@decocms/sandbox-controller 0.5.0 → 0.6.0

package/dist/index.js

@@ -1,3 +1,5 @@
+import "./chunk-QGM4M3NI.js";
+
 // index.ts
 import { KubeConfig } from "@kubernetes/client-node";
 
@@ -24,16 +26,16 @@ function delay(ms, options = {}) {
   });
 }
 var I32_MAX = 2 ** 31 - 1;
-function setArbitraryLengthTimeout(callback, delay2) {
-  delay2 = Math.trunc(Math.max(delay2, 0) || 0);
-  if (delay2 <= I32_MAX) {
-    const id2 = Number(setTimeout(callback, delay2));
+function setArbitraryLengthTimeout(callback, delay3) {
+  delay3 = Math.trunc(Math.max(delay3, 0) || 0);
+  if (delay3 <= I32_MAX) {
+    const id2 = Number(setTimeout(callback, delay3));
     return { valueOf: () => id2 };
   }
   const start = Date.now();
   let timeoutId;
   const queueTimeout = () => {
-    const currentDelay = delay2 - (Date.now() - start);
+    const currentDelay = delay3 - (Date.now() - start);
     timeoutId = currentDelay > I32_MAX ? Number(setTimeout(queueTimeout, I32_MAX)) : Number(setTimeout(callback, currentDelay));
   };
   queueTimeout();
@@ -3650,7 +3652,8 @@ var AgentSandboxProvider = class {
       handle: rec.handle,
       workdir: rec.workdir,
       previewUrl: this.composePreviewUrl(rec),
-      warmPoolAdopted: rec.tenantPoolPodBound === true
+      warmPoolAdopted: rec.tenantPoolPodBound === true,
+      provider: "kubernetes"
     };
   }
   // ---- Persistence ----------------------------------------------------------
@@ -4461,239 +4464,3144 @@ function tenantPoolReader(store, cluster, { refreshMs = DEFAULT_TENANT_POOL_REFR
   };
 }
 
-// ../sandbox/server/provider/sandbox-api.ts
-import { z as z4 } from "zod";
-var SANDBOX_TOOLS = {
-  ensure: "SANDBOX_ENSURE",
-  status: "SANDBOX_STATUS",
-  delete: "SANDBOX_DELETE",
-  lifetime: "SANDBOX_LIFETIME",
-  capacity: "SANDBOX_CAPACITY",
-  tenantPoolsPush: "SANDBOX_TENANT_POOLS_PUSH",
-  credentialsPush: "SANDBOX_CREDENTIALS_PUSH",
-  list: "SANDBOX_LIST"
+// ../sandbox/server/provider/freestyle.ts
+import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/errors.js
+var FreestyleApiError = class _FreestyleApiError extends Error {
+  /** A stable identifier for the failure, e.g. `"NOT_FOUND"`. */
+  code;
+  /** The HTTP status code of the response. */
+  status;
+  /** The request path that failed, for debugging. */
+  path;
+  constructor(status, body, path) {
+    super(body.message || `Freestyle API error: ${body.code}`);
+    this.name = "FreestyleApiError";
+    this.code = body.code;
+    this.status = status;
+    this.path = path;
+    Object.setPrototypeOf(this, _FreestyleApiError.prototype);
+  }
 };
-var SANDBOX_WATCH_PATH = "/api/sandbox/watch";
-var SANDBOX_WATCH_KEEPALIVE_MS = 15e3;
-var id = z4.string().min(1).max(512);
-var CLONE_URL_MAX = 4096;
-var ORG_FS_CONFIG_MAX = 65536;
-var expiresAt = z4.number().int().positive();
-var sandboxIdSchema = z4.object({
-  userId: id,
-  projectRef: id
-});
-var tenantSchema = z4.object({
-  orgId: id,
-  userId: id,
-  orgSlug: z4.string().optional(),
-  orgName: z4.string().optional(),
-  userEmail: z4.string().optional(),
-  userName: z4.string().optional()
-});
-var repoSchema = z4.object({
-  cloneUrl: z4.string().min(1).max(CLONE_URL_MAX),
-  connectionId: z4.string().optional(),
-  repositoryId: z4.string().optional(),
-  userName: z4.string(),
-  userEmail: z4.string(),
-  branch: z4.string().optional(),
-  displayName: z4.string().optional(),
-  submoduleCredentials: z4.array(z4.object({ host: z4.string(), token: z4.string() })).optional(),
-  directoryName: z4.string().optional(),
-  credentialExpiresAt: expiresAt.optional()
-});
-var ensureOptionsSchema = z4.object({
-  purpose: z4.enum(["interactive", "harness-run"]).optional(),
-  sandboxImage: SandboxImageSchema.optional(),
-  branch: z4.string().optional(),
-  repo: repoSchema.optional(),
-  extraRepos: z4.array(repoSchema).optional(),
-  workload: z4.object({
-    runtime: z4.enum(["node", "bun", "deno"]),
-    packageManager: z4.enum(["npm", "pnpm", "yarn", "bun", "deno"]),
-    devPort: z4.number().int().optional(),
-    packageManagerPath: z4.string().optional()
-  }).optional(),
-  cloneOnly: z4.boolean().optional(),
-  env: z4.record(z4.string(), z4.string()).optional(),
-  tenant: tenantSchema.optional(),
-  orgFsConfigJson: z4.string().max(ORG_FS_CONFIG_MAX).optional()
-});
-var daemonSchema = z4.object({
-  url: z4.url({ protocol: /^https?$/ }),
-  token: z4.string().min(1)
-});
-var ensureInputSchema = z4.object({
-  id: sandboxIdSchema,
-  opts: ensureOptionsSchema,
-  /**
-   * Until when `opts.orgFsConfigJson` stays valid, at least; unset keeps it
-   * out of the host's store. Clone credentials carry their own
-   * `credentialExpiresAt`.
-   */
-  credentialsValidUntil: z4.object({ orgFsConfig: expiresAt.optional() }).optional()
-});
-var ensureOutputSchema = z4.object({
-  handle: z4.string().min(1),
-  workdir: z4.string().min(1),
-  previewUrl: z4.string().nullable(),
-  warmPoolAdopted: z4.boolean(),
-  daemon: daemonSchema
-});
-var handleInputSchema = z4.object({ handle: z4.string().min(1) });
-var statusInputSchema = z4.object({
-  handle: z4.string().min(1),
-  /** Re-provision an evicted claim before answering. */
-  resurrect: z4.boolean().optional()
-});
-var podTerminationSchema = z4.object({
-  reason: z4.string(),
-  oomKilled: z4.boolean(),
-  exitCode: z4.number().int().optional(),
-  memoryLimit: z4.string().optional(),
-  evictionMessage: z4.string().optional()
-});
-var statusOutputSchema = z4.object({
-  alive: z4.boolean(),
-  previewUrl: z4.string().nullable(),
-  daemon: daemonSchema.nullable(),
-  lastTermination: podTerminationSchema.nullable()
-});
-var lifetimeInputSchema = z4.object({
-  handle: z4.string().min(1),
-  graceMs: z4.number().int().min(0).optional()
-});
-var emptySchema = z4.object({});
-var capacityOutputSchema = z4.object({ schedulable: z4.boolean() });
-var tenantPoolsPushInputSchema = z4.object({
-  repoUrl: z4.string().min(1).max(CLONE_URL_MAX),
-  ref: z4.string().min(1)
-});
-var tenantPoolsPushOutputSchema = z4.object({
-  pools: z4.array(z4.string())
-});
-var toolErrorSchema = z4.object({
-  code: z4.enum(["bootstrap-rejected", "internal"]),
-  error: z4.string(),
-  status: z4.number().int().optional()
-});
-var since = z4.number();
-var claimPhaseSchema = z4.discriminatedUnion(
-  "kind",
-  [
-    z4.object({ kind: z4.literal("claiming"), since }),
-    z4.object({
-      kind: z4.literal("waiting-for-capacity"),
-      since,
-      message: z4.string().optional(),
-      nodeClaim: z4.string().optional()
-    }),
-    z4.object({ kind: z4.literal("pulling-image"), since }),
-    z4.object({ kind: z4.literal("starting-container"), since }),
-    z4.object({ kind: z4.literal("warming-daemon"), since }),
-    z4.object({ kind: z4.literal("ready") }),
-    z4.object({
-      kind: z4.literal("failed"),
-      reason: z4.enum([
-        "image-pull-backoff",
-        "crash-loop-backoff",
-        "scheduling-timeout",
-        "claim-never-created",
-        "reconciler-error",
-        "unknown"
-      ]),
-      message: z4.string()
-    })
-  ]
-);
-var tenantIdsSchema = z4.object({ orgId: id, userId: id });
-var repoIdentitySchema = z4.union([
-  z4.object({ repositoryId: id }).strict(),
-  z4.object({ connectionId: id, repo: id }).strict()
-]);
-var CREDENTIALS_PUSH_MAX = 2e3;
-var pushedCloneUrl = z4.url({ protocol: /^https?$/ }).max(CLONE_URL_MAX);
-var credentialsPushInputSchema = z4.object({
-  cloneUrls: z4.array(
-    z4.object({
-      tenant: tenantIdsSchema,
-      repo: repoIdentitySchema,
-      cloneUrl: pushedCloneUrl,
-      expiresAt
-    })
-  ).max(CREDENTIALS_PUSH_MAX),
-  /** Clone URLs for tenant pool allocations, keyed by the pool's tenant and repo. */
-  poolCloneUrls: z4.array(
-    z4.object({
-      tenant: id,
-      repoUrl: z4.string().min(1).max(CLONE_URL_MAX),
-      cloneUrl: pushedCloneUrl,
-      expiresAt
-    })
-  ).max(CREDENTIALS_PUSH_MAX).default([]),
-  orgFsConfigs: z4.array(
-    z4.object({
-      tenant: tenantIdsSchema,
-      orgFsConfigJson: z4.string().min(1).max(ORG_FS_CONFIG_MAX),
-      expiresAt
-    })
-  ).max(CREDENTIALS_PUSH_MAX)
-});
-var credentialsPushOutputSchema = z4.object({
-  stored: z4.number().int().nonnegative(),
-  kept: z4.number().int().nonnegative()
-});
-var SANDBOX_LIST_MAX = 5e3;
-var SANDBOX_LIST_POOLS_MAX = 500;
-var SANDBOX_LIST_POOL_REPOS_MAX = 100;
-var listOutputSchema = z4.object({
-  sandboxes: z4.array(
-    z4.object({
-      handle: id,
-      tenant: tenantIdsSchema.nullable(),
-      repos: z4.array(repoIdentitySchema).max(16),
-      /** The sandbox mounts org-fs. */
-      orgFs: z4.boolean(),
-      /** When the org-fs config the host holds for its tenant expires. */
-      orgFsConfigExpiresAt: expiresAt.nullable()
-    })
-  ).max(SANDBOX_LIST_MAX),
-  /** Defaulted so a host that predates pool listing still lists its sandboxes. */
-  pools: z4.array(
-    z4.object({
-      name: id,
-      tenant: id,
-      image: SandboxImageSchema,
-      repos: z4.array(
-        z4.object({
-          repoUrl: z4.string().min(1).max(CLONE_URL_MAX),
-          branch: z4.string().min(1)
-        })
-      ).max(SANDBOX_LIST_POOL_REPOS_MAX)
-    })
-  ).max(SANDBOX_LIST_POOLS_MAX).default([])
-});
 
-// ../sandbox/server/provider/sandbox-server.ts
-function messageChain(err) {
-  const parts = [];
-  for (let e = err, depth = 0; e && depth < 5; depth++) {
-    parts.push(e instanceof Error ? e.message : String(e));
-    e = e instanceof Error ? e.cause : void 0;
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/runtime.js
+function isNodeRuntime() {
+  return typeof process !== "undefined" && Boolean(process.versions?.node);
+}
+var globalFetch = (input, init) => globalThis.fetch(input, init);
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/transport.js
+async function loadUndici() {
+  if (!isNodeRuntime())
+    return null;
+  try {
+    const specifier = "undici";
+    return await import(
+      /* @vite-ignore */
+      specifier
+    );
+  } catch {
+    return null;
   }
-  return parts.join(": ");
 }
-function tool(def) {
-  return {
-    ...def,
-    // A thrown message is all an MCP error carries, so it carries JSON.
-    execute: (input) => def.execute(input).catch((err) => {
-      const body = err instanceof ConfigRequestError ? {
-        code: "bootstrap-rejected",
-        error: err.message,
-        status: err.status
-      } : { code: "internal", error: messageChain(err) };
+var MAX_CONNECTIONS = 4;
+async function createHttp2Fetch() {
+  const undici = await loadUndici();
+  if (!undici)
+    return null;
+  const dispatcher = new undici.Agent({ allowH2: true, connections: MAX_CONNECTIONS });
+  return ((input, init) => undici.fetch(input, { ...init, dispatcher }));
+}
+function isTls(input) {
+  const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+  return url.startsWith("https:");
+}
+function defaultFetch() {
+  let pending;
+  const resolve = () => {
+    pending ??= createHttp2Fetch().then((h2) => h2 ?? globalFetch).catch(() => globalFetch);
+    return pending;
+  };
+  return (input, init) => isTls(input) ? resolve().then((impl) => impl(input, init)) : globalFetch(input, init);
+}
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/client.js
+var IDENTITY_TOKEN_HEADER = "x-freestyle-identity-access-token";
+var BACKGROUND_AFTER_SECS_HEADER = "x-freestyle-background-after-secs";
+var BACKGROUND_REQUEST_ID_HEADER = "x-freestyle-background-request-id";
+var BACKGROUND_AFTER_SECS = 5;
+var BACKGROUND_POLL_INTERVAL_MS = 2e3;
+var DEFAULT_BASE_URL = "https://api.freestyle.sh";
+function delay2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function buildQuery(query) {
+  if (!query)
+    return "";
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(query)) {
+    if (value === void 0 || value === null)
+      continue;
+    params.set(key, String(value));
+  }
+  const qs = params.toString();
+  return qs ? `?${qs}` : "";
+}
+function segment(value) {
+  return encodeURIComponent(value);
+}
+var FreestyleClient = class {
+  baseUrl;
+  authenticationHeaders;
+  fetchImpl;
+  /** Identity-token callers cannot poll `/v5/background-requests`, so their requests are never backgrounded. */
+  backgroundEligible;
+  constructor(options = {}) {
+    this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+    if (!options.fetch && !globalThis.fetch) {
+      throw new Error("No fetch implementation available. Pass `fetch` in FreestyleOptions when running on a runtime without a global fetch.");
+    }
+    this.fetchImpl = options.fetch ?? defaultFetch();
+    if ("identityAccessToken" in options && options.identityAccessToken) {
+      this.authenticationHeaders = {
+        [IDENTITY_TOKEN_HEADER]: options.identityAccessToken
+      };
+      this.backgroundEligible = false;
+      return;
+    }
+    this.backgroundEligible = true;
+    if ("stackAccessToken" in options && options.stackAccessToken) {
+      this.authenticationHeaders = {
+        Authorization: `Bearer ${options.stackAccessToken}`,
+        "X-Freestyle-Team-Id": options.teamId
+      };
+      return;
+    }
+    const apiKey = options.apiKey ?? globalThis.process?.env?.FREESTYLE_API_KEY;
+    if (!apiKey) {
+      throw new Error("No Freestyle API key provided. Pass `apiKey` in FreestyleOptions or set FREESTYLE_API_KEY.");
+    }
+    this.authenticationHeaders = { Authorization: `Bearer ${apiKey}` };
+  }
+  /** Headers this client authenticates every request with, e.g. for a raw WebSocket handshake. */
+  authHeaders() {
+    return { ...this.authenticationHeaders };
+  }
+  /** Absolute URL for an API path, e.g. `/v5/vms/{id}` → `https://.../v5/vms/{id}`. */
+  url(path, query) {
+    return `${this.baseUrl}${path}${buildQuery(query)}`;
+  }
+  /**
+   * Low-level escape hatch: an authenticated `fetch` against the API, relative
+   * to `baseUrl`. Pass the whole path, `/v5` included — the same paths the
+   * methods above use, and the same ones the API declares. It is also how the
+   * client follows a server-supplied URL (a 202's `resultUrl`), and the only
+   * way to reach the unversioned `/status` and `/openapi.json`.
