@nimbus-sh/worker 0.9.0 → 0.11.0

package/dist/npm/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/npm/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,sEAAsE;IACtE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,GAAG,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnC;;;OAGG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,eAAe,GAAG,kBAAkB,CAgBlF;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GACrC,SAAS,CAKX"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/npm/resolver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,8DAA8D;IAC9D,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,sEAAsE;IACtE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,GAAG,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnC,iGAAiG;IACjG,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CACtC;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,eAAe,CAAC;CACtB;AAID,uGAAuG;AACvG,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,EACtC,MAAM,GAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAa,GAC/C,SAAS,CAKX;AAED,+CAA+C;AAC/C,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,GAAG,gBAAgB,EAAE,CAKnE"}

package/dist/npm/resolver.js

@@ -4,32 +4,19 @@
  * Registry resolution runs in fanout facets; this module contains only the
  * supervisor-side contracts and computations consumed after resolution.
  */
-/**
- * Serialize a resolved package into the registry-cache row shape. Facet task
- * bodies keep inline literals of this shape because `fn.toString()` isolates
- * cannot import supervisor modules.
- */
-export function registryEntryFromResolved(pkg) {
-    return {
-        name: pkg.name,
-        version: pkg.version,
-        tarballUrl: pkg.tarballUrl,
-        integrity: pkg.integrity,
-        depsJson: JSON.stringify(pkg.dependencies),
-        peerDepsJson: JSON.stringify(pkg.peerDependencies ?? {}),
-        exportsJson: JSON.stringify(pkg.exports ?? {}),
-        main: pkg.main,
-        moduleField: pkg.module,
-        binJson: JSON.stringify(pkg.bin),
-        platformJson: JSON.stringify({ os: pkg.os, cpu: pkg.cpu, libc: pkg.libc }),
-        optionalDepsJson: JSON.stringify(pkg.optionalDependencies ?? {}),
-        fetchedAt: Date.now(),
-    };
-}
-/** Compute the flat hoist plan used by the current one-version-per-name resolver. */
-export function computeHoistPlan(resolved) {
+/** The walk's placement decisions carried forward: first version per name at root, the rest nested. */
+export function computeHoistPlan(resolved, nested = new Map()) {
     return {
         root: new Map(resolved),
-        nested: new Map(),
+        nested: new Map(nested),
     };
 }
+/** Every placement in the plan, root first. */
+export function hoistPlacements(plan) {
+    const out = [];
+    for (const [name, pkg] of plan.root)
+        out.push({ placement: name, pkg });
+    for (const [placement, pkg] of plan.nested)
+        out.push({ placement, pkg });
+    return out;
+}

