withruntime 0.12.0 → 0.14.0

package/dist/transport.js

@@ -1,7 +1,7 @@
 import { ConnectionError, DELIBERATE, errorFor, NOTHING_RAN, RuntimeError, WAITS_FOR_ROOM, } from "./errors.js";
 import { describeRoute, envFetch, openWebSocket } from "./proxy.js";
 import { warningText } from "./product-renames.js";
-export const VERSION = "0.12.0";
+export const VERSION = "0.14.0";
 export const DEFAULT_BASE_URL = "https://api.withruntime.com";
 /** Runtime's API as code inside a Runtime sandbox reaches it: the sandbox's
  * own host sends each request on to DEFAULT_BASE_URL over HTTPS. The API runs
@@ -9,6 +9,9 @@ export const DEFAULT_BASE_URL = "https://api.withruntime.com";
  * because the hop never leaves the machine: it goes from the program to the
  * guest's own proxy and over the sandbox's private channel to its host. */
 export const SANDBOX_BASE_URL = "http://runtime.internal";
+/** How a Runtime secret's placeholder starts, the value a sandbox sees in its
+ * place (packages/cloud-guide/docs/security.md). */
+export const PLACEHOLDER = "rtsec_";
 /** Every Runtime sandbox has this file; guest-net.py keeps it current. Tests
  * move it, so the machine running them does not decide what they see. */
 export const sandboxMarker = { path: "/run/runtime/environment.json" };
@@ -204,7 +207,13 @@ export class Transport {
             throw missingKey();
         else
             this.#apiKey = options.apiKey;
-        this.baseUrl = apiOrigin(options.baseUrl ? reachable(options.baseUrl) : defaultBaseUrl());
+        // A secret's placeholder becomes the key only on its way out through the
+        // sandbox's proxy; runtime.internal goes to the host without it, so the
+        // API sees the placeholder and answers 401 (land-lander, 11 October 2026:
+        // every worker's `check --remote`). Such a key's calls take the public API.
+        const placeholder = this.#apiKey?.startsWith(PLACEHOLDER) === true;
+        const origin = options.baseUrl || processEnv().RUNTIME_API_URL || DEFAULT_BASE_URL;
+        this.baseUrl = apiOrigin(placeholder ? origin : reachable(origin));
         // The environment's proxy (HTTPS_PROXY, NO_PROXY) on Node and Bun alike;
         // a fetch passed in is used as it is.
         this.#fetch = options.fetch ?? envFetch;
@@ -301,6 +310,18 @@ export class Transport {
         await sleep(ms, signal);
         await gate?.take();
     }
+    /** Wait before sending a refused call again. When the call's deadline
+     * ends the wait, the refusal stands: on a loaded machine bun can fire
+     * AbortSignal.timeout before a shorter setTimeout, and the call then
+     * failed as a timeout although the transport had judged the wait to fit
+     * (11 October 2026). A caller's own cancel still ends it as a cancel. */
+    async #retryAfter(refusal, ms, signal, gate) {
+        await this.#rest(ms, signal, gate).catch((cause) => {
+            throw signal?.reason?.name === "TimeoutError"
+                ? refusal
+                : cause;
+        });
+    }
     async #send(call, consume, gate) {
         let apiKey;
         try {
@@ -413,7 +434,7 @@ export class Transport {
                     inCallback = true;
                     call.onCapacityWait?.(error, pause);
                     inCallback = false;
-                    await this.#rest(pause, signal, gate);
+                    await this.#retryAfter(error, pause, signal, gate);
                     continue;
                 }
                 // Nothing ran: safe to send again for any call, past maxRetries,
@@ -429,7 +450,7 @@ export class Transport {
                     const pause = Math.min(30_000, base * 2 ** Math.min(idleAttempt++, 3)) * (0.9 + Math.random() * 0.2);
                     if (pause >= idleUntil - performance.now())
                         throw error;
-                    await this.#rest(pause, signal, gate);
+                    await this.#retryAfter(error, pause, signal, gate);
                     continue;
                 }
                 const retryable = [429, 502, 503, 504].includes(status) && !DELIBERATE.has(error.code);

