withruntime 0.11.1 → 0.12.0

package/dist/e2b/unsupported.d.ts

@@ -17,3 +17,22 @@ export declare const waitForFile: Unsupported;
 export declare const waitForTimeout: Unsupported;
 export declare const Volume: Unsupported;
 export declare const Secret: Unsupported;
+export declare const SecretPaginator: Unsupported;
+export declare const Git: Unsupported;
+export declare const ReadyCmd: Unsupported;
+export declare const LogEntry: Unsupported;
+export declare const LogEntryStart: Unsupported;
+export declare const LogEntryEnd: Unsupported;
+export declare const defaultBuildLogger: Unsupported;
+export declare const ConnectionConfig: Unsupported;
+export declare const ApiClient: Unsupported;
+export declare const getSignature: Unsupported;
+/** E2B's "every address" network selector, as E2B defines it. */
+export declare const ALL_TRAFFIC = "0.0.0.0/0";
+/** E2B's volume entry types, as E2B defines them. */
+export declare enum VolumeFileType {
+    UNKNOWN = "unknown",
+    FILE = "file",
+    DIRECTORY = "directory",
+    SYMLINK = "symlink"
+}

package/dist/e2b/unsupported.js

@@ -15,7 +15,7 @@ export function unsupportedExport(name, alternative) {
         },
     });
 }
-const TEMPLATES = "Build a Runtime image instead: `npx withruntime image build --dockerfile e2b.Dockerfile --name <template>` or runtime.images.build({ name, dockerfile | recipe }), then Sandbox.create('<template>').";
+const TEMPLATES = "Build a Runtime image instead: `npx withruntime images build --dockerfile e2b.Dockerfile --name <template>` or runtime.images.build({ name, dockerfile | recipe }), then Sandbox.create('<template>').";
 export const Template = unsupportedExport("Template builder", TEMPLATES);
 export const TemplateBase = unsupportedExport("TemplateBase", TEMPLATES);
 export const waitForPort = unsupportedExport("waitForPort (a template ready check)", TEMPLATES);
@@ -25,3 +25,24 @@ export const waitForFile = unsupportedExport("waitForFile (a template ready chec
 export const waitForTimeout = unsupportedExport("waitForTimeout (a template ready check)", TEMPLATES);
 export const Volume = unsupportedExport("Volume", "Use runtime.volumes (Runtime volumes) and mount one with runtime: { create: { volumes: [{ volumeId, path }] } }.");
 export const Secret = unsupportedExport("Secret", "Use a Runtime secret: `npx withruntime secrets set NAME --host api.example.com`. The sandbox sees a placeholder, and the egress proxy adds the value on HTTPS to that host.");
+export const SecretPaginator = unsupportedExport("SecretPaginator", "List Runtime secrets with `npx withruntime secrets ls` or runtime.secrets.list().");
+export const Git = unsupportedExport("git module (deprecated by E2B too)", "Run git with sandbox.commands.run('git ...'); git is installed.");
+export const ReadyCmd = unsupportedExport("ReadyCmd (a template ready check)", TEMPLATES);
+export const LogEntry = unsupportedExport("LogEntry (template build logs)", TEMPLATES);
+export const LogEntryStart = unsupportedExport("LogEntryStart (template build logs)", TEMPLATES);
+export const LogEntryEnd = unsupportedExport("LogEntryEnd (template build logs)", TEMPLATES);
+export const defaultBuildLogger = unsupportedExport("defaultBuildLogger (template build logs)", TEMPLATES);
+const ENDPOINTS = "This package talks only to Runtime's API through the sandbox's own methods; sandbox.runtime is the Runtime sandbox underneath.";
+export const ConnectionConfig = unsupportedExport("ConnectionConfig", ENDPOINTS);
+export const ApiClient = unsupportedExport("ApiClient (E2B's REST client)", ENDPOINTS);
+export const getSignature = unsupportedExport("getSignature (signed file URLs)", "Use sandbox.files.read and sandbox.files.write.");
+/** E2B's "every address" network selector, as E2B defines it. */
+export const ALL_TRAFFIC = "0.0.0.0/0";
+/** E2B's volume entry types, as E2B defines them. */
+export var VolumeFileType;
+(function (VolumeFileType) {
+    VolumeFileType["UNKNOWN"] = "unknown";
+    VolumeFileType["FILE"] = "file";
+    VolumeFileType["DIRECTORY"] = "directory";
+    VolumeFileType["SYMLINK"] = "symlink";
+})(VolumeFileType || (VolumeFileType = {}));

