@miosa/sdk 0.3.0 → 1.1.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import { randomUUID } from 'crypto';
+import { randomUUID, createHmac, timingSafeEqual } from 'crypto';
 import EventEmitter from 'events';
 
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
@@ -662,10 +662,11 @@ var ApiKeys = class {
     return listItems(data);
   }
   async create(params) {
-    const { idempotencyKey: ikey, expiresAt, ...rest } = params;
+    const { idempotencyKey: ikey, expiresAt, workspaceId, ...rest } = params;
     const body = stripUndefined2({
       ...rest,
-      expires_at: expiresAt ?? rest.expires_at
+      expires_at: expiresAt ?? rest.expires_at,
+      workspace_id: workspaceId ?? rest.workspace_id
     });
     const data = await this.http.request("/api-keys", {
       method: "POST",
@@ -1695,6 +1696,690 @@ var Desktop = class {
     return this.http.post(`${this.base()}/launch`, params);
   }
 };
+
+// src/resources/egressAudit.ts
+function unwrap17(payload) {
+  if (payload && typeof payload === "object") {
+    const p = payload;
+    for (const k of ["data", "event", "items"]) {
+      if (k in p) return p[k];
+    }
+  }
+  return payload;
+}
+function unwrapList8(payload) {
+  if (Array.isArray(payload)) return payload;
+  if (payload && typeof payload === "object") {
+    const p = payload;
+    for (const k of ["data", "events", "audit", "items"]) {
+      if (Array.isArray(p[k])) return p[k];
+    }
+  }
+  return [];
+}
+function stripUndefined5(input) {
+  return Object.fromEntries(
+    Object.entries(input).filter(([, v]) => v !== void 0)
+  );
+}
+function pickFirst(...values) {
+  for (const v of values) if (v !== void 0) return v;
+  return void 0;
+}
+function listQuery(params) {
+  return stripUndefined5({
+    resource_id: pickFirst(params.resourceId, params.resource_id),
+    resource_type: pickFirst(params.resourceType, params.resource_type),
+    host: params.host,
+    action: params.action,
+    since: params.since,
+    until: params.until,
+    limit: params.limit,
+    cursor: params.cursor,
+    external_user_id: pickFirst(params.externalUserId, params.external_user_id),
+    external_workspace_id: pickFirst(
+      params.externalWorkspaceId,
+      params.external_workspace_id
+    )
+  });
+}
+function sleep2(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+var EgressAudit = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** List audit events with optional filters. */
+  async list(params = {}) {
+    const data = await this.http.get(
+      "/egress/audit",
+      listQuery(params)
+    );
+    return unwrapList8(data);
+  }
+  /** Get a single audit event by id. */
+  async get(id) {
+    const data = await this.http.get(
+      `/egress/audit/${id}`
+    );
+    return unwrap17(data);
+  }
+  /**
+   * Long-poll the audit endpoint and yield new events as they appear.
+   *
+   * Tenant-wide `client.audit.tail()` is REST-based long polling. A
+   * live WebSocket / SSE tail is only available for the sandbox-scoped
+   * variant — see {@link SandboxAudit.tail}.
+   */
+  async *tail(params = {}) {
+    const pollMs = params.pollIntervalMs ?? 2e3;
+    let since = params.since;
+    const seen = /* @__PURE__ */ new Set();
+    while (true) {
+      const queryParams = { ...params };
+      if (since !== void 0) queryParams.since = since;
+      const data = await this.http.get(
+        "/egress/audit",
+        listQuery(queryParams)
+      );
+      const events = unwrapList8(data);
+      for (const event of events) {
+        if (event.id && seen.has(event.id)) continue;
+        if (event.id) seen.add(event.id);
+        yield event;
+        const ts = event.inserted_at ?? event.timestamp;
+        if (typeof ts === "string") since = ts;
+      }
+      await sleep2(pollMs);
+    }
+  }
+};
+var SandboxAudit = class {
+  constructor(http, resourceId) {
+    this.http = http;
+    this.resourceId = resourceId;
+    this.delegate = new EgressAudit(http);
+  }
+  http;
+  resourceId;
+  resourceType = "sandbox";
+  delegate;
+  list(params = {}) {
+    return this.delegate.list({
+      ...params,
+      resource_id: params.resourceId ?? params.resource_id ?? this.resourceId,
+      resource_type: params.resourceType ?? params.resource_type ?? this.resourceType
+    });
+  }
+  get(id) {
+    return this.delegate.get(id);
