eve 0.36.0 → 0.37.0

package/dist/src/compiled/@vercel/sandbox-stable/api-client/with-retry.d.ts

@@ -0,0 +1,10 @@
+import { Options } from "../_async-retry.js";
+
+//#region src/api-client/with-retry.d.ts
+interface RequestOptions {
+  onRetry?(error: any, options: RequestOptions): void;
+  retry?: Partial<Options>;
+}
+//#endregion
+export { RequestOptions };
+//# sourceMappingURL=with-retry.d.ts.map

package/dist/src/compiled/@vercel/sandbox-stable/auth/error.d.ts

@@ -0,0 +1,15 @@
+//#region src/auth/error.d.ts
+declare class NotOk extends Error {
+  name: string;
+  response: {
+    statusCode: number;
+    responseText: string;
+  };
+  constructor(response: {
+    statusCode: number;
+    responseText: string;
+  });
+}
+//#endregion
+export { NotOk };
+//# sourceMappingURL=error.d.ts.map

package/dist/src/compiled/@vercel/sandbox-stable/auth/file.d.ts

@@ -0,0 +1,18 @@
+import { z } from "#compiled/zod/index.js";
+
+//#region src/auth/file.d.ts
+declare const AuthFile: z.ZodObject<{
+  token: z.ZodOptional<z.ZodString>;
+  refreshToken: z.ZodOptional<z.ZodString>;
+  expiresAt: z.ZodOptional<z.ZodPipe<z.ZodNumber, z.ZodTransform<Date, number>>>;
+}, z.core.$strip>;
+type AuthFile = z.infer<typeof AuthFile>;
+declare const getAuth: () => {
+  token?: string | undefined;
+  refreshToken?: string | undefined;
+  expiresAt?: Date | undefined;
+} | null;
+declare function updateAuthConfig(config: AuthFile): void;
+//#endregion
+export { getAuth, updateAuthConfig };
+//# sourceMappingURL=file.d.ts.map

package/dist/src/compiled/@vercel/sandbox-stable/auth/index.d.ts

@@ -0,0 +1,6 @@
+import { getAuth, updateAuthConfig } from "./file.js";
+import { DeviceAuthorizationRequest, OAuth, isOAuthError } from "./oauth.js";
+import { pollForToken } from "./poll-for-token.js";
+import { inferScope } from "./project.js";
+import { NotOk } from "./error.js";
+export { DeviceAuthorizationRequest, NotOk, OAuth, getAuth, inferScope, isOAuthError, pollForToken, updateAuthConfig };