package/dist/opencode-artifact.generated.js

@@ -18,7 +18,7 @@
  * with different content never serves stale bytes from a warm colo cache.
  */
 export const OPENCODE_ARTIFACT_VERSION = "1.16.2";
-export const OPENCODE_ARTIFACT_BUILD_ID = "5f00a2957fbf1f17";
+export const OPENCODE_ARTIFACT_BUILD_ID = "77f4bee3991c68c0";
 export const OPENCODE_ARTIFACT_PRESENT = true;
 export const OPENCODE_ARTIFACT_ENTRY = "/_assets/opencode/1.16.2/index.js";
 export const OPENCODE_ARTIFACT_FILES = ["bip-bop-01-ga21wr3r.mp3", "bip-bop-03-kgfd4rq4.mp3", "chunks.json", "highlights-eq9cgrbb.scm", "highlights-ghv9g403.scm", "highlights-hk7bwhj4.scm", "highlights-r812a2qc.scm", "highlights-x6tmsnaa.scm", "index-attach.js", "injections-73j83es3.scm", "nope-03-2z8weyjw.mp3", "parser.worker.js", "photon_rs_bg-bq08arze.wasm", "staplebops-06-rz29m246.mp3", "tree-sitter-3jzf13jk.wasm", "tree-sitter-bash-hq5s6fxb.wasm", "tree-sitter-javascript-nd0q4pe9.wasm", "tree-sitter-markdown-411r6y9b.wasm", "tree-sitter-markdown_inline-j5349f42.wasm", "tree-sitter-powershell-ryb2ffqs.wasm", "tree-sitter-typescript-zxjzwt75.wasm", "tree-sitter-zig-e78zbjpm.wasm", "worker.js", "yoga.wasm", "yup-01-30ecpeh9.mp3"];
@@ -28,7 +28,7 @@ export const OPENCODE_ARTIFACT_FILES = ["bip-bop-01-ga21wr3r.mp3", "bip-bop-03-k
  * (the L2 tier included) before the bytes are compiled as a wasm module or
  * evaluated as facet ESM; a file with no entry here is a loud throw.
  */
-export const OPENCODE_ARTIFACT_DIGESTS = { "bip-bop-01-ga21wr3r.mp3": "129765d4203f92ecb36ba17553b037ebf4daf28ebb56013b3896d3e7e36f2d74", "bip-bop-03-kgfd4rq4.mp3": "82b992e5dc5cfdc4d7206e0cd12d3132fa76ae30f8af51ec4cc216ba15f1afcd", "chunks.json": "91a733d40ff10c50202ddc6f1a17cb61205fa58d112c81d85e1a4230d394ee45", "highlights-eq9cgrbb.scm": "8e823819058d480c450ca4ef377a05675f6ed6f7c0460a69b972cdbe940c0893", "highlights-ghv9g403.scm": "c90e849891a3c8698992e10efdeaff7e7a8f98da47f941489566cb9e60f639b5", "highlights-hk7bwhj4.scm": "f2232f0fde717543e4541cec871dd8633cb9bc6b5d1686a56b2d469c1dd9e6b6", "highlights-r812a2qc.scm": "f3b02df1a9213cfecfb6936bce8db2f777edd523fc23ed890695e6cb4552d556", "highlights-x6tmsnaa.scm": "ca9a109ddd21c5ffdc6b84f00c0a4b2eeb55ae36a0b8eeb9b02348269c5acd22", "index-attach.js": "9b11e5c29b61050c1a1822d5427ff160a23538e28115b1acf6106fdf1e467123", "index.js": "6002a1bba20dc167453ade832a636f620f00d89c03a4d5f8f9da29e406ee2179", "injections-73j83es3.scm": "a2bf8c052454acbe765970a4ad2706c60cad7b62a762b927e28f60af1a0ef516", "nope-03-2z8weyjw.mp3": "9832805f84dcdb4a8ccb46a98cc75def72b52509610837938ed8343b2537df0c", "parser.worker.js": "6f9e4650d1c4524ed7cf6be288cadd89eebb97506864d85cf63c912b3fde43e6", "photon_rs_bg-bq08arze.wasm": "10468181565c56004c867f3a4af96f89a0ef5a63a72f2b5fb12c1f1992a3615c", "staplebops-06-rz29m246.mp3": "eb87d63312ac11b1ceb1a8b348057dfe4d1166d5a85dc79778fe69d458f4c097", "tree-sitter-3jzf13jk.wasm": "f38dcc4b43b818f9a0785bc1c6d5611a75ac4cdd428ff3f02757c34ca4e46d7f", "tree-sitter-bash-hq5s6fxb.wasm": "364f0a2cd385c792239423026ef442dbd073d34c396b7bc9e5932426b8e4aa5d", "tree-sitter-javascript-nd0q4pe9.wasm": "5fb488d0cabb4775a594bab85682de5ad6ce83c0d6ac997a9f82dd084d571240", "tree-sitter-markdown_inline-j5349f42.wasm": "9bbd71a70a23f6d0193bb162a72eecf2a2bd9ce76910d7ad3da9c5f80f122671", "tree-sitter-markdown-411r6y9b.wasm": "3e13182f21373634c40653f170e6f2d2790914eb2c243927086d79023c534f7a", "tree-sitter-powershell-ryb2ffqs.wasm": "1d30b5a21866354aa2eb94845556f1e19126ff00e3335048719a0e6435b1c154", "tree-sitter-typescript-zxjzwt75.wasm": "778025db5a8be0e70f8ccc3671e486dfeddd048c25d9e8a70c26de2e1bf6f97d", "tree-sitter-zig-e78zbjpm.wasm": "54b3b83dd9c62da5815f06132bc3fc914d9dcc780370b32416446a0b7969e8c6", "worker.js": "9bdd2405e25b2dcec3c936a88efa97670f1c39d71d5c5634f3ec5a0d45a5f7a8", "yoga.wasm": "7ba9c9483c8c38a468e9aef4a95ed72fad8a43594be8e5123eb3bdb6479edf5b", "yup-01-30ecpeh9.mp3": "b227d0516dfa1eda3b250635cce19e040af3f9cee443a8bb4b5a80990bca3f58" };
+export const OPENCODE_ARTIFACT_DIGESTS = { "bip-bop-01-ga21wr3r.mp3": "129765d4203f92ecb36ba17553b037ebf4daf28ebb56013b3896d3e7e36f2d74", "bip-bop-03-kgfd4rq4.mp3": "82b992e5dc5cfdc4d7206e0cd12d3132fa76ae30f8af51ec4cc216ba15f1afcd", "chunks.json": "91a733d40ff10c50202ddc6f1a17cb61205fa58d112c81d85e1a4230d394ee45", "highlights-eq9cgrbb.scm": "8e823819058d480c450ca4ef377a05675f6ed6f7c0460a69b972cdbe940c0893", "highlights-ghv9g403.scm": "c90e849891a3c8698992e10efdeaff7e7a8f98da47f941489566cb9e60f639b5", "highlights-hk7bwhj4.scm": "f2232f0fde717543e4541cec871dd8633cb9bc6b5d1686a56b2d469c1dd9e6b6", "highlights-r812a2qc.scm": "f3b02df1a9213cfecfb6936bce8db2f777edd523fc23ed890695e6cb4552d556", "highlights-x6tmsnaa.scm": "ca9a109ddd21c5ffdc6b84f00c0a4b2eeb55ae36a0b8eeb9b02348269c5acd22", "index-attach.js": "8affc9bb21dc8ef55e8599a2b82f36d9a2cf39189563f9f7a9f029a0f9cc7db0", "index.js": "6002a1bba20dc167453ade832a636f620f00d89c03a4d5f8f9da29e406ee2179", "injections-73j83es3.scm": "a2bf8c052454acbe765970a4ad2706c60cad7b62a762b927e28f60af1a0ef516", "nope-03-2z8weyjw.mp3": "9832805f84dcdb4a8ccb46a98cc75def72b52509610837938ed8343b2537df0c", "parser.worker.js": "6f9e4650d1c4524ed7cf6be288cadd89eebb97506864d85cf63c912b3fde43e6", "photon_rs_bg-bq08arze.wasm": "10468181565c56004c867f3a4af96f89a0ef5a63a72f2b5fb12c1f1992a3615c", "staplebops-06-rz29m246.mp3": "eb87d63312ac11b1ceb1a8b348057dfe4d1166d5a85dc79778fe69d458f4c097", "tree-sitter-3jzf13jk.wasm": "f38dcc4b43b818f9a0785bc1c6d5611a75ac4cdd428ff3f02757c34ca4e46d7f", "tree-sitter-bash-hq5s6fxb.wasm": "364f0a2cd385c792239423026ef442dbd073d34c396b7bc9e5932426b8e4aa5d", "tree-sitter-javascript-nd0q4pe9.wasm": "5fb488d0cabb4775a594bab85682de5ad6ce83c0d6ac997a9f82dd084d571240", "tree-sitter-markdown_inline-j5349f42.wasm": "9bbd71a70a23f6d0193bb162a72eecf2a2bd9ce76910d7ad3da9c5f80f122671", "tree-sitter-markdown-411r6y9b.wasm": "3e13182f21373634c40653f170e6f2d2790914eb2c243927086d79023c534f7a", "tree-sitter-powershell-ryb2ffqs.wasm": "1d30b5a21866354aa2eb94845556f1e19126ff00e3335048719a0e6435b1c154", "tree-sitter-typescript-zxjzwt75.wasm": "778025db5a8be0e70f8ccc3671e486dfeddd048c25d9e8a70c26de2e1bf6f97d", "tree-sitter-zig-e78zbjpm.wasm": "54b3b83dd9c62da5815f06132bc3fc914d9dcc780370b32416446a0b7969e8c6", "worker.js": "9bdd2405e25b2dcec3c936a88efa97670f1c39d71d5c5634f3ec5a0d45a5f7a8", "yoga.wasm": "7ba9c9483c8c38a468e9aef4a95ed72fad8a43594be8e5123eb3bdb6479edf5b", "yup-01-30ecpeh9.mp3": "b227d0516dfa1eda3b250635cce19e040af3f9cee443a8bb4b5a80990bca3f58" };
 export const OPENCODE_TREE_SITTER_WASMS = { "core": "tree-sitter-3jzf13jk.wasm", "bash": "tree-sitter-bash-hq5s6fxb.wasm", "powershell": "tree-sitter-powershell-ryb2ffqs.wasm" };
 export const OPENCODE_TUI_WORKERS = { "server": "worker.js", "parser": "parser.worker.js" };
 /**