+  }
+  /** SSE tail of the sandbox-scoped audit stream. */
+  async *tail(params = {}) {
+    const streamPath = this.resourceType === "sandbox" ? `/sandboxes/${this.resourceId}/audit/stream` : `/computers/${this.resourceId}/audit/stream`;
+    try {
+      const stream = this.http.stream(streamPath, {
+        method: "GET"
+      });
+      for await (const event of stream) {
+        yield event;
+      }
+    } catch {
+      yield* this.delegate.tail({
+        ...params,
+        resource_id: this.resourceId,
+        resource_type: this.resourceType
+      });
+    }
+  }
+};
+var ComputerAudit = class extends SandboxAudit {
+  resourceType = "computer";
+};
+
+// src/resources/egressNetwork.ts
+function unwrap18(payload) {
+  if (payload && typeof payload === "object") {
+    const p = payload;
+    for (const k of ["data", "policy", "rule", "items"]) {
+      if (k in p) return p[k];
+    }
+  }
+  return payload;
+}
+function unwrapList9(payload) {
+  if (Array.isArray(payload)) return payload;
+  if (payload && typeof payload === "object") {
+    const p = payload;
+    for (const k of [
+      "data",
+      "policies",
+      "rules",
+      "allowlist",
+      "suggestions",
+      "items"
+    ]) {
+      if (Array.isArray(p[k])) return p[k];
+    }
+  }
+  return [];
+}
+function stripUndefined6(input) {
+  return Object.fromEntries(
+    Object.entries(input).filter(([, v]) => v !== void 0)
+  );
+}
+function pickFirst2(...values) {
+  for (const v of values) if (v !== void 0) return v;
+  return void 0;
+}
+function ruleBody(host, params, effect) {
+  return stripUndefined6({
+    host,
+    effect,
+    methods: params.methods,
+    path_glob: pickFirst2(params.pathGlob, params.path_glob),
+    policy_id: pickFirst2(params.policyId, params.policy_id),
+    resource_id: pickFirst2(params.resourceId, params.resource_id),
+    resource_type: pickFirst2(params.resourceType, params.resource_type),
+    note: params.note
+  });
+}
+var EgressNetwork = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  // ── allowlist ─────────────────────────────────────────────────────────────
+  /** Add an `allow` rule for `host` to the allowlist. */
+  async allow(host, params = {}) {
+    const data = await this.http.post(
+      "/egress/allowlist",
+      ruleBody(host, params, "allow")
+    );
+    return unwrap18(data);
+  }
+  /** Add a `deny` rule for `host` to the allowlist. */
+  async deny(host, params = {}) {
+    const data = await this.http.post(
+      "/egress/allowlist",
+      ruleBody(host, params, "deny")
+    );
+    return unwrap18(data);
+  }
+  /** List allowlist rules. */
+  async rules(params = {}) {
+    const query = stripUndefined6({
+      policy_id: pickFirst2(params.policyId, params.policy_id),
+      resource_id: pickFirst2(params.resourceId, params.resource_id),
+      resource_type: pickFirst2(params.resourceType, params.resource_type)
+    });
+    const data = await this.http.get("/egress/allowlist", query);
+    return unwrapList9(data);
+  }
+  /** Delete an allowlist rule by id. */
+  async removeRule(ruleId) {
+    await this.http.delete(`/egress/allowlist/${ruleId}`);
+  }
+  // ── policies ──────────────────────────────────────────────────────────────
+  /** List egress policies. */
+  async policies(params = {}) {
+    const query = stripUndefined6({
+      resource_id: pickFirst2(params.resourceId, params.resource_id),
+      resource_type: pickFirst2(params.resourceType, params.resource_type)
+    });
+    const data = await this.http.get("/egress/policies", query);
+    return unwrapList9(data);
+  }
+  /** Create an egress policy. */
+  async createPolicy(params) {
+    const body = stripUndefined6({
+      name: params.name,
+      mode: params.mode ?? "enforce",
+      default_effect: pickFirst2(
+        params.defaultEffect,
+        params.default_effect,
+        "deny"
+      ),
+      resource_id: pickFirst2(params.resourceId, params.resource_id),
+      resource_type: pickFirst2(params.resourceType, params.resource_type),
+      description: params.description
+    });
+    const data = await this.http.post(
+      "/egress/policies",
+      body
+    );
+    return unwrap18(data);
+  }
+  /** Update an egress policy by id. */
+  async updatePolicy(policyId, params) {
+    const body = stripUndefined6({
+      mode: params.mode,
