withruntime 0.33.0 → 0.33.2

package/COMPATIBILITY.md

@@ -329,8 +329,8 @@ share the file path and `compat.provider` resource label.
 ## Evidence that can be repeated locally
 
 Run `bun test tests/compat` from the SDK package and run `bun run check-types`.
-The test run compiles unchanged typed consumer bodies from
-`tests/compat/consumers/workflows.ts.txt` against all ten TypeScript adapters,
+The type check (`tests/compat/consumers/tsconfig.json`) compiles unchanged typed consumer bodies from
+`tests/compat/consumers/workflows.ts` against all ten TypeScript adapters,
 including E2B's interpreter. Run
 `bun tests/compat/check-consumers.ts <verified-cache>` to compile the
 same bodies against the pinned upstream declarations; the script checks each

package/dist/ci/index.d.ts

@@ -8,3 +8,6 @@ import { Runtime, type RuntimeOptions } from "../client.js";
 export type * from "../products/ci.js";
 /** `runtime.ci` of a client made with `options`. */
 export declare function ci(options?: RuntimeOptions): Runtime["ci"];
+/** GitHub Actions workflows and a CircleCI config as a `runtime.yml`, with
+ * notes on what was not carried over (`runtime ci import`). */
+export { importCi, type CiImport, type CiSource } from "../ci-import.js";

package/dist/ci/index.js

@@ -9,3 +9,6 @@ import { Runtime } from "../client.js";
 export function ci(options) {
     return new Runtime(options).ci;
 }
+/** GitHub Actions workflows and a CircleCI config as a `runtime.yml`, with
+ * notes on what was not carried over (`runtime ci import`). */
+export { importCi } from "../ci-import.js";

package/dist/ci-cli.d.ts

@@ -5,6 +5,6 @@ type Out = {
     write: (text: string) => void;
     error: (text: string) => void;
 };
-export declare const CI_HELP = "runtime ci <command>\n\n  CI/CD checks each push and pull request of a connected GitHub repository in\n  sandboxes, as the steps its config file names. A fork's pull request waits\n  until a writer re-runs it on GitHub. In a private beta: outside it, each\n  command says how to ask to join.\n\n  connect <owner/name> [--branch main] [--config runtime.yml] [--installation <id>]\n          [--trust <app-slug>[bot]]... [--name <name>]\n                                              Connect a repository; prints its id. Takes a full key.\n                                              --trust runs that App's pushes as its own from the start\n  repos [ls] [--all]                          Connected repositories, with the Apps each trusts;\n                                              --all: disconnected ones too\n  repos trust <repoId | owner/name> <app-slug>[bot]...\n                                              Run that App's pushes as the repository's own code,\n                                              keeping the Apps it trusts already\n  repos untrust <repoId | owner/name> <app-slug>[bot]...\n                                              Stop trusting those Apps, keeping the rest\n  disconnect <repoId | owner/name>            Stop checking it; its checks still going are cancelled\n  ls [--repository <repoId>] [--branch <name>] [--commit <sha>] [--pr <number>]\n     [--state <state>]... [--limit 20]        Checks, newest first, with their jobs by state\n  get <checkId>                               One check and its jobs in plan order\n  logs <jobId>                                A job's output, its last 256 KiB, and its sandboxes\n  tests <repoId> [--quarantined]              Its test files: time, recent outcomes, quarantine\n  flakes [--repository <repoId>] [--all]      Flaky tests: each quarantined (or still gating), its\n                                              owner and 48-hour deadline; --all: ended ones too\n  flake <flakeId>                             One flaky test: its proof, owner, and recent runs\n  flake prove <flakeId>                       Its 100 proof runs again at main's next commit\n  flake hand <flakeId> <login | org/team>     Hand it to someone else\n  flake delete <flakeId> --reason <why>       Say why its test is deleted; it ends once main\n                                              no longer holds the file\n\n  A failed job's sandbox may be kept paused: `runtime sandboxes wake <id>`, then\n  `runtime sandboxes shell <id>` to look around where it failed.\n\nExamples\n  runtime ci connect acme/web --config .runtime/ci.yml\n  runtime ci repos trust acme/web acme-bot[bot]\n  runtime ci ls --commit $(git rev-parse HEAD)\n  runtime ci logs <jobId>\n";
+export declare const CI_HELP = "runtime ci <command>\n\n  CI/CD checks each push and pull request of a connected GitHub repository in\n  sandboxes, as the steps its config file names. A fork's pull request waits\n  until a writer re-runs it on GitHub. In a private beta: outside it, each\n  command says how to ask to join.\n\n  import [dir] [--write] [--force]            This folder's GitHub Actions workflows and CircleCI\n                                              config as a runtime.yml: printed, or written with\n                                              --write; what isn't carried over is noted at its top.\n                                              Needs no key and sends nothing\n  connect <owner/name> [--branch main] [--config runtime.yml] [--installation <id>]\n          [--trust <app-slug>[bot]]... [--name <name>]\n                                              Connect a repository; prints its id. Takes a full key.\n                                              --trust runs that App's pushes as its own from the start\n  repos [ls] [--all]                          Connected repositories, with the Apps each trusts;\n                                              --all: disconnected ones too\n  repos trust <repoId | owner/name> <app-slug>[bot]...\n                                              Run that App's pushes as the repository's own code,\n                                              keeping the Apps it trusts already\n  repos untrust <repoId | owner/name> <app-slug>[bot]...\n                                              Stop trusting those Apps, keeping the rest\n  repos undo <repoId | owner/name> on|off     When main's check fails, find the first commit that\n                                              fails it and open a pull request reverting it, which\n                                              lands once its check passes. Off until turned on;\n                                              takes an owner's or admin's full key\n  disconnect <repoId | owner/name>            Stop checking it; its checks still going are cancelled\n  ls [--repository <repoId>] [--branch <name>] [--commit <sha>] [--pr <number>]\n     [--state <state>]... [--limit 20]        Checks, newest first, with their jobs by state\n  get <checkId>                               One check and its jobs in plan order\n  cancel <checkId>                            Cancel a queued or running check: its jobs end,\n                                              its machines are let go, GitHub is told\n  logs <jobId>                                A job's output, its last 256 KiB, and its sandboxes\n  tests <repoId> [--quarantined]              Its test files: time, recent outcomes, quarantine\n  flakes [--repository <repoId>] [--all]      Flaky tests: each quarantined (or still gating), its\n                                              owner and 48-hour deadline; --all: ended ones too\n  flake <flakeId>                             One flaky test: its proof, owner, and recent runs\n  flake prove <flakeId>                       Its 100 proof runs again at main's next commit\n  flake hand <flakeId> <login | org/team>     Hand it to someone else\n  flake delete <flakeId> --reason <why>       Say why its test is deleted; it ends once main\n                                              no longer holds the file\n\n  A failed job's sandbox may be kept paused: `runtime sandboxes wake <id>`, then\n  `runtime sandboxes shell <id>` to look around where it failed.\n\nExamples\n  runtime ci import --write\n  runtime ci connect acme/web --config .runtime/ci.yml\n  runtime ci repos trust acme/web acme-bot[bot]\n  runtime ci repos undo acme/web on\n  runtime ci ls --commit $(git rev-parse HEAD)\n  runtime ci logs <jobId>\n";
 export declare function ciCommand(argv: string[], out: Out, client: () => Promise<Runtime>, kit: CliKit): Promise<number>;
 export {};

