@tangle-network/sandbox 0.9.7 → 0.10.1

package/README.md

@@ -50,6 +50,34 @@ If sandbox creation hangs or times out, do not generate fallback code that
 pretends to have run in a sandbox. Surface the failure, keep the `sandboxId` or
 request id, and retry with the same idempotency key when available.
 
+### Temporary GPU for evals
+
+Keep the base sandbox cheap and attach a GPU only around the command that needs it.
+Omit `provider` to let the platform choose the cheapest configured GPU cloud.
+Every GPU lease needs a hard spend cap and lifetime.
+
+```typescript
+const lease = await box.gpu.attach({
+  accelerator: { kind: "nvidia-3090", count: 1, memoryMB: 24_000 },
+  maxSpendUsd: 1,
+  maxLifetimeSeconds: 900,
+  idleTimeoutSeconds: 120,
+});
+
+try {
+  const result = await box.gpu.exec(lease.id, {
+    command: "python eval.py",
+    timeoutMs: 15 * 60 * 1000,
+  });
+  console.log(result.result.stdout);
+} finally {
+  await box.gpu.detach(lease.id);
+}
+```
+
+The detached lease includes `billing.seconds`, `billing.customerCostUsd`, and provider cost basis fields once billing is finalized.
+See `examples/gpu-eval-lease.ts` for the full create, run, detach, and sandbox cleanup flow.
+
 ## Installation
 
 ```bash

package/dist/agent/index.d.ts

@@ -1,5 +1,5 @@
-import { G as CodeExecutionOptions, K as CodeExecutionResult, Y as CodeResultPart, n as SandboxInstance, q as CodeLanguage } from "../sandbox-B6qbvsur.js";
-import { i as SandboxClient } from "../client-DWkQOg1k.js";
+import { $ as CodeExecutionResult, Q as CodeExecutionOptions, et as CodeLanguage, n as SandboxInstance, nt as CodeResultPart } from "../sandbox-Bm2C9Phd.js";
+import { i as SandboxClient } from "../client-BgKAw8YA.js";
 import * as _$_modelcontextprotocol_sdk_server_index_js0 from "@modelcontextprotocol/sdk/server/index.js";
 
 //#region src/agent/tools/_specs.d.ts

package/dist/auth/index.js

@@ -1,39 +1,78 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
 //#region src/auth/tokens.ts
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
 /**
-* JWT Token Utilities
-*
-* Token generation and verification using HMAC-SHA256. Server-only
-* (uses Node.js `crypto`).
-*/
-/**
-* Base64URL encode (RFC 7515).
+* Base64URL encode (RFC 7515). Isomorphic: `btoa` + `TextEncoder` exist in
+* Node and browsers, so — unlike `Buffer` — this never blanks a browser page
+* that transitively imports the module.
 */
 function base64UrlEncode(data) {
-	return (typeof data === "string" ? Buffer.from(data) : data).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+	const bytes = typeof data === "string" ? textEncoder.encode(data) : data;
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 /**
-* Base64URL decode (RFC 7515) to raw bytes. Returns `null` if the
-* input contains characters outside the base64url alphabet.
+* Base64URL decode (RFC 7515) to raw bytes. Returns `null` if the input is
+* not valid base64url (characters outside the alphabet, or a length that
+* cannot decode).
 */
-function decodeBase64UrlToBuffer(input) {
+function decodeBase64UrlToBytes(input) {
 	if (!/^[A-Za-z0-9_-]*$/.test(input)) return null;
 	const padded = input + "=".repeat((4 - input.length % 4) % 4);
-	return Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+	let binary;
+	try {
+		binary = atob(padded.replace(/-/g, "+").replace(/_/g, "/"));
+	} catch {
+		return null;
+	}
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+/**
+* Base64URL decode to a UTF-8 string, or `null` if the input is not valid
+* base64url.
+*/
+function decodeBase64UrlToString(input) {
+	const bytes = decodeBase64UrlToBytes(input);
+	return bytes === null ? null : textDecoder.decode(bytes);
+}
+let nodeCrypto;
+/**
+* Resolve Node's `crypto` lazily and synchronously. Signing and verification
+* are server-only (HMAC-SHA256), but this module must stay importable in a
+* browser bundle — a static `import "node:crypto"` forces bundlers to resolve
+* the builtin at load and blanks the page. `process.getBuiltinModule` exists
+* only on a Node runtime (Node >= 22.3); in a browser `globalThis.process` is
+* undefined, so callers get a clear server-only error instead of a crash.
+*/
+function getNodeCrypto() {
+	if (nodeCrypto) return nodeCrypto;
+	const resolved = globalThis.process?.getBuiltinModule?.("node:crypto");
+	if (!resolved) throw new Error("@tangle-network/sandbox/auth: token signing and verification are server-only (HMAC-SHA256 via Node.js crypto) and cannot run in a browser.");
+	nodeCrypto = resolved;
+	return nodeCrypto;
 }
 /**
 * Create HMAC-SHA256 signature.
 */
 function createSignature(data, secret) {
+	const { createHmac } = getNodeCrypto();
 	return base64UrlEncode(createHmac("sha256", secret).update(data).digest());
 }
 /**
-* JWT header (always the same for our use case).
+* Base64URL-encoded JWT header `{"alg":"HS256","typ":"JWT"}`. Computed on
+* first use (not at module load) and memoized.