+      default_effect: pickFirst2(params.defaultEffect, params.default_effect),
+      name: params.name,
+      description: params.description
+    });
+    const data = await this.http.patch(
+      `/egress/policies/${policyId}`,
+      body
+    );
+    return unwrap18(data);
+  }
+  // ── mode helpers ──────────────────────────────────────────────────────────
+  /** Set the policy to `mode="enforce"` — denied egress is blocked. */
+  async lockdown(params = {}) {
+    return this.setMode("enforce", params);
+  }
+  /** Set the policy to `mode="audit_only"` — log but do not block. */
+  async observe(params = {}) {
+    return this.setMode("audit_only", params);
+  }
+  async setMode(mode, params) {
+    const policyId = pickFirst2(params.policyId, params.policy_id);
+    const resourceId = pickFirst2(params.resourceId, params.resource_id);
+    const resourceType = pickFirst2(params.resourceType, params.resource_type);
+    if (policyId) {
+      return this.updatePolicy(policyId, { mode });
+    }
+    const body = resourceId !== void 0 && resourceType !== void 0 ? stripUndefined6({
+      mode,
+      resource_id: resourceId,
+      resource_type: resourceType
+    }) : { mode };
+    const data = await this.http.patch(
+      "/egress/policies",
+      body
+    );
+    return unwrap18(data);
+  }
+  // ── suggestions ───────────────────────────────────────────────────────────
+  /** AI-generated allowlist suggestions from recent denied egress. */
+  async suggestions(params = {}) {
+    const query = stripUndefined6({
+      resource_id: pickFirst2(params.resourceId, params.resource_id),
+      resource_type: pickFirst2(params.resourceType, params.resource_type),
+      since: params.since ?? "7d"
+    });
+    const data = await this.http.get(
+      "/egress/audit/suggestions",
+      query
+    );
+    return unwrapList9(data);
+  }
+};
+var SandboxNetwork = class {
+  constructor(http, resourceId) {
+    this.resourceId = resourceId;
+    this.delegate = new EgressNetwork(http);
+  }
+  resourceId;
+  resourceType = "sandbox";
+  delegate;
+  resolvedResourceId(params) {
+    return params.resourceId ?? params.resource_id ?? this.resourceId;
+  }
+  resolvedResourceType(params) {
+    return params.resourceType ?? params.resource_type ?? this.resourceType;
+  }
+  allow(host, params = {}) {
+    return this.delegate.allow(host, {
+      ...params,
+      resource_id: this.resolvedResourceId(params),
+      resource_type: this.resolvedResourceType(params)
+    });
+  }
+  deny(host, params = {}) {
+    return this.delegate.deny(host, {
+      ...params,
+      resource_id: this.resolvedResourceId(params),
+      resource_type: this.resolvedResourceType(params)
+    });
+  }
+  rules(params = {}) {
+    return this.delegate.rules({
+      ...params,
+      resource_id: this.resolvedResourceId(params),
+      resource_type: this.resolvedResourceType(params)
+    });
+  }
+  removeRule(ruleId) {
+    return this.delegate.removeRule(ruleId);
+  }
+  lockdown(params = {}) {
+    const body = {
+      resource_id: this.resourceId,
+      resource_type: this.resourceType
+    };
+    if (params.policyId !== void 0) body.policyId = params.policyId;
+    return this.delegate.lockdown(body);
+  }
+  observe(params = {}) {
+    const body = {
+      resource_id: this.resourceId,
+      resource_type: this.resourceType
+    };
+    if (params.policyId !== void 0) body.policyId = params.policyId;
+    return this.delegate.observe(body);
+  }
+  suggestions(params = {}) {
+    const body = {
+      resource_id: this.resourceId,
+      resource_type: this.resourceType
+    };
+    if (params.since !== void 0) body.since = params.since;
+    return this.delegate.suggestions(body);
+  }
+  policies() {
+    return this.delegate.policies({
+      resource_id: this.resourceId,
+      resource_type: this.resourceType
+    });
+  }
+};
+var ComputerNetwork = class extends SandboxNetwork {
+  resourceType = "computer";
+};
+
+// src/resources/egressSecrets.ts
+function unwrap19(payload) {
+  if (payload && typeof payload === "object") {
+    const p = payload;
+    for (const k of ["data", "secret", "binding", "items"]) {
+      if (k in p) return p[k];
+    }
+  }
+  return payload;
+}
+function unwrapList10(payload) {
+  if (Array.isArray(payload)) return payload;
