withruntime 0.3.1 → 0.5.0

package/dist/vercel/filesystem.js

@@ -0,0 +1,248 @@
+import { RuntimeError } from "../errors.js";
+import { fsError, translate } from "./errors.js";
+/** Node's Stats, as far as a sandbox file can answer. uid, gid, ino and the
+ * other inode fields are 0. */
+export class Stats {
+    size;
+    mode;
+    mtime;
+    mtimeMs;
+    atime;
+    atimeMs;
+    ctime;
+    ctimeMs;
+    birthtime;
+    birthtimeMs;
+    uid = 0;
+    gid = 0;
+    dev = 0;
+    ino = 0;
+    nlink = 1;
+    rdev = 0;
+    blksize = 4096;
+    blocks;
+    #type;
+    constructor(entry) {
+        this.#type = entry.type;
+        this.size = entry.size;
+        const typeBits = entry.type === "directory" ? 0o040000 : entry.type === "symlink" ? 0o120000 : 0o100000;
+        this.mode = typeBits | ((parseInt(entry.mode, 8) || 0) & 0o7777);
+        this.mtime = this.atime = this.ctime = this.birthtime = new Date(entry.modifiedAt);
+        this.mtimeMs = this.atimeMs = this.ctimeMs = this.birthtimeMs = this.mtime.getTime();
+        this.blocks = Math.ceil(entry.size / 512);
+    }
+    isFile() {
+        return this.#type === "file";
+    }
+    isDirectory() {
+        return this.#type === "directory";
+    }
+    isSymbolicLink() {
+        return this.#type === "symlink";
+    }
+    isBlockDevice() {
+        return false;
+    }
+    isCharacterDevice() {
+        return false;
+    }
+    isFIFO() {
+        return false;
+    }
+    isSocket() {
+        return false;
+    }
+}
+/** Node's Dirent, from a sandbox listing. */
+export class Dirent {
+    name;
+    parentPath;
+    path;
+    #type;
+    constructor(entry, parent) {
+        this.name = entry.name;
+        this.parentPath = this.path = parent;
+        this.#type = entry.type;
+    }
+    isFile() {
+        return this.#type === "file";
+    }
+    isDirectory() {
+        return this.#type === "directory";
+    }
+    isSymbolicLink() {
+        return this.#type === "symlink";
+    }
+    isBlockDevice() {
+        return false;
+    }
+    isCharacterDevice() {
+        return false;
+    }
+    isFIFO() {
+        return false;
+    }
+    isSocket() {
+        return false;
+    }
+}
+const encodingOf = (options) => typeof options === "string" ? options : (options?.encoding ?? null);
+const bytesOf = (data, encoding) => typeof data === "string" ? Buffer.from(data, encoding ?? "utf8") : Buffer.from(data);
+function missing(error) {
+    return error instanceof RuntimeError && (error.code === "file_not_found" || error.status === 404);
+}
+/** `sandbox.fs`: node:fs/promises over Runtime's files API and a few
+ * commands. Relative paths resolve against the sandbox's working directory,
+ * `/vercel/sandbox`, which is `/workspace` on Runtime. Errors carry Node's
+ * codes: `ENOENT` for a missing path. */
+export class FileSystem {
+    #ctx;
+    constructor(ctx) {
+        this.#ctx = ctx;
+    }
+    async #call(syscall, path, work) {
+        try {
+            return await work();
+        }
+        catch (error) {
+            if (missing(error))
+                throw fsError("ENOENT", syscall, path);
+            throw translate(error, this.#ctx.name);
+        }
+    }
+    /** Runs a coreutils command; a failure is a Node-style error. */
+    async #run(syscall, path, argv) {
+        const result = await this.#call(syscall, path, () => this.#ctx.run(argv));
+        if (result.exitCode === 0)
+            return result.stdout;
+        if (/No such file or directory/.test(result.stderr))
+            throw fsError("ENOENT", syscall, path);
+        if (/File exists/.test(result.stderr))
+            throw fsError("EEXIST", syscall, path);
+        if (/Is a directory/.test(result.stderr))
+            throw fsError("EISDIR", syscall, path);
+        if (/Not a directory/.test(result.stderr))
+            throw fsError("ENOTDIR", syscall, path);
+        throw Object.assign(new Error(`${syscall} '${path}' failed: ${result.stderr.trim()}`), {
+            code: "EIO",
+            syscall,
+            path,
+        });
+    }
+    async readFile(path, options) {
+        const target = this.#ctx.resolve(path);
+        const files = await this.#ctx.files();
