@promigence/sdk 0.1.0-beta.14 → 0.1.0-beta.16

package/dist/context.js

@@ -387,6 +387,74 @@ export function secretLike(path) {
         return false;
     return SECRET_NAMES.some((re) => re.test(name));
 }
+export const CONTENT_CHECK_MAX_BYTES = 1024 * 1024;
+const PUBLIC_PEM = new Set([
+    "CERTIFICATE", "TRUSTED CERTIFICATE", "X509 CERTIFICATE", "X509 CRL", "CERTIFICATE REQUEST",
+    "NEW CERTIFICATE REQUEST", "PUBLIC KEY", "RSA PUBLIC KEY", "PKCS7", "CMS", "DH PARAMETERS",
+    "X9.42 DH PARAMETERS", "EC PARAMETERS",
+]);
+function publicPem(text) {
+    if (/private[\s_-]*key/i.test(text))
+        return false;
+    const types = [...text.matchAll(/-----BEGIN ([^\r\n-]+)-----/g)].map((m) => m[1].trim().toUpperCase());
+    if (types.length === 0 || !types.every((t) => PUBLIC_PEM.has(t)))
+        return false;
+    const outside = text.replace(/-----BEGIN ([^\r\n-]+)-----[\s\S]*?-----END \1-----/g, "");
+    if (/-----(BEGIN|END) /.test(outside))
+        return false;
+    return !outside.split(/\r?\n/).some((l) => /^(?=.*[A-Za-z0-9+/])[A-Za-z0-9+/=]{40,}$/.test(l.trim()));
+}
+const NPMRC_CREDENTIAL = /_auth|token|passw|secret|credential|certfile|keyfile|otp|username/i;
+function npmrcWithoutCredentials(text) {
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim().replace(/^[;#]+\s*/, "");
+        if (!line)
+            continue;
+        if (NPMRC_CREDENTIAL.test(line) || /:\/\/[^\s/]*@/.test(line))
+            return false;
+        const eq = line.indexOf("=");
+        const key = (eq < 0 ? line : line.slice(0, eq)).trim();
+        const own = key.startsWith("//") ? key.slice(key.lastIndexOf(":") + 1) : key;
+        if (/^(key|cert|email)$/i.test(own.trim()))
+            return false;
+    }
+    return true;
+}
+export function clearedByContent(path, content) {
+    const name = path.split("/").filter(Boolean).pop() ?? "";
+    let text;
+    if (typeof content === "string") {
+        text = content;
+    }
+    else {
+        try {
+            text = new TextDecoder("utf-8", { fatal: true }).decode(content);
+        }
+        catch {
+            return false;
+        }
+    }
+    if (text.includes("\u0000"))
+        return false;
+    if (/\.pem$/i.test(name))
+        return publicPem(text);
+    if (/^\.npmrc$/i.test(name))
+        return npmrcWithoutCredentials(text);
+    return false;
+}
+export function secretLikeFile(rel, abs) {
+    if (!secretLike(rel))
+        return false;
+    try {
+        const st = lstatSync(abs);
+        if (!st.isFile() || st.size > CONTENT_CHECK_MAX_BYTES)
+            return true;
+        return !clearedByContent(rel, readFileSync(abs));
+    }
+    catch {
+        return true;
+    }
+}
 function namedList(items) {
     const more = items.length > NAMED ? ` and ${items.length - NAMED} more` : "";
     return items.slice(0, NAMED).join(", ") + more;
@@ -395,7 +463,7 @@ export function credentialRefusalMessage(hits) {
     const one = hits.length === 1;
     return `${hits.length} file${one ? " looks" : "s look"} like ${one ? "a credential" : "credentials"} and ${one ? "was" : "were"} not uploaded: ${namedList(hits)}; nothing was created`;
 }
-export const CREDENTIAL_CHECK_NOTE = "The check goes by file name and is best-effort: it cannot see what a file holds, so look over what you send.";
+export const CREDENTIAL_CHECK_NOTE = "The check goes by file name and is best-effort: it reads only a .pem (one with no private key passes) and an .npmrc (one with no token or password passes), so look over what you send.";
 function insidePath(p) {
     return goClean(p.split(sep).join("/").replace(/^\.\/+/, ""));
 }
@@ -495,7 +563,7 @@ function collect(dir, opts) {
     if (special.length > 0) {
         notes.push(`Left out ${namedList(special)}: a socket, device or pipe; a build context holds only files, directories and links.`);
     }
-    const secrets = entries.filter((e) => e.kind === "file" && secretLike(e.rel)).map((e) => e.rel);
+    const secrets = entries.filter((e) => e.kind === "file" && secretLikeFile(e.rel, e.abs)).map((e) => e.rel);
     return { entries, bytes, notes, secrets, ignore };
 }
 export function listContext(dir, opts = {}) {
@@ -518,8 +586,10 @@ export function packContext(dir, opts = {}) {
         const ig = c.ignore?.file;
         throw new InvalidArgumentError(`the build context is over ${max} bytes${ig ? ` even without what its ${ig} excludes` : ""}`, `${ig ? `Exclude more in ${ig}` : "Add a .dockerignore"}, point --context at a smaller directory, or pass a git URL pinned to a full 40-character sha.`);
     }
-    if (c.secrets.length > 0 && !opts.allowSecrets) {
-        throw new InvalidArgumentError(credentialRefusalMessage(c.secrets), `A snapshot keeps every file it holds, and every sandbox started from it has them. Exclude them in ${c.ignore?.file ?? ".dockerignore"}, pass the values as secrets, or pass { allowSecrets: true } if they are not real credentials. ${CREDENTIAL_CHECK_NOTE}`);
+    const allowed = new Set((opts.allowSecretFiles ?? []).map(insidePath));
+    const refused = c.secrets.filter((s) => !allowed.has(s));
+    if (refused.length > 0 && !opts.allowSecrets) {
+        throw new InvalidArgumentError(credentialRefusalMessage(refused), `A snapshot keeps every file it holds, and every sandbox started from it has them. Exclude them in ${c.ignore?.file ?? ".dockerignore"}, pass the values as secrets, or name each that is not a real credential in { allowSecretFiles: [...] } ({ allowSecrets: true } for all of them). ${CREDENTIAL_CHECK_NOTE}`);
     }
     if (c.entries.length === 0) {
         throw new InvalidArgumentError(`the build context ${JSON.stringify(dir)} is empty`, "Point --context at the directory holding your Dockerfile.");