package/dist/e2b/users.d.ts

@@ -9,6 +9,15 @@ export declare function runAs(ctx: SandboxContext, user: Username | undefined, o
 export declare function commandAs(user: string, script: string, cwdGiven: boolean): string[];
 /** An interactive login shell as `user`, for a PTY. */
 export declare function shellAs(user: string, cwdGiven: boolean): string[];
+/** A running command as E2B lists it, from the command line Runtime keeps
+ * (its words joined by spaces, at most 256 characters): `/bin/bash -l -c
+ * <script>` for a command, `/bin/bash -i -l` for a PTY, as E2B starts them,
+ * whether it runs as the sandbox user or through `commandAs`. Anything else,
+ * started outside this package, is its first word and the rest. */
+export declare function listedAs(command: string): {
+    cmd: string;
+    args: string[];
+};
 /** E2B's file calls as another Linux user: each one a short script run with
  * `sudo -u`, since Runtime's file API acts as the sandbox's own user. Output
  * streams, so a read of any size comes back whole. */

package/dist/e2b/users.js

@@ -62,6 +62,28 @@ export function commandAs(user, script, cwdGiven) {
 export function shellAs(user, cwdGiven) {
     return commandAs(user, "exec /bin/bash -i -l", cwdGiven);
 }
+/** A running command as E2B lists it, from the command line Runtime keeps
+ * (its words joined by spaces, at most 256 characters): `/bin/bash -l -c
+ * <script>` for a command, `/bin/bash -i -l` for a PTY, as E2B starts them,
+ * whether it runs as the sandbox user or through `commandAs`. Anything else,
+ * started outside this package, is its first word and the rest. */
+export function listedAs(command) {
+    const wrapped = AS_USER.exec(command);
+    if (wrapped) {
+        const inner = command.slice(wrapped[0].length);
+        if (inner === "exec /bin/bash -i -l")
+            return { cmd: "/bin/bash", args: ["-i", "-l"] };
+        return { cmd: "/bin/bash", args: ["-l", "-c", inner] };
+    }
+    if (command.startsWith("bash -c "))
+        return { cmd: "/bin/bash", args: ["-l", "-c", command.slice(8)] };
+    if (command === "/bin/bash -i -l")
+        return { cmd: "/bin/bash", args: ["-i", "-l"] };
+    const [cmd = "", ...args] = command.split(" ");
+    return { cmd, args };
+}
+/** What `commandAs` puts before the script, as the joined command line shows it. */
+const AS_USER = /^sudo -n -E -H -u [^ ]+ -- \/bin\/bash -c (?:cd ~ 2>\/dev\/null\n)?/;
 /** One `sh -c` script as `user`, with its arguments passed apart, never
  * pasted into the script. */
 function script(user, text, ...args) {