package/dist/replica/routing.d.ts

@@ -1,5 +1,5 @@
 /**
- * replica-routing.ts — W12 — DO read replica routing primitives.
+ * replica/routing.ts — W12 — DO read replica routing primitives.
  *
  * Pure module (no `cloudflare:workers` import) so it can be unit-tested
  * under Bun. NimbusSession wraps these helpers in its constructor and
@@ -28,10 +28,7 @@
  *     pins it near the DO; RPC into the DO is unaffected. DOs themselves
  *     don't move.
  *
- *   - ~lambros/Feedback for DO read replication API: replicas error with
- *     "Network connection lost" during high-volume writes. Mitigation:
- *     suspend replicas during npm install / git clone bursts (the
- *     suspension state lives in `replica-suspension.ts`).
+
  */
 /** Result of `classifyReplicaPolicy(pathname, method)`. */
 export type ReplicaPolicy = 
@@ -45,34 +42,12 @@ export type ReplicaPolicy =
  *  not subscribe its own hibernation handler to a stream the primary
  *  appends to. */
  | 'primary-only-ws';
-/** Eventual-consistency tolerance in ms (replica-eligible routes only). */
-export interface RoutePolicy {
-    policy: ReplicaPolicy;
-    /** Max acceptable replication lag for this route, in ms. `null` for
-     *  primary-only routes (not replicable). */
-    toleranceMs: number | null;
-}
 /**
  * Pure routing decision. Mirrors the route table in W12-plan §2.
  * Methods other than GET/HEAD on a replica-eligible route escape to
  * primary-only — read replicas only make sense for reads.
  */
 export declare function classifyReplicaPolicy(pathname: string, method: string): ReplicaPolicy;
-/**
- * Eventual-consistency tolerance per route (in ms).
- *
- * Returns `null` for primary-only routes (not replicable) and a numeric
- * tolerance for replica-eligible routes. The probe
- * `eventual-consistency-window-ms.mjs` enforces that every eligible route
- * has a tolerance ≤ 2000ms.
- *
- * The 2-second budget aligns with D1 read-replication best practice
- * (D1 docs § "Replica lag and consistency model"); DO replicas are
- * the same architectural pattern.
- */
-export declare function getEventualConsistencyToleranceMs(pathname: string): number | null;
-/** Tolerance lookup table (for diagnostics / observability surfaces). */
-export declare const REPLICA_POLICIES: Record<string, RoutePolicy>;
 export type ReplicasState = 'enabled' | 'enabled-via-configure' | 'unsupported' | 'error';
 export interface TryEnableReplicasResult {
     state: ReplicasState;
@@ -103,17 +78,6 @@ export interface ReplicaStateInspect {
  *     when the SPEC's `waitForBookmark` lands.
  */
 export declare function inspectReplicaState(ctx: any): ReplicaStateInspect;
-/**
- * Capture the current bookmark immediately after a write completes on
- * the primary. The caller (e.g. /api/write-file) can stash the result in
- * a response header / cookie so the next read-your-writes call from the
- * same client can wait for the replica to catch up before responding.
- *
- * Phase 1 of W12 surfaces this as observability only (visible via
- * /api/_diag/memory.replica.bookmark). Phase 2 (W12.5 if measured demand)
- * wires the wait-for-bookmark contract end-to-end.
- */
-export declare function captureBookmarkAfterWrite(ctx: any): string | null;
 export interface DelegationInputs {
     isReplica: boolean;
     policy: ReplicaPolicy;