package/dist/ci-cli.js

@@ -1,3 +1,6 @@
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { importCi } from "./ci-import.js";
 import { me, named } from "./cli-name.js";
 import { ci, } from "./products/ci.js";
 export const CI_HELP = `runtime ci <command>
@@ -7,6 +10,10 @@ export const CI_HELP = `runtime ci <command>
   until a writer re-runs it on GitHub. In a private beta: outside it, each
   command says how to ask to join.
 
+  import [dir] [--write] [--force]            This folder's GitHub Actions workflows and CircleCI
+                                              config as a runtime.yml: printed, or written with
+                                              --write; what isn't carried over is noted at its top.
+                                              Needs no key and sends nothing
   connect <owner/name> [--branch main] [--config runtime.yml] [--installation <id>]
           [--trust <app-slug>[bot]]... [--name <name>]
                                               Connect a repository; prints its id. Takes a full key.
@@ -18,10 +25,16 @@ export const CI_HELP = `runtime ci <command>
                                               keeping the Apps it trusts already
   repos untrust <repoId | owner/name> <app-slug>[bot]...
                                               Stop trusting those Apps, keeping the rest
+  repos undo <repoId | owner/name> on|off     When main's check fails, find the first commit that
+                                              fails it and open a pull request reverting it, which
+                                              lands once its check passes. Off until turned on;
+                                              takes an owner's or admin's full key
   disconnect <repoId | owner/name>            Stop checking it; its checks still going are cancelled
   ls [--repository <repoId>] [--branch <name>] [--commit <sha>] [--pr <number>]
      [--state <state>]... [--limit 20]        Checks, newest first, with their jobs by state
   get <checkId>                               One check and its jobs in plan order
+  cancel <checkId>                            Cancel a queued or running check: its jobs end,
+                                              its machines are let go, GitHub is told
   logs <jobId>                                A job's output, its last 256 KiB, and its sandboxes
   tests <repoId> [--quarantined]              Its test files: time, recent outcomes, quarantine
   flakes [--repository <repoId>] [--all]      Flaky tests: each quarantined (or still gating), its
@@ -36,8 +49,10 @@ export const CI_HELP = `runtime ci <command>
   \`runtime sandboxes shell <id>\` to look around where it failed.
 
 Examples
+  runtime ci import --write
   runtime ci connect acme/web --config .runtime/ci.yml
   runtime ci repos trust acme/web acme-bot[bot]
+  runtime ci repos undo acme/web on
   runtime ci ls --commit $(git rev-parse HEAD)
   runtime ci logs <jobId>
 `;
@@ -64,6 +79,46 @@ const STATES = ["queued", "running", "passed", "failed", "cancelled"];
 const ownerOf = (f) => f.owner === null
     ? "nobody found"
     : `@${f.owner.login}${f.owner.pullRequest === null ? "" : ` (#${f.owner.pullRequest})`}`;
+/** `runtime ci import [dir] [--write] [--force]`: the folder's GitHub Actions
+ * workflows and CircleCI config as a `runtime.yml`, printed or written. */
+async function importCommand(argv, out, kit) {
+    const args = kit.parse(argv, ["write", "force"], []);
+    const root = args.positional[0] ?? ".";
+    const files = [];
+    const workflows = join(root, ".github", "workflows");
+    if (existsSync(workflows))
+        for (const name of readdirSync(workflows).sort())
+            if (/\.ya?ml$/.test(name))
+                files.push({
+                    path: `.github/workflows/${name}`,
+                    text: readFileSync(join(workflows, name), "utf8"),
+                });
+    const circle = join(root, ".circleci", "config.yml");
+    if (existsSync(circle))
+        files.push({ path: ".circleci/config.yml", text: readFileSync(circle, "utf8") });
+    if (!files.length)
+        throw kit.usage(`${root} has neither .github/workflows/*.yml nor .circleci/config.yml to import.`);
+    const made = importCi(files);
+    if (!made.yaml) {
+        out.error(made.notes.join("\n"));
+        throw kit.usage("No job of these runs on a push or a pull request: nothing to write.");
+    }
+    if (!kit.has(args, "write")) {
+        out.write(out.json ? JSON.stringify({ ...made, read: files.map((f) => f.path) }) : made.yaml.trimEnd());
+        return 0;
+    }
+    const target = join(root, "runtime.yml");
+    if (existsSync(target) && !kit.has(args, "force"))
+        throw kit.usage(`${target} is there already: --force writes over it.`);
+    writeFileSync(target, made.yaml);
+    const notes = made.notes.length
+        ? `, ${made.notes.length} notes on what was not carried over at its top`
+        : "";
+    out.write(out.json
+        ? JSON.stringify({ ...made, read: files.map((f) => f.path), written: target })
+        : `${target}: ${made.steps.length} steps from ${files.length === 1 ? "1 file" : `${files.length} files`}${notes}. Push it, then \`${me} ci connect <owner/name>\`.`);
+    return 0;
+}
 export async function ciCommand(argv, out, client, kit) {
     const { parse, flag, has, need, table, usage, unknown } = kit;
     const [verb, ...rest] = argv;
@@ -72,6 +127,9 @@ export async function ciCommand(argv, out, client, kit) {
         print(named(CI_HELP), { usage: named(CI_HELP) });
         return 0;
     }
+    // Reads and writes this folder's files only: no key, nothing sent.
+    if (verb === "import")
+        return importCommand(rest, out, kit);
     const api = ci((await client()).transport);
     const whole = (value, what) => {
         if (value === undefined)
@@ -128,6 +186,18 @@ export async function ciCommand(argv, out, client, kit) {
                 print(`${repo.repository} trusts ${trusted(repo)}.`, repo);
                 return 0;
             }
+            if (action === "undo") {
+                const id = need(more[0], "the repository's id or owner/name");
+                const say = need(more[1], "on or off");
+                if (say !== "on" && say !== "off")
+                    throw usage(`${say} is neither on nor off: ${me} ci repos undo ${id} on`);
+                const found = await api.repositories.find(id);
+                const repo = await api.repositories.setUndo(found?.id ?? id, say === "on");
+                print(repo.undoCulprits
+                    ? `${repo.repository}: when ${repo.productionBranch}'s check fails, its culprit is found and a pull request reverting it opens.`
+                    : `${repo.repository}: a failing ${repo.productionBranch} is reported, never undone.`, repo);
+                return 0;
+            }
             if (action === "connect")
                 return ciCommand(["connect", ...more], out, client, kit);
             if (action === "disconnect" || action === "rm")
@@ -139,6 +209,7 @@ export async function ciCommand(argv, out, client, kit) {
                     "connect",
                     "trust",
                     "untrust",
+                    "undo",
                     "disconnect",
                 ]);
             const args = parse(listing, ["all"], []);
@@ -148,13 +219,14 @@ export async function ciCommand(argv, out, client, kit) {
             })).toArray(Infinity);
             print(all.length
                 ? table([
-                    ["ID", "REPOSITORY", "BRANCH", "CONFIG", "TRUSTED APPS", "STATE"],
+                    ["ID", "REPOSITORY", "BRANCH", "CONFIG", "TRUSTED APPS", "UNDO", "STATE"],
                     ...all.map((r) => [
                         r.id,
                         r.repository,
                         r.productionBranch,
                         r.configPath,
                         trusted(r),
+                        r.undoCulprits ? "on" : "off",
                         r.state,
                     ]),
                 ])
@@ -220,6 +292,11 @@ export async function ciCommand(argv, out, client, kit) {
             ].join("\n"), check);
             return 0;
         }
+        case "cancel": {
+            const check = await api.checks.cancel(need(rest[0], "a check's id (runtime ci ls)"));
+            print(`${check.repository} ${check.commit.slice(0, 12)} ${where(check)}: ${check.state}${check.reason ? ` (${check.reason})` : ""}`, check);
+            return 0;
+        }
         case "logs":
         case "job": {
             const job = await api.jobs.get(need(rest[0], "a job's id (runtime ci get <checkId>)"));
@@ -323,6 +400,7 @@ export async function ciCommand(argv, out, client, kit) {
         "disconnect",
         "ls",
         "get",
+        "cancel",
         "logs",
         "tests",
         "flakes",

