@nimbus-sh/worker 0.5.0 → 0.7.0

package/dist/npm/semver.js

@@ -0,0 +1,226 @@
+/**
+ * npm/semver.ts — the one semver implementation the npm resolver picks
+ * versions with.
+ *
+ * The resolver facet (npm/resolve-one-facet.ts) runs inside a dynamic worker
+ * whose only module scope is the preamble string in
+ * loaders/npm-resolve-preamble.ts. That preamble embeds THESE functions by
+ * `fn.toString()`, so the facet's version pick is this module's by
+ * construction — there is no second copy to drift, and
+ * tests/unit/npm-semver.mjs asserts the embedded functions answer exactly
+ * as the exported ones do.
+ *
+ * Every function here is self-contained on purpose: no closures over module
+ * constants, no imports, only calls to the other functions in this file by
+ * name. `toString()` reproduces exactly that, and nothing else.
+ *
+ * What is implemented is the subset of node-semver that npm dependency
+ * ranges use: exact versions, `^`, `~`, comparators, hyphen ranges, `||`,
+ * X-ranges (`1`, `1.2`, `1.x`, `*`), and — the part the previous helper
+ * lacked — prerelease identifiers. Ignoring them meant every `1.0.0-*`
+ * compared equal, so `json-server@1.0.0-beta.15` resolved to whichever
+ * `1.0.0-*` the packument listed first (`1.0.0-alpha.1`) and
+ * `^1.0.0-next.24` picked `1.0.0-next.0`. Measured against the live registry
+ * lists before this rewrite.
+ */
+/** Parse `v1.2.3-beta.4+build` → `[1, 2, 3, ['beta', 4]]`; null for a non-version. */
+export function parseSemver(v) {
+    const m = String(v).trim().replace(/^[v=]+/, '')
+        .match(/^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/);
+    if (!m)
+        return null;
+    const prerelease = m[4] === undefined
+        ? []
+        : m[4].split('.').map((id) => (/^\d+$/.test(id) ? Number(id) : id));
+    return [Number(m[1]), Number(m[2]), Number(m[3]), prerelease];
+}
+/**
+ * Total order. A release sorts above every prerelease of the same triple;
+ * prerelease identifiers compare left to right, numeric before alphanumeric,
+ * numeric by value, alphanumeric lexically, and a longer list sorts above
+ * its prefix (semver.org §11).
+ */
+export function compareSemver(a, b) {
+    if (a[0] !== b[0])
+        return a[0] - b[0];
+    if (a[1] !== b[1])
+        return a[1] - b[1];
+    if (a[2] !== b[2])
+        return a[2] - b[2];
+    const ap = a[3] ?? [];
+    const bp = b[3] ?? [];
+    if (ap.length === 0 && bp.length === 0)
+        return 0;
+    if (ap.length === 0)
+        return 1;
+    if (bp.length === 0)
+        return -1;
+    const n = Math.min(ap.length, bp.length);
+    for (let i = 0; i < n; i++) {
+        const x = ap[i];
+        const y = bp[i];
+        if (x === y)
+            continue;
+        if (typeof x === 'number' && typeof y === 'number')
+            return x - y;
+        if (typeof x === 'number')
+            return -1;
+        if (typeof y === 'number')
+            return 1;
+        return x < y ? -1 : 1;
+    }
+    return ap.length - bp.length;
+}
+/**
+ * One comparator set (the space-separated part of a range) as
+ * `>=lower <upper` bounds. Every range shape npm uses normalises to at
+ * most two bounds, so a set is a list of `[op, version]` pairs.
+ */
+export function semverComparators(part) {
+    const comp = part.trim();
+    if (comp === '' || comp === '*' || comp === 'x' || comp === 'X' || comp === 'latest')
+        return [];
+    const m = comp.match(/^(\^|~>?|>=|<=|>|<|=)?\s*v?(\d+|[xX*])(?:\.(\d+|[xX*]))?(?:\.(\d+|[xX*]))?(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/);
+    if (!m)
+        return null;
+    const op = m[1] === '~>' ? '~' : (m[1] ?? '');
+    const wild = (s) => s === undefined || s === 'x' || s === 'X' || s === '*';
+    const majorWild = wild(m[2]);
+    const minorWild = wild(m[3]);
+    const patchWild = wild(m[4]);
+    const major = majorWild ? 0 : Number(m[2]);
+    const minor = minorWild ? 0 : Number(m[3]);
+    const patch = patchWild ? 0 : Number(m[4]);
+    const pre = m[5] === undefined || patchWild
+        ? []
+        : m[5].split('.').map((id) => (/^\d+$/.test(id) ? Number(id) : id));
+    const lower = [major, minor, patch, pre];
+    const ge = () => [['>=', lower]];
+    const upto = (u) => [['>=', lower], ['<', u]];
+    // X-ranges: `*`, `1`, `1.2`, `1.x`, `1.2.x` — an op in front is applied to
+    // the lowest version the X-range names (`>=1.2` is `>=1.2.0`, `<1.x` is `<1.0.0`).
+    if (majorWild)
+        return [];
+    if (minorWild) {
+        if (op === '' || op === '^' || op === '~' || op === '=')
