withruntime 0.18.0 → 0.23.0

package/dist/products/agents.d.ts

@@ -0,0 +1,272 @@
+/** Agents: a coding or support agent's harness (Claude Code, Codex, Gemini
+ * CLI, or your own code on an agents SDK) in a sandbox of its own per
+ * session, on your own model key. Your app drives its sessions through this
+ * API and webhooks. In a private beta: outside it every call is refused with
+ * `product_in_beta`.
+ *
+ *   const agent = await runtime.agents.create({
+ *     name: "support",
+ *     definition: {
+ *       ...runtime.agents.templates["claude-code"].definition,
+ *       ...runtime.agents.uses.support.definition,
+ *       instructions: "Answer questions about our product. Be brief.",
+ *     },
+ *   });
+ *   const session = await runtime.agents.start("support", { input: "Hi!", key: "customer:42" });
+ *   for await (const event of session.events()) if (event.kind === "reply") console.log(event.body.text);
+ *
+ * A session's sandbox is billed while it runs, at $0.03 per active vCPU-hour
+ * and $0.01 per GiB-hour of memory; a waiting session's sandbox is paused.
+ * No session fee, no seats. */
+import { Page } from "../page.js";
+import type { RequestOptions, Transport } from "../transport.js";
+export type AgentDefinition = {
+    /** What runs the harness, from the sandbox's home. */
+    command: string;
+    /** Where each session's sandbox starts: an image of yours, or a snapshot
+     * of a machine you set up by hand (a harness logged in to your own
+     * subscription included). The default image has Node and Python. */
+    from?: {
+        image: string;
+    } | {
+        snapshot: string;
+    };
+    /** 1, 2, 4, 8 or 16; default 4. */
+    vcpu?: number;
+    /** 512 to 65536, a multiple of 256; default 8192 (8 GiB). */
+    memoryMiB?: number;
+    /** The agent's standing words, at most 64 KiB. */
+    instructions?: string;
+    /** Settings the harness sees; never a secret. */
+    env?: Record<string, string>;
+    /** Names of your egress secrets the sandbox may use: it sees a placeholder,
+     * and the egress proxy adds the value toward the secret's hosts. Model
+     * keys of any provider go here (ANTHROPIC_API_KEY, OPENAI_API_KEY,
+     * GEMINI_API_KEY, OPENROUTER_API_KEY, or an OpenAI-compatible endpoint's
+     * key with env.OPENAI_BASE_URL). */
+    secrets?: string[];
+    /** MCP servers the harness may reach. */
+    mcp?: {
+        name: string;
+        url: string;
+    }[];
+    volumes?: {
+        volume: string;
+        path: string;
+    }[];
+    /** How long a session's sandbox runs with nothing happening before it
+     * pauses; default 60. */
+    idlePauseSeconds?: number;
+    /** A session's longest life; default 86400. */
+    maxSessionSeconds?: number;
+    /** Sessions running at once; more wait, queued. Default 10. */
+    maxConcurrent?: number;
+    /** The use it was set up for (`uses`). */
+    template?: "support" | "team";
+};
+export type Agent = {
+    id: string;
+    name: string;
+    version: number;
+    /** With its defaults written in. */
+    definition: AgentDefinition;
+    labels: Record<string, string>;
+    /** `subscription_for_customers`: its secrets name CLAUDE_CODE_OAUTH_TOKEN
+     * and it is set up to answer your customers (`template: "support"`). A
+     * subscription is for your own team's agents; an agent that serves your
+     * customers uses an API key. */
+    warnings: "subscription_for_customers"[];
+    createdAt: string;
+    updatedAt: string;
+};
+export type AgentSessionState = "queued" | "running" | "waiting" | "done" | "failed" | "stopped";
+/** One session. Subagents' parentSessionId and rootSessionId, its cost and
+ * treeCost, historyBytes and attachmentBytes join it as the API gains
+ * them. */
+export type AgentSession = {