+   */
+  async fetch(path, init = {}) {
+    const headers = new Headers(init.headers);
+    for (const [name, value] of Object.entries(this.authHeaders())) {
+      if (!headers.has(name))
+        headers.set(name, value);
+    }
+    return this.fetchImpl(this.absoluteUrl(path), { ...init, headers });
+  }
+  /** A path or URL as this client's `fetch` resolves it: absolute URLs are
+   * followed as given, everything else hangs off `baseUrl` with no version
+   * segment added — the caller already supplied whatever version it wants. */
+  absoluteUrl(pathOrUrl) {
+    return /^https?:\/\//i.test(pathOrUrl) ? pathOrUrl : `${this.baseUrl}${pathOrUrl}`;
+  }
+  async request(method, path, { query, body, rawBody, signal } = {}) {
+    const headers = { ...this.authHeaders() };
+    if (this.backgroundEligible) {
+      headers[BACKGROUND_AFTER_SECS_HEADER] = String(BACKGROUND_AFTER_SECS);
+    }
+    let payload;
+    if (rawBody !== void 0) {
+      headers["Content-Type"] = "application/octet-stream";
+      payload = rawBody;
+    } else if (body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      payload = JSON.stringify(body);
+    }
+    const url = this.url(path, query);
+    const response = await this.fetchImpl(url, {
+      method,
+      headers,
+      body: payload,
+      signal
+    });
+    if (this.backgroundEligible && response.status === 202) {
+      try {
+        return await this.pollBackgroundRequest(response, path);
+      } catch (error) {
+        if (method === "GET" && error instanceof FreestyleApiError && error.code === "BACKGROUND_RESULT_UNSTORABLE") {
+          delete headers[BACKGROUND_AFTER_SECS_HEADER];
+          const retry2 = await this.fetchImpl(url, { method, headers, body: payload });
+          return this.finalize(retry2, path);
+        }
+        throw error;
+      }
+    }
+    return this.finalize(response, path);
+  }
+  /**
+   * Follow a 202 from a backgrounded request: poll its result URL until the
+   * stored response — success or error, identical to what the inline call
+   * would have produced — is ready.
+   */
+  async pollBackgroundRequest(accepted, path) {
+    const acceptedBody = await accepted.json().catch(() => ({}));
+    const requestId = accepted.headers.get(BACKGROUND_REQUEST_ID_HEADER) ?? acceptedBody.requestId;
+    const resultPath = acceptedBody.resultUrl ?? (requestId ? `/v5/background-requests/${segment(requestId)}` : void 0);
+    if (!resultPath) {
+      throw new FreestyleApiError(accepted.status, { code: "BACKGROUND_PROTOCOL_ERROR", message: "202 Accepted carried no background request id" }, path);
+    }
+    let consecutiveFailures = 0;
+    for (; ; ) {
+      await delay2(BACKGROUND_POLL_INTERVAL_MS);
+      let response;
+      try {
+        response = await this.fetch(resultPath, { method: "GET" });
+        consecutiveFailures = 0;
+      } catch (error) {
+        if (++consecutiveFailures >= 5)
+          throw error;
+        continue;
+      }
+      if (response.status === 202)
+        continue;
+      return this.finalize(response, path);
+    }
+  }
+  /** Turn a terminal API response into the call's value, or throw its error. */
+  async finalize(response, path) {
+    if (!response.ok) {
+      let errorBody;
+      try {
+        errorBody = await response.json();
+      } catch {
+        errorBody = { code: "UNKNOWN_ERROR", message: await response.text().catch(() => response.statusText) };
+      }
+      throw new FreestyleApiError(response.status, errorBody, path);
+    }
+    if (response.status === 204)
+      return void 0;
+    const text = await response.text();
+    if (!text)
+      return void 0;
+    return JSON.parse(text);
+  }
+  get(path, query) {
+    return this.request("GET", path, { query });
+  }
+  post(path, body) {
+    return this.request("POST", path, { body: body ?? {} });
+  }
+  patch(path, body) {
+    return this.request("PATCH", path, { body: body ?? {} });
+  }
+  put(path, body) {
+    return this.request("PUT", path, { body: body ?? {} });
+  }
+  putEmpty(path) {
+    return this.request("PUT", path, {});
+  }
+  /** PUT raw bytes as `application/octet-stream`: a whole file, or one chunk of one. */
+  putBytes(path, rawBody, query, signal) {
+    return this.request("PUT", path, { query, rawBody, signal });
+  }
+  /**
+   * GET a response whose body is bytes rather than JSON, returned unread so the
+   * caller can stream it. Errors still surface as {@link FreestyleApiError}.
+   */
+  async getBytes(path, query, init = {}) {
+    const headers = { ...this.authHeaders() };
+    if (init.range)
+      headers["Range"] = init.range;
+    const response = await this.fetchImpl(this.url(path, query), {
+      method: "GET",
+      headers,
+      signal: init.signal
+    });
+    if (!response.ok) {
+      let errorBody;
+      try {
+        errorBody = await response.json();
+      } catch {
+        errorBody = {
+          code: "UNKNOWN_ERROR",
+          message: await response.text().catch(() => response.statusText)
+        };
+      }
+      throw new FreestyleApiError(response.status, errorBody, path);
+    }
+    return response;
+  }
+  delete(path, query) {
+    return this.request("DELETE", path, { query });
+  }
+};
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/domains.js
+var DomainsNamespace = class {
+  client;
+  verifications;
+  certificates;
+  /** The branding on the 404 page for hostnames under your domains that nothing serves. */
+  placeholder;
+  constructor(client) {
+    this.client = client;
+    this.verifications = new DomainVerificationsNamespace(client);
+    this.certificates = new DomainCertificatesNamespace(client);
+    this.placeholder = new DomainPlaceholderNamespace(client);
+  }
+  /**
+   * List the domains you hold: those you verified, and any Freestyle
+   * subdomain you have taken by publishing it.
+   */
+  async list() {
+    const { domains } = await this.client.get("/v5/domains");
+    return domains;
+  }
+};
+var DomainVerificationsNamespace = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  /**
+   * Issue a challenge. Publish the returned `verificationCode` as a TXT
+   * record at `recordName`, then `complete()` it.
+   */
+  create(domain) {
+    return this.client.post("/v5/verifications", { domain });
+  }
+  async list(options = {}) {
+    const { verifications } = await this.client.get("/v5/verifications", options);
+    return verifications;
+  }
+  /** Fetch a verification challenge by its id or its domain. */
+  get(domainOrId) {
+    return this.client.get(`/v5/verifications/${segment(domainOrId)}`);
+  }
+  /**
+   * Check DNS and record ownership. Addressed by id, only that challenge's
+   * own code counts; use this when several people are verifying the same
+   * domain.
+   */
+  complete(domainOrId) {
+    return this.client.putEmpty(`/v5/verifications/${segment(domainOrId)}`);
+  }
+  /**
+   * Withdraw outstanding challenges; by domain this drops all of them. A
+   * challenge that already verified is a permanent record and cannot be
+   * deleted.
+   */
+  delete(domainOrId) {
+    return this.client.delete(`/v5/verifications/${segment(domainOrId)}`);
+  }
+};
+var DomainCertificatesNamespace = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  async list() {
+    const { certificates } = await this.client.get("/v5/certificates");
+    return certificates;
+  }
+  /**
+   * Request an ongoing `*.domain` certificate. Requires
+   * `_acme-challenge.<domain>` to be NS-delegated to Freestyle's
+   * nameservers, since wildcards can only be proven over DNS.
+   */
+  createWildcard(domain) {
+    return this.client.post("/v5/certificates/wildcard", { domain });
+  }
+};
+var DomainPlaceholderNamespace = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  /** Your placeholder branding, or `null` when pages carry the Freestyle default. */
+  async get() {
+    try {
+      return await this.client.get("/v5/domains/placeholder");
+    } catch (error) {
+      if (error instanceof FreestyleApiError && error.status === 404)
+        return null;
+      throw error;
+    }
+  }
+  /**
+   * Set the branding for every placeholder page under your verified domains,
+   * including domains you verify later. Replaces any earlier setting.
+   */
+  set(options) {
+    return this.client.put("/v5/domains/placeholder", options);
+  }
+  /** Remove your branding; pages go back to the Freestyle default. */
+  delete() {
+    return this.client.delete("/v5/domains/placeholder");
+  }
+};
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/firewall.js
+var FirewallRuleValidationError = class _FirewallRuleValidationError extends Error {
+  /** The field the complaint is about, in dotted form. */
+  path;
+  constructor(path, message) {
+    super(message);
+    this.name = "FirewallRuleValidationError";
+    this.path = path;
+    Object.setPrototypeOf(this, _FirewallRuleValidationError.prototype);
+  }
+};
+var ENDPOINT_FIELDS = [
+  "vmId",
+  "vpcId",
+  "tunnelId",
+  "cidr",
+  "public",
+  "port",
+  "protocol"
+];
+var IDENTITY_FIELDS = ["vmId", "vpcId", "tunnelId", "cidr", "public"];
+var PROTOCOLS = ["tcp", "udp", "icmp"];
+var PORTED_PROTOCOLS = ["tcp", "udp"];
+var MAX_DESCRIPTION_LENGTH = 1024;
+function fail(path, message) {
+  throw new FirewallRuleValidationError(path, message);
+}
+function hasIdentity(endpoint) {
+  return IDENTITY_FIELDS.some((field) => endpoint[field] !== void 0);
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateCidr(path, cidr) {
+  const slash = cidr.lastIndexOf("/");
+  if (slash < 0) {
+    fail(path, `${path} \`${cidr}\` is not a CIDR: expected address/prefix, e.g. 203.0.113.0/24 or 2001:db8::/32`);
+  }
+  const address = cidr.slice(0, slash);
+  const prefixText = cidr.slice(slash + 1);
+  if (!/^\d+$/.test(prefixText)) {
+    fail(path, `${path} \`${cidr}\`: prefix length must be a number`);
+  }
+  const prefix = Number(prefixText);
+  const isIpv6 = address.includes(":");
+  const max = isIpv6 ? 128 : 32;
+  if (prefix > max) {
+    fail(path, `${path} \`${cidr}\`: prefix length must be 0\u2013${max}`);
+  }
+  if (!isIpv6 && !/^\d{1,3}(\.\d{1,3}){3}$/.test(address)) {
+    fail(path, `${path} \`${cidr}\`: \`${address}\` is not an IP address`);
+  }
+}
+function validateFirewallEndpoint(endpoint, path) {
+  if (!isPlainObject(endpoint)) {
+    fail(path, `${path} must be an object`);
+  }
+  for (const field of Object.keys(endpoint)) {
+    if (!ENDPOINT_FIELDS.includes(field)) {
+      fail(`${path}.${field}`, `${path} has unknown field \`${field}\`. Expected one of: ${ENDPOINT_FIELDS.join(", ")}`);
+    }
+  }
+  const matcher = endpoint;
+  for (const field of ["vmId", "vpcId", "tunnelId", "cidr"]) {
+    const value = matcher[field];
+    if (value !== void 0 && (typeof value !== "string" || value.length === 0)) {
+      fail(`${path}.${field}`, `${path}.${field} must be a non-empty string`);
+    }
+  }
+  if (matcher.public !== void 0 && matcher.public !== true) {
+    fail(`${path}.public`, `${path}.public must be true when present: it declares the public Internet. Omit the field to match something else`);
+  }
+  if (matcher.public === true) {
+    if (matcher.vmId !== void 0) {
+      fail(`${path}.public`, `${path} cannot combine \`public: true\` with \`vmId\`: that would mean the VM only when reached over its public address, a distinction this API does not make yet. Use \`vmId\` alone to match the VM on any path, or \`public: true\` alone to match public addresses`);
+    }
+    if (matcher.vpcId !== void 0) {
+      fail(`${path}.public`, `${path} cannot combine \`public: true\` with \`vpcId\`: that would mean the network's members only when reached over their public addresses, a distinction this API does not make yet. Use \`vpcId\` alone or \`public: true\` alone`);
+    }
+    if (matcher.tunnelId !== void 0) {
+      fail(`${path}.public`, `${path} cannot combine \`public: true\` with \`tunnelId\`: traffic through a tunnel arrives over the tunnel, not over the public Internet. Use \`tunnelId\` alone`);
+    }
+  }
+  if (matcher.cidr !== void 0) {
+    validateCidr(`${path}.cidr`, matcher.cidr);
+  }
+  if (matcher.protocol !== void 0 && !PROTOCOLS.includes(matcher.protocol)) {
+    fail(`${path}.protocol`, `${path}.protocol must be one of: ${PROTOCOLS.join(", ")} (got \`${String(matcher.protocol)}\`)`);
+  }
+  if (matcher.port !== void 0) {
+    if (!Number.isInteger(matcher.port) || matcher.port < 1 || matcher.port > 65535) {
+      fail(`${path}.port`, `${path}.port must be an integer between 1 and 65535`);
+    }
+    if (matcher.protocol === void 0) {
+      fail(`${path}.protocol`, `${path}.port ${matcher.port} requires ${path}.protocol: set it to "tcp" or "udp" so the rule opens one transport rather than both`);
+    }
+    if (!PORTED_PROTOCOLS.includes(matcher.protocol)) {
+      fail(`${path}.port`, `${path}.protocol "${matcher.protocol}" has no ports; remove ${path}.port ${matcher.port}`);
+    }
+  }
+}
+var RULE_FIELDS = ["action", "source", "destination", "description"];
+function validateRuleShape(rule, prefix) {
+  if (!isPlainObject(rule)) {
+    fail(prefix || "rule", `${prefix || "rule"} must be an object`);
+  }
+  for (const field of Object.keys(rule)) {
+    if (!RULE_FIELDS.includes(field)) {
+      fail(`${prefix}${field}`, `Unknown field \`${field}\`. Expected one of: ${RULE_FIELDS.join(", ")}`);
+    }
+  }
+  const typed = rule;
+  if (typed.action === void 0) {
+    fail(`${prefix}action`, `${prefix}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);
+  }
+  if (typed.action !== "allow") {
+    fail(`${prefix}action`, `${prefix}action must be "allow" (got \`${String(typed.action)}\`). Only allow rules exist today`);
+  }
+  if (typed.description !== void 0) {
+    if (typeof typed.description !== "string") {
+      fail(`${prefix}description`, "description must be a string");
+    }
+    if (typed.description.length > MAX_DESCRIPTION_LENGTH) {
+      fail(`${prefix}description`, `description is too long (${typed.description.length} characters, maximum ${MAX_DESCRIPTION_LENGTH})`);
+    }
+  }
+  if (typed.source === void 0)
+    fail(`${prefix}source`, `${prefix}source is required`);
+  if (typed.destination === void 0) {
+    fail(`${prefix}destination`, `${prefix}destination is required`);
+  }
+  validateFirewallEndpoint(typed.source, `${prefix}source`);
+  validateFirewallEndpoint(typed.destination, `${prefix}destination`);
+  return typed;
+}
+function validateFirewallRule(rule) {
+  const typed = validateRuleShape(rule, "");
+  for (const side of ["source", "destination"]) {
+    const endpoint = typed[side];
+    if (hasIdentity(endpoint))
+      continue;
+    const narrowing = [
+      endpoint.port !== void 0 ? `port ${endpoint.port}` : void 0,
+      endpoint.protocol !== void 0 ? `protocol ${endpoint.protocol}` : void 0
+    ].filter(Boolean).join(", ");
+    fail(side, narrowing ? `${side} only narrows traffic (${narrowing}) without saying what it is. Add \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\`. Leaving it out to mean "this VM" only works inside vms.create` : `${side} is empty. A matcher must say what the traffic is: \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\` for the public Internet`);
+  }
+  return typed;
+}
+function validateFirewallSpec(spec, subject = "VM") {
+  if (spec === void 0 || spec === null) {
+    fail("firewall", `firewall is required on a ${subject} create. A ${subject} gets nothing implicitly, so state what it may reach \u2014 \`{ rules: [] }\` if the answer is nothing`);
+  }
+  if (!isPlainObject(spec)) {
+    fail("firewall", "firewall must be an object with a `rules` array");
+  }
+  for (const field of Object.keys(spec)) {
+    if (field !== "rules") {
+      fail(`firewall.${field}`, `firewall has unknown field \`${field}\`. Expected: rules`);
+    }
+  }
+  const rules = spec.rules;
+  if (!Array.isArray(rules)) {
+    fail("firewall.rules", "firewall.rules must be an array");
+  }
+  rules.forEach((rule, index) => {
+    const prefix = `firewall.rules[${index}].`;
+    const typed = validateRuleShape(rule, prefix);
+    const sourceNames = hasIdentity(typed.source);
+    const destinationNames = hasIdentity(typed.destination);
+    if (!sourceNames && !destinationNames && subject !== "network") {
+      fail(`firewall.rules[${index}]`, `firewall.rules[${index}]: both source and destination refer to the ${subject} being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, \`tunnelId\`, \`cidr\`, or \`public: true\``);
+    }
+    if (sourceNames && destinationNames) {
+      fail(`firewall.rules[${index}]`, `firewall.rules[${index}]: neither end refers to the ${subject} being created. Leave one endpoint's identity unset so it means this ${subject}, or create the rule with firewall.rules.create instead`);
+    }
+  });
+  return spec;
+}
+function rulePath(ruleId) {
+  return `/v5/firewall/rules/${segment(ruleId)}`;
+}
+var FirewallRulesNamespace = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  /**
+   * Allow traffic from one place to another.
+   *
+   * @example
+   * // Public Internet -> a VM, on HTTPS.
+   * await freestyle.firewall.rules.create({
+   *   action: "allow",
+   *   source: { public: true },
+   *   destination: { vmId: "vm-123456", port: 443, protocol: "tcp" },
+   * });
+   *
+   * @example
+   * // One private network -> another, on Postgres.
+   * await freestyle.firewall.rules.create({
+   *   action: "allow",
+   *   source: { vpcId: "vpc-frontend" },
+   *   destination: { vpcId: "vpc-backend", port: 5432, protocol: "tcp" },
+   * });
+   *
+   * @throws {FirewallRuleValidationError} before any request, when the rule
+   * cannot be well formed.
+   */
+  // `async` so a validation failure arrives as a rejected promise like every
+  // other error from this client, instead of a synchronous throw that a
+  // `.catch()` chain would sail straight past.