+            return upto([major + 1, 0, 0, []]);
+        return op === '<=' ? [['<', [major + 1, 0, 0, []]]] : [[op, lower]];
+    }
+    if (patchWild) {
+        if (op === '' || op === '~' || op === '=')
+            return upto([major, minor + 1, 0, []]);
+        if (op === '^')
+            return upto(major === 0 ? [0, minor + 1, 0, []] : [major + 1, 0, 0, []]);
+        return op === '<=' ? [['<', [major, minor + 1, 0, []]]] : [[op, lower]];
+    }
+    switch (op) {
+        case '^':
+            if (major > 0)
+                return upto([major + 1, 0, 0, []]);
+            if (minor > 0)
+                return upto([0, minor + 1, 0, []]);
+            return upto([0, 0, patch + 1, []]);
+        case '~':
+            return upto([major, minor + 1, 0, []]);
+        case '':
+        case '=':
+            return [['=', lower]];
+        default:
+            return [[op, lower]];
+    }
+}
+/**
+ * node-semver's prerelease rule: a prerelease version satisfies a comparator
+ * set only when some comparator in that set names a prerelease of the same
+ * `major.minor.patch`. `^1.0.0-next.24` admits `1.0.0-next.29` and `1.0.0`,
+ * never `1.1.0-rc.1`; `^1.0.0` admits no prerelease at all.
+ */
+export function satisfiesRange(version, range) {
+    const v = parseSemver(version);
+    if (!v)
+        return false;
+    const trimmed = String(range).trim();
+    if (trimmed === '' || trimmed === '*' || trimmed === 'x' || trimmed === 'latest')
+        return v[3].length === 0;
+    for (const orPart of trimmed.split(/\s*\|\|\s*/)) {
+        let comparators = [];
+        const hyphen = orPart.trim().match(/^(\S+)\s+-\s+(\S+)$/);
+        if (hyphen) {
+            const lo = semverComparators('>=' + hyphen[1]);
+            const hi = semverComparators('<=' + hyphen[2]);
+            comparators = lo && hi ? [...lo, ...hi] : null;
+        }
+        else {
+            for (const part of orPart.trim().split(/\s+/)) {
+                const c = semverComparators(part);
+                if (c === null) {
+                    comparators = null;
+                    break;
+                }
+                comparators.push(...c);
+            }
+        }
+        if (comparators === null)
+            continue;
+        let ok = true;
+        for (const [op, r] of comparators) {
+            const cmp = compareSemver(v, r);
+            if (op === '>=' ? cmp < 0 : op === '>' ? cmp <= 0 : op === '<=' ? cmp > 0 : op === '<' ? cmp >= 0 : cmp !== 0) {
+                ok = false;
+                break;
+            }
+        }
+        if (!ok)
+            continue;
+        if (v[3].length > 0) {
+            const admitted = comparators.some(([, r]) => r[3].length > 0 && r[0] === v[0] && r[1] === v[1] && r[2] === v[2]);
+            if (!admitted)
+                continue;
+        }
+        return true;
+    }
+    return false;
+}
+/**
+ * Whether `range` is semver-shaped at all — `''`, `*`, `latest`, tags,
+ * comparators, hyphen ranges, `||` groups. False for git:, github:,
+ * URL, file:, and other non-registry specifiers, where a version pin's
+ * presence is all a lockfile can answer.
+ */
+export function isSemverRange(range) {
+    const trimmed = String(range).trim();
+    if (trimmed === '' || trimmed === '*' || trimmed === 'x' || trimmed === 'X' || trimmed === 'latest')
+        return true;
+    for (const orPart of trimmed.split(/\s*\|\|\s*/)) {
+        const hyphen = orPart.trim().match(/^(\S+)\s+-\s+(\S+)$/);
+        if (hyphen) {
+            const lo = semverComparators('>=' + hyphen[1]);
+            const hi = semverComparators('<=' + hyphen[2]);
+            if (lo === null || hi === null)
+                return false;
+            continue;
+        }
+        for (const part of orPart.trim().split(/\s+/)) {
+            if (semverComparators(part) === null)
+                return false;
+        }
+    }
+    return true;
+}
+/** The highest version satisfying `range`, or null; `latest`/`*` are the caller's dist-tag lookup. */
+export function resolveVersion(versions, range) {
+    const trimmed = String(range ?? '').trim();
+    if (trimmed === '' || trimmed === '*' || trimmed === 'x' || trimmed === 'X' || trimmed === 'latest')
+        return null;
+    let best = null;
+    for (const v of versions) {
+        if (!satisfiesRange(v, trimmed))
+            continue;
+        const p = parseSemver(v);
+        if (!p)
+            continue;
+        if (best === null || compareSemver(p, best.p) > 0)
+            best = { v, p };
+    }
+    return best === null ? null : best.v;
+}