 */
-const JWT_HEADER = base64UrlEncode(JSON.stringify({
-	alg: "HS256",
-	typ: "JWT"
-}));
+let jwtHeaderCache;
+function jwtHeader() {
+	if (jwtHeaderCache === void 0) jwtHeaderCache = base64UrlEncode(JSON.stringify({
+		alg: "HS256",
+		typ: "JWT"
+	}));
+	return jwtHeaderCache;
+}
 function issueToken(signingSecret, payload, ttlMinutes) {
 	const now = Math.floor(Date.now() / 1e3);
 	const fullPayload = {
@@ -41,7 +80,8 @@ function issueToken(signingSecret, payload, ttlMinutes) {
 		iat: now,
 		exp: now + ttlMinutes * 60
 	};
-	const data = `${JWT_HEADER}.${base64UrlEncode(JSON.stringify(fullPayload))}`;
+	const encodedPayload = base64UrlEncode(JSON.stringify(fullPayload));
+	const data = `${jwtHeader()}.${encodedPayload}`;
 	return `${data}.${createSignature(data, signingSecret)}`;
 }
 /**
@@ -119,8 +159,8 @@ function unsafeDecodeToken(token) {
 		if (parts.length !== 3) return null;
 		const payload = parts[1];
 		if (payload === void 0) return null;
-		const padded = payload + "=".repeat((4 - payload.length % 4) % 4);
-		const decoded = Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString();
+		const decoded = decodeBase64UrlToString(payload);
+		if (decoded === null) return null;
 		return JSON.parse(decoded);
 	} catch {
 		return null;
@@ -145,20 +185,21 @@ function verifyToken(token, signingSecret, options = {}) {
 		if (parts.length !== 3) return null;
 		const [headerB64, payloadB64, signatureB64] = parts;
 		if (!headerB64 || !payloadB64 || !signatureB64) return null;
+		const headerJson = decodeBase64UrlToString(headerB64);
+		if (headerJson === null) return null;
 		let header;
 		try {
-			const headerPadded = headerB64 + "=".repeat((4 - headerB64.length % 4) % 4);
-			const headerJson = Buffer.from(headerPadded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString();
 			header = JSON.parse(headerJson);
 		} catch {
 			return null;
 		}
 		if (header.alg !== "HS256") return null;
 		const expectedSig = createSignature(`${headerB64}.${payloadB64}`, signingSecret);
-		const providedRaw = decodeBase64UrlToBuffer(signatureB64);
-		const expectedRaw = decodeBase64UrlToBuffer(expectedSig);
+		const providedRaw = decodeBase64UrlToBytes(signatureB64);
+		const expectedRaw = decodeBase64UrlToBytes(expectedSig);
 		if (!providedRaw || !expectedRaw) return null;
 		if (providedRaw.length !== expectedRaw.length) return null;
+		const { timingSafeEqual } = getNodeCrypto();
 		if (!timingSafeEqual(providedRaw, expectedRaw)) return null;
 		const payload = unsafeDecodeToken(token);
 		if (!payload) return null;

package/dist/{client-DWkQOg1k.d.ts → client-BgKAw8YA.d.ts}

@@ -1,4 +1,4 @@
-import { $ as CreateSandboxFleetOptions, $n as SandboxFleetTraceBundle, A as AttachSandboxFleetMachineOptions, B as BatchTask, Bn as SandboxFleetDriverCapability, Cn as PublishPublicTemplateVersionOptions, Ct as FleetDispatchStreamOptions, Dn as ReconcileSandboxFleetsResult, Dt as FleetPromptDispatchOptions, En as ReconcileSandboxFleetsOptions, Et as FleetMachineId, Fn as SandboxFleetArtifact, Gr as TokenRefreshHandler, Gt as IntelligenceReportWindow, Hn as SandboxFleetInfo, Ht as IntelligenceReportBudget, In as SandboxFleetArtifactSpec, Jn as SandboxFleetManifest, Jt as ListSandboxFleetOptions, Kn as SandboxFleetMachineRecord, L as BatchEvent, Ln as SandboxFleetCostEstimate, Lr as SubscriptionInfo, Nn as SandboxEnvironment, Nr as SshKeysManager, Ot as FleetPromptDispatchResult, Q as CreateRequestOptions, Qn as SandboxFleetToken, R as BatchOptions, Sn as PublishPublicTemplateOptions, St as FleetDispatchResultBufferOptions, Tn as ReapExpiredSandboxFleetsResult, Tt as FleetExecDispatchResult, Ut as IntelligenceReportCompareTo, Vt as IntelligenceReport, Xn as SandboxFleetOperationsSummary, Yt as ListSandboxOptions, Z as CreateIntelligenceReportOptions, Zr as UsageInfo, _t as ExecResult, a as TraceExportSink, ar as SandboxFleetWorkspaceReconcileResult, bn as PublicTemplateInfo, bt as FleetDispatchCancelResult, cr as SandboxInfo, et as CreateSandboxFleetTokenOptions, gt as ExecOptions, hn as PromptResult, i as TraceExportResult, jn as SandboxClientConfig, mn as PromptOptions, n as SandboxInstance, nr as SandboxFleetTraceOptions, nt as CreateSandboxOptions, or as SandboxFleetWorkspaceRestoreResult, pn as PromptInputPart, rr as SandboxFleetUsage, sr as SandboxFleetWorkspaceSnapshotResult, t as HttpClient, tt as CreateSandboxFleetWithCoordinatorOptions, wn as ReapExpiredSandboxFleetsOptions, wr as SecretsManager, wt as FleetExecDispatchOptions, xn as PublicTemplateVersionInfo, xt as FleetDispatchResultBuffer, z as BatchResult, zn as SandboxFleetDispatchResponse } from "./sandbox-B6qbvsur.js";