+  if (payload && typeof payload === "object") {
+    const p = payload;
+    for (const k of ["data", "secrets", "bindings", "providers", "items"]) {
+      if (Array.isArray(p[k])) return p[k];
+    }
+  }
+  return [];
+}
+function stripUndefined7(input) {
+  return Object.fromEntries(
+    Object.entries(input).filter(([, v]) => v !== void 0)
+  );
+}
+function pickFirst3(...values) {
+  for (const v of values) if (v !== void 0) return v;
+  return void 0;
+}
+function setBody(params) {
+  return stripUndefined7({
+    name: params.name,
+    value: params.value,
+    type: params.type ?? "api_key",
+    scope: params.scope ?? "user",
+    expose_as_env: pickFirst3(params.exposeAsEnv, params.expose_as_env),
+    workspace_id: pickFirst3(params.workspaceId, params.workspace_id),
+    owner_user_id: pickFirst3(params.ownerUserId, params.owner_user_id),
+    external_user_id: pickFirst3(params.externalUserId, params.external_user_id),
+    external_workspace_id: pickFirst3(
+      params.externalWorkspaceId,
+      params.external_workspace_id
+    ),
+    resource_id: pickFirst3(params.resourceId, params.resource_id),
+    resource_type: pickFirst3(params.resourceType, params.resource_type),
+    refresh_token: pickFirst3(params.refreshToken, params.refresh_token),
+    expires_at: pickFirst3(params.expiresAt, params.expires_at),
+    metadata: params.metadata
+  });
+}
+function listQuery2(params) {
+  return stripUndefined7({
+    scope: params.scope,
+    type: params.type,
+    workspace_id: pickFirst3(params.workspaceId, params.workspace_id),
+    owner_user_id: pickFirst3(params.ownerUserId, params.owner_user_id),
+    external_user_id: pickFirst3(params.externalUserId, params.external_user_id),
+    external_workspace_id: pickFirst3(
+      params.externalWorkspaceId,
+      params.external_workspace_id
+    ),
+    resource_id: pickFirst3(params.resourceId, params.resource_id),
+    resource_type: pickFirst3(params.resourceType, params.resource_type)
+  });
+}
+function rotateBody(params) {
+  return stripUndefined7({
+    value: pickFirst3(params.newValue, params.new_value, params.value),
+    refresh_token: pickFirst3(params.refreshToken, params.refresh_token),
+    expires_at: pickFirst3(params.expiresAt, params.expires_at)
+  });
+}
+function bindingBody(params) {
+  return stripUndefined7({
+    secret_id: pickFirst3(params.secretId, params.secret_id),
+    resource_id: pickFirst3(params.resourceId, params.resource_id),
+    resource_type: pickFirst3(params.resourceType, params.resource_type),
+    expose_as_env: pickFirst3(params.exposeAsEnv, params.expose_as_env)
+  });
+}
+function bindingQuery(params) {
+  return stripUndefined7({
+    resource_id: pickFirst3(params.resourceId, params.resource_id),
+    resource_type: pickFirst3(params.resourceType, params.resource_type),
+    secret_id: pickFirst3(params.secretId, params.secret_id)
+  });
+}
+function oauthBody(params) {
+  return stripUndefined7({
+    provider: params.provider,
+    expose_as_env: pickFirst3(params.exposeAsEnv, params.expose_as_env),
+    scope: params.scope,
+    owner_user_id: pickFirst3(params.ownerUserId, params.owner_user_id),
+    external_user_id: pickFirst3(params.externalUserId, params.external_user_id),
+    external_workspace_id: pickFirst3(
+      params.externalWorkspaceId,
+      params.external_workspace_id
+    ),
+    resource_id: pickFirst3(params.resourceId, params.resource_id),
+    resource_type: pickFirst3(params.resourceType, params.resource_type),
+    redirect_uri: pickFirst3(params.redirectUri, params.redirect_uri)
+  });
+}
+function sleep3(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+var OAuthFlow = class {
+  authorizeUrl;
+  state;
+  provider;
+  data;
+  http;
+  constructor(http, payload, provider) {
+    this.http = http;
+    this.authorizeUrl = payload.authorize_url ?? payload.authorizeUrl ?? "";
+    this.state = payload.state ?? "";
+    if (provider !== void 0) {
+      this.provider = provider;
+    }
+    this.data = payload;
+  }
+  /**
+   * Poll `GET /egress/oauth/status?state=...` until the flow completes.
+   *
+   * Returns the status payload once the upstream provider issues
+   * tokens. Rejects with a `TimeoutError`-style Error if the flow does
+   * not complete within `timeoutSec` seconds, or if the upstream
+   * returns a failed status.
