@nimbus-sh/worker 0.4.0 → 0.6.0

package/dist/index.d.ts

@@ -22,6 +22,7 @@
  * runtime and generated assets in one place.
  */
 import { NimbusSession, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub } from './session/nimbus-session.js';
+import { NimbusPublicDirectory } from './router/public-directory-do.js';
 import { SupervisorRPC } from './session/supervisor-rpc.js';
 import { CirrusHmrRPC } from './facets/real-vite-hmr.js';
 export { createNimbusHandler } from './router/index.js';
@@ -36,7 +37,7 @@ export { base64Utf8, base64Url, base64UrlDecode, decodeJsonBase64Url, encodeJson
 export { clearNimbusAgentOAuthCookie, createNimbusAgentOAuthCookie, fetchNimbusCloudflareAccounts, fetchNimbusCloudflareUserInfo, isNimbusCloudflareAccountId, isNimbusTenantSegment, loadNimbusAgentOAuthFromRequest, nimbusAgentAuthCookiePath, nimbusAgentRouteContext, NIMBUS_AGENT_AUTH_COOKIE, NIMBUS_AGENT_AUTH_COOKIE_PURPOSE, NIMBUS_AGENT_AUTH_COOKIE_TTL_SECONDS, NIMBUS_CF_OAUTH_AUTH_URL, NIMBUS_CF_OAUTH_TOKEN_URL, NIMBUS_CF_OAUTH_USERINFO_URL, NIMBUS_CLOUDFLARE_API, readNimbusAgentCookieSecret, readNimbusCookie, requestNimbusCloudflareOAuthToken, serializeNimbusCookie, } from './session/agent-oauth.js';
 export type { NimbusAgentOAuthCookie, NimbusCloudflareAccount, } from './session/agent-oauth.js';
 export type { NimbusAuthEnv, NimbusTokenClaims, VerifiedNimbusToken, } from './auth/index.js';
-export { NimbusSession, SupervisorRPC, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, CirrusHmrRPC, };
+export { NimbusSession, NimbusPublicDirectory, SupervisorRPC, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, CirrusHmrRPC, };
 /**
  * Module-level reference to ctx.exports from the fetch handler.
  * Used by NimbusSession to create loopback bindings for facets.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAWzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,YAAY,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,0BAA0B,EAC1B,QAAQ,EACR,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAIjE,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,YAAY,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC5F,YAAY,EACV,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,eAAe,GAChB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,UAAU,EACV,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,QAAQ,EACR,eAAe,EACf,UAAU,GACX,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAC3B,qBAAqB,EACrB,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,gCAAgC,EAChC,oCAAoC,EACpC,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AA4BzB,OAAO,EACL,aAAa,EACb,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACZ,YAAY,GACb,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,GAAG,CAEnC;;AAOD,wBAAqC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACb,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAWzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,YAAY,EACV,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,YAAY,EACZ,0BAA0B,EAC1B,QAAQ,EACR,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAIjE,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAChF,YAAY,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC5F,YAAY,EACV,WAAW,EACX,eAAe,EACf,MAAM,EACN,QAAQ,EACR,eAAe,GAChB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,UAAU,EACV,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,QAAQ,EACR,eAAe,EACf,UAAU,GACX,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAC3B,qBAAqB,EACrB,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,gCAAgC,EAChC,oCAAoC,EACpC,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,iCAAiC,EACjC,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AA4BzB,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,YAAY,EACZ,YAAY,GACb,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,GAAG,CAEnC;;AAOD,wBAAqC"}

package/dist/index.js

@@ -22,6 +22,7 @@
  * runtime and generated assets in one place.
  */
 import { NimbusSession, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, } from './session/nimbus-session.js';
+import { NimbusPublicDirectory } from './router/public-directory-do.js';
 import { SupervisorRPC } from './session/supervisor-rpc.js';
 import { CirrusHmrRPC } from './facets/real-vite-hmr.js';
 import { createNimbusHandler } from './router/index.js';
@@ -71,7 +72,7 @@ setRegistryEventSink((e) => {
 // Re-export inner-Worker binding shims so wrangler bundles them AND
 // ctx.exports auto-populates Service Bindings for them (via
 // enable_ctx_exports; default at compat date 2026-04-01+).
-export { NimbusSession, SupervisorRPC, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, CirrusHmrRPC, };
+export { NimbusSession, NimbusPublicDirectory, SupervisorRPC, NimbusAssetsRPC, NimbusLoaderRPC, NimbusLoadedWorker, NimbusLoadedEntrypoint, NimbusDurableObjectNamespace, NimbusDOStub, CirrusHmrRPC, };
 /**
  * Module-level reference to ctx.exports from the fetch handler.
  * Used by NimbusSession to create loopback bindings for facets.