package/dist/replica/routing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../../src/replica/routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,2DAA2D;AAC3D,MAAM,MAAM,aAAa;AACvB,iEAAiE;AAC/D,YAAY;AACd,wEAAwE;GACtE,mBAAmB;AACrB,uCAAuC;GACrC,cAAc;AAChB;;kBAEkB;GAChB,iBAAiB,CAAC;AAEtB,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,aAAa,CAAC;IACtB;gDAC4C;IAC5C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAMD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,aAAa,CAkDf;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMjF;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAaxD,CAAC;AAMF,MAAM,MAAM,aAAa,GACrB,SAAS,GACT,uBAAuB,GACvB,aAAa,GACb,OAAO,CAAC;AAEZ,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,uBAAuB,CAgBnE;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,mBAAmB,CAgBjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,IAAI,CAEjE;AAMD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB;oEACgE;IAChE,MAAM,EAAE,OAAO,CAAC;IAChB;2DACuD;IACvD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAoBzE;AAED,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B;;qBAEiB;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB;yCACqC;IACrC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,EAAE,gBAAgB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,eAAe,CAAC,CA6B1B"}
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../../src/replica/routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,2DAA2D;AAC3D,MAAM,MAAM,aAAa;AACvB,iEAAiE;AAC/D,YAAY;AACd,wEAAwE;GACtE,mBAAmB;AACrB,uCAAuC;GACrC,cAAc;AAChB;;kBAEkB;GAChB,iBAAiB,CAAC;AAStB;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,GACb,aAAa,CAkDf;AAcD,MAAM,MAAM,aAAa,GACrB,SAAS,GACT,uBAAuB,GACvB,aAAa,GACb,OAAO,CAAC;AAEZ,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,aAAa,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,uBAAuB,CAgBnE;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,GAAG,GAAG,mBAAmB,CAgBjE;AAQD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB;oEACgE;IAChE,MAAM,EAAE,OAAO,CAAC;IAChB;2DACuD;IACvD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAoBzE;AAED,0CAA0C;AAC1C,MAAM,WAAW,eAAe;IAC9B;;qBAEiB;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB;yCACqC;IACrC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,EAAE,gBAAgB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACnE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,GAC7C,OAAO,CAAC,eAAe,CAAC,CA6B1B"}

package/dist/replica/routing.js

@@ -1,5 +1,5 @@
 /**
- * replica-routing.ts — W12 — DO read replica routing primitives.
+ * replica/routing.ts — W12 — DO read replica routing primitives.
  *
  * Pure module (no `cloudflare:workers` import) so it can be unit-tested
  * under Bun. NimbusSession wraps these helpers in its constructor and
@@ -28,14 +28,11 @@
  *     pins it near the DO; RPC into the DO is unaffected. DOs themselves
  *     don't move.
  *
- *   - ~lambros/Feedback for DO read replication API: replicas error with
- *     "Network connection lost" during high-volume writes. Mitigation:
- *     suspend replicas during npm install / git clone bursts (the
- *     suspension state lives in `replica-suspension.ts`).
+
  */
+/** Eventual-consistency tolerance in ms (replica-eligible routes only). */
 const PROCESSES_LOGS_RE = /^\/api\/processes\/\d+\/logs$/;
 const PORT_RE = /^\/port\/\d+(\/.*)?$/;
-const TWO_SECONDS = 2000;
 /**
  * Pure routing decision. Mirrors the route table in W12-plan §2.
  * Methods other than GET/HEAD on a replica-eligible route escape to
@@ -105,42 +102,6 @@ export function classifyReplicaPolicy(pathname, method) {
 function isReadMethod(method) {
     return method === 'GET' || method === 'HEAD';
 }
-/**
- * Eventual-consistency tolerance per route (in ms).
- *
- * Returns `null` for primary-only routes (not replicable) and a numeric
- * tolerance for replica-eligible routes. The probe
- * `eventual-consistency-window-ms.mjs` enforces that every eligible route
- * has a tolerance ≤ 2000ms.
- *
- * The 2-second budget aligns with D1 read-replication best practice
- * (D1 docs § "Replica lag and consistency model"); DO replicas are
- * the same architectural pattern.
- */
-export function getEventualConsistencyToleranceMs(pathname) {
-    // Re-classify with a synthetic GET to figure out replica eligibility.
-    const policy = classifyReplicaPolicy(pathname, 'GET');
-    if (policy === 'replica-ok')
-        return TWO_SECONDS;
-    if (policy === 'replica-warm-only')
-        return TWO_SECONDS;
-    return null;
-}
-/** Tolerance lookup table (for diagnostics / observability surfaces). */
-export const REPLICA_POLICIES = {
-    '/api/memory': { policy: 'replica-ok', toleranceMs: TWO_SECONDS },
-    '/api/_diag/memory': { policy: 'replica-ok', toleranceMs: TWO_SECONDS },
-    '/api/processes': { policy: 'replica-ok', toleranceMs: TWO_SECONDS },
-    '/api/stats': { policy: 'replica-ok', toleranceMs: TWO_SECONDS },
-    '/preview/': { policy: 'replica-warm-only', toleranceMs: TWO_SECONDS },
-    '/ws': { policy: 'primary-only-ws', toleranceMs: null },
-    '/api/write-file': { policy: 'primary-only', toleranceMs: null },
-    '/api/mkdir': { policy: 'primary-only', toleranceMs: null },
-    '/api/start-vite': { policy: 'primary-only', toleranceMs: null },
-    '/api/supervisor-rpc': { policy: 'primary-only', toleranceMs: null },
-    '/worker/': { policy: 'primary-only', toleranceMs: null },
-    '/__nimbus/worker/': { policy: 'primary-only', toleranceMs: null },
-};
 /**
  * Best-effort: enable read replicas on this DO instance. Safe to call from
  * the constructor — pre-GA runtimes that lack the API surface no-op.
@@ -198,19 +159,6 @@ export function inspectReplicaState(ctx) {
     catch { /* best-effort */ }
     return { isReplica, primary: isReplica ? s.primary : null, bookmark };
 }
-/**
- * Capture the current bookmark immediately after a write completes on
- * the primary. The caller (e.g. /api/write-file) can stash the result in
- * a response header / cookie so the next read-your-writes call from the
- * same client can wait for the replica to catch up before responding.
- *
- * Phase 1 of W12 surfaces this as observability only (visible via
- * /api/_diag/memory.replica.bookmark). Phase 2 (W12.5 if measured demand)
- * wires the wait-for-bookmark contract end-to-end.
- */
-export function captureBookmarkAfterWrite(ctx) {
-    return inspectReplicaState(ctx).bookmark;
-}
 /**
  * Pure decision: should this isolate forward the Request to the primary
  * via `ctx.storage.primary.fetch(request)`?