package/dist/src/compiled/@vercel/sandbox-stable/auth/oauth.d.ts

@@ -0,0 +1,111 @@
+import { z } from "#compiled/zod/index.js";
+
+//#region src/auth/oauth.d.ts
+declare const IntrospectionResponse: z.ZodUnion<[z.ZodObject<{
+  active: z.ZodLiteral<true>;
+  client_id: z.ZodString;
+  session_id: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+  active: z.ZodLiteral<false>;
+}, z.core.$strip>]>;
+declare function OAuth(): Promise<{
+  /**
+   * Perform the Device Authorization Request
+   *
+   * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
+   * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+   */
+  deviceAuthorizationRequest(): Promise<DeviceAuthorizationRequest>;
+  /**
+   * Perform the Device Access Token Request
+   *
+   * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
+   */
+  deviceAccessTokenRequest(device_code: string): Promise<[Error] | [null, Response]>;
+  /**
+   * Process the Token request Response
+   *
+   * @see https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+   */
+  processTokenResponse(response: Response): Promise<[OAuthError] | [null, TokenSet]>;
+  /**
+   * Perform a Token Revocation Request.
+   *
+   * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1
+   * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.2
+   */
+  revokeToken(token: string): Promise<OAuthError | void>;
+  /**
+   * Perform Refresh Token Request.
+   *
+   * @see https://datatracker.ietf.org/doc/html/rfc6749#section-6
+   */
+  refreshToken(token: string): Promise<TokenSet>;
+  /**
+   * Perform Token Introspection Request.
+   *
+   * @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.1
+   */
+  introspectToken(token: string): Promise<z.infer<typeof IntrospectionResponse>>;
+}>;
+type OAuth = Awaited<ReturnType<typeof OAuth>>;
+declare const TokenSet: z.ZodObject<{
+  access_token: z.ZodString;
+  token_type: z.ZodLiteral<"Bearer">;
+  expires_in: z.ZodNumber;
+  refresh_token: z.ZodOptional<z.ZodString>;
+  scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type TokenSet = z.infer<typeof TokenSet>;
+declare const OAuthErrorResponse: z.ZodObject<{
+  error: z.ZodEnum<{
+    invalid_request: "invalid_request";
+    invalid_client: "invalid_client";
+    invalid_grant: "invalid_grant";
+    unauthorized_client: "unauthorized_client";
+    unsupported_grant_type: "unsupported_grant_type";
+    invalid_scope: "invalid_scope";
+    server_error: "server_error";
+    authorization_pending: "authorization_pending";
+    slow_down: "slow_down";
+    access_denied: "access_denied";
+    expired_token: "expired_token";
+    unsupported_token_type: "unsupported_token_type";
+  }>;
+  error_description: z.ZodOptional<z.ZodString>;
+  error_uri: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type OAuthErrorResponse = z.infer<typeof OAuthErrorResponse>;
+declare class OAuthError extends Error {
+  name: string;
+  code: OAuthErrorResponse["error"];
+  cause: Error;
+  constructor(message: string, response: unknown);
+}
+declare function isOAuthError(error: unknown): error is OAuthError;
+interface DeviceAuthorizationRequest {
+  /** The device verification code. */
+  device_code: string;
+  /** The end-user verification code. */
+  user_code: string;
+  /**
+   * The minimum amount of time in seconds that the client
+   * SHOULD wait between polling requests to the token endpoint.
+   */
+  interval: number;
+  /** The end-user verification URI on the authorization server. */
+  verification_uri: string;
+  /**
+   * The end-user verification URI on the authorization server,
+   * including the `user_code`, without redirection.
+   */
+  verification_uri_complete: string;
+  /**
+   * The absolute lifetime of the `device_code` and `user_code`.
+   * Calculated from `expires_in`.
+   */
+  expiresAt: number;
+}
+//#endregion
+export { DeviceAuthorizationRequest, OAuth, isOAuthError };
+//# sourceMappingURL=oauth.d.ts.map

package/dist/src/compiled/@vercel/sandbox-stable/auth/poll-for-token.d.ts

@@ -0,0 +1,28 @@
+import { DeviceAuthorizationRequest, OAuth } from "./oauth.js";
+
+//#region src/auth/poll-for-token.d.ts
+type PollTokenItem = {
+  _tag: "Timeout";
+  newInterval: number;
+} | {
+  _tag: "SlowDown";
+  newInterval: number;
+} | {
+  _tag: "Error";
+  error: Error;
+} | {
+  _tag: "Response";
+  response: {
+    text(): Promise<string>;
+  };
+};
+declare function pollForToken({
+  request,
+  oauth
+}: {
+  request: DeviceAuthorizationRequest;
+  oauth: OAuth;
+}): AsyncGenerator<PollTokenItem, void, void>;
+//#endregion
+export { pollForToken };
+//# sourceMappingURL=poll-for-token.d.ts.map