package/dist/ci-import.d.ts

@@ -0,0 +1,23 @@
+export type CiSource = {
+    path: string;
+    text: string;
+};
+export type CiImport = {
+    /** The `runtime.yml`, its notes on top as comments; `null` when no job runs on a push or pull request. */
+    yaml: string | null;
+    /** What was not carried over, or carried differently, one line each. */
+    notes: string[];
+    /** The steps written, by name. */
+    steps: string[];
+};
+/** Every combination of a GitHub `strategy.matrix`, its `exclude` and `include` applied. */
+export declare function matrixCells(matrix: Record<string, unknown> | undefined): Record<string, string>[];
+/** Files a cache key hashes: GitHub's `hashFiles('a', 'b')` or CircleCI's `{{ checksum "a" }}`. */
+export declare function cacheFiles(key: string): string[];
+/** Whether a line installs the project's own dependencies and nothing else:
+ * `npm ci` or `pip install -r requirements.txt`, never `npm install pino@9`,
+ * which one matrix cell asks and another doesn't. */
+export declare function installsOnly(line: string): boolean;
+/** `runtime.yml` from GitHub Actions workflows (`.github/workflows/*.yml`)
+ * and a CircleCI config (`.circleci/config.yml`), each given with its path. */
+export declare function importCi(files: CiSource[]): CiImport;