package/dist/router/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAuCH,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AA+CzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAoWf"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/router/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAuCH,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,iBAAiB,CAAC;AA+CzB,YAAY,EACV,YAAY,IAAI,eAAe,EAC/B,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB;IACpB,GAAG,EAAE,GAAG,CAAC;CACV;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;OAGG;IACH,YAAY,CAAC,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAErD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,gBAAgB,KAClB,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAEhD,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,oCAAoC;IACpC,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,yEAAyE;IACzE,GAAG,CAAC,EAAE,qBAAqB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,0BAA+B,GACvC,aAAa,CAiXf"}

package/dist/router/index.js

@@ -36,7 +36,7 @@ import { buildPreviewHost, isPreviewHostSafeSid, parsePreviewHost, readPreviewHo
 import { parseSessionRoute, forwardToSession, renderInvalidSessionHtml, SESSION_ROUTE_PREFIX, LEGACY_PUBLIC_DO_SEGMENT, PREVIEW_CAPABILITY_HEADER, PUBLIC_BEARER_HEADER, } from '../_shared/session-router.js';
 import { issueNimbusToken, verifyNimbusToken, verifyRequestToken, requireScopes, requireSessionPin, authErrorResponse, setNimbusTokenCookie, NIMBUS_TOKEN_QUERY, NimbusAuthError, NimbusBootstrapConsumedError, NimbusTokenClaimsError, DEFAULT_TOKEN_TTL_MS, ATTACH_BOOTSTRAP_TTL_MS, } from '../auth/index.js';
 import { adoptCtxExports } from '@nimbus-sh/fabric/composition.js';
-import { handleNimbusRemoteApi, } from './remote-api.js';
+import { handleNimbusRemoteApi, remoteApiEnabled, } from './remote-api.js';
 import { parseAgentOAuthStateParam } from '../session/agent.js';
 import { publicDirectoryStub } from './public-directory.js';
 /**
@@ -231,7 +231,9 @@ export function createNimbusHandler(options = {}) {
         if (sdkResponse)
             return sdkResponse;
         if (url.pathname === '/api/nimbus/oauth/callback') {
-            const payload = parseAgentOAuthStateParam(url.searchParams.get('state'));
+            // Signed by the session that started the flow: a state this deployment
+            // did not sign never reaches a Durable Object.
+            const payload = await parseAgentOAuthStateParam(url.searchParams.get('state'), env);
             if (!payload || !isValidSessionId(payload.sessionId)) {
                 return new Response('Invalid OAuth state', { status: 400 });
             }
@@ -344,7 +346,18 @@ export function createNimbusHandler(options = {}) {
                 return Response.json({ url: previewUrl }, { headers: { 'Cache-Control': 'no-store' } });
             }
             // `/s/<id>` and `/s/<id>/` (no inner path) → serve the xterm UI shell.
+            // Only to GET and HEAD: a root DELETE is the SDK's destroy, answered by
+            // handleNimbusRemoteApi above when the remote API is enabled.
             if (route.innerPath === '/' || route.innerPath === '') {
+                if (request.method !== 'GET' && request.method !== 'HEAD') {
+                    return new Response('Method not allowed', {
+                        status: 405,
+                        headers: {
+                            Allow: remoteApiEnabled(options.sdk) ? 'GET, HEAD, DELETE' : 'GET, HEAD',
+                            'Cache-Control': 'no-store',
+                        },
+                    });
+                }
                 if (env.ASSETS) {
                     const shellUrl = new URL('/s/index.html', url.origin);
                     return env.ASSETS.fetch(new Request(shellUrl.toString(), {

package/dist/router/public-directory.d.ts

@@ -47,6 +47,24 @@ export declare function publicDirectoryStub(env: unknown): {
     unbind(capability: string): Promise<void>;
     resolve(capability: string): Promise<PublicDirectoryEntry | null>;
 } | null;
+/**
+ * `{ tenantSegment, sid }` for the session DO this host is, read off its own
+ * DO name — `tn:sub:sid` (or `legacy:public:_:sid`), no request header
+ * needed. A host without a DO id (a unit-test stub) may carry the fields on
+ * itself.
+ */
+export declare function sessionIdentity(host: {
+    ctx?: {
+        id?: {
+            name?: unknown;
+        };
+    };
+    tenantSegment?: string;
+    sessionId?: string;
+}): {
+    tenantSegment: string;
+    sid: string;
+} | null;
 /**
  * Publish a public port's capability to the routing directory. A legacy-
  * public deployment needs no directory — its DO name is already the one

