withruntime 0.33.3 → 0.34.0

package/dist/e2b/code-interpreter.d.ts

@@ -1,11 +1,4 @@
-/** `@e2b/code-interpreter`, on Runtime. Change the import:
- *
- *   import { Sandbox } from "withruntime/e2b/code-interpreter";
- *
- * runCode runs in Runtime's interpreter (sandbox.runtime.interpreter):
- * stateful contexts in every E2B interpreter language. */
-import type { Runtime } from "../client.js";
-import type { ConnectionOpts } from "./client.js";
+import { E2B as BaseE2B } from "./index.js";
 import { Sandbox as BaseSandbox } from "./sandbox.js";
 export * from "./index.js";
 export type RunCodeLanguage = "python" | "javascript" | "typescript" | "r" | "java" | "bash" | (string & {});
@@ -135,9 +128,7 @@ export declare class Sandbox extends BaseSandbox {
 }
 export default Sandbox;
 /** E2B's client with bound options, for the code interpreter. */
-export declare class E2B {
+export declare class E2B extends BaseE2B {
+    protected static readonly sandboxClass: typeof BaseSandbox;
     readonly Sandbox: typeof Sandbox;
-    constructor(opts?: Omit<ConnectionOpts, "signal"> & {
-        client?: Runtime;
-    });
 }

package/dist/e2b/code-interpreter.js

@@ -1,5 +1,5 @@
 import { guard, NotSupportedError, SandboxError, TimeoutError } from "./errors.js";
-import { bind } from "./index.js";
+import { E2B as BaseE2B } from "./index.js";
 import { Sandbox as BaseSandbox } from "./sandbox.js";
 export * from "./index.js";
 /** A line of output, as E2B's callbacks receive it. */
@@ -234,9 +234,6 @@ export class Sandbox extends BaseSandbox {
 }
 export default Sandbox;
 /** E2B's client with bound options, for the code interpreter. */
-export class E2B {
-    Sandbox;
-    constructor(opts = {}) {
-        this.Sandbox = bind(Sandbox, opts);
-    }
+export class E2B extends BaseE2B {
+    static sandboxClass = Sandbox;
 }

package/dist/e2b/index.d.ts

@@ -15,9 +15,15 @@ export type { ConnectionOpts, HttpVersion, RuntimeOpts } from "./client.js";
 export { Pty, type PtyCreateOpts, type PtyConnectOpts } from "./pty.js";
 export { Template, TemplateBase, Volume, Secret, waitForPort, waitForURL, waitForProcess, waitForFile, waitForTimeout, SecretPaginator, Git, ReadyCmd, LogEntry, LogEntryStart, LogEntryEnd, defaultBuildLogger, ConnectionConfig, ApiClient, getSignature, ALL_TRAFFIC, VolumeFileType, } from "./unsupported.js";
 export default Sandbox;
-/** E2B's client with bound options: `new E2B({ apiKey }).Sandbox.create()`. */
+/** E2B's client with bound options: `new E2B({ apiKey }).Sandbox.create()`.
+ * Its Secret, Template and Volume refuse, naming Runtime's alternative, as
+ * the top-level exports do. */
 export declare class E2B {
+    protected static readonly sandboxClass: typeof Sandbox;
     readonly Sandbox: typeof Sandbox;
+    readonly Secret: import("./unsupported.js").Unsupported;
+    readonly Template: import("./unsupported.js").Unsupported;
+    readonly Volume: import("./unsupported.js").Unsupported;
     constructor(opts?: Omit<ConnectionOpts, "signal"> & {
         client?: Runtime;
     });