+  async create(options) {
+    const validated = validateFirewallRule(options);
+    return this.client.post("/v5/firewall/rules", validated);
+  }
+  /**
+   * List your rules, newest first. Pass `vmId` for the rules that apply to one
+   * VM — those naming it, plus those naming a private network it is on.
+   */
+  list(options = {}) {
+    return this.client.get("/v5/firewall/rules", options);
+  }
+  get(ruleId) {
+    return this.client.get(rulePath(ruleId));
+  }
+  /** Delete a rule. The resources it named are untouched. */
+  delete(ruleId) {
+    return this.client.delete(rulePath(ruleId));
+  }
+};
+var FirewallNamespace = class {
+  client;
+  rules;
+  constructor(client) {
+    this.client = client;
+    this.rules = new FirewallRulesNamespace(client);
+  }
+  /**
+   * Ask whether a connection would be allowed, without changing anything.
+   *
+   * Useful for checking a rule set before you rely on it — and for confirming
+   * what you already believe, e.g. that a mapped domain reaches a VM with no
+   * rules at all.
+   *
+   * @example
+   * // A mapped domain: allowed whatever your rules say.
+   * await freestyle.firewall.evaluate({
+   *   source: { platform: true },
+   *   destination: { vmId: "vm-123456", port: 3000 },
+   *   protocol: "tcp",
+   * });
+   * // => { outcome: "allowedByPlatform", side: "source" }
+   */
+  evaluate(traffic) {
+    return this.client.post("/v5/firewall/evaluate", traffic);
+  }
+};
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/identities.js
+function identityPath(id2) {
+  return `/v5/identities/${segment(id2)}`;
+}
+var IdentityTokensNamespace = class {
+  client;
+  basePath;
+  constructor(client, basePath) {
+    this.client = client;
+    this.basePath = basePath;
+  }
+  /** Mint an access token for the identity. */
+  create() {
+    return this.client.post(`${this.basePath}/tokens`);
+  }
+  list() {
+    return this.client.get(`${this.basePath}/tokens`);
+  }
+  revoke(tokenId) {
+    return this.client.delete(`${this.basePath}/tokens/${segment(tokenId)}`);
+  }
+};
+var IdentityVmPermissionsNamespace = class {
+  client;
+  basePath;
+  constructor(client, basePath) {
+    this.client = client;
+    this.basePath = basePath;
+  }
+  /** List the VMs this identity has been granted access to. */
+  list() {
+    return this.client.get(`${this.basePath}/permissions/vm`);
+  }
+  /** Grant this identity access to a VM. */
+  grant(options) {
+    return this.client.post(`${this.basePath}/permissions/vm`, options);
+  }
+  /** Fetch this identity's grant on a VM. */
+  get(vmId) {
+    return this.client.get(`${this.basePath}/permissions/vm/${segment(vmId)}`);
+  }
+  /** Change which Linux users this identity may act as on a VM. */
+  update(vmId, allowedLinuxUsers) {
+    return this.client.patch(`${this.basePath}/permissions/vm/${segment(vmId)}`, {
+      allowedLinuxUsers
+    });
+  }
+  /** Revoke this identity's access to a VM. */
+  revoke(vmId) {
+    return this.client.delete(`${this.basePath}/permissions/vm/${segment(vmId)}`);
+  }
+};
+var Identity = class {
+  id;
+  tokens;
+  permissions;
+  client;
+  basePath;
+  constructor(client, id2) {
+    this.client = client;
+    this.id = id2;
+    this.basePath = identityPath(id2);
+    this.tokens = new IdentityTokensNamespace(client, this.basePath);
+    this.permissions = { vm: new IdentityVmPermissionsNamespace(client, this.basePath) };
+  }
+  data() {
+    return this.client.get(this.basePath);
+  }
+  /** Delete the identity, along with its tokens and grants. Managed identities cannot be deleted. */
+  delete() {
+    return this.client.delete(this.basePath);
+  }
+};
+var IdentitiesNamespace = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  /** Create an identity. */
+  async create(options = {}) {
+    const data = await this.client.post("/v5/identities", options);
+    return { identity: new Identity(this.client, data.id), identityId: data.id, data };
+  }
+  list(options = {}) {
+    return this.client.get("/v5/identities", options);
+  }
+  get(identityId) {
+    return this.client.get(identityPath(identityId));
+  }
+  /** A handle to an identity, without a network call. */
+  ref(identityId) {
+    return new Identity(this.client, identityId);
+  }
+  delete(identityId) {
+    return this.client.delete(identityPath(identityId));
+  }
+};
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/tls.js
+var TlsRuleValidationError = class _TlsRuleValidationError extends Error {
+  /** The field the complaint is about, in dotted form. */
+  path;
+  constructor(path, message) {
+    super(message);
+    this.name = "TlsRuleValidationError";
+    this.path = path;
+    Object.setPrototypeOf(this, _TlsRuleValidationError.prototype);
+  }
+};
+var TlsForwardAuthValidationError = class _TlsForwardAuthValidationError extends Error {
+  /** The field the complaint is about, in dotted form. */
+  path;
+  constructor(path, message) {
+    super(message);
+    this.name = "TlsForwardAuthValidationError";
+    this.path = path;
+    Object.setPrototypeOf(this, _TlsForwardAuthValidationError.prototype);
+  }
+};
+var ENDPOINT_FIELDS2 = ["vmId", "vpcId", "public", "host", "port"];
+var IDENTITY_FIELDS2 = ["vmId", "vpcId", "public", "host"];
+var PROTOCOLS2 = [
+  "tcp",
+  "http",
+  "postgres",
+  "minecraft",
+  "smtp",
+  "imap",
+  "imaps",
+  "socks5"
+];
+var MAX_DOMAIN_LENGTH = 253;
+var MAX_LABEL_LENGTH = 63;
+var FORWARD_AUTH_FIELDS = [
+  "url",
+  "headers",
+  "timeoutMs",
+  "protectedCookies",
+  "authResponseHeaders"
+];
+var FORWARD_AUTH_REFERENCE_FIELDS = ["id"];
+var HTTP_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+var FORWARD_AUTH_HEADER_NAME = /^[0-9A-Za-z-]+$/;
+var MAX_FORWARD_AUTH_URL_LENGTH = 2048;
+var MAX_FORWARD_AUTH_HEADERS = 32;
+var MAX_FORWARD_AUTH_HEADER_BYTES = 16 * 1024;
+var MAX_FORWARD_AUTH_RESPONSE_HEADERS = 32;
+var MAX_FORWARD_AUTH_COOKIES = 32;
+var MAX_FORWARD_AUTH_COOKIE_NAME_LENGTH = 128;
+var RESERVED_FORWARD_AUTH_HEADERS = /* @__PURE__ */ new Set([
+  "host",
+  "content-length",
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "proxy-connection",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+function fail2(path, message) {
+  throw new TlsRuleValidationError(path, message);
+}
+function failForwardAuth(path, message) {
+  throw new TlsForwardAuthValidationError(path, message);
+}
+function hasTlsIdentity(endpoint) {
+  return IDENTITY_FIELDS2.some((field) => endpoint[field] !== void 0);
+}
+function isEmptyEndpoint(endpoint) {
+  return !hasTlsIdentity(endpoint) && endpoint.port === void 0;
+}
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function validateForwardAuthHeaderName(value, path, responseHeader) {
+  if (typeof value !== "string" || !FORWARD_AUTH_HEADER_NAME.test(value)) {
+    failForwardAuth(path, `${path} must be a valid HTTP header name`);
+  }
+  const lower = value.toLowerCase();
+  if (RESERVED_FORWARD_AUTH_HEADERS.has(lower) || lower.startsWith("x-forwarded-") || lower.startsWith("x-freestyle-") || responseHeader && (lower === "cookie" || lower === "set-cookie")) {
+    failForwardAuth(path, `${path} may not use reserved header \`${value}\``);
+  }
+}
+function validateHeaderNameList(value, path) {
+  if (!Array.isArray(value)) {
+    failForwardAuth(path, `${path} must be an array of header names`);
+  }
+  if (value.length > MAX_FORWARD_AUTH_RESPONSE_HEADERS) {
+    failForwardAuth(path, `${path} may contain at most ${MAX_FORWARD_AUTH_RESPONSE_HEADERS} names`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  value.forEach((name, index) => {
+    validateForwardAuthHeaderName(name, `${path}[${index}]`, true);
+    const lower = name.toLowerCase();
+    if (seen.has(lower)) {
+      failForwardAuth(`${path}[${index}]`, `${path} contains duplicate header \`${name}\``);
+    }
+    seen.add(lower);
+  });
+}
+function validateTlsForwardAuth(options) {
+  if (!isPlainObject2(options)) {
+    failForwardAuth("forwardAuth", "forwardAuth must be an object");
+  }
+  for (const field of Object.keys(options)) {
+    if (!FORWARD_AUTH_FIELDS.includes(field)) {
+      failForwardAuth(field, `Unknown field \`${field}\`. Expected one of: ${FORWARD_AUTH_FIELDS.join(", ")}`);
+    }
+  }
+  const typed = options;
+  if (typeof typed.url !== "string" || typed.url.length === 0 || typed.url.length > MAX_FORWARD_AUTH_URL_LENGTH) {
+    failForwardAuth("url", "url is required and must be an absolute HTTPS URL");
+  }
+  let url;
+  try {
+    url = new URL(typed.url);
+  } catch {
+    failForwardAuth("url", "url must be an absolute HTTPS URL");
+  }
+  if (url.protocol !== "https:" || url.hostname.length === 0 || url.username.length > 0 || url.password.length > 0 || url.hash.length > 0 || url.port === "0") {
+    failForwardAuth("url", "url must be an absolute HTTPS URL");
+  }
+  if (typed.headers !== void 0) {
+    if (!isPlainObject2(typed.headers)) {
+      failForwardAuth("headers", "headers must be an object of header name to value");
+    }
+    const entries = Object.entries(typed.headers);
+    if (entries.length > MAX_FORWARD_AUTH_HEADERS) {
+      failForwardAuth("headers", `headers may contain at most ${MAX_FORWARD_AUTH_HEADERS} entries`);
+    }
+    let totalBytes = 0;
+    const seenNames = /* @__PURE__ */ new Set();
+    for (const [name, value] of entries) {
+      validateForwardAuthHeaderName(name, `headers.${name}`, false);
+      const lower = name.toLowerCase();
+      if (seenNames.has(lower)) {
+        failForwardAuth(`headers.${name}`, `headers contains duplicate header \`${name}\``);
+      }
+      seenNames.add(lower);
+      if (typeof value !== "string" || /[\0\r\n]/.test(value)) {
+        failForwardAuth(`headers.${name}`, `headers.${name} must be a string`);
+      }
+      totalBytes += name.length + value.length;
+    }
+    if (totalBytes > MAX_FORWARD_AUTH_HEADER_BYTES) {
+      failForwardAuth("headers", `headers may contain at most ${MAX_FORWARD_AUTH_HEADER_BYTES} bytes`);
+    }
+  }
+  if (typed.timeoutMs !== void 0 && (!Number.isInteger(typed.timeoutMs) || typed.timeoutMs < 100 || typed.timeoutMs > 5e3)) {
+    failForwardAuth("timeoutMs", "timeoutMs must be an integer between 100 and 5000");
+  }
+  if (typed.protectedCookies !== void 0) {
+    if (!Array.isArray(typed.protectedCookies)) {
+      failForwardAuth("protectedCookies", "protectedCookies must be an array of cookie names");
+    }
+    if (typed.protectedCookies.length > MAX_FORWARD_AUTH_COOKIES) {
+      failForwardAuth("protectedCookies", `protectedCookies may contain at most ${MAX_FORWARD_AUTH_COOKIES} names`);
+    }
+    const seen = /* @__PURE__ */ new Set();
+    typed.protectedCookies.forEach((name, index) => {
+      if (typeof name !== "string" || name.length > MAX_FORWARD_AUTH_COOKIE_NAME_LENGTH || !HTTP_TOKEN.test(name)) {
+        failForwardAuth(`protectedCookies[${index}]`, `protectedCookies[${index}] must be a valid HTTP cookie name`);
+      }
+      if (seen.has(name)) {
+        failForwardAuth(`protectedCookies[${index}]`, `protectedCookies contains duplicate cookie \`${name}\``);
+      }
+      seen.add(name);
+    });
+  }
+  if (typed.authResponseHeaders !== void 0) {
+    validateHeaderNameList(typed.authResponseHeaders, "authResponseHeaders");
+  }
+  return typed;
+}
+function validateTlsForwardAuthReference(value, path) {
+  if (!isPlainObject2(value)) {
+    fail2(path, `${path} must be an object with an \`id\``);
+  }
+  for (const field of Object.keys(value)) {
+    if (!FORWARD_AUTH_REFERENCE_FIELDS.includes(field)) {
+      fail2(`${path}.${field}`, `${path} has unknown field \`${field}\`. Expected: ${FORWARD_AUTH_REFERENCE_FIELDS.join(", ")}`);
+    }
+  }
+  const id2 = value.id;
+  if (typeof id2 !== "string" || id2.length === 0) {
+    fail2(`${path}.id`, `${path}.id is required and must be a non-empty string`);
+  }
+}
+function validateTlsDomain(domain) {
+  if (typeof domain !== "string") {
+    fail2("domain", "domain is required and must be a string");
+  }
+  if (domain === "*")
+    return;
+  const bare = domain.startsWith("*.") ? domain.slice(2) : domain;
+  if (bare.length === 0 || bare.length > MAX_DOMAIN_LENGTH) {
+    fail2("domain", `domain \`${domain}\` is not a hostname`);
+  }
+  const labels = bare.split(".");
+  if (labels.length < 2) {
+    fail2("domain", `domain \`${domain}\` must have at least two labels, e.g. acme.com`);
+  }
+  for (const label of labels) {
+    if (label.length === 0 || label.length > MAX_LABEL_LENGTH) {
+      fail2("domain", `domain \`${domain}\` has an empty or over-long label`);
+    }
+    if (!/^[a-z0-9-]+$/.test(label)) {
+      fail2("domain", `domain \`${domain}\`: labels are lowercase letters, digits, and hyphens (a \`*.\` prefix is the only wildcard)`);
+    }
+    if (label.startsWith("-") || label.endsWith("-")) {
+      fail2("domain", `domain \`${domain}\`: a label cannot start or end with a hyphen`);
+    }
+  }
+}
+var ATEXT_PUNCT = "!#$%&'*+-/=?^_`{|}~.";
+function validateTlsMailRoute(domain) {
+  if (typeof domain !== "string") {
+    fail2("domain", "domain is required and must be a string");
+  }
+  const at = domain.lastIndexOf("@");
+  if (at === -1) {
+    validateTlsDomain(domain);
+    return;
+  }
+  const local = domain.slice(0, at);
+  const bare = domain.slice(at + 1);
+  if (local.length === 0 || local.length > 64) {
+    fail2("domain", `mail route \`${domain}\`: the part before \`@\` must be 1-64 characters`);
+  }
+  if (local.startsWith(".") || local.endsWith(".") || local.includes("..")) {
+    fail2("domain", `mail route \`${domain}\`: the part before \`@\` cannot start or end with a dot, or contain \`..\``);
+  }
+  for (const character of local) {
+    if (!/[a-zA-Z0-9]/.test(character) && !ATEXT_PUNCT.includes(character)) {
+      fail2("domain", `mail route \`${domain}\`: the part before \`@\` may use letters, digits, dots, and \`${ATEXT_PUNCT.slice(0, -1)}\` (quoted mailboxes are not supported)`);
+    }
+  }
+  if (bare === "*") {
+    fail2("domain", `mail route \`${domain}\`: \`*\` is not a mail domain \u2014 name the domain the mailbox lives at`);
+  }
+  validateTlsDomain(bare);
+}
+function validateTlsEndpoint(endpoint, side) {
+  if (!isPlainObject2(endpoint)) {
+    fail2(side, `${side} must be an object`);
+  }
+  for (const field of Object.keys(endpoint)) {
+    if (!ENDPOINT_FIELDS2.includes(field)) {
+      fail2(`${side}.${field}`, `${side} has unknown field \`${field}\`. Expected one of: ${ENDPOINT_FIELDS2.join(", ")}`);
+    }
+  }
+  const matcher = endpoint;
+  for (const field of ["vmId", "vpcId", "host"]) {
+    const value = matcher[field];
+    if (value !== void 0 && (typeof value !== "string" || value.length === 0)) {
+      fail2(`${side}.${field}`, `${side}.${field} must be a non-empty string`);
+    }
+  }
+  if (matcher.public !== void 0 && matcher.public !== true) {
+    fail2(`${side}.public`, `${side}.public must be true when present. Omit the field to match something else`);
+  }
+  if (side === "source") {
+    if (matcher.host !== void 0) {
+      fail2("source.host", "source.host is not allowed: a source is who opens the session, not where it lands. Put `host` on the destination");
+    }
+    if (matcher.port !== void 0) {
+      fail2("source.port", "source.port is not allowed: a source is who opens the session, not where it lands. Put `port` on the destination");
+    }
+    if (matcher.public === true && (matcher.vmId !== void 0 || matcher.vpcId !== void 0)) {
+      fail2("source.public", "source cannot combine `public: true` with `vmId` or `vpcId`: use one alone. `public` is every client on the Internet; `vmId`/`vpcId` is a specific dialer");
+    }
+  } else {
+    if (matcher.vpcId !== void 0) {
+      fail2("destination.vpcId", "destination.vpcId is not allowed: a session lands in one place, not on a whole network. Name a `vmId`, a `host`, or `public: true` for the domain's own origin. A whole network may be a source");
+    }
+    const landings = [
+      matcher.vmId !== void 0,
+      matcher.host !== void 0,
+      matcher.public === true
+    ].filter(Boolean).length;
+    if (landings > 1) {
+      fail2("destination", "destination names more than one landing: give exactly one of `vmId`, `host`, or `public: true`");
+    }
+    if ((matcher.vmId !== void 0 || matcher.host !== void 0) && matcher.port === void 0) {
+      fail2("destination.port", `destination.port is required with ${matcher.vmId !== void 0 ? "`vmId`" : "`host`"}: say which port the session lands on`);
+    }
+  }
+  if (matcher.port !== void 0) {
+    if (!Number.isInteger(matcher.port) || matcher.port < 1 || matcher.port > 65535) {
+      fail2(`${side}.port`, `${side}.port must be an integer between 1 and 65535`);
+    }
+  }
+}
+function transformProtocol(transform) {
+  if ("postgres" in transform)
+    return "postgres";
+  if ("smtp" in transform)
+    return "smtp";
+  if ("socks5" in transform)
+    return "socks5";
+  return "http";
+}
+function validateS3Transform(value, path) {
+  function object(value2, fields, path2) {
+    if (!isPlainObject2(value2) || Object.keys(value2).some((key) => !fields.includes(key))) {
+      fail2(path2, `${path2} must contain only ${fields.join(", ")}`);
+    }
+  }
+  object(value, ["region", "credentials", "scope"], path);
+  if (typeof value.region !== "string" || !/^[a-z0-9-]{1,63}$/.test(value.region)) {
+    fail2(`${path}.region`, "invalid s3.region");
+  }
+  object(value.credentials, ["accessKeyId", "secretAccessKey", "sessionToken"], `${path}.credentials`);
+  for (const field of ["accessKeyId", "secretAccessKey", "sessionToken"]) {
+    const credential = value.credentials[field];
+    if (field === "sessionToken" && credential === void 0)
+      continue;
+    if (typeof credential !== "string" || !/^[\x21-\x7e]{1,16384}$/.test(credential)) {
+      fail2(`${path}.credentials.${field}`, "invalid s3 credentials");
+    }
+  }
+  if (!/^[a-zA-Z0-9]+$/.test(value.credentials.accessKeyId)) {
+    fail2(`${path}.credentials.accessKeyId`, "invalid s3 access key id");
+  }
+  object(value.scope, ["bucket", "prefix", "operations"], `${path}.scope`);
+  const { bucket, prefix, operations } = value.scope;
+  if (typeof bucket !== "string" || !/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(bucket) || bucket.includes("..")) {
+    fail2(`${path}.scope.bucket`, "invalid s3.scope.bucket");
+  }
+  if (typeof prefix !== "string" || Buffer.byteLength(prefix, "utf8") > 1024 || /[\x00-\x1f\x7f-\x9f]/u.test(prefix)) {
+    fail2(`${path}.scope.prefix`, "invalid s3.scope.prefix");
+  }