package/dist/errors.d.ts

@@ -13,8 +13,8 @@ export declare const DELIBERATE: ReadonlySet<string>;
  * minutes when it has none), however many retries it allows otherwise. */
 export declare const NOTHING_RAN: ReadonlySet<string>;
 /** Refusals of a create that clear when a sandbox stops or pauses, or a host
- * frees room: the trial's slots, an email domain's trial slots, the account's
- * quota and the region's capacity. `sandboxes.create` waits them out, retrying
+ * frees room: an account without credit's eight at once and its total, an
+ * email domain's, the account's quota and the region's capacity. `sandboxes.create` waits them out, retrying
  * with the same key and input, for up to `waitForCapacityMs`. */
 export declare const WAITS_FOR_ROOM: ReadonlySet<string>;
 export declare class RuntimeError extends Error {
@@ -38,8 +38,8 @@ export declare class RuntimeError extends Error {
         cause?: unknown;
     });
     /** Retrying this exact call (the SDK keeps the key) is safe and may work.
-     * True for no_capacity and trial_busy as well, which clear by themselves when
-     * a host frees room or a trial sandbox stops. `sandboxes.create` already
+     * True for no_capacity and no_credit_running_limit as well, which clear by themselves when
+     * a host frees room or a sandbox without credit stops. `sandboxes.create` already
      * waits for those (see `waitForCapacityMs`), so seeing one from a create
      * means the wait ran out or was switched off. */
     get retryable(): boolean;
@@ -68,7 +68,9 @@ export declare class AccountBlockedError extends RuntimeError {
  * same idempotencyKey (the SDK does, automatically) settles it safely. */
 export declare class ConnectionError extends RuntimeError {
 }
-/** Raised by exec({ check: true }) when a command exits non-zero. */
+/** Raised by exec({ check: true }) when a command exits non-zero. Its code
+ * is `out_of_memory` when the sandbox's out-of-memory killer ended it, with
+ * the result's message and hint. */
 export declare class CommandError extends RuntimeError {
     readonly exitCode: number | null;
     readonly stdout: string;
@@ -78,6 +80,13 @@ export declare class CommandError extends RuntimeError {
         stdout: string;
         stderr: string;
         timedOut?: boolean;
+        outOfMemory?: {
+            code: string;
+            message: string;
+            hint: string;
+        };
     });
+    /** The same command in the same sandbox runs out of memory again. */
+    get retryable(): boolean;
 }
 export declare function errorFor(status: number, body: unknown, idempotencyKey?: string): RuntimeError;