package/dist/router/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAuCH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AA+BzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAuUf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAuCH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AA+CzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAoWf"}

package/dist/router/index.js

@@ -50,21 +50,30 @@ const publicTenantCache = new Map();
  * The tenant segment a public capability URL forwards under. The directory
  * is consulted first; a deployment without the binding falls back to the
  * legacy-public DO name, which is where legacy-mode sessions already live.
+ * The directory row also carries the port and name the capability was
+ * bound with, which is what the `<cap>--<name>--<sid>` form resolves and
+ * verifies against.
  */
-async function resolvePublicTenantSegment(capability, env) {
+async function resolvePublicCapability(capability, env, uncached = false) {
     const cached = publicTenantCache.get(capability);
-    if (cached !== undefined)
+    if (!uncached && cached !== undefined)
         return cached;
     const stub = publicDirectoryStub(env);
     if (stub === null)
-        return LEGACY_PUBLIC_DO_SEGMENT;
+        return { tenantSegment: LEGACY_PUBLIC_DO_SEGMENT, port: null, name: null };
     const entry = await stub.resolve(capability).catch(() => null);
     if (entry === null) {
         // An unresolvable capability 404s: no session DO is named for it.
+        publicTenantCache.delete(capability);
         return null;
     }
-    publicTenantCache.set(capability, entry.tenantSegment);
-    return entry.tenantSegment;
+    const resolved = {
+        tenantSegment: entry.tenantSegment,
+        port: entry.port,
+        name: entry.name ?? null,
+    };
+    publicTenantCache.set(capability, resolved);
+    return resolved;
 }
 /**
  * Build a Nimbus default-export handler. The returned object is exactly
@@ -138,16 +147,38 @@ export function createNimbusHandler(options = {}) {
                 // directory — a positive hit is cached for the life of this
                 // isolate, a miss 404s, and a deployment without the binding
                 // falls back to the legacy-public DO name.
-                const tenantSegment = await resolvePublicTenantSegment(preview.capability, env);
-                if (tenantSegment === null) {
+                let resolved = await resolvePublicCapability(preview.capability, env);
+                const matchesHost = (entry) => entry !== null && (preview.name !== undefined
+                    ? entry.name === preview.name && entry.port !== null
+                    : entry.port === null || entry.port === preview.port);
+                // Rename/rebinding can leave a positive isolate cache entry behind.
+                // Verify BOTH host forms, and read through once before refusing.
+                if (resolved !== null && !matchesHost(resolved)) {
+                    resolved = await resolvePublicCapability(preview.capability, env, true);
+                }
+                if (resolved === null || !matchesHost(resolved)) {
                     return new Response('Not found', { status: 404 });
                 }
+                // The name form is resolved by capability like the port form, then
+                // the name is verified against the directory row: a capability
+                // presented under a name it was not bound with is a 404, never a
+                // guess at some other application.
+                let port;
+                if (preview.name !== undefined) {
+                    if (resolved.name !== preview.name || resolved.port === null) {
+                        return new Response('Not found', { status: 404 });
+                    }
+                    port = resolved.port;
+                }
+                else {
+                    port = preview.port;
+                }
                 return forwardToSession(request, {
                     sessionId: preview.sid,
-                    innerPath: `/port/${preview.port}${url.pathname === '/' ? '/' : url.pathname}`,
+                    innerPath: `/port/${port}${url.pathname === '/' ? '/' : url.pathname}`,
                     basePath: '',
                 }, env, {
-                    tenantSegment,
+                    tenantSegment: resolved.tenantSegment,
                     extraHeaders: {
                         [PREVIEW_CAPABILITY_HEADER]: preview.capability,
                         [PUBLIC_BEARER_HEADER]: '1',
@@ -172,9 +203,15 @@ export function createNimbusHandler(options = {}) {
             });
             if (auth instanceof Response)
                 return auth;
+            // The scoped name form is resolved INSIDE the session — the name is
+            // a reservation alias only that session's records know — so it is
+            // forwarded as `/app/<name>/`, the session's own name-addressed door.
+            const scopedInner = preview.name !== undefined
+                ? `/app/${preview.name}`
+                : `/port/${preview.port}`;
             return forwardToSession(request, {
                 sessionId: preview.sid,
-                innerPath: `/port/${preview.port}${url.pathname === '/' ? '/' : url.pathname}`,
+                innerPath: `${scopedInner}${url.pathname === '/' ? '/' : url.pathname}`,
                 basePath: '',
             }, env, { tenantSegment: auth.tenantSegment });
         }