package/dist/node-shims-artifact.generated.js

@@ -7,6 +7,6 @@
  * prefix so cache layers never serve stale bytes after a rebuild;
  * NODE_SHIMS_SHA256 is the full digest verified at fetch time.
  */
-export const NODE_SHIMS_ENTRY = "/_assets/runtime/node-shims-fea906843f6d594e.js";
-export const NODE_SHIMS_BUILD_ID = "fea906843f6d594e";
-export const NODE_SHIMS_SHA256 = "fea906843f6d594ee6ba6e9fe286ecc8a803e600c4b340c9343dd6844eaac9a2";
+export const NODE_SHIMS_ENTRY = "/_assets/runtime/node-shims-9e1380d9ee430fcc.js";
+export const NODE_SHIMS_BUILD_ID = "9e1380d9ee430fcc";
+export const NODE_SHIMS_SHA256 = "9e1380d9ee430fcca4e8700a97da811eee0fe7e9cab4c6357e94c3fc21efa2d9";

package/dist/router/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAqCH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AAGzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAoSf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAuCH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AA+CzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAoWf"}

package/dist/router/index.js

@@ -33,11 +33,48 @@
  */
 import { generateSessionId, isValidSessionId, } from '../_shared/session-id.js';
 import { buildPreviewHost, isPreviewHostSafeSid, parsePreviewHost, readPreviewHostSuffix, } from '../_shared/preview-host.js';
-import { parseSessionRoute, forwardToSession, renderInvalidSessionHtml, SESSION_ROUTE_PREFIX, LEGACY_PUBLIC_DO_SEGMENT, } from '../_shared/session-router.js';
+import { parseSessionRoute, forwardToSession, renderInvalidSessionHtml, SESSION_ROUTE_PREFIX, LEGACY_PUBLIC_DO_SEGMENT, PREVIEW_CAPABILITY_HEADER, PUBLIC_BEARER_HEADER, } from '../_shared/session-router.js';
 import { issueNimbusToken, verifyNimbusToken, verifyRequestToken, requireScopes, requireSessionPin, authErrorResponse, setNimbusTokenCookie, NIMBUS_TOKEN_QUERY, NimbusAuthError, NimbusBootstrapConsumedError, NimbusTokenClaimsError, DEFAULT_TOKEN_TTL_MS, ATTACH_BOOTSTRAP_TTL_MS, } from '../auth/index.js';
 import { adoptCtxExports } from '@nimbus-sh/fabric/composition.js';
 import { handleNimbusRemoteApi, } from './remote-api.js';
 import { parseAgentOAuthStateParam } from '../session/agent.js';
+import { publicDirectoryStub } from './public-directory.js';
+/**
+ * Positive directory resolutions, per isolate. A capability that resolved
+ * once keeps resolving — the row is deleted only when the port goes
+ * private, and a stale cache entry 404s honestly at the session's own
+ * visibility check anyway. Misses are never cached.
+ */
+const publicTenantCache = new Map();
+/**
+ * The tenant segment a public capability URL forwards under. The directory
+ * is consulted first; a deployment without the binding falls back to the
+ * legacy-public DO name, which is where legacy-mode sessions already live.
+ * The directory row also carries the port and name the capability was
+ * bound with, which is what the `<cap>--<name>--<sid>` form resolves and
+ * verifies against.
+ */
+async function resolvePublicCapability(capability, env, uncached = false) {
+    const cached = publicTenantCache.get(capability);
+    if (!uncached && cached !== undefined)
+        return cached;
+    const stub = publicDirectoryStub(env);
+    if (stub === null)
+        return { tenantSegment: LEGACY_PUBLIC_DO_SEGMENT, port: null, name: null };
+    const entry = await stub.resolve(capability).catch(() => null);
+    if (entry === null) {
+        // An unresolvable capability 404s: no session DO is named for it.
+        publicTenantCache.delete(capability);
+        return null;
+    }
+    const resolved = {
+        tenantSegment: entry.tenantSegment,
+        port: entry.port,
+        name: entry.name ?? null,
+    };
+    publicTenantCache.set(capability, resolved);
+    return resolved;
+}
 /**
  * Build a Nimbus default-export handler. The returned object is exactly
  * what `export default` expects in a Workers entry module.
@@ -102,6 +139,52 @@ export function createNimbusHandler(options = {}) {
                     },
                 });
             }
+            if (preview.capability !== undefined) {
+                // The public capability form carries no attach token and never
+                // asks for one: the capability IS the bearer, so there is no