package/dist/e2b/index.js

@@ -1,5 +1,6 @@
 import { clientFor } from "./client.js";
 import { Sandbox } from "./sandbox.js";
+import { Secret, Template, Volume } from "./unsupported.js";
 export { Sandbox, SandboxPaginator, DEFAULT_SHAPE, DEFAULT_TIMEOUT_MS, } from "./sandbox.js";
 export { Commands, CommandHandle, pidOf, } from "./commands.js";
 export { Filesystem, FileType, FilesystemEventType, } from "./filesystem.js";
@@ -7,11 +8,17 @@ export { SandboxError, TimeoutError, InvalidArgumentError, NotEnoughSpaceError,
 export { Pty } from "./pty.js";
 export { Template, TemplateBase, Volume, Secret, waitForPort, waitForURL, waitForProcess, waitForFile, waitForTimeout, SecretPaginator, Git, ReadyCmd, LogEntry, LogEntryStart, LogEntryEnd, defaultBuildLogger, ConnectionConfig, ApiClient, getSignature, ALL_TRAFFIC, VolumeFileType, } from "./unsupported.js";
 export default Sandbox;
-/** E2B's client with bound options: `new E2B({ apiKey }).Sandbox.create()`. */
+/** E2B's client with bound options: `new E2B({ apiKey }).Sandbox.create()`.
+ * Its Secret, Template and Volume refuse, naming Runtime's alternative, as
+ * the top-level exports do. */
 export class E2B {
+    static sandboxClass = Sandbox;
     Sandbox;
+    Secret = Secret;
+    Template = Template;
+    Volume = Volume;
     constructor(opts = {}) {
-        this.Sandbox = bind(Sandbox, opts);
+        this.Sandbox = bind(new.target.sandboxClass, opts);
     }
 }
 /** A subclass whose static calls use `opts`'s key or client unless a call

package/dist/index.d.ts

@@ -18,13 +18,13 @@ export type { BookRoom, RoomBooking, RoomBookingPage } from "./products/reservat
 export type { AuditEvent, AuditPage } from "./products/audit.js";
 export type { Plan, PlanAddOn, PlanChange, PlanIncluded, PlanLimit, PlanNow, Plans, } from "./products/plans.js";
 export type { UsageExportQuery, UsageExportRow, UsageExportPage, } from "./products/observability.js";
-export type { JobSecret, Secret, SecretApiPolicy, SecretGit, SecretGithubApp, SecretRule, SecretScope, SecretUse, SetSecret, } from "./products/secrets.js";
+export type { JobSecret, Secret, SecretApiPolicy, SecretGit, SecretGithubApp, SecretRule, SecretScope, SecretUse, ListSecrets, SetSecret, } from "./products/secrets.js";
 export { SecretPartlyStoredError } from "./products/secrets.js";
 export type { McpCatalogEntry, McpGateway, McpServerRequest } from "./products/mcp.js";
 export type { FileEvent, FileEventType, WatchHandle, WatchNotice, WatchOptions, } from "./products/watch.js";
 export type { Mount, MountBucket } from "./products/mounts.js";
 export type { TailscaleJoin, TailscaleJoined, TailscaleNode, TailscaleStatus, } from "./products/tailscale.js";
-export type { Volume, VolumeBackup, CreateVolume, VolumeAttachment } from "./products/volumes.js";
+export type { Volume, VolumeBackup, VolumeBackupKeep, VolumeBackupSchedule, CreateVolume, VolumeAttachment, } from "./products/volumes.js";
 export type { CreateJob, Job, JobAlert, JobAlertDelivery, JobCompute, JobDefinition, JobLogs, JobRun, JobRunState, JobSchedule, UpdateJob, } from "./products/jobs.js";
 export type { CheckedDomain, DnsRecord, Domain, EgressAddress, TcpPort, Tunnel as PrivateTunnel, TunnelPeer, TunnelPeerCreated, SetUpstreamProxy, UpstreamProxy, } from "./products/network-products.js";
 export type { PrivateNetwork } from "./products/private-network.js";
@@ -78,8 +78,10 @@ export { openWalletAccount, claimWalletAccount, rekeyWalletAccount, type OpenedW
 export type { Topup } from "./products/billing.js";
 export type { NewKey, LimitedKey, LimitedKeyAction, MadeKey, ListedKey, KeyUsage, } from "./products/api-keys.js";
 export type { SsoConnection, SsoStatus } from "./products/sso.js";
-export type { Agent, AgentDefinition, AgentEvent, AgentMemoryEntry, AgentMemoryFile, AgentMemoryHit, AgentMemoryPage, AgentMemoryUsage, AgentMemoryWritten, AgentSession, AgentSessionHandle, AgentSessionState, AgentTemplate, AgentTemplateKey, AgentTrigger, AgentTriggerKind, AgentUse, CreateAgent, CreateAgentTrigger, StartAgentSession, } from "./products/agents.js";
+export type { Agent, AgentAsk, AgentAskState, AgentDefinition, AgentEvent, AgentHeldCall, AgentMemoryEntry, AgentMemoryFile, AgentMemoryHit, AgentMemoryPage, AgentMemoryUsage, AgentMemoryWritten, AgentSession, AgentSessionHandle, AgentSessionState, AgentTemplate, AgentTemplateKey, AgentTrigger, AgentTriggerCall, AgentTriggerCallOutcome, AgentTriggerKind, AgentTriggerRules, AgentUse, AnswerAgentAsk, CreateAgent, CreateAgentTrigger, ListAgentAsks, StartAgentSession, } from "./products/agents.js";
 export { AGENT_TEMPLATES, AGENT_USES } from "./products/agents.js";
 export type { AgentsDeployChange, AgentsDeployOptions, AgentsDeployResult, AgentsFile, AgentsFileAgent, AgentsFileTrigger, AgentsSource, } from "./agents-deploy.js";
 export type { Container, ContainerState, CreateContainer, UpdateContainer, } from "./products/containers.js";
+export type { Browser, BrowserConnectOptions, BrowserInfo, BrowserScreenshot, BrowserScreenshotResult, CreateBrowser, UpdateBrowser, } from "./products/browsers.js";
+export type { CreateDesktop, Desktop, DesktopAct, DesktopState, UpdateDesktop, } from "./products/desktops.js";
 export type { CiFlake, CiFlakeDetail, CiReleaseStep, CiRepository, CiTestResult, ConnectCiRepository, ListCiFlakes, ListCiReleaseSteps, ListCiRepositories, UpdateCiFlake, } from "./products/ci.js";