+        const bytes = await this.#call("open", target, () => files.read(target, typeof options === "object" && options?.signal ? { signal: options.signal } : {}));
+        const encoding = encodingOf(options);
+        const buffer = Buffer.from(bytes);
+        return encoding ? buffer.toString(encoding) : buffer;
+    }
+    async writeFile(path, data, options) {
+        const target = this.#ctx.resolve(path);
+        const files = await this.#ctx.files();
+        await this.#call("open", target, () => files.write(target, bytesOf(data, encodingOf(options))));
+    }
+    async appendFile(path, data, options) {
+        const target = this.#ctx.resolve(path);
+        const files = await this.#ctx.files();
+        const before = await files.read(target).catch((error) => {
+            if (missing(error))
+                return new Uint8Array();
+            throw translate(error, this.#ctx.name);
+        });
+        await this.#call("open", target, () => files.write(target, Buffer.concat([before, bytesOf(data, encodingOf(options))])));
+    }
+    async mkdir(path, options) {
+        const target = this.#ctx.resolve(path);
+        const recursive = typeof options === "object" && options.recursive === true;
+        await this.#run("mkdir", target, recursive ? ["mkdir", "-p", target] : ["mkdir", target]);
+        return recursive ? target : undefined;
+    }
+    async readdir(path, options = {}) {
+        const target = this.#ctx.resolve(path);
+        const files = await this.#ctx.files();
+        const entries = await this.#call("scandir", target, () => files.list(target, { depth: 1, hidden: true }));
+        return options.withFileTypes
+            ? entries.map((entry) => new Dirent(entry, target))
+            : entries.map((entry) => entry.name);
+    }
+    async lstat(path, _options = {}) {
+        const target = this.#ctx.resolve(path);
+        const files = await this.#ctx.files();
+        const found = await this.#call("lstat", target, () => files.stat(target));
+        if (!found.exists)
+            throw fsError("ENOENT", "lstat", target);
+        return new Stats(found);
+    }
+    /** Follows symbolic links. */
+    async stat(path, options = {}) {
+        const target = this.#ctx.resolve(path);
+        const first = await this.lstat(target, options);
+        if (!first.isSymbolicLink())
+            return first;
+        return this.lstat(await this.realpath(target), options);
+    }
+    async unlink(path, _options = {}) {
+        const target = this.#ctx.resolve(path);
+        await this.#run("unlink", target, ["rm", "--", target]);
+    }
+    async rm(path, options = {}) {
+        const target = this.#ctx.resolve(path);
+        const flags = `${options.recursive ? "r" : ""}${options.force ? "f" : ""}`;
+        await this.#run("rm", target, flags ? ["rm", `-${flags}`, "--", target] : ["rm", "--", target]);
+    }
+    async rmdir(path, _options = {}) {
+        const target = this.#ctx.resolve(path);
+        await this.#run("rmdir", target, ["rmdir", "--", target]);
+    }
+    async rename(oldPath, newPath, _options = {}) {
+        const from = this.#ctx.resolve(oldPath);
+        const to = this.#ctx.resolve(newPath);
+        const files = await this.#ctx.files();
+        await this.#call("rename", from, () => files.rename(from, to, { overwrite: true }));
+    }
+    async copyFile(src, dest, _options = {}) {
+        const from = this.#ctx.resolve(src);
+        const to = this.#ctx.resolve(dest);
+        await this.#run("copyfile", from, ["cp", "--", from, to]);
+    }
+    async access(path, _options = {}) {
+        const target = this.#ctx.resolve(path);
+        if (!(await this.exists(target)))
+            throw fsError("ENOENT", "access", target);
+    }
+    async exists(path, _options = {}) {
+        const target = this.#ctx.resolve(path);
+        const files = await this.#ctx.files();
+        return this.#call("access", target, () => files.exists(target));
+    }
+    async chmod(path, mode, _options = {}) {
+        const target = this.#ctx.resolve(path);
+        const octal = typeof mode === "number" ? mode.toString(8) : mode;
+        await this.#run("chmod", target, ["chmod", octal, "--", target]);
+    }
+    async chown(path, uid, gid, _options = {}) {