package/dist/ci-import.js

@@ -0,0 +1,565 @@
+import { parse, stringify } from "yaml";
+/** The most a step's `timeout:` may say, in seconds: GitHub's own 6 hours. */
+const MOST_TIMEOUT_S = 6 * 3600;
+const MOST_STEPS = 64;
+const MOST_CACHE = 32;
+// A project's own install: run once in setup and kept in the warm machine,
+// so a check runs only its tests.
+const INSTALL = /^(npm (ci|install|i)|yarn( install)?|pnpm (install|i)|bun (install|i)|pip3? install|python3? -m pip install|poetry install|uv sync|pipenv install|go mod download|cargo fetch|bundle install|composer install|mix deps\.get)(?=\s|$)/;
+// Actions whose work a Runtime machine already did: the commit is checked
+// out, and Node, Bun, Python, git and a C compiler are on it.
+const DONE = /^actions\/checkout@/;
+const TOOLS = /^(actions\/setup-(node|python|go|java|dotnet)|oven-sh\/setup-bun|pnpm\/action-setup|dtolnay\/rust-toolchain|actions-rs\/toolchain|ruby\/setup-ruby|astral-sh\/setup-uv|denoland\/setup-deno)@/;
+const CACHE = /^actions\/cache(\/restore|\/save)?@/;
+const HAS = "a machine has Node, Bun, Python, git and a C compiler; install anything else in setup";
+const stepName = (raw) => raw
+    .replace(/[^A-Za-z0-9 _.:-]+/g, " ")
+    .replace(/\s+/g, " ")
+    .trim()
+    .replace(/^[^A-Za-z0-9]+/, "")
+    .slice(0, 63)
+    .trim() || "job";
+const envName = (k) => /^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(k) && !k.startsWith("RUNTIME_");
+const quoteSh = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+/** A value as one shell word: its literal text single-quoted, each variable
+ * `expand` put in (`${RUNTIME_CI_COMMIT}` for `${{ github.sha }}`) in double
+ * quotes, so the shell fills it in and nothing else in the value is read. */
+const wordSh = (parts) => parts.map((p) => (typeof p === "string" ? quoteSh(p) : `"\${${p.v}}"`)).join("") || "''";
+const asText = (v) => v === null || v === undefined
+    ? ""
+    : typeof v === "string"
+        ? v
+        : typeof v === "number" || typeof v === "boolean"
+            ? `${v}`
+            : JSON.stringify(v);
+/** An action's name with its pinned ref left off: `actions/cache@<sha>` is `actions/cache`. */
+const action = (uses) => uses.split("@")[0];
+/** Every combination of a GitHub `strategy.matrix`, its `exclude` and `include` applied. */
+export function matrixCells(matrix) {
+    if (!matrix || typeof matrix !== "object")
+        return [{}];
+    const keys = Object.keys(matrix).filter((k) => k !== "include" && k !== "exclude");
+    let cells = keys.length ? [{}] : [];
+    for (const key of keys) {
+        const values = matrix[key];
+        if (!Array.isArray(values))
+            continue;
+        cells = cells.flatMap((c) => values.map((v) => ({ ...c, [key]: asText(v) })));
+    }
+    const fits = (cell, rule) => Object.entries(rule).every(([k, v]) => cell[k] === v);
+    const text = (rule) => Object.fromEntries(Object.entries(rule && typeof rule === "object" ? rule : {}).map(([k, v]) => [k, asText(v)]));
+    for (const rule of matrix.exclude ?? [])
+        cells = cells.filter((c) => !fits(c, text(rule)));
+    for (const rule of matrix.include ?? []) {
+        const add = text(rule);
+        const base = Object.fromEntries(Object.entries(add).filter(([k]) => keys.includes(k)));
+        const matched = Object.keys(base).length ? cells.filter((c) => fits(c, base)) : [];
+        if (matched.length)
+            for (const c of matched)
+                Object.assign(c, add);
+        else
+            cells.push(add);
+    }
+    return cells.length ? cells : [{}];
+}
+/** Files a cache key hashes: GitHub's `hashFiles('a', 'b')` or CircleCI's `{{ checksum "a" }}`. */
+export function cacheFiles(key) {
+    const out = [];
+    for (const m of key.matchAll(/hashFiles\(([^)]*)\)/g))
+        for (const f of m[1].matchAll(/['"]([^'"]+)['"]/g))
+            out.push(f[1]);
+    for (const m of key.matchAll(/checksum\s+"([^"]+)"/g))
+        out.push(m[1]);
+    return out.filter((f) => !f.includes("{{") && !f.startsWith("/") && !f.startsWith("~"));
+}
+/** Whether a line installs the project's own dependencies and nothing else:
+ * `npm ci` or `pip install -r requirements.txt`, never `npm install pino@9`,
+ * which one matrix cell asks and another doesn't. */
+export function installsOnly(line) {
+    const t = line.trim();
+    const m = INSTALL.exec(t);
+    if (!m || /[|;&<>$`]/.test(t))
+        return false;
+    const words = t.slice(m[0].length).trim().split(/\s+/).filter(Boolean);
+    for (let i = 0; i < words.length; i++) {
+        const w = words[i];
+        if (["-r", "--requirement", "-e", "--editable", "-c"].includes(w))
+            i++;
+        else if (!w.startsWith("-") && w !== ".")
+            return false;
+    }
+    return true;
+}
+class Writer {
+    steps = [];
+    setup = [];
+    cache = new Set();
+    notes = [];
+    note(where, what) {
+        const line = `${where}: ${what}`.replace(/\s+/g, " ");
+        if (!this.notes.includes(line))
+            this.notes.push(line);
+    }
+    /** A step's lines, its installs moved to setup when they run there as
+     * they did in the step: `movable` (the step names no folder and no env of
+     * its own) and no line before it changes folder. Setup runs at the
+     * repository's root with no step's env, so `npm ci` under
+     * `working-directory: web`, or after `cd web`, stays in its step. */
+    lines(script, movable = true) {
+        const kept = [];
+        let moved = !movable;
+        for (const line of script.split("\n")) {
+            if (/(^|[;&|(]\s*)(cd|pushd)\b/.test(line.trim()))
+                moved = true;
+            if (!moved && installsOnly(line)) {
+                if (!this.setup.includes(line.trim()))
+                    this.setup.push(line.trim());
+            }
+            else
+                kept.push(line.replace(/\s+$/, ""));
+        }
+        while (kept.length && !kept[kept.length - 1].trim())
+            kept.pop();
+        while (kept.length && !kept[0].trim())
+            kept.shift();
+        return kept;
+    }
+    unique(name) {
+        let n = stepName(name);
+        for (let i = 2; this.steps.some((s) => s.name === n); i++)
+            n = stepName(`${name} ${i}`);
+        return n;
+    }
+}
+/** A job's steps as one script. Each step of GitHub's or CircleCI's ran in a
+ * shell of its own, so a `cd` or an `export` in one never reached the next:
+ * with more than one, each is a subshell. Undefined when none runs anything. */
+function script(blocks) {
+    const runs = blocks.filter((b) => b.some((l) => l.trim() && !l.trim().startsWith("#")));
+    if (!runs.length)
+        return undefined;
+    const lines = blocks.flatMap((b) => runs.length > 1 && runs.includes(b) ? ["(", ...b.map((l) => `  ${l}`), ")"] : b);
+    return ["set -e", ...lines].join("\n");
+}
+/** `${{ ... }}` in a GitHub value: matrix cells, the commit and the branch
+ * filled in; a secret, or anything else only GitHub knows, leaves the value
+ * out (undefined), and `bad` is told what. */
+function expand(value, cell, bad) {
+    const parts = expandParts(value, cell, bad);
+    return parts?.map((p) => (typeof p === "string" ? p : `\${${p.v}}`)).join("");
+}
+/** `expand`'s value as its literal parts and the variables put in for
+ * GitHub's values, for a value written as one shell word (`wordSh`). */
+function expandParts(value, cell, bad) {
+    let ok = true;
+    const parts = [];
+    const text = (t) => {
+        if (!t)
+            return;
+        const last = parts[parts.length - 1];
+        if (typeof last === "string")
+            parts[parts.length - 1] = last + t;
+        else
+            parts.push(t);
+    };
+    let at = 0;
+    for (const m of value.matchAll(/\$\{\{([\s\S]*?)\}\}/g)) {
+        text(value.slice(at, m.index));
+        at = m.index + m[0].length;
+        const expr = m[1].trim();
+        const c = /^matrix\.([A-Za-z0-9_-]+)$/.exec(expr);
+        const e = /^env\.([A-Za-z_][A-Za-z0-9_]*)$/.exec(expr);
+        if (c && cell[c[1]] !== undefined)
+            text(cell[c[1]]);
+        else if (expr === "github.sha")
+            parts.push({ v: "RUNTIME_CI_COMMIT" });
+        else if (expr === "github.ref_name" || expr === "github.head_ref")
+            parts.push({ v: "RUNTIME_CI_BRANCH" });
+        else if (expr === "github.workspace")
+            parts.push({ v: "PWD" });
+        else if (e)
+            parts.push({ v: e[1] });
+        else {
+            const s = /^secrets\.([A-Za-z_][A-Za-z0-9_]*)$/.exec(expr);
+            bad(s ? `secret ${s[1]}` : m[0]);
