@veris-ai/daytona 0.2.1 → 0.3.0

package/dist/veris-api.d.ts

@@ -1,3 +1,5 @@
+import type { ReceiptBaseline } from './run-receipt';
+import type { ControlOptions, ControlResource } from './service-control';
 import type { Sandbox } from '@daytona/sdk';
 import type { ControlPlane, ServiceInfo } from './control-plane';
 import type { Receipt, ReceiptEntry } from './receipt';
@@ -13,6 +15,13 @@ export interface VerisContext {
     canaryHost: string;
     /** Whether this twin is owned (delete removes it) or attached (caller owns it). */
     ownsTwin: boolean;
+    /** Newest request id per service when this run began, so a receipt counts
+     *  what the run caused rather than what an attached twin already held. Set by
+     *  create(); a sandbox rehydrated by get() has none and reads the log from
+     *  the start, as the receipt always did. Not persisted in a label on
+     *  purpose — the sandbox can rewrite its own labels, and a watermark it
+     *  chose would let it hide its own traffic from the receipt. */
+    watermarks?: Record<string, number>;
 }
 /** Narrow assertTouched to specific requests. All fields AND together. */
 export interface TouchMatcher {
@@ -23,17 +32,32 @@ export interface TouchMatcher {
     minRequests?: number;
 }
 export interface VerisApi {
+    /** Whether provider teardown owns this twin. */
+    readonly ownsTwin: boolean;
     /** The Veris twin's sandbox id — NOT the Daytona sandbox id. */
     readonly sandboxId: string;
+    /** The Veris environment the twin was deployed from. Every control-plane
+     *  route that acts on a twin is scoped to it, so a caller that wants to talk
+     *  to the twin itself needs it and has nowhere else to read it from. */
+    readonly environmentId: string;
     readonly mode: 'gateway';
     services(): Promise<ServiceInfo[]>;
     /** The service's own manual: what it models and how its data is shaped. */
     manual(service: string): Promise<string>;
+    receiptBaseline(): Promise<ReceiptBaseline>;
+    receiptSince(baseline: ReceiptBaseline, service?: string): Promise<Receipt>;
+    control(service: string, resource: ControlResource, options?: ControlOptions): Promise<unknown>;
     receipt(): Promise<Receipt>;
     receipt(service: string): Promise<ReceiptEntry>;
     assertTouched(service: string, match?: TouchMatcher): Promise<void>;
     getDataPlaneEnv(): Promise<Record<string, string>>;
     getTrustEnv(): Record<string, string>;
+    /** The same trust variables as a shell `export` prelude, for a caller that
+     *  can only prefix a command line. */
+    trustPrelude(): string;
+    /** Append the Veris CA to the CA bundles SDKs ship with them. Run it after
+     *  installing dependencies; returns the files it changed. */
+    patchBundledCas(): Promise<string[]>;
     deliverTo(port: number, opts?: DeliverToOpts): Promise<string>;
     deliverTo(url: string | null, opts?: DeliverToOpts): Promise<string | null>;
 }
@@ -45,7 +69,9 @@ export interface DeliverToOpts {
 export declare class VerisApiImpl implements VerisApi {
     private readonly ctx;
     constructor(ctx: VerisContext);
+    get ownsTwin(): boolean;
     get sandboxId(): string;
+    get environmentId(): string;
     get mode(): 'gateway';
     services(): Promise<ServiceInfo[]>;
     /** Resolve a service by name. A typo and a service that exists but saw
@@ -60,10 +86,42 @@ export declare class VerisApiImpl implements VerisApi {
      * ride around it — named rather than rounded off.
      */
     private leaks;
+    /** Where this service's log was when the run began. 0 reads all of it. */
+    private watermark;
+    private verifyIntegrity;
+    receiptBaseline(): Promise<ReceiptBaseline>;
+    receiptSince(baseline: ReceiptBaseline, service?: string): Promise<Receipt>;
+    control(service: string, resource: ControlResource, options?: ControlOptions): Promise<unknown>;
     assertTouched(service: string, match?: TouchMatcher): Promise<void>;
     getDataPlaneEnv(): Promise<Record<string, string>>;
     /** The CA trust vars injected at create, for callers building their own env. */
     getTrustEnv(): Record<string, string>;
+    /**
+     * The same variables as a shell prelude, for a caller that has no env map to
+     * fill — anything running a command through a session or a shell it did not
+     * build the environment for. Daytona resets SSL_CERT_FILE,
+     * REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE and NODE_EXTRA_CA_CERTS to its own CA
+     * file inside the sandbox, and that file cannot verify the gateway's leaf, so
+     * a command that inherits them fails on certificate validation:
+     * `uv sync` dies with "invalid peer certificate: UnknownIssuer".
+     *
+     *   sbx.process.executeCommand(`${sbx.veris.trustPrelude()} uv sync`)
+     */
+    trustPrelude(): string;
+    /**
+     * Append the Veris CA to the CA bundles the code under test's own SDKs ship.
+     *
+     * The variables above reach every client that reads one. stripe-python does
+     * not: it passes `verify=stripe.ca_bundle_path`, so the first Stripe call
+     * fails with "Could not verify Stripe's SSL certificate" in a sandbox where
+     * curl, Node and `requests` all succeed. This patches the file itself, which
+     * is the Daytona-shaped version of the veris CLI's --patch-bundled-cas.
+     *
+     * Call it AFTER installing dependencies — the bundles arrive with them, so
+     * there is nothing to patch at create time. Safe to call again; it returns
+     * only the files it actually changed.
+     */
+    patchBundledCas(): Promise<string[]>;
     /**
      * Point every mocked vendor's callbacks/webhooks at this sandbox.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@veris-ai/daytona",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Veris twin interception for Daytona: a drop-in @daytona/sdk whose sandboxes come up with a Veris twin already answering their vendor API calls. Unmodified code, real hostnames, receipts.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -13,6 +13,9 @@
       "require": "./dist/index.cjs"
     }
   },
+  "bin": {
+    "veris-daytona": "./dist/cli.js"
+  },
   "sideEffects": false,
   "files": [
     "dist",
@@ -28,6 +31,9 @@
     "prepublishOnly": "npm run build",
     "dev": "tsup --watch"
   },
+  "dependencies": {
+    "yaml": "^2.9.0"
+  },
   "peerDependencies": {
     "@daytona/sdk": ">=0.204.1 <1"
   },