@tensorlakeai/tensorlake 0.5.158 → 0.5.159

package/dist/index.d.cts

@@ -86,6 +86,8 @@ interface NativeSandboxClient {
     deleteSandbox(sandboxId: string): Promise<string>;
     suspendSandbox(sandboxId: string): Promise<string>;
     resumeSandbox(sandboxId: string): Promise<string>;
+    suspendSandboxAndWait(sandboxId: string, waitSec: number): Promise<boolean>;
+    resumeSandboxAndWait(sandboxId: string, waitSec: number): Promise<boolean>;
     attachFileSystem(sandboxId: string, fileSystemId: string, mountPath: string, readOnly?: boolean | null, prefetch?: boolean | null, snapshotId?: string | null, owner?: string | null): Promise<TracedJson>;
     detachFileSystem(sandboxId: string, mountPath: string): Promise<TracedJson>;
     createSnapshot(sandboxId: string, snapshotType?: string | null): Promise<TracedJson>;
@@ -308,6 +310,8 @@ interface ClaimSandboxOptions {
     fileSystems?: FileSystemMount[];
 }
 interface CreateSandboxOptions {
+    /** Allow proxy traffic to wake a suspended sandbox (default true). False requires a named sandbox. */
+    autoResume?: boolean;
     /** Optional sandbox image name. GPU sandboxes require a CAS image; when omitted with a GPU request, Tensorlake uses the server's configured GPU default. */
     image?: string;
     /** CPU count. Defaults to 1 for fresh creates; snapshot restores inherit it when omitted. */
@@ -328,6 +332,10 @@ interface CreateSandboxOptions {
     allowOut?: string[];
     denyOut?: string[];
     snapshotId?: string;
+    /** Whether exposed user ports are reachable without Tensorlake auth. Defaults to false for fresh creates; snapshot restores inherit it when omitted. */
+    allowUnauthenticatedAccess?: boolean;
+    /** User ports routable through the sandbox proxy. Port 9501 is reserved. Snapshot restores inherit ports when omitted; [] clears them. Does not enable unauthenticated access. */
+    exposedPorts?: number[];
     /** Optional name for the sandbox. Named sandboxes support suspend/resume. When absent the sandbox is ephemeral. */
     name?: string;
     /** File systems to mount on fresh creation or warm-pool claim, each at its own absolute, unique guest mount path. */
@@ -377,6 +385,8 @@ interface SandboxResourceResizeInfo {
 }
 /** Wait options apply only to resource updates and are ignored for other properties. */
 interface UpdateSandboxOptions extends ResourceResizeWaitOptions {
+    /** Change wake-on-traffic policy without waking or suspending the sandbox. Omit to keep it unchanged; false requires a named sandbox. Cannot be combined with resource resizing. */
+    autoResume?: boolean;
     /** Whole live vCPU target; omitted retains the current allocation. */
     cpus?: number;
     /** Memory target in MiB, with the same units as create; never rounded by the SDK. */
@@ -472,6 +482,8 @@ interface CopySandboxResponse {
     sandboxes: CopiedSandboxResponse[];
 }
 interface SandboxInfo {
+    /** Whether proxy traffic may wake this sandbox; defaults to true on older servers. */
+    autoResume: boolean;
     /**
      * The runtime the server chose for this sandbox: `firecracker`,
      * `cloud-hypervisor` or `gvisor`. Informational only; it is never sent and
@@ -1581,6 +1593,10 @@ declare class SandboxClient {
      * cannot. By default blocks until the sandbox is fully `Suspended`. Pass
      * `{ wait: false }` to return immediately after the request is sent
      * (fire-and-return); the server processes the suspend asynchronously.
+     *
+     * The server answers as soon as the suspend completes. When its wait runs
+     * out first, or the server does not support waiting, the rest of `timeout`
+     * is spent polling every `pollInterval` seconds.