+import { $n as ReconcileSandboxFleetsResult, Bn as PromptOptions, Bt as FleetDispatchResultBuffer, Dt as ExecOptions, G as BatchRunOptions, Gt as FleetMachineId, Ht as FleetDispatchStreamOptions, J as BatchTask, Jn as PublishPublicTemplateOptions, K as BatchRunRequest, Kn as PublicTemplateInfo, Kt as FleetPromptDispatchOptions, M as AttachSandboxFleetMachineOptions, Mr as SandboxFleetWorkspaceRestoreResult, Nr as SandboxFleetWorkspaceSnapshotResult, Or as SandboxFleetTraceOptions, Ot as ExecResult, Pr as SandboxInfo, Qn as ReconcileSandboxFleetsOptions, Ri as TokenRefreshHandler, Sr as SandboxFleetOperationsSummary, Ti as SubscriptionInfo, Tr as SandboxFleetTraceBundle, U as BatchOptions, Ut as FleetExecDispatchOptions, V as BatchEvent, Vn as PromptResult, Vt as FleetDispatchResultBufferOptions, W as BatchResult, Wi as UsageInfo, Wt as FleetExecDispatchResult, Xn as ReapExpiredSandboxFleetsOptions, Yn as PublishPublicTemplateVersionOptions, Zn as ReapExpiredSandboxFleetsResult, _n as IntelligenceReportWindow, a as TraceExportSink, ar as SandboxEnvironment, bn as ListSandboxFleetOptions, br as SandboxFleetManifest, cr as SandboxFleetArtifactSpec, ct as CreateSandboxFleetOptions, dr as SandboxFleetDispatchResponse, dt as CreateSandboxOptions, fr as SandboxFleetDriverCapability, hn as IntelligenceReportCompareTo, i as TraceExportResult, jr as SandboxFleetWorkspaceReconcileResult, kr as SandboxFleetUsage, lr as SandboxFleetCostEstimate, lt as CreateSandboxFleetTokenOptions, mn as IntelligenceReportBudget, mr as SandboxFleetInfo, n as SandboxInstance, oi as SecretsManager, ot as CreateIntelligenceReportOptions, pn as IntelligenceReport, qn as PublicTemplateVersionInfo, qt as FleetPromptDispatchResult, rr as SandboxClientConfig, sr as SandboxFleetArtifact, st as CreateRequestOptions, t as HttpClient, ut as CreateSandboxFleetWithCoordinatorOptions, vr as SandboxFleetMachineRecord, wr as SandboxFleetToken, xi as SshKeysManager, xn as ListSandboxOptions, zn as PromptInputPart, zr as SandboxProfileSummary, zt as FleetDispatchCancelResult } from "./sandbox-Bm2C9Phd.js";
 
 //#region src/lib/sse-parser.d.ts
 /**
@@ -185,6 +185,20 @@ declare class SandboxFleetClient {
   private listBySandboxMetadata;
 }
 //#endregion
+//#region src/session-events.d.ts
+/** Event delivered to a product session through the Sandbox session gateway. */
+interface SessionBroadcastEvent {
+  type: string;
+  id?: string;
+  data?: unknown;
+  channel?: string;
+}
+/** Result returned after Sandbox accepts or rejects a session event. */
+interface SessionBroadcastResult {
+  success: boolean;
+  sessionId: string;
+}
+//#endregion
 //#region src/client.d.ts
 /**
  * Client for the Tangle Sandbox platform.
@@ -254,6 +268,10 @@ declare class SandboxClient implements HttpClient {
    */
   get secrets(): SecretsManager;
   get sshKeys(): SshKeysManager;
+  /** List agent profiles registered by the Sandbox API. */
+  listProfiles(): Promise<SandboxProfileSummary[]>;
+  /** Deliver a server-originated event to a mapped product session. */
+  broadcastSessionEvent(sessionId: string, event: SessionBroadcastEvent): Promise<SessionBroadcastResult>;
   private _environments;
   /**
    * Access available development environments.
@@ -435,6 +453,7 @@ declare class SandboxClient implements HttpClient {
    * console.log(`Success rate: ${result.successRate}%`);
    * ```
    */
+  runBatch(request: BatchRunRequest, options?: BatchRunOptions): Promise<BatchResult>;
   runBatch(tasks: BatchTask[], options?: BatchOptions): Promise<BatchResult>;
   /**
    * Stream events from a batch execution.
@@ -461,6 +480,7 @@ declare class SandboxClient implements HttpClient {
    * }
    * ```
    */
+  streamBatch(request: BatchRunRequest, options?: BatchRunOptions): AsyncGenerator<BatchEvent>;
   streamBatch(tasks: BatchTask[], options?: BatchOptions): AsyncGenerator<BatchEvent>;
   /**
    * Make an authenticated HTTP request to the API.
@@ -712,4 +732,4 @@ declare class TeamsClient {
  * Alias for SandboxClient for cleaner imports.