+  const allowed = ["GetObject", "HeadObject", "PutObject", "DeleteObject", "ListObjectsV2", "CreateMultipartUpload", "UploadPart", "ListParts", "CompleteMultipartUpload", "AbortMultipartUpload", "ListMultipartUploads"];
+  if (!Array.isArray(operations) || operations.length === 0 || operations.length > allowed.length || operations.some((op) => !allowed.includes(op)) || new Set(operations).size !== operations.length) {
+    fail2(`${path}.scope.operations`, "s3.scope.operations must be a nonempty list of distinct supported operations");
+  }
+}
+function validateTlsTransform(transform, path) {
+  if (!isPlainObject2(transform)) {
+    fail2(path, `${path} must be an object: \`{ headers: { \u2026 } }\`, \`{ postgres: { \u2026 } }\`, \`{ smtp: { \u2026 } }\` or \`{ socks5: { \u2026 } }\``);
+  }
+  const keys = Object.keys(transform);
+  if (keys.length !== 1 || !["headers", "jsonPatch", "postgres", "smtp", "socks5", "s3"].includes(keys[0] ?? "")) {
+    fail2(path, `${path} must have exactly one of \`headers\`, \`jsonPatch\`, \`postgres\`, \`smtp\`, \`socks5\` or \`s3\` (got: ${keys.length === 0 ? "nothing" : keys.join(", ")})`);
+  }
+  if (keys[0] === "s3") {
+    validateS3Transform(transform.s3, `${path}.s3`);
+    return;
+  }
+  if (keys[0] === "jsonPatch") {
+    const patch = transform.jsonPatch;
+    if (!Array.isArray(patch) || patch.length > 128) {
+      fail2(path, `${path}.jsonPatch must be an array of at most 128 operations`);
+    }
+    const pointer = (value) => typeof value === "string" && (value === "" || value.startsWith("/")) && !/~(?:[^01]|$)/u.test(value);
+    const jsonValue = (value, seen = /* @__PURE__ */ new Set(), depth = 0) => {
+      if (depth > 64)
+        return false;
+      if (value === null || typeof value === "string" || typeof value === "boolean")
+        return true;
+      if (typeof value === "number")
+        return Number.isFinite(value);
+      if (typeof value !== "object" || seen.has(value))
+        return false;
+      seen.add(value);
+      const valid = (Array.isArray(value) ? Array.from(value) : isPlainObject2(value) ? Object.values(value) : [void 0]).every((entry) => jsonValue(entry, seen, depth + 1));
+      seen.delete(value);
+      return valid;
+    };
+    for (const [index, operation] of patch.entries()) {
+      if (!isPlainObject2(operation) || !["add", "remove", "replace", "move", "copy", "test"].includes(String(operation.op)) || !pointer(operation.path)) {
+        fail2(path, `${path}.jsonPatch[${index}] requires a standard op and valid JSON Pointer path`);
+      }
+      if (["move", "copy"].includes(operation.op) && !pointer(operation.from)) {
+        fail2(path, `${path}.jsonPatch[${index}].from must be a JSON Pointer`);
+      }
+      if (["add", "replace", "test"].includes(operation.op) && (!Object.hasOwn(operation, "value") || !jsonValue(operation.value))) {
+        fail2(path, `${path}.jsonPatch[${index}].value must be a JSON value (null is allowed)`);
+      }
+    }
+    let encoded;
+    try {
+      encoded = JSON.stringify(patch);
+    } catch {
+      fail2(path, "jsonPatch must be JSON serializable");
+    }
+    if (Buffer.byteLength(encoded, "utf8") > 64 * 1024)
+      fail2(path, "jsonPatch exceeds 64 KiB");
+    return;
+  }
+  if (keys[0] === "socks5") {
+    const socks5 = transform.socks5;
+    if (!isPlainObject2(socks5)) {
+      fail2(`${path}.socks5`, `${path}.socks5 must be an object with \`username\` and \`password\``);
+    }
+    for (const field of Object.keys(socks5)) {
+      if (!["username", "password"].includes(field)) {
+        fail2(`${path}.socks5.${field}`, `${path}.socks5 has unknown field \`${field}\`. Expected: username, password`);
+      }
+    }
+    for (const field of ["username", "password"]) {
+      if (typeof socks5[field] !== "string" || socks5[field].length === 0) {
+        fail2(`${path}.socks5.${field}`, `${path}.socks5.${field} is required and must be a non-empty string`);
+      }
+    }
+    return;
+  }
+  if (keys[0] === "smtp") {
+    const smtp = transform.smtp;
+    if (!isPlainObject2(smtp)) {
+      fail2(`${path}.smtp`, `${path}.smtp must be an object with \`username\` and \`password\``);
+    }
+    for (const field of Object.keys(smtp)) {
+      if (!["username", "password"].includes(field)) {
+        fail2(`${path}.smtp.${field}`, `${path}.smtp has unknown field \`${field}\`. Expected: username, password`);
+      }
+    }
+    for (const field of ["username", "password"]) {
+      if (typeof smtp[field] !== "string" || smtp[field].length === 0) {
+        fail2(`${path}.smtp.${field}`, `${path}.smtp.${field} is required and must be a non-empty string`);
+      }
+    }
+    return;
+  }
+  if (keys[0] === "headers") {
+    const headers = transform.headers;
+    if (!isPlainObject2(headers)) {
+      fail2(`${path}.headers`, `${path}.headers must be an object of header name to value`);
+    }
+    for (const [name, value] of Object.entries(headers)) {
+      if (typeof value !== "string") {
+        fail2(`${path}.headers.${name}`, `${path}.headers.${name} must be a string`);
+      }
+    }
+  } else {
+    const postgres2 = transform.postgres;
+    if (!isPlainObject2(postgres2)) {
+      fail2(`${path}.postgres`, `${path}.postgres must be an object with \`username\` and \`password\``);
+    }
+    for (const field of Object.keys(postgres2)) {
+      if (!["username", "password", "database"].includes(field)) {
+        fail2(`${path}.postgres.${field}`, `${path}.postgres has unknown field \`${field}\`. Expected: username, password, database`);
+      }
+    }
+    const pg = postgres2;
+    for (const field of ["username", "password"]) {
+      if (typeof pg[field] !== "string" || pg[field].length === 0) {
+        fail2(`${path}.postgres.${field}`, `${path}.postgres.${field} is required and must be a non-empty string`);
+      }
+    }
+    if (pg.database !== void 0 && typeof pg.database !== "string") {
+      fail2(`${path}.postgres.database`, `${path}.postgres.database must be a string`);
+    }
+  }
+}
+function resolveTlsProtocol(protocol, transforms) {
+  let resolved = protocol;
+  transforms.forEach((transform, index) => {
+    const needed = transformProtocol(transform);
+    if (resolved === void 0) {
+      resolved = needed;
+    } else if (resolved !== needed) {
+      fail2(`transform[${index}]`, `transform requires protocol \`${needed}\` but the rule is \`${resolved}\`; a rule terminates one protocol`);
+    }
+  });
+  return resolved ?? "http";
+}
+function validateHttpRequestMatch(value, path) {
+  if (!isPlainObject2(value) || Object.keys(value).some((key) => key !== "method" && key !== "path")) {
+    fail2(path, `${path} must be an object containing only method and path`);
+  }
+  if (value.method !== void 0 && (!Array.isArray(value.method) || value.method.some((method) => typeof method !== "string" || method.length === 0 || /[^!#$%&'*+.^_`|~0-9A-Za-z-]/.test(method)))) {
+    fail2(`${path}.method`, `${path}.method must be an array of HTTP method tokens`);
+  }
+  if (value.path !== void 0) {
+    const matcher = value.path;
+    if (!isPlainObject2(matcher) || Object.keys(matcher).length !== 1 || typeof matcher.exact !== "string" || !matcher.exact.startsWith("/") || /[\s?#]/.test(matcher.exact)) {
+      fail2(`${path}.path`, `${path}.path must contain exact: an absolute path without a query or fragment`);
+    }
+  }
+}
+var RULE_FIELDS2 = [
+  "action",
+  "domain",
+  "protocol",
+  "source",
+  "destination",
+  "transform",
+  "match",
+  "forwardAuth"
+];
+function validateRuleShape2(rule, prefix) {
+  if (!isPlainObject2(rule)) {
+    fail2(prefix || "rule", `${prefix || "rule"} must be an object`);
+  }
+  for (const field of Object.keys(rule)) {
+    if (!RULE_FIELDS2.includes(field)) {
+      fail2(`${prefix}${field}`, `Unknown field \`${field}\`. Expected one of: ${RULE_FIELDS2.join(", ")}`);
+    }
+  }
+  const typed = rule;
+  if (typed.action === void 0) {
+    fail2(`${prefix}action`, `${prefix}action is required. Write \`action: "allow"\` \u2014 every rule states what it does rather than defaulting to it`);
+  }
+  if (typed.action !== "allow") {
+    fail2(`${prefix}action`, `${prefix}action must be "allow" (got \`${String(typed.action)}\`). Only allow rules exist today`);
+  }
+  if (typed.protocol !== void 0 && !PROTOCOLS2.includes(typed.protocol)) {
+    fail2(`${prefix}protocol`, `${prefix}protocol must be one of: ${PROTOCOLS2.join(", ")} (got \`${String(typed.protocol)}\`)`);
+  }
+  const source = typed.source ?? {};
+  const destination = typed.destination ?? {};
+  validateTlsEndpoint(source, "source");
+  validateTlsEndpoint(destination, "destination");
+  const transforms = typed.transform ?? [];
+  if (!Array.isArray(transforms)) {
+    fail2(`${prefix}transform`, `${prefix}transform must be an array`);
+  }
+  transforms.forEach((transform, index) => validateTlsTransform(transform, `${prefix}transform[${index}]`));
+  const protocol = resolveTlsProtocol(typed.protocol, transforms);
+  if (typed.match !== void 0) {
+    validateHttpRequestMatch(typed.match, `${prefix}match`);
+    if (protocol !== "http" || source.public === true || !(destination.public === true || destination.host !== void 0)) {
+      fail2(`${prefix}match`, "match requires HTTP egress from a VM or VPC to a public origin or host");
+    }
+  }
+  if (transforms.some((entry) => "s3" in entry)) {
+    if (transforms.length !== 1 || typed.match !== void 0 || source.public === true || !(destination.public === true || destination.host !== void 0) || typed.domain.includes("*")) {
+      fail2(`${prefix}transform`, "s3 requires a sole transform on HTTP egress to a concrete origin, without match");
+    }
+  }
+  const patches = transforms.filter((entry) => "jsonPatch" in entry);
+  if (patches.length > 1) {
+    fail2(`${prefix}transform`, "a rule may carry only one jsonPatch transform");
+  }
+  if (patches.length && (source.public === true || !(destination.public === true || destination.host !== void 0))) {
+    fail2(`${prefix}transform`, "jsonPatch requires HTTP egress from a VM or VPC to a public origin or host");
+  }
+  if (typed.forwardAuth !== void 0) {
+    validateTlsForwardAuthReference(typed.forwardAuth, `${prefix}forwardAuth`);
+    const destinationIsVm = destination.vmId !== void 0 || !hasTlsIdentity(destination) && destination.port !== void 0;
+    if (protocol !== "http" || source.public !== true || !destinationIsVm || typed.domain === "*") {
+      fail2(`${prefix}forwardAuth`, `${prefix}forwardAuth is only supported on HTTP public ingress: \`{ public: true } -> { vmId, port }\``);
+    }
+  }
+  if (protocol === "smtp") {
+    validateTlsMailRoute(typed.domain);
+  } else {
+    validateTlsDomain(typed.domain);
+  }
+  const internalService = (source.vmId !== void 0 || source.vpcId !== void 0) && destination.vmId !== void 0;
+  if (internalService && transforms.length > 0) {
+    fail2(`${prefix}transform`, "a VM-to-VM rule cannot carry a transform yet \u2014 remove it (only public ingress/egress rules run transforms)");
+  }
+  if (protocol === "tcp") {
+    const destinationIsWorld = destination.public === true || destination.host !== void 0;
+    const sourceIsIdentity = source.vmId !== void 0 || source.vpcId !== void 0;
+    if (destinationIsWorld || sourceIsIdentity) {
+      fail2(`${prefix}protocol`, "a `tcp` rule is public ingress only \u2014 `{ public: true } -> { vmId, port }`. The edge splices the session without terminating it, so outbound there is nothing to broker (an outbound allow is a firewall rule, and injecting into one needs `http` or `postgres`) and inward there is no certificate to answer the source with. Give the source `public: true`, or drop `protocol` to be served as HTTPS");
+    }
+  } else if (protocol === "imap" || protocol === "imaps") {
+    const destinationIsWorld = destination.public === true || destination.host !== void 0;
+    const sourceIsIdentity = source.vmId !== void 0 || source.vpcId !== void 0;
+    if (destinationIsWorld || sourceIsIdentity) {
+      fail2(`${prefix}protocol`, `an \`${protocol}\` rule is public ingress only \u2014 \`{ public: true } -> { vmId, port }\`. The 993 front serves mail clients reaching a VM's IMAP server; outbound there is nothing to broker (an outbound allow is a firewall rule) and inward there is no certificate to answer the source with`);
+    }
+  } else if (protocol === "socks5") {
+    const destinationIsWorld = destination.public === true || destination.host !== void 0;
+    const sourceIsIdentity = source.public !== true;
+    if (!sourceIsIdentity || !destinationIsWorld) {
+      fail2(`${prefix}protocol`, 'a `socks5` rule is egress only \u2014 `{ vmId } -> { host: "gate.provider.com", port: 1080 }`. The front exists so a guest can open sessions through a proxy whose credentials it never holds; inbound there is nothing to serve, and publishing one would be an open proxy on a platform address');
+    }
+    if (destination.host === void 0) {
+      fail2(`${prefix}destination`, "a `socks5` rule has to name the proxy it goes through: give the destination a `host` and the `port` the provider listens on. `{ public: true }` on its own asks the edge to be the proxy, which would let the guest out on our address rather than through yours");
+    }
+  } else if (protocol === "postgres") {
+    const injects = transforms.some((transform) => transform !== null && typeof transform === "object" && "postgres" in transform);
+    const destinationIsWorld = destination.public === true || destination.host !== void 0;
+    if (injects && !destinationIsWorld) {
+      fail2(`${prefix}transform`, "a `postgres` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would hand every client a logged-in session. Give the destination `public: true` or a `host`, or drop the transform");
+    }
+  } else if (protocol === "smtp") {
+    const injects = transforms.some((transform) => transform !== null && typeof transform === "object" && "smtp" in transform);
+    const destinationIsWorld = destination.public === true || destination.host !== void 0;
+    if (injects && !destinationIsWorld) {
+      fail2(`${prefix}transform`, "an `smtp` transform belongs on an egress rule: the edge spends a credential the guest never holds, so pointing it at your own VM would turn it into an open relay. Give the destination `public: true` or a `host`, or drop the transform");
+    }
+    if (typeof typed.domain === "string" && typed.domain.includes("@") && source.public !== true) {
+      fail2(`${prefix}domain`, `\`${typed.domain}\` names a mailbox, which only makes sense on a rule that receives mail. An egress or VM-to-VM rule names the host the guest submits through \u2014 drop the part before \`@\``);
+    }
+  }
+  return { ...typed, source, destination };
+}
+function missingIdentityMessage(side, endpoint) {
+  if (side === "source") {
+    return isEmptyEndpoint(endpoint) ? "source is empty. Say who opens the session: `vmId`, `vpcId`, or `public: true`" : "source only narrows the session without saying who opens it. Add `vmId`, `vpcId`, or `public: true`";
+  }
+  return "destination is empty. Say where the session lands: `vmId` + `port`, `host` + `port`, or `public: true` for the domain's own origin";
+}
+function validateTlsRule(rule) {
+  const typed = validateRuleShape2(rule, "");
+  for (const side of ["source", "destination"]) {
+    const endpoint = typed[side];
+    if (!hasTlsIdentity(endpoint)) {
+      fail2(side, missingIdentityMessage(side, endpoint));
+    }
+  }
+  if (typed.source.public === true && typed.destination.public === true) {
+    fail2("destination", "a rule from the public Internet to the domain's own origin allows nothing the world cannot already do. Did you mean a `vmId` destination (ingress) or a `vmId` source (egress)?");
+  }
+  return typed;
+}
+function validateTlsSpec(spec) {
+  if (!isPlainObject2(spec)) {
+    fail2("tls", "tls must be an object with a `rules` array");
+  }
+  for (const field of Object.keys(spec)) {
+    if (field !== "rules") {
+      fail2(`tls.${field}`, `tls has unknown field \`${field}\`. Expected: rules`);
+    }
+  }
+  const rules = spec.rules;
+  if (!Array.isArray(rules)) {
+    fail2("tls.rules", "tls.rules must be an array");
+  }
+  rules.forEach((rule, index) => {
+    const prefix = `tls.rules[${index}].`;
+    const typed = validateRuleShape2(rule, prefix);
+    const sourceNames = hasTlsIdentity(typed.source);
+    const destinationNames = hasTlsIdentity(typed.destination);
+    if (!sourceNames && !destinationNames) {
+      fail2(`tls.rules[${index}]`, `tls.rules[${index}]: both source and destination refer to the VM being created, which allows nothing. Give one of them a \`vmId\`, \`vpcId\`, or \`public: true\``);
+    }
+    if (sourceNames && destinationNames) {
+      fail2(`tls.rules[${index}]`, `tls.rules[${index}]: neither end refers to the VM being created. Leave one endpoint's identity unset so it means this VM, or create the rule with tls.rules.create instead`);
+    }
+    if (!destinationNames && typed.destination.port === void 0) {
+      fail2(`tls.rules[${index}].destination.port`, `tls.rules[${index}]: destination.port is required: say which port on this VM the session lands on`);
+    }
+  });
+  return spec;
+}
+function tlsRulePath(ruleId) {
+  return `/v5/tls/${segment(ruleId)}`;
+}
+function tlsForwardAuthPath(id2) {
+  return `/v5/tls/forward-auth/${segment(id2)}`;
+}
+var TlsForwardAuthNamespace = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  /** List your forward-auth configurations, newest first. */
+  list() {
+    return this.client.get("/v5/tls/forward-auth");
+  }
+  /** Create a forward-auth configuration. Static request-header values are write-only. */
+  async create(options) {
+    const validated = validateTlsForwardAuth(options);
+    return this.client.post("/v5/tls/forward-auth", validated);
+  }
+  /** Fetch one forward-auth configuration by id. */
+  get(id2) {
+    return this.client.get(tlsForwardAuthPath(id2));
+  }
+  /** Replace a configuration in place, including rotating its static headers. */
+  async update(id2, options) {
+    const validated = validateTlsForwardAuth(options);
+    return this.client.put(tlsForwardAuthPath(id2), validated);
+  }
+  /** Delete an unused forward-auth configuration. */
+  delete(id2) {
+    return this.client.delete(tlsForwardAuthPath(id2));
+  }
+};
+var TlsRulesNamespace = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  /**
+   * Allow a named TLS session: `domain`, from `source`, to `destination`.