      */
     suspend(sandboxId: string, options?: SuspendResumeOptions): Promise<void>;
     /**
@@ -1589,8 +1605,18 @@ declare class SandboxClient {
      * By default blocks until the sandbox is `Running` and routable. Pass
      * `{ wait: false }` to return immediately after the request is sent
      * (fire-and-return); the server processes the resume asynchronously.
+     *
+     * The server answers as soon as the sandbox runs. When its wait runs out
+     * first, or the server does not support waiting, the rest of `timeout` is
+     * spent polling every `pollInterval` seconds.
      */
     resume(sandboxId: string, options?: SuspendResumeOptions): Promise<void>;
+    /**
+     * Send a suspend or resume. With `wait`, the server waits for `target` and
+     * answers whether it was reached; when its wait runs out first, the rest of
+     * the timeout is spent polling.
+     */
+    private changeLifecycle;
     /**
      * Attach a registered file system to a running sandbox at `mountPath`.
      *
@@ -2798,6 +2824,8 @@ declare class RemoteAPIError extends SandboxError {
     readonly statusCode: number;
     /** Original response body, retained for compatibility and diagnostics. */
     readonly responseMessage: string;
+    /** Machine-readable API error code, including proxy policy failures. */
+    readonly code?: string;
     readonly sandboxId?: string;
     /** Server reason, including unknown future reasons. */
     readonly reason?: string;

package/dist/index.d.ts

@@ -86,6 +86,8 @@ interface NativeSandboxClient {
     deleteSandbox(sandboxId: string): Promise<string>;
     suspendSandbox(sandboxId: string): Promise<string>;
     resumeSandbox(sandboxId: string): Promise<string>;
+    suspendSandboxAndWait(sandboxId: string, waitSec: number): Promise<boolean>;
+    resumeSandboxAndWait(sandboxId: string, waitSec: number): Promise<boolean>;
     attachFileSystem(sandboxId: string, fileSystemId: string, mountPath: string, readOnly?: boolean | null, prefetch?: boolean | null, snapshotId?: string | null, owner?: string | null): Promise<TracedJson>;
     detachFileSystem(sandboxId: string, mountPath: string): Promise<TracedJson>;
     createSnapshot(sandboxId: string, snapshotType?: string | null): Promise<TracedJson>;
@@ -308,6 +310,8 @@ interface ClaimSandboxOptions {
     fileSystems?: FileSystemMount[];
 }
 interface CreateSandboxOptions {
+    /** Allow proxy traffic to wake a suspended sandbox (default true). False requires a named sandbox. */
+    autoResume?: boolean;
     /** Optional sandbox image name. GPU sandboxes require a CAS image; when omitted with a GPU request, Tensorlake uses the server's configured GPU default. */
     image?: string;
     /** CPU count. Defaults to 1 for fresh creates; snapshot restores inherit it when omitted. */
@@ -328,6 +332,10 @@ interface CreateSandboxOptions {
     allowOut?: string[];
     denyOut?: string[];
     snapshotId?: string;
+    /** Whether exposed user ports are reachable without Tensorlake auth. Defaults to false for fresh creates; snapshot restores inherit it when omitted. */
+    allowUnauthenticatedAccess?: boolean;
+    /** User ports routable through the sandbox proxy. Port 9501 is reserved. Snapshot restores inherit ports when omitted; [] clears them. Does not enable unauthenticated access. */
+    exposedPorts?: number[];
     /** Optional name for the sandbox. Named sandboxes support suspend/resume. When absent the sandbox is ephemeral. */
     name?: string;
     /** File systems to mount on fresh creation or warm-pool claim, each at its own absolute, unique guest mount path. */
@@ -377,6 +385,8 @@ interface SandboxResourceResizeInfo {
 }
 /** Wait options apply only to resource updates and are ignored for other properties. */
 interface UpdateSandboxOptions extends ResourceResizeWaitOptions {
+    /** Change wake-on-traffic policy without waking or suspending the sandbox. Omit to keep it unchanged; false requires a named sandbox. Cannot be combined with resource resizing. */
+    autoResume?: boolean;
     /** Whole live vCPU target; omitted retains the current allocation. */
     cpus?: number;
     /** Memory target in MiB, with the same units as create; never rounded by the SDK. */
@@ -472,6 +482,8 @@ interface CopySandboxResponse {
     sandboxes: CopiedSandboxResponse[];
 }
 interface SandboxInfo {
+    /** Whether proxy traffic may wake this sandbox; defaults to true on older servers. */
+    autoResume: boolean;
     /**
      * The runtime the server chose for this sandbox: `firecracker`,
      * `cloud-hypervisor` or `gvisor`. Informational only; it is never sent and
@@ -1581,6 +1593,10 @@ declare class SandboxClient {
      * cannot. By default blocks until the sandbox is fully `Suspended`. Pass
      * `{ wait: false }` to return immediately after the request is sent
      * (fire-and-return); the server processes the suspend asynchronously.