package/dist/router/public-directory.d.ts

@@ -14,6 +14,9 @@ export interface PublicDirectoryEntry {
     readonly tenantSegment: string;
     readonly sid: string;
     readonly port: number;
+    /** The reservation's name alias, when the capability was bound with one —
+     *  what the `<cap>--<name>--<sid>` host form is verified against. */
+    readonly name?: string;
 }
 /** The DO body, usable with any `{ storage }` the tests hand it. */
 export declare class PublicDirectoryStore {
@@ -29,6 +32,7 @@ export declare class PublicDirectoryStore {
         tenantSegment: string;
         sid: string;
         port: number;
+        name?: string;
     }): Promise<void>;
     unbind(capability: string): Promise<void>;
     resolve(capability: string): Promise<PublicDirectoryEntry | null>;
@@ -60,7 +64,7 @@ export declare function bindPublicPortCapability(host: {
     };
     tenantSegment?: string;
     sessionId?: string;
-}, capability: string, port: number): Promise<void>;
+}, capability: string, port: number, name?: string): Promise<void>;
 /** Retire a public port's capability from the routing directory. */
 export declare function unbindPublicPortCapability(host: {
     env?: unknown;

package/dist/router/public-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-directory.d.ts","sourceRoot":"","sources":["../../src/router/public-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAMD,oEAAoE;AACpE,qBAAa,oBAAoB;IACnB,OAAO,CAAC,GAAG;gBAAH,GAAG,EAAE;QAAE,OAAO,EAAE;YAClC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YACtD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SACvC,CAAA;KAAE;IAEG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAC1D,OAAO,CAAC,IAAI,CAAC;IAgBV,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;CAKxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG;IACjD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACnE,GAAG,IAAI,CAUP;AA6BD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,oEAAoE;AACpE,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf"}
+{"version":3,"file":"public-directory.d.ts","sourceRoot":"","sources":["../../src/router/public-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;yEACqE;IACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD,oEAAoE;AACpE,qBAAa,oBAAoB;IACnB,OAAO,CAAC,GAAG;gBAAH,GAAG,EAAE;QAAE,OAAO,EAAE;YAClC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YACtD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SACvC,CAAA;KAAE;IAEG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC,IAAI,CAAC;IAoBV,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;CAKxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG;IACjD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACnE,GAAG,IAAI,CAUP;AA6BD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,oEAAoE;AACpE,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/router/public-directory.js