  */
 //#endregion
-export { Team as a, SandboxFleet as c, ParsedSSEEvent as d, parseSSEStream as f, SandboxClient as i, SandboxFleetClient as l, IntelligenceClient as n, TeamInvitation as o, InviteTeamMemberOptions as r, TeamMember as s, CreateTeamOptions as t, ParseSSEStreamOptions as u };
+export { Team as a, SessionBroadcastEvent as c, SandboxFleetClient as d, ParseSSEStreamOptions as f, SandboxClient as i, SessionBroadcastResult as l, parseSSEStream as m, IntelligenceClient as n, TeamInvitation as o, ParsedSSEEvent as p, InviteTeamMemberOptions as r, TeamMember as s, CreateTeamOptions as t, SandboxFleet as u };

package/dist/{client-BZSkXIEp.js → client-DeHvk634.js}

@@ -1,5 +1,5 @@
-import { f as encodePromptForWire, l as exportTraceBundle, p as parseSSEStream, s as normalizeConnection, t as SandboxInstance } from "./sandbox-bDWrUu8i.js";
-import { d as ValidationError, f as parseErrorResponse, i as NotFoundError, r as NetworkError, t as AuthError, u as TimeoutError } from "./errors-DZsfJUuc.js";
+import { d as exportTraceBundle, g as parseSSEStream, l as normalizeConnection, m as encodePromptForWire, n as normalizeStartupDiagnostics, t as SandboxInstance } from "./sandbox-CeimsfC8.js";
+import { a as NotFoundError, d as TimeoutError, f as ValidationError, i as NetworkError, p as parseErrorResponse, t as AuthError } from "./errors-DSz87Rkk.js";
 //#region src/resources.ts
 /**
 * Compute tiers, ordered smallest → largest. Defined HERE (not imported from
@@ -140,6 +140,7 @@ function mergeCreateOptions(defaults, machine) {
 		}
 	} : void 0;
 	const driver = machine.driver ?? defaults?.driver;
+	const gpuLease = mergeGpuLeaseOptions(defaults?.gpuLease, machine.gpuLease);
 	return {
 		...defaults,
 		...rest,
@@ -152,7 +153,26 @@ function mergeCreateOptions(defaults, machine) {
 			...machine.env
 		},
 		backend,
-		driver
+		driver,
+		gpuLease
+	};
+}
+function mergeGpuLeaseOptions(defaults, machine) {
+	if (!defaults && !machine) return void 0;
+	const maxSpendUsd = machine?.maxSpendUsd ?? defaults?.maxSpendUsd;
+	const maxLifetimeSeconds = machine?.maxLifetimeSeconds ?? defaults?.maxLifetimeSeconds;
+	if (maxSpendUsd === void 0 || maxLifetimeSeconds === void 0) return;
+	const env = defaults?.env || machine?.env ? {
+		...defaults?.env,
+		...machine?.env
+	} : void 0;
+	return {
+		...machine?.provider ?? defaults?.provider ? { provider: machine?.provider ?? defaults?.provider } : {},
+		...machine?.image ?? defaults?.image ? { image: machine?.image ?? defaults?.image } : {},
+		...env ? { env } : {},
+		maxSpendUsd,
+		maxLifetimeSeconds,
+		...machine?.idleTimeoutSeconds ?? defaults?.idleTimeoutSeconds ? { idleTimeoutSeconds: machine?.idleTimeoutSeconds ?? defaults?.idleTimeoutSeconds } : {}
 	};
 }
 function assertPolicy(machines, defaults, policy) {
@@ -165,17 +185,21 @@ function assertPolicy(machines, defaults, policy) {
 	let totalMemoryMb = 0;
 	let totalStorageMb = 0;
 	let totalAccelerators = 0;
+	let totalGpuLeaseMaxSpendUsd = 0;
 	for (const machine of machines) {
-		const resources = mergeCreateOptions(defaults, machine).resources;
+		const options = mergeCreateOptions(defaults, machine);
+		const resources = options.resources;
 		totalCpu += resources?.cpuCores ?? 0;
 		totalMemoryMb += resources?.memoryMB ?? 0;
 		totalStorageMb += resources?.diskGB ? resources.diskGB * 1024 : 0;
 		totalAccelerators += resources?.accelerator?.count ?? (resources?.accelerator ? 1 : 0);
+		if (options.gpuLease) totalGpuLeaseMaxSpendUsd += options.gpuLease.maxSpendUsd;
 	}
 	if (policy?.maxTotalCpu !== void 0 && totalCpu > policy.maxTotalCpu) throw new ValidationError(`Fleet create requested ${totalCpu} CPU cores but policy.maxTotalCpu is ${policy.maxTotalCpu}`, { "policy.maxTotalCpu": "exceeded" });
 	if (policy?.maxTotalMemoryMb !== void 0 && totalMemoryMb > policy.maxTotalMemoryMb) throw new ValidationError(`Fleet create requested ${totalMemoryMb} MB RAM but policy.maxTotalMemoryMb is ${policy.maxTotalMemoryMb}`, { "policy.maxTotalMemoryMb": "exceeded" });
 	if (policy?.maxTotalStorageMb !== void 0 && totalStorageMb > policy.maxTotalStorageMb) throw new ValidationError(`Fleet create requested ${totalStorageMb} MB storage but policy.maxTotalStorageMb is ${policy.maxTotalStorageMb}`, { "policy.maxTotalStorageMb": "exceeded" });
 	if (policy?.maxTotalAccelerators !== void 0 && totalAccelerators > policy.maxTotalAccelerators) throw new ValidationError(`Fleet create requested ${totalAccelerators} accelerator devices but policy.maxTotalAccelerators is ${policy.maxTotalAccelerators}`, { "policy.maxTotalAccelerators": "exceeded" });
+	if (policy?.maxSpendUsd !== void 0 && totalGpuLeaseMaxSpendUsd > policy.maxSpendUsd) throw new ValidationError(`Fleet GPU lease max spend $${totalGpuLeaseMaxSpendUsd} exceeds policy.maxSpendUsd $${policy.maxSpendUsd}`, { "policy.maxSpendUsd": "exceeded" });