+     *
+     * The server answers as soon as the suspend completes. When its wait runs
+     * out first, or the server does not support waiting, the rest of `timeout`
+     * is spent polling every `pollInterval` seconds.
      */
     suspend(sandboxId: string, options?: SuspendResumeOptions): Promise<void>;
     /**
@@ -1589,8 +1605,18 @@ declare class SandboxClient {
      * By default blocks until the sandbox is `Running` and routable. Pass
      * `{ wait: false }` to return immediately after the request is sent
      * (fire-and-return); the server processes the resume asynchronously.
+     *
+     * The server answers as soon as the sandbox runs. When its wait runs out
+     * first, or the server does not support waiting, the rest of `timeout` is
+     * spent polling every `pollInterval` seconds.
      */
     resume(sandboxId: string, options?: SuspendResumeOptions): Promise<void>;
+    /**
+     * Send a suspend or resume. With `wait`, the server waits for `target` and
+     * answers whether it was reached; when its wait runs out first, the rest of
+     * the timeout is spent polling.
+     */
+    private changeLifecycle;
     /**
      * Attach a registered file system to a running sandbox at `mountPath`.
      *
@@ -2798,6 +2824,8 @@ declare class RemoteAPIError extends SandboxError {
     readonly statusCode: number;
     /** Original response body, retained for compatibility and diagnostics. */
     readonly responseMessage: string;
+    /** Machine-readable API error code, including proxy policy failures. */
+    readonly code?: string;
     readonly sandboxId?: string;
     /** Server reason, including unknown future reasons. */
     readonly reason?: string;

package/dist/index.js

@@ -46,7 +46,7 @@ var init_defaults = __esm({
   "src/defaults.ts"() {
     "use strict";
     init_esm_shims();
-    SDK_VERSION = "0.5.158";
+    SDK_VERSION = "0.5.159";
     API_URL = process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai";
     API_KEY = process.env.TENSORLAKE_API_KEY ?? void 0;
     NAMESPACE = process.env.INDEXIFY_NAMESPACE ?? "default";
@@ -181,13 +181,17 @@ var init_errors = __esm({
       statusCode;
       /** Original response body, retained for compatibility and diagnostics. */
       responseMessage;
+      /** Machine-readable API error code, including proxy policy failures. */
+      code;
       errorDetails;
       constructor(statusCode, message) {
         let failure;
+        let code;
         try {
           const payload = JSON.parse(message);
           if (payload && typeof payload === "object" && !Array.isArray(payload)) {
             const record = payload;
+            if (typeof record.code === "string") code = record.code;
             if (typeof record.sandbox_id === "string" && record.sandbox_id.trim() && (record.status === "failed" || record.status === "terminated"))
               failure = record;
           }
@@ -213,6 +217,7 @@ var init_errors = __esm({
         this.name = "RemoteAPIError";
         this.statusCode = statusCode;
         this.responseMessage = message;
+        this.code = code;
       }
     };
     RequestNotFinishedError = class extends Error {
@@ -509,7 +514,7 @@ var init_native_worker_client = __esm({
       }
     };
     runtimeKey = /* @__PURE__ */ Symbol.for(
-      `tensorlake.native.worker.${false ? "source" : "0.5.158"}.v1`
+      `tensorlake.native.worker.${false ? "source" : "0.5.159"}.v1`
     );
     runtimes = globalThis;
   }
@@ -4930,6 +4935,12 @@ var init_client = __esm({
         if (options?.timeoutSecs != null) body.timeout_secs = options.timeoutSecs;
         if (options?.entrypoint != null) body.entrypoint = options.entrypoint;
         if (options?.snapshotId != null) body.snapshot_id = options.snapshotId;
+        if (options?.allowUnauthenticatedAccess != null) {