+                // session:attach exchange and no embedder credential to verify.
+                // The capability names the owning session through the public
+                // directory — a positive hit is cached for the life of this
+                // isolate, a miss 404s, and a deployment without the binding
+                // falls back to the legacy-public DO name.
+                let resolved = await resolvePublicCapability(preview.capability, env);
+                const matchesHost = (entry) => entry !== null && (preview.name !== undefined
+                    ? entry.name === preview.name && entry.port !== null
+                    : entry.port === null || entry.port === preview.port);
+                // Rename/rebinding can leave a positive isolate cache entry behind.
+                // Verify BOTH host forms, and read through once before refusing.
+                if (resolved !== null && !matchesHost(resolved)) {
+                    resolved = await resolvePublicCapability(preview.capability, env, true);
+                }
+                if (resolved === null || !matchesHost(resolved)) {
+                    return new Response('Not found', { status: 404 });
+                }
+                // The name form is resolved by capability like the port form, then
+                // the name is verified against the directory row: a capability
+                // presented under a name it was not bound with is a 404, never a
+                // guess at some other application.
+                let port;
+                if (preview.name !== undefined) {
+                    if (resolved.name !== preview.name || resolved.port === null) {
+                        return new Response('Not found', { status: 404 });
+                    }
+                    port = resolved.port;
+                }
+                else {
+                    port = preview.port;
+                }
+                return forwardToSession(request, {
+                    sessionId: preview.sid,
+                    innerPath: `/port/${port}${url.pathname === '/' ? '/' : url.pathname}`,
+                    basePath: '',
+                }, env, {
+                    tenantSegment: resolved.tenantSegment,
+                    extraHeaders: {
+                        [PREVIEW_CAPABILITY_HEADER]: preview.capability,
+                        [PUBLIC_BEARER_HEADER]: '1',
+                    },
+                });
+            }
             if (request.method === 'GET'
                 && request.headers.get('Upgrade') !== 'websocket'
                 && url.searchParams.get(NIMBUS_TOKEN_QUERY)
@@ -120,9 +203,15 @@ export function createNimbusHandler(options = {}) {
             });
             if (auth instanceof Response)
                 return auth;
+            // The scoped name form is resolved INSIDE the session — the name is
+            // a reservation alias only that session's records know — so it is
+            // forwarded as `/app/<name>/`, the session's own name-addressed door.
+            const scopedInner = preview.name !== undefined
+                ? `/app/${preview.name}`
+                : `/port/${preview.port}`;
             return forwardToSession(request, {
                 sessionId: preview.sid,
-                innerPath: `/port/${preview.port}${url.pathname === '/' ? '/' : url.pathname}`,
+                innerPath: `${scopedInner}${url.pathname === '/' ? '/' : url.pathname}`,
                 basePath: '',
             }, env, { tenantSegment: auth.tenantSegment });
         }
@@ -281,7 +370,12 @@ export function createNimbusHandler(options = {}) {
                     console.warn('[nimbus] onSessionStart hook threw synchronously:', e);
                 }
             }
-            return forwardToSession(request, route, env, { tenantSegment });
+            return forwardToSession(request, route, env, {
+                tenantSegment,
+                ...(auth.verified?.claims.scopes !== undefined
+                    ? { callerScopes: auth.verified.claims.scopes }
+                    : {}),
+            });
         }
         // ── Back-compat legacy root paths → landing page ────────────────
         if (isLegacyRootPath(url.pathname)) {