+   */
+  async waitForCompletion(options = {}) {
+    const timeoutSec = options.timeoutSec ?? 300;
+    const pollMs = options.pollIntervalMs ?? 2e3;
+    const deadline = Date.now() + timeoutSec * 1e3;
+    while (Date.now() < deadline) {
+      const data = await this.http.get("/egress/oauth/status", {
+        state: this.state
+      });
+      const payload = unwrap19(data) ?? {};
+      const status = payload.status;
+      if (status === "completed" || status === "ready" || status === "succeeded") {
+        return payload;
+      }
+      if (status === "failed" || status === "error" || status === "denied") {
+        throw new Error(
+          `OAuth flow ${this.state} ended in status=${status}: ${payload.error ?? payload.message ?? "no detail"}`
+        );
+      }
+      await sleep3(pollMs);
+    }
+    throw new Error(
+      `OAuth flow ${this.state} did not complete within ${timeoutSec}s`
+    );
+  }
+};
+var EgressSecrets = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /**
+   * Create a secret. When `exposeAsEnv` is provided together with
+   * `resourceId` the backend also creates a binding so the value is
+   * injected as an env-var on that resource.
+   */
+  async set(params) {
+    const data = await this.http.post(
+      "/egress/secrets",
+      setBody(params)
+    );
+    return unwrap19(data);
+  }
+  /** List secrets. */
+  async list(params = {}) {
+    const data = await this.http.get(
+      "/egress/secrets",
+      listQuery2(params)
+    );
+    return unwrapList10(data);
+  }
+  /** Get a single secret by id. */
+  async get(id) {
+    const data = await this.http.get(
+      `/egress/secrets/${id}`
+    );
+    return unwrap19(data);
+  }
+  /** Rotate the secret's value. */
+  async rotate(id, params) {
+    const body = typeof params === "string" ? rotateBody({ newValue: params }) : rotateBody(params);
+    const data = await this.http.patch(
+      `/egress/secrets/${id}`,
+      body
+    );
+    return unwrap19(data);
+  }
+  /** Delete a secret. */
+  async delete(id) {
+    await this.http.delete(`/egress/secrets/${id}`);
+  }
+  // ── bindings ───────────────────────────────────────────────────────────────
+  /** Bind a secret to a resource as an env var. */
+  async createBinding(params) {
+    const data = await this.http.post(
+      "/egress/bindings",
+      bindingBody(params)
+    );
+    return unwrap19(data);
+  }
+  /** List secret bindings. */
+  async listBindings(params = {}) {
+    const data = await this.http.get(
+      "/egress/bindings",
+      bindingQuery(params)
+    );
+    return unwrapList10(data);
+  }
+  /** Delete a binding. */
+  async deleteBinding(id) {
+    await this.http.delete(`/egress/bindings/${id}`);
+  }
+  // ── OAuth Connect ──────────────────────────────────────────────────────────
+  /** List OAuth providers visible to the current tenant. */
+  async providers() {
+    const data = await this.http.get("/egress/oauth/providers");
+    return unwrapList10(data);
+  }
+  /**
+   * Start an OAuth Connect flow.
+   *
+   * Returns an {@link OAuthFlow} — the caller must surface
+   * `flow.authorizeUrl` to the end user (the SDK does NOT open the
+   * browser) and then call `flow.waitForCompletion()` to receive the
+   * resulting secret id.