+            ok = false;
+        }
+    }
+    text(value.slice(at));
+    return ok ? parts : undefined;
+}
+/** A YAML mapping, or an empty one for anything else. */
+const obj = (v) => (v && typeof v === "object" && !Array.isArray(v) ? v : {});
+const list = (v) => (Array.isArray(v) ? v : []);
+/** A key that is one name or a list of them (`needs: a` or `needs: [a, b]`). */
+const names = (v) => (typeof v === "string" ? [v] : list(v).map(asText));
+const runsOnPush = (on) => {
+    const events = typeof on === "string" ? [on] : Array.isArray(on) ? on : Object.keys(obj(on));
+    return events.some((e) => e === "push" || e === "pull_request" || e === "pull_request_target");
+};
+function read(w, file) {
+    try {
+        return obj(parse(file.text));
+    }
+    catch (error) {
+        w.note(file.path, `not read: ${error.message.split("\n")[0]}`);
+        return undefined;
+    }
+}
+function fromActions(w, file) {
+    const doc = read(w, file);
+    if (!doc?.jobs)
+        return;
+    if (!runsOnPush(doc.on)) {
+        w.note(file.path, "skipped: it runs on neither push nor pull_request");
+        return;
+    }
+    const top = obj(doc.env);
+    const named = new Map();
+    const made = [];
+    for (const [id, raw] of Object.entries(obj(doc.jobs))) {
+        const job = obj(raw);
+        const where = `${file.path} ${id}`;
+        if (job.uses) {
+            w.note(where, `skipped: a reusable workflow (${asText(job.uses)}); import that file instead`);
+            continue;
+        }
+        const runsOn = asText(job["runs-on"]);
+        if (job.if)
+            w.note(where, `its if (${asText(job.if)}) is not carried: it runs on every check`);
+        const timeout = jobTimeout(w, where, job["timeout-minutes"]);
+        if (job["continue-on-error"])
+            w.note(where, "continue-on-error is not carried: a failure fails the check");
+        const dir = asText(obj(obj(job.defaults).run)["working-directory"]);
+        const cells = matrixCells(obj(obj(job.strategy).matrix));
+        const jobSteps = list(job.steps).map(obj);
+        // What the kept commands read: a matrix key only a left-out setup
+        // action read (a Node version, say) names no step.
+        const reads = JSON.stringify([
+            job.env,
+            job.services,
+            jobSteps.map((s) => [s.run, s.env, s["working-directory"]]),
+        ]);
+        const steps = [];
+        const bodies = new Set();
+        for (const cell of cells) {
+            const os = expand(runsOn, cell, () => { }) ?? runsOn;
+            if (/macos|windows/i.test(os)) {
+                w.note(where, `${os} is left out: Runtime machines are Linux`);
+                continue;
+            }
+            const bad = (what) => w.note(where, `${what} is not carried; set it in the step's env or a Runtime secret`);
+            const env = {};
+            for (const [k, v] of Object.entries({ ...top, ...obj(job.env) })) {
+                const value = expand(asText(v), cell, bad);
+                if (value !== undefined && envName(k))
+                    env[k] = value;
+            }
+            const blocks = [];
+            for (const [name, raw] of Object.entries(obj(job.services))) {
+                const svc = obj(raw);
+                const image = expand(asText(typeof raw === "string" ? raw : svc.image), cell, bad);
+                if (!image)
+                    continue;
+                const flags = Object.entries(obj(svc.env)).map(([k, v]) => `-e ${k}=${wordSh(expandParts(asText(v), cell, bad) ?? [])}`);
+                const ports = list(svc.ports).map(asText);
+                const moved = ports.some((p) => {
+                    const [a, b] = p.split(":");
+                    return b !== undefined && a !== b;
+                });
+                const net = moved ? ports.map((p) => `-p ${p}`) : ["--network host"];
+                blocks.push([
+                    ["docker run -d --name", stepName(name).replace(/ /g, "-"), ...net, ...flags, image].join(" "),
+                ]);
+                w.note(where, `service ${name} starts with Docker in the step; wait for it as its health check did`);
+            }
+            for (const s of jobSteps) {
+                const uses = asText(s.uses);
+                if (uses) {
+                    if (DONE.test(uses))
+                        continue;
+                    if (TOOLS.test(uses))
+                        w.note(where, `${action(uses)} is not needed: ${HAS}`);
+                    else if (CACHE.test(uses))
+                        for (const f of cacheFiles(asText(obj(s.with).key)))
+                            w.cache.add(f);
+                    else {
+                        w.note(where, `action ${action(uses)} is not carried; run its commands in the step`);
+                        blocks.push([`# was: uses: ${action(uses)}`]);
+                    }
+                    continue;
+                }
+                if (!s.run)
+                    continue;
+                const said = asText(s.name ?? s.run).split("\n")[0];
+                if (s.if && /failure\(\)|cancelled\(\)/.test(asText(s.if))) {
+                    w.note(where, `step "${said}" ran only on failure; left out`);
+                    continue;
+                }
+                if (s.if)
+                    w.note(where, `step "${said}": its if (${asText(s.if)}) is not carried`);
+                const run = expand(asText(s.run), cell, bad);
+                if (run === undefined) {
+                    blocks.push([`# left out (it needs a secret or a GitHub value): ${said}`]);
+                    continue;
+                }
+                const exports = [];
+                for (const [k, v] of Object.entries(obj(s.env))) {
+                    const value = expandParts(asText(v), cell, bad);
+                    if (value !== undefined && envName(k))
+                        exports.push(`export ${k}=${wordSh(value)}`);
+                }
+                const wd = asText(s["working-directory"]) || dir;
+                const lines = w.lines(run, !wd && !exports.length);
+                if (!lines.length)
+                    continue;
+                blocks.push([...(wd ? [`cd ${quoteSh(wd)}`] : []), ...exports, ...lines]);
+            }
+            const run = script(blocks);
+            if (!run) {
+                w.note(where, "has no command left to run here; not written");
+                continue;
+            }
+            // Cells that differ only in what a left-out action read run the same
+            // commands: one step runs them.
+            const body = JSON.stringify([run, env]);
+            if (bodies.has(body)) {
+                w.note(where, "matrix cells that differ only in a tool's version run once, on the machine's own");
+                continue;
+            }
+            bodies.add(body);
+            const label = Object.entries(cell)
+                .filter(([k]) => reads.includes(`matrix.${k}`))
+                .map(([, v]) => v)
+                .join(" ");
+            const title = asText(job.name || id).includes("${{") ? id : asText(job.name || id);
+            steps.push({
+                name: w.unique(label ? `${title} ${label}` : title),
+                run,
+                needs: [],
+                env,
+                ...(timeout ? { timeout } : {}),
+            });
+        }
+        made.push({ steps, needs: names(job.needs) });
+        named.set(id, steps.map((s) => s.name));
+    }
+    for (const m of made)
+        for (const s of m.steps) {
+            s.needs = m.needs.flatMap((n) => named.get(n) ?? []);
+            w.steps.push(s);
+        }
+}
+/** A GitHub job's `timeout-minutes` as a step's `timeout:` in seconds;
+ * undefined (the default, 6 hours as GitHub's) when it says none, or a value
+ * that is not a number, which is noted. */
+function jobTimeout(w, where, raw) {
+    if (raw === undefined || raw === null || raw === "")
+        return undefined;
+    const minutes = Number(raw);
+    if (!Number.isFinite(minutes) || minutes <= 0) {
+        w.note(where, `timeout-minutes ${asText(raw)} is not carried; the step has the default 6 hours`);
+        return undefined;
+    }
+    const seconds = Math.ceil(minutes * 60);
+    if (seconds > MOST_TIMEOUT_S) {
+        w.note(where, `asks ${asText(raw)} minutes; a step here runs at most 360, as on GitHub`);
+        return MOST_TIMEOUT_S;
+    }
+    return seconds;
+}
+// CircleCI's resource classes by vCPUs: medium is 2, large 4, xlarge 8, 2xlarge 16.
+const CIRCLE_MACHINES = {