@@ -31,10 +31,14 @@ export class PublicDirectoryStore {
             || !Number.isInteger(entry.port) || entry.port < 1 || entry.port > 65535) {
             throw new Error('NimbusPublicDirectory.bind: entry needs tenantSegment, sid, and a real port');
         }
+        if (entry.name !== undefined && !/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/.test(entry.name)) {
+            throw new Error('NimbusPublicDirectory.bind: name must be one DNS label');
+        }
         await this.ctx.storage.put(rowKey(capability), {
             tenantSegment: entry.tenantSegment,
             sid: entry.sid,
             port: entry.port,
+            ...(entry.name !== undefined ? { name: entry.name } : {}),
         });
     }
     async unbind(capability) {
@@ -87,7 +91,7 @@ function sessionIdentity(host) {
  * on a non-legacy deployment is a loud error: the exposure would be half-
  * public — stored as public, unroutable in practice.
  */
-export async function bindPublicPortCapability(host, capability, port) {
+export async function bindPublicPortCapability(host, capability, port, name) {
     const identity = sessionIdentity(host);
     if (identity === null)
         return;
@@ -99,7 +103,10 @@ export async function bindPublicPortCapability(host, capability, port) {
             + '— without it the capability URL cannot resolve to this session. '
             + 'Add the binding and the NimbusPublicDirectory migration to wrangler.jsonc.');
     }
-    await stub.bind(capability, { tenantSegment: identity.tenantSegment, sid: identity.sid, port });
+    await stub.bind(capability, {
+        tenantSegment: identity.tenantSegment, sid: identity.sid, port,
+        ...(name !== undefined ? { name } : {}),
+    });
 }
 /** Retire a public port's capability from the routing directory. */
 export async function unbindPublicPortCapability(host, capability) {

package/dist/router/remote-api.d.ts

@@ -83,6 +83,7 @@ interface NimbusSessionRpcStub {
     _rpcListPorts(): Promise<unknown>;
     _rpcExposePort(port: number, options?: {
         visibility?: 'scoped' | 'public';
+        name?: string;
     }): Promise<unknown>;
     _rpcEnsureDurableApp(input: {
         owner?: string;
@@ -90,9 +91,26 @@ interface NimbusSessionRpcStub {
         visibility?: 'scoped' | 'public';
     }): Promise<unknown>;
     _rpcRemoveDurableApp(owner: string): Promise<unknown>;
+    _rpcExposeApp(target: RemoteAppTarget, options?: {
+        visibility?: 'scoped' | 'public';
+        name?: string;
+    }): Promise<unknown>;
+    _rpcListApps(): Promise<unknown>;
+    _rpcRotateLink(target: RemoteAppTarget): Promise<unknown>;
+    _rpcRemoveApp(target: RemoteAppTarget): Promise<unknown>;
     _rpcUnexposePort(port: number): Promise<unknown>;
     _rpcDestroy(options?: Record<string, unknown>): Promise<unknown>;
 }
+/** An app target on the wire: a port, a pid, a name/owner, or the explicit object forms. */
+type RemoteAppTarget = number | string | {
+    port: number;
+} | {
+    pid: number;
+} | {
+    name: string;
+} | {
+    owner: string;
+};
 interface NimbusSessionNamespace {
     idFromName(name: string): DurableObjectId;
     get(id: DurableObjectId): NimbusSessionRpcStub;

package/dist/router/remote-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAIA,OAAO,EAML,KAAK,aAAa,EAEnB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,UAAU,oBAAoB;IAC5B,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/F,oBAAoB,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5H,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,UAAU,sBAAsB;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,oBAAoB,CAAC;CAChD;AAED,UAAU,eAAgB,SAAQ,OAAO,CAAC,aAAa,CAAC;IACtD,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAmCD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA2E1B"}
+{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAIA,OAAO,EAML,KAAK,aAAa,EAEnB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,UAAU,oBAAoB;IAC5B,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,oBAAoB,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5H,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxH,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,4FAA4F;AAC5F,KAAK,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnH,UAAU,sBAAsB;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,oBAAoB,CAAC;CAChD;AAED,UAAU,eAAgB,SAAQ,OAAO,CAAC,aAAa,CAAC;IACtD,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAmCD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA2E1B"}