package/dist/errors.js

@@ -15,6 +15,7 @@ export const DELIBERATE = new Set([
     "secrets_unavailable",
     "identity_unavailable",
     "env_unavailable",
+    "resize_unavailable",
 ]);
 /** Refusals that guarantee nothing ran: a sandbox running as many commands
  * as it can (`guest_busy`), and the API's own limits, which answer before any
@@ -22,19 +23,22 @@ export const DELIBERATE = new Set([
  * safe, so the SDK does, with backoff, until the call's deadline (five
  * minutes when it has none), however many retries it allows otherwise. */
 export const NOTHING_RAN = new Set(["guest_busy", "busy", "rate_limited"]);
-/** Refusals that pass on their own: a host frees room, a trial slot frees. */
-const PASSING = new Set(["no_capacity", "trial_busy"]);
+/** Refusals that pass on their own: a host frees room, a sandbox of an
+ * account without credit stops. */
+const PASSING = new Set(["no_capacity", "no_credit_running_limit", "no_credit_total_limit"]);
 /** Refusals of a create that clear when a sandbox stops or pauses, or a host
- * frees room: the trial's slots, an email domain's trial slots, the account's
- * quota and the region's capacity. `sandboxes.create` waits them out, retrying
+ * frees room: an account without credit's eight at once and its total, an
+ * email domain's, the account's quota and the region's capacity. `sandboxes.create` waits them out, retrying
  * with the same key and input, for up to `waitForCapacityMs`. */
 export const WAITS_FOR_ROOM = new Set([
-    "trial_busy",
-    "trial_domain_limit",
-    "trial_capacity",
+    "no_credit_running_limit",
+    "no_credit_total_limit",
+    "no_credit_domain_limit",
+    "no_credit_capacity_full",
     "quota_exceeded",
     "no_capacity",
-    // A volume whose last sandbox is stopping: free within seconds.
+    // A volume whose last sandbox is stopping: free once the stop lets go of
+    // its disk, up to about a minute (measured 50 to 60 s, 6 October 2026).
     "volume_releasing",
 ]);
 export class RuntimeError extends Error {
@@ -63,14 +67,14 @@ export class RuntimeError extends Error {
             this.retryAfterMs = init.retryAfterMs;
     }
     /** Retrying this exact call (the SDK keeps the key) is safe and may work.
-     * True for no_capacity and trial_busy as well, which clear by themselves when
-     * a host frees room or a trial sandbox stops. `sandboxes.create` already
+     * True for no_capacity and no_credit_running_limit as well, which clear by themselves when
+     * a host frees room or a sandbox without credit stops. `sandboxes.create` already
      * waits for those (see `waitForCapacityMs`), so seeing one from a create
      * means the wait ran out or was switched off. */
     get retryable() {
         if (DELIBERATE.has(this.code))
             return false;
-        // A fork asking for more copies than the trial runs at once never fits.
+        // A fork asking for more copies than an account without credit runs at once never fits.
         if (PASSING.has(this.code))
             return this.details?.field !== "count";
         return [0, 429, 502, 503, 504].includes(this.status);
@@ -102,23 +106,33 @@ export class AccountBlockedError extends RuntimeError {
  * same idempotencyKey (the SDK does, automatically) settles it safely. */
 export class ConnectionError extends RuntimeError {
 }
-/** Raised by exec({ check: true }) when a command exits non-zero. */
+/** Raised by exec({ check: true }) when a command exits non-zero. Its code
+ * is `out_of_memory` when the sandbox's out-of-memory killer ended it, with
+ * the result's message and hint. */
 export class CommandError extends RuntimeError {
     exitCode;
     stdout;
     stderr;
     constructor(result) {
+        const memory = result.outOfMemory;
         super({
             message: result.timedOut
                 ? "Command timed out."
-                : `Command exited with ${result.exitCode}.${result.stderr ? ` ${result.stderr.trim().slice(-500)}` : ""}`,
-            code: result.timedOut ? "command_timeout" : "command_failed",
+                : memory
+                    ? `Command exited with ${result.exitCode}. ${memory.message}`
+                    : `Command exited with ${result.exitCode}.${result.stderr ? ` ${result.stderr.trim().slice(-500)}` : ""}`,
+            code: result.timedOut ? "command_timeout" : memory ? memory.code : "command_failed",
             status: 0,
+            ...(memory && !result.timedOut ? { hint: memory.hint } : {}),
         });
         this.exitCode = result.exitCode;
         this.stdout = result.stdout;
         this.stderr = result.stderr;
     }
+    /** The same command in the same sandbox runs out of memory again. */
+    get retryable() {
+        return this.code === "out_of_memory" ? false : super.retryable;
+    }
 }
 export function errorFor(status, body, idempotencyKey) {
     const error = body?.error ?? {};