package/dist/types.d.ts

@@ -92,7 +92,7 @@ export type CreateSandbox = {
      * `env`. At most 32 variables and 32 KiB. Values are never shown again;
      * answers list only `envNames`. Copies made by fork() keep them. */
     env?: Record<string, string>;
-    /** Omit to use the included usage while it lasts, then prepaid credit. */
+    /** Omit to use the free usage while it lasts, then prepaid credit. */
     funding?: "trial" | "paid";
     region?: string;
     vcpu?: number;
@@ -295,11 +295,11 @@ export type Usage = {
         /** @deprecated Read `availableMs`. Still sent for older clients. */
         reservedMs: number;
         availableMs: number;
-        /** `monthly`: the included usage every month only. `hours`: free hours
-         * given before 5 October 2026, kept, beside the included usage. Absent
+        /** `monthly`: the free usage every month only. `hours`: free hours
+         * given before 5 October 2026, kept, beside the free usage. Absent
          * from an API older than 5 October 2026. */
         offer?: "monthly" | "hours";
-        /** When the included usage renews: the 1st of next month, 00:00 UTC. */
+        /** When the free usage renews: the 1st of next month, 00:00 UTC. */
         renewsAt?: string;
     } | null;
     /** What the account uses free this calendar month (UTC), one row per
@@ -318,9 +318,13 @@ export type Usage = {
         /** The month's first day, YYYY-MM-DD. */
         month: string;
         renewsAt: string;
+        /** When the free machine time ends for an account that has never paid
+         * (30 days after it opened); null once it has paid, when it renews
+         * every month. Absent from an API older than 14 October 2026. */
+        freeUntil?: string | null;
     }>;
     /** What Runtime for Startups includes (https://withruntime.com/startups).
-     * Startup hours are given once, used after this month's included usage
+     * Startup hours are given once, used after this month's free usage
      * and before credit, never renewed, and gone after 12 months. Storage is
      * GB kept free each month for those 12 months. Empty unless the account
      * was accepted to the program or given it; absent from an older API. */

package/dist/vercel/sandbox.d.ts

@@ -147,7 +147,7 @@ export declare class Sandbox {
     /** Creates a sandbox and waits until it runs. Vercel's defaults: 2 vCPUs,
      * 2048 MiB per vCPU, persistent. With no `timeout` it has no time limit: it
      * runs while it works and pauses when idle. A `timeout` is kept as given. Funding is left to
-     * Runtime: the included usage first, then prepaid credit, exactly as withruntime's own create. */
+     * Runtime: the free usage first, then prepaid credit, exactly as withruntime's own create. */
     static create(params?: CreateSandboxParams): Promise<Sandbox & AsyncDisposable>;
     /** A sandbox by name (or Runtime id), woken if it is paused unless
      * `resume: false`. */

package/dist/vercel/sandbox.js

@@ -260,7 +260,7 @@ export class Sandbox {
     /** Creates a sandbox and waits until it runs. Vercel's defaults: 2 vCPUs,
      * 2048 MiB per vCPU, persistent. With no `timeout` it has no time limit: it
      * runs while it works and pauses when idle. A `timeout` is kept as given. Funding is left to
-     * Runtime: the included usage first, then prepaid credit, exactly as withruntime's own create. */
+     * Runtime: the free usage first, then prepaid credit, exactly as withruntime's own create. */
     static async create(params = {}) {
         refuseCreate(params);
         const client = clientFor(params);