package/dist/router/public-directory-do.d.ts

@@ -0,0 +1,17 @@
+/**
+ * public-directory-do.ts — the NimbusPublicDirectory Durable Object class.
+ *
+ * Lives apart from `public-directory.ts` so the session-side helpers and
+ * the router-side stub stay importable outside workerd — this file alone
+ * needs `cloudflare:workers` for `DurableObject`. The wrangler binding
+ * name and migration entry are `NimbusPublicDirectory`.
+ */
+import { DurableObject } from 'cloudflare:workers';
+import { type PublicDirectoryEntry } from './public-directory.js';
+export declare class NimbusPublicDirectory extends DurableObject {
+    private store;
+    bind(capability: string, entry: PublicDirectoryEntry): Promise<void>;
+    unbind(capability: string): Promise<void>;
+    resolve(capability: string): Promise<PublicDirectoryEntry | null>;
+}
+//# sourceMappingURL=public-directory-do.d.ts.map

package/dist/router/public-directory-do.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-directory-do.d.ts","sourceRoot":"","sources":["../../src/router/public-directory-do.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAE/B,qBAAa,qBAAsB,SAAQ,aAAa;IACtD,OAAO,CAAC,KAAK,CAAsC;IAEnD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB;IACpD,MAAM,CAAC,UAAU,EAAE,MAAM;IACzB,OAAO,CAAC,UAAU,EAAE,MAAM;CAC3B"}

package/dist/router/public-directory-do.js

@@ -0,0 +1,16 @@
+/**
+ * public-directory-do.ts — the NimbusPublicDirectory Durable Object class.
+ *
+ * Lives apart from `public-directory.ts` so the session-side helpers and
+ * the router-side stub stay importable outside workerd — this file alone
+ * needs `cloudflare:workers` for `DurableObject`. The wrangler binding
+ * name and migration entry are `NimbusPublicDirectory`.
+ */
+import { DurableObject } from 'cloudflare:workers';
+import { PublicDirectoryStore, } from './public-directory.js';
+export class NimbusPublicDirectory extends DurableObject {
+    store = new PublicDirectoryStore(this.ctx);
+    bind(capability, entry) { return this.store.bind(capability, entry); }
+    unbind(capability) { return this.store.unbind(capability); }
+    resolve(capability) { return this.store.resolve(capability); }
+}

package/dist/router/public-directory.d.ts

@@ -0,0 +1,79 @@
+/**
+ * public-directory.ts — capability → session routing for public preview hosts.
+ *
+ * The public capability host form `<cap>--<port>--<sid>.<suffix>` carries
+ * no session:attach credential, so the router has no verified tenant to
+ * name the session DO with. This singleton Durable Object is the one
+ * lookup that answers it: keyed by the unguessable 24-hex capability,
+ * it says which tenant segment + sid + port the capability belongs to.
+ * Rows are written by the session the moment a port goes public and are
+ * deleted on unexpose/clear/remove — there is no listing API, so the
+ * directory is never an enumeration surface.
+ */
+export interface PublicDirectoryEntry {
+    readonly tenantSegment: string;
+    readonly sid: string;
+    readonly port: number;
+    /** The reservation's name alias, when the capability was bound with one —
+     *  what the `<cap>--<name>--<sid>` host form is verified against. */
+    readonly name?: string;
+}
+/** The DO body, usable with any `{ storage }` the tests hand it. */
+export declare class PublicDirectoryStore {
+    private ctx;
+    constructor(ctx: {
+        storage: {
+            get<T = unknown>(key: string): Promise<T | undefined>;
+            put(key: string, value: unknown): Promise<void>;
+            delete(key: string): Promise<unknown>;
+        };
+    });
+    bind(capability: string, entry: {
+        tenantSegment: string;
+        sid: string;
+        port: number;
+        name?: string;
+    }): Promise<void>;
+    unbind(capability: string): Promise<void>;
+    resolve(capability: string): Promise<PublicDirectoryEntry | null>;
+}
+/**
+ * The stub the router and the session share: one name, one binding, one
+ * instance. A missing binding on an enforce-mode deployment is loud at the
+ * caller — this helper returns null and the caller decides.
+ */
+export declare function publicDirectoryStub(env: unknown): {
+    bind(capability: string, entry: PublicDirectoryEntry): Promise<void>;
+    unbind(capability: string): Promise<void>;
+    resolve(capability: string): Promise<PublicDirectoryEntry | null>;
+} | null;
+/**
+ * Publish a public port's capability to the routing directory. A legacy-
+ * public deployment needs no directory — its DO name is already the one
+ * the public form resolves to — and is allowed to run without the binding.
+ * Anything else MUST bind, and a missing `NIMBUS_PUBLIC_DIRECTORY` binding
+ * on a non-legacy deployment is a loud error: the exposure would be half-
+ * public — stored as public, unroutable in practice.
+ */
+export declare function bindPublicPortCapability(host: {
+    env?: unknown;
+    ctx?: {
+        id?: {
+            name?: unknown;
+        };
+    };
+    tenantSegment?: string;
+    sessionId?: string;
+}, capability: string, port: number, name?: string): Promise<void>;
+/** Retire a public port's capability from the routing directory. */
+export declare function unbindPublicPortCapability(host: {
+    env?: unknown;
+    ctx?: {
+        id?: {
+            name?: unknown;
+        };
+    };
+    tenantSegment?: string;
+    sessionId?: string;
+}, capability: string): Promise<void>;
+//# sourceMappingURL=public-directory.d.ts.map