package/dist/core.d.ts

@@ -1,8 +1,10 @@
 /** Promigence SDK — constants, error hierarchy and shared types. */
-export declare const VERSION = "0.1.0-beta.14";
+export declare const VERSION = "0.1.0-beta.16";
 export declare const DOCS_URL = "https://promigence.ai";
 /** The error reference; each code is an anchor on it (the API's `docs` link has the same form). */
 export declare const ERRORS_DOCS_URL = "https://www.promigence.ai/docs/errors";
+/** The row of `code` in the error reference. */
+export declare function errorsDocsFor(code: string): string;
 export declare const DEFAULT_API_URL = "https://api.promigence.ai/v1";
 /** Where to write about a key. A key is self-serve: `promigence login` signs up or in and stores one. */
 export declare const KEY_CONTACT = "support@promigence.ai";
@@ -43,8 +45,8 @@ export interface PromigenceErrorInit {
     /** The API error's `retryable`: nothing ran and the same request, sent again as is, can succeed. */
     retryable?: boolean;
 }
-/** What a caller reads instead: a fact about this beta, not a mistake of theirs. */
-export declare const PREVIEWS_UNAVAILABLE = "preview URLs are not available in this beta yet";
+/** What a caller reads instead: a fact about their account, not a mistake of theirs. */
+export declare const PREVIEWS_UNAVAILABLE = "preview URLs are not turned on for this account";
 export declare function previewsFix(sandboxId?: string, port?: string | number): string;
 /**
  * A `fix` that opens by repeating the message says only what it adds: the API's `usage` fix is
@@ -97,7 +99,13 @@ export declare class PromigenceError extends Error {
         guide: string;
     };
 }
-/** Bad arguments (e.g. an unknown template, a missing spend cap). exit 2 */
+/**
+ * Bad arguments (e.g. an unknown template, a missing spend cap). exit 2
+ *
+ * `code` says who refused: `invalid_argument` is the SDK, before anything was sent; `usage` is the
+ * API, refusing what it was sent. Nothing ran and nothing was billed either way, so catch this
+ * class (or exit 2) to handle both.
+ */
 export declare class InvalidArgumentError extends PromigenceError {
     /**
      * `code` defaults to `invalid_argument` — what the SDK raises for a bad argument it catches
@@ -122,6 +130,26 @@ export declare function previewsOff(message: string): boolean;
 export declare class PreviewsUnavailableError extends InvalidArgumentError {
     constructor(sandboxId?: string, port?: string | number);
 }
+/** The sandbox and its state when an API message is the "has ended" refusal, else `undefined`. */
+export declare function sandboxEndedIn(message: string): {
+    sandboxId: string;
+    state: string;
+} | undefined;
+/** What a caller of this SDK does about an ended sandbox. */
+export declare const SANDBOX_ENDED_FIX = "Start a new sandbox: Sandbox.create(). This one's getInfo() says how it ended (`outcome`).";
+/**
+ * A call to a sandbox that has ended (`state` `ended` or `failed`): it does not come back. Still an
+ * `InvalidArgumentError` with code `usage` and exit 2, as the API answers it, so a catch written
+ * against earlier releases still catches it; catch this class to tell an ended sandbox from a bad
+ * argument. `sandboxId` and `state` name the sandbox and how it stands.
+ */
+export declare class SandboxEndedError extends InvalidArgumentError {
+    /** The sandbox that has ended. */
+    readonly sandboxId: string;
+    /** Its state: `ended`, or `failed` for one that ended on a failure. */
+    readonly state: string;
+    constructor(message: string, sandboxId: string, state: string, fix?: string);
+}
 /** The environment failed (our fault, never the task's). exit 3 */
 export declare class EnvFailedError extends PromigenceError {
     constructor(code: string, message: string, fix: string);