package/dist/router/remote-api.js

@@ -163,30 +163,45 @@ async function dispatchRemoteRpc(ctx) {
             assertRuntimeForLanguage(ctx, language, options.install);
             return ctx.stub._rpcRunCode(stringArg(args[0], 'code'), options);
         }
+        // The file plane. Each op's trailing argument is the SDK's file options
+        // object; `fileOptions` reads it so a `cred` the client put on the wire
+        // is refused loudly rather than dropped — the session-user default is
+        // the only identity a remote token can act as.
         case 'readFile':
+            fileOptions(args[1]);
             return ctx.stub._rpcReadFile(stringArg(args[0], 'path'));
         case 'readFileBytes':
+            fileOptions(args[1]);
             return ctx.stub._rpcReadFileBytes(stringArg(args[0], 'path'));
         case 'writeFile':
+            fileOptions(args[2]);
             return ctx.stub._rpcWriteFile(stringArg(args[0], 'path'), fileContentArg(args[1]));
         case 'stat':
+            fileOptions(args[1]);
             return ctx.stub._rpcStat(stringArg(args[0], 'path'));
         case 'lstat':
+            fileOptions(args[1]);
             return ctx.stub._rpcLstat(stringArg(args[0], 'path'));
         case 'rename':
+            fileOptions(args[2]);
             return ctx.stub._rpcRename(stringArg(args[0], 'from'), stringArg(args[1], 'to'));
         case 'chmod':
+            fileOptions(args[2]);
             return ctx.stub._rpcChmod(stringArg(args[0], 'path'), numberArg(args[1], 'mode'));
         case 'readRange':
+            fileOptions(args[3]);
             return ctx.stub._rpcFsReadRange(stringArg(args[0], 'path'), numberArg(args[1], 'offset'), numberArg(args[2], 'length'));
         case 'readdir':
+            fileOptions(args[1]);
             return ctx.stub._rpcReaddir(stringArg(args[0], 'path'));
         case 'exists':
+            fileOptions(args[1]);
             return ctx.stub._rpcExists(stringArg(args[0], 'path'));
         case 'mkdir':
+            fileOptions(args[1]);
             return ctx.stub._rpcMkdir(stringArg(args[0], 'path'));
         case 'deleteFile':
-            return ctx.stub._rpcDeleteFile(stringArg(args[0], 'path'), objectArg(args[1]));
+            return ctx.stub._rpcDeleteFile(stringArg(args[0], 'path'), fileOptions(args[1]));
         case 'installRuntime': {
             const spec = stringArg(args[0], 'spec');
             assertRuntimeAllowed(ctx, spec, 'onDemand');
@@ -223,11 +238,18 @@ async function dispatchRemoteRpc(ctx) {
             return ctx.stub._rpcListPorts();
         case 'exposePort': {
             const options = args[1] === undefined ? undefined : objectArg(args[1]);
-            return ctx.stub._rpcExposePort(numberArg(args[0], 'port'), options === undefined ? undefined : {
-                visibility: options.visibility === undefined ? undefined
-                    : options.visibility === 'public' ? 'public' : 'scoped',
-            });
+            return ctx.stub._rpcExposePort(numberArg(args[0], 'port'), options === undefined ? undefined : exposeOptions(options));
+        }
+        case 'exposeApp': {
+            const options = args[1] === undefined ? undefined : objectArg(args[1]);
+            return ctx.stub._rpcExposeApp(appTargetArg(args[0]), options === undefined ? undefined : exposeOptions(options));
         }
+        case 'listApps':
+            return ctx.stub._rpcListApps();
+        case 'rotateLink':
+            return ctx.stub._rpcRotateLink(appTargetArg(args[0]));
+        case 'removeApp':
+            return ctx.stub._rpcRemoveApp(appTargetArg(args[0]));
         case 'ensureDurableApp': {
             const input = objectArg(args[0]);
             return ctx.stub._rpcEnsureDurableApp({
@@ -249,6 +271,28 @@ async function dispatchRemoteRpc(ctx) {
             throw apiError(`Unknown Nimbus sandbox operation: ${String(op)}`, 'E_REMOTE_OP', 400);
     }
 }
+function exposeOptions(options) {
+    return {
+        ...(options.visibility === undefined ? {} : { visibility: options.visibility === 'public' ? 'public' : 'scoped' }),
+        ...(options.name === undefined ? {} : { name: stringArg(options.name, 'name') }),
+    };
+}
+function appTargetArg(value) {
+    if (typeof value === 'number')
+        return numberArg(value, 'target');
+    if (typeof value === 'string')
+        return stringArg(value, 'target');
+    const target = objectArg(value);
+    if (target.port !== undefined)
+        return { port: numberArg(target.port, 'port') };
+    if (target.pid !== undefined)
+        return { pid: numberArg(target.pid, 'pid') };
+    if (target.name !== undefined)
+        return { name: stringArg(target.name, 'name') };
+    if (target.owner !== undefined)
+        return { owner: stringArg(target.owner, 'owner') };
+    throw apiError('Nimbus app target must be a port, a pid, a name, or { port | pid | name | owner }', 'E_ARG_SHAPE', 400);
+}
 function requireAnyScope(ctx, scopes) {
     const explicit = ctx.verified?.claims.scopes;
     if (explicit === undefined)
@@ -272,6 +316,21 @@ function execOptions(ctx, value) {
         cwd: typeof options.cwd === 'string' ? options.cwd : ctx.root,
     };
 }
+/**
+ * A file op's options object. The same boundary rule as `execOptions`: the
+ * remote token authenticates a SESSION, so a caller does not get to name the
+ * uid its file operation acts as. `files.as(cred)` puts `cred` on the wire
+ * explicitly so this refusal is the answer the caller gets — never a read
+ * that silently ran as somebody else. A colocated embedder holding the DO
+ * stub is trusted with `cred` the same way it is trusted with kernel writes.
+ */
+function fileOptions(value) {
+    const options = value === undefined ? {} : objectArg(value);
+    if (options.cred !== undefined) {
+        throw apiError('cred is not accepted over the remote API', 'E_ARG_SHAPE', 400);
+    }
+    return options;
+}
 function processLogOptions(value) {
     const options = objectArg(value);
     return {