package/dist/src/compiled/@vercel/sandbox-stable/auth/project.d.ts

@@ -0,0 +1,40 @@
+//#region src/auth/project.d.ts
+/**
+ * Resolves the team and project scope for sandbox operations.
+ *
+ * First checks for a locally linked project in `.vercel/project.json`.
+ * If found, uses the `projectId` and `orgId` from there.
+ *
+ * Otherwise, if `teamId` is not provided, builds an ordered list of candidate
+ * teams to try: the user's `defaultTeamId` first (if set), then hobby-plan
+ * teams where the user has an OWNER role (preferring the personal team matching
+ * the username, then the most recently updated). Tries each candidate until one
+ * succeeds.
+ *
+ * @param opts.token - Vercel API authentication token.
+ * @param opts.teamId - Optional team slug. If omitted, candidate teams are resolved automatically.
+ * @param opts.cwd - Optional directory to search for `.vercel/project.json`. Defaults to `process.cwd()`.
+ * @returns The resolved scope with `projectId`, `teamId`, and whether the project was `created`.
+ *
+ * @throws {NotOk} If the API returns an error other than 404 when checking the project.
+ *
+ * @example
+ * ```ts
+ * const scope = await inferScope({ token: "vercel_..." });
+ * // => { projectId: "vercel-sandbox-default-project", teamId: "my-team", created: false }
+ * ```
+ */
+declare function inferScope(opts: {
+  token: string;
+  teamId?: string;
+  cwd?: string;
+}): Promise<{
+  projectId: string;
+  teamId: string;
+  created: boolean;
+  teamSlug?: string;
+  projectSlug?: string;
+}>;
+//#endregion
+export { inferScope };
+//# sourceMappingURL=project.d.ts.map

