@hyperbrowser/sdk 1.2.0 → 1.2.1

package/dist/types/sandbox.d.ts

@@ -59,12 +59,34 @@ export interface Sandbox {
     network?: SandboxNetworkPolicy | null;
     runtime: SandboxRuntimeTarget;
     exposedPorts: SandboxExposeResult[];
+    /**
+     * Secrets were delivered into the sandbox, or it was restored from a
+     * snapshot that may hold them.
+     */
+    containsSecrets?: boolean;
 }
 export interface SandboxDetail extends Sandbox {
     token: string | null;
     tokenExpiresAt: string | null;
 }
 export type SandboxVolumeMountType = "rw" | "ro";
+/**
+ * A stored secret to deliver as an environment variable: its name, or
+ * `{ name, version }` to pin a version. The latest version is used otherwise.
+ */
+export type SandboxSecretReference = string | {
+    name: string;
+    version?: number | "latest";
+};
+/** Environment variable name to secret, at most 32 per process or sandbox. */
+export type SandboxSecrets = Record<string, SandboxSecretReference>;
+/** The secret version an environment variable received. */
+export interface SandboxResolvedSecret {
+    env: string;
+    name: string;
+    secretId: string;
+    version: number;
+}
 export interface SandboxVolumeMount {
     id: string;
     type?: SandboxVolumeMountType;
@@ -89,6 +111,7 @@ export type CreateSandboxParams = (SandboxCreateCommonParams & {
     cpu?: never;
     memoryMiB?: never;
     diskMiB?: never;
+    secrets?: never;
 }) | (SandboxCreateCommonParams & {
     snapshotName?: never;
     snapshotId?: never;
@@ -97,6 +120,12 @@ export type CreateSandboxParams = (SandboxCreateCommonParams & {
     cpu?: number;
     memoryMiB?: number;
     diskMiB?: number;
+    /**
+     * Secrets for the image's startup command only; requires the API key's
+     * `secrets.use` scope and is not supported with `runtimeClass:
+     * "gvisor-cpu"`. The sandbox is marked as containing secrets.
+     */
+    secrets?: SandboxSecrets;
 });
 export interface SandboxListParams {
     status?: SandboxStatus;
@@ -157,6 +186,8 @@ export interface SandboxSnapshotSummary {
     compatibilityTag?: string | null;
     metadata: Record<string, unknown>;
     uploaded: boolean;
+    /** The snapshot's memory may hold secrets. */
+    containsSecrets?: boolean;
     createdAt: string;
     updatedAt: string;
 }
@@ -409,6 +440,17 @@ export interface SandboxExecParams {
     timeoutMs?: number;
     timeoutSec?: number;
     runAs?: string;
+    /**
+     * Stored secrets to deliver as environment variables of this process only.
+     * The process is started through the control API, which has the sandbox
+     * service decrypt them; requires the API key's `secrets.use` scope. Anything
+     * running as the same user (or root) in the sandbox can read the process's
+     * environment, and the sandbox is marked as containing secrets.
+     *
+     * Output is read back from the process's retained output rather than the
+     * start stream, so `maxOutputBytes` does not apply.
+     */
+    secrets?: SandboxSecrets;
     /** @deprecated Ignored for process APIs. */
     useShell?: boolean;
 }

package/dist/types/secret.d.ts

@@ -0,0 +1,67 @@
+/** A secret value: a UTF-8 string or its raw bytes, used byte-for-byte. */
+export type SecretValue = string | Uint8Array;
+export interface SecretsPublicKeyJwk {
+    kty: string;
+    n: string;
+    e: string;
+}
+/** The platform key that secret values are encrypted to before upload. */
+export interface SecretsPublicKey {
+    kid: string;
+    alg: string;
+    enc: string;
+    jwk: SecretsPublicKeyJwk;
+}
+export interface Secret {
+    id: string;
+    name: string;
+    description: string;
+    /** Bound into every envelope for this secret; the SDK uses it when encrypting. */
+    encryptionContext: string;
+    /** Null until a value is stored. */
+    latestVersion: number | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface SecretVersion {
+    version: number;
+    kid: string;
+    createdAt: string;
+}
+export interface SecretDetail extends Secret {
+    versions: SecretVersion[];
+}
+export interface CreateSecretParams {
+    /** 1-128 letters, digits, '_' or '-', starting with a letter or digit. */
+    name: string;
+    description?: string;
+    /**
+     * The first version's value. It is validated and the platform key is checked
+     * before the secret is created, then encrypted locally and uploaded.
+     */
+    value?: SecretValue;
+}
+export interface UpdateSecretParams {
+    description: string;
+}
+export interface SecretListParams {
+    search?: string;
+    page?: number;
+    /** At most 100. */
+    limit?: number;
+}
+export interface SecretListResponse {
+    secrets: Secret[];
+    totalCount: number;
+    page: number;
+    perPage: number;
+}
+export interface SecretDeleteResult {
+    deleted: boolean;
+    id: string;
+    name: string;
+}
+export interface SecretVersionDeleteResult {
+    deleted: boolean;
+    version: number;
+}

package/dist/types/secret.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperbrowser/sdk",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Node SDK for Hyperbrowser API",
   "author": "",
   "repository": {