+    small: "2cpu",
+    medium: "2cpu",
+    large: "4cpu",
+    xlarge: "8cpu",
+    "2xlarge": "16cpu",
+    "2xlarge+": "16cpu",
+};
+const KEPT_BY_CHECK = [
+    "store_artifacts",
+    "store_test_results",
+    "persist_to_workspace",
+    "attach_workspace",
+];
+function fromCircle(w, file) {
+    const doc = read(w, file);
+    if (!doc)
+        return;
+    const jobs = obj(doc.jobs);
+    const commands = obj(doc.commands);
+    if (doc.orbs)
+        w.note(file.path, `orbs (${Object.keys(obj(doc.orbs)).join(", ")}) are not carried; run their commands in the step`);
+    // The jobs each workflow runs, with what each requires; every job when no workflow says.
+    const runs = [];
+    const workflows = Object.entries(obj(doc.workflows))
+        .filter(([k, v]) => k !== "version" && obj(v).jobs)
+        .map(([k, v]) => [k, obj(v)]);
+    for (const [wf, flow] of workflows) {
+        if (flow.triggers) {
+            w.note(`${file.path} ${wf}`, "skipped: a scheduled workflow");
+            continue;
+        }
+        for (const entry of list(flow.jobs)) {
+            if (typeof entry === "string")
+                runs.push({ job: entry, name: entry, requires: [] });
+            else
+                for (const [job, raw] of Object.entries(obj(entry))) {
+                    const opts = obj(raw);
+                    if (opts.type === "approval") {
+                        w.note(`${file.path} ${job}`, "an approval hold is not carried");
+                        continue;
+                    }
+                    if (opts.matrix)
+                        w.note(`${file.path} ${job}`, "its matrix is not carried; one step is written");
+                    runs.push({ job, name: asText(opts.name ?? job), requires: names(opts.requires) });
+                }
+        }
+    }
+    if (!workflows.length)
+        for (const job of Object.keys(jobs))
+            runs.push({ job, name: job, requires: [] });
+    const named = new Map();
+    const pending = [];
+    for (const r of runs) {
+        if (named.has(r.name))
+            continue;
+        const where = `${file.path} ${r.job}`;
+        if (!jobs[r.job]) {
+            w.note(where, "is an orb's job; not carried");
+            continue;
+        }
+        const job = obj(jobs[r.job]);
+        if (job.macos || job.windows) {
+            w.note(where, "skipped: Runtime machines are Linux");
+            continue;
+        }
+        const env = {};
+        for (const [k, v] of Object.entries(obj(job.environment)))
+            if (envName(k))
+                env[k] = asText(v);
+        const blocks = [];
+        const docker = list(job.docker).map(obj);
+        if (docker[0]?.image)
+            w.note(where, `ran in ${asText(docker[0].image)}; here ${HAS}`);
+        for (const svc of docker.slice(1)) {
+            const image = asText(svc.image);
+            const flags = Object.entries(obj(svc.environment)).map(([k, v]) => `-e ${k}=${quoteSh(asText(v))}`);
+            const name = stepName(asText(svc.name) || (image.split(":")[0].split("/").pop() ?? "")).replace(/ /g, "-");
+            blocks.push([["docker run -d --name", name, "--network host", ...flags, image].join(" ")]);
+            w.note(where, `service ${image} starts with Docker in the step; wait for it before the tests`);
+        }
+        const dir = asText(job.working_directory);
+        const walk = (steps, depth) => {
+            for (const raw of steps) {
+                const [kind, opts] = typeof raw === "string"
+                    ? [raw, undefined]
+                    : (Object.entries(obj(raw))[0] ?? ["", undefined]);
+                // The checkout is made; Docker runs on the machine itself.
+                if (kind === "checkout" || kind === "setup_remote_docker")
+                    continue;
+                if (kind === "run") {
+                    const o = obj(opts);
+                    const cmd = asText(typeof opts === "string" ? opts : o.command);
+                    if (o.when === "on_fail") {
+                        w.note(where, `step "${asText(o.name ?? cmd.split("\n")[0])}" ran only on failure; left out`);
+                        continue;
+                    }
+                    const exports = Object.entries(obj(o.environment))
+                        .filter(([k]) => envName(k))
+                        .map(([k, v]) => `export ${k}=${quoteSh(asText(v))}`);
+                    // A step's working_directory is under the job's, which is where
+                    // the checkout went: here, the repository's root.
+                    const wd = asText(o.working_directory);
+                    const cd = wd && !/^[~/$]/.test(wd) && wd !== "." ? [`cd ${quoteSh(wd)}`] : [];
+                    const lines = w.lines(cmd, !cd.length && !exports.length);
+                    if (!lines.length)
+                        continue;
+                    if (wd && !cd.length && wd !== "." && wd !== dir)
+                        w.note(where, `working_directory ${wd} is not carried; the step runs at the repository's root`);
+                    blocks.push([...cd, ...exports, ...lines]);
+                }
+                else if (kind === "restore_cache" || kind === "save_cache") {
+                    const o = obj(opts);
+                    for (const key of [o.key, ...list(o.keys)])
+                        for (const f of cacheFiles(asText(key)))
+                            w.cache.add(f);
+                }
+                else if (commands[kind] && depth < 4) {
+                    if (opts)
+                        w.note(where, `command ${kind}'s parameters are not filled in`);
+                    walk(list(obj(commands[kind]).steps), depth + 1);
+                }
+                else if (KEPT_BY_CHECK.includes(kind)) {
+                    w.note(where, `${kind} is not carried: a check keeps each job's log, and a failed job's sandbox`);
+                }
+                else if (kind) {
+                    w.note(where, `${kind} (an orb's or unknown step) is not carried; run its commands in the step`);
+                    blocks.push([`# was: ${kind}`]);
+                }
+            }
+        };
+        walk(list(job.steps), 0);
+        const run = script(blocks);
+        if (!run) {
+            w.note(where, "has no command left to run here; not written");
+            continue;
+        }
+        const machine = CIRCLE_MACHINES[asText(job.resource_class).replace(/^.*\./, "")];
+        const step = {
+            name: w.unique(r.name),
+            run,
+            needs: [],
+            env,
+            ...(machine && machine !== "4cpu" ? { machine } : {}),
+        };
+        named.set(r.name, step.name);
+        pending.push({ step, requires: r.requires });
+    }
+    for (const p of pending) {
+        p.step.needs = p.requires.map((n) => named.get(n)).filter((n) => !!n);
+        w.steps.push(p.step);
+    }
+}
+/** `runtime.yml` from GitHub Actions workflows (`.github/workflows/*.yml`)
+ * and a CircleCI config (`.circleci/config.yml`), each given with its path. */
+export function importCi(files) {
+    const w = new Writer();
+    for (const f of [...files].sort((a, b) => a.path.localeCompare(b.path)))
+        if (f.path.includes(".circleci/"))
+            fromCircle(w, f);
+        else
+            fromActions(w, f);
+    if (!w.steps.length)
+        return { yaml: null, notes: w.notes, steps: [] };
+    if (w.steps.length > MOST_STEPS) {
+        w.note("runtime.yml", `${w.steps.length} steps; a file holds ${MOST_STEPS}, the rest are left out`);
+        w.steps = w.steps.slice(0, MOST_STEPS);
+    }
+    const cache = [...w.cache].slice(0, MOST_CACHE);
+    const doc = {};
+    if (w.setup.length)
+        doc.setup = w.setup.join("\n");
+    if (cache.length)
+        doc.cache = cache;
+    doc.steps = w.steps.map((s) => ({
+        name: s.name,
+        run: s.run,
+        ...(s.needs.length ? { needs: s.needs } : {}),
+        ...(s.machine ? { machine: s.machine } : {}),
+        ...(s.timeout ? { timeout: s.timeout } : {}),
+        ...(Object.keys(s.env).length ? { env: s.env } : {}),
+    }));
+    const head = [
+        `# Written by \`runtime ci import\` from ${files.map((f) => f.path).join(", ")}.`,
+        ...(w.notes.length
+            ? ["# Not carried over, or carried differently:", ...w.notes.map((n) => `#  - ${n}`)]
+            : []),
+    ];
+    return {
+        yaml: `${head.join("\n")}\n${stringify(doc, { lineWidth: 0 })}`,
+        notes: w.notes,
+        steps: w.steps.map((s) => s.name),
+    };
+}