package/dist/products/agents.d.ts

@@ -51,6 +51,11 @@ export type AgentDefinition = {
      * GEMINI_API_KEY, OPENROUTER_API_KEY, or an OpenAI-compatible endpoint's
      * key with env.OPENAI_BASE_URL). */
     secrets?: string[];
+    /** Claude accounts, 1 to 16 egress secrets' names: subscription tokens,
+     * or API keys for a name holding API_KEY. Each session takes the one with
+     * the most usage left; the review template moves to the next when one is
+     * out of usage, and waits for the soonest reset when all are. */
+    pool?: string[];
     /** MCP servers the harness may reach. */
     mcp?: {
         name: string;
@@ -130,12 +135,90 @@ export type AgentEvent = {
     } & Record<string, unknown>;
     createdAt: string;
 };
+export type AgentAskState = "open" | "answered" | "expired" | "withdrawn" | "closed";
+/** One row of the account's inbox: a question a session's harness needs
+ * answered to go on. Asks of one agent's sessions sharing a memory, with the same `step` are
+ * one row while it is open, and one answer reaches every session asking. */
+export type AgentAsk = {
+    id: string;
+    /** The agent of the session that asked first. */
+    agentId: string;
+    /** What it waits on, in the asker's words. */
+    step: string | null;
+    question: string;
+    /** Why it matters. */
+    why: string | null;
+    options: {
+        label: string;
+        detail?: string;
+    }[];
+    /** The recommended option's label; taken as the answer when it expires. */
+    pick: string | null;
+    /** Who sees it: its agent's labels with the ask's own over them. */
+    labels: Record<string, string>;
+    state: AgentAskState;
+    /** An option's label and/or words; `expired` when the pick was taken at
+     * expiry. */
+    answer: {
+        option?: string;
+        text?: string;
+        expired?: boolean;
+    } | null;
+    /** A key's principal id, or `runtime` for a pick taken at expiry. */
+    answeredBy: string | null;
+    /** The sessions asking it, each with its ask event's seq and the answer
+     * event that woke it. */
+    sessions: {
+        sessionId: string;
+        state: "asking" | "answered" | "expired" | "withdrawn" | "ended";
+        seq: number;
+        answerSeq: number | null;
+    }[];
+    expiresAt: string | null;
+    createdAt: string;
+    updatedAt: string;
+    closedAt: string | null;
+};
+export type ListAgentAsks = {
+    /** Open by default. */
+    state?: AgentAskState[];
+    agent?: string;
+    /** Asks carrying every one of these labels: who sees an ask. */
+    labels?: Record<string, string>;
+    cursor?: string;
+    limit?: number;
+};
+/** An option's label, words, or both. */
+export type AnswerAgentAsk = {
+    option?: string;
+    text?: string;
+};
 export type AgentTriggerKind = "slack" | "github" | "schedule" | "webhook";
+/** A trigger's rules, each optional. */
+export type AgentTriggerRules = {
+    /** Queue order of its sessions when the agent's maxConcurrent is full:
+     * -100 to 100, higher first, then oldest. Default 0. */
+    priority?: number;
+    /** Sessions it may start in an hour; a call past it is held for you.
+     * Joining an open session is never capped. Default none. */
+    maxStartsPerHour?: number;
+    /** A call whose key's last session has ended: "start" a new one (the
+     * default), "note" it in the ended session's log and run nothing, or
+     * "ask" you (the call is held until you start it). */
+    onEnded?: "start" | "note" | "ask";
+    /** Where a held call is told: "email" to who added the trigger (the
+     * default), or "webhook", the account's webhooks' agent.call.held alone. */