package/dist/router/public-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-directory.d.ts","sourceRoot":"","sources":["../../src/router/public-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;yEACqE;IACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD,oEAAoE;AACpE,qBAAa,oBAAoB;IACnB,OAAO,CAAC,GAAG;gBAAH,GAAG,EAAE;QAAE,OAAO,EAAE;YAClC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YACtD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SACvC,CAAA;KAAE;IAEG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC,IAAI,CAAC;IAoBV,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;CAKxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG;IACjD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACnE,GAAG,IAAI,CAUP;AA6BD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,oEAAoE;AACpE,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf"}
+{"version":3,"file":"public-directory.d.ts","sourceRoot":"","sources":["../../src/router/public-directory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;yEACqE;IACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD,oEAAoE;AACpE,qBAAa,oBAAoB;IACnB,OAAO,CAAC,GAAG;gBAAH,GAAG,EAAE;QAAE,OAAO,EAAE;YAClC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YACtD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;SACvC,CAAA;KAAE;IAEG,IAAI,CACR,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC,IAAI,CAAC;IAoBV,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;CAKxE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG;IACjD,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACnE,GAAG,IAAI,CAUP;AAMD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAWhD;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,oEAAoE;AACpE,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACtG,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/router/public-directory.js

@@ -70,7 +70,7 @@ import { LEGACY_PUBLIC_DO_SEGMENT } from '../_shared/session-router.js';
  * needed. A host without a DO id (a unit-test stub) may carry the fields on
  * itself.
  */
-function sessionIdentity(host) {
+export function sessionIdentity(host) {
     const name = host.ctx?.id?.name;
     if (typeof name === 'string' && name.length > 0) {
         const cut = name.lastIndexOf(':');

package/dist/router/remote-api.d.ts

@@ -48,7 +48,7 @@ interface NimbusSessionRpcStub {
         preinstall?: string[];
     }): Promise<unknown>;
     _rpcBootProbe(): Promise<unknown>;
-    _rpcExec(command: string, options?: Record<string, unknown>): Promise<unknown>;
+    _rpcExecStream(command: string, options?: Record<string, unknown>): Promise<ReadableStream<Uint8Array>>;
     _rpcStartProcess(command: string, options?: Record<string, unknown>): Promise<unknown>;
     _rpcRunCode(code: string, options?: Record<string, unknown>): Promise<unknown>;
     _rpcReadFile(path: string): Promise<unknown>;
@@ -119,5 +119,7 @@ interface NimbusRemoteEnv extends Partial<NimbusAuthEnv> {
     NIMBUS_SESSION?: NimbusSessionNamespace;
 }
 export declare function handleNimbusRemoteApi(request: Request, env: NimbusRemoteEnv, sdk: NimbusSdkRouterConfig | undefined): Promise<Response | null>;
+/** Whether the remote API (and with it `DELETE /s/<id>/`) is served. */
+export declare function remoteApiEnabled(sdk: NimbusSdkRouterConfig | undefined): boolean;
 export {};
 //# sourceMappingURL=remote-api.d.ts.map

package/dist/router/remote-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAIA,OAAO,EAML,KAAK,aAAa,EAEnB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,UAAU,oBAAoB;IAC5B,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,oBAAoB,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5H,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxH,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,4FAA4F;AAC5F,KAAK,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnH,UAAU,sBAAsB;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,oBAAoB,CAAC;CAChD;AAED,UAAU,eAAgB,SAAQ,OAAO,CAAC,aAAa,CAAC;IACtD,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAmCD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA2E1B"}
+{"version":3,"file":"remote-api.d.ts","sourceRoot":"","sources":["../../src/router/remote-api.ts"],"names":[],"mappings":"AAOA,OAAO,EAML,KAAK,aAAa,EAEnB,MAAM,kBAAkB,CAAC;AAI1B,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,KAAK,GACL,KAAK,GACL,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,OAAO,GACP,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,CAAC,EAAE;QACR,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,OAAO,GAAG,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,UAAU,oBAAoB;IAC5B,SAAS,CAAC,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IACxG,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtF,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1F,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9G,oBAAoB,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5H,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxH,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,aAAa,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,WAAW,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,4FAA4F;AAC5F,KAAK,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnH,UAAU,sBAAsB;IAC9B,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IAC1C,GAAG,CAAC,EAAE,EAAE,eAAe,GAAG,oBAAoB,CAAC;CAChD;AAED,UAAU,eAAgB,SAAQ,OAAO,CAAC,aAAa,CAAC;IACtD,cAAc,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAgCD,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,qBAAqB,GAAG,SAAS,GACrC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA6F1B;AAED,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,qBAAqB,GAAG,SAAS,GAAG,OAAO,CAEhF"}