+   */
+  async connect(params) {
+    const data = await this.http.post(
+      "/egress/oauth/start",
+      oauthBody(params)
+    );
+    const payload = unwrap19(data) ?? {};
+    return new OAuthFlow(this.http, payload, params.provider);
+  }
+};
+var SandboxSecrets = class {
+  constructor(http, resourceId) {
+    this.resourceId = resourceId;
+    this.delegate = new EgressSecrets(http);
+  }
+  resourceId;
+  resourceType = "sandbox";
+  delegate;
+  resolvedResourceId(params) {
+    return params.resourceId ?? params.resource_id ?? this.resourceId;
+  }
+  resolvedResourceType(params) {
+    return params.resourceType ?? params.resource_type ?? this.resourceType;
+  }
+  set(params) {
+    return this.delegate.set({
+      ...params,
+      resource_id: this.resolvedResourceId(params),
+      resource_type: this.resolvedResourceType(params)
+    });
+  }
+  list(params = {}) {
+    return this.delegate.list({
+      ...params,
+      resource_id: this.resolvedResourceId(params),
+      resource_type: this.resolvedResourceType(params)
+    });
+  }
+  get(id) {
+    return this.delegate.get(id);
+  }
+  rotate(id, params) {
+    return this.delegate.rotate(id, params);
+  }
+  delete(id) {
+    return this.delegate.delete(id);
+  }
+  connect(params) {
+    return this.delegate.connect({
+      ...params,
+      resource_id: this.resolvedResourceId(params),
+      resource_type: this.resolvedResourceType(params)
+    });
+  }
+  listBindings(params = {}) {
+    return this.delegate.listBindings({
+      ...params,
+      resource_id: this.resolvedResourceId(params),
+      resource_type: this.resolvedResourceType(params)
+    });
+  }
+};
+var ComputerSecrets = class extends SandboxSecrets {
+  resourceType = "computer";
+};
 var EventStream = class extends EventEmitter {
   ws = null;
   closed = false;
@@ -2252,6 +2937,12 @@ var Computer = class _Computer {
   ports;
   /** Volume attachment — list, attach, detach. */
   volumes;
+  /** Encrypted secrets + OAuth credentials scoped to this computer. */
+  secrets;
+  /** Egress allowlist + policies scoped to this computer. */
+  network;
+  /** Egress audit log + live tail scoped to this computer. */
+  audit;
   http;
   constructor(http, data) {
     this.http = http;
@@ -2272,6 +2963,9 @@ var Computer = class _Computer {
     this.logs = new ComputerLogs(http, id);
     this.ports = new ComputerPorts(http, id);
     this.volumes = new ComputerVolumes(http, id);
+    this.secrets = new ComputerSecrets(http, id);
+    this.network = new ComputerNetwork(http, id);
+    this.audit = new ComputerAudit(http, id);
   }
   get id() {
     return this.data.id;
@@ -2668,7 +3362,7 @@ var Credits = class {
     return this.http.get("/credits/usage");
   }
 };
-function unwrap17(payload) {
+function unwrap20(payload) {
   if (payload && typeof payload === "object" && "data" in payload) {
     return payload.data;
   }
@@ -2684,7 +3378,7 @@ function listItems2(payload, candidateKeys = ["data", "cron_jobs", "executions",
   }
   return [];
 }
-function stripUndefined5(input) {
+function stripUndefined8(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -2698,28 +3392,28 @@ var CronJobs = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined5({ ...params });
+    const query = stripUndefined8({ ...params });
     const data = await this.http.get("/cron-jobs", query);
     return listItems2(data);
   }
   async get(jobId) {
     const data = await this.http.get(`/cron-jobs/${jobId}`);
-    return unwrap17(data);
+    return unwrap20(data);
   }
   async create(params) {
     const { idempotencyKey: ikey, ...rest } = params;
-    const body = stripUndefined5(rest);
+    const body = stripUndefined8(rest);
     const data = await this.http.request("/cron-jobs", {
       method: "POST",
       body,
       headers: { "Idempotency-Key": idempotencyKey2(ikey) }
     });
-    return unwrap17(data);
+    return unwrap20(data);
   }
   async update(jobId, params) {
-    const body = stripUndefined5(params);
+    const body = stripUndefined8(params);
     const data = await this.http.patch(`/cron-jobs/${jobId}`, body);
-    return unwrap17(data);
+    return unwrap20(data);
   }
   async delete(jobId) {
     await this.http.delete(`/cron-jobs/${jobId}`);
@@ -2727,11 +3421,11 @@ var CronJobs = class {
   // ── Control ────────────────────────────────────────────────────────────────
   async pause(jobId) {
     const data = await this.http.post(`/cron-jobs/${jobId}/pause`);
-    return unwrap17(data);
+    return unwrap20(data);
   }
   async resume(jobId) {
     const data = await this.http.post(`/cron-jobs/${jobId}/resume`);
-    return unwrap17(data);