+    notify?: "email" | "webhook";
+    /** A webhook's only: the key of a call that sends none, from its JSON's
+     * fields: "{cause}", "{alert.host}:{check}". */
+    key?: string;
+};
 export type AgentTrigger = {
     id: string;
     agentId: string;
     kind: AgentTriggerKind;
     config: Record<string, unknown>;
+    rules: AgentTriggerRules;
     pausedAt: string | null;
     pausedWhy: string | null;
     createdAt: string;
@@ -157,7 +240,7 @@ export type StartAgentSession = {
     key?: string;
     labels?: Record<string, string>;
 };
-export type CreateAgentTrigger = {
+export type CreateAgentTrigger = ({
     kind: "slack";
     config: {
         team: string;
@@ -180,9 +263,48 @@ export type CreateAgentTrigger = {
 } | {
     kind: "webhook";
     config: Record<string, never>;
+}) & {
+    rules?: AgentTriggerRules;
+};
+/** One call to a webhook trigger: its words, and the key and labels of the
+ * session it starts or joins. */
+export type AgentTriggerCall = {
+    text: string;
+    key?: string;
+    labels?: Record<string, string>;
+};
+/** What a call did: started a session, joined its key's open one, was
+ * noted in its key's ended one, or was held for you (`why`). */
+export type AgentTriggerCallOutcome = {
+    outcome: "started" | "joined" | "noted" | "held";
+    sessionId: string | null;
+    seq: number | null;
+    callId: string | null;
+    why: AgentHeldCall["why"] | null;
+    replayed: boolean;
+};
+/** A call a trigger held for you because no session could take it. None is
+ * ever dropped. */
+export type AgentHeldCall = {
+    id: string;
+    triggerId: string;
+    agentId: string;
+    key: string | null;
+    text: string;
+    labels: Record<string, string>;
+    /** The trigger was paused; it had started maxStartsPerHour sessions this
+     * hour; its key's session had ended and onEnded is "ask"; the agent's day
+     * budget was spent; the account's sessions were at their limit; Agents
+     * was closed to the account. */
+    why: "paused" | "rate" | "ended" | "budget" | "quota" | "closed";
+    state: "held" | "started" | "dismissed";
+    sessionId: string | null;
+    notify: "email" | "webhook";
+    createdAt: string;
+    resolvedAt: string | null;
 };
-/** The five harnesses' names, so `templates["claude-code"]` is known to be there. */
-export type AgentTemplateKey = "claude-code" | "codex" | "gemini-cli" | "claude-agent-sdk" | "openai-agents-sdk";
+/** The harnesses' names, so `templates["claude-code"]` is known to be there. */
+export type AgentTemplateKey = "claude-code" | "codex" | "gemini-cli" | "claude-agent-sdk" | "openai-agents-sdk" | "review" | "judge";
 /** A file of an agent's memory (`memory.list`). `scope` is whose: empty for
  * the shared memory, which every session reads (one keeping memory per key
  * reads what you wrote there, and never changes it), or a session key
@@ -240,9 +362,8 @@ export type AgentTemplate = {
     /** How your own subscription logs it in, for your own team's agents, or
      * null when it takes an API key alone. */
     subscription: string | null;
-    definition: {
+    definition: Pick<AgentDefinition, "secrets" | "pool" | "vcpu" | "memoryMiB" | "maxSessionSeconds"> & {
         command: string;
-        secrets: string[];
     };
 };
 /** A use: what an agent is for, merged into a template's definition. */
@@ -257,7 +378,7 @@ export type AgentUse = {
         template: "support" | "team";
     };
 };
-/** The five harnesses (agents-contract.md); tests/agents.test.ts holds them
+/** The harnesses (agents-contract.md); tests/agents.test.ts holds them
  * to packages/cloud-guide/agent-templates.json. */