package/dist/wallet.d.ts

@@ -17,8 +17,11 @@ export type WalletClaim = {
     status: Exclude<Topup["status"], "paid">;
     orgId: string;
     topup: Topup | null;
+    /** What to do now, such as sending the top-up again when it has no address. */
+    next?: string;
 };
-/** Opens an account and a stablecoin top-up of `usd` dollars ($10 to $10,000).
+/** Opens an account and a stablecoin top-up of `usd` dollars ($10 to $500,
+ *  a new account's first week).
  *  `acceptTerms` must be true: opening one means agreeing to
  *  https://withruntime.com/legal/terms, so ask the person you work for first. */
 export declare function openWalletAccount(input: {

package/dist/wallet.js

@@ -33,7 +33,8 @@ async function post(options, path, body) {
         });
     return [response.status, answer];
 }
-/** Opens an account and a stablecoin top-up of `usd` dollars ($10 to $10,000).
+/** Opens an account and a stablecoin top-up of `usd` dollars ($10 to $500,
+ *  a new account's first week).
  *  `acceptTerms` must be true: opening one means agreeing to
  *  https://withruntime.com/legal/terms, so ask the person you work for first. */
 export async function openWalletAccount(input, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "withruntime",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "license": "Apache-2.0",
   "mcpName": "com.withruntime/runtime",
   "type": "module",
@@ -161,19 +161,9 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "prepack": "bun run build",
     "check-types": "tsc --noEmit",
     "lint": "eslint",
-    "test": "bun scripts/test.ts",
-    "test:java": "bun ../../sdks/java/scripts/check.ts",
-    "test:ruby": "bun ../../sdks/ruby/scripts/check.ts",
-    "test:python": "bun scripts/test-python.ts",
-    "test:go": "bun scripts/test-go.ts",
-    "compat:upstream": "bun scripts/check-upstream.ts",
-    "test:compat": "bun test tests/e2b tests/daytona tests/vercel tests/blaxel tests/compat tests/drop-in-isolation.test.ts tests/drop-in-paths.test.ts tests/process-input.test.ts tests/watch-reentrant.test.ts tests/upstream-check.test.ts tests/process-output.test.ts tests/prepare-compatibility.test.ts",
-    "compat:prepare": "bun scripts/prepare-compatibility.ts",
-    "compat:inventory": "bun scripts/compat-inventory.ts",
-    "compat:oracle": "bun oracle/check.mjs"
+    "test": "bun test"
   },
   "devDependencies": {
     "@ai-sdk/harness": "1.0.124",
@@ -187,8 +177,6 @@
     "@openai/agents": "0.18.0",
     "@openai/agents-core": "0.18.0",
     "@openrouter/sdk": "1.3.27",
-    "@runtime/cloud": "workspace:*",
-    "@runtime/cloud-guide": "workspace:*",
     "@runtime/eslint-config": "workspace:*",
     "@runtime/typescript-config": "workspace:*",
     "@types/bun": "^1.4.0",

package/dist/cli/logs.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/cli/logs.test.js