package/dist/freestyle/index.d.ts

@@ -1,14 +1,105 @@
 import type { Runtime } from "../client.js";
-import type { Sandbox } from "../sandbox.js";
-import { CompatibilityError, type ClientOptions } from "../compat/core.js";
+import type { Sandbox, Terminal } from "../sandbox.js";
+import type { Snapshot } from "../snapshots.js";
+import { CompatibilityError, type ClientOptions, type Refused, type RefusedAsync } from "../compat/core.js";
 export { CompatibilityError };
 export type VmState = "starting" | "running" | "pausing" | "paused" | "stopped";
+export interface FreestyleErrorBody {
+    code: string;
+    message: string;
+}
+/** What every failed Runtime call becomes, as Freestyle throws it for a
+ * non-2xx response: `code` is Runtime's error code in upper case
+ * (`NOT_FOUND`), `status` its HTTP status, and `cause` the RuntimeError. */
+export declare class FreestyleApiError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly path?: string;
+    constructor(status: number, body: FreestyleErrorBody, path?: string);
+}
+export interface FreestyleConnectionError {
+    name?: string;
+    message?: string;
+    code?: string;
+    errno?: string | number;
+    syscall?: string;
+    address?: string;
+    port?: number;
+}
+/** What a call that got no answer from Runtime becomes, as Freestyle 0.2.17
+ * throws a failed fetch: a TypeError whose `cause` is the RuntimeError
+ * ConnectionError and whose `errors` carry it as one entry. */
+export declare class FreestyleTransportError extends TypeError {
+    readonly errors: FreestyleConnectionError[];
+    constructor(cause: unknown, errors: FreestyleConnectionError[]);
+    toJSON(): {
+        name: string;
+        message: string;
+        errors: FreestyleConnectionError[];
+    };
+}
+export declare class FirewallRuleValidationError extends Error {
+    readonly path: string;
+    constructor(path: string, message: string);
+}
+export declare class TlsRuleValidationError extends Error {
+    readonly path: string;
+    constructor(path: string, message: string);
+}
+export declare class TlsForwardAuthValidationError extends Error {
+    readonly path: string;
+    constructor(path: string, message: string);
+}
+export declare const FirewallNamespace: Refused;
+export declare const FirewallRulesNamespace: Refused;
+export declare const validateFirewallEndpoint: Refused;
+export declare const validateFirewallRule: Refused;
+export declare const validateFirewallSpec: Refused;
+export declare const TlsNamespace: Refused;
+export declare const TlsRulesNamespace: Refused;
+export declare const TlsForwardAuthNamespace: Refused;
+export declare const hasTlsIdentity: Refused;
+export declare const resolveTlsProtocol: Refused;
+export declare const validateTlsDomain: Refused;
+export declare const validateTlsEndpoint: Refused;
+export declare const validateTlsForwardAuth: Refused;
+export declare const validateTlsMailRoute: Refused;
+export declare const validateTlsRule: Refused;
+export declare const validateTlsSpec: Refused;
+export declare const TunnelsNamespace: Refused;
+export declare const VpcNamespace: Refused;
+export declare const Vpc: Refused;
+export declare const VpcTunnelNamespace: Refused;
+export type FirewallProtocol = "tcp" | "udp" | "icmp";
+export interface FirewallEndpoint {
+    vmId?: string;
+    vpcId?: string;
+    tunnelId?: string;
+    cidr?: string;
+    public?: true;
+    port?: number;
+    protocol?: FirewallProtocol;
+}
 export interface FirewallRule {
     action: "allow";
-    source: Record<string, never>;
-    destination: {
-        public: true;
-    };
+    source: FirewallEndpoint;
+    destination: FirewallEndpoint;
+    description?: string;
+}
+export interface FirewallRuleData {
+    id: string;
+    action: "allow";
+    source: FirewallEndpoint;
+    destination: FirewallEndpoint;
+    description?: string | null;
+    dependencies: {
+        kind: string;
+        id: string;
+        slug?: string | null;
+        displayName?: string | null;
+    }[];
+    createdAt: string;
+    updatedAt: string;
 }
 export interface CreateVmOptions {
     snapshotId?: string | null;
@@ -27,14 +118,42 @@ export interface ExecOptions {