+   *
+   * An ingress `domain` is a name you have verified, or any unused subdomain
+   * of `style.dev`, which is free and needs no verification or DNS records.
+   *
+   * @example
+   * // Public HTTPS ingress: anyone dialing app.acme.com lands on a VM's port.
+   * await freestyle.tls.rules.create({
+   *   action: "allow",
+   *   domain: "app.acme.com",
+   *   source: { public: true },
+   *   destination: { vmId: "vm-123456", port: 8000 },
+   * });
+   *
+   * @example
+   * // Egress with a secret injected: a VM reaches OpenAI at its real origin,
+   * // and the edge adds the Authorization header the guest never held.
+   * await freestyle.tls.rules.create({
+   *   action: "allow",
+   *   domain: "api.openai.com",
+   *   source: { vmId: "vm-123456" },
+   *   destination: { public: true },
+   *   transform: [{ headers: { authorization: "Bearer sk-…" } }],
+   * });
+   *
+   * @example
+   * // Internal service: one VM reaches another by a name. The source opens
+   * // https://api.internal; the edge terminates it and forwards to the target
+   * // VM's port. Steered at the edge, HTTP-only, no transform.
+   * await freestyle.tls.rules.create({
+   *   action: "allow",
+   *   domain: "api.internal",
+   *   source: { vmId: "vm-123456" },
+   *   destination: { vmId: "vm-654321", port: 8000 },
+   * });
+   *
+   * @throws {TlsRuleValidationError} before any request, when the rule cannot be
+   * well formed.
+   */
+  // `async` so a validation failure arrives as a rejected promise like every
+  // other error from this client, instead of a synchronous throw that a
+  // `.catch()` chain would sail straight past.
+  async create(options) {
+    const validated = validateTlsRule(options);
+    return this.client.post("/v5/tls", validated);
+  }
+  /**
+   * List your rules, newest first. Pass `vmId` for the rules that apply to one
+   * VM — those naming it, plus those naming a private network it is on.
+   */
+  list(options = {}) {
+    return this.client.get("/v5/tls", options);
+  }
+  get(ruleId) {
+    return this.client.get(tlsRulePath(ruleId));
+  }
+  /**
+   * Replace a rule in place. The one mutation the firewall does not allow: a
+   * transform carries a rotating secret, and delete-then-create would drop
+   * traffic or trip the account limit mid-swap. The rule keeps its id and
+   * creation time; everything in `options` is replaced.
+   *
+   * @throws {TlsRuleValidationError} before any request, when the replacement
+   * cannot be well formed.
+   */
+  async update(ruleId, options) {
+    const validated = validateTlsRule(options);
+    return this.client.put(tlsRulePath(ruleId), validated);
+  }
+  /** Delete a rule. The resources it named are untouched. */
+  delete(ruleId) {
+    return this.client.delete(tlsRulePath(ruleId));
+  }
+};
+var TlsNamespace = class {
+  client;
+  rules;
+  forwardAuth;
+  constructor(client) {
+    this.client = client;
+    this.rules = new TlsRulesNamespace(client);
+    this.forwardAuth = new TlsForwardAuthNamespace(client);
+  }
+};
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/tunnel.js
+function tunnelPath(idOrSlug) {
+  return `/v5/tunnels/${segment(idOrSlug)}`;
+}
+function withTunnelId(tunnel) {
+  tunnel.tunnelId ??= tunnel.id;
+  return tunnel;
+}
+var TunnelsNamespace = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  /** List your tunnels, newest first. Listings never include a private key. */
+  list() {
+    return this.client.get("/v5/tunnels").then((result) => {
+      result.tunnels.forEach(withTunnelId);
+      return result;
+    });
+  }
+  /**
+   * Create a tunnel, optionally attaching networks in the same call
+   * (`vpcs`, all-or-nothing). This is a one-time setup: the tunnel lives
+   * until you delete it and its config never changes — save it, bring it up
+   * once, and manage which networks it reaches by attaching and detaching
+   * them.
+   */
+  create(options = {}) {
+    return this.client.post("/v5/tunnels", options).then(withTunnelId);
+  }
+  /** Read one tunnel by its id or its slug. Its config comes back with a blank `PrivateKey`. */
+  get(tunnelIdOrSlug) {
+    return this.client.get(tunnelPath(tunnelIdOrSlug)).then(withTunnelId);
+  }
+  /**
+   * Rename a tunnel or change its slug. Only the labels move: the keys,
+   * addresses, routes and attached networks are untouched, so a connected
+   * client sees nothing change and the config you saved keeps working.
+   */
+  update(tunnelIdOrSlug, options) {
+    return this.client.patch(tunnelPath(tunnelIdOrSlug), options).then(withTunnelId);
+  }
+  /**
+   * Replace a tunnel's keys, keeping its id and every attached network's
+   * address. Use this if you lost the config or need to revoke one that
+   * leaked.
+   */
+  rotateKey(tunnelIdOrSlug, options = {}) {
+    return this.client.post(`${tunnelPath(tunnelIdOrSlug)}/rotate-key`, options).then(withTunnelId);
+  }
+  /** Delete a tunnel, detaching every network as it goes. */
+  delete(tunnelIdOrSlug) {
+    return this.client.delete(tunnelPath(tunnelIdOrSlug));
+  }
+  /**
+   * Attach a private network to a tunnel. The tunnel gains an address inside
+   * the network — what that network's VMs see as your address — and a
+   * connected client can reach it immediately, with no config change. The
+   * network's CIDRs must fall inside the tunnel's routes and must not
+   * overlap another attached network's.
+   */
+  attachVpc(tunnelIdOrSlug, vpcIdOrSlug, options = {}) {
+    return this.client.post(`${tunnelPath(tunnelIdOrSlug)}/vpcs/${segment(vpcIdOrSlug)}`, options).then(withTunnelId);
+  }
+  /**
+   * Detach a private network from a tunnel: it stops being reachable and the
+   * tunnel's address inside it is released. The tunnel — and any connected
+   * client — carries on untouched.
+   */
+  detachVpc(tunnelIdOrSlug, vpcIdOrSlug) {
+    return this.client.delete(`${tunnelPath(tunnelIdOrSlug)}/vpcs/${segment(vpcIdOrSlug)}`).then(withTunnelId);
+  }
+};
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/vms/fs.js
+var RESUMABLE_THRESHOLD_BYTES = 8 * 1024 * 1024;
+var DEFAULT_CHUNK_BYTES = 16 * 1024 * 1024;
+var DEFAULT_MAX_ATTEMPTS = 5;
+var VmFilesystem = class {
+  client;
+  basePath;
+  constructor(client, basePath) {
+    this.client = client;
+    this.basePath = basePath;
+  }
+  /**
+   * Read a whole file, or with `offset`/`length` just part of one, into memory.
+   *
+   * The result is a plain `Uint8Array` on every runtime — never a Node
+   * `Buffer`, even on Node. Don't coerce it with `String(bytes)` or
+   * `bytes.toString()`: those go through the typed-array `toString` and
+   * produce the byte values joined by commas ("123,10,32,…"), not the file's
+   * text. For text use {@link readTextFile}, or decode explicitly with
+   * `new TextDecoder().decode(bytes)`.
+   */
+  async readFile(path, options = {}) {
+    const response = await this.openRead(path, options);
+    return new Uint8Array(await response.arrayBuffer());
+  }
+  /** Read a file as UTF-8 text. Use this, not `String(await readFile(...))`. */
+  async readTextFile(path, options = {}) {
+    const response = await this.openRead(path, options);
+    return await response.text();
+  }
+  /**
+   * Stream a file out of the VM without holding it in memory — pipe it to disk,
+   * to an HTTP response, or through a parser.
+   *
+   * ```ts
+   * const bytes = await vm.fs.readFileStream("/var/log/big.log");
+   * await pipeline(Readable.fromWeb(bytes), createWriteStream("big.log"));
+   * ```
+   */
+  async readFileStream(path, options = {}) {
+    const response = await this.openRead(path, options);
+    if (!response.body)
+      throw new Error(`no response body reading ${path}`);
+    return response.body;
+  }
+  /**
+   * Write a file into the VM, whatever its size.
+   *
+   * ```ts
+   * await vm.fs.writeFile("/etc/app.conf", "debug = true");
+   * await vm.fs.writeFile("/data/model.bin", await openAsBlob("model.bin"), {
+   *   onProgress: ({ completedBytes, totalBytes }) =>
+   *     console.log(`${completedBytes}/${totalBytes}`),
+   * });
+   * ```
+   *
+   * A `Blob` (`node:fs`'s `openAsBlob`, or a browser `File`) is read one chunk at
+   * a time and never held in memory whole.
+   */
+  async writeFile(path, content, options = {}) {
+    const body = typeof content === "string" ? new TextEncoder().encode(content) : content;
+    const size = body instanceof Uint8Array ? body.byteLength : body.size;
+    if (size > RESUMABLE_THRESHOLD_BYTES) {
+      return this.uploadInChunks(path, body, size, options);
+    }
+    const bytes = body instanceof Uint8Array ? body : new Uint8Array(await body.arrayBuffer());
+    await this.client.putBytes(`${this.basePath}/fs/write`, bytes, { path, mode: options.mode, sha256: await sha256Hex(bytes) }, options.signal);
+    options.onProgress?.({ completedBytes: size, totalBytes: size });
+  }
+  /** Write text. Identical to {@link writeFile} with a string. */
+  writeTextFile(path, content, options = {}) {
+    return this.writeFile(path, content, options);
+  }
+  async readDir(path) {
+    const { entries } = await this.client.get(`${this.basePath}/fs/dir`, { path });
+    return entries;
+  }
+  async mkdir(path) {
+    await this.client.post(`${this.basePath}/fs/mkdir`, { path });
+  }
+  async remove(path) {
+    await this.client.delete(`${this.basePath}/fs/remove`, { path });
+  }
+  async exists(path) {
+    const { exists } = await this.client.get(`${this.basePath}/fs/exists`, { path });
+    return exists;
+  }
+  stat(path) {
+    return this.client.get(`${this.basePath}/fs/stat`, { path });
+  }
+  openRead(path, options) {
+    const { offset, length } = options;
+    let range;
+    if (offset !== void 0 || length !== void 0) {
+      const start = offset ?? 0;
+      range = length === void 0 ? `bytes=${start}-` : `bytes=${start}-${start + length - 1}`;
+    }
+    return this.client.getBytes(`${this.basePath}/fs/read`, { path }, { range, signal: options.signal });
+  }
+  /**
+   * Send a large file as an upload session: ordered chunks, each retried
+   * independently with backoff, so one dropped connection costs one chunk rather
+   * than the whole transfer. The file appears at `path` only on commit.
+   */
+  async uploadInChunks(path, content, size, options) {
+    const chunkSize = options.chunkSize ?? DEFAULT_CHUNK_BYTES;
+    const maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+    const sha256 = content instanceof Uint8Array ? await sha256Hex(content) : void 0;
+    const session = await this.client.post(`${this.basePath}/fs/uploads`, {
+      path,
+      size,
+      sha256,
+      mode: options.mode
+    });
+    const uploadPath = `${this.basePath}/fs/uploads/${session.uploadId}`;
+    try {
+      let offset = session.receivedBytes;
+      while (offset < size) {
+        const end = Math.min(offset + chunkSize, size);
+        const chunk = content instanceof Uint8Array ? content.subarray(offset, end) : content.slice(offset, end);
+        const status = await this.putChunkWithRetry(uploadPath, chunk, offset, maxAttempts, options.signal);
+        offset = status.receivedBytes;
+        options.onProgress?.({ completedBytes: Math.min(offset, size), totalBytes: size });
+      }
+      await this.client.post(`${uploadPath}/commit`);
+    } catch (error) {
+      await this.client.delete(uploadPath).catch(() => {
+      });
+      throw error;
+    }
+  }
+  /**
+   * PUT one chunk, retrying transient failures. After any failure the session
+   * is re-fetched: the server only counts fully-stored chunks, so its
+   * `receivedBytes` tells us whether this chunk actually landed (return) or
+   * must be resent (retry).