+    id: string;
+    agentId: string;
+    agentVersion: number;
+    key: string | null;
+    trigger: "api" | AgentTriggerKind;
+    state: AgentSessionState;
+    /** Why it ended. */
+    reason: string | null;
+    /** What the agent said it ended with: a pull request's address, an answer. */
+    result: string | null;
+    sandboxId: string | null;
+    lastSeq: number;
+    labels: Record<string, string>;
+    createdAt: string;
+    startedAt: string | null;
+    endedAt: string | null;
+};
+export type AgentEvent = {
+    seq: number;
+    kind: "input" | "answer" | "reply" | "ask" | "status" | "result" | "error" | "note";
+    /** A key's principal id, slack:<user>, github:<login>, agent (the
+     * harness) or runtime. */
+    actor: string;
+    /** Words are body.text. */
+    body: {
+        text?: string;
+    } & Record<string, unknown>;
+    createdAt: string;
+};
+export type AgentTriggerKind = "slack" | "github" | "schedule" | "webhook";
+export type AgentTrigger = {
+    id: string;
+    agentId: string;
+    kind: AgentTriggerKind;
+    config: Record<string, unknown>;
+    pausedAt: string | null;
+    pausedWhy: string | null;
+    createdAt: string;
+    /** A webhook's secret, which each of its calls carries: answered once,
+     * when it is added, and never again. Keep it where you keep your keys. */
+    secret?: string;
+};
+export type CreateAgent = {
+    name: string;
+    definition: AgentDefinition;
+    labels?: Record<string, string>;
+};
+export type StartAgentSession = {
+    input: string;
+    /** Words with the same key join its open session: a Slack thread, a pull
+     * request, one of your customers (`customer:42`). */
+    key?: string;
+    labels?: Record<string, string>;
+};
+export type CreateAgentTrigger = {
+    kind: "slack";
+    config: {
+        team: string;
+        channel: string;
+    };
+} | {
+    kind: "github";
+    config: {
+        installation: number;
+        repository: string;
+        events?: string[];
+    };
+} | {
+    kind: "schedule";
+    config: {
+        cron: string;
+        timezone?: string;
+        input: string;
+    };
+} | {
+    kind: "webhook";
+    config: Record<string, never>;
+};
+/** The five harnesses' names, so `templates["claude-code"]` is known to be there. */
+export type AgentTemplateKey = "claude-code" | "codex" | "gemini-cli" | "claude-agent-sdk" | "openai-agents-sdk";
+/** A harness, as data (packages/cloud-guide/agent-templates.json, the same
+ * in every SDK and the guide). `definition` is what an agent's definition
+ * takes from it; add a use's (`uses`) and your instructions. */
+export type AgentTemplate = {
+    key: AgentTemplateKey;
+    title: string;
+    command: string;
+    /** The egress secret its API key is stored as, and the host it is for. */
+    apiKeySecret: string;
+    apiKeyHost: string;
+    /** How your own subscription logs it in, for your own team's agents, or
+     * null when it takes an API key alone. */
+    subscription: string | null;
+    definition: {
+        command: string;
+        secrets: string[];
+    };
+};
+/** A use: what an agent is for, merged into a template's definition. */
+export type AgentUse = {
+    key: "support" | "team";
+    title: string;
+    /** How its sessions are keyed: the key your app passes per customer, or
+     * none. */
+    sessionKey: string | null;
+    triggers: ("api" | AgentTriggerKind)[];
+    definition: Partial<AgentDefinition> & {
+        template: "support" | "team";
+    };
+};
+/** The five harnesses (agents-contract.md); tests/agents.test.ts holds them
+ * to packages/cloud-guide/agent-templates.json. */
+export declare const AGENT_TEMPLATES: Readonly<Record<AgentTemplateKey, AgentTemplate>>;