     env?: Record<string, string>;
     stdin?: string;
 }
+export interface FreestyleOptions extends ClientOptions {
+    teamId?: string;
+    stackAccessToken?: string;
+    identityAccessToken?: string;
+}
 export declare class Freestyle {
     readonly vms: VmsNamespace;
-    constructor(options?: ClientOptions);
+    readonly fetch: RefusedAsync;
+    constructor(options?: FreestyleOptions);
+    get firewall(): never;
+    get tls(): never;
+    get tunnels(): never;
+    get vpc(): never;
 }
-export declare class VmsNamespace {
+export declare class VmSnapshotsNamespace {
     private readonly runtime;
-    readonly snapshots: {
-        get: (id: string) => Promise<{
+    constructor(runtime: Runtime);
+    /** A snapshot by id or by its slug (Runtime's snapshot name). */
+    resolve(id: string): Promise<Snapshot>;
+    get(snapshotId: string): Promise<{
+        id: string;
+        sourceVmId: string;
+        slug: string | null;
+        displayName: string | null;
+        public: boolean;
+        createdAt: string;
+        updatedAt: string;
+        ttlSeconds: number | null;
+    }>;
+    delete(snapshotId: string): Promise<void>;
+    list(options?: {
+        sourceVmId?: string;
+        limit?: number;
+        offset?: number;
+    }): Promise<{
+        snapshots: {
             id: string;
             sourceVmId: string;
             slug: string | null;
@@ -42,29 +161,31 @@ export declare class VmsNamespace {
             public: boolean;
             createdAt: string;
             updatedAt: string;
-            ttlSeconds: number;
-        }>;
-        delete: (id: string) => Promise<void>;
-        list: (options?: {
-            sourceVmId?: string;
-            limit?: number;
-            offset?: number;
-        }) => Promise<{
-            snapshots: {
-                id: string;
-                sourceVmId: string;
-                slug: string | null;
-                displayName: string | null;
-                public: boolean;
-                createdAt: string;
-                updatedAt: string;
-                ttlSeconds: number;
-            }[];
-            totalCount: number;
-        }>;
-    };
+            ttlSeconds: number | null;
+        }[];
+        totalCount: number;
+    }>;
+    /** Renames, relabels and re-times a snapshot: slug is its Runtime name,
+     * ttlSeconds whole days from now. */
+    update(snapshotId: string, options: {
+        slug?: string;
+        displayName?: string;
+        ttlSeconds?: number;
+    }): Promise<{
+        id: string;
+        sourceVmId: string;
+        slug: string | null;
+        displayName: string | null;
+        public: boolean;
+        createdAt: string;
+        updatedAt: string;
+        ttlSeconds: number | null;
+    }>;
+}
+export declare class VmsNamespace {
+    private readonly runtime;
+    readonly snapshots: VmSnapshotsNamespace;
     constructor(runtime: Runtime);
-    private resolveSnapshot;
     create(options: CreateVmOptions): Promise<{
         vm: Vm;
         vmId: string;
@@ -89,13 +210,15 @@ export declare class VmsNamespace {
         };
         firewallRules: {
             id: string;
+            action: "allow";
             source: {
                 vmId: string;
             };
-            action: "allow";
-            destination: {
-                public: true;
-            };
+            destination: FirewallEndpoint;
+            description: null;
+            dependencies: never[];
+            createdAt: string;
+            updatedAt: string;
         }[];
         tlsRules: never[];
     }>;
@@ -196,10 +319,118 @@ export declare class VmFilesystem {
         modified: string;
     }>;
 }
+export interface PtySessionInfo {
+    sessionId: number;
+    state: string;
+    createdUnix: number;
+    cols: number;
+    rows: number;
+    exitCode?: number | null;
+    linuxUser?: string | null;
+    slug?: string | null;
+}
+export interface PtyOpenOptions {
+    exec?: string;
+    cols?: number;
+    rows?: number;
+    linuxUser?: string;
+    slug?: string;
+}
+export type PtySessionSelector = number | string;
+export interface PtyAttachOptions {
