withruntime 0.12.0 → 0.14.0

package/README.md

@@ -29,11 +29,11 @@ console.log(result.exitCode, result.stdout);
 `await using` deletes it when the block ends (Node 24, Bun or TypeScript; on
 Node 22 call `await sbx.delete()`), and `keep: true` stops it instead, keeping
 its disk. With no arguments you get the
-included usage, 100 hours of a 2 vCPU, 4 GB sandbox every month with no card (up to
-eight sandboxes running at once without credit), 2 vCPU, 4 GiB of
+free usage, with no card (up to
+four sandboxes running at once without credit), 2 vCPU, 4 GiB of
 memory and a 4 GiB disk. The current default image includes NumPy, pandas and
 matplotlib; see the [sandbox environment](https://withruntime.com/docs/sandbox-environment).
-The included usage is spent first, then prepaid credit, with nothing to
+The free usage is spent first, then prepaid credit, with nothing to
 choose; `funding` is accepted and ignored.
 
 The sandbox object does the rest:

package/README.src.md

@@ -31,11 +31,11 @@ console.log(result.exitCode, result.stdout);
 `await using` deletes it when the block ends (Node 24, Bun or TypeScript; on
 Node 22 call `await sbx.delete()`), and `keep: true` stops it instead, keeping
 its disk. With no arguments you get the
-included usage, {{included-machine}} every month with no card (up to
+free usage, with no card (up to
 {{trial-sandboxes}} sandboxes running at once without credit), 2 vCPU, 4 GiB of
 memory and a 4 GiB disk. The current default image includes NumPy, pandas and
 matplotlib; see the [sandbox environment](https://withruntime.com/docs/sandbox-environment).
-The included usage is spent first, then prepaid credit, with nothing to
+The free usage is spent first, then prepaid credit, with nothing to
 choose; `funding` is accepted and ignored.
 
 The sandbox object does the rest:

package/dist/billing-cli.js

@@ -184,7 +184,7 @@ async function walletCommand(verb, value, acceptTerms, wait, out, sleep, wallet)
     let payBy = null;
     if (verb === "topup") {
         if (!acceptTerms)
-            throw usage("Opening an account means agreeing to https://withruntime.com/legal/terms. Add --accept-terms once the person you work for agrees.");
+            throw usage("Opening an account means agreeing to https://withruntime.com/legal/terms. Add --accept-terms to agree to them for whoever you act for.");
         const opened = await wallet.open({ usd: dollarsOf(value), acceptTerms: true });
         code = opened.claimCode;
         payBy = opened.payBy;
@@ -224,11 +224,15 @@ async function walletCommand(verb, value, acceptTerms, wait, out, sleep, wallet)
                 : `The top-up ${claim.status}: nothing was credited. Open a new one with \`${me} billing topup <usd> --new-account --accept-terms\`.`);
             return 1;
         }
-        if (!wait || Date.now() >= until) {
+        // A top-up that never reached Stripe has no address: waiting cannot help.
+        const noAddress = claim.topup?.status === "open" && !claim.topup.networks.length;
+        if (noAddress || !wait || Date.now() >= until) {
             out.write(out.json
                 ? JSON.stringify(claim)
-                : `Not paid yet (${claim.status}). Run \`${me} billing claim ${code}\` again once the transfer has gone through.`);
-            return wait ? 1 : 0;
+                : noAddress
+                    ? (claim.next ?? "This top-up has no address to pay to yet.")
+                    : `Not paid yet (${claim.status}). Run \`${me} billing claim ${code}\` again once the transfer has gone through.`);
+            return noAddress || wait ? 1 : 0;
         }
     }
 }

package/dist/blaxel/sandbox.d.ts

@@ -139,7 +139,7 @@ export declare class SandboxInstance {
     get expiresIn(): number | undefined;
     /** Creates a sandbox and answers once it runs. Blaxel's defaults: the base
      * image (Runtime's stock image) and 4096 MB, with vCPUs at one per 2048 MB.
-     * Funding is left to Runtime: the included usage first, then prepaid credit. A name another live sandbox holds is refused
+     * Funding is left to Runtime: the free usage first, then prepaid credit. A name another live sandbox holds is refused
      * with a 409, as in Blaxel. */
     static create<T extends typeof SandboxInstance>(this: T, sandbox?: SandboxCreateConfiguration | SandboxModel, options?: SandboxCreateOptions): Promise<InstanceType<T>>;
     /** The named sandbox, or a new one when no live sandbox has the name.