package/dist/keys.js

@@ -1,5 +1,5 @@
 import { execFile } from "node:child_process";
-import { generateKeyPair, privateDecrypt } from "node:crypto";
+import { privateDecrypt } from "node:crypto";
 import { hostname } from "node:os";
 import { promisify } from "node:util";
 import { connectionOrigins } from "./credentials.js";
@@ -7,6 +7,7 @@ import { RuntimeError } from "./errors.js";
 import { named } from "./cli-name.js";
 import { sandboxIdentityHeaders } from "./identity.js";
 import { describeRoute, envFetch } from "./proxy.js";
+import { sealing } from "./sealing.js";
 const KEY = /^rtcloud_([a-f0-9-]{36})_[A-Za-z0-9_-]{43}$/;
 /** How often to ask whether the owner has answered. The website answers
  * "pending" to anything faster than every 4.5 seconds. */
@@ -79,16 +80,19 @@ export async function createKey(request, env, options = {}) {
     async function post(path, body, key) {
         const address = `${origins.auth}/api/connect/${path}`;
         let response;
+        // The sandbox's identity first: its own lookup has its own deadline, and
+        // the call's 20 s start when the call does.
+        const identity = await sandboxIdentityHeaders();
         try {
             response = await fetcher(address, {
                 method: "POST",
                 redirect: "error",
-                signal: AbortSignal.timeout(20_000),
                 headers: {
                     "content-type": "application/json",
                     ...(key ? { authorization: `Bearer ${key}` } : {}),
-                    ...(await sandboxIdentityHeaders()),
+                    ...identity,
                 },
+                signal: AbortSignal.timeout(20_000),
                 body: JSON.stringify(body),
             });
         }
@@ -101,11 +105,7 @@ export async function createKey(request, env, options = {}) {
             throw failure(response.status === 429 ? "rate_limited" : "key_request_failed", typeof result.error === "string" ? result.error : "Runtime could not take this request.", response.status);
         return result;
     }
-    const pair = await promisify(generateKeyPair)("rsa", {
-        modulusLength: 2048,
-        publicKeyEncoding: { type: "spki", format: "pem" },
-        privateKeyEncoding: { type: "pkcs8", format: "pem" },
-    });
+    const pair = await sealing.pair();
     const started = await post("start", {
         purpose: "key",
         agentName: name,

package/dist/login.js

@@ -1,5 +1,5 @@
 import { execFile } from "node:child_process";
-import { generateKeyPair, privateDecrypt } from "node:crypto";
+import { privateDecrypt } from "node:crypto";
 import { hostname } from "node:os";
 import { promisify } from "node:util";
 import { me, named } from "./cli-name.js";
@@ -7,6 +7,7 @@ import { Runtime } from "./client.js";
 import { checkBrowserOrigins, connectionOrigins, connectionStore } from "./credentials.js";
 import { sandboxIdentityHeaders } from "./identity.js";
 import { describeRoute, envFetch } from "./proxy.js";
+import { sealing } from "./sealing.js";
 class ConnectionError extends Error {
     status;
     constructor(status, message) {
@@ -73,16 +74,19 @@ function connection(env, options) {
     async function request(path, body, key) {
         let response;
         const address = `${origins.auth}/api/connect/${path}`;
+        // The sandbox's identity first: its own lookup has its own deadline, and
+        // the call's 20 s start when the call does.
+        const identity = await sandboxIdentityHeaders();
         try {
             response = await fetcher(address, {
                 method: "POST",
                 redirect: "error",
-                signal: AbortSignal.timeout(20_000),
                 headers: {
                     "content-type": "application/json",
                     ...(key ? { authorization: `Bearer ${key}` } : {}),
-                    ...(await sandboxIdentityHeaders()),
+                    ...identity,
                 },
+                signal: AbortSignal.timeout(20_000),
                 body: JSON.stringify(body ?? {}),
             });
         }
@@ -259,11 +263,7 @@ export async function beginDeviceLogin(env, agentName, options = {}) {
     let pending = await store.readPending();
     const resumed = pending !== null;
     if (!pending) {
-        const pair = await promisify(generateKeyPair)("rsa", {
-            modulusLength: 2048,
-            publicKeyEncoding: { type: "spki", format: "pem" },
-            privateKeyEncoding: { type: "pkcs8", format: "pem" },
-        });
+        const pair = await sealing.pair();
         // The computer's own name goes to the approval page beside the code, so an
         // owner can tell this request from a link somebody else started.
         const started = await request("start", {