+        const target = this.#ctx.resolve(path);
+        await this.#run("chown", target, ["sudo", "chown", `${uid}:${gid}`, "--", target]);
+    }
+    async symlink(target, path, _options = {}) {
+        const link = this.#ctx.resolve(path);
+        await this.#run("symlink", link, ["ln", "-s", "--", target, link]);
+    }
+    async readlink(path, _options = {}) {
+        const target = this.#ctx.resolve(path);
+        return (await this.#run("readlink", target, ["readlink", "--", target])).replace(/\n$/, "");
+    }
+    async realpath(path, _options = {}) {
+        const target = this.#ctx.resolve(path);
+        return (await this.#run("realpath", target, ["realpath", "-e", "--", target])).replace(/\n$/, "");
+    }
+    async truncate(path, len = 0, _options = {}) {
+        const target = this.#ctx.resolve(path);
+        await this.#run("open", target, ["truncate", "-s", String(len), "--", target]);
+    }
+    async mkdtemp(prefix, _options = {}) {
+        const base = this.#ctx.resolve(prefix);
+        return (await this.#run("mkdtemp", base, ["mktemp", "-d", `${base}XXXXXX`])).replace(/\n$/, "");
+    }
+}

package/dist/vercel/index.d.ts

@@ -0,0 +1,30 @@
+export { Sandbox, DEFAULT_TIMEOUT_MS, DEFAULT_VCPUS, MEMORY_MIB_PER_VCPU, networkRules, toRuntimePath, type CreateSandboxParams, type RunCommandParams, type NetworkPolicy, type SandboxRoute, } from "./sandbox.js";
+export { Command, CommandFinished, type CommandOutput, type LogOutputLine, type Signal, } from "./command.js";
+export { FileSystem, Stats, Dirent } from "./filesystem.js";
+export { Snapshot } from "./snapshot.js";
+export { APIError, StreamError, AuthenticationError, NotSupportedError } from "./errors.js";
+export type { Credentials, WithRuntime } from "./client.js";
+/** Vercel's default region; Runtime runs in one US region. */
+export declare const DEFAULT_SANDBOX_REGION = "iad1";
+export declare const Drive: {
+    (...args: unknown[]): never;
+    new (...args: unknown[]): never;
+    readonly [key: string]: (...args: unknown[]) => never;
+};
+export declare const Session: {
+    (...args: unknown[]): never;
+    new (...args: unknown[]): never;
+    readonly [key: string]: (...args: unknown[]) => never;
+};
+export declare const SandboxUser: {
+    (...args: unknown[]): never;
+    new (...args: unknown[]): never;
+    readonly [key: string]: (...args: unknown[]) => never;
+};
+export declare class SandboxUserAlreadyExistsError extends Error {
+}
+export declare const defineSandboxProxy: {
+    (...args: unknown[]): never;
+    new (...args: unknown[]): never;
+    readonly [key: string]: (...args: unknown[]) => never;
+};

package/dist/vercel/index.js

@@ -0,0 +1,38 @@
+/** Code written for Vercel Sandbox's SDK, on Runtime Cloud. Change the import:
+ *
+ *   import { Sandbox } from "withruntime/vercel"; // was: from "@vercel/sandbox"
+ *
+ * and set RUNTIME_API_KEY, or run `npx withruntime login` once. A Vercel token
+ * is never sent anywhere. What Runtime cannot do the way Vercel does throws
+ * NotSupportedError, naming what to use. */
+import { NotSupportedError } from "./errors.js";
+export { Sandbox, DEFAULT_TIMEOUT_MS, DEFAULT_VCPUS, MEMORY_MIB_PER_VCPU, networkRules, toRuntimePath, } from "./sandbox.js";
+export { Command, CommandFinished, } from "./command.js";
+export { FileSystem, Stats, Dirent } from "./filesystem.js";
+export { Snapshot } from "./snapshot.js";
+export { APIError, StreamError, AuthenticationError, NotSupportedError } from "./errors.js";
+/** Vercel's default region; Runtime runs in one US region. */
+export const DEFAULT_SANDBOX_REGION = "iad1";
+/** A stand-in for a Vercel export Runtime has no counterpart for. Importing it
+ * works, so a module that only mentions it still loads; calling it, building it
+ * or reading anything from it throws NotSupportedError naming the alternative. */
+function unsupportedExport(name, alternative) {
+    const fail = () => {
+        throw new NotSupportedError(`Vercel's ${name}`, alternative);
+    };
+    return new Proxy(function unsupported() { }, {
+        apply: fail,
+        construct: fail,
+        get: (_target, property) => {
+            if (typeof property === "symbol" || property === "then" || property === "prototype")
+                return undefined;