 export declare const AGENT_TEMPLATES: Readonly<Record<AgentTemplateKey, AgentTemplate>>;
 /** A harness by a key read from a file or a flag, or undefined. */
@@ -321,13 +442,45 @@ export declare function agents(t: Transport): {
          * (`session_open`): stop it first. */
         delete: (id: string, options?: RequestOptions) => Promise<void>;
     };
+    /** The account's inbox: the questions its agents' sessions need answered
+     * to go on, one row per step however many sessions ask it. */
+    asks: {
+        /** Newest first; open ones unless `state` says otherwise. */
+        list: (query?: ListAgentAsks, options?: RequestOptions) => Promise<Page<AgentAsk>>;
+        get: (id: string, options?: RequestOptions) => Promise<AgentAsk>;
+        /** Every session asking it reads the answer next, and wakes. An ask no
+         * longer open is refused with `ask_closed`. */
+        answer: (id: string, answer: AnswerAgentAsk, options?: RequestOptions) => Promise<AgentAsk>;
+    };
     triggers: {
         create: (agent: string, input: CreateAgentTrigger, options?: RequestOptions) => Promise<AgentTrigger>;
         list: (agent: string, options?: RequestOptions) => Promise<AgentTrigger[]>;
-        /** Its events are refused, saying `why`; nothing else is held. */
+        /** Held: a webhook's calls are kept for you (see `held`), saying
+         * `why`; nothing else is held. */
         pause: (id: string, why: string, options?: RequestOptions) => Promise<AgentTrigger>;
         resume: (id: string, options?: RequestOptions) => Promise<AgentTrigger>;
         delete: (id: string, options?: RequestOptions) => Promise<void>;
+        /** Its rules, whole, in place: its secret stays. `{}` is every default. */
+        setRules: (id: string, rules: AgentTriggerRules, options?: RequestOptions) => Promise<AgentTrigger>;
+        /** A webhook trigger's call, as its sender makes it: by the trigger's
+         * secret, never your key. A call with the key of an open session joins
+         * it. Pass `idempotencyKey` to make a retry the same call. */
+        call: (id: string, secret: string, call: AgentTriggerCall, options?: RequestOptions) => Promise<AgentTriggerCallOutcome>;
+        /** Calls it held for you, newest first. */
+        held: (trigger: string, query?: {
+            state?: AgentHeldCall["state"][];
+            cursor?: string;
+            limit?: number;
+        }, options?: RequestOptions) => Promise<Page<AgentHeldCall>>;
+        /** Start a held call: one session with it and every call held for its
+         * key since, oldest first. */
+        startHeld: (id: string, call: string, options?: RequestOptions) => Promise<{
+            session: AgentSession;
+            joined: boolean;
+            calls: number;
+        }>;
+        /** Dismiss a held call: nothing runs. */
+        dismissHeld: (id: string, call: string, options?: RequestOptions) => Promise<AgentHeldCall>;
     };
     /** Its built-in memory: text files kept across sessions, which the
      * agent reads, writes and searches from inside its sessions. A scope is
@@ -363,7 +516,8 @@ export declare function agents(t: Transport): {
         }, options?: RequestOptions) => Promise<boolean>;
     };
     /** The harnesses, as data: claude-code, codex, gemini-cli,
-     * claude-agent-sdk, openai-agents-sdk. */
+     * claude-agent-sdk, openai-agents-sdk, review (a CI/CD agent step's
+     * reviewer) and judge (an agent step held to your instructions alone). */
     templates: Readonly<Record<AgentTemplateKey, AgentTemplate>>;
     /** The uses, as data: support (your customers) and team (your team). */
     uses: Readonly<Record<"team" | "support", AgentUse>>;