@@ -1,272 +0,0 @@
-import { expect, test } from "bun:test";
-import { logsProductCommand } from "./logs.js";
-import { terminalSafe } from "../terminal.js";
-import { logs, traces, alerts } from "../products/logs.js";
-import { Transport } from "../transport.js";
-import { InvalidRequestError } from "../errors.js";
-const input = {
-    name: "errors",
-    labels: {},
-    query: '{app="api"}',
-    condition: "above 5",
-    for: "5m",
-    actions: [],
-};
-const cases = [
-    ["logs", ["query", "{}"], { from: "1", to: "2", limit: "5" }, "GET", "/v1/logs/query_range"],
-    ["logs", ["labels"], {}, "GET", "/v1/logs/labels"],
-    ["logs", ["values", "app"], {}, "GET", "/v1/logs/labels/app/values"],
-    ["logs", ["ingest"], { body: '{"resourceLogs":[]}' }, "POST", "/v1/logs"],
-    ["traces", ["ingest"], { body: '{"resourceSpans":[]}' }, "POST", "/v1/traces"],
-    ["traces", ["get", "id"], {}, "GET", "/v1/traces/id"],
-    ["traces", ["search", "{}"], {}, "GET", "/v1/traces:search"],
-    ["traces", ["tags"], {}, "GET", "/v1/traces/tags"],
-    ["alerts", ["test", "id"], {}, "POST", "/v1/alerts/id/test"],
-    [
-        "alerts",
-        ["silence", "id"],
-        { until: "2026-10-07T00:00:00Z", reason: "maintenance" },
-        "POST",
-        "/v1/alerts/id/silence",
-    ],
-];
-for (const product of ["logs", "traces", "alerts"])
-    for (const verb of ["ls", "get", "create", "update", "delete"]) {
-        const collection = `/v1/${product}${product === "alerts" ? "" : "/views"}`;
-        cases.push([
-            product,
-            [
-                ...(product === "alerts" ? [] : ["views"]),
-                verb,
-                ...(["get", "update", "delete"].includes(verb) ? ["id"] : []),
-            ],
-            ["create", "update"].includes(verb) ? { body: JSON.stringify(input) } : {},
-            { ls: "GET", get: "GET", create: "POST", update: "PUT", delete: "DELETE" }[verb],
-            collection + (["get", "update", "delete"].includes(verb) ? "/id" : ""),
-        ]);
-    }
-function setup() {
-    const requests = [];
-    const transport = new Transport({
-        apiKey: "fake",
-        baseUrl: "https://fake.test",
-        maxRetries: 0,
-        fetch: (async (url, init) => {
-            requests.push({ url: new URL(url instanceof Request ? url.url : url), init: init ?? {} });
-            return Response.json({ ...input, id: "id", data: [], nextCursor: null, marker: "ok" });
-        }),
-    });
-    return {
-        client: { logs: logs(transport), traces: traces(transport), alerts: alerts(transport) },
-        requests,
-    };
-}
-for (const [product, positional, flags, method, path] of cases)
-    for (const mode of ["tty", "pipe", "json"])
-        test(`${product} ${positional.join(" ")} ${mode}`, async () => {
-            const { client, requests } = setup(), output = [];
-            const result = await logsProductCommand(product, positional, {
-                positional,
-                flags: new Map(Object.entries({ ...flags, "idempotency-key": "retry-key" }).map(([key, value]) => [
-                    key,
-                    [value],
-                ])),
-            }, {
-                json: mode === "json",
-                tty: mode === "tty",
-                write: (text) => output.push(text),
-                error: () => {
-                    throw new Error("unexpected stderr");
-                },
-            }, async () => client);
-            expect(result).toBe(0);
-            expect(requests).toHaveLength(1);
-            expect(requests[0].url.pathname).toBe(path);
-            expect(requests[0].init.method).toBe(method);
-            expect(output).toHaveLength(1);
-            expect(output[0]).not.toContain("\x1b");
-            const printed = JSON.parse(output[0]);
-            if (positional.includes("delete"))
-                expect(printed).toEqual({ deleted: "id" });
-            else if (positional.includes("ls"))
-                expect(printed).toEqual({ data: [], nextCursor: null });
-            else
-                expect(printed.marker).toBe("ok");
-            if (method !== "GET")
