet.js

@@ -7,10 +7,10 @@
  * independent fanout tasks. This file is the per-task body: one packument
  * fetch, one version pick, and edge extraction.
  *
- * Each task runs inside a Worker Loader isolate (FanoutPool routes
+ * Each task runs inside a Worker Loader isolate (Fanout routes
  * automatically: <5 = in-DO, ≥5 = peer-DO). The isolate is short-lived;
  * task body has its own ~128 MiB envelope. Parallelism = layer width
- * (capped at 32 by FanoutPool's MAX_PEER_FANOUT).
+ * (capped at 32 by Fanout's MAX_PEER_FANOUT).
  *
  * Stability invariants (cloudflare-parallel serialises via fn.toString)
  * ───────────────────────────────────────────────────────────────────
@@ -61,13 +61,13 @@
  */
 /**
  * Per-package fanout task body. Serialised via fn.toString() and
- * dispatched by FanoutPool.submitMany — see installer.ts
+ * dispatched by Fanout.submitMany — see installer.ts
  * resolveTreeViaFanout.
  *
- * Function signature MUST be `(spec, env)` so FanoutPool's
+ * Function signature MUST be `(spec, env)` so Fanout's
  * submitMany invocation `fn(item, env)` lines up.
  *
- * `env` is the loader-isolate env supplied by FanoutPool.
+ * `env` is the loader-isolate env supplied by Fanout.
  * `env.SUPERVISOR` is the supervisor-rpc binding (putRegistryEntries,
  * getPackument).
  */

package/dist/router/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAqCH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAoSf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAuCH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AA+BzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAuUf"}

package/dist/router/index.js

@@ -33,11 +33,39 @@
  */
 import { generateSessionId, isValidSessionId, } from '../_shared/session-id.js';
 import { buildPreviewHost, isPreviewHostSafeSid, parsePreviewHost, readPreviewHostSuffix, } from '../_shared/preview-host.js';
-import { parseSessionRoute, forwardToSession, renderInvalidSessionHtml, SESSION_ROUTE_PREFIX, LEGACY_PUBLIC_DO_SEGMENT, } from '../_shared/session-router.js';
+import { parseSessionRoute, forwardToSession, renderInvalidSessionHtml, SESSION_ROUTE_PREFIX, LEGACY_PUBLIC_DO_SEGMENT, PREVIEW_CAPABILITY_HEADER, PUBLIC_BEARER_HEADER, } from '../_shared/session-router.js';
 import { issueNimbusToken, verifyNimbusToken, verifyRequestToken, requireScopes, requireSessionPin, authErrorResponse, setNimbusTokenCookie, NIMBUS_TOKEN_QUERY, NimbusAuthError, NimbusBootstrapConsumedError, NimbusTokenClaimsError, DEFAULT_TOKEN_TTL_MS, ATTACH_BOOTSTRAP_TTL_MS, } from '../auth/index.js';
-import { setCtxExports } from '@nimbus-sh/fabric/ctx-exports.js';
+import { adoptCtxExports } from '@nimbus-sh/fabric/composition.js';
 import { handleNimbusRemoteApi, } from './remote-api.js';
 import { parseAgentOAuthStateParam } from '../session/agent.js';
+import { publicDirectoryStub } from './public-directory.js';
+/**
+ * Positive directory resolutions, per isolate. A capability that resolved
+ * once keeps resolving — the row is deleted only when the port goes
+ * private, and a stale cache entry 404s honestly at the session's own
+ * visibility check anyway. Misses are never cached.
+ */
+const publicTenantCache = new Map();
+/**
+ * The tenant segment a public capability URL forwards under. The directory
+ * is consulted first; a deployment without the binding falls back to the
+ * legacy-public DO name, which is where legacy-mode sessions already live.
+ */
+async function resolvePublicTenantSegment(capability, env) {
+    const cached = publicTenantCache.get(capability);
+    if (cached !== undefined)
+        return cached;
+    const stub = publicDirectoryStub(env);
+    if (stub === null)
+        return LEGACY_PUBLIC_DO_SEGMENT;
+    const entry = await stub.resolve(capability).catch(() => null);
+    if (entry === null) {
+        // An unresolvable capability 404s: no session DO is named for it.
+        return null;
+    }
+    publicTenantCache.set(capability, entry.tenantSegment);
+    return entry.tenantSegment;
+}
 /**
  * Build a Nimbus default-export handler. The returned object is exactly
  * what `export default` expects in a Workers entry module.
@@ -82,7 +110,7 @@ export function createNimbusHandler(options = {}) {
     async function route(request, env, ctx) {
         // Capture ctx.exports on first call (loopback bindings for facets).
         if (ctx?.exports)
-            setCtxExports(ctx.exports);
+            adoptCtxExports(ctx.exports);
         const url = new URL(request.url);
         const previewSuffix = readPreviewHostSuffix(env);
         // ── <port>--<sid>.<suffix> — port preview ───────────────────────
@@ -102,6 +130,30 @@ export function createNimbusHandler(options = {}) {
                     },
                 });
             }
+            if (preview.capability !== undefined) {
+                // The public capability form carries no attach token and never
+                // asks for one: the capability IS the bearer, so there is no
+                // session:attach exchange and no embedder credential to verify.
+                // The capability names the owning session through the public
+                // directory — a positive hit is cached for the life of this
+                // isolate, a miss 404s, and a deployment without the binding
+                // falls back to the legacy-public DO name.
+                const tenantSegment = await resolvePublicTenantSegment(preview.capability, env);
+                if (tenantSegment === null) {
+                    return new Response('Not found', { status: 404 });
+                }
+                return forwardToSession(request, {
+                    sessionId: preview.sid,
+                    innerPath: `/port/${preview.port}${url.pathname === '/' ? '/' : url.pathname}`,
+                    basePath: '',
+                }, env, {
+                    tenantSegment,
+                    extraHeaders: {
+                        [PREVIEW_CAPABILITY_HEADER]: preview.capability,
+                        [PUBLIC_BEARER_HEADER]: '1',
+                    },
+                });
+            }
             if (request.method === 'GET'
                 && request.headers.get('Upgrade') !== 'websocket'
                 && url.searchParams.get(NIMBUS_TOKEN_QUERY)
@@ -281,7 +333,12 @@ export function createNimbusHandler(options = {}) {
                     console.warn('[nimbus] onSessionStart hook threw synchronously:', e);
                 }
             }
-            return forwardToSession(request, route, env, { tenantSegment });
+            return forwardToSession(request, route, env, {
+                tenantSegment,
+                ...(auth.verified?.claims.scopes !== undefined
+                    ? { callerScopes: auth.verified.claims.scopes }
+                    : {}),
+            });
         }
         // ── Back-compat legacy root paths → landing page ────────────────
         if (isLegacyRootPath(url.pathname)) {

