withruntime 0.21.0 → 0.33.0

package/dist/daytona/errors.js

@@ -1,4 +1,5 @@
 import { RuntimeError } from "../errors.js";
+import { productSwitchedOff } from "../switched-off.js";
 /* Daytona's error classes by the same names and parents, so a
    `catch (e) { if (e instanceof DaytonaNotFoundError) ... }` written for
    Daytona keeps working. One made from a Runtime answer carries Runtime's
@@ -164,7 +165,7 @@ export function translate(error, subject = "other") {
         .filter(Boolean)
         .join("\n");
     let out;
-    if (error.status === 503 && error.code.endsWith("_unavailable"))
+    if (productSwitchedOff(error))
         out = new NotSupportedError(error.code.replace(/_unavailable$/, ""), error.hint ?? "", message);
     else if (error.code === "file_not_found" || (error.status === 404 && subject === "file"))
         out = new DaytonaFileNotFoundError(message);

package/dist/e2b/errors.js

@@ -1,4 +1,5 @@
 import { RuntimeError } from "../errors.js";
+import { productSwitchedOff } from "../switched-off.js";
 function attach(error, detail) {
     const target = error;
     if (detail.code !== undefined)
@@ -198,7 +199,7 @@ export function translate(error, subject = "other") {
         out = new SandboxNotRunningError(message);
     else if (error.code === "sandbox_not_ready" || error.code === "host_unavailable")
         out = new SandboxUnreachableError(message);
-    else if (error.status === 503 && error.code.endsWith("_unavailable"))
+    else if (productSwitchedOff(error))
         // A product switched off on purpose (forks, previews): Runtime's own words
         // say what is off and what to use meanwhile.
         out = new NotSupportedError(error.code.replace(/_unavailable$/, ""), error.hint ?? "", message);

package/dist/e2b/filesystem.d.ts

@@ -70,6 +70,7 @@ export interface FilesystemWriteOpts extends FilesystemRequestOpts {
 export interface FilesystemListOpts extends FilesystemRequestOpts {
     depth?: number;
 }
+export declare function absolute(path: string): string;
 /** `sandbox.files`: E2B's filesystem module over Runtime's files API. Relative
  * paths resolve against the home directory, as in E2B (Runtime's is
  * /workspace), and come back under /home/user, as E2B gives them. */

package/dist/e2b/filesystem.js

@@ -17,7 +17,7 @@ export var FilesystemEventType;
 })(FilesystemEventType || (FilesystemEventType = {}));
 /** Runtime's home, where E2B's relative paths land. */
 const HOME = "/workspace";
-function absolute(path) {
+export function absolute(path) {
     return path.startsWith("/") ? path : `${HOME}/${path.replace(/^\.\//, "")}`;
 }
 /** E2B's home, which E2B code expects in the paths it gets back. */

package/dist/e2b/sandbox.d.ts

@@ -113,6 +113,10 @@ export type SandboxListOpts = SandboxApiOpts & {
     limit?: number;
     nextToken?: string;
 };
+type FileUrlOpts = {
+    user?: string;
+    useSignatureExpiration?: number;
+};
 /** The Runtime image name an E2B template name stands for: E2B's
  * `team/name:tag` without the team, since a Runtime account's images are its
  * own. `name`, `name:tag` and `name@version` are Runtime image names too. */
@@ -204,8 +208,13 @@ export declare class Sandbox {
     getMetrics(opts?: MetricsOpts): Promise<E2BSandboxMetrics[]>;
     static getMetrics(sandboxId: string, opts?: MetricsOpts & SandboxApiOpts): Promise<E2BSandboxMetrics[]>;
     updateNetwork(): Promise<never>;
-    uploadUrl(): Promise<never>;
-    downloadUrl(): Promise<never>;
+    /** E2B's signed upload URL: anyone can PUT a body to it, with no key.
+     * Runtime's links name one file, so `path` is required. `useSignatureExpiration`
+     * is the lifetime in seconds (one hour by default, at most 7 days); `user`
+     * is ignored, a link writes as the sandbox's own user. */
+    uploadUrl(path?: string, opts?: FileUrlOpts): Promise<string>;
+    /** E2B's signed download URL: anyone can open it, with no key. See `uploadUrl`. */
+    downloadUrl(path: string, opts?: FileUrlOpts): Promise<string>;
     getMcpUrl(): never;
     getMcpToken(): Promise<never>;
 }