package/dist/products/agents.js

@@ -22,7 +22,9 @@ import { Page } from "../page.js";
 const START = 'npx -y @anthropic-ai/claude-code --dangerously-skip-permissions --mcp-config ~/.runtime-agent/mcp.json -p "$(cat ~/.runtime-agent/start.md)"';
 const CODEX = 'npx -y @openai/codex exec --dangerously-bypass-approvals-and-sandbox "$(cat ~/.runtime-agent/start.md)"';
 const GEMINI = 'npx -y @google/gemini-cli --yolo -p "$(cat ~/.runtime-agent/start.md)"';
-/** The five harnesses (agents-contract.md); tests/agents.test.ts holds them
+const REVIEW = "python3 ~/.runtime-agent/runtime-agent review";
+const JUDGE = "python3 ~/.runtime-agent/runtime-agent judge";
+/** The harnesses (agents-contract.md); tests/agents.test.ts holds them
  * to packages/cloud-guide/agent-templates.json. */
 export const AGENT_TEMPLATES = {
     "claude-code": {
@@ -70,6 +72,36 @@ export const AGENT_TEMPLATES = {
         subscription: null,
         definition: { command: "python3 ~/agent.py", secrets: ["OPENAI_API_KEY"] },
     },
+    review: {
+        key: "review",
+        title: "Code review",
+        command: REVIEW,
+        apiKeySecret: "ANTHROPIC_API_KEY",
+        apiKeyHost: "api.anthropic.com",
+        subscription: "a token per account: run `claude setup-token` on your own computer (Pro/Max) for each, store each with `runtime secrets set CLAUDE_1` scoped to api.anthropic.com, then name them all in pool (--pool CLAUDE_1 --pool CLAUDE_2)",
+        definition: {
+            command: REVIEW,
+            pool: ["ANTHROPIC_API_KEY"],
+            vcpu: 2,
+            memoryMiB: 2048,
+            maxSessionSeconds: 1800,
+        },
+    },
+    judge: {
+        key: "judge",
+        title: "Your rules",
+        command: JUDGE,
+        apiKeySecret: "ANTHROPIC_API_KEY",
+        apiKeyHost: "api.anthropic.com",
+        subscription: "a token per account, as for review: `runtime secrets set CLAUDE_1` scoped to api.anthropic.com for each, then name them all in pool; its instructions are the rules that block",
+        definition: {
+            command: JUDGE,
+            pool: ["ANTHROPIC_API_KEY"],
+            vcpu: 2,
+            memoryMiB: 2048,
+            maxSessionSeconds: 1800,
+        },
+    },
 };
 /** A harness by a key read from a file or a flag, or undefined. */
 export function agentTemplate(key) {
@@ -166,6 +198,28 @@ export function agents(t) {
         });
         return new Page(page.data, page.nextCursor, (cursor) => listSessions({ ...query, cursor }, options));
     };
+    const listAsks = async (query = {}, options) => {
+        const { labels, ...rest } = query;
+        const page = await t.json({
+            method: "GET",
+            path: "/v1/agents/asks",
+            query: {
+                ...rest,
+                ...(labels ? { label: Object.entries(labels).map(([k, v]) => `${k}:${v}`) } : {}),
+            },
+            ...options,
+        });
+        return new Page(page.data, page.nextCursor, (cursor) => listAsks({ ...query, cursor }, options));
+    };
+    const listHeld = async (trigger, query = {}, options) => {
+        const page = await t.json({
+            method: "GET",
+            path: `/v1/agents/triggers/${enc(trigger)}/held`,
+            query,
+            ...options,
+        });
+        return new Page(page.data, page.nextCursor, (cursor) => listHeld(trigger, { ...query, cursor }, options));
+    };
     const listMemory = async (agent, query = {}, options) => {
         const page = await t.json({
             method: "GET",
@@ -227,6 +281,21 @@ export function agents(t) {
                 });
             },
         },
+        /** The account's inbox: the questions its agents' sessions need answered