package/dist/router/remote-api.js

@@ -1,7 +1,10 @@
-import { LEGACY_PUBLIC_DO_SEGMENT, } from '../_shared/session-router.js';
+import { LEGACY_PUBLIC_DO_SEGMENT, parseSessionRoute, } from '../_shared/session-router.js';
+import { isValidSessionId } from '../_shared/session-id.js';
 import { z } from 'zod/v4';
+import { WireEncoder, WireDecoder } from '@nimbus-sh/core/_shared/wire-codec.js';
 import { requireScopes, requireSessionPin, verifyRequestToken, NimbusAuthError, isNimbusIdComponent, } from '../auth/index.js';
 import { useRpcResource } from '@nimbus-sh/platform/rpc-dispose.js';
+import { EXEC_STREAM_CONTENT_TYPE, collectExecStream, decodeExecStream } from '@nimbus-sh/core/runtime/exec-stream.js';
 const DEFAULT_REMOTE_BASE_PATH = '/api/nimbus/v1';
 const RemoteRpcBodySchema = z.object({
     profile: z.string().optional(),
@@ -11,35 +14,43 @@ const RemoteRpcBodySchema = z.object({
     op: z.string().optional(),
     args: z.array(z.unknown()).optional(),
 }).passthrough();
-const WireBytesSchema = z.object({
-    __nimbusWireType: z.literal('bytes'),
-    base64: z.string(),
-}).passthrough();
 export async function handleNimbusRemoteApi(request, env, sdk) {
     const remote = normalizeRemoteConfig(sdk?.remote);
     if (!remote.enabled)
         return null;
     const url = new URL(request.url);
-    const match = matchRemoteRpc(url.pathname, remote.basePath);
+    // `DELETE /s/<id>/` is the session's own address for `box.destroy()`: the
+    // same operation, under the same authorization, as the RPC below.
+    const sessionRoot = request.method === 'DELETE' ? parseSessionRoute(url.pathname) : null;
+    const destroyingRoot = sessionRoot !== null && sessionRoot.innerPath === '/';
+    const match = destroyingRoot ? { sandboxId: sessionRoot.sessionId } : matchRemoteRpc(url.pathname, remote.basePath);
     if (!match)
         return null;
-    if (request.method === 'OPTIONS')
-        return corsResponse(null, 204);
-    if (request.method !== 'POST') {
-        return remoteJson({ ok: false, error: 'Method not allowed', code: 'E_METHOD_NOT_ALLOWED' }, 405);
+    if (!destroyingRoot) {
+        if (request.method === 'OPTIONS')
+            return corsResponse(null, 204);
+        if (request.method !== 'POST') {
+            return remoteJson({ ok: false, error: 'Method not allowed', code: 'E_METHOD_NOT_ALLOWED' }, 405);
+        }
     }
     if (!env?.NIMBUS_SESSION) {
         return remoteJson({ ok: false, error: 'NIMBUS_SESSION binding is missing', code: 'E_NIMBUS_BINDING_MISSING' }, 500);
     }
-    if (!isNimbusIdComponent(match.sandboxId)) {
+    if (!isNimbusIdComponent(match.sandboxId) || (destroyingRoot && !isValidSessionId(match.sandboxId))) {
         return remoteJson({ ok: false, error: 'Invalid sandbox id', code: 'E_SANDBOX_ID' }, 400);
     }
     let body;
-    try {
-        body = RemoteRpcBodySchema.parse(decodeWire(await request.json()));
+    if (destroyingRoot) {
+        const reason = request.headers.get('X-Nimbus-Cleanup-Reason');
+        body = { op: 'destroy', args: [reason === null ? {} : { reason }] };
     }
-    catch (e) {
-        return remoteJson({ ok: false, error: `Invalid JSON body: ${errorMessage(e)}`, code: 'E_BAD_JSON' }, 400);
+    else {
+        try {
+            body = RemoteRpcBodySchema.parse(WireDecoder.parse(await request.json()));
+        }
+        catch (e) {
+            return remoteJson({ ok: false, error: `Invalid JSON body: ${errorMessage(e)}`, code: 'E_BAD_JSON' }, 400);
+        }
     }
     const remoteAuth = await resolveRemoteAuth(request, env, remote, match.sandboxId);
     if (remoteAuth instanceof Response)
@@ -70,6 +81,13 @@ export async function handleNimbusRemoteApi(request, env, sdk) {
         // `rpcMs` only when the caller sets `diag`, so the normal SDK envelope
         // is unchanged.
         const wantDiag = body.diag === true;
+        // The one op whose answer is a stream: the body is the encoded exec
+        // stream itself, so output flows under the client's own backpressure.
+        if (body.op === 'execStream') {
+            const args = body.args ?? [];
+            const wire = await ctx.stub._rpcExecStream(stringArg(args[0], 'command'), execOptions(ctx, args[1]));
+            return corsResponse(wire, 200, { 'Content-Type': EXEC_STREAM_CONTENT_TYPE });
+        }
         const t0 = Date.now();
         return await useRpcResource(dispatchRemoteRpc(ctx), (result) => remoteJson(wantDiag ? { ok: true, result, rpcMs: Date.now() - t0 } : { ok: true, result }));
     }
@@ -82,6 +100,10 @@ export async function handleNimbusRemoteApi(request, env, sdk) {
         }, err.httpStatus);
     }
 }
+/** Whether the remote API (and with it `DELETE /s/<id>/`) is served. */
+export function remoteApiEnabled(sdk) {
+    return normalizeRemoteConfig(sdk?.remote).enabled;
+}
 function normalizeRemoteConfig(remote) {
     const value = typeof remote === 'object' ? remote : {};
     return {
@@ -154,7 +176,7 @@ async function dispatchRemoteRpc(ctx) {
         case 'bootProbe':
             return ctx.stub._rpcBootProbe();
         case 'exec':
-            return ctx.stub._rpcExec(stringArg(args[0], 'command'), execOptions(ctx, args[1]));
+            return collectExecStream(decodeExecStream(await ctx.stub._rpcExecStream(stringArg(args[0], 'command'), execOptions(ctx, args[1]))));
         case 'startProcess':
             return ctx.stub._rpcStartProcess(stringArg(args[0], 'command'), execOptions(ctx, args[1]));
         case 'runCode': {
@@ -311,6 +333,9 @@ function execOptions(ctx, value) {
     if (options.cred !== undefined) {
         throw apiError('cred is not accepted over the remote API', 'E_ARG_SHAPE', 400);
     }
+    // A named shell owns its cwd; defaulting one here reset it on every call.
+    if (options.shellId !== undefined && options.cwd === undefined)
+        return options;
     return {
         ...options,
         cwd: typeof options.cwd === 'string' ? options.cwd : ctx.root,
@@ -433,7 +458,7 @@ function trimSlashes(value) {
     return value.slice(start, end);
 }
 function remoteJson(value, status = 200) {
-    return corsResponse(JSON.stringify(encodeWire(value)), status, {
+    return corsResponse(JSON.stringify(WireEncoder.parse(value)), status, {
         'Content-Type': 'application/json',
     });
 }
@@ -449,65 +474,3 @@ function corsResponse(body, status, headers = {}) {
         },
     });
 }
-function encodeWire(value) {
-    if (value instanceof Uint8Array) {
-        return {
-            __nimbusWireType: 'bytes',
-            base64: bytesToBase64(value),
-        };
-    }
-    if (value instanceof ArrayBuffer) {
-        return {
-            __nimbusWireType: 'bytes',
-            base64: bytesToBase64(new Uint8Array(value)),
-        };
-    }
-    if (ArrayBuffer.isView(value)) {
-        const view = value;
-        return {
-            __nimbusWireType: 'bytes',
-            base64: bytesToBase64(new Uint8Array(view.buffer, view.byteOffset, view.byteLength)),
-        };
-    }
-    if (Array.isArray(value))
-        return value.map(encodeWire);
-    if (value && typeof value === 'object') {
-        const out = {};
-        for (const [key, item] of Object.entries(value)) {
-            if (item !== undefined)
-                out[key] = encodeWire(item);
-        }
-        return out;
-    }
-    return value;
-}
-function decodeWire(value) {
-    const bytes = WireBytesSchema.safeParse(value);
-    if (bytes.success)
-        return base64ToBytes(bytes.data.base64);
-    if (Array.isArray(value))
-        return value.map(decodeWire);
-    if (value && typeof value === 'object') {
-        const out = {};
-        for (const [key, item] of Object.entries(value)) {
-            out[key] = decodeWire(item);
-        }
-        return out;
-    }
-    return value;
-}
-function bytesToBase64(bytes) {
-    let binary = '';
-    const chunk = 0x8000;
-    for (let i = 0; i < bytes.length; i += chunk) {
-        binary += String.fromCharCode(...bytes.subarray(i, i + chunk));
-    }
-    return btoa(binary);
-}
-function base64ToBytes(base64) {
-    const binary = atob(base64);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++)
-        bytes[i] = binary.charCodeAt(i);
-    return bytes;
-}