package/dist/router/public-directory-do.d.ts

@@ -0,0 +1,17 @@
+/**
+ * public-directory-do.ts — the NimbusPublicDirectory Durable Object class.
+ *
+ * Lives apart from `public-directory.ts` so the session-side helpers and
+ * the router-side stub stay importable outside workerd — this file alone
+ * needs `cloudflare:workers` for `DurableObject`. The wrangler binding
+ * name and migration entry are `NimbusPublicDirectory`.
+ */
+import { DurableObject } from 'cloudflare:workers';
+import { type PublicDirectoryEntry } from './public-directory.js';
+export declare class NimbusPublicDirectory extends DurableObject {
+    private store;
+    bind(capability: string, entry: PublicDirectoryEntry): Promise<void>;
+    unbind(capability: string): Promise<void>;
+    resolve(capability: string): Promise<PublicDirectoryEntry | null>;
+}
+//# sourceMappingURL=public-directory-do.d.ts.map

package/dist/router/public-directory-do.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-directory-do.d.ts","sourceRoot":"","sources":["../../src/router/public-directory-do.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAE/B,qBAAa,qBAAsB,SAAQ,aAAa;IACtD,OAAO,CAAC,KAAK,CAAsC;IAEnD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;IACpD,MAAM,CAAC,UAAU,EAAE,MAAM;IACzB,OAAO,CAAC,UAAU,EAAE,MAAM;CAC3B"}