package/dist/router/public-directory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-directory.d.ts","sourceRoot":"","sources":["../../src/router/public-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;yEACqE;IACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD,oEAAoE;AACpE,qBAAa,oBAAoB;IACnB,OAAO,CAAC,GAAG;gBAAH,GAAG,EAAE;QAAE,OAAO,EAAE;YAClC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YACtD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SACvC,CAAA;KAAE;IAEG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC,IAAI,CAAC;IAoBV,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;CAKxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG;IACjD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACnE,GAAG,IAAI,CAUP;AA6BD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,oEAAoE;AACpE,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/router/public-directory.js

@@ -0,0 +1,122 @@
+/**
+ * public-directory.ts — capability → session routing for public preview hosts.
+ *
+ * The public capability host form `<cap>--<port>--<sid>.<suffix>` carries
+ * no session:attach credential, so the router has no verified tenant to
+ * name the session DO with. This singleton Durable Object is the one
+ * lookup that answers it: keyed by the unguessable 24-hex capability,
+ * it says which tenant segment + sid + port the capability belongs to.
+ * Rows are written by the session the moment a port goes public and are
+ * deleted on unexpose/clear/remove — there is no listing API, so the
+ * directory is never an enumeration surface.
+ */
+const BINDING_NAME = 'NIMBUS_PUBLIC_DIRECTORY';
+const DIRECTORY_NAME = 'public-directory';
+const ROW_PREFIX = 'public-capability:';
+function rowKey(capability) {
+    return `${ROW_PREFIX}${capability}`;
+}
+/** The DO body, usable with any `{ storage }` the tests hand it. */
+export class PublicDirectoryStore {
+    ctx;
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    async bind(capability, entry) {
+        if (!/^[a-f0-9]{24}$/.test(capability)) {
+            throw new Error('NimbusPublicDirectory.bind: capability must be 24 lowercase hex');
+        }
+        if (typeof entry.tenantSegment !== 'string' || entry.tenantSegment.length === 0
+            || typeof entry.sid !== 'string' || entry.sid.length === 0
+            || !Number.isInteger(entry.port) || entry.port < 1 || entry.port > 65535) {
+            throw new Error('NimbusPublicDirectory.bind: entry needs tenantSegment, sid, and a real port');
+        }
+        if (entry.name !== undefined && !/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/.test(entry.name)) {
+            throw new Error('NimbusPublicDirectory.bind: name must be one DNS label');
+        }
+        await this.ctx.storage.put(rowKey(capability), {
+            tenantSegment: entry.tenantSegment,
+            sid: entry.sid,
+            port: entry.port,
+            ...(entry.name !== undefined ? { name: entry.name } : {}),
+        });
+    }
+    async unbind(capability) {
+        await this.ctx.storage.delete(rowKey(capability));
+    }
+    async resolve(capability) {
+        const stored = await this.ctx.storage.get(rowKey(capability));