+export declare const AGENT_USES: Readonly<Record<"support" | "team", AgentUse>>;
+/** One session, to talk to and follow. */
+export type AgentSessionHandle = {
+    readonly id: string;
+    /** The session as it was when started or read. */
+    readonly session: AgentSession;
+    /** Whether the start's words joined a session already open with its key. */
+    readonly joined: boolean;
+    /** The seq of the words that started or joined it. */
+    readonly seq: number;
+    /** Words in; answers their seq. */
+    send(text: string, options?: RequestOptions): Promise<{
+        seq: number;
+    }>;
+    /** Its log after `after` (0 by default), each event as it comes, waiting
+     * up to 30 seconds a call; ends when the session has ended. */
+    events(options?: {
+        after?: number;
+        signal?: AbortSignal;
+    }): AsyncGenerator<AgentEvent>;
+    stop(options?: RequestOptions): Promise<AgentSession>;
+    /** Until it has ended; answers it then. */
+    wait(options?: {
+        signal?: AbortSignal;
+    }): Promise<AgentSession>;
+    get(options?: RequestOptions): Promise<AgentSession>;
+};
+export declare function agents(t: Transport): {
+    /** An agent: a name and a definition its sessions start from. */
+    create: (input: CreateAgent, options?: RequestOptions) => Promise<Agent>;
+    /** By its id or its name. */
+    get: (agent: string, options?: RequestOptions) => Promise<Agent>;
+    /** Your agents, oldest first. Await for a page, or `for await` for all. */
+    list: (query?: {
+        cursor?: string;
+        limit?: number;
+    }, options?: RequestOptions) => Promise<Page<Agent>>;
+    /** A new version of the definition, whole; sessions already started keep theirs. */
+    update: (agent: string, definition: AgentDefinition, options?: RequestOptions) => Promise<Agent>;
+    /** Its triggers go and its open sessions stop. */
+    delete: (agent: string, options?: RequestOptions) => Promise<void>;
+    /** A session with its first words, or the open one with the same key joined. */
+    start(agent: string, input: StartAgentSession, options?: RequestOptions): Promise<AgentSessionHandle>;
+    /** A session you already have, by its id. */
+    session(id: string, options?: RequestOptions): Promise<AgentSessionHandle>;
+    sessions: {
+        get: (id: string, options?: RequestOptions) => Promise<AgentSession>;
+        /** Newest first; of one agent, or in some states. */
+        list: (query?: {
+            agent?: string;
+            state?: AgentSessionState[];
+            cursor?: string;
+            limit?: number;
+        }, options?: RequestOptions) => Promise<Page<AgentSession>>;
+        /** An ended session and its log go. Its history is storage like any
+         * other, kept until you delete it; an open session is refused
+         * (`session_open`): stop it first. */
+        delete: (id: string, options?: RequestOptions) => Promise<void>;
+    };
+    triggers: {
+        create: (agent: string, input: CreateAgentTrigger, options?: RequestOptions) => Promise<AgentTrigger>;
+        list: (agent: string, options?: RequestOptions) => Promise<AgentTrigger[]>;
+        /** Its events are refused, saying `why`; nothing else is held. */
+        pause: (id: string, why: string, options?: RequestOptions) => Promise<AgentTrigger>;
+        resume: (id: string, options?: RequestOptions) => Promise<AgentTrigger>;
+        delete: (id: string, options?: RequestOptions) => Promise<void>;
+    };
+    /** The harnesses, as data: claude-code, codex, gemini-cli,
+     * claude-agent-sdk, openai-agents-sdk. */
+    templates: Readonly<Record<AgentTemplateKey, AgentTemplate>>;
+    /** The uses, as data: support (your customers) and team (your team). */
+    uses: Readonly<Record<"team" | "support", AgentUse>>;
+};