package/dist/router/public-directory-do.js

@@ -0,0 +1,16 @@
+/**
+ * public-directory-do.ts — the NimbusPublicDirectory Durable Object class.
+ *
+ * Lives apart from `public-directory.ts` so the session-side helpers and
+ * the router-side stub stay importable outside workerd — this file alone
+ * needs `cloudflare:workers` for `DurableObject`. The wrangler binding
+ * name and migration entry are `NimbusPublicDirectory`.
+ */
+import { DurableObject } from 'cloudflare:workers';
+import { PublicDirectoryStore, } from './public-directory.js';
+export class NimbusPublicDirectory extends DurableObject {
+    store = new PublicDirectoryStore(this.ctx);
+    bind(capability, entry) { return this.store.bind(capability, entry); }
+    unbind(capability) { return this.store.unbind(capability); }
+    resolve(capability) { return this.store.resolve(capability); }
+}

package/dist/router/public-directory.d.ts

@@ -0,0 +1,75 @@
+/**
+ * public-directory.ts — capability → session routing for public preview hosts.
+ *
+ * The public capability host form `<cap>--<port>--<sid>.<suffix>` carries
+ * no session:attach credential, so the router has no verified tenant to
+ * name the session DO with. This singleton Durable Object is the one
+ * lookup that answers it: keyed by the unguessable 24-hex capability,
+ * it says which tenant segment + sid + port the capability belongs to.
+ * Rows are written by the session the moment a port goes public and are
+ * deleted on unexpose/clear/remove — there is no listing API, so the
+ * directory is never an enumeration surface.
+ */
+export interface PublicDirectoryEntry {
+    readonly tenantSegment: string;
+    readonly sid: string;
+    readonly port: number;
+}
+/** The DO body, usable with any `{ storage }` the tests hand it. */
+export declare class PublicDirectoryStore {
+    private ctx;
+    constructor(ctx: {
+        storage: {
+            get<T = unknown>(key: string): Promise<T | undefined>;
+            put(key: string, value: unknown): Promise<void>;
+            delete(key: string): Promise<unknown>;
+        };
+    });
+    bind(capability: string, entry: {
+        tenantSegment: string;
+        sid: string;
+        port: number;
+    }): Promise<void>;
+    unbind(capability: string): Promise<void>;
+    resolve(capability: string): Promise<PublicDirectoryEntry | null>;
+}
+/**
+ * The stub the router and the session share: one name, one binding, one
+ * instance. A missing binding on an enforce-mode deployment is loud at the
+ * caller — this helper returns null and the caller decides.
+ */
+export declare function publicDirectoryStub(env: unknown): {
+    bind(capability: string, entry: PublicDirectoryEntry): Promise<void>;
+    unbind(capability: string): Promise<void>;
+    resolve(capability: string): Promise<PublicDirectoryEntry | null>;
+} | null;
+/**
+ * Publish a public port's capability to the routing directory. A legacy-
+ * public deployment needs no directory — its DO name is already the one
+ * the public form resolves to — and is allowed to run without the binding.
+ * Anything else MUST bind, and a missing `NIMBUS_PUBLIC_DIRECTORY` binding
+ * on a non-legacy deployment is a loud error: the exposure would be half-
+ * public — stored as public, unroutable in practice.
+ */
+export declare function bindPublicPortCapability(host: {
+    env?: unknown;
+    ctx?: {
+        id?: {
+            name?: unknown;
+        };
+    };
+    tenantSegment?: string;
+    sessionId?: string;
+}, capability: string, port: number): Promise<void>;
+/** Retire a public port's capability from the routing directory. */
+export declare function unbindPublicPortCapability(host: {
+    env?: unknown;
+    ctx?: {
+        id?: {
+            name?: unknown;
+        };
+    };
+    tenantSegment?: string;
+    sessionId?: string;
+}, capability: string): Promise<void>;
+//# sourceMappingURL=public-directory.d.ts.map

package/dist/router/public-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-directory.d.ts","sourceRoot":"","sources":["../../src/router/public-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAMD,oEAAoE;AACpE,qBAAa,oBAAoB;IACnB,OAAO,CAAC,GAAG;gBAAH,GAAG,EAAE;QAAE,OAAO,EAAE;YAClC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YACtD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SACvC,CAAA;KAAE;IAEG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC1D,OAAO,CAAC,IAAI,CAAC;IAgBV,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;CAKxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG;IACjD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACnE,GAAG,IAAI,CAUP;AA6BD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,oEAAoE;AACpE,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf"}