+   */
+  async putChunkWithRetry(uploadPath, chunk, offset, maxAttempts, signal) {
+    let lastError;
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+      signal?.throwIfAborted?.();
+      try {
+        return await this.client.putBytes(uploadPath, chunk, { offset }, signal);
+      } catch (error) {
+        lastError = error;
+        const retryable = !(error instanceof FreestyleApiError) || error.status >= 500 || error.status === 408 || error.status === 409 || error.status === 429;
+        if (!retryable || signal?.aborted || attempt === maxAttempts)
+          throw error;
+        await sleep(Math.min(500 * 2 ** (attempt - 1), 8e3));
+        const status = await this.client.get(uploadPath).catch(() => void 0);
+        if (status && status.receivedBytes > offset)
+          return status;
+      }
+    }
+    throw lastError;
+  }
+};
+async function sha256Hex(bytes) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle)
+    return void 0;
+  const digest = await subtle.digest("SHA-256", bytes);
+  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/vms/pty.js
+function isNodeRuntime2() {
+  return typeof process !== "undefined" && Boolean(process.versions?.node);
+}
+async function openSocket(url, headers) {
+  if (isNodeRuntime2()) {
+    let wsModule;
+    try {
+      wsModule = await import("./wrapper-GH5LMTDE.js");
+    } catch {
+      throw new Error("PTY sessions need the `ws` package in Node. Install it with `npm install ws`.");
+    }
+    return new wsModule.default(url, { headers });
+  }
+  const NativeWebSocket = globalThis.WebSocket;
+  if (!NativeWebSocket) {
+    throw new Error("PTY sessions need a WebSocket client; no global WebSocket is available in this environment.");
+  }
+  return new NativeWebSocket(url);
+}
+function onSocketEvent(socket, event, listener) {
+  if (socket.on) {
+    socket.on(event, listener);
+    return;
+  }
+  socket.addEventListener?.(event, listener);
+}
+var utf8Decoder = new TextDecoder();
+function normalizeMessage(raw, isBinary) {
+  if (raw && typeof raw === "object" && "data" in raw) {
+    const data = raw.data;
+    if (typeof data === "string")
+      return { text: data };
+    if (data instanceof ArrayBuffer)
+      return { binary: new Uint8Array(data) };
+    return {};
+  }
+  if (raw instanceof Uint8Array)
+    return isBinary ? { binary: raw } : { text: utf8Decoder.decode(raw) };
+  if (typeof raw === "string")
+    return { text: raw };
+  return {};
+}
+var PtySession = class {
+  _sessionId;
+  _slug;
+  _created = false;
+  socket;
+  constructor(socket, sessionId, events = {}) {
+    this.socket = socket;
+    this._sessionId = sessionId;
+    onSocketEvent(socket, "message", (raw, isBinary) => {
+      const { text, binary } = normalizeMessage(raw, isBinary);
+      if (binary) {
+        events.onData?.(binary);
+        return;
+      }
+      if (!text)
+        return;
+      let msg;
+      try {
+        msg = JSON.parse(text);
+      } catch {
+        return;
+      }
+      if (msg.type === "exited")
+        events.onExit?.(msg.exitCode);
+      else if (msg.type === "error")
+        events.onError?.(new Error(msg.message));
+      else if (msg.type === "sessionInfo") {
+        this._sessionId = msg.sessionId;
+        this._slug = msg.slug;
+        this._created = msg.created ?? true;
+        events.onSessionInfo?.(msg.sessionId);
+      }
+    });
+    onSocketEvent(socket, "close", (raw) => {
+      const info = raw;
+      events.onClose?.({
+        wasClean: info?.wasClean ?? true,
+        code: info?.code ?? 1e3,
+        reason: info?.reason ?? ""
+      });
+    });
+    onSocketEvent(socket, "error", (error) => events.onError?.(error));
+  }
+  /** Send raw bytes (or UTF-8 text) to the guest's stdin. */
+  write(data) {
+    this.socket.send(typeof data === "string" ? new TextEncoder().encode(data) : data);
+  }
+  resize(options) {
+    this.sendControl({ type: "resize", cols: options.cols, rows: options.rows });
+  }
+  signal(sig) {
+    this.sendControl({ type: "signal", signal: sig });
+  }
+  sendControl(msg) {
+    this.socket.send(JSON.stringify(msg));
+  }
+  /** Close the connection. The shell keeps running; a later `attach()` can reconnect. */
+  detach() {
+    this.socket.close();
+  }
+  get sessionId() {
+    return this._sessionId;
+  }
+  /**
+   * The name this session answers to, from the server's `sessionInfo` frame.
+   * `undefined` for a session opened without a slug — reattach to that one by
+   * `sessionId` instead.
+   */
+  get slug() {
+    return this._slug;
+  }
+  /**
+   * Whether `open()` started this shell, or handed back one that was already
+   * running under the same `slug`. `false` means your `exec` never ran — check
+   * it before waiting on output from a command you thought you started.
+   */
+  get created() {
+    return this._created;
+  }
+  get readyState() {
+    return this.socket.readyState;
+  }
+};
+function waitForOpen(socket) {
+  return new Promise((resolve, reject) => {
+    if (socket.readyState === 1) {
+      resolve();
+      return;
+    }
+    onSocketEvent(socket, "open", () => resolve());
+    onSocketEvent(socket, "error", (error) => reject(error));
+  });
+}
+var VmPty = class {
+  client;
+  basePath;
+  constructor(client, basePath) {
+    this.client = client;
+    this.basePath = basePath;
+  }
+  /**
+   * Open a new terminal on the VM. The returned session's data/exit
+   * listeners are live from the moment the socket connects — installed
+   * before we even know the session id — so a command that produces output
+   * (or exits) immediately can never race past them.
+   */
+  async open(options = {}) {
+    const { exec, cols, rows, linuxUser, slug, replaceOnExit, onData, onExit, onClose, onError } = options;
+    const query = {};
+    if (exec !== void 0)
+      query.exec = exec;
+    if (cols !== void 0)
+      query.cols = cols;
+    if (rows !== void 0)
+      query.rows = rows;
+    if (linuxUser !== void 0)
+      query.linuxUser = linuxUser;
+    if (slug !== void 0)
+      query.slug = slug;
+    if (replaceOnExit !== void 0)
+      query.replaceOnExit = String(replaceOnExit);
+    const url = wsUrl(this.client, `${this.basePath}/pty`, query);
+    const headers = this.client.authHeaders();
+    const socket = await openSocket(url, headers);
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const session = new PtySession(socket, -1, {
+        onData,
+        onExit,
+        onClose: (info) => {
+          if (!settled) {
+            settled = true;
+            reject(new Error("connection closed before sessionInfo"));
+          }
+          onClose?.(info);
+        },
+        onError: (error) => {
+          if (!settled) {
+            settled = true;
+            reject(error);
+          }
+          onError?.(error);
+        },
+        onSessionInfo: () => {
+          settled = true;
+          resolve(session);
+        }
+      });
+    });
+  }
+  /** Reattach to an existing session; retained scrollback replays first. */
+  async attach(options) {
+    const { session: selector, linuxUser, onData, onExit, onClose, onError } = options;
+    const url = wsUrl(this.client, `${this.basePath}/pty/sessions/${segment(String(selector))}`, {
+      ...linuxUser !== void 0 ? { linuxUser } : {}
+    });
+    const headers = this.client.authHeaders();
+    const socket = await openSocket(url, headers);
+    const session = new PtySession(socket, typeof selector === "number" ? selector : -1, {
+      onData,
+      onExit,
+      onClose,
+      onError
+    });
+    await waitForOpen(socket);
+    return session;
+  }
+  /** List the VM's terminal sessions, running and recently exited. */
+  list(options = {}) {
+    return this.client.get(`${this.basePath}/pty/sessions`, options);
+  }
+  /** Kill a terminal session and remove it. */
+  close(session, options = {}) {
+    return this.client.delete(`${this.basePath}/pty/sessions/${segment(String(session))}`, options);
+  }
+};
+var VmLinuxUserPty = class {
+  pty;
+  linuxUser;
+  constructor(pty, linuxUser) {
+    this.pty = pty;
+    this.linuxUser = linuxUser;
+  }
+  open(options = {}) {
+    return this.pty.open({ ...options, linuxUser: this.linuxUser });
+  }
+  attach(options) {
+    return this.pty.attach({ ...options, linuxUser: this.linuxUser });
+  }
+  list() {
+    return this.pty.list({ linuxUser: this.linuxUser });
+  }
+  close(session) {
+    return this.pty.close(session, { linuxUser: this.linuxUser });
+  }
+};
+function wsUrl(client, path, query) {
+  const httpUrl = client.url(path, query);
+  return httpUrl.replace(/^http/, "ws");
+}
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/vms/snapshots.js
+var VmSnapshotsNamespace = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  list(options = {}) {
+    return this.client.get("/v5/snapshots", options);
+  }
+  get(snapshotId) {
+    return this.client.get(`/v5/snapshots/${segment(snapshotId)}`);
+  }
+  update(snapshotId, options) {
+    return this.client.patch(`/v5/snapshots/${segment(snapshotId)}`, options);
+  }
+  delete(snapshotId) {
+    return this.client.delete(`/v5/snapshots/${segment(snapshotId)}`);
+  }
+};
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/vms/index.js
+function vmPath(id2) {
+  return `/v5/vms/${segment(id2)}`;
+}
+var Vm = class {
+  id;
+  fs;
+  pty;
+  client;
+  basePath;
+  constructor(client, id2) {
+    this.client = client;
+    this.id = id2;
+    this.basePath = vmPath(id2);
+    this.fs = new VmFilesystem(client, this.basePath);
+    this.pty = new VmPty(client, this.basePath);
+  }
+  /** Fetch the current VM record. */
+  data() {
+    return this.client.get(this.basePath);
+  }
+  /**
+   * The firewall rules that apply to this VM: those naming it, plus those
+   * naming a private network it is attached to.
+   *
+   * Deleting the VM deletes the rules that name it, so this never reports a
+   * rule over a machine that no longer exists.
+   */
+  firewallRules() {
+    return this.client.get("/v5/firewall/rules", { vmId: this.id });
+  }
+  /** Rename the VM, change its slug or idle timeout, or merge in metadata. */
+  update(options) {
+    return this.client.patch(this.basePath, options);
+  }
+  /** Boot a stopped VM, or resume a paused one. */
+  start() {
+    return this.client.post(`${this.basePath}/start`);
+  }
+  /** Freeze a running VM, keeping its memory so a later start resumes it exactly. */
+  pause() {
+    return this.client.post(`${this.basePath}/pause`);
+  }
+  /**
+   * Change vCPU, memory, or disk. Every axis is grow-only. vCPU and memory
+   * apply live to a running VM, on resume for a paused one, and at the next
+   * boot for a stopped one. Growing the disk needs a running VM.
+   */
+  resize(options) {
+    return this.client.post(`${this.basePath}/resize`, options);
+  }
+  /** Permanently destroy the VM */
+  delete() {
+    return this.client.delete(this.basePath);
+  }
+  /**
+   * Run a command in the guest and wait for it to finish. A non-zero exit
+   * status is still a successful call — check `statusCode`, which is null if
+   * the command was killed by its timeout.
+   */
+  exec(options) {
+    const body = typeof options === "string" ? { command: options } : options;
+    return this.client.post(`${this.basePath}/exec-await`, body);
+  }
+  /** Scope process and terminal operations to one existing in-guest Linux user. */
+  linuxUser(linuxUser) {
+    return new VmLinuxUser(this, linuxUser);
+  }
+  /**
+   * Capture the VM's exact state, memory and disk. The VM must be running or
+   * paused. The new snapshot is private and fully materialized when this
+   * resolves.
+   */
+  snapshot(options = {}) {
+    return this.client.post(`${this.basePath}/snapshot`, options);
+  }
+};
+var VmLinuxUser = class {
+  vm;
+  linuxUser;
+  pty;
+  constructor(vm, linuxUser) {
+    this.vm = vm;
+    this.linuxUser = linuxUser;
+    this.pty = new VmLinuxUserPty(vm.pty, linuxUser);
+  }
+  exec(options) {
+    const request = typeof options === "string" ? { command: options } : options;
+    return this.vm.exec({ ...request, linuxUser: this.linuxUser });
+  }
+};
+var VmsNamespace = class {
+  client;
+  snapshots;
+  constructor(client) {
+    this.client = client;
+    this.snapshots = new VmSnapshotsNamespace(client);
+  }
+  /**
+   * Boot a new VM.
+   *
+   * `firewall` is required: a VM gets nothing implicitly, so state what it may
+   * reach. `{ rules: [] }` is a legitimate answer — a VM reachable only through
+   * a mapped domain or SSH.
+   *
+   * @example
+   * const { vm, vmId } = await freestyle.vms.create({
+   *   firewall: {
+   *     rules: [
+   *       // This VM can reach the Internet. Without it, it cannot.
+   *       { action: "allow", source: {}, destination: { public: true } },
+   *     ],
+   *   },
+   * });
+   * await vm.exec("echo hello");
+   */
+  async create(options) {
+    validateFirewallSpec(options.firewall, "VM");
+    if (options.tls !== void 0) {
+      validateTlsSpec(options.tls);
+    }
+    const data = await this.client.post("/v5/vms", options);
+    return {
+      vm: new Vm(this.client, data.id),
+      vmId: data.id,
+      data,
+      // The ids of the rules the create declared — nothing else names them.
+      firewallRules: data.firewallRules ?? [],
+      tlsRules: data.tlsRules ?? []
+    };
+  }
+  /**
+   * List your VMs.
+   *
+   * @example
+   * const { vms } = await freestyle.vms.list();
+   */
+  list(options = {}) {
+    return this.client.get("/v5/vms", options);
+  }
+  /**
+   * Fetch a VM by its id or its slug.
+   *
+   * @example
+   * const vm = await freestyle.vms.get("vmId");
+   */
+  get(vmIdOrSlug) {
+    return this.client.get(vmPath(vmIdOrSlug));
+  }
+  /** A handle to a VM, without a network call. */
+  ref(vmIdOrSlug) {
+    return new Vm(this.client, vmIdOrSlug);
+  }
+  delete(vmIdOrSlug) {
+    return this.client.delete(vmPath(vmIdOrSlug));
+  }
+};
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/vpc.js
+function vpcPath(id2) {
+  return `/v5/vpcs/${segment(id2)}`;
+}
+var VpcTunnelNamespace = class {
+  client;
+  basePath;
+  constructor(client, basePath) {
+    this.client = client;
+    this.basePath = basePath;
+  }
+  /**
+   * List the tunnels attached to this network, newest first. Listings never
+   * include a private key: one is returned only by
+   * `freestyle.tunnels.create` and `freestyle.tunnels.rotateKey`.