package/dist/core.js

@@ -1,7 +1,10 @@
 import { hintArg } from "./hint.js";
-export const VERSION = "0.1.0-beta.14";
+export const VERSION = "0.1.0-beta.16";
 export const DOCS_URL = "https://promigence.ai";
 export const ERRORS_DOCS_URL = "https://www.promigence.ai/docs/errors";
+export function errorsDocsFor(code) {
+    return `${ERRORS_DOCS_URL}#${code}`;
+}
 export const DEFAULT_API_URL = "https://api.promigence.ai/v1";
 export const KEY_CONTACT = "support@promigence.ai";
 export const WAIT_TIMEOUT_MS = 100_000;
@@ -10,10 +13,11 @@ export const IMAGE_BUILD_LIST_PRICE = 0.1656;
 export const MAX_OUTPUT_BYTES_DEFAULT = 64 * 1024;
 export const FILE_PUT_CHUNK_BYTES = 16 * 1024 * 1024;
 const PREVIEWS_OFF = /^previews are not enabled on this deployment\.?$/i;
-export const PREVIEWS_UNAVAILABLE = "preview URLs are not available in this beta yet";
+export const PREVIEWS_UNAVAILABLE = "preview URLs are not turned on for this account";
 export function previewsFix(sandboxId = "SID", port = 8000) {
     return `Reach the port over SSH instead: \`promigence sandbox ssh ${hintArg(sandboxId)} -- -N -L ${hintArg(`${port}:localhost:${port}`)}\` ` +
-        `forwards http://localhost:${port} here to port ${port} in the sandbox until Ctrl-C.`;
+        `forwards http://localhost:${port} here to port ${port} in the sandbox until Ctrl-C. ` +
+        "Write to support@promigence.ai to have preview URLs turned on.";
 }
 export async function withPreviewsFix(call, sandboxId, port = "PORT") {
     try {
@@ -52,7 +56,7 @@ export class PromigenceError extends Error {
         this.name = new.target.name;
         this.code = code;
         this.fix = previewsOff ? previewsFix() : fixBeyondMessage(init.message, init.fix);
-        this.docs = init.docs ?? DOCS_URL;
+        this.docs = init.docs ?? errorsDocsFor(code);
         this.exitCode = init.exitCode ?? 1;
         this.cliExit = init.exitCode ?? 1;
         this.guide = `promigence agent-guide --section errors --code ${hintArg(code)}`;
@@ -99,6 +103,21 @@ export class PreviewsUnavailableError extends InvalidArgumentError {
         super(PREVIEWS_UNAVAILABLE, previewsFix(sandboxId, port), "unsupported");
     }
 }
+const SANDBOX_ENDED = /^sandbox (\S+) has ended \(`([a-z_]+)`\)/;
+export function sandboxEndedIn(message) {
+    const m = SANDBOX_ENDED.exec(message.trim());
+    return m ? { sandboxId: m[1], state: m[2] } : undefined;
+}
+export const SANDBOX_ENDED_FIX = "Start a new sandbox: Sandbox.create(). This one's getInfo() says how it ended (`outcome`).";
+export class SandboxEndedError extends InvalidArgumentError {
+    sandboxId;
+    state;
+    constructor(message, sandboxId, state, fix = SANDBOX_ENDED_FIX) {
+        super(message, fix, "usage");
+        this.sandboxId = sandboxId;
+        this.state = state;
+    }
+}
 export class EnvFailedError extends PromigenceError {
     constructor(code, message, fix) {
         super({ code, message, fix, exitCode: 3 });
@@ -216,6 +235,7 @@ export const EXIT_BY_CODE = {
     env_failed: 3, snapshot_rejected: 6, build_failed: 3, snapshot_failed: 4,
     not_connected: 7,
     service_restart: 3,
+    digest_mismatch: 4,
     fork_failed: 3, start_timeout: 3, readiness_failed: 3, verify_too_slow: 3,
     verify_each_failed: 3, toolchain_mismatch: 3, sandbox_unresponsive: 3, oom_within_tier: 3,
     disk_full_within_tier: 3, sandbox_interrupted: 3, integrity_mismatch: 3, egress_unavailable: 3,
@@ -247,6 +267,8 @@ export const EXIT_BY_CODE = {
     project_cap_reached: 5,
     spend_limit_reached: 5,
     billing_hold: 5,
+    credits_exhausted: 5, purchase_limit: 5, purchases_blocked: 5,
+    card_needed: 5, auto_reload_unavailable: 5,
     tier_over_plan: 2,
     network_host_refused: 9, network_policy_unsupported: 3,
     secrets_in_snapshot: 2, secrets_unavailable: 3,