 	const maxLifetimeSeconds = Math.max(...machines.map((machine) => mergeCreateOptions(defaults, machine).maxLifetimeSeconds ?? DEFAULT_MACHINE_LIFETIME_SECONDS));
 	if (policy?.maxLifetimeSeconds !== void 0 && maxLifetimeSeconds > policy.maxLifetimeSeconds) throw new ValidationError(`Fleet create requested ${maxLifetimeSeconds}s max lifetime but policy.maxLifetimeSeconds is ${policy.maxLifetimeSeconds}`, { "policy.maxLifetimeSeconds": "exceeded" });
 	for (const machine of machines) {
@@ -184,14 +208,20 @@ function assertPolicy(machines, defaults, policy) {
 	}
 }
 function assertMachineDescriptorPolicy(machineId, options, policy) {
-	if (!policy) return;
 	const driverType = options.driver?.type;
-	if (policy.allowedDrivers && driverType && !policy.allowedDrivers.includes(driverType)) throw new ValidationError(`Fleet machine '${machineId}' requested driver '${driverType}' outside policy.allowedDrivers`, { "policy.allowedDrivers": "exceeded" });
+	if (policy?.allowedDrivers && driverType && !policy.allowedDrivers.includes(driverType)) throw new ValidationError(`Fleet machine '${machineId}' requested driver '${driverType}' outside policy.allowedDrivers`, { "policy.allowedDrivers": "exceeded" });
 	const image = options.environment ?? options.image;
-	if (policy.allowedImages && image && !policy.allowedImages.includes(image)) throw new ValidationError(`Fleet machine '${machineId}' requested image '${image}' outside policy.allowedImages`, { "policy.allowedImages": "exceeded" });
+	if (policy?.allowedImages && image && !policy.allowedImages.includes(image)) throw new ValidationError(`Fleet machine '${machineId}' requested image '${image}' outside policy.allowedImages`, { "policy.allowedImages": "exceeded" });
 	const templateId = options.templateId ?? options.publicTemplateId;
-	if (policy.allowedTemplateIds && templateId && !policy.allowedTemplateIds.includes(templateId)) throw new ValidationError(`Fleet machine '${machineId}' requested template '${templateId}' outside policy.allowedTemplateIds`, { "policy.allowedTemplateIds": "exceeded" });
-	if (policy.allowAccelerators === false && (options.resources?.accelerator?.count ?? (options.resources?.accelerator ? 1 : 0)) > 0) throw new ValidationError(`Fleet machine '${machineId}' requested accelerators but policy.allowAccelerators is false`, { "policy.allowAccelerators": "exceeded" });
+	if (policy?.allowedTemplateIds && templateId && !policy.allowedTemplateIds.includes(templateId)) throw new ValidationError(`Fleet machine '${machineId}' requested template '${templateId}' outside policy.allowedTemplateIds`, { "policy.allowedTemplateIds": "exceeded" });
+	if (policy?.allowAccelerators === false && (options.resources?.accelerator?.count ?? (options.resources?.accelerator ? 1 : 0)) > 0) throw new ValidationError(`Fleet machine '${machineId}' requested accelerators but policy.allowAccelerators is false`, { "policy.allowAccelerators": "exceeded" });
+	const acceleratorCount = options.resources?.accelerator?.count ?? (options.resources?.accelerator ? 1 : 0);
+	if (acceleratorCount > 0 && !options.gpuLease) throw new ValidationError(`Fleet machine '${machineId}' requested accelerators but gpuLease is missing`, { gpuLease: "required" });
+	if (acceleratorCount === 0 && options.gpuLease) throw new ValidationError(`Fleet machine '${machineId}' set gpuLease without resources.accelerator`, { gpuLease: "unexpected" });
+	if (options.gpuLease) {
+		if (!Number.isFinite(options.gpuLease.maxSpendUsd) || options.gpuLease.maxSpendUsd <= 0) throw new ValidationError(`Fleet machine '${machineId}' gpuLease.maxSpendUsd must be positive`, { "gpuLease.maxSpendUsd": "invalid" });
+		if (!Number.isInteger(options.gpuLease.maxLifetimeSeconds) || options.gpuLease.maxLifetimeSeconds <= 0) throw new ValidationError(`Fleet machine '${machineId}' gpuLease.maxLifetimeSeconds must be a positive integer`, { "gpuLease.maxLifetimeSeconds": "invalid" });
+	}
 }
 function calculateResourceTotals(machines, defaults) {
 	let totalCpu = 0;
@@ -916,6 +946,25 @@ function getMachineRole(info) {
 	return value === "coordinator" || value === "worker" ? value : void 0;
 }
 //#endregion
+//#region src/session-events.ts
+async function broadcastSessionEvent(client, sessionId, event) {
+	if (!sessionId.trim()) throw new ValidationError("Session ID is required");
+	if (!event.type.trim()) throw new ValidationError("Session event type is required");
+	const response = await client.fetch(`/v1/session/${encodeURIComponent(sessionId)}/broadcast`, {
+		method: "POST",
+		body: JSON.stringify(event)
+	});
+	if (!response.ok) {
+		const body = await response.text();
+		throw parseErrorResponse(response.status, body, void 0, response.headers);
+	}
+	const result = await response.json();
+	return {
+		success: result.success,
+		sessionId: result.sessionId
+	};
+}
+//#endregion
 //#region src/client.ts
 /**
 * Sandbox Client
@@ -933,6 +982,7 @@ const DEFAULT_TIMEOUT_MS = 3e4;
 * safe server-side, but polling is cheaper and avoids duplicate work).