package/dist/products/agents.js

@@ -0,0 +1,251 @@
+/** Agents: a coding or support agent's harness (Claude Code, Codex, Gemini
+ * CLI, or your own code on an agents SDK) in a sandbox of its own per
+ * session, on your own model key. Your app drives its sessions through this
+ * API and webhooks. In a private beta: outside it every call is refused with
+ * `product_in_beta`.
+ *
+ *   const agent = await runtime.agents.create({
+ *     name: "support",
+ *     definition: {
+ *       ...runtime.agents.templates["claude-code"].definition,
+ *       ...runtime.agents.uses.support.definition,
+ *       instructions: "Answer questions about our product. Be brief.",
+ *     },
+ *   });
+ *   const session = await runtime.agents.start("support", { input: "Hi!", key: "customer:42" });
+ *   for await (const event of session.events()) if (event.kind === "reply") console.log(event.body.text);
+ *
+ * A session's sandbox is billed while it runs, at $0.03 per active vCPU-hour
+ * and $0.01 per GiB-hour of memory; a waiting session's sandbox is paused.
+ * No session fee, no seats. */
+import { Page } from "../page.js";
+const START = 'npx -y @anthropic-ai/claude-code --dangerously-skip-permissions --mcp-config ~/.runtime-agent/mcp.json -p "$(cat ~/.runtime-agent/start.md)"';
+const CODEX = 'npx -y @openai/codex exec --dangerously-bypass-approvals-and-sandbox "$(cat ~/.runtime-agent/start.md)"';
+const GEMINI = 'npx -y @google/gemini-cli --yolo -p "$(cat ~/.runtime-agent/start.md)"';
+/** The five harnesses (agents-contract.md); tests/agents.test.ts holds them
+ * to packages/cloud-guide/agent-templates.json. */
+export const AGENT_TEMPLATES = {
+    "claude-code": {
+        key: "claude-code",
+        title: "Claude Code",
+        command: START,
+        apiKeySecret: "ANTHROPIC_API_KEY",
+        apiKeyHost: "api.anthropic.com",
+        subscription: "token: run `claude setup-token` on your own computer (Pro/Max), then `runtime secrets set CLAUDE_CODE_OAUTH_TOKEN` scoped to api.anthropic.com",
+        definition: { command: START, secrets: ["ANTHROPIC_API_KEY"] },
+    },
+    codex: {
+        key: "codex",
+        title: "Codex CLI",
+        command: CODEX,
+        apiKeySecret: "OPENAI_API_KEY",
+        apiKeyHost: "api.openai.com",
+        subscription: "login once in the sandbox's terminal: `npx -y @openai/codex login --device-auth`, kept in the snapshot or a volume at `~/.codex`",
+        definition: { command: CODEX, secrets: ["OPENAI_API_KEY"] },
+    },
+    "gemini-cli": {
+        key: "gemini-cli",
+        title: "Gemini CLI",
+        command: GEMINI,
+        apiKeySecret: "GEMINI_API_KEY",
+        apiKeyHost: "generativelanguage.googleapis.com",
+        subscription: "login once in the sandbox's terminal (Sign in with Google), kept at `~/.gemini`",
+        definition: { command: GEMINI, secrets: ["GEMINI_API_KEY"] },
+    },
+    "claude-agent-sdk": {
+        key: "claude-agent-sdk",
+        title: "Claude Agent SDK",
+        command: "python3 ~/agent.py",
+        apiKeySecret: "ANTHROPIC_API_KEY",
+        apiKeyHost: "api.anthropic.com",
+        subscription: null,
+        definition: { command: "python3 ~/agent.py", secrets: ["ANTHROPIC_API_KEY"] },
+    },
+    "openai-agents-sdk": {
+        key: "openai-agents-sdk",
+        title: "OpenAI Agents SDK",
+        command: "python3 ~/agent.py",
+        apiKeySecret: "OPENAI_API_KEY",
+        apiKeyHost: "api.openai.com",
+        subscription: null,
+        definition: { command: "python3 ~/agent.py", secrets: ["OPENAI_API_KEY"] },
+    },
+};
+export const AGENT_USES = {
+    support: {
+        key: "support",
+        title: "Your customers",
+        sessionKey: "customer:<id>",
+        triggers: ["api", "webhook"],
+        definition: {
+            template: "support",
+            vcpu: 1,
+            memoryMiB: 1024,
+            idlePauseSeconds: 10,
+            maxConcurrent: 1000,
+        },
+    },
+    team: {
+        key: "team",
+        title: "Your team",
+        sessionKey: null,
+        triggers: ["slack", "github"],
+        definition: { template: "team", vcpu: 4, memoryMiB: 8192 },
+    },
+};
+const enc = encodeURIComponent;
+const ENDED = ["done", "failed", "stopped"];
+export function agents(t) {
+    const getSession = (id, options) => t.json({ method: "GET", path: `/v1/agents/sessions/${enc(id)}`, ...options });
+    async function* events(id, options = {}) {
+        let after = options.after ?? 0;
+        for (;;) {
+            options.signal?.throwIfAborted();
+            const read = await t.json({
+                method: "GET",
+                path: `/v1/agents/sessions/${enc(id)}/events`,
+                query: { after, wait: 30 },
+                ...(options.signal ? { signal: options.signal } : {}),
+                timeoutMs: 0,
+            });
+            for (const event of read.data) {
+                after = event.seq;
+                yield event;
+            }
+            if (read.ended)
+                return;
+        }
+    }
+    const handle = (session, joined = false, seq = session.lastSeq) => ({
+        id: session.id,
+        session,
+        joined,
+        seq,