-                expect(new Headers(requests[0].init.headers).get("idempotency-key")).toBe("retry-key");
-            if (positional[0] === "query")
-                expect(Object.fromEntries(requests[0].url.searchParams)).toEqual({
-                    query: "{}",
-                    start: "1",
-                    end: "2",
-                    limit: "5",
-                });
-        });
-for (const mode of ["tty", "pipe", "json"])
-    test(`tail ${mode}, selector escaping, gap and backpressure`, async () => {
-        const { client } = setup();
-        const output = [];
-        let drained = 0;
-        const events = [
-            {
-                time: "12:00",
-                timeUnixNano: "1",
-                severity: 9,
-                severityText: "INFO",
-                labels: {},
-                attributes: {},
-                traceId: null,
-                spanId: null,
-                body: "line\x1b[2J\nnext",
-                cursor: "one",
-            },
-            { gap: true, from: "old", to: "kept" },
-        ];
-        let received;
-        client.logs.tail = async function* (query, options) {
-            received = { query, options };
-            yield* events;
-        };
-        const positional = ["tail", 'app"name'];
-        await logsProductCommand("logs", positional, {
-            positional,
-            flags: new Map([
-                ["since", ["1h"]],
-                ["grep", ['a"b']],
-            ]),
-        }, {
-            json: mode === "json",
-            tty: mode === "tty",
-            write: (text) => output.push(text),
-            error() { },
-            async drain() {
-                drained++;
-            },
-        }, async () => client, { now: Date.parse("2026-10-06T12:00:00Z") });
-        expect(received).toEqual({
-            query: '{app="app\\"name"} |= "a\\"b"',
-            options: { start: "2026-10-06T11:00:00.000Z" },
-        });
-        expect(drained).toBe(2);
-        if (mode === "json")
-            expect(output.map((text) => JSON.parse(text))).toEqual(events);
-        else {
-            if (mode === "tty")
-                expect(output[0]).toContain("line\\u001b[2J\\u000anext");
-            else
-                expect(output[0]).toContain("line\u001b[2J\nnext");
-            expect(output[1]).toContain("Logs expired");
-            expect(output[1].includes("\x1b[2m")).toBe(mode === "tty");
-        }
-    });
-test("tail survives an actual fake-fetch disconnect through the SDK", async () => {
-    let calls = 0;
-    const cursors = [], output = [];
-    const abort = new AbortController();
-    const transport = new Transport({
-        apiKey: "fake",
-        baseUrl: "https://fake.test",
-        fetch: (async (input) => {
-            cursors.push(new URL(input instanceof Request ? input.url : input).searchParams.get("cursor"));
-            const cursor = String(++calls);
-            return new Response(`id: ${cursor}\ndata: ${JSON.stringify({ time: "now", timeUnixNano: "1", labels: {}, body: "same", severityText: "INFO" })}\n\n`, { headers: { "content-type": "text/event-stream" } });
-        }),
-    });
-    const client = { logs: logs(transport), traces: traces(transport), alerts: alerts(transport) };
-    const run = logsProductCommand("logs", ["tail", "{}"], { positional: ["tail", "{}"], flags: new Map() }, {
-        json: true,
-        write(text) {
-            output.push(text);
-            if (output.length === 2)
-                abort.abort(new Error("done"));
-        },
-        error() { },
-    }, async () => client, { signal: abort.signal });
-    await expect(run).rejects.toThrow("done");
-    expect(cursors).toEqual([null, "1"]);
-    expect(output.map((text) => JSON.parse(text).cursor)).toEqual(["1", "2"]);
-});
-for (const [product, positional, flags] of [
-    ["logs", ["query", "{}"], { limit: "0" }],
-    ["logs", ["query"], {}],
-    ["logs", ["tail", "api"], { since: "forever" }],
-    ["alerts", ["create"], { body: "[1]" }],
-    ["alerts", ["create"], { body: "broken" }],
-    ["alerts", ["silence", "id"], { until: "tomorrow" }],
-    ["logs", ["ingest"], { body: "{}" }],