+    session: PtySessionSelector;
+    linuxUser?: string;
+}
+export interface PtySessionEvents {
+    onData?: (data: Uint8Array) => void;
+    onExit?: (exitCode: number) => void;
+    onClose?: (info: {
+        wasClean: boolean;
+        code: number;
+        reason: string;
+    }) => void;
+    onError?: (err: unknown) => void;
+}
+/** A session's number: FNV-1a of its process id, 31 bits, never 0. */
+export declare function sessionNumber(processId: string): number;
+export declare class PtySession {
+    #private;
+    private readonly terminal;
+    private readonly sandbox;
+    private readonly processId;
+    readonly sessionId: number;
+    readonly slug: string | undefined;
+    readonly created: boolean;
+    constructor(terminal: Terminal, sandbox: Sandbox, processId: string, sessionId: number, slug: string | undefined, created: boolean, events: PtySessionEvents);
+    private readonly onError;
+    write(data: Uint8Array | string): void;
+    resize(options: {
+        cols: number;
+        rows: number;
+    }): void;
+    signal(sig: "sigint" | "sigkill"): void;
+    /** Closes the connection; the shell keeps running and attach() finds it. */
+    detach(): void;
+    get readyState(): number;
+}
+export declare class VmPty {
+    private readonly get;
+    constructor(get: () => Promise<Sandbox>);
+    private sessions;
+    private find;
+    private connect;
+    open(options?: PtyOpenOptions & PtySessionEvents): Promise<PtySession>;
+    attach(options: PtyAttachOptions & PtySessionEvents): Promise<PtySession>;
+    list(options?: {
+        linuxUser?: string;
+    }): Promise<{
+        sessions: PtySessionInfo[];
+    }>;
+    /** Ends a session's shell. An exited session stays in the list. */
+    close(session: PtySessionSelector, options?: {
+        linuxUser?: string;
+    }): Promise<{
+        sessionId: number;
+        exitCode: number | null | undefined;
+    } | {
+        sessionId: number;
+        exitCode?: undefined;
+    }>;
+}
+export declare class VmLinuxUserPty {
+    private readonly pty;
+    private readonly linuxUser;
+    constructor(pty: VmPty, linuxUser: string);
+    open(options?: Omit<PtyOpenOptions, "linuxUser"> & PtySessionEvents): Promise<PtySession>;
+    attach(options: Omit<PtyAttachOptions, "linuxUser"> & PtySessionEvents): Promise<PtySession>;
+    list(): Promise<{
+        sessions: PtySessionInfo[];
+    }>;
+    close(session: PtySessionSelector): Promise<{
+        sessionId: number;
+        exitCode: number | null | undefined;
+    } | {
+        sessionId: number;
+        exitCode?: undefined;
+    }>;
+}
+export declare class VmLinuxUser {
+    private readonly vm;
+    private readonly linuxUser;
+    readonly pty: VmLinuxUserPty;
+    constructor(vm: Vm, linuxUser: string);
+    exec(options: string | Omit<ExecOptions, "linuxUser">): Promise<{
+        stdout: string;
+        stderr: string;
+        statusCode: number | null;
+    }>;
+}
 export declare class Vm {
     private readonly runtime;
     readonly id: string;
     readonly fs: VmFilesystem;
+    readonly pty: VmPty;
+    readonly resize: RefusedAsync;
     constructor(runtime: Runtime, id: string);
     data(): Promise<{
         id: string;
@@ -259,6 +490,23 @@ export declare class Vm {
         updatedAt: string;
     }>;
     delete(): Promise<void>;
+    /** The VM's outbound rules, read back from its network settings. */
+    firewallRules(): Promise<{
+        rules: {
+            id: string;
+            action: "allow";
+            source: {
+                vmId: string;
+            };
+            destination: FirewallEndpoint;
+            description: null;
+            dependencies: never[];
+            createdAt: string;
+            updatedAt: string;
+        }[];
+        totalCount: number;
+    }>;
+    linuxUser(linuxUser: string): VmLinuxUser;
     update(options: {
         slug?: string;
         displayName?: string;
@@ -303,7 +551,7 @@ export declare class Vm {
             public: boolean;
             createdAt: string;
             updatedAt: string;
-            ttlSeconds: number;
+            ttlSeconds: number | null;
         };
     }>;
 }