package/dist/src/compiled/@vercel/sandbox-stable/command.d.ts

@@ -0,0 +1,292 @@
+import { CommandData, LogOutputLine } from "./api-client/validators.js";
+import { APIClient } from "./api-client/api-client.js";
+import "./api-client/index.js";
+import { Signal } from "./utils/resolveSignal.js";
+import { WORKFLOW_DESERIALIZE, WORKFLOW_SERIALIZE } from "./_workflow-serde.js";
+
+//#region src/command.d.ts
+/**
+ * Cached output from a command execution.
+ */
+interface CommandOutput {
+  stdout: string;
+  stderr: string;
+}
+/**
+ * Serialized representation of a Command for @workflow/serde.
+ */
+interface SerializedCommand {
+  sandboxId: string;
+  cmd: CommandData;
+  /** Cached output, included if output was fetched before serialization */
+  output?: CommandOutput;
+}
+/**
+ * Serialized representation of a CommandFinished for @workflow/serde.
+ */
+interface SerializedCommandFinished extends SerializedCommand {
+  exitCode: number;
+  durationMs?: number;
+}
+/**
+ * A command executed in a Sandbox.
+ *
+ * For detached commands, you can {@link wait} to get a {@link CommandFinished} instance
+ * with the populated exit code. For non-detached commands, {@link Sandbox.runCommand}
+ * automatically waits and returns a {@link CommandFinished} instance.
+ *
+ * You can iterate over command output with {@link logs}.
+ *
+ * @see {@link Sandbox.runCommand} to start a command.
+ *
+ * @hideconstructor
+ */
+declare class Command {
+  /**
+   * Cached API client instance.
+   * @internal
+   */
+  protected _client: APIClient | null;
+  /**
+   * Lazily resolve credentials and construct an API client.
+   * @internal
+   */
+  protected ensureClient(): Promise<APIClient>;
+  /**
+   * ID of the session this command is running in.
+   */
+  protected sessionId: string;
+  /**
+   * Data for the command execution.
+   */
+  protected cmd: CommandData;
+  exitCode: number | null;
+  durationMs?: number;
+  protected outputCache: Promise<{
+    stdout: string;
+    stderr: string;
+    both: string;
+  }> | null;
+  /**
+   * Synchronously accessible resolved output, populated after output is fetched.
+   * Used for serialization.
+   * @internal
+   */
+  protected _resolvedOutput: CommandOutput | null;
+  /**
+   * ID of the command execution.
+   */
+  get cmdId(): string;
+  get cwd(): string;
+  get startedAt(): number;
+  /**
+   * @param params - Object containing the client, sandbox ID, and command data.
+   * @param params.client - Optional API client. If not provided, will be lazily created using global credentials.
+   * @param params.sessionId - The ID of the session where the command is running.
+   * @param params.cmd - The command data.
+   * @param params.output - Optional cached output to restore (used during deserialization).
+   */
+  constructor({
+    client,
+    sessionId,
+    cmd,
+    output
+  }: {
+    client?: APIClient;
+    sessionId: string;
+    cmd: CommandData;
+    output?: CommandOutput;
+  });
+  /**
+   * Serialize a Command instance to plain data for @workflow/serde.
+   *
+   * @param instance - The Command instance to serialize
+   * @returns A plain object containing the sandbox ID, command data, and output if fetched
+   */
+  static [WORKFLOW_SERIALIZE](instance: Command): SerializedCommand;
+  /**
+   * Deserialize plain data back into a Command instance for @workflow/serde.
+   *
+   * The deserialized instance will lazily create an API client using
+   * OIDC or environment credentials when needed.
+   *
+   * @param data - The serialized command data
+   * @returns The reconstructed Command instance
+   */
+  static [WORKFLOW_DESERIALIZE](data: SerializedCommand): Command;
+  /**
+   * Iterate over the output of this command.
+   *
+   * ```
+   * for await (const log of cmd.logs()) {
+   *   if (log.stream === "stdout") {
+   *     process.stdout.write(log.data);
+   *   } else {
+   *     process.stderr.write(log.data);
+   *   }
+   * }
+   * ```
+   *
+   * @param opts - Optional parameters.
+   * @param opts.signal - An AbortSignal to cancel log streaming.
+   * @returns An async iterable of log entries from the command output.
+   *
+   * @see {@link Command.stdout}, {@link Command.stderr}, and {@link Command.output}
+   * to access output as a string.
+   */
+  logs(opts?: {
+    signal?: AbortSignal;
+  }): AsyncGenerator<LogOutputLine, void, void> & Disposable & {
+    close(): void;
+  };
+  /**
+   * Wait for a command to exit and populate its exit code.
+   *
+   * This method is useful for detached commands where you need to wait
+   * for completion. For non-detached commands, {@link Sandbox.runCommand}
+   * automatically waits and returns a {@link CommandFinished} instance.
+   *
+   * ```
+   * const detachedCmd = await sandbox.runCommand({ cmd: 'sleep', args: ['5'], detached: true });
+   * const result = await detachedCmd.wait();
+   * if (result.exitCode !== 0) {
+   *   console.error("Something went wrong...")
+   * }
+   * ```
+   *