+        if (!stored)
+            return null;
+        return stored;
+    }
+}
+/**
+ * The stub the router and the session share: one name, one binding, one
+ * instance. A missing binding on an enforce-mode deployment is loud at the
+ * caller — this helper returns null and the caller decides.
+ */
+export function publicDirectoryStub(env) {
+    const namespace = env?.[BINDING_NAME];
+    if (!namespace || typeof namespace.idFromName !== 'function')
+        return null;
+    return namespace.get(namespace.idFromName(DIRECTORY_NAME));
+}
+// ── Session side ─────────────────────────────────────────────────────────────
+import { LEGACY_PUBLIC_DO_SEGMENT } from '../_shared/session-router.js';
+/**
+ * `{ tenantSegment, sid }` for the session DO this host is, read off its own
+ * DO name — `tn:sub:sid` (or `legacy:public:_:sid`), no request header
+ * needed. A host without a DO id (a unit-test stub) may carry the fields on
+ * itself.
+ */
+function sessionIdentity(host) {
+    const name = host.ctx?.id?.name;
+    if (typeof name === 'string' && name.length > 0) {
+        const cut = name.lastIndexOf(':');
+        if (cut > 0)
+            return { tenantSegment: name.slice(0, cut), sid: name.slice(cut + 1) };
+    }
+    if (typeof host.tenantSegment === 'string' && typeof host.sessionId === 'string'
+        && host.tenantSegment.length > 0 && host.sessionId.length > 0) {
+        return { tenantSegment: host.tenantSegment, sid: host.sessionId };
+    }
+    return null;
+}
+/**
+ * Publish a public port's capability to the routing directory. A legacy-
+ * public deployment needs no directory — its DO name is already the one
+ * the public form resolves to — and is allowed to run without the binding.
+ * Anything else MUST bind, and a missing `NIMBUS_PUBLIC_DIRECTORY` binding
+ * on a non-legacy deployment is a loud error: the exposure would be half-
+ * public — stored as public, unroutable in practice.
+ */
+export async function bindPublicPortCapability(host, capability, port, name) {
+    const identity = sessionIdentity(host);
+    if (identity === null)
+        return;
+    if (identity.tenantSegment === LEGACY_PUBLIC_DO_SEGMENT)
+        return;
+    const stub = publicDirectoryStub(host.env);
+    if (stub === null) {
+        throw new Error('Nimbus: a public port exposure needs the NIMBUS_PUBLIC_DIRECTORY binding '
+            + '— without it the capability URL cannot resolve to this session. '
+            + 'Add the binding and the NimbusPublicDirectory migration to wrangler.jsonc.');
+    }
+    await stub.bind(capability, {
+        tenantSegment: identity.tenantSegment, sid: identity.sid, port,
+        ...(name !== undefined ? { name } : {}),
+    });
+}
+/** Retire a public port's capability from the routing directory. */
+export async function unbindPublicPortCapability(host, capability) {
+    const identity = sessionIdentity(host);
+    if (identity === null)
+        return;
+    if (identity.tenantSegment === LEGACY_PUBLIC_DO_SEGMENT)
+        return;
+    const stub = publicDirectoryStub(host.env);
+    if (stub === null)
+        return; // unbind of a bind that never happened is not an error
+    await stub.unbind(capability);
+}