package/dist/e2b/sandbox.js

@@ -1,7 +1,7 @@
 import { clientFor, keySource, request, } from "./client.js";
 import { Commands } from "./commands.js";
 import { guard, InvalidArgumentError, NotSupportedError, PublicPreviewNotAllowedError, SandboxError, SandboxNotFoundError, TemplateError, } from "./errors.js";
-import { Filesystem } from "./filesystem.js";
+import { absolute, Filesystem } from "./filesystem.js";
 import { Pty } from "./pty.js";
 /* E2B's Sandbox over Runtime's. Every call is one or a few calls of the
    withruntime SDK; nothing here speaks HTTP. What Runtime cannot do the same
@@ -85,6 +85,13 @@ function snapshotMemory(field, mode, keepMemory) {
         throw new InvalidArgumentError(`${field} must be one of: ${SNAPSHOT_MODES.join(", ")} (got ${JSON.stringify(mode)}).`);
     return mode === "full";
 }
+/** A link's lifetime in whole seconds, one hour unless given, held to Runtime's 60 s to 7 days. */
+function linkLifetime(opts) {
+    const asked = opts.useSignatureExpiration;
+    if (asked === undefined)
+        return 3600;
+    return Math.min(604800, Math.max(60, Math.ceil(asked)));
+}
 const filesOnlyPause = () => new NotSupportedError("A files-only pause (mode: 'filesystem', or keepMemory: false)", "Runtime's pause keeps memory and files; leave mode out or pass mode: 'full'. " +
     "For a copy of the files alone, use createSnapshot({ mode: 'filesystem' }).");
 function refuseCreate(opts) {
@@ -575,11 +582,20 @@ export class Sandbox {
     updateNetwork() {
         return unsupported("E2B's network rules (updateNetwork)", "Use sandbox.runtime.network.set({ internet, allow, deny }).");
     }
-    uploadUrl() {
-        return unsupported("Signed upload URLs", "Use sandbox.files.write(path, data).");
-    }
-    downloadUrl() {
-        return unsupported("Signed download URLs", "Use sandbox.files.read(path, { format: 'bytes' }).");
+    /** E2B's signed upload URL: anyone can PUT a body to it, with no key.
+     * Runtime's links name one file, so `path` is required. `useSignatureExpiration`
+     * is the lifetime in seconds (one hour by default, at most 7 days); `user`
+     * is ignored, a link writes as the sandbox's own user. */
+    async uploadUrl(path, opts = {}) {
+        if (path === undefined)
+            throw new InvalidArgumentError("Runtime's upload URL is made for one file: pass the file's path.");
+        const link = await guard("file", () => this.#runtime.files.uploadUrl(absolute(path), { expiresInSeconds: linkLifetime(opts) }));
+        return link.url;
+    }
+    /** E2B's signed download URL: anyone can open it, with no key. See `uploadUrl`. */
+    async downloadUrl(path, opts = {}) {
+        const link = await guard("file", () => this.#runtime.files.downloadUrl(absolute(path), { expiresInSeconds: linkLifetime(opts) }));
+        return link.url;
     }
     getMcpUrl() {
         throw new NotSupportedError("E2B's MCP gateway", "Runtime's own MCP server is `npx withruntime mcp`.");

package/dist/errors.d.ts

@@ -2,9 +2,10 @@
  * `hint` says what to do next, and `requestId` is what to quote in a report
  * (runtime.feedback.submit, `runtime feedback`, or support). */
 /** A product switched off on this deployment, or paused on purpose: the API
- * answers these 503s in fixed words (`serverFault` "off" in
- * packages/cloud/src/api/respond.ts) and retrying cannot change them.
- * host_unavailable and busy pass, and are retried. */
+ * answers these with 501 (503 from an older server) in fixed words, and
+ * retrying cannot change them. host_unavailable and busy pass, and are
+ * retried. The API also says so itself (`retryable: false`); this set is for
+ * a server too old to. */
 export declare const DELIBERATE: ReadonlySet<string>;
 /** Refusals that guarantee nothing ran: a sandbox running as many commands
  * as it can (`guest_busy`), and the API's own limits, which answer before any
@@ -26,6 +27,10 @@ export declare class RuntimeError extends Error {
     /** The key the SDK sent. A retry with it never repeats the effect. */
     readonly idempotencyKey?: string;
     readonly retryAfterMs?: number;
+    /** What the API said of this answer: whether the same request, sent again
+     * unchanged, may succeed. Undefined from a server too old to say, or for a
+     * failure the SDK made itself; `retryable` then judges by code and status. */
+    readonly sentRetryable?: boolean;
     constructor(init: {
         message: string;
         code: string;
@@ -35,13 +40,15 @@ export declare class RuntimeError extends Error {
         details?: Record<string, unknown>;
         idempotencyKey?: string;
         retryAfterMs?: number;
+        sentRetryable?: boolean;
         cause?: unknown;
     });
     /** Retrying this exact call (the SDK keeps the key) is safe and may work.
      * True for no_capacity and no_credit_running_limit as well, which clear by themselves when
      * a host frees room or a sandbox without credit stops. `sandboxes.create` already
      * waits for those (see `waitForCapacityMs`), so seeing one from a create
-     * means the wait ran out or was switched off. */
+     * means the wait ran out or was switched off. The API's own word
+     * (`sentRetryable`) wins; the rest is for an older server. */
     get retryable(): boolean;
     toString(): string;
 }