package/dist/http2.d.ts

@@ -197,10 +197,18 @@ export declare const __http2Internals: {
         gapUs: number;
         pace: string;
     };
+    /** The offset that turns the thread's stamps into trace times (`clockOffset`), read from the two clocks given. */
+    clockOffset(hr: () => number, now: () => number): number;
     /** Tests: make the transport thread stop answering (it reads nothing more), as a stuck one would. */
     wedgeThreadForTest(): void;
     /** Tests: make the transport thread fail as a crash would. */
     crashThreadForTest(): void;
+    /**
+     * Tests: the transport thread gives no spaced request its turn until `releaseTurnsForTest`. Both go as messages, in order
+     * with the requests and their cancels, so what is sent between them reaches the thread while every spaced request waits.
+     */
+    holdTurnsForTest(): void;
+    releaseTurnsForTest(): void;
     /** The early lookup, for tests: start one with a platform, DNS servers and hosts file of the test's own. */
     early: {
         start(host: string): boolean;

package/dist/http2.js

@@ -1340,6 +1340,12 @@ const THREAD_GRACE_MS = 1_000;
 const THREAD_SWEEP_MS = 250;
 const THREAD_MARKS = 4096;
 const THREAD_PHASES = ["w.got", "w.sent", "w.head", "w.end"];
+function clockOffset(hr = () => Number(process.hrtime.bigint()) / 1e6, now = () => performance.now(), n = 5) {
+    let best = -Infinity;
+    for (let i = 0; i < n; i++)
+        best = Math.max(best, hr() - now());
+    return best;
+}
 class TransportThread {
     origin;
     worker;
@@ -1365,7 +1371,7 @@ class TransportThread {
     posts = 0;
     answered = 0;
     pace = THREAD_DEFAULTS.pace;
-    hrOffset = Number(process.hrtime.bigint()) / 1e6 - performance.now();
+    hrOffset = clockOffset();
     constructor(origin, worker, port, acks) {
         this.origin = origin;
         this.worker = worker;
@@ -2054,6 +2060,9 @@ export const __http2Internals = {
     threadKnobs(env) {
         return threadKnobs(env);
     },
+    clockOffset(hr, now) {
+        return clockOffset(hr, now);
+    },
     wedgeThreadForTest() {
         try {
             transportThread?.port.postMessage({ t: "wedge-for-test" });
@@ -2066,6 +2075,18 @@ export const __http2Internals = {
         }
         catch { }
     },
+    holdTurnsForTest() {
+        try {
+            transportThread?.port.postMessage({ t: "hold-turns-for-test" });
+        }
+        catch { }
+    },
+    releaseTurnsForTest() {
+        try {
+            transportThread?.port.postMessage({ t: "release-turns-for-test" });
+        }
+        catch { }
+    },
     early: {
         start(host) {
             return earlyLookupFor(host.toLowerCase()) !== undefined;