Bring Your Own Infrastructure

import { Theazo } from 'theazo'

// Managed — Theazo uses its own E2B account (zero config)
const theazo = new Theazo({ apiKey: 'th_live_...' })

// Direct BYOI — Theazo calls E2B using your key
// credentialRef points to a secret stored in the Theazo secrets vault
const theazo = new Theazo({
  apiKey: 'th_live_...',
  compute: {
    provider: 'e2b',
    credentialRef: 'e2b_key',  // PUT /v1/secrets/e2b_key first
  },
})

// Agents now provision on your E2B account, at your E2B rates
const session = await theazo.sessions.forUser('user_123')
const result  = await session.run('researcher', 'analyze competitor pricing')

import { Theazo } from 'theazo'

const theazo = new Theazo({
  apiKey: 'th_live_...',
  compute: {
    provider: 'custom',
    endpoint: 'https://compute.agentco.com/sandbox',
    credentialRef: 'compute_token',  // PUT /v1/secrets/compute_token first
  },
})

// Headers sent on every request from Theazo to your endpoint:
Authorization: Bearer {token}           // the credential from your secrets vault
X-Theazo-Signature: sha256={hmac}       // HMAC-SHA256 of request body with shared secret
X-Theazo-Timestamp: {unix_ms}           // for replay protection — reject if > 5min old

// Express.js — example webhook endpoint implementation
import express from 'express'
import crypto from 'crypto'

const app = express()
app.use(express.json())

const SHARED_SECRET = process.env.THEAZO_WEBHOOK_SECRET!

function verifySignature(body: string, sig: string, timestamp: string): boolean {
  const now = Date.now()
  const ts = parseInt(timestamp, 10)
  if (Math.abs(now - ts) > 5 * 60 * 1000) return false   // replay protection

  const expected = 'sha256=' + crypto
    .createHmac('sha256', SHARED_SECRET)
    .update(body)
    .digest('hex')

  return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))
}

// POST /create — provision a new sandbox
app.post('/sandbox/create', async (req, res) => {
  const rawBody = JSON.stringify(req.body)
  const sig = req.headers['x-theazo-signature'] as string
  const ts  = req.headers['x-theazo-timestamp'] as string

  if (!verifySignature(rawBody, sig, ts)) {
    return res.status(401).json({ error: 'invalid_signature' })
  }

  const { runtime, timeout, envVars } = req.body

  // Your infra provisioning logic here:
  const sandboxId = await provisionContainer({ runtime, timeout, envVars })

  res.json({ sandboxId, metadata: { runtime } })
})

// POST /:id/exec — run a command
app.post('/sandbox/:id/exec', async (req, res) => {
  // ... verify signature, then:
  const { command } = req.body
  const result = await runInContainer(req.params.id, command)

  res.json({
    stdout:   result.stdout,
    stderr:   result.stderr,
    exitCode: result.exitCode,
  })
})

// DELETE /:id — destroy
app.delete('/sandbox/:id', async (req, res) => {
  await destroyContainer(req.params.id)
  res.json({ ok: true })
})

// No model config — Theazo uses its own Anthropic/OpenAI account
const theazo = new Theazo({ apiKey: 'th_live_...' })

const session = await theazo.sessions.forUser('user_123')
const result  = await session.run('researcher', 'summarize this report')
// result.cost includes compute + model tokens (billed to your Theazo account)

import { Theazo } from 'theazo'

// Store your key in the secrets vault first:
// PUT /v1/secrets/anthropic_key  { value: 'sk-ant-...' }

const theazo = new Theazo({
  apiKey: 'th_live_...',
  models: {
    provider:      'anthropic',
    credentialRef: 'anthropic_key',   // references secrets vault entry
  },
})

// Per-session override — useful for multi-tenant setups where each customer
// has their own Anthropic account:
const session = await theazo.sessions.forUser('user_123', {
  models: {
    provider:      'openai',
    credentialRef: 'user_123_openai_key',
  },
})

import { Theazo } from 'theazo'