package/dist/errors.js

@@ -2,20 +2,28 @@
  * `hint` says what to do next, and `requestId` is what to quote in a report
  * (runtime.feedback.submit, `runtime feedback`, or support). */
 /** A product switched off on this deployment, or paused on purpose: the API
- * answers these 503s in fixed words (`serverFault` "off" in
- * packages/cloud/src/api/respond.ts) and retrying cannot change them.
- * host_unavailable and busy pass, and are retried. */
+ * answers these with 501 (503 from an older server) in fixed words, and
+ * retrying cannot change them. host_unavailable and busy pass, and are
+ * retried. The API also says so itself (`retryable: false`); this set is for
+ * a server too old to. */
 export const DELIBERATE = new Set([
     "unavailable",
     "unsupported",
     "fork_unavailable",
     "previews_unavailable",
+    "file_links_unavailable",
     "network_unavailable",
     "network_rules_unavailable",
     "secrets_unavailable",
     "identity_unavailable",
     "env_unavailable",
     "resize_unavailable",
+    "feature_unavailable",
+    "delete_unavailable",
+    "switch_image_unavailable",
+    "switching_paused",
+    "schema_migration_required",
+    "storage_unavailable",
 ]);
 /** Refusals that guarantee nothing ran: a sandbox running as many commands
  * as it can (`guest_busy`), and the API's own limits, which answer before any
@@ -50,6 +58,10 @@ export class RuntimeError extends Error {
     /** The key the SDK sent. A retry with it never repeats the effect. */
     idempotencyKey;
     retryAfterMs;
+    /** What the API said of this answer: whether the same request, sent again
+     * unchanged, may succeed. Undefined from a server too old to say, or for a
+     * failure the SDK made itself; `retryable` then judges by code and status. */
+    sentRetryable;
     constructor(init) {
         super(init.message, init.cause === undefined ? undefined : { cause: init.cause });
         this.name = new.target.name;
@@ -65,18 +77,28 @@ export class RuntimeError extends Error {
             this.idempotencyKey = init.idempotencyKey;
         if (init.retryAfterMs !== undefined)
             this.retryAfterMs = init.retryAfterMs;
+        if (init.sentRetryable !== undefined)
+            this.sentRetryable = init.sentRetryable;
     }
     /** Retrying this exact call (the SDK keeps the key) is safe and may work.
      * True for no_capacity and no_credit_running_limit as well, which clear by themselves when
      * a host frees room or a sandbox without credit stops. `sandboxes.create` already
      * waits for those (see `waitForCapacityMs`), so seeing one from a create
-     * means the wait ran out or was switched off. */
+     * means the wait ran out or was switched off. The API's own word
+     * (`sentRetryable`) wins; the rest is for an older server. */
     get retryable() {
+        if (this.sentRetryable !== undefined)
+            return this.sentRetryable;
         if (DELIBERATE.has(this.code))
             return false;
         // A fork asking for more copies than an account without credit runs at once never fits.
         if (PASSING.has(this.code))
             return this.details?.field !== "count";
+        // The account at one of its limits (a 429 since 17 October 2026): some
+        // free when its own work ends, some only when something is deleted, so
+        // the same call again is no answer by itself.
+        if (this.code === "quota_exceeded")
+            return false;
         return [0, 429, 502, 503, 504].includes(this.status);
     }
     toString() {
@@ -146,6 +168,7 @@ export function errorFor(status, body, idempotencyKey) {
             ? { details: error.details }
             : {}),
         ...(typeof error.retryAfterMs === "number" ? { retryAfterMs: error.retryAfterMs } : {}),
+        ...(typeof error.retryable === "boolean" ? { sentRetryable: error.retryable } : {}),
         ...(idempotencyKey ? { idempotencyKey } : {}),
     };
     if (init.code === "account_blocked")