+         * to go on, one row per step however many sessions ask it. */
+        asks: {
+            /** Newest first; open ones unless `state` says otherwise. */
+            list: listAsks,
+            get: (id, options) => t.json({ method: "GET", path: `/v1/agents/asks/${enc(id)}`, ...options }),
+            /** Every session asking it reads the answer next, and wakes. An ask no
+             * longer open is refused with `ask_closed`. */
+            answer: (id, answer, options) => t.json({
+                method: "POST",
+                path: `/v1/agents/asks/${enc(id)}/answer`,
+                body: answer,
+                ...options,
+            }),
+        },
         triggers: {
             create: (agent, input, options) => t.json({
                 method: "POST",
@@ -239,7 +308,8 @@ export function agents(t) {
                 path: `/v1/agents/${enc(agent)}/triggers`,
                 ...options,
             })).data,
-            /** Its events are refused, saying `why`; nothing else is held. */
+            /** Held: a webhook's calls are kept for you (see `held`), saying
+             * `why`; nothing else is held. */
             pause: (id, why, options) => t.json({
                 method: "POST",
                 path: `/v1/agents/triggers/${enc(id)}/pause`,
@@ -259,6 +329,40 @@ export function agents(t) {
                     ...options,
                 });
             },
+            /** Its rules, whole, in place: its secret stays. `{}` is every default. */
+            setRules: (id, rules, options) => t.json({
+                method: "PATCH",
+                path: `/v1/agents/triggers/${enc(id)}`,
+                body: { rules },
+                ...options,
+            }),
+            /** A webhook trigger's call, as its sender makes it: by the trigger's
+             * secret, never your key. A call with the key of an open session joins
+             * it. Pass `idempotencyKey` to make a retry the same call. */
+            call: (id, secret, call, options) => t.json({
+                method: "POST",
+                path: `/v1/agents/triggers/${enc(id)}/calls`,
+                body: call,
+                bearer: secret,
+                ...options,
+            }),
+            /** Calls it held for you, newest first. */
+            held: listHeld,
+            /** Start a held call: one session with it and every call held for its
+             * key since, oldest first. */
+            startHeld: (id, call, options) => t.json({
+                method: "POST",
+                path: `/v1/agents/triggers/${enc(id)}/held/${enc(call)}/start`,
+                body: {},
+                ...options,
+            }),
+            /** Dismiss a held call: nothing runs. */
+            dismissHeld: (id, call, options) => t.json({
+                method: "POST",
+                path: `/v1/agents/triggers/${enc(id)}/held/${enc(call)}/dismiss`,
+                body: {},
+                ...options,
+            }),
         },
         /** Its built-in memory: text files kept across sessions, which the
          * agent reads, writes and searches from inside its sessions. A scope is
@@ -292,7 +396,8 @@ export function agents(t) {
             })).deleted,
         },
         /** The harnesses, as data: claude-code, codex, gemini-cli,
-         * claude-agent-sdk, openai-agents-sdk. */
+         * claude-agent-sdk, openai-agents-sdk, review (a CI/CD agent step's
+         * reviewer) and judge (an agent step held to your instructions alone). */
         templates: AGENT_TEMPLATES,
         /** The uses, as data: support (your customers) and team (your team). */
         uses: AGENT_USES,