package/dist/runtime/bash-repl.js

@@ -1,6 +1,6 @@
 import { formatShellPrompt } from '@nimbus-sh/core/substrate/lifo/shell/Shell.js';
 import { CRED_KERNEL } from '@nimbus-sh/core/runtime/os-contracts.js';
-import { withHostFilesystem } from '@nimbus-sh/core/shell/execution-fs.js';
+import { withHostView } from '@nimbus-sh/core/runtime/process-files.js';
 import { createBashFacetSession } from '@nimbus-sh/core/runtime/bash-runner.js';
 import { facetHostForManager } from './facet-loader-host.js';
 import { ReplSession, } from './repl-session.js';
@@ -84,7 +84,7 @@ class BashReplAdapter {
     async ensureSession(signal) {
         if (this.session)
             return null;
-        this.session = await withHostFilesystem(this.deps.authority, CRED_KERNEL, (artifacts) => createBashFacetSession({
+        this.session = await withHostView(this.deps.authority, CRED_KERNEL, (artifacts) => createBashFacetSession({
             facets: facetHostForManager(this.deps.facetMgr),
             artifacts,
             filesystem: this.deps.filesystem,

package/dist/runtime/bun-repl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bun-repl.d.ts","sourceRoot":"","sources":["../../src/runtime/bun-repl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAKlE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAiTD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAInE"}
+{"version":3,"file":"bun-repl.d.ts","sourceRoot":"","sources":["../../src/runtime/bun-repl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAKlE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AA6RD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAInE"}

package/dist/runtime/bun-repl.js

@@ -31,7 +31,7 @@
  * thrown by vm bubble up; we surface them as stderr via the runtime
  * stderr capture.
  */
-import { ReplSession } from './repl-session.js';
+import { ReplSession, replPushResult } from './repl-session.js';
 import { BUN_SHIM_PREAMBLE, BUN_VERSION } from './bun-runner.js';
 class BunReplAdapter {
     pool = null;
@@ -93,18 +93,7 @@ class BunReplAdapter {
         catch (e) {
             return { kind: 'error', stderr: `[bun-repl] push dispatch failed: ${e?.message || e}\n` };
         }
-        if (result.exit) {
-            return {
-                kind: 'exit',
-                exitCode: result.exitCode || 0,
-                stdout: result.stdout,
-                stderr: result.stderr,
-            };
-        }
-        if (result.incomplete) {
-            return { kind: 'incomplete' };
-        }
-        return { kind: 'output', stdout: result.stdout || '', stderr: result.stderr || '' };
+        return replPushResult(result);
     }
     async close() {
         if (this.pool) {