// OpenRouter — 200+ models behind one key
const theazo = new Theazo({
  apiKey: 'th_live_...',
  models: {
    provider:      'openai-compatible',
    endpoint:      'https://openrouter.ai/api/v1',
    credentialRef: 'openrouter_key',
    model:         'anthropic/claude-sonnet-4-5',
  },
})

// Azure OpenAI
const theazo = new Theazo({
  apiKey: 'th_live_...',
  models: {
    provider:      'openai-compatible',
    endpoint:      'https://my-org.openai.azure.com/openai/deployments/gpt-4o',
    credentialRef: 'azure_openai_key',
    model:         'gpt-4o',
  },
})

// Self-hosted vLLM or Ollama
const theazo = new Theazo({
  apiKey: 'th_live_...',
  models: {
    provider:      'openai-compatible',
    endpoint:      'http://my-gpu-server:8000/v1',
    credentialRef: 'vllm_key',   // or omit if no auth required
    model:         'meta-llama/Llama-3.1-70B-Instruct',
  },
})

// Per-agent override at creation time
const agent = await session.agents.create({
  definition: 'researcher',
  model: 'openai/gpt-4o',           // override the platform-level model config
})

// Or per-session — all agents in this session use this model
const session = await theazo.sessions.forUser('user_123', {
  models: {
    provider:      'openai-compatible',
    endpoint:      'https://openrouter.ai/api/v1',
    credentialRef: 'openrouter_key',
    model:         'google/gemini-flash-1.5',
  },
})

# 1. Store the credential in the vault
curl https://api.theazo.com/v1/secrets/e2b_key \
  -X PUT \
  -H "Authorization: Bearer th_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "value": "e2b_sk_..." }'

# 2. Reference it by name in your SDK config (never the raw value)
# compute: { provider: 'e2b', credentialRef: 'e2b_key' }

# 3. To rotate: update the vault entry — no code changes required
curl https://api.theazo.com/v1/secrets/e2b_key \
  -X PUT \
  -H "Authorization: Bearer th_live_..." \
  -d '{ "value": "e2b_sk_new_..." }'

# Register an E2B BYOI credential
curl https://api.theazo.com/v1/providers/e2b \
  -X PUT \
  -H "Authorization: Bearer th_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "credentialRef": "e2b_key",
    "mode": "byoi"
  }'

# Register a custom webhook provider
curl https://api.theazo.com/v1/providers/custom \
  -X PUT \
  -H "Authorization: Bearer th_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "endpoint":       "https://compute.agentco.com/sandbox",
    "credentialRef":  "compute_token",
    "mode":           "byoi"
  }'

import { Theazo } from 'theazo'

const theazo = new Theazo({ apiKey: 'th_live_...' })
const session = await theazo.sessions.forUser('user_123')
const agent   = await session.agents.create({ browser: false })

// Run your LangGraph agent code inside the isolated sandbox
const result = await agent.exec({
  lang: 'python',
  code: `
from langgraph.graph import StateGraph
from theazo_sandbox import log, span, complete

def researcher(state):
    log("Searching for information...")
    with span("fetch"):
        data = fetch_data(state["task"])
    return { "result": data }

graph = StateGraph(dict)
graph.add_node("researcher", researcher)
graph.set_entry_point("researcher")

app = graph.compile()
output = app.invoke({ "task": "analyze competitor pricing" })
complete(output["result"])
  `,
})

console.log(result.stdout)
console.log(result.cost)  // { amount: 8, currency: 'usd' } — compute time only

# Install inside your exec() environment
pip install theazo-sandbox

from theazo_sandbox import log, span, progress, complete

log("Starting analysis", level="info")

with span("fetch_data"):
    data = fetch_competitor_pages()

progress(50, "Data fetched, now analyzing...")

with span("analyze"):
    result = analyze(data)

complete(result)   # signals successful completion to Theazo