withruntime 0.18.0 → 0.23.0

package/dist/products/secrets.js

@@ -161,6 +161,16 @@ export function secrets(t) {
             body: only,
             ...options,
         }),
+        /** Narrows where a secret goes, without its value: `hosts` a subset of
+         * its hosts, `rules` allowing only requests its rules allow now (a secret
+         * without rules allows every request). Either absent stays as it is.
+         * Anything wider is refused: widening needs the value, through `set`. */
+        narrow: (name, to, options) => t.json({
+            method: "PUT",
+            path: `${path(name)}/rules`,
+            body: to,
+            ...options,
+        }),
         /** The sandboxes' secrets: names, hosts and placeholders. Never values.
          * `all()` includes the jobs copies. */
         list,
@@ -209,6 +219,26 @@ export function secrets(t) {
                 ...options,
             });
         },
+        /** Choose which of your keys may use the jobs copy besides the one that
+         * stored it: agent ids (`principalId` from `me()`), `[]` for only that
+         * key, or `"all"` for every key of yours. Replaces the list. Only your
+         * person or the key that stored it may call this. */
+        share: async (name, agents, options) => {
+            const live = await liveCopy(name, options);
+            if (!live)
+                throw new NotFoundError({
+                    message: `${name} has no copy for jobs to share.`,
+                    code: "not_found",
+                    status: 404,
+                    hint: "Store one with set(name, { value, jobs: true }).",
+                });
+            return store({
+                method: "POST",
+                path: `${jobPath(live.id)}:share`,
+                body: { agents },
+                ...options,
+            });
+        },
         /** Delete a secret everywhere it is kept: the sandboxes' value is erased
          * and its placeholder stops working, and the jobs copy stops being given
          * to runs (its name stays taken). */

package/dist/sandbox.d.ts

@@ -95,12 +95,15 @@ export declare class Sandbox extends Machine<SandboxInfo, SandboxSettings, Delet
      * each its own sandbox, answered once they run. A running sandbox is paused
      * for the moment its snapshot takes, then woken. One without `count`; an
      * array with it. `funding` is what the copies run on, as for a create;
+     * omitted, they keep this sandbox's. `secrets` names the egress secrets the
+     * copies may use, and may only narrow this sandbox's list: [] is none;
      * omitted, they keep this sandbox's. */
     fork(options?: {
         name?: string;
         labels?: Record<string, string>;
         keepSnapshot?: boolean;
         funding?: "trial" | "paid";
+        secrets?: string[];
     } & RequestOptions): Promise<Sandbox>;
     fork(options: {
         count: number;
@@ -108,6 +111,7 @@ export declare class Sandbox extends Machine<SandboxInfo, SandboxSettings, Delet
         labels?: Record<string, string>;
         keepSnapshot?: boolean;
         funding?: "trial" | "paid";
+        secrets?: string[];
     } & RequestOptions): Promise<Sandbox[]>;
 }
 /** A sandbox session, as the API answers it. `token` is set only in the

package/dist/transport.d.ts

@@ -1,5 +1,5 @@
 import { RuntimeError } from "./errors.js";
-export declare const VERSION = "0.18.0";
+export declare const VERSION = "0.23.0";
 export declare const DEFAULT_BASE_URL = "https://api.withruntime.com";
 /** Runtime's API as code inside a Runtime sandbox reaches it: the sandbox's
  * own host sends each request on to DEFAULT_BASE_URL over HTTPS. The API runs
@@ -38,7 +38,7 @@ export type Query = Record<string, string | number | boolean | readonly string[]
 export type Call = RequestOptions & {
     /** Internal protocol hook: successful headers arrived, before reading the body. */
     onResponse?: (response: Response) => void;
-    method: "GET" | "POST" | "PUT" | "DELETE";
+    method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
     path: string;
     query?: Query;
     body?: unknown;

package/dist/transport.js

@@ -1,7 +1,7 @@
 import { ConnectionError, DELIBERATE, errorFor, NOTHING_RAN, RuntimeError, WAITS_FOR_ROOM, } from "./errors.js";
 import { describeRoute, envFetch, openWebSocket } from "./proxy.js";
 import { warningText } from "./product-renames.js";
-export const VERSION = "0.18.0";
+export const VERSION = "0.23.0";
 export const DEFAULT_BASE_URL = "https://api.withruntime.com";
 /** Runtime's API as code inside a Runtime sandbox reaches it: the sandbox's
  * own host sends each request on to DEFAULT_BASE_URL over HTTPS. The API runs

package/dist/tunnel.js

@@ -235,7 +235,7 @@ export class Tunnel {
                                 message: "The sandbox has no OpenSSH server (sshd).",
                                 code: "sshd_missing",
                                 status: 0,
-                                hint: "Install it once: sudo apt-get install -y openssh-server",
+                                hint: "Install it once: sudo apt-get update && sudo apt-get install -y openssh-server",
                             })
                             : new RuntimeError({
                                 message: `The sandbox refused the connection (${error.message}).`,

package/dist/types.d.ts

@@ -62,6 +62,12 @@ export type SandboxInfo = {
     /** The names of its own environment variables (`env`), on a create, an
      * update and a read of one sandbox. Values are never shown. */
     envNames?: string[];
+    /** The egress secrets this sandbox may use, by name: only those of your
+     * egress secrets that would otherwise reach it. Null is every secret that
+     * reaches it. Fixed for the sandbox's life; a fork or a copy of a snapshot
+     * may only narrow its source's list. On a create, an update, a fork and a
+     * read of one sandbox; absent from list pages and older servers. */
+    secrets?: string[] | null;
     /** On an update with labels by a key that may read secrets, when one of
      * the account's egress secrets is scoped: true once every server running its sandboxes holds the change,
      * so the next request uses the new scope; false while one has not
@@ -102,6 +108,11 @@ export type CreateSandbox = {
      * `env`. At most 32 variables and 32 KiB. Values are never shown again;
      * answers list only `envNames`. Copies made by fork() keep them. */
     env?: Record<string, string>;
+    /** The egress secrets this sandbox may use, by name: only those of your
+     * egress secrets that would otherwise reach it. [] is none; leave it out
+     * for every secret that reaches it. Fixed for the sandbox's life; a fork or
+     * a copy of a snapshot may only narrow its source's list. At most 64. */
+    secrets?: string[];
     /** Omit to use the free usage while it lasts, then prepaid credit. */
     funding?: "trial" | "paid";
     region?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "withruntime",
-  "version": "0.18.0",
+  "version": "0.23.0",
   "license": "Apache-2.0",
   "mcpName": "com.withruntime/runtime",
   "type": "module",
@@ -55,6 +55,21 @@
       "import": "./dist/networks/index.js",
       "default": "./dist/networks/index.js"
     },
+    "./agents": {
+      "types": "./dist/agents/index.d.ts",
+      "import": "./dist/agents/index.js",
+      "default": "./dist/agents/index.js"
+    },
+    "./containers": {
+      "types": "./dist/containers/index.d.ts",
+      "import": "./dist/containers/index.js",
+      "default": "./dist/containers/index.js"
+    },
+    "./builds": {
+      "types": "./dist/builds/index.d.ts",
+      "import": "./dist/builds/index.js",
+      "default": "./dist/builds/index.js"
+    },
     "./e2b": {
       "types": "./dist/e2b/index.d.ts",
       "import": "./dist/e2b/index.js",