+        send: (text, options) => t.json({
+            method: "POST",
+            path: `/v1/agents/sessions/${enc(session.id)}/messages`,
+            body: { text },
+            ...options,
+        }),
+        events: (options) => events(session.id, options),
+        stop: (options) => t.json({
+            method: "POST",
+            path: `/v1/agents/sessions/${enc(session.id)}/stop`,
+            body: {},
+            ...options,
+        }),
+        async wait(options = {}) {
+            const now = await getSession(session.id, options);
+            if (ENDED.includes(now.state))
+                return now;
+            for await (const _ of events(session.id, { after: now.lastSeq, ...options }))
+                ;
+            return getSession(session.id, options);
+        },
+        get: (options) => getSession(session.id, options),
+    });
+    const list = async (query = {}, options) => {
+        const page = await t.json({
+            method: "GET",
+            path: "/v1/agents",
+            query,
+            ...options,
+        });
+        return new Page(page.data, page.nextCursor, (cursor) => list({ ...query, cursor }, options));
+    };
+    const listSessions = async (query = {}, options) => {
+        const page = await t.json({
+            method: "GET",
+            path: "/v1/agents/sessions",
+            query,
+            ...options,
+        });
+        return new Page(page.data, page.nextCursor, (cursor) => listSessions({ ...query, cursor }, options));
+    };
+    return {
+        /** An agent: a name and a definition its sessions start from. */
+        create: (input, options) => t.json({ method: "POST", path: "/v1/agents", body: input, ...options }),
+        /** By its id or its name. */
+        get: (agent, options) => t.json({ method: "GET", path: `/v1/agents/${enc(agent)}`, ...options }),
+        /** Your agents, oldest first. Await for a page, or `for await` for all. */
+        list,
+        /** A new version of the definition, whole; sessions already started keep theirs. */
+        update: (agent, definition, options) => t.json({
+            method: "PATCH",
+            path: `/v1/agents/${enc(agent)}`,
+            body: { definition },
+            ...options,
+        }),
+        /** Its triggers go and its open sessions stop. */
+        delete: async (agent, options) => {
+            await t.json({ method: "DELETE", path: `/v1/agents/${enc(agent)}`, ...options });
+        },
+        /** A session with its first words, or the open one with the same key joined. */
+        async start(agent, input, options) {
+            const out = await t.json({
+                method: "POST",
+                path: `/v1/agents/${enc(agent)}/sessions`,
+                body: input,
+                ...options,
+            });
+            return handle(out.session, out.joined, out.seq);
+        },
+        /** A session you already have, by its id. */
+        async session(id, options) {
+            return handle(await getSession(id, options));
+        },
+        sessions: {
+            get: getSession,
+            /** Newest first; of one agent, or in some states. */
+            list: listSessions,
+            /** An ended session and its log go. Its history is storage like any
+             * other, kept until you delete it; an open session is refused
+             * (`session_open`): stop it first. */
+            delete: async (id, options) => {
+                await t.json({
+                    method: "DELETE",
+                    path: `/v1/agents/sessions/${enc(id)}`,
+                    ...options,
+                });
+            },
+        },
+        triggers: {
+            create: (agent, input, options) => t.json({
+                method: "POST",
+                path: `/v1/agents/${enc(agent)}/triggers`,
+                body: input,
+                ...options,
+            }),
+            list: async (agent, options) => (await t.json({
+                method: "GET",
+                path: `/v1/agents/${enc(agent)}/triggers`,
+                ...options,
+            })).data,
+            /** Its events are refused, saying `why`; nothing else is held. */
+            pause: (id, why, options) => t.json({
+                method: "POST",
+                path: `/v1/agents/triggers/${enc(id)}/pause`,
+                body: { why },
+                ...options,
+            }),
+            resume: (id, options) => t.json({
+                method: "POST",
+                path: `/v1/agents/triggers/${enc(id)}/resume`,
+                body: {},
+                ...options,
+            }),
+            delete: async (id, options) => {
+                await t.json({
+                    method: "DELETE",
+                    path: `/v1/agents/triggers/${enc(id)}`,
+                    ...options,
+                });
+            },
+        },
+        /** The harnesses, as data: claude-code, codex, gemini-cli,
+         * claude-agent-sdk, openai-agents-sdk. */
+        templates: AGENT_TEMPLATES,
+        /** The uses, as data: support (your customers) and team (your team). */
+        uses: AGENT_USES,
+    };
+}