-    ["traces", ["ingest"], { body: "{}" }],
-    ["alerts", ["oops", "id"], {}],
-])
-    test(`refuses ${positional.join(" ")} ${JSON.stringify(flags)}`, async () => {
-        const { client, requests } = setup();
-        await expect(logsProductCommand(product, positional, { positional, flags: new Map(Object.entries(flags).map(([key, value]) => [key, [value]])) }, { json: true, write() { }, error() { } }, async () => client)).rejects.toMatchObject({ code: "usage", hint: expect.any(String) });
-        expect(requests).toHaveLength(0);
-    });
-test("help needs no credentials", async () => {
-    const output = [];
-    await logsProductCommand("logs", ["help"], { positional: ["help"], flags: new Map() }, { json: false, write: (text) => output.push(text), error() { } }, async () => {
-        throw new Error("credentials requested");
-    });
-    expect(output[0]).toContain("\nruntime logs query");
-});
-test("typed failures reach the main CLI's JSON error renderer unchanged", async () => {
-    const { client } = setup();
-    const failure = new InvalidRequestError({
-        code: "query_limit",
-        message: "Too broad",
-        status: 400,
-        hint: "Narrow the time range.",
-    });
-    client.logs.queryRange = async () => {
-        throw failure;
-    };
-    await expect(logsProductCommand("logs", ["query", "{}"], { positional: ["query", "{}"], flags: new Map() }, {
-        json: true,
-        write() {
-            throw new Error("Do not print success on failure");
-        },
-        error() { },
-    }, async () => client)).rejects.toBe(failure);
-});
-test("human JSON keeps formatting but escapes C1 terminal controls", async () => {
-    const { client } = setup();
-    const output = [];
-    client.traces.get = async () => ({ resourceSpans: [], marker: "\u009b2J" });
-    await logsProductCommand("traces", ["get", "id"], { positional: ["get", "id"], flags: new Map() }, { json: false, tty: true, write: (text) => output.push(text), error() { } }, async () => client);
-    expect(output[0]).not.toContain("\u009b");
-    expect(output[0]).toContain("\\u009b");
-    expect(output[0]).toContain("\n");
-    expect(JSON.parse(output[0]).marker).toBe("\u009b2J");
-});
-test("a terminal shows what customers' programs wrote, escaped, and nothing acts", async () => {
-    // Clipboard (OSC 52), a forged link (OSC 8), screen clear, the one-byte C1
-    // CSI and a right-to-left override; tab stays.
-    const hostile = "a\tb \x1b]52;c;c2VjcmV0\x07 \x1b]8;;https://evil.test\x07ok\x1b]8;;\x07 \x1b[2J \u009b2J \u202eevil";
-    const shown = terminalSafe(hostile);
-    // eslint-disable-next-line no-control-regex -- the test looks for control characters
-    expect(shown).not.toMatch(/[\x00-\x08\x0a-\x1f\x7f-\x9f\u202e]/);
-    expect(shown).toContain("a\tb");
-    expect(shown).toContain("\\u001b]52;c;c2VjcmV0\\u0007");
-    expect(shown).toContain("\\u009b2J \\u202eevil");
-    const run = async (tty, raw, json) => {
-        const { client } = setup();
-        client.logs.tail = async function* () {
-            yield { cursor: "c", time: "t", severityText: "INFO", body: hostile, labels: {} };
-        };
-        const output = [];
-        const flags = new Map(raw ? [["raw", ["true"]]] : []);
-        await logsProductCommand("logs", ["tail", "{}"], { positional: ["tail", "{}"], flags }, { json, tty, write: (text) => output.push(text), error() { } }, async () => client);
-        return output.join("\n");
-    };
-    for (const json of [false, true]) {
-        const onTerminal = await run(true, false, json);
-        expect(onTerminal).not.toContain("\x1b]");
-        expect(onTerminal).not.toContain("\u009b");
-        expect(onTerminal).not.toContain("\u202e");
-        if (json)
-            expect(JSON.parse(onTerminal).body).toBe(hostile);
-        // A pipe, or --raw on a terminal, gets exactly what was written.
-        expect(await run(false, false, json)).toContain(json ? JSON.stringify(hostile) : hostile);
-        expect(await run(true, true, json)).toContain(json ? JSON.stringify(hostile) : hostile);
-    }
-});

package/dist/products/logs.test.d.ts

@@ -1 +0,0 @@
-export {};