package/dist/products/ci.d.ts

@@ -27,6 +27,9 @@ export type CiRepository = {
     /** The GitHub Apps (`<app-slug>[bot]`, lowercase, sorted) whose pushes run
      * as the code of someone who can write. */
     trustedApps: string[];
+    /** Whether a red production branch's culprit is undone by a pull request
+     * CI/CD opens: off until `setUndo` turns it on. */
+    undoCulprits: boolean;
     state: "connected" | "disconnected";
 };
 export type ConnectCiRepository = {
@@ -302,6 +305,12 @@ export declare function ci(t: Transport): {
         trust: (id: string, apps: string[], options?: RequestOptions) => Promise<CiRepository>;
         /** Takes Apps off those it trusts, keeping the rest. */
         untrust: (id: string, apps: string[], options?: RequestOptions) => Promise<CiRepository>;
+        /** Turn on (or off) the undo of a red production branch's culprit:
+         * when main's check fails, CI/CD finds the first commit that fails it
+         * and opens a pull request reverting it, which lands once its own
+         * check passes. Off until set; only an owner's or admin's full key
+         * sets it. */
+        setUndo: (id: string, on: boolean, options?: RequestOptions) => Promise<CiRepository>;
         /** Disconnect: its checks still going are cancelled; what ended stays. */
         disconnect: (id: string, options?: RequestOptions) => Promise<CiRepository>;
     };
@@ -310,6 +319,9 @@ export declare function ci(t: Transport): {
         list: (query?: ListCiChecks, options?: RequestOptions) => Promise<Page<CiCheck>>;
         /** A check with its jobs in plan order. */
         get: (id: string, options?: RequestOptions) => Promise<CiCheckDetail>;
+        /** Cancel a queued or running check: its jobs end and its machines
+         * are let go. A check that has ended is answered as it is. */
+        cancel: (id: string, options?: RequestOptions) => Promise<CiCheckDetail>;
     };
     jobs: {
         /** A job with the tail of its log and the sandboxes it ran in. */

package/dist/products/ci.js

@@ -61,6 +61,17 @@ export function ci(t) {
                 const drop = new Set(apps.map((a) => a.toLowerCase()));
                 return setTrustedApps(repo.id, repo.trustedApps.filter((a) => !drop.has(a)), options);
             },
+            /** Turn on (or off) the undo of a red production branch's culprit:
+             * when main's check fails, CI/CD finds the first commit that fails it
+             * and opens a pull request reverting it, which lands once its own
+             * check passes. Off until set; only an owner's or admin's full key
+             * sets it. */
+            setUndo: (id, on, options) => t.json({
+                method: "POST",
+                path: `${at("/v1/ci/repositories", id)}:update`,
+                body: { undoCulprits: on },
+                ...options,
+            }),
             /** Disconnect: its checks still going are cancelled; what ended stays. */
             disconnect: (id, options) => t.json({
                 method: "DELETE",
@@ -73,6 +84,13 @@ export function ci(t) {
             list: (query = {}, options) => paged("/v1/ci/checks", query, options),
             /** A check with its jobs in plan order. */
             get: (id, options) => t.json({ method: "GET", path: at("/v1/ci/checks", id), ...options }),
+            /** Cancel a queued or running check: its jobs end and its machines
+             * are let go. A check that has ended is answered as it is. */
+            cancel: (id, options) => t.json({
+                method: "POST",
+                path: `${at("/v1/ci/checks", id)}:cancel`,
+                ...options,
+            }),
         },
         jobs: {
             /** A job with the tail of its log and the sandboxes it ran in. */

package/dist/sealing.d.ts

@@ -0,0 +1,6 @@
+export declare const sealing: {
+    pair: () => Promise<{
+        publicKey: string;
+        privateKey: string;
+    }>;
+};

package/dist/sealing.js

@@ -0,0 +1,14 @@
+import { generateKeyPair } from "node:crypto";
+import { promisify } from "node:util";
+/* The key pair a browser approval seals its answer to (RSA-OAEP, SHA-256):
+   a login's credential, or a key asked for with `keys create`. Made fresh
+   for each request, so only this process can open what the page sends. An
+   object, so a test file can make one pair and reuse it: each takes 80 ms of
+   CPU to make, most of the login and key tests' time (24 October 2026). */
+export const sealing = {
+    pair: () => promisify(generateKeyPair)("rsa", {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: "spki", format: "pem" },
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    }),
+};

package/dist/transport.d.ts

@@ -1,5 +1,5 @@
 import { RuntimeError } from "./errors.js";
-export declare const VERSION = "0.33.0";
+export declare const VERSION = "0.33.2";
 export declare const DEFAULT_BASE_URL = "https://api.withruntime.com";
 /** Runtime's API as code inside a Runtime sandbox reaches it: the sandbox's
  * own host sends each request on to DEFAULT_BASE_URL over HTTPS. The API runs

package/dist/transport.js

@@ -1,7 +1,7 @@
 import { ConnectionError, DELIBERATE, errorFor, NOTHING_RAN, RuntimeError, WAITS_FOR_ROOM, } from "./errors.js";
 import { describeRoute, envFetch, openWebSocket, untrustedCertificate } from "./proxy.js";
 import { warningText } from "./product-renames.js";
-export const VERSION = "0.33.0";
+export const VERSION = "0.33.2";
 export const DEFAULT_BASE_URL = "https://api.withruntime.com";
 /** Runtime's API as code inside a Runtime sandbox reaches it: the sandbox's
  * own host sends each request on to DEFAULT_BASE_URL over HTTPS. The API runs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "withruntime",
-  "version": "0.33.0",
+  "version": "0.33.2",
   "license": "Apache-2.0",
   "mcpName": "com.withruntime/runtime",
   "type": "module",
@@ -197,8 +197,8 @@
   },
   "scripts": {
     "build": "node ../typescript-config/tsc5.mjs -p tsconfig.build.json",
-    "check-types": "tsgo --noEmit",
-    "lint": "oxlint -c ../eslint-config/oxlint.json --ignore-pattern 'dist/**' --ignore-pattern 'tests/fixtures/modal/**'",
+    "check-types": "tsgo --noEmit && tsgo -p tests/compat/consumers",
+    "lint": "oxlint -c ../eslint-config/oxlint.json --ignore-pattern 'dist/**' --ignore-pattern 'tests/fixtures/modal/**' --ignore-pattern 'tests/compat/consumers/**'",
     "test": "bun test"
   },
   "devDependencies": {