+          body.allow_unauthenticated_access = options.allowUnauthenticatedAccess;
+        }
+        if (options?.exposedPorts != null) {
+          body.exposed_ports = normalizeUserPorts(options.exposedPorts);
+        }
         if (options?.name != null) body.name = options.name;
         if (options?.fileSystems != null && options.fileSystems.length > 0) {
           body.file_systems = options.fileSystems.map(fileSystemMountToWire);
@@ -4941,6 +4952,7 @@ var init_client = __esm({
             deny_out: options?.denyOut ?? []
           };
         }
+        if (options?.autoResume != null) body.auto_resume = options.autoResume;
         if (options?.maxPendingSecs != null) {
           if (!Number.isInteger(options.maxPendingSecs) || options.maxPendingSecs < 0) {
             throw new SandboxError("maxPendingSecs must be a non-negative integer");
@@ -5057,13 +5069,14 @@ var init_client = __esm({
         const resizing = Object.keys(resources).length > 0;
         if (resizing) {
           validateResizeWait(options);
-          if (options.name != null || options.allowUnauthenticatedAccess != null || options.exposedPorts != null || options.network !== void 0) {
+          if (options.name != null || options.allowUnauthenticatedAccess != null || options.exposedPorts != null || options.autoResume != null || options.network !== void 0) {
             throw new SandboxError(
               "resources cannot be combined with other sandbox update fields"
             );
           }
           body.resources = resources;
         }
+        if (options.autoResume != null) body.auto_resume = options.autoResume;
         if (options.name != null) body.name = options.name;
         if (options.allowUnauthenticatedAccess != null) {
           body.allow_unauthenticated_access = options.allowUnauthenticatedAccess;
@@ -5158,28 +5171,19 @@ var init_client = __esm({
        * cannot. By default blocks until the sandbox is fully `Suspended`. Pass
        * `{ wait: false }` to return immediately after the request is sent
        * (fire-and-return); the server processes the suspend asynchronously.
+       *
+       * The server answers as soon as the suspend completes. When its wait runs
+       * out first, or the server does not support waiting, the rest of `timeout`
+       * is spent polling every `pollInterval` seconds.
        */
       async suspend(sandboxId, options) {
-        await callNative(() => this.native.suspendSandbox(sandboxId), {
+        await this.changeLifecycle(
           sandboxId,
-          notFoundKind: "sandbox"
-        });
-        if (options?.wait === false) return;
-        const timeout = options?.timeout ?? 300;
-        const pollInterval = options?.pollInterval ?? 1;
-        const deadline = Date.now() + timeout * 1e3;
-        while (Date.now() < deadline) {
-          const info = await this.get(sandboxId);
-          if (info.status === "suspended" /* SUSPENDED */) return;
-          if (info.status === "terminated" /* TERMINATED */) {
-            throw new SandboxError(
-              `Sandbox ${sandboxId} terminated while waiting for suspend`
-            );
-          }
-          await sleep2(pollInterval * 1e3);
-        }
-        throw new SandboxError(
-          `Sandbox ${sandboxId} did not suspend within ${timeout}s`
+          "suspend",
+          "suspended" /* SUSPENDED */,
+          () => this.native.suspendSandbox(sandboxId),
+          (waitSec) => this.native.suspendSandboxAndWait(sandboxId, waitSec),
+          options
         );
       }
       /**
@@ -5188,28 +5192,58 @@ var init_client = __esm({
        * By default blocks until the sandbox is `Running` and routable. Pass
        * `{ wait: false }` to return immediately after the request is sent
        * (fire-and-return); the server processes the resume asynchronously.