+            return fail();
+        },
+    });
+}
+export const Drive = unsupportedExport("Drive", "Use a Runtime volume (runtime.volumes) and mount it with withruntime: { create: { volumes: [{ volumeId, path }] } }.");
+export const Session = unsupportedExport("Session", "A Runtime sandbox is its own session: call the methods on the sandbox.");
+export const SandboxUser = unsupportedExport("SandboxUser", "Commands run as the sandbox owner with passwordless sudo; create users with `sudo useradd` in runCommand.");
+export class SandboxUserAlreadyExistsError extends Error {
+}
+export const defineSandboxProxy = unsupportedExport("sandbox proxy (defineSandboxProxy)", "Share a port with sandbox.withruntime.previews.create(port) instead.");

package/dist/vercel/sandbox.d.ts

@@ -0,0 +1,317 @@
+import type { Writable } from "node:stream";
+import type { Runtime } from "../client.js";
+import { type Credentials, type RuntimeCreate, type RuntimeSandbox, type WithRuntime } from "./client.js";
+import { Command, CommandFinished } from "./command.js";
+import { FileSystem } from "./filesystem.js";
+import { Snapshot } from "./snapshot.js";
+/** Vercel's default machine: 2 vCPUs with 2048 MB each (checked 23 September
+ * 2026). Runtime gives 2 vCPU and 4096 MiB. */
+export declare const DEFAULT_VCPUS = 2;
+export declare const MEMORY_MIB_PER_VCPU = 2048;
+/** Vercel's default timeout, 5 minutes. */
+export declare const DEFAULT_TIMEOUT_MS = 300000;
+/** Vercel's working directory; `/workspace` on Runtime. */
+export declare const HOME = "/vercel/sandbox";
+export type NetworkPolicy = "allow-all" | "deny-all" | {
+    allow?: string[] | Record<string, unknown[]>;
+    subnets?: {
+        allow?: string[];
+        deny?: string[];
+    };
+};
+type Source = {
+    type: "git";
+    url: string;
+    depth?: number;
+    revision?: string;
+    username?: string;
+    password?: string;
+} | {
+    type: "tarball";
+    url: string;
+} | {
+    type: "snapshot";
+    snapshotId: string;
+};
+export interface CreateSandboxParams extends Credentials {
+    name?: string;
+    source?: Source;
+    /** Shared at public HTTPS addresses (Runtime previews); `domain(port)`
+     * answers from them. */
+    ports?: number[];
+    /** Milliseconds. Default 300 000; 60 s to 1 hour on Runtime. */
+    timeout?: number;
+    resources?: {
+        vcpus: number;
+    };
+    networkPolicy?: NetworkPolicy;
+    networkId?: string;
+    /** Given to every command run through this object. */
+    env?: Record<string, string>;
+    /** Stored as Runtime labels. */
+    tags?: Record<string, string>;
+    region?: string;
+    failoverRegions?: string[];
+    mounts?: Record<string, unknown>;
+    signal?: AbortSignal;
+    /** Default true: `stop()` pauses the sandbox, keeping its files (and its
+     * memory), and `Sandbox.get({ name })` wakes it. false: `stop()` ends it. */
+    persistent?: boolean;
+    /** Milliseconds a stopped persistent sandbox is kept, as Runtime's
+     * retention (whole days, 1 to 365; 0 is 365). */
+    snapshotExpiration?: number;
+    /** Accepted: a paused Runtime sandbox keeps exactly its latest state. */
+    keepLastSnapshots?: {
+        count: number;
+        expiration?: number;
+        deleteEvicted?: boolean;
+    };
+    onResume?: (sandbox: Sandbox) => Promise<void>;
+    /** A legacy Vercel runtime (node22, node24, node26, python3.13): Runtime's
+     * stock image, which has Node.js 24 and Python 3.12. */
+    runtime?: string;
+    /** A Vercel managed image (Runtime's stock image) or the name of a ready
+     * Runtime image. */
+    image?: string;
+    /** Runtime-only: an explicit client, or fields for the create. */
+    withruntime?: WithRuntime;
+}
+export interface RunCommandParams {
+    cmd: string;
+    args?: string[];
+    cwd?: string;
+    env?: Record<string, string>;
+    /** Runs the command under `sudo`, which needs no password. */
+    sudo?: boolean;
+    detached?: boolean;
+    stdout?: Writable;
+    stderr?: Writable;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}
+export interface SandboxRoute {
+    port: number;
+    subdomain: string;
+    url: string;
+}
+/** Vercel's network policy as Runtime's rules. Header injection and