package/dist/products/apps.d.ts

@@ -39,7 +39,42 @@ export type StatefulSettings = {
     /** Seconds a stopped copy has after SIGTERM to exit. */
     stopGraceSeconds: number;
 };
-export type App = AppSettings & StatefulSettings & {
+/** How an App's new version goes live: every copy together (at_once, the
+ * default), or staged: one copy of it beside the live version's, then about
+ * 10%, 50% and all of them, each stage judged on its visitors' errors and
+ * speed before the next. A stage that does worse goes back: its copies
+ * finish their requests and stop, then the deploy fails (deploy_stage_failed)
+ * and the live version never stops serving. */
+export type ReleaseStages = "at_once" | "staged";
+export type ReleaseSettings = {
+    releaseStages: ReleaseStages;
+    /** 60 to 3600 seconds; defaults to 300. How long each stage runs once its
+     * copies serve before it is judged. */
+    releaseSoakSeconds: number;
+};
+/** An App's staged release under way, or its last. */
+export type StagedRelease = {
+    version: number;
+    /** The version live when it began, serving beside it. */
+    from: number;
+    /** rolling: its stages go live; back: a stage did worse and its copies
+     * leave; done: every copy runs it; failed: it went back (or its copies
+     * failed their health check) and the version failed; ended: another
+     * deploy or a rollback took its place. */
+    state: "rolling" | "back" | "done" | "failed" | "ended";
+    stage: number;
+    stages: number;
+    /** Copies of the new version the stage serves beside the old version's. */
+    copies: number;
+    /** Copies the release walks to. */
+    of: number;
+    soakSeconds: number;
+    /** Its last step, in words. */
+    detail: string;
+    startedAt: number;
+    updatedAt: number;
+};
+export type App = AppSettings & StatefulSettings & ReleaseSettings & {
     id: string;
     name: string | null;
     /** Its address for life, its name then its account's:
@@ -58,6 +93,8 @@ export type App = AppSettings & StatefulSettings & {
     } | null;
     liveVersion: number | null;
     previousVersion: number | null;
+    /** Its staged release under way, or its last; null before its first. */
+    stagedRelease: StagedRelease | null;
     /** While a copy waits for room in its region: its account's lane, its
      * place in line (1 is next), how many wait ahead by lane, and why.
      * Higher lanes get room first. Absent while nothing of it waits. */
@@ -69,7 +106,7 @@ export type AppLine = {
     ahead: Record<string, number>;
     words: string;
 };
-export type RuntimeFunction = Omit<App, "minCopies" | keyof StatefulSettings> & {
+export type RuntimeFunction = Omit<App, "minCopies" | keyof StatefulSettings | keyof ReleaseSettings | "stagedRelease"> & {
     minCopies: 0;
     /** 250 to 5000 ms: at most how long a copy stays awake after its last request ends. */
     sleepAfterMs: number;
@@ -125,14 +162,18 @@ export type CreateApp = Omit<CreateFunction, "minCopies" | "sleepAfterMs"> & {
     volume?: AppVolume;
     /** 0 to 900; defaults to 30. */
     stopGraceSeconds?: number;
+    /** Defaults to "at_once"; see ReleaseStages. */
+    releaseStages?: ReleaseStages;
+    /** 60 to 3600; defaults to 300. */
+    releaseSoakSeconds?: number;
 };
-export type UpdateApp = Partial<AppSettings & StatefulSettings> & {
+export type UpdateApp = Partial<AppSettings & StatefulSettings & ReleaseSettings> & {
     name?: string | null;
     labels?: Record<string, string>;
     /** Only Functions sleep on this rule; an App is refused it. */
     sleepAfterMs?: never;
 };
-export type UpdateFunction = Omit<UpdateApp, "minCopies" | "sleepAfterMs" | keyof StatefulSettings> & {
+export type UpdateFunction = Omit<UpdateApp, "minCopies" | "sleepAfterMs" | keyof StatefulSettings | keyof ReleaseSettings> & {
     minCopies?: never;
     /** 250 to 5000 ms; see CreateFunction.sleepAfterMs. */
     sleepAfterMs?: number;
@@ -159,7 +200,7 @@ export type AppDeploy = {
 } | {
     state: "failed" | "superseded";
     error: {
-        code: "deploy_build_failed" | "deploy_health_failed" | "deploy_stop_failed" | "deploy_switch_failed" | "deploy_superseded";
+        code: "deploy_build_failed" | "deploy_health_failed" | "deploy_stop_failed" | "deploy_stage_failed" | "deploy_switch_failed" | "deploy_superseded";
         message: string;
         hint: string;
         lastOutput: string;

package/dist/products/browsers.d.ts

@@ -40,6 +40,28 @@ export type BrowserInfo = {
     liveViewUrl?: string;
     hint?: string;
 };
+export type BrowserScreenshot = {
+    /** An http(s) address, opened in a new tab that is closed after. */
+    url?: string;
+    /** The whole page, not only the window. */
+    fullPage?: boolean;
+    format?: "png" | "jpeg";
+    /** 0 to 10000 ms after the page loads, for late scripts. */
+    waitMs?: number;
+};
+export type BrowserScreenshotResult = {
+    /** Where the page ended, after redirects. */
+    url: string;
+    title: string;
+    /** The page's HTTP status; null for the page already shown. */
+    status: number | null;
+    mimeType: "image/png" | "image/jpeg";
+    bytes: number;
+    width: number | null;
+    height: number | null;
+    /** The image. */
+    base64: string;
+};
 export type BrowserConnectOptions = {
     playwright: [endpointURL: string, options: {
         headers: Record<string, string>;
@@ -66,6 +88,10 @@ export declare function browsers(t: Transport): {
     list: (query?: ListBrowsers, options?: RequestOptions) => Promise<Page<Browser>>;
     /** Change a browser's name or labels without changing its compute settings. */
     update(id: string, input: UpdateBrowser, options?: RequestOptions): Promise<Browser>;
+    /** Open `url` in a new tab and shoot it once it loads (without `url`, what
+     * the browser shows now); the image is `base64`, its page's url, title
+     * and HTTP status beside it. Runs inside the browser's own sandbox. */
+    screenshot(id: string, input?: BrowserScreenshot, options?: RequestOptions): Promise<BrowserScreenshotResult>;
     /** End a browser by id; pass RequestOptions to bound or deduplicate the request. */
     delete: (id: string, options?: RequestOptions) => Promise<void>;
 };