+       *
+       * The server answers as soon as the sandbox runs. When its wait runs out
+       * first, or the server does not support waiting, the rest of `timeout` is
+       * spent polling every `pollInterval` seconds.
        */
       async resume(sandboxId, options) {
-        await callNative(() => this.native.resumeSandbox(sandboxId), {
+        await this.changeLifecycle(
           sandboxId,
-          notFoundKind: "sandbox"
-        });
-        if (options?.wait === false) return;
+          "resume",
+          "running" /* RUNNING */,
+          () => this.native.resumeSandbox(sandboxId),
+          (waitSec) => this.native.resumeSandboxAndWait(sandboxId, waitSec),
+          options
+        );
+      }
+      /**
+       * Send a suspend or resume. With `wait`, the server waits for `target` and
+       * answers whether it was reached; when its wait runs out first, the rest of
+       * the timeout is spent polling.
+       */
+      async changeLifecycle(sandboxId, action, target, send, sendAndWait, options) {
+        const context = { sandboxId, notFoundKind: "sandbox" };
+        if (options?.wait === false) {
+          await callNative(send, context);
+          return;
+        }
         const timeout = options?.timeout ?? 300;
         const pollInterval = options?.pollInterval ?? 1;
         const deadline = Date.now() + timeout * 1e3;
+        let settled;
+        try {
+          settled = await callNative(() => sendAndWait(timeout), context);
+        } catch (error) {
+          if (!(error instanceof RemoteAPIError) || error.statusCode !== 409) {
+            throw error;
+          }
+          if ((await this.get(sandboxId)).status === target) return;
+          throw error;
+        }
+        if (settled) return;
         while (Date.now() < deadline) {
           const info = await this.get(sandboxId);
-          if (info.status === "running" /* RUNNING */) return;
+          if (info.status === target) return;
           if (info.status === "terminated" /* TERMINATED */) {
             throw new SandboxError(
-              `Sandbox ${sandboxId} terminated while waiting for resume`
+              `Sandbox ${sandboxId} terminated while waiting for ${action}`
             );
           }
           await sleep2(pollInterval * 1e3);
         }
         throw new SandboxError(
-          `Sandbox ${sandboxId} did not resume within ${timeout}s`
+          `Sandbox ${sandboxId} did not ${action} within ${timeout}s`
         );
       }
       /**
@@ -5486,6 +5520,11 @@ var init_client = __esm({
        * claim that is still starting is then waited on the same way.
        */
       async createAndConnect(options) {
+        if (options?.poolId != null && (options.allowUnauthenticatedAccess != null || options.exposedPorts != null)) {
+          throw new SandboxError(
+            "allowUnauthenticatedAccess and exposedPorts cannot be combined with poolId: pool claims inherit access settings from the pool."
+          );
+        }
         const opStart = nowMs();
         const requestTimeout = options?.requestTimeout ?? options?.startupTimeout ?? this.requestTimeoutMs / 1e3;
         const requestClient = this.withRequestTimeout(requestTimeout);
@@ -5498,6 +5537,9 @@ var init_client = __esm({
         const requestedName = options?.poolId != null ? null : options?.name ?? null;
         const createStart = nowMs();
         let result;
+        if (options?.poolId != null && options.autoResume != null) {
+          throw new SandboxError("autoResume cannot be set when claiming from a pool");
+        }
         if (options?.poolId != null) {
           result = await requestClient.claim(options.poolId, {
             fileSystems: options.fileSystems