+ * forwarding rules have no Runtime counterpart and are refused. */
+export declare function networkRules(policy: NetworkPolicy): NonNullable<RuntimeCreate["network"]>;
+/** Runtime's `/workspace` stands for Vercel's `/vercel/sandbox`: relative
+ * paths resolve against it, and paths under /vercel/sandbox are rewritten. */
+export declare function toRuntimePath(path: string, cwd?: string): string;
+type Resolved = {
+    runtime: RuntimeSandbox;
+    client: Runtime;
+    params: CreateSandboxParams;
+};
+/** A sandbox with Vercel's methods. `sandbox.withruntime` is the Runtime
+ * sandbox underneath, for anything Vercel has no name for. */
+export declare class Sandbox {
+    #private;
+    readonly fs: FileSystem;
+    /** Use Sandbox.create, Sandbox.get or Sandbox.getOrCreate. */
+    constructor(resolved: Resolved);
+    /** The Runtime sandbox underneath: previews, network, snapshots, desktop,
+     * interpreter, processes and the rest of Runtime's SDK. */
+    get withruntime(): RuntimeSandbox;
+    /** The sandbox's name, or its Runtime id when it was made without one. */
+    get name(): string;
+    get routes(): SandboxRoute[];
+    get persistent(): boolean;
+    get region(): string;
+    get failoverRegions(): string[];
+    get networkId(): string | undefined;
+    get vcpus(): number;
+    /** Megabytes. */
+    get memory(): number;
+    get runtime(): string | undefined;
+    get image(): string | undefined;
+    get createdAt(): Date;
+    get updatedAt(): Date;
+    get cwd(): string;
+    get status(): "pending" | "running" | "stopping" | "stopped";
+    /** Milliseconds. */
+    get timeout(): number;
+    get expiresAt(): Date;
+    get tags(): Record<string, string>;
+    get sourceSnapshotId(): string | undefined;
+    /** Creates a sandbox and waits until it runs. Vercel's defaults: 2 vCPUs,
+     * 2048 MiB per vCPU, a 5-minute timeout, persistent. Funding is left to
+     * Runtime: the free trial while the account has trial time, then prepaid
+     * credit, exactly as withruntime's own create. */
+    static create(params?: CreateSandboxParams): Promise<Sandbox & AsyncDisposable>;
+    /** A sandbox by name (or Runtime id), woken if it is paused unless
+     * `resume: false`. */
+    static get(params: {
+        name: string;
+        resume?: boolean;
+        signal?: AbortSignal;
+        onResume?: (sandbox: Sandbox) => Promise<void>;
+    } & Credentials & {
+        withruntime?: WithRuntime;
+    }): Promise<Sandbox>;
+    /** The named sandbox, or a new one with that name when there is none. */
+    static getOrCreate(params?: CreateSandboxParams & {
+        resume?: boolean;
+        onCreate?: (sandbox: Sandbox) => Promise<void>;
+    }): Promise<Sandbox>;
+    /** A new sandbox copied from a running one, memory and all (a Runtime
+     * fork). `sourceSandbox` is its name. */
+    static fork(params: Omit<CreateSandboxParams, "source"> & {
+        sourceSandbox: string;
+    }): Promise<Sandbox & AsyncDisposable>;
+    /** Running and stopped (paused) sandboxes, oldest first, with Vercel's
+     * paginator: `for await (const s of await Sandbox.list())`. */
+    static list(params?: {
+        tags?: Record<string, string>;
+        limit?: number;
+        signal?: AbortSignal;
+    } & Credentials & {
+        withruntime?: WithRuntime;
+    } & Record<string, unknown>): Promise<{
+        sandboxes: ListItem[];
+        pagination: {
+            count: number;
+            next: string | null;
+        };
+    } & {
+        pages(): AsyncGenerator<{
+            sandboxes: ListItem[];
+            pagination: {
+                count: number;
+                next: string | null;
+            };
+        }, void, unknown>;
+        [Symbol.asyncIterator](): AsyncGenerator<ListItem, void, unknown>;
+        toArray(): Promise<ListItem[]>;
+    }>;
+    /** Runs a command. It waits and resolves with a CommandFinished (a
+     * non-zero exit is not an error), or with `detached: true` resolves at once
+     * with a Command. */
+    runCommand(command: string, args?: string[], opts?: {
+        signal?: AbortSignal;
+        timeoutMs?: number;
+    }): Promise<CommandFinished>;
+    runCommand(params: RunCommandParams & {
+        detached: true;
+    }): Promise<Command>;