package/dist/blaxel/sandbox.js

@@ -573,7 +573,7 @@ export class SandboxInstance {
     // ---- create, get, list ---------------------------------------------------
     /** Creates a sandbox and answers once it runs. Blaxel's defaults: the base
      * image (Runtime's stock image) and 4096 MB, with vCPUs at one per 2048 MB.
-     * Funding is left to Runtime: the included usage first, then prepaid credit. A name another live sandbox holds is refused
+     * Funding is left to Runtime: the free usage first, then prepaid credit. A name another live sandbox holds is refused
      * with a 409, as in Blaxel. */
     static async create(sandbox, options = {}) {
         const { createIfNotExist = false, safe = false } = options;

package/dist/cli.d.ts

@@ -2,7 +2,7 @@
 import { RuntimeError } from "./errors.js";
 import type { OutOfMemory, Usage } from "./types.js";
 import type { SwitchProvider } from "./products/switching.js";
-import type { SecretRule } from "./products/secrets.js";
+import type { SecretRule, SecretScope } from "./products/secrets.js";
 type Out = {
     json: boolean;
     write: (text: string) => void;
@@ -30,7 +30,7 @@ declare const kit: {
 };
 export type CliKit = typeof kit;
 export declare function run(argv: string[], env?: NodeJS.ProcessEnv, out?: Out): Promise<number>;
-/** `runtime usage` for a person: the balance, the included usage and what each kind
+/** `runtime usage` for a person: the balance, the free usage and what each kind
  * of resource was charged, in dollars. --json keeps every figure, and each
  * resource with its rates and CPU time. */
 /** One row per resource, for a spreadsheet: when it ran, how big it was, how
@@ -44,12 +44,27 @@ export declare function usageCsv(u: Usage): string;
 export declare function outOfMemoryLines(memory: OutOfMemory | undefined): string | undefined;
 /** How to move a rival's code across, when one import does it. */
 export declare function dropInLines(provider: SwitchProvider | undefined): string[];
+/** A secret's value, from standard input only, so it never sits in shell
+ * history or a process list. Piped: everything, less one trailing newline.
+ * A terminal: one line, not shown. */
+/** A pasted secret as the header it becomes: no line breaks (a token copied
+ * from a terminal arrives wrapped), no bracketed-paste markers, no space at
+ * either end. 13 October 2026: Marc's pasted Claude token was refused as
+ * "not visible ASCII". A header cannot hold a line break, so none is lost. */
+export declare function cleanSecret(raw: string): string;
 /** `--allow` values as secret rules: each is `[METHOD[,METHOD]...] PATH`, and
  * rules naming the same methods share one rule's paths. Only the shape is read
  * here; the API holds every rule to the same check the host makes
  * (ARCHITECTURE.md section 10, "Per-path rules on an egress secret") and says
  * which one it refused. */
 export declare function parseSecretRules(values: string[]): SecretRule[];
+/** `--only-label role=hub,tier=x --only-sandbox <id>`: a sandbox whose labels
+ * hold every pair of any one --only-label gets the secret, and so does each
+ * --only-sandbox. `--all-sandboxes`: every sandbox again. Nothing: undefined,
+ * so a replacement keeps the scope it has. */
+export declare function parseSecretScope(labels: string[] | undefined, sandboxes: string[] | undefined, all: boolean): SecretScope | undefined;
+/** Who gets a secret, in a few words. */
+export declare const scopeText: (only: SecretScope | undefined) => string;
 export declare function secretsCommand(argv: string[], env: NodeJS.ProcessEnv, out: Out, 
 /** Tests give the value here; the CLI reads standard input. */
 read?: () => Promise<string>): Promise<number>;