package/dist/products/containers.d.ts

@@ -0,0 +1,71 @@
+/** Containers: one OCI image's process on its own microVM, billed at the
+ * sandbox rates (packages/cloud/src/api/products/containers.ts), at
+ * /v1/containers. In a private beta: an account outside it is refused with
+ * product_in_beta (403), and retrying does not change it. */
+import type { Transport } from "../transport.js";
+import { type ResourceRecord } from "./resources.js";
+export type ContainerState = "waiting" | "running" | "sleeping" | "stopped" | "failed" | "deleting" | "deleted";
+export type Container = ResourceRecord & {
+    name: string | null;
+    labels: Record<string, string>;
+    state: ContainerState;
+    createdAt: number;
+    updatedAt: number;
+    deletedAt: number | null;
+    /** The image it runs, pinned to its digest (name@sha256:...). */
+    image: string;
+    entrypoint: string[];
+    command: string[];
+    workingDir: string;
+    user: string;
+    /** The TCP port it serves on, or null when it serves none. */
+    port: number | null;
+    /** The image's exposed ports, as N/tcp or N/udp. */
+    exposedPorts: string[];
+    onExit: "restart" | "stop";
+    sleep: boolean;
+    vcpu: number;
+    memoryMiB: number;
+    /** The environment's names. Values are never answered: they may be secrets. */
+    envNames: string[];
+};
+export type CreateContainer = {
+    /** An OCI image reference; the answer pins its digest. */
+    image: string;
+    /** 1 to 16. */
+    vcpu: number;
+    /** 128 to 65536 MiB. */
+    memoryMiB: number;
+    name?: string;
+    labels?: Record<string, string>;
+    /** Replaces the image's Entrypoint and drops its Cmd. */
+    entrypoint?: string[];
+    /** Replaces the image's Cmd; keeps the effective entrypoint. */
+    command?: string[];
+    /** Set over the image's own environment. */
+    env?: Record<string, string>;
+    /** An absolute path; the image's, else /. */
+    workingDir?: string;
+    /** The image's, else root. */
+    user?: string;
+    /** 1 to 65535. Required when the image exposes several TCP ports. */
+    port?: number;
+    /** Default: restart when it serves a port, otherwise stop. */
+    onExit?: "restart" | "stop";
+    /** Sleep when idle; false by default. */
+    sleep?: boolean;
+};
+/** Only the name and labels change; a null name clears it. */
+export type UpdateContainer = {
+    name?: string | null;
+    labels?: Record<string, string>;
+};
+export declare function containers(t: Transport): {
+    base: string;
+    create: (input: CreateContainer, options?: import("../transport.js").RequestOptions) => Promise<Container>;
+    get: (id: string, options?: import("./resources.js").ResourceGetOptions<"stopped" | "running" | "deleted" | "failed" | "deleting" | "waiting" | "sleeping">) => Promise<Container>;
+    list: (query?: import("./resources.js").ResourceListQuery<"stopped" | "running" | "deleted" | "failed" | "deleting" | "waiting" | "sleeping">, options?: import("../transport.js").RequestOptions) => Promise<import("../page.js").Page<Container>>;
+    update: (id: string, input: UpdateContainer, options?: import("../transport.js").RequestOptions) => Promise<Container>;
+    wait: (id: string, target: "stopped" | "running" | "deleted" | "failed" | "deleting" | "waiting" | "sleeping", options?: import("./resources.js").ResourceWaitOptions) => Promise<Container>;
+    delete: (id: string, options?: import("./resources.js").ResourceDeleteOptions) => Promise<Container>;
+};