package/dist/router/remote-api.d.ts

@@ -81,10 +81,36 @@ interface NimbusSessionRpcStub {
         bytes?: number;
     }): Promise<unknown>;
     _rpcListPorts(): Promise<unknown>;
-    _rpcExposePort(port: number): Promise<unknown>;
+    _rpcExposePort(port: number, options?: {
+        visibility?: 'scoped' | 'public';
+        name?: string;
+    }): Promise<unknown>;
+    _rpcEnsureDurableApp(input: {
+        owner?: string;
+        preferredPort?: number;
+        visibility?: 'scoped' | 'public';
+    }): Promise<unknown>;
+    _rpcRemoveDurableApp(owner: string): Promise<unknown>;
+    _rpcExposeApp(target: RemoteAppTarget, options?: {
+        visibility?: 'scoped' | 'public';
+        name?: string;
+    }): Promise<unknown>;
+    _rpcListApps(): Promise<unknown>;
+    _rpcRotateLink(target: RemoteAppTarget): Promise<unknown>;
+    _rpcRemoveApp(target: RemoteAppTarget): Promise<unknown>;
     _rpcUnexposePort(port: number): Promise<unknown>;
     _rpcDestroy(options?: Record<string, unknown>): Promise<unknown>;
 }
+/** An app target on the wire: a port, a pid, a name/owner, or the explicit object forms. */
+type RemoteAppTarget = number | string | {
+    port: number;
+} | {
+    pid: number;
+} | {
+    name: string;
+} | {
+    owner: string;
+};
 interface NimbusSessionNamespace {
     idFromName(name: string): DurableObjectId;
     get(id: DurableObjectId): NimbusSessionRpcStub;

package/dist/router/remote-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAIA,OAAO,EAML,KAAK,aAAa,EAEnB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,UAAU,oBAAoB;IAC5B,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,UAAU,sBAAsB;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,oBAAoB,CAAC;CAChD;AAED,UAAU,eAAgB,SAAQ,OAAO,CAAC,aAAa,CAAC;IACtD,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAmCD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA2E1B"}
+{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAIA,OAAO,EAML,KAAK,aAAa,EAEnB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,UAAU,oBAAoB;IAC5B,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,oBAAoB,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5H,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxH,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,4FAA4F;AAC5F,KAAK,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnH,UAAU,sBAAsB;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,oBAAoB,CAAC;CAChD;AAED,UAAU,eAAgB,SAAQ,OAAO,CAAC,aAAa,CAAC;IACtD,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAmCD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA2E1B"}

package/dist/router/remote-api.js

@@ -221,8 +221,32 @@ async function dispatchRemoteRpc(ctx) {
             return ctx.stub._rpcProcessLogs(numberArg(args[0], 'pid'), processLogOptions(args[1]));
         case 'listPorts':
             return ctx.stub._rpcListPorts();
-        case 'exposePort':
-            return ctx.stub._rpcExposePort(numberArg(args[0], 'port'));
+        case 'exposePort': {
+            const options = args[1] === undefined ? undefined : objectArg(args[1]);
+            return ctx.stub._rpcExposePort(numberArg(args[0], 'port'), options === undefined ? undefined : exposeOptions(options));
+        }
+        case 'exposeApp': {
+            const options = args[1] === undefined ? undefined : objectArg(args[1]);
+            return ctx.stub._rpcExposeApp(appTargetArg(args[0]), options === undefined ? undefined : exposeOptions(options));
+        }
+        case 'listApps':
+            return ctx.stub._rpcListApps();
+        case 'rotateLink':
+            return ctx.stub._rpcRotateLink(appTargetArg(args[0]));
+        case 'removeApp':
+            return ctx.stub._rpcRemoveApp(appTargetArg(args[0]));
+        case 'ensureDurableApp': {
+            const input = objectArg(args[0]);
+            return ctx.stub._rpcEnsureDurableApp({
+                owner: stringArg(input.owner, 'owner'),
+                ...(input.preferredPort === undefined ? {} : { preferredPort: numberArg(input.preferredPort, 'preferredPort') }),
+                ...(input.visibility === undefined ? {} : { visibility: input.visibility === 'public' ? 'public' : 'scoped' }),
+            });
+        }
+        case 'removeDurableApp': {
+            const input = objectArg(args[0]);
+            return ctx.stub._rpcRemoveDurableApp(stringArg(input.owner, 'owner'));
+        }
         case 'unexposePort':
             return ctx.stub._rpcUnexposePort(numberArg(args[0], 'port'));
         case 'destroy':
@@ -232,6 +256,28 @@ async function dispatchRemoteRpc(ctx) {
             throw apiError(`Unknown Nimbus sandbox operation: ${String(op)}`, 'E_REMOTE_OP', 400);
     }
 }
+function exposeOptions(options) {
+    return {
+        ...(options.visibility === undefined ? {} : { visibility: options.visibility === 'public' ? 'public' : 'scoped' }),
+        ...(options.name === undefined ? {} : { name: stringArg(options.name, 'name') }),
+    };
+}
+function appTargetArg(value) {
+    if (typeof value === 'number')
+        return numberArg(value, 'target');
+    if (typeof value === 'string')
+        return stringArg(value, 'target');
+    const target = objectArg(value);
+    if (target.port !== undefined)
+        return { port: numberArg(target.port, 'port') };
+    if (target.pid !== undefined)
+        return { pid: numberArg(target.pid, 'pid') };
+    if (target.name !== undefined)
+        return { name: stringArg(target.name, 'name') };
+    if (target.owner !== undefined)
+        return { owner: stringArg(target.owner, 'owner') };
+    throw apiError('Nimbus app target must be a port, a pid, a name, or { port | pid | name | owner }', 'E_ARG_SHAPE', 400);
+}
 function requireAnyScope(ctx, scopes) {
     const explicit = ctx.verified?.claims.scopes;
     if (explicit === undefined)