+    return unwrap20(data);
   }
   async runNow(jobId, opts = {}) {
     const data = await this.http.request(
@@ -2741,7 +3435,7 @@ var CronJobs = class {
         headers: { "Idempotency-Key": idempotencyKey2(opts.idempotencyKey) }
       }
     );
-    return unwrap17(data);
+    return unwrap20(data);
   }
   // ── Execution history ──────────────────────────────────────────────────────
   async listExecutions(jobId) {
@@ -2756,12 +3450,12 @@ var CronJobs = class {
     const data = await this.http.get(
       `/cron-jobs/${jobId}/executions/${executionId}`
     );
-    return unwrap17(data);
+    return unwrap20(data);
   }
 };
 
 // src/resources/dashboard.ts
-function unwrap18(payload) {
+function unwrap21(payload) {
   if (payload && typeof payload === "object") {
     const p = payload;
     for (const k of ["data", "dashboard", "overview", "items"]) {
@@ -2778,15 +3472,15 @@ var Dashboard = class {
   /** Aggregated user dashboard payload. */
   async summary() {
     const data = await this.http.get("/dashboard");
-    return unwrap18(data);
+    return unwrap21(data);
   }
   /** Status / health overview (public endpoint). */
   async overview() {
     const data = await this.http.get("/overview");
-    return unwrap18(data);
+    return unwrap21(data);
   }
 };
-function unwrap19(payload) {
+function unwrap22(payload) {
   if (payload && typeof payload === "object" && "data" in payload) {
     return payload.data;
   }
@@ -2802,7 +3496,7 @@ function listItems3(payload, candidateKeys = ["data", "databases", "items"]) {
   }
   return [];
 }
-function stripUndefined6(input) {
+function stripUndefined9(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -2816,13 +3510,13 @@ var Databases = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined6({ ...params });
+    const query = stripUndefined9({ ...params });
     const data = await this.http.get("/databases", query);
     return listItems3(data);
   }
   async get(databaseId) {
     const data = await this.http.get(`/databases/${databaseId}`);
-    return unwrap19(data);
+    return unwrap22(data);
   }
   async create(params) {
     const {
@@ -2833,7 +3527,7 @@ var Databases = class {
       size: _deprecatedSize,
       ...rest
     } = params;
-    const body = stripUndefined6({
+    const body = stripUndefined9({
       ...rest,
       engine_version: engine_version ?? version
     });
@@ -2846,7 +3540,7 @@ var Databases = class {
         )
       }
     });
-    return unwrap19(data);
+    return unwrap22(data);
   }
   async delete(databaseId) {
     await this.http.delete(`/databases/${databaseId}`);
@@ -2856,27 +3550,27 @@ var Databases = class {
     const data = await this.http.post(
       `/databases/${databaseId}/start`
     );
-    return unwrap19(data);
+    return unwrap22(data);
   }
   async stop(databaseId) {
     const data = await this.http.post(`/databases/${databaseId}/stop`);
-    return unwrap19(data);
+    return unwrap22(data);
   }
   async restart(databaseId) {
     const data = await this.http.post(
       `/databases/${databaseId}/restart`
     );
-    return unwrap19(data);
+    return unwrap22(data);
   }
   // ── Credentials + logs ────────────────────────────────────────────────────
   async credentials(databaseId) {
     const data = await this.http.get(
       `/databases/${databaseId}/credentials`
     );
-    return unwrap19(data);
+    return unwrap22(data);
   }
   async logs(databaseId, params = {}) {
-    const query = stripUndefined6({
+    const query = stripUndefined9({
       lines: params.lines,
       since: params.since
     });
@@ -2903,7 +3597,7 @@ function attributionBody(p) {
 function idempotencyKey4(key) {
   return key ?? randomUUID();
 }
-function unwrap20(payload) {
+function unwrap23(payload) {
   if (payload && typeof payload === "object" && "data" in payload) {
     return payload.data;
   }
@@ -2919,7 +3613,7 @@ function listItems4(payload, candidateKeys = ["items", "deployments", "versions"
   }
   return [];
 }
-function stripUndefined7(input) {
+function stripUndefined10(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -2932,7 +3626,7 @@ var DeploymentVersions = class {
   http;
   deploymentId;
   async list(params = {}) {
-    const query = stripUndefined7({
+    const query = stripUndefined10({
       state: params.state,
       limit: params.limit,
       cursor: params.cursor,
@@ -2948,10 +3642,10 @@ var DeploymentVersions = class {
     const data = await this.http.get(
       `/deployments/${this.deploymentId}/versions/${versionId}`
     );
-    return unwrap20(data);
+    return unwrap23(data);
   }
   async promote(versionId, opts = {}) {