package/dist/products/containers.js

@@ -0,0 +1,6 @@
+import { resource } from "./resources.js";
+/** A wait ends at its target or at one of these, with the container's error. */
+const SETTLED = ["failed", "deleted"];
+export function containers(t) {
+    return resource(t, "containers", SETTLED);
+}

package/dist/products/index.d.ts

@@ -21,6 +21,9 @@ import { sandboxTailscale } from "./tailscale.js";
 import { secrets } from "./secrets.js";
 import { mcp, sandboxMcp } from "./mcp.js";
 import { events, otel, sandboxMetrics, webhooks } from "./observability.js";
+import { agents } from "./agents.js";
+import { builds } from "./builds.js";
+import { containers } from "./containers.js";
 export declare const clientExtensions: {
     images: typeof images;
     volumes: typeof volumes;
@@ -41,6 +44,9 @@ export declare const clientExtensions: {
     ports: typeof ports;
     ips: typeof ips;
     networks: typeof networks;
+    agents: typeof agents;
+    builds: typeof builds;
+    containers: typeof containers;
 };
 export declare const sandboxExtensions: {
     interpreter: typeof sandboxInterpreter;

package/dist/products/index.js

@@ -19,6 +19,9 @@ import { sandboxTailscale } from "./tailscale.js";
 import { secrets } from "./secrets.js";
 import { mcp, sandboxMcp } from "./mcp.js";
 import { events, otel, sandboxMetrics, webhooks } from "./observability.js";
+import { agents } from "./agents.js";
+import { builds } from "./builds.js";
+import { containers } from "./containers.js";
 /* HOW A LANE ADDS A PRODUCT TO THE SDK
  *
  * 1. Write src/products/<name>.ts exporting a factory:
@@ -54,6 +57,10 @@ export const clientExtensions = {
     ports,
     ips,
     networks,
+    agents,
+    // Builds (beta): the API answers product_in_beta outside its list.
+    builds,
+    containers,
 };
 export const sandboxExtensions = {
     interpreter: sandboxInterpreter,

package/dist/products/secrets.d.ts

@@ -75,6 +75,10 @@ export type JobSecret = {
     name: string;
     ownerId: string;
     createdBy: string;
+    /** Agents besides `createdBy` that may use it, as `principalId`s from
+     * `runtime.me()`, or `"all"`: every key of the person. A secret stored on
+     * the website is `"all"`. */
+    usableBy: string[] | "all";
     version: number;
     createdAt: number;
     updatedAt: number;
@@ -120,6 +124,16 @@ export declare function secrets(t: Transport): {
     scope: (name: string, only: SecretScope, options?: RequestOptions) => Promise<Secret & {
         enforced: boolean;
     }>;
+    /** Narrows where a secret goes, without its value: `hosts` a subset of
+     * its hosts, `rules` allowing only requests its rules allow now (a secret
+     * without rules allows every request). Either absent stays as it is.
+     * Anything wider is refused: widening needs the value, through `set`. */
+    narrow: (name: string, to: {
+        hosts?: string[];
+        rules?: SecretRule[];
+    }, options?: RequestOptions) => Promise<Secret & {
+        enforced: boolean;
+    }>;
     /** The sandboxes' secrets: names, hosts and placeholders. Never values.
      * `all()` includes the jobs copies. */
     list: (options?: RequestOptions) => Promise<Secret[]>;
@@ -140,6 +154,11 @@ export declare function secrets(t: Transport): {
         version: number;
         value: string;
     }>;
+    /** Choose which of your keys may use the jobs copy besides the one that
+     * stored it: agent ids (`principalId` from `me()`), `[]` for only that
+     * key, or `"all"` for every key of yours. Replaces the list. Only your
+     * person or the key that stored it may call this. */
+    share: (name: string, agents: string[] | "all", options?: RequestOptions) => Promise<JobSecret>;
     /** Delete a secret everywhere it is kept: the sandboxes' value is erased
      * and its placeholder stops working, and the jobs copy stops being given
      * to runs (its name stays taken). */