package/dist/runtime/cpython-resident.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cpython-resident.d.ts","sourceRoot":"","sources":["../../src/runtime/cpython-resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAwDxE;AAeD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,GAAG,oBAAoB,CA8CjF"}
+{"version":3,"file":"cpython-resident.d.ts","sourceRoot":"","sources":["../../src/runtime/cpython-resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAwDxE;AAeD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,GAAG,oBAAoB,CAgDjF"}

package/dist/runtime/cpython-resident.js

@@ -91,6 +91,8 @@ export function cpythonResidentStart(facetMgr) {
         const command = args.command;
         const workerCode = buildCPythonSocketProcessWorker(buildCPythonPreamble());
         const spawned = await facetMgr.spawnWorker(workerCode, command, args.cwd, {
+            resident: { argv: args.argv, runtime: 'python' },
+            restart: z.object({ NIMBUS_RESTART: z.literal('on-failure') }).safeParse(args.startArgs.userEnv).success ? 'on-failure' : 'never',
             compatibilityFlags: ['nodejs_compat'],
             // By path, not by value: the interpreter is 10.6 MiB, more than a single
             // RPC value may carry, so whichever host runs this process reads it itself.
@@ -106,7 +108,7 @@ export function cpythonResidentStart(facetMgr) {
         }
         const data = boot.data;
         if (data.state === 'listening' && typeof data.port === 'number' && data.port > 0) {
-            facetMgr.registerPort(spawned.pid, data.port);
+            await facetMgr.registerPort(spawned.pid, data.port);
             const routeable = await facetMgr.waitForRouteablePorts(spawned.pid);
             const port = routeable.includes(data.port) ? data.port : routeable[0];
             if (!port) {

package/dist/runtime/node-shims.d.ts

@@ -9,7 +9,10 @@
  *   - events: full EventEmitter
  *   - stream: real Readable/Writable/Transform/Duplex with backpressure
  *   - crypto: createHash (FNV-1a sync, SubtleCrypto async), randomBytes/UUID
- *   - zlib: real gzip/gunzip/deflate via CompressionStream/DecompressionStream
+ *   - zlib: forward to workerd's native node:zlib when the facet real-import
+ *     block materialised (full sync/brotli/stream surface; results are the
+ *     host realm's own Buffers, recognized by the widened isBuffer);
+ *     CompressionStream fallback with honest sync refusal
  *   - dns: real DNS resolution via Cloudflare DNS-over-HTTPS
  *   - http: virtual server with port registry for supervisor routing
  *   - https: fetch()-backed request/get

package/dist/runtime/node-shims.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-shims.d.ts","sourceRoot":"","sources":["../../src/runtime/node-shims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAgDH,wBAAgB,iBAAiB,IAAI,MAAM,CAo8N1C"}
+{"version":3,"file":"node-shims.d.ts","sourceRoot":"","sources":["../../src/runtime/node-shims.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAgDH,wBAAgB,iBAAiB,IAAI,MAAM,CA+vO1C"}