@tangle-network/tcloud/dist/sandbox-pIzrBKnd.d.ts

TypeScript SDK and CLI for Tangle Router, Sandbox, model routing, and agent service calls

import { Sandbox } from "@tangle-network/sandbox";
import { AsyncAttestationPolicy, AttestationVerificationResult } from "@tangle-network/tcloud-attestation";
import { AgentProfile } from "@tangle-network/agent-interface";
//#region src/sandbox.d.ts
/**
 * GPU / accelerator request, mirroring `@tangle-network/sandbox`'s
 * `SandboxResources.accelerator` shape (that type is not re-exported from the
 * SDK's public entry, so we declare the structural shape here and forward it
 * verbatim). `kind` is the accelerator class (e.g. 'nvidia-a100'); `count`
 * defaults to 1; `memoryMB` is a minimum device-memory floor when the exact
 * class is flexible.
 */
interface SandboxAccelerator {
  kind: string;
  count?: number;
  memoryMB?: number;
}
type TCloudSandboxTee = 'any' | 'tdx' | 'nitro' | 'sev-snp' | 'phala-dstack' | 'gcp' | 'azure' | (string & {});
interface TCloudSandboxCreateOptions {
  name?: string;
  image?: string;
  environment?: string;
  ssh?: boolean;
  cpu?: number;
  memoryMb?: number;
  diskGb?: number;
  /**
   * GPU / accelerator request for heavy compute workloads (CFD, FEA, PDE,
   * MD, training). Forwarded verbatim to the underlying `@tangle-network/
   * sandbox` `CreateSandboxOptions.resources.accelerator`, which the fleet
   * autoscaler uses to provision a GPU-class host. `{ kind, count?, memoryMB? }`
   * — e.g. `{ kind: 'nvidia-a100', count: 1 }`. Omit for CPU-only sandboxes.
   */
  accelerator?: SandboxAccelerator;
  gitUrl?: string;
  gitRef?: string;
  backend?: 'opencode' | 'claude-code' | 'codex' | 'amp' | (string & {});
  /**
   * Declarative agent profile rendered into `backend.profile` on the
   * underlying `@tangle-network/sandbox` `CreateSandboxOptions`. The
   * profile carries the harness's prompt, tool allowlist, MCP servers
   * to attach, and subagents available for dispatch — everything a
   * coding-agent backend needs to specialize.
   *
   * When set alongside `backend` (string), `backend.type` becomes the
   * type and the profile rides as `backend.profile`. When `backend` is
   * omitted, the SDK applies its default type and consumes the profile
   * as-is.
   *
   * Confidential execution: if `agentProfile.confidential` is set AND
   * `tee` is also requested at the top level, the top-level `tee`
   * wins (it's the explicit op-level requirement). Set one or the
   * other, not both. The SDK fails closed when the operator cannot
   * satisfy the requested TEE.
   */
  agentProfile?: AgentProfile;
  tee?: TCloudSandboxTee;
  sealed?: boolean;
  attestationNonce?: string | 'auto';
  verify?: boolean;
  attestationPolicy?: Omit<AsyncAttestationPolicy, 'expectedNonce'>;
}
interface TCloudSandboxAttestationStatus {
  requested: boolean;
  evidenceReturned: boolean;
  verified: boolean;
  nonceBound: boolean;
  errors: string[];
}
interface TCloudSandboxCreateResult {
  sandbox: unknown;
  attestation?: unknown;
  verification?: AttestationVerificationResult;
  attestationNonce?: string;
  attestationStatus: TCloudSandboxAttestationStatus;
}
interface TCloudTeeAttestationChallenge {
  nonce: string;
  randomHex: string;
  contextHashHex?: string;
}
interface TCloudTeeAttestationHeartbeatSample {
  sequence: number;
  nonce: string;
  context: string;
  attestation: unknown;
  verification: AttestationVerificationResult;
  checkedAt: Date;
}
interface TCloudTeeAttestationHeartbeatOptions {
  tee?: TCloudSandboxTee;
  intervalMs?: number;
  signal?: AbortSignal;
  immediate?: boolean;
  continueOnFailure?: boolean;
  sessionId?: string;
  attestationPolicy?: Omit<AsyncAttestationPolicy, 'expectedNonce'>;
  onSuccess?: (sample: TCloudTeeAttestationHeartbeatSample) => void;
  onFailure?: (error: unknown) => void;
}
interface TCloudTeeAttestationHeartbeat {
  stop(): void;
  ping(context?: string): Promise<TCloudTeeAttestationHeartbeatSample>;
  readonly stopped: boolean;
  readonly failures: number;
  readonly latest: TCloudTeeAttestationHeartbeatSample | undefined;
  readonly done: Promise<void>;
}
interface TCloudSandboxConfig {
  apiKey: string;
  baseUrl?: string;
  timeoutMs?: number;
}
declare class TCloudSandbox {
  private readonly client;
  private readonly apiKey;
  private readonly baseUrl;
  private readonly timeoutMs;
  constructor(config: TCloudSandboxConfig);
  /**
   * The underlying SDK-compatible client (#44): the full
   * `SandboxClient` shape (`create(options?: CreateSandboxOptions)`) that
   * agent-runtime's `runLoop` and SDK-native code expect — already
   * authenticated to the sandbox gateway. `TCloudSandbox.create` remains the
   * convenience wrapper (attestation policy + TEE fallbacks); this exposes
   * the raw surface for callers that need complete `CreateSandboxOptions`.
   */
  sdkClient(): Sandbox;
  create(options: TCloudSandboxCreateOptions): Promise<TCloudSandboxCreateResult>;
  private attachTeeApiFallbacks;
  private fetchTeeAttestation;
  private fetchTeePublicKey;
  private fetchSandboxApi;
}
declare function createTeeAttestationChallenge(context?: string | Uint8Array): TCloudTeeAttestationChallenge;
declare function startTeeAttestationHeartbeat(sandbox: unknown, options?: TCloudTeeAttestationHeartbeatOptions): TCloudTeeAttestationHeartbeat;
declare function buildSandboxCreateOptions(options: TCloudSandboxCreateOptions): any;
declare function shouldVerifyAttestation(options: Pick<TCloudSandboxCreateOptions, 'tee' | 'verify'>): boolean;
declare function generateAttestationNonce(bytes?: number): string;
//#endregion
export { TCloudSandboxCreateOptions as a, TCloudTeeAttestationChallenge as c, TCloudTeeAttestationHeartbeatSample as d, buildSandboxCreateOptions as f, startTeeAttestationHeartbeat as g, shouldVerifyAttestation as h, TCloudSandboxConfig as i, TCloudTeeAttestationHeartbeat as l, generateAttestationNonce as m, TCloudSandbox as n, TCloudSandboxCreateResult as o, createTeeAttestationChallenge as p, TCloudSandboxAttestationStatus as r, TCloudSandboxTee as s, SandboxAccelerator as t, TCloudTeeAttestationHeartbeatOptions as u };