+    runCommand(params: RunCommandParams): Promise<CommandFinished>;
+    /** A command started earlier, by its cmdId. */
+    getCommand(cmdId: string, _opts?: {
+        signal?: AbortSignal;
+    }): Promise<Command>;
+    mkDir(path: string, _opts?: {
+        signal?: AbortSignal;
+    }): Promise<void>;
+    /** The file's bytes as a Node stream, or null when there is no file. */
+    readFile(file: {
+        path: string;
+        cwd?: string;
+    }, opts?: {
+        signal?: AbortSignal;
+    }): Promise<NodeJS.ReadableStream | null>;
+    /** The file as a Buffer, or null when there is no file. */
+    readFileToBuffer(file: {
+        path: string;
+        cwd?: string;
+    }, opts?: {
+        signal?: AbortSignal;
+    }): Promise<Buffer | null>;
+    /** Copies a sandbox file to the local disk; null when there is no file. */
+    downloadFile(src: {
+        path: string;
+        cwd?: string;
+    }, dst: {
+        path: string;
+        cwd?: string;
+    }, opts?: {
+        mkdirRecursive?: boolean;
+        signal?: AbortSignal;
+    }): Promise<string | null>;
+    /** Writes files, making their directories. Relative paths land in the
+     * working directory; `mode` sets permissions. */
+    writeFiles(files: {
+        path: string;
+        content: string | Uint8Array;
+        mode?: number;
+    }[], _opts?: {
+        signal?: AbortSignal;
+    }): Promise<void>;
+    /** The public address of a port listed in `ports`, such as
+     * `https://3000-<id>.runtimehost.com`. A browser sees a one-time page
+     * naming Runtime before the site. */
+    domain(port: number): string;
+    /** Ends the session. A persistent sandbox is paused, keeping its files and
+     * memory, and wakes on the next call or Sandbox.get; any other ends. */
+    stop(opts?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        name: string;
+        status: string;
+    }>;
+    /** Ends the sandbox for good. */
+    delete(opts?: {
+        deleteOrphanSnapshots?: boolean;
+        signal?: AbortSignal;
+    }): Promise<void>;
+    [Symbol.asyncDispose](): Promise<void>;
+    /** Moves the end `duration` milliseconds later (at most an hour ahead of
+     * now on Runtime). */
+    extendTimeout(duration: number, opts?: {
+        signal?: AbortSignal;
+    }): Promise<void>;
+    /** Replaces the network rules; returns the policy given. */
+    updateNetworkPolicy(networkPolicy: NetworkPolicy, _opts?: {
+        signal?: AbortSignal;
+    }): Promise<NetworkPolicy>;
+    /** Changes what Runtime can change on a sandbox: `timeout`, `ports`,
+     * `networkPolicy` and `snapshotExpiration`. Anything else is refused before
+     * anything changes. */
+    update(params: {
+        timeout?: number;
+        ports?: number[];
+        networkPolicy?: NetworkPolicy;
+        snapshotExpiration?: number;
+    } & Record<string, unknown>, _opts?: {
+        signal?: AbortSignal;
+    }): Promise<void>;
+    /** Keeps the sandbox's whole machine as a Runtime snapshot (files, memory
+     * and running processes), then stops the sandbox, as Vercel does. Start
+     * from it with `Sandbox.create({ source: { type: "snapshot", snapshotId } })`. */
+    snapshot(opts?: {
+        expiration?: number;
+        signal?: AbortSignal;
+    }): Promise<Snapshot>;
+    openInteractive(): Promise<never>;
+    getDefaultUser(): Promise<{
+        username: string;
+        group: string;
+    }>;
+    createUser(): Promise<never>;
+    asUser(): never;
+    createGroup(): Promise<never>;
+    addUserToGroup(): Promise<never>;
+    removeUserFromGroup(): Promise<never>;
+    currentSession(): never;
+    listSessions(): Promise<never>;
+    listSnapshots(): Promise<never>;
+}
+/** Milliseconds as whole days for Runtime's retention: 1 to 365, and 0 (no
+ * expiration) as 365. */
+export declare function retentionDays(ms: number): number;
+type ListItem = {
+    name: string;
+    persistent: boolean;
+    createdAt: number;
+    updatedAt: number;
+    currentSessionId: string;
+    status: "pending" | "running" | "stopping" | "stopped";
+    region: string;
+    vcpus: number;
+    memory: number;
+    timeout: number;
+    expiresAt: number;
+    tags: Record<string, string>;
+};
+export {};