+   * @param params - Optional parameters.
+   * @param params.signal - An AbortSignal to cancel waiting.
+   * @returns A {@link CommandFinished} instance with populated exit code.
+   */
+  wait(params?: {
+    signal?: AbortSignal;
+  }): Promise<CommandFinished>;
+  /**
+   * Get cached output, fetching logs only once and reusing for concurrent calls.
+   * This prevents race conditions when stdout() and stderr() are called in parallel.
+   */
+  protected getCachedOutput(opts?: {
+    signal?: AbortSignal;
+  }): Promise<{
+    stdout: string;
+    stderr: string;
+    both: string;
+  }>;
+  /**
+   * Get the output of `stdout`, `stderr`, or both as a string.
+   *
+   * NOTE: This may throw string conversion errors if the command does
+   * not output valid Unicode.
+   *
+   * @param stream - The output stream to read: "stdout", "stderr", or "both".
+   * @param opts - Optional parameters.
+   * @param opts.signal - An AbortSignal to cancel output streaming.
+   * @returns The output of the specified stream(s) as a string.
+   */
+  output(stream?: "stdout" | "stderr" | "both", opts?: {
+    signal?: AbortSignal;
+  }): Promise<string>;
+  /**
+   * Get the output of `stdout` as a string.
+   *
+   * NOTE: This may throw string conversion errors if the command does
+   * not output valid Unicode.
+   *
+   * @param opts - Optional parameters.
+   * @param opts.signal - An AbortSignal to cancel output streaming.
+   * @returns The standard output of the command.
+   */
+  stdout(opts?: {
+    signal?: AbortSignal;
+  }): Promise<string>;
+  /**
+   * Get the output of `stderr` as a string.
+   *
+   * NOTE: This may throw string conversion errors if the command does
+   * not output valid Unicode.
+   *
+   * @param opts - Optional parameters.
+   * @param opts.signal - An AbortSignal to cancel output streaming.
+   * @returns The standard error output of the command.
+   */
+  stderr(opts?: {
+    signal?: AbortSignal;
+  }): Promise<string>;
+  /**
+   * Kill a running command in a sandbox.
+   *
+   * @param signal - The signal to send the running process. Defaults to SIGTERM.
+   * @param opts - Optional parameters.
+   * @param opts.abortSignal - An AbortSignal to cancel the kill operation.
+   * @returns Promise<void>.
+   */
+  kill(signal?: Signal, opts?: {
+    abortSignal?: AbortSignal;
+  }): Promise<void>;
+}
+/**
+ * A command that has finished executing.
+ *
+ * The exit code is immediately available and populated upon creation.
+ * Unlike {@link Command}, you don't need to call wait() - the command
+ * has already completed execution.
+ *
+ * @hideconstructor
+ */
+declare class CommandFinished extends Command {
+  /**
+   * The exit code of the command. This is always populated for
+   * CommandFinished instances.
+   */
+  exitCode: number;
+  /**
+   * The duration of the command execution in milliseconds.
+   */
+  durationMs?: number;
+  /**
+   * @param params - Object containing client, sandbox ID, command data, and exit code.
+   * @param params.client - Optional API client. If not provided, will be lazily created using global credentials.
+   * @param params.sessionId - The ID of the session where the command ran.
+   * @param params.cmd - The command data.
+   * @param params.exitCode - The exit code of the completed command.
+   * @param params.durationMs - Optional duration of the command execution in milliseconds.
+   * @param params.output - Optional cached output to restore (used during deserialization).
+   */
+  constructor(params: {
+    client?: APIClient;
+    sessionId: string;
+    cmd: CommandData;
+    exitCode: number;
+    durationMs?: number;
+    output?: CommandOutput;
+  });
+  /**
+   * Serialize a CommandFinished instance to plain data for @workflow/serde.
+   *
+   * @param instance - The CommandFinished instance to serialize
+   * @returns A plain object containing the sandbox ID, command data, exit code, and output if fetched
+   */
+  static [WORKFLOW_SERIALIZE](instance: CommandFinished): SerializedCommandFinished;
+  /**
+   * Deserialize plain data back into a CommandFinished instance for @workflow/serde.
+   *
+   * The deserialized instance will lazily create an API client using
+   * OIDC or environment credentials when needed.
+   *
+   * @param data - The serialized command finished data
+   * @returns The reconstructed CommandFinished instance
+   */
+  static [WORKFLOW_DESERIALIZE](data: SerializedCommandFinished): CommandFinished;
+  /**
+   * The wait method is not needed for CommandFinished instances since
+   * the command has already completed and exitCode is populated.
+   *
+   * @deprecated This method is redundant for CommandFinished instances.
+   * The exitCode is already available.
+   * @returns This CommandFinished instance.
+   */
+  wait(): Promise<CommandFinished>;
+}
+//#endregion
+export { Command, CommandFinished, CommandOutput, SerializedCommand, SerializedCommandFinished };
+//# sourceMappingURL=command.d.ts.map