package/dist/runtime/cpython-resident.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cpython-resident.d.ts","sourceRoot":"","sources":["../../src/runtime/cpython-resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAwDxE;AAeD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,GAAG,oBAAoB,CA8CjF"}
+{"version":3,"file":"cpython-resident.d.ts","sourceRoot":"","sources":["../../src/runtime/cpython-resident.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAwDxE;AAeD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,YAAY,GAAG,oBAAoB,CAgDjF"}

package/dist/runtime/cpython-resident.js

@@ -91,6 +91,8 @@ export function cpythonResidentStart(facetMgr) {
         const command = args.command;
         const workerCode = buildCPythonSocketProcessWorker(buildCPythonPreamble());
         const spawned = await facetMgr.spawnWorker(workerCode, command, args.cwd, {
+            resident: { argv: args.argv, runtime: 'python' },
+            restart: z.object({ NIMBUS_RESTART: z.literal('on-failure') }).safeParse(args.startArgs.userEnv).success ? 'on-failure' : 'never',
             compatibilityFlags: ['nodejs_compat'],
             // By path, not by value: the interpreter is 10.6 MiB, more than a single
             // RPC value may carry, so whichever host runs this process reads it itself.
@@ -106,7 +108,7 @@ export function cpythonResidentStart(facetMgr) {
         }
         const data = boot.data;
         if (data.state === 'listening' && typeof data.port === 'number' && data.port > 0) {
-            facetMgr.registerPort(spawned.pid, data.port);
+            await facetMgr.registerPort(spawned.pid, data.port);
             const routeable = await facetMgr.waitForRouteablePorts(spawned.pid);
             const port = routeable.includes(data.port) ? data.port : routeable[0];
             if (!port) {

package/dist/runtime/html-entrypoint.d.ts

@@ -3,5 +3,12 @@ export declare function rewriteViteBuildHtml(html: string, options: {
     jsFilename: string;
     cssFilename?: string;
     removeImportMap?: boolean;
+    /**
+     * Vite injects `<link rel="stylesheet">` for CSS bundled through the
+     * entry when index.html declares none (the create-vite template puts
+     * all CSS behind `import './index.css'`). Set true to get that
+     * behavior; when false, only an existing stylesheet link is rewritten.
+     */
+    injectCss?: boolean;
 }): Promise<string>;
 //# sourceMappingURL=html-entrypoint.d.ts.map

package/dist/runtime/html-entrypoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html-entrypoint.d.ts","sourceRoot":"","sources":["../../src/runtime/html-entrypoint.ts"],"names":[],"mappings":"AAEA,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAcxF;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GACA,OAAO,CAAC,MAAM,CAAC,CA8BjB"}
+{"version":3,"file":"html-entrypoint.d.ts","sourceRoot":"","sources":["../../src/runtime/html-entrypoint.ts"],"names":[],"mappings":"AAEA,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAcxF;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACA,OAAO,CAAC,MAAM,CAAC,CAkDjB"}