 */
 const DEFAULT_CREATE_TIMEOUT_MS = 12e4;
+const DEFAULT_GPU_CREATE_TIMEOUT_MS = 900 * 1e3;
 /**
 * Extra grace the SDK's client-side batch deadline gets on top of
 * the server-side `timeoutMs`. The server's clock starts when the
@@ -1136,6 +1186,19 @@ var SandboxClient = class {
 		if (!this._sshKeys) this._sshKeys = new SshKeysManagerImpl(this);
 		return this._sshKeys;
 	}
+	/** List agent profiles registered by the Sandbox API. */
+	async listProfiles() {
+		const response = await this.fetch("/profiles");
+		if (!response.ok) {
+			const body = await response.text();
+			throw parseErrorResponse(response.status, body, void 0, response.headers);
+		}
+		return (await response.json()).profiles ?? [];
+	}
+	/** Deliver a server-originated event to a mapped product session. */
+	async broadcastSessionEvent(sessionId, event) {
+		return broadcastSessionEvent(this, sessionId, event);
+	}
 	_environments = null;
 	/**
 	* Access available development environments.
@@ -1194,7 +1257,7 @@ var SandboxClient = class {
 	* ```
 	*/
 	async create(options, requestOptions) {
-		const timeoutMs = requestOptions?.timeoutMs ?? DEFAULT_CREATE_TIMEOUT_MS;
+		const timeoutMs = requestOptions?.timeoutMs ?? (options?.gpuLease ? DEFAULT_GPU_CREATE_TIMEOUT_MS : DEFAULT_CREATE_TIMEOUT_MS);
 		const idempotencyKey = options?.idempotencyKey ?? generateIdempotencyKey();
 		const deadline = Date.now() + timeoutMs;
 		const git = options?.git ? {
@@ -1228,11 +1291,13 @@ var SandboxClient = class {
 					git,
 					tools: options?.tools,
 					bare: options?.bare,
+					...options?.publicEdge === false ? { publicEdge: false } : {},
 					driver: options?.driver,
 					backend: resolvedBackend,
 					permissions: options?.permissions,
 					env: options?.env,
 					resources,
+					gpuLease: options?.gpuLease,
 					sshEnabled: options?.sshEnabled,
 					sshPublicKeys: options?.sshPublicKeys ?? (options?.sshPublicKey ? [options.sshPublicKey] : void 0),
 					sshKeyIds: options?.sshKeyIds,
@@ -1240,6 +1305,7 @@ var SandboxClient = class {
 					maxLifetimeSeconds: options?.maxLifetimeSeconds,
 					idleTimeoutSeconds: options?.idleTimeoutSeconds,
 					storage: options?.storage,
+					ephemeral: options?.ephemeral,
 					fromSnapshot: options?.fromSnapshot,
 					fromSandboxId: options?.fromSandboxId,
 					templateId: options?.templateId,
@@ -1373,6 +1439,9 @@ var SandboxClient = class {
 		const data = await response.json();
 		return {
 			computeMinutes: data.computeMinutes ?? 0,
+			gpuSeconds: data.gpuSeconds ?? 0,
+			gpuCostUsd: data.gpuCostUsd ?? 0,
+			gpuProviderCostUsd: data.gpuProviderCostUsd ?? 0,
 			activeSandboxes: data.activeSandboxes ?? 0,
 			totalSandboxes: data.totalSandboxes ?? 0,
 			periodStart: new Date(data.periodStart),
@@ -1452,39 +1521,12 @@ var SandboxClient = class {
 		}
 		return await response.json();
 	}
-	/**
-	* Run multiple tasks in parallel across sandboxes.
-	* Returns the aggregated results after all tasks complete.
-	*
-	* @param tasks - Array of tasks to execute
-	* @param options - Batch execution options
-	* @returns Aggregated batch results
-	*
-	* @throws {@link TimeoutError} if the server hasn't begun responding
-	*   before the deadline (pre-stream timeout).
-	* @throws {@link ValidationError} / {@link QuotaError} / other typed
-	*   SDK errors if the server rejects the request before streaming.
-	* @throws `DOMException` with `name === "AbortError"` if
-	*   `options.signal` fires OR the safety-valve deadline fires
-	*   AFTER streaming has begun — parseSSEStream can't distinguish
-	*   the source mid-stream. Callers that need to tell cancel from
-	*   timeout should check `options.signal?.aborted` in their catch.
-	* @throws `Error` with the server message if the stream emits a
-	*   `batch.failed` event.