package/dist/src/compiled/@vercel/sandbox-stable/constants.d.ts

@@ -0,0 +1,5 @@
+//#region src/constants.d.ts
+type RUNTIMES = "node26" | "node24" | "node22" | "python3.13";
+//#endregion
+export { RUNTIMES };
+//# sourceMappingURL=constants.d.ts.map

package/dist/src/compiled/@vercel/sandbox-stable/execution-context.d.ts

@@ -0,0 +1,116 @@
+import { Command, CommandFinished } from "./command.js";
+import { RunCommandParams } from "./session.js";
+
+//#region src/execution-context.d.ts
+
+/**
+ * The common surface for running commands and performing file operations in
+ * a sandbox, regardless of scope.
+ *
+ * Implemented by {@link Sandbox}, {@link Session}, and {@link SandboxUser},
+ * so code can be written against "somewhere to run commands" without caring
+ * whether it targets the whole sandbox or a specific user's context.
+ *
+ * Implementations may scope the operations: for example, {@link SandboxUser}
+ * runs commands as its user and resolves relative paths against the user's
+ * home directory.
+ */
+interface ExecutionContext {
+  /**
+   * Start executing a command in this context.
+   *
+   * @param command - The command to execute.
+   * @param args - Arguments to pass to the command.
+   * @param opts - Optional parameters.
+   * @returns A {@link CommandFinished} result once execution is done.
+   */
+  runCommand(command: string, args?: string[], opts?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+  }): Promise<CommandFinished>;
+  /**
+   * Start executing a command in this context in detached mode.
+   *
+   * @param params - The command parameters.
+   * @returns A {@link Command} instance for the running command.
+   */
+  runCommand(params: RunCommandParams & {
+    detached: true;
+  }): Promise<Command>;
+  /**
+   * Start executing a command in this context.
+   *
+   * @param params - The command parameters.
+   * @returns A {@link CommandFinished} result once execution is done.
+   */
+  runCommand(params: RunCommandParams): Promise<CommandFinished>;
+  /**
+   * Create a directory in the filesystem of this context.
+   *
+   * @param path - Path of the directory to create
+   * @param opts - Optional parameters.
+   */
+  mkDir(path: string, opts?: {
+    signal?: AbortSignal;
+  }): Promise<void>;
+  /**
+   * Read a file from this context as a stream.
+   *
+   * @param file - File to read, with path and optional cwd
+   * @param opts - Optional parameters.
+   * @returns A ReadableStream of the file contents, or null if not found
+   */
+  readFile(file: {
+    path: string;
+    cwd?: string;
+  }, opts?: {
+    signal?: AbortSignal;
+  }): Promise<NodeJS.ReadableStream | null>;
+  /**
+   * Read a file from this context as a Buffer.
+   *
+   * @param file - File to read, with path and optional cwd
+   * @param opts - Optional parameters.
+   * @returns The file contents as a Buffer, or null if not found
+   */
+  readFileToBuffer(file: {
+    path: string;
+    cwd?: string;
+  }, opts?: {
+    signal?: AbortSignal;
+  }): Promise<Buffer | null>;
+  /**
+   * Download a file from this context to the local filesystem.
+   *
+   * @param src - Source file in the sandbox
+   * @param dst - Destination on the local machine
+   * @param opts - Optional parameters.
+   * @returns The absolute path to the written file, or null if not found
+   */
+  downloadFile(src: {
+    path: string;
+    cwd?: string;
+  }, dst: {
+    path: string;
+    cwd?: string;
+  }, opts?: {
+    mkdirRecursive?: boolean;
+    signal?: AbortSignal;
+  }): Promise<string | null>;
+  /**
+   * Write files to the filesystem of this context.
+   *
+   * @param files - Array of files with path, content, and optional mode
+   * @param opts - Optional parameters.
+   */
+  writeFiles(files: {
+    path: string;
+    content: string | Uint8Array;
+    mode?: number;
+  }[], opts?: {
+    signal?: AbortSignal;
+  }): Promise<void>;
+}
+//#endregion
+export { ExecutionContext };
+//# sourceMappingURL=execution-context.d.ts.map