+   */
+  list() {
+    return this.client.get(`${this.basePath}/tunnels`);
+  }
+};
+var Vpc = class {
+  id;
+  tunnels;
+  client;
+  basePath;
+  constructor(client, id2) {
+    this.client = client;
+    this.id = id2;
+    this.basePath = vpcPath(id2);
+    this.tunnels = new VpcTunnelNamespace(client, this.basePath);
+  }
+  data() {
+    return this.client.get(this.basePath);
+  }
+  update(options) {
+    return this.client.patch(this.basePath, options);
+  }
+  delete() {
+    return this.client.delete(this.basePath);
+  }
+};
+var VpcNamespace = class {
+  client;
+  constructor(client) {
+    this.client = client;
+  }
+  /** List your private networks. */
+  list() {
+    return this.client.get("/v5/vpcs");
+  }
+  /** Create a private network, optionally with the rules that say what it is for. */
+  async create(options = {}) {
+    if (options.firewall !== void 0)
+      validateFirewallSpec(options.firewall, "network");
+    const data = await this.client.post("/v5/vpcs", options);
+    return {
+      vpc: new Vpc(this.client, data.id),
+      vpcId: data.id,
+      data,
+      firewallRules: data.firewallRules ?? []
+    };
+  }
+  /** Fetch a private network by its id or its slug. */
+  get(vpcIdOrSlug) {
+    return this.client.get(vpcPath(vpcIdOrSlug));
+  }
+  /** A handle to a private network, without a network call. */
+  ref(vpcIdOrSlug) {
+    return new Vpc(this.client, vpcIdOrSlug);
+  }
+  delete(vpcIdOrSlug) {
+    return this.client.delete(vpcPath(vpcIdOrSlug));
+  }
+};
+
+// ../../node_modules/.bun/freestyle@0.2.16/node_modules/freestyle/dist/index.js
+var Freestyle = class {
+  client;
+  vms;
+  vpc;
+  tunnels;
+  /** Allowed network communication, stated as `source -> destination` intent. */
+  firewall;
+  /** Named TLS sessions, stated as `domain, source -> destination` intent. */
+  tls;
+  domains;
+  identities;
+  constructor(options = {}) {
+    this.client = new FreestyleClient(options);
+    this.vms = new VmsNamespace(this.client);
+    this.vpc = new VpcNamespace(this.client);
+    this.tunnels = new TunnelsNamespace(this.client);
+    this.firewall = new FirewallNamespace(this.client);
+    this.tls = new TlsNamespace(this.client);
+    this.domains = new DomainsNamespace(this.client);
+    this.identities = new IdentitiesNamespace(this.client);
+  }
+  /** Low-level escape hatch: an authenticated `fetch` against the API. Pass the whole path, `/v5` included. */
+  fetch(path, init) {
+    return this.client.fetch(path, init);
+  }
+};
+
+// ../sandbox/package.json
+var package_default = {
+  name: "@decocms/sandbox",
+  version: "1.79.0",
+  private: true,
+  type: "module",
+  description: "Sandbox runtime for isolated Studio tool execution",
+  scripts: {
+    check: "tsc --noEmit",
+    test: "bun test",
+    build: "bun run build:typegen && bun run build:harness-runner",
+    "build:typegen": "mkdir -p dist && bun run --cwd=../typegen build && bun --cwd=../typegen pm pack --filename $PWD/dist/typegen.tgz --quiet",
+    "build:harness-runner": "mkdir -p dist && bun --cwd=../harness-runner pm pack --filename $PWD/dist/harness-runner.tgz --quiet"
+  },
+  exports: {
+    "./shared": "./shared.ts",
+    "./provider": "./server/provider/index.ts",
+    "./provider/agent-sandbox": "./server/provider/agent-sandbox/index.ts",
+    "./provider/postgres-state-store": "./server/provider/postgres-state-store.ts",
+    "./provider/freestyle": "./server/provider/freestyle.ts",
+    "./provider/remote": "./server/provider/remote.ts",
+    "./provider/router": "./server/provider/router.ts",
+    "./provider/sandbox-api": "./server/provider/sandbox-api.ts",
+    "./provider/sandbox-server": "./server/provider/sandbox-server.ts",
+    "./daemon-client": "./server/daemon-client.ts",
+    "./org-fs": "./org-fs.ts",
+    "./dispatch": "./dispatch/index.ts",
+    "./dispatch/*": "./dispatch/*.ts",
+    "./proxy/http": "./proxy/http.ts",
+    "./proxy/websocket": "./proxy/websocket.ts"
+  },
+  dependencies: {
+    "@decocms/shared": "workspace:*",
+    "@kubernetes/client-node": "^1.4.0",
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "@opentelemetry/api": "^1.9.0",
+    freestyle: "0.2.16",
+    zod: "4.3.6"
+  },
+  devDependencies: {
+    "@types/bun": "latest",
+    postgres: "^3.4.5",
+    typescript: "^7.0.2"
+  }
+};
+
+// ../sandbox/server/provider/shared/proxy-metrics.ts
+var RUNNER_KIND = {
+  kubernetes: "agent-sandbox",
+  freestyle: "freestyle"
+};
+function daemonProxyTimer(meter) {
+  const histogram = meter?.createHistogram("studio.sandbox.proxy.duration_ms", {
+    description: "Wall-clock latency of studio-mediated requests to the sandbox daemon: tool exec proxies (source=daemon) and preview iframe traffic (source=preview).",
+    unit: "ms"
+  });
+  return async (runnerKind, send) => {
+    if (!histogram) return send();
+    const start = performance.now();
+    const record = (statusCode) => histogram.record(performance.now() - start, {
+      runner_kind: runnerKind,
+      source: "daemon",
+      status_code: statusCode
+    });
+    try {
+      const res = await send();
+      record(res.status);
+      return res;
+    } catch (err) {
+      record(0);
+      throw err;
+    }
+  };
+}
+
+// ../sandbox/server/provider/freestyle.ts
+var LOG_LABEL2 = "FreestyleSandboxProvider";
+var DAEMON_PORT = 9e3;
+var WORKDIR = "/app";
+var DEFAULT_DEV_PORT2 = 3e3;
+var CONTAINER = "sandbox";
+var TOKEN_KEY = "studio-daemon-token";
+var ORG_KEY = "studio-org-id";
+var USER_KEY = "studio-user-id";
+var DAEMON_BOOT_TIMEOUT_MS = 12e4;
+var HEALTH_POLL_MS = 500;
+var HEALTH_PROBE_TIMEOUT_MS2 = 5e3;
+var IMAGE_PULL_TIMEOUT_MS = 3e5;
+var LOOKUP_TTL_MS = 5 * 6e4;
+var MISS_TTL_MS = 1e4;
+var LOOKUP_MAX = 5e3;
+var WATCH_TIMEOUT_MS = 5 * 6e4;
+var FreestyleSandboxProvider = class {
+  freestyle;
+  image;
+  idleTimeoutSeconds;
+  domainSuffix;
+  timeDaemonRequest;
+  inflight = new Inflight();
+  snapshotInflight = new Inflight();
+  lookups = /* @__PURE__ */ new Map();
+  releaseTimers = /* @__PURE__ */ new Map();
+  constructor(opts) {
+    this.freestyle = new Freestyle({ apiKey: opts.apiKey });
+    this.image = opts.image ?? `ghcr.io/decocms/studio/studio-sandbox-go:${package_default.version}`;
+    this.idleTimeoutSeconds = opts.idleTimeoutSeconds ?? 15 * 60;
+    this.domainSuffix = opts.domainSuffix ?? "style.dev";
+    this.timeDaemonRequest = daemonProxyTimer(opts.meter);
+  }
+  /** Whether this handle is a Freestyle sandbox. Cached; see `MISS_TTL_MS`. */
+  async owns(handle) {
+    return await this.find(handle) !== null;
+  }
+  // ---- Lookup ---------------------------------------------------------------
+  daemonUrl(handle) {
+    return `https://${handle}.${this.domainSuffix}`;
+  }
+  async find(handle, opts = {}) {
+    const hit = this.lookups.get(handle);
+    if (!opts.refresh && hit && Date.now() - hit.at < (hit.found ? LOOKUP_TTL_MS : MISS_TTL_MS)) {
+      return hit.found;
+    }
+    let found = null;
+    try {
+      const data = await this.freestyle.vms.get(handle);
+      const token = data.metadata[TOKEN_KEY];
+      if (token) {
+        found = {
+          vm: this.freestyle.vms.ref(data.id),
+          daemon: { url: this.daemonUrl(handle), token }
+        };
+      }
+    } catch (err) {
+      if (!(err instanceof FreestyleApiError && err.status === 404)) throw err;
+    }
+    this.remember(handle, found);
+    return found;
+  }
+  remember(handle, found) {
+    this.lookups.delete(handle);
+    if (this.lookups.size >= LOOKUP_MAX) {
+      const oldest = this.lookups.keys().next();
+      if (!oldest.done) this.lookups.delete(oldest.value);
+    }
+    this.lookups.set(handle, { found, at: Date.now() });
+  }
+  // ---- Base snapshot --------------------------------------------------------
+  /**
+   * A snapshot of a VM with the image already pulled, so a sandbox boots in
+   * seconds instead of pulling ~2GB. One per image; built on first use.
+   */
+  baseSnapshot() {
+    const image = this.image;
+    const slug = `studio-sandbox-${createHash3("sha256").update(image).digest("hex").slice(0, 16)}`;
+    return this.snapshotInflight.run(slug, async () => {
+      if (await this.snapshotExists(slug)) return slug;
+      console.log(`[${LOG_LABEL2}] building base snapshot ${slug} for ${image}`);
+      const { vm } = await this.freestyle.vms.create({
+        ttlSeconds: 1800,
+        firewall: {
+          rules: [
+            { action: "allow", source: {}, destination: { public: true } }
+          ]
+        }
+      });
+      try {
+        await this.run(vm, `docker pull -q ${shellQuote(image)}`, {
+          timeoutMs: IMAGE_PULL_TIMEOUT_MS
+        });
+        await vm.snapshot({ slug });
+      } catch (err) {
+        if (!await this.snapshotExists(slug)) throw err;
+      } finally {
+        await vm.delete().catch(() => {
+        });
+      }
+      return slug;
+    });
+  }
+  async snapshotExists(slug) {
+    try {
+      await this.freestyle.vms.snapshots.get(slug);
+      return true;
+    } catch (err) {
+      if (err instanceof FreestyleApiError && err.status === 404) return false;
+      throw err;
+    }
+  }
+  async run(vm, command, opts = {}) {
+    const res = await vm.exec({ command, ...opts });
+    if (res.statusCode !== 0) {
+      throw new Error(
+        `${command.split(" ", 2).join(" ")} failed (${res.statusCode ?? "timeout"}): ${(res.stderr || res.stdout || "").slice(-500)}`
+      );
+    }
+    return res.stdout ?? "";
+  }
+  // ---- Lifecycle ------------------------------------------------------------
+  async ensure(id2, opts = {}) {
+    const handle = computeHandle(id2);
+    if (handle.startsWith("s-")) {
+      throw new Error(
+        `ensure: projectRef has no slug source: ${id2.projectRef}`
+      );
+    }
+    return this.inflight.run(handle, async () => {
+      this.cancelRelease(handle);
+      const existing = await this.find(handle, { refresh: true });
+      if (existing) {
+        await this.resume(existing, opts);
+      } else {
+        await this.create(handle, opts);
+      }
+      return {
+        handle,
+        workdir: WORKDIR,
+        previewUrl: this.daemonUrl(handle),
+        warmPoolAdopted: false,
+        provider: "freestyle"
+      };
+    });
+  }
+  async resume(found, opts) {
+    const { state } = await found.vm.data();
+    if (state !== "running") await found.vm.start();
+    await this.waitForDaemon(found.daemon.url);
+    const patch = gitCredentialRefreshPatch(opts);
+    if (patch) {
+      await postConfig(found.daemon.url, found.daemon.token, patch).catch(
+        (err) => console.warn(
+          `[${LOG_LABEL2}] git credential refresh failed: ${errMsg2(err)}`
+        )
+      );
+    }
+  }
+  async create(handle, opts) {
+    const snapshotId = await this.baseSnapshot();
+    const token = randomBytes2(24).toString("hex");
+    const { vm } = await this.freestyle.vms.create({
+      snapshotId,
+      slug: handle,
+      idleTimeoutSeconds: this.idleTimeoutSeconds,
+      metadata: {
+        [TOKEN_KEY]: token,
+        ...opts.tenant ? { [ORG_KEY]: opts.tenant.orgId, [USER_KEY]: opts.tenant.userId } : {}
+      },
+      firewall: {
+        rules: [{ action: "allow", source: {}, destination: { public: true } }]
+      },
+      tls: {
+        rules: [
+          {
+            action: "allow",
+            domain: `${handle}.${this.domainSuffix}`,
+            source: { public: true },
+            destination: { port: DAEMON_PORT }
+          }
+        ]
+      }
+    });
+    const daemon = { url: this.daemonUrl(handle), token };
+    try {
+      const env = {
+        ...opts.env,
+        DAEMON_TOKEN: token,
+        DAEMON_BOOT_ID: crypto.randomUUID(),
+        APP_ROOT: WORKDIR,
+        PROXY_PORT: String(DAEMON_PORT)
+      };
+      const envFlags = Object.keys(env).map((k) => `-e ${shellQuote(k)}`).join(" ");
+      await this.run(
+        vm,
+        `docker run -d --name ${CONTAINER} --restart=always -p ${DAEMON_PORT}:${DAEMON_PORT} ${envFlags} ${shellQuote(this.image)}`,
+        { env, timeoutMs: IMAGE_PULL_TIMEOUT_MS }
+      );
+      await this.waitForDaemon(daemon.url);
+      await postConfig(daemon.url, token, this.configPayload(opts) ?? {});
+      if (opts.orgFsConfigJson) {
+        await postOrgFsConfig(daemon.url, token, opts.orgFsConfigJson).catch(
+          (err) => console.warn(`[${LOG_LABEL2}] org-fs relay failed`, err)
+        );
+      }
+    } catch (err) {
+      await vm.delete().catch(() => {
+      });
+      this.lookups.delete(handle);
+      throw err;
+    }
+    this.remember(handle, { vm, daemon });
+  }
+  configPayload(opts) {
+    return buildConfigPayload({
+      runtime: opts.workload?.runtime ?? "node",
+      packageManager: opts.workload?.packageManager ? {
+        name: opts.workload.packageManager,
+        ...opts.workload.packageManagerPath ? { path: opts.workload.packageManagerPath } : {}
+      } : null,
+      repo: opts.repo ?? null,
+      extraRepos: opts.extraRepos ?? [],
+      port: opts.workload?.devPort ?? DEFAULT_DEV_PORT2,
+      tenant: opts.tenant,
+      cloneOnly: opts.cloneOnly === true
+    });
+  }
+  async waitForDaemon(url) {
+    const deadline = Date.now() + DAEMON_BOOT_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      if (await daemonAnswers(url)) return;
+      await delay(HEALTH_POLL_MS);
+    }
+    throw new Error(
+      `sandbox daemon at ${url} did not answer /health within ${DAEMON_BOOT_TIMEOUT_MS / 1e3}s`
+    );
+  }
+  async delete(handle) {
+    this.cancelRelease(handle);
+    const found = await this.find(handle, { refresh: true });
+    this.lookups.delete(handle);
+    if (!found) return;
+    await found.vm.exec({ command: `docker stop -t 30 ${CONTAINER}`, timeoutMs: 45e3 }).catch(() => {
+    });
+    await found.vm.delete();
+  }
+  async lastTermination(_handle) {
+    return null;
+  }
+  /** A paused VM is alive: the next request resumes it. */
+  async alive(handle) {
+    return await this.find(handle, { refresh: true }) !== null;
+  }
+  /** `ensure` only returns once the daemon answers, so this only has to see that. */
+  async *watchClaimLifecycle(handle, signal) {
+    const since2 = Date.now();
+    yield { kind: "claiming", since: since2 };
+    let announced = false;
+    while (!signal?.aborted) {
+      const found = await this.find(handle, { refresh: true }).catch(
+        () => null
+      );
+      if (found) {
+        if (!announced) {
+          announced = true;
+          yield { kind: "warming-daemon", since: Date.now() };
+        }
+        if (await daemonAnswers(found.daemon.url)) {
+          yield { kind: "ready" };
+          return;
+        }
+      }
+      if (Date.now() - since2 > WATCH_TIMEOUT_MS) {
+        yield {
+          kind: "failed",
+          reason: found ? "crash-loop-backoff" : "claim-never-created",
+          message: found ? "the sandbox VM exists but its daemon never answered" : "no sandbox VM was created"
+        };
+        return;
+      }
+      await delay(1e3);
+    }
+  }
+  async hasSchedulableCapacity() {
+    return true;
+  }
+  async getPreviewUrl(handle) {
+    return await this.find(handle) ? this.daemonUrl(handle) : null;
+  }
+  async proxyDaemonRequest(handle, path, init) {
+    const found = await this.find(handle);
+    if (!found) {
+      return Response.json({ error: "sandbox not found" }, { status: 404 });
+    }
+    const reread = async () => (await this.find(handle, { refresh: true }))?.daemon ?? null;
+    return this.timeDaemonRequest(
+      RUNNER_KIND.freestyle,
+      () => proxyDaemonWithRetry(found.daemon, path, init, {
+        unauthorized: async () => {
+          const fresh = await reread();
+          return fresh && fresh.token !== found.daemon.token ? fresh : null;
+        },
+        unreachable: reread
+      })
+    );
+  }
+  /** The daemon's public address and bearer, for a host serving `sandbox-api`. */
+  async daemonEndpoint(handle) {
+    return (await this.find(handle))?.daemon ?? null;
+  }
+  async adoptLiveClaim(_id, handle) {
+    return await this.find(handle, { refresh: true }) !== null;
+  }
+  async resolvePreviewUpstreamUrl(handle) {
+    return (await this.find(handle))?.daemon.url ?? null;
+  }
+  proxyPreviewRequest(handle, request) {
+    return proxyPreview(
+      request,
+      {
+        base: () => this.resolvePreviewUpstreamUrl(handle).catch(() => null),
+        invalidate: () => this.lookups.delete(handle),
+        retryBase: () => this.find(handle, { refresh: true }).then((f) => f?.daemon.url ?? null).catch(() => null)
+      },
+      LOG_LABEL2
+    );
+  }
+  async markTenantPoolsDirty(_repoUrl, _ref) {
+    return [];
+  }
+  /**
+   * Pause after `graceMs`. Pausing keeps memory and disk, so this costs the
+   * sandbox nothing but a resume.
+   *
+   * ponytail: in-process timer, lost on restart; the idle timeout pauses the
+   * VM anyway, only later.