-	*
-	* @example
-	* ```typescript
-	* const result = await client.runBatch([
-	*   { id: "task-1", message: "Analyze this file" },
-	*   { id: "task-2", message: "Generate a summary" },
-	* ]);
-	* console.log(`Success rate: ${result.successRate}%`);
-	* ```
-	*/
-	async runBatch(tasks, options) {
+	async runBatch(input, options) {
+		const tasks = Array.isArray(input) ? input : input.tasks;
 		const results = [];
 		let totalRetries = 0;
-		for await (const event of this.streamBatch(tasks, options)) {
+		const stream = Array.isArray(input) ? this.streamBatch(input, options) : this.streamBatch(input, options);
+		for await (const event of stream) {
 			if (event.type === "task.completed") {
 				const data = event.data;
 				const usageTotal = (data.usage?.inputTokens ?? 0) + (data.usage?.outputTokens ?? 0);
@@ -1494,7 +1536,12 @@ var SandboxClient = class {
 					response: data.resultSummary ?? data.response,
 					durationMs: data.durationMs ?? 0,
 					retries: data.retries ?? 0,
-					tokensUsed: data.tokensUsed ?? (usageTotal > 0 ? usageTotal : void 0)
+					tokensUsed: data.tokensUsed ?? (usageTotal > 0 ? usageTotal : void 0),
+					backend: data.backend,
+					backendLabel: data.backendLabel,
+					backendModel: data.backendModel,
+					sessionId: data.sessionId,
+					sandboxId: data.sidecarId
 				});
 				totalRetries += data.retries ?? 0;
 			}
@@ -1505,7 +1552,11 @@ var SandboxClient = class {
 					success: false,
 					error: data.error,
 					durationMs: data.durationMs ?? 0,
-					retries: data.retries ?? 0
+					retries: data.retries ?? 0,
+					backend: data.backend,
+					backendLabel: data.backendLabel,
+					backendModel: data.backendModel,
+					sandboxId: data.sidecarId
 				});
 				totalRetries += data.retries ?? 0;
 			}
@@ -1521,51 +1572,36 @@ var SandboxClient = class {
 			succeeded,
 			failed,
 			totalRetries,
-			successRate: tasks.length > 0 ? succeeded / tasks.length * 100 : 0,
+			successRate: results.length > 0 ? succeeded / results.length * 100 : 0,
 			results
 		};
 	}
-	/**
-	* Stream events from a batch execution.
-	* Use this for real-time progress updates during batch processing.
-	*
-	* @param tasks - Array of tasks to execute
-	* @param options - Batch execution options
-	*
-	* @throws {@link TimeoutError} if the server hasn't begun responding
-	*   before the deadline (pre-stream timeout).
-	* @throws {@link ValidationError} / {@link QuotaError} / other typed
-	*   SDK errors if the server rejects the request before streaming.
-	* @throws `DOMException` with `name === "AbortError"` if
-	*   `options.signal` fires OR the safety-valve deadline fires
-	*   AFTER streaming has begun. Distinguish via
-	*   `options.signal?.aborted` in the consumer's catch.
-	*
-	* @example
-	* ```typescript
-	* for await (const event of client.streamBatch(tasks)) {
-	*   if (event.type === "task.completed") {
-	*     console.log(`Task ${event.data.taskId} completed`);
-	*   }
-	* }
-	* ```
-	*/
-	async *streamBatch(tasks, options) {
+	async *streamBatch(input, options) {
+		const { signal: legacySignal, ...legacyRequestOptions } = (Array.isArray(input) ? options : void 0) ?? {};
+		const request = Array.isArray(input) ? {
+			tasks: input,
+			...legacyRequestOptions
+		} : input;
+		const userSignal = Array.isArray(input) ? legacySignal : options?.signal;
 		const url = `${this.baseUrl}/batch/run`;
-		const resolvedTimeoutMs = options?.timeoutMs ?? 3e5;
+		const resolvedTimeoutMs = request.timeoutMs ?? 3e5;
 		const requestBody = JSON.stringify({
-			tasks,
-			backend: options?.backend ? {
-				...options.backend,
-				type: options.backend.type ?? "opencode"
-			} : { type: "opencode" },
+			...request,
+			backend: request.backend ? {
+				...request.backend,
+				type: request.backend.type ?? "opencode"
+			} : request.backends ? void 0 : { type: "opencode" },
+			backends: request.backends?.map((backend) => ({
+				...backend,
+				type: backend.type ?? "opencode"
+			})),
 			timeoutMs: resolvedTimeoutMs,
-			scalingMode: options?.scalingMode ?? "balanced",
-			persistent: options?.persistent ?? false,
-			graceMs: options?.graceMs ?? 0
+			scalingMode: request.scalingMode ?? "balanced",
+			persistent: request.persistent ?? false,
+			graceMs: request.graceMs ?? 0
 		});
 		const deadline = AbortSignal.timeout(resolvedTimeoutMs + CLIENT_DEADLINE_GRACE_MS);
-		const combinedSignal = options?.signal ? AbortSignal.any([options.signal, deadline]) : deadline;
+		const combinedSignal = userSignal ? AbortSignal.any([userSignal, deadline]) : deadline;
 		let response;
 		try {
 			response = await globalThis.fetch(url, {
@@ -1579,7 +1615,7 @@ var SandboxClient = class {
 				signal: combinedSignal
 			});
 		} catch (err) {
-			if (options?.signal?.aborted) throw err instanceof Error && err.name === "AbortError" ? err : new DOMException("Batch aborted", "AbortError");
+			if (userSignal?.aborted) throw err instanceof Error && err.name === "AbortError" ? err : new DOMException("Batch aborted", "AbortError");
 			if (err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError")) throw new TimeoutError(resolvedTimeoutMs, "Batch request timed out before the first SSE event");
 			throw new NetworkError(`Failed to connect to Sandbox API: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0, {
 				endpoint: "/batch/run",
@@ -1590,7 +1626,7 @@ var SandboxClient = class {
 			const errBody = await response.text();
 			throw parseErrorResponse(response.status, errBody, void 0, response.headers);
 		}
-		yield* parseSSEStream(response.body, { signal: combinedSignal });
+		for await (const event of parseSSEStream(response.body, { signal: combinedSignal })) yield event;
 	}
 	/**
 	* Make an authenticated HTTP request to the API.