package/dist/fly/index.d.ts

@@ -0,0 +1,102 @@
+import type { Sandbox } from "../sandbox.js";
+import { type ClientOptions } from "../compat/core.js";
+export type MachineState = "created" | "starting" | "started" | "stopping" | "stopped" | "suspending" | "suspended" | "destroying" | "destroyed";
+export type GuestConfig = {
+    cpu_kind?: "shared" | "performance";
+    cpus?: number;
+    memory_mb?: number;
+    [key: string]: unknown;
+};
+export type InitConfig = {
+    exec?: string[];
+    entrypoint?: string[];
+    cmd?: string[];
+    [key: string]: unknown;
+};
+export type MachineFile = {
+    guest_path: string;
+    raw_value?: string;
+    [key: string]: unknown;
+};
+export type MachineConfig = {
+    image: string;
+    env?: Record<string, string>;
+    guest?: GuestConfig;
+    init?: InitConfig;
+    metadata?: Record<string, string>;
+    files?: MachineFile[];
+    auto_destroy?: boolean;
+    restart?: {
+        policy?: string;
+        max_retries?: number;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+};
+export type MachineEvent = {
+    id: string;
+    type: string;
+    status: string;
+    source: string;
+    timestamp: number;
+};
+export type Machine = {
+    id: string;
+    name: string;
+    state: MachineState;
+    region: string;
+    instance_id: string;
+    private_ip: string;
+    config: MachineConfig;
+    image_ref: {
+        registry: string;
+        repository: string;
+        tag: string;
+        digest: string;
+    };
+    created_at: string;
+    updated_at: string;
+    events: MachineEvent[];
+    host_status: "ok";
+};
+export type MachinesApiOptions = ClientOptions & {
+    /** Where the Fly region asked for is not Runtime's: `iad` (Ashburn,
+     * Virginia) is the Fly region next to Runtime's us-east servers. */
+    regions?: readonly string[];
+    /** Answer only requests that carry their own Runtime key, never with this
+     * handler's login: set when anyone but this computer can reach it. */
+    requireKey?: boolean;
+};
+/** A Machine's state as Fly words it, from the sandbox's. */
+export declare function machineState(state: Sandbox["state"]): MachineState;
+/** The Dockerfile that makes a Fly image and `init` one Runtime image: Fly's
+ * `exec` replaces both entrypoint and cmd, `entrypoint` drops the image's
+ * cmd unless `cmd` is given, and `cmd` keeps the entrypoint, as Docker does. */
+export declare function dockerfileFor(image: string, init?: InitConfig, files?: MachineFile[]): string;
+/** The supervised form of a main process. */
+export declare function supervised(argv: readonly string[]): string[];
+/** A restart policy as the supervisor reads it. */
+export declare function restartOf(restart: MachineConfig["restart"]): string;
+export declare class MachinesApi {
+    #private;
+    constructor({ regions, requireKey, ...options }?: MachinesApiOptions);
+    /** Answers one Machines API request. */
+    fetch: (request: Request) => Promise<Response>;
+}
+/** A sandbox as Fly's Machine object. */
+export declare function toMachine(sandbox: Sandbox): Machine;
+/** One handler for every Machines API request, for Bun.serve, Deno.serve,
+ * Hono or any server that speaks fetch. */
+export declare function machinesApi(options?: MachinesApiOptions): (request: Request) => Promise<Response>;
+/** Serves the Machines API on a port of this computer (default 4280, the
+ * port of Fly's own `_api.internal`), for code that reads its address from
+ * FLY_API_HOSTNAME (fly-admin's `apiUrl`, fly-go's FLY_FLAPS_BASE_URL). Off
+ * this computer's loopback, a request without its own Runtime key is refused,
+ * so the login it runs as is never lent to the network. */
+export declare function serveMachinesApi(options?: MachinesApiOptions & {
+    port?: number;
+    hostname?: string;
+}): Promise<{
+    url: string;
+    close(): Promise<void>;
+}>;