+   */
+  async releaseAfter(handle, graceMs) {
+    this.cancelRelease(handle);
+    const timer = setTimeout(() => {
+      this.releaseTimers.delete(handle);
+      void this.find(handle).then((f) => f?.vm.pause()).catch(
+        (err) => console.warn(`[${LOG_LABEL2}] pause ${handle} failed: ${errMsg2(err)}`)
+      );
+    }, graceMs);
+    timer.unref?.();
+    this.releaseTimers.set(handle, timer);
+  }
+  /** The VM's idle timeout already counts every request as activity. */
+  async renewTtl(handle) {
+    this.cancelRelease(handle);
+  }
+  cancelRelease(handle) {
+    const timer = this.releaseTimers.get(handle);
+    if (timer) clearTimeout(timer);
+    this.releaseTimers.delete(handle);
+  }
+  close() {
+    for (const timer of this.releaseTimers.values()) clearTimeout(timer);
+    this.releaseTimers.clear();
+    this.lookups.clear();
+  }
+};
+async function daemonAnswers(url) {
+  try {
+    const res = await fetch(`${url}/health`, {
+      signal: AbortSignal.timeout(HEALTH_PROBE_TIMEOUT_MS2)
+    });
+    await res.body?.cancel();
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+function shellQuote(s) {
+  return `'${s.replaceAll("'", `'\\''`)}'`;
+}
+function errMsg2(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// ../sandbox/server/provider/router.ts
+import { createHash as createHash4 } from "crypto";
+
+// ../sandbox/server/provider/shared/provider-tag.ts
+var KEY = "sandboxProvider";
+function tagSandboxProvider(err, kind) {
+  if (err instanceof Error) Object.assign(err, { [KEY]: kind });
+  return err;
+}
+function sandboxProviderOfError(err) {
+  for (let e = err, depth = 0; e instanceof Error && depth < 5; depth++) {
+    const kind = e[KEY];
+    if (kind === "kubernetes" || kind === "freestyle") return kind;
+    e = e.cause;
+  }
+  return void 0;
+}
+
+// ../sandbox/server/provider/router.ts
+function handleShare(handle) {
+  const hex = createHash4("sha256").update(handle).digest("hex").slice(0, 8);
+  return Number.parseInt(hex, 16) / 2 ** 32;
+}
+var PICKED_MAX = 5e3;
+var SandboxProviderRouter = class {
+  constructor(providers, opts = {}) {
+    this.providers = providers;
+    if (!providers.kubernetes && !providers.freestyle) {
+      throw new Error("SandboxProviderRouter needs at least one provider");
+    }
+    this.freestyleShare = Math.min(1, Math.max(0, opts.freestyleShare ?? 0));
+  }
+  providers;
+  picked = /* @__PURE__ */ new Map();
+  freestyleShare;
+  get(kind) {
+    const provider = this.providers[kind];
+    if (!provider)
+      throw new Error(`sandbox provider ${kind} is not configured`);
+    return provider;
+  }
+  remember(handle, kind) {
+    this.picked.delete(handle);
+    if (this.picked.size >= PICKED_MAX) {
+      const oldest = this.picked.keys().next();
+      if (!oldest.done) this.picked.delete(oldest.value);
+    }
+    this.picked.set(handle, kind);
+  }
+  /** Who serves an existing handle. Kubernetes is the fallback: it has no cheap ownership check. */
+  async providerOf(handle) {
+    const { kubernetes, freestyle } = this.providers;
+    if (!freestyle) return "kubernetes";
+    if (!kubernetes) return "freestyle";
+    const picked = this.picked.get(handle);
+    if (picked) return picked;
+    return await freestyle.owns(handle) ? "freestyle" : "kubernetes";
+  }
+  async owner(handle) {
+    return this.get(await this.providerOf(handle));
+  }
+  /** Where `ensure` puts this sandbox. */
+  async place(handle, opts) {
+    const { kubernetes, freestyle } = this.providers;
+    const image = opts.sandboxImage ?? "default";
+    if (image !== "default") {
+      if (!kubernetes) {
+        throw new Error(`sandbox image ${image} needs the kubernetes provider`);
+      }
+      return "kubernetes";
+    }
+    if (!kubernetes) return "freestyle";
+    if (!freestyle) return "kubernetes";
+    if (await freestyle.owns(handle)) return "freestyle";
+    if (await kubernetes.alive(handle).catch(() => false)) return "kubernetes";
+    if (opts.provider) return opts.provider;
+    if (handleShare(handle) < this.freestyleShare) return "freestyle";
+    const roomy = await kubernetes.hasSchedulableCapacity().catch(() => false);
+    return roomy ? "kubernetes" : "freestyle";
+  }
+  async ensure(id2, opts = {}) {
+    const { provider: _requested, ...rest } = opts;
+    const handle = computeHandle(id2);
+    const kind = await this.place(handle, opts);
+    this.remember(handle, kind);
+    try {
+      return await this.get(kind).ensure(id2, rest);
+    } catch (err) {
+      throw tagSandboxProvider(err, kind);
+    }
+  }
+  async delete(handle) {
+    await (await this.owner(handle)).delete(handle);
+    this.picked.delete(handle);
+  }
+  async lastTermination(handle) {
+    return (await this.owner(handle)).lastTermination(handle);
+  }
+  async alive(handle) {
+    return (await this.owner(handle)).alive(handle);
+  }
+  async *watchClaimLifecycle(handle, signal) {
+    yield* (await this.owner(handle)).watchClaimLifecycle(handle, signal);
+  }
+  /** Room anywhere: an ensure without room on Kubernetes lands on Freestyle. */
+  async hasSchedulableCapacity() {
+    const { kubernetes, freestyle } = this.providers;
+    if (!kubernetes || freestyle) return true;
+    return kubernetes.hasSchedulableCapacity();
+  }
+  async getPreviewUrl(handle) {
+    return (await this.owner(handle)).getPreviewUrl(handle);
+  }
+  async proxyDaemonRequest(handle, path, init) {
+    return (await this.owner(handle)).proxyDaemonRequest(handle, path, init);
+  }
+  async adoptLiveClaim(id2, handle) {
+    return (await this.owner(handle)).adoptLiveClaim(id2, handle);
+  }
+  async resolvePreviewUpstreamUrl(handle) {
+    return (await this.owner(handle)).resolvePreviewUpstreamUrl(handle);
+  }
+  async proxyPreviewRequest(handle, request) {
+    return (await this.owner(handle)).proxyPreviewRequest(handle, request);
+  }
+  async markTenantPoolsDirty(repoUrl, ref) {
+    return await this.providers.kubernetes?.markTenantPoolsDirty(repoUrl, ref) ?? [];
+  }
+  async releaseAfter(handle, graceMs) {
+    await (await this.owner(handle)).releaseAfter(handle, graceMs);
+  }
+  async renewTtl(handle) {
+    await (await this.owner(handle)).renewTtl(handle);
+  }
+  async daemonEndpoint(handle) {
+    const owner = this.providers[await this.providerOf(handle)];
+    if (!owner?.daemonEndpoint) {
+      throw new Error("sandbox provider has no daemon endpoint to serve");
+    }
+    return owner.daemonEndpoint(handle);
+  }
+  /** Only Kubernetes sandboxes take pushed credentials. */
+  listSandboxes() {
+    return this.providers.kubernetes?.listSandboxes?.() ?? [];
+  }
+  listTenantPools() {
+    return this.providers.kubernetes?.listTenantPools?.() ?? [];
+  }
+  close() {
+    this.providers.kubernetes?.close();
+    this.providers.freestyle?.close();
+    this.picked.clear();
+  }
+};
+
+// ../sandbox/server/provider/sandbox-api.ts
+import { z as z4 } from "zod";
+var SANDBOX_TOOLS = {
+  ensure: "SANDBOX_ENSURE",
+  status: "SANDBOX_STATUS",
+  delete: "SANDBOX_DELETE",
+  lifetime: "SANDBOX_LIFETIME",
+  capacity: "SANDBOX_CAPACITY",
+  tenantPoolsPush: "SANDBOX_TENANT_POOLS_PUSH",
+  credentialsPush: "SANDBOX_CREDENTIALS_PUSH",
+  list: "SANDBOX_LIST"
+};
+var SANDBOX_WATCH_PATH = "/api/sandbox/watch";
+var SANDBOX_WATCH_KEEPALIVE_MS = 15e3;
+var id = z4.string().min(1).max(512);
+var CLONE_URL_MAX = 4096;
+var ORG_FS_CONFIG_MAX = 65536;
+var expiresAt = z4.number().int().positive();
+var sandboxIdSchema = z4.object({
+  userId: id,
+  projectRef: id
+});
+var tenantSchema = z4.object({
+  orgId: id,
+  userId: id,
+  orgSlug: z4.string().optional(),
+  orgName: z4.string().optional(),
+  userEmail: z4.string().optional(),
+  userName: z4.string().optional()
+});
+var repoSchema = z4.object({
+  cloneUrl: z4.string().min(1).max(CLONE_URL_MAX),
+  connectionId: z4.string().optional(),
+  repositoryId: z4.string().optional(),
+  userName: z4.string(),
+  userEmail: z4.string(),
+  branch: z4.string().optional(),
+  displayName: z4.string().optional(),
+  submoduleCredentials: z4.array(z4.object({ host: z4.string(), token: z4.string() })).optional(),
+  directoryName: z4.string().optional(),
+  credentialExpiresAt: expiresAt.optional()
+});
+var providerKindSchema = z4.enum(["kubernetes", "freestyle"]);
+var ensureOptionsSchema = z4.object({
+  provider: providerKindSchema.optional(),
+  purpose: z4.enum(["interactive", "harness-run"]).optional(),
+  sandboxImage: SandboxImageSchema.optional(),
+  branch: z4.string().optional(),
+  repo: repoSchema.optional(),
+  extraRepos: z4.array(repoSchema).optional(),
+  workload: z4.object({
+    runtime: z4.enum(["node", "bun", "deno"]),
+    packageManager: z4.enum(["npm", "pnpm", "yarn", "bun", "deno"]),
+    devPort: z4.number().int().optional(),
+    packageManagerPath: z4.string().optional()
+  }).optional(),
+  cloneOnly: z4.boolean().optional(),
+  env: z4.record(z4.string(), z4.string()).optional(),
+  tenant: tenantSchema.optional(),
+  orgFsConfigJson: z4.string().max(ORG_FS_CONFIG_MAX).optional()
+});
+var daemonSchema = z4.object({
+  url: z4.url({ protocol: /^https?$/ }),
+  token: z4.string().min(1)
+});
+var ensureInputSchema = z4.object({
+  id: sandboxIdSchema,
+  opts: ensureOptionsSchema,
+  /**
+   * Until when `opts.orgFsConfigJson` stays valid, at least; unset keeps it
+   * out of the host's store. Clone credentials carry their own
+   * `credentialExpiresAt`.
+   */
+  credentialsValidUntil: z4.object({ orgFsConfig: expiresAt.optional() }).optional()
+});
+var ensureOutputSchema = z4.object({
+  handle: z4.string().min(1),
+  workdir: z4.string().min(1),
+  previewUrl: z4.string().nullable(),
+  warmPoolAdopted: z4.boolean(),
+  provider: providerKindSchema.default("kubernetes"),
+  daemon: daemonSchema
+});
+var handleInputSchema = z4.object({ handle: z4.string().min(1) });
+var statusInputSchema = z4.object({
+  handle: z4.string().min(1),
+  /** Re-provision an evicted claim before answering. */
+  resurrect: z4.boolean().optional()
+});
+var podTerminationSchema = z4.object({
+  reason: z4.string(),
+  oomKilled: z4.boolean(),
+  exitCode: z4.number().int().optional(),
+  memoryLimit: z4.string().optional(),
+  evictionMessage: z4.string().optional()
+});
+var statusOutputSchema = z4.object({
+  alive: z4.boolean(),
+  previewUrl: z4.string().nullable(),
+  daemon: daemonSchema.nullable(),
+  lastTermination: podTerminationSchema.nullable(),
+  provider: providerKindSchema.default("kubernetes")
+});
+var lifetimeInputSchema = z4.object({
+  handle: z4.string().min(1),
+  graceMs: z4.number().int().min(0).optional()
+});
+var emptySchema = z4.object({});
+var capacityOutputSchema = z4.object({ schedulable: z4.boolean() });
+var tenantPoolsPushInputSchema = z4.object({
+  repoUrl: z4.string().min(1).max(CLONE_URL_MAX),
+  ref: z4.string().min(1)
+});
+var tenantPoolsPushOutputSchema = z4.object({
+  pools: z4.array(z4.string())
+});
+var toolErrorSchema = z4.object({
+  code: z4.enum(["bootstrap-rejected", "internal"]),
+  error: z4.string(),
+  status: z4.number().int().optional(),
+  /** The provider that failed, when the host knows it. */
+  provider: providerKindSchema.optional()
+});
+var since = z4.number();
+var claimPhaseSchema = z4.discriminatedUnion(
+  "kind",
+  [
+    z4.object({ kind: z4.literal("claiming"), since }),
+    z4.object({
+      kind: z4.literal("waiting-for-capacity"),
+      since,
+      message: z4.string().optional(),
+      nodeClaim: z4.string().optional()
+    }),
+    z4.object({ kind: z4.literal("pulling-image"), since }),
+    z4.object({ kind: z4.literal("starting-container"), since }),
+    z4.object({ kind: z4.literal("warming-daemon"), since }),
+    z4.object({ kind: z4.literal("ready") }),
+    z4.object({
+      kind: z4.literal("failed"),
+      reason: z4.enum([
+        "image-pull-backoff",
+        "crash-loop-backoff",
+        "scheduling-timeout",
+        "claim-never-created",
+        "reconciler-error",
+        "unknown"
+      ]),
+      message: z4.string()
+    })
+  ]
+);
+var tenantIdsSchema = z4.object({ orgId: id, userId: id });
+var repoIdentitySchema = z4.union([
+  z4.object({ repositoryId: id }).strict(),
+  z4.object({ connectionId: id, repo: id }).strict()
+]);
+var CREDENTIALS_PUSH_MAX = 2e3;
+var pushedCloneUrl = z4.url({ protocol: /^https?$/ }).max(CLONE_URL_MAX);
+var credentialsPushInputSchema = z4.object({
+  cloneUrls: z4.array(
+    z4.object({
+      tenant: tenantIdsSchema,
+      repo: repoIdentitySchema,
+      cloneUrl: pushedCloneUrl,
+      expiresAt
+    })
+  ).max(CREDENTIALS_PUSH_MAX),
+  /** Clone URLs for tenant pool allocations, keyed by the pool's tenant and repo. */
+  poolCloneUrls: z4.array(
+    z4.object({
+      tenant: id,
+      repoUrl: z4.string().min(1).max(CLONE_URL_MAX),
+      cloneUrl: pushedCloneUrl,
+      expiresAt
+    })
+  ).max(CREDENTIALS_PUSH_MAX).default([]),
+  orgFsConfigs: z4.array(
+    z4.object({
+      tenant: tenantIdsSchema,
+      orgFsConfigJson: z4.string().min(1).max(ORG_FS_CONFIG_MAX),
+      expiresAt
+    })
+  ).max(CREDENTIALS_PUSH_MAX)
+});
+var credentialsPushOutputSchema = z4.object({
+  stored: z4.number().int().nonnegative(),
+  kept: z4.number().int().nonnegative()
+});
+var SANDBOX_LIST_MAX = 5e3;
+var SANDBOX_LIST_POOLS_MAX = 500;
+var SANDBOX_LIST_POOL_REPOS_MAX = 100;
+var listOutputSchema = z4.object({
+  sandboxes: z4.array(
+    z4.object({
+      handle: id,
+      tenant: tenantIdsSchema.nullable(),
+      repos: z4.array(repoIdentitySchema).max(16),
+      /** The sandbox mounts org-fs. */
+      orgFs: z4.boolean(),
+      /** When the org-fs config the host holds for its tenant expires. */
+      orgFsConfigExpiresAt: expiresAt.nullable()
+    })
+  ).max(SANDBOX_LIST_MAX),
+  /** Defaulted so a host that predates pool listing still lists its sandboxes. */
+  pools: z4.array(
+    z4.object({
+      name: id,
+      tenant: id,
+      image: SandboxImageSchema,
+      repos: z4.array(
+        z4.object({
+          repoUrl: z4.string().min(1).max(CLONE_URL_MAX),
+          branch: z4.string().min(1)
+        })
+      ).max(SANDBOX_LIST_POOL_REPOS_MAX)
+    })
+  ).max(SANDBOX_LIST_POOLS_MAX).default([])
+});
+
+// ../sandbox/server/provider/sandbox-server.ts
+function messageChain(err) {
+  const parts = [];
+  for (let e = err, depth = 0; e && depth < 5; depth++) {
+    parts.push(e instanceof Error ? e.message : String(e));
+    e = e instanceof Error ? e.cause : void 0;
+  }
+  return parts.join(": ");
+}
+function tool(def) {
+  return {
+    ...def,
+    // A thrown message is all an MCP error carries, so it carries JSON.
+    execute: (input) => def.execute(input).catch((err) => {
+      const provider = sandboxProviderOfError(err);
+      const body = {
+        ...err instanceof ConfigRequestError ? {
+          code: "bootstrap-rejected",
+          error: err.message,
+          status: err.status
+        } : { code: "internal", error: messageChain(err) },
+        ...provider ? { provider } : {}
+      };
       throw new Error(JSON.stringify(body));
     })
   };
@@ -4732,7 +7640,8 @@ function sandboxTools(provider, credentials) {
           alive: daemon !== null,
           previewUrl,
           daemon,
-          lastTermination
+          lastTermination,
+          provider: await provider().providerOf?.(handle) ?? "kubernetes"
         };
       }
     }),
@@ -4873,6 +7782,7 @@ function kubeConfigForServer(server) {
 export {
   AgentSandboxProvider,
   CREDENTIALS_PUSH_MAX,
+  FreestyleSandboxProvider,
   PushedCredentials,
   SANDBOX_LIST_MAX,
   SANDBOX_LIST_POOLS_MAX,
@@ -4880,6 +7790,7 @@ export {
   SANDBOX_TOOLS,
   SANDBOX_WATCH_KEEPALIVE_MS,
   SANDBOX_WATCH_PATH,
+  SandboxProviderRouter,
   TenantPoolCapacityError,
   TenantPoolConflictError,
   capacityOutputSchema,