@@ -1639,7 +1675,9 @@ var SandboxClient = class {
 			startedAt: data.startedAt ? new Date(data.startedAt) : void 0,
 			lastActivityAt: data.lastActivityAt ? new Date(data.lastActivityAt) : void 0,
 			expiresAt: data.expiresAt ? new Date(data.expiresAt) : void 0,
-			error: data.error
+			error: data.error,
+			gpuLease: data.gpuLease,
+			startupDiagnostics: normalizeStartupDiagnostics(data.startupDiagnostics) ?? void 0
 		};
 	}
 	_tokenRefreshHandlers = /* @__PURE__ */ new Set();

package/dist/collaboration/index.js

@@ -1,2 +1,2 @@
-import { a as CollaborationClient, i as parseCollaborationDocumentId, n as buildCollaborationDocumentId, r as normalizeCollaborationPath, t as CollaborationFileBridge } from "../collaboration-BxlfZ2Uh.js";
+import { a as CollaborationClient, i as parseCollaborationDocumentId, n as buildCollaborationDocumentId, r as normalizeCollaborationPath, t as CollaborationFileBridge } from "../collaboration-D17lnOJX.js";
 export { CollaborationClient, CollaborationFileBridge, buildCollaborationDocumentId, normalizeCollaborationPath, parseCollaborationDocumentId };

package/dist/{collaboration-BxlfZ2Uh.js → collaboration-D17lnOJX.js}

@@ -1,4 +1,4 @@
-import { f as parseErrorResponse, r as NetworkError, u as TimeoutError } from "./errors-DZsfJUuc.js";
+import { d as TimeoutError, i as NetworkError, p as parseErrorResponse } from "./errors-DSz87Rkk.js";
 //#region src/collaboration/client.ts
 const DEFAULT_TIMEOUT_MS = 3e4;
 function normalizeBaseUrl(url) {

package/dist/core.d.ts

@@ -1,4 +1,4 @@
-import { $t as NetworkConfig, _t as ExecResult, an as PreviewLinkManager, cr as SandboxInfo, gt as ExecOptions, in as PreviewLinkInfo, jn as SandboxClientConfig, n as SandboxInstance, nt as CreateSandboxOptions, pr as SandboxStatus } from "./sandbox-B6qbvsur.js";
-import { i as SandboxClient } from "./client-DWkQOg1k.js";
-import { a as PartialFailureError, c as SandboxErrorJson, d as StateError, f as TimeoutError, i as NotFoundError, l as SandboxFailureDetail, n as CapabilityError, o as QuotaError, p as ValidationError, r as NetworkError, s as SandboxError, t as AuthError, u as ServerError } from "./errors-1Se5ATyZ.js";
+import { An as PreviewLinkInfo, Dt as ExecOptions, Gr as SandboxStatus, Ot as ExecResult, Pr as SandboxInfo, Tn as NetworkConfig, dt as CreateSandboxOptions, jn as PreviewLinkManager, n as SandboxInstance, rr as SandboxClientConfig } from "./sandbox-Bm2C9Phd.js";
+import { i as SandboxClient } from "./client-BgKAw8YA.js";
+import { a as NotFoundError, c as SandboxError, d as ServerError, f as StateError, i as NetworkError, l as SandboxErrorJson, m as ValidationError, n as CapabilityError, o as PartialFailureError, p as TimeoutError, s as QuotaError, t as AuthError, u as SandboxFailureDetail } from "./errors-H9268M_g.js";
 export { AuthError, CapabilityError, type CreateSandboxOptions, type ExecOptions, type ExecResult, type NetworkConfig, NetworkError, NotFoundError, PartialFailureError, type PreviewLinkInfo, type PreviewLinkManager, QuotaError, SandboxClient as Sandbox, SandboxClient, type SandboxClientConfig, SandboxError, type SandboxErrorJson, type SandboxFailureDetail, type SandboxInfo, SandboxInstance, type SandboxStatus, ServerError, StateError, TimeoutError, ValidationError };

package/dist/core.js

@@ -1,4 +1,4 @@
-import { t as SandboxInstance } from "./sandbox-bDWrUu8i.js";
-import { a as PartialFailureError, c as ServerError, d as ValidationError, i as NotFoundError, l as StateError, n as CapabilityError, o as QuotaError, r as NetworkError, s as SandboxError, t as AuthError, u as TimeoutError } from "./errors-DZsfJUuc.js";
-import { n as SandboxClient } from "./client-BZSkXIEp.js";
+import { t as SandboxInstance } from "./sandbox-CeimsfC8.js";
+import { a as NotFoundError, c as SandboxError, d as TimeoutError, f as ValidationError, i as NetworkError, l as ServerError, n as CapabilityError, o as PartialFailureError, s as QuotaError, t as AuthError, u as StateError } from "./errors-DSz87Rkk.js";
+import { n as SandboxClient } from "./client-DeHvk634.js";
 export { AuthError, CapabilityError, NetworkError, NotFoundError, PartialFailureError, QuotaError, SandboxClient as Sandbox, SandboxClient, SandboxError, SandboxInstance, ServerError, StateError, TimeoutError, ValidationError };