-    const body = stripUndefined7({ environment: opts.environment });
+    const body = stripUndefined10({ environment: opts.environment });
     const data = await this.http.request(
       `/deployments/${this.deploymentId}/versions/${versionId}/promote`,
       {
@@ -2960,7 +3654,7 @@ var DeploymentVersions = class {
         headers: { "Idempotency-Key": idempotencyKey4(opts.idempotencyKey) }
       }
     );
-    return unwrap20(data);
+    return unwrap23(data);
   }
 };
 var DeploymentReleases = class {
@@ -2980,7 +3674,7 @@ var DeploymentReleases = class {
     const data = await this.http.get(
       `/deployments/${this.deploymentId}/releases/${releaseId}`
     );
-    return unwrap20(data);
+    return unwrap23(data);
   }
 };
 var DeploymentRuntimeInstances = class {
@@ -3000,14 +3694,14 @@ var DeploymentRuntimeInstances = class {
     const data = await this.http.get(
       `/deployments/${this.deploymentId}/runtime-instances/${instanceId}`
     );
-    return unwrap20(data);
+    return unwrap23(data);
   }
   async logs(instanceId, lines = 100) {
     const data = await this.http.get(
       `/deployments/${this.deploymentId}/runtime-instances/${instanceId}/logs`,
       { lines }
     );
-    const unwrapped = unwrap20(data);
+    const unwrapped = unwrap23(data);
     const result = { logs: String(unwrapped.logs ?? "") };
     if (typeof unwrapped.runtime_instance_id === "string") {
       result.runtime_instance_id = unwrapped.runtime_instance_id;
@@ -3038,11 +3732,11 @@ var DeploymentDomains = class {
       `/deployments/${this.deploymentId}/domains`,
       {
         method: "POST",
-        body: stripUndefined7(body),
+        body: stripUndefined10(body),
         headers: { "Idempotency-Key": idempotencyKey4(params.idempotencyKey) }
       }
     );
-    return unwrap20(data);
+    return unwrap23(data);
   }
   async list(filters = {}) {
     const data = await this.http.get(
@@ -3055,7 +3749,7 @@ var DeploymentDomains = class {
     const data = await this.http.post(
       `/deployments/${this.deploymentId}/domains/${domainId}/verify`
     );
-    return unwrap20(data);
+    return unwrap23(data);
   }
   async delete(domainId) {
     await this.http.delete(
@@ -3070,7 +3764,7 @@ var Deployments = class {
   http;
   async list(params = {}) {
     const projectId = params.projectId ?? params.project_id;
-    const query = stripUndefined7({
+    const query = stripUndefined10({
       project_id: projectId,
       state: params.state,
       limit: params.limit,
@@ -3085,10 +3779,10 @@ var Deployments = class {
   }
   async get(deploymentId) {
     const data = await this.http.get(`/deployments/${deploymentId}`);
-    return unwrap20(data);
+    return unwrap23(data);
   }
   async create(params) {
-    const body = stripUndefined7({
+    const body = stripUndefined10({
       name: params.name,
       repo_url: params.repoUrl ?? params.repo_url,
       branch: params.branch,
@@ -3097,6 +3791,7 @@ var Deployments = class {
       auto_deploy: params.autoDeploy ?? params.auto_deploy,
       database: params.database,
       metadata: params.metadata,
+      target_region: params.targetRegion ?? params.target_region,
       ...attributionBody(params)
     });
     const data = await this.http.request("/deployments", {
@@ -3104,10 +3799,10 @@ var Deployments = class {
       body,
       headers: { "Idempotency-Key": idempotencyKey4(params.idempotencyKey) }
     });
-    return unwrap20(data);
+    return unwrap23(data);
   }
   async update(deploymentId, params) {
-    const body = stripUndefined7({
+    const body = stripUndefined10({
       name: params.name,
       branch: params.branch,
       build_command: params.buildCommand ?? params.build_command,
@@ -3118,13 +3813,13 @@ var Deployments = class {
       `/deployments/${deploymentId}`,
       body
     );
-    return unwrap20(data);
+    return unwrap23(data);
   }
   async delete(deploymentId) {
     await this.http.delete(`/deployments/${deploymentId}`);
   }
   async publish(deploymentId, params) {
-    const body = stripUndefined7({
+    const body = stripUndefined10({
       source_sandbox_id: params.sourceSandboxId ?? params.source_sandbox_id,
       output_path: params.outputPath ?? params.output_path,
       entrypoint: params.entrypoint,
@@ -3138,7 +3833,7 @@ var Deployments = class {
         headers: { "Idempotency-Key": idempotencyKey4(params.idempotencyKey) }
       }
     );
-    return unwrap20(data);
+    return unwrap23(data);
   }
   /**
    * Backward-compatible bridge: POST /sandboxes/:id/deploy. Works today;
@@ -3146,7 +3841,7 @@ var Deployments = class {
    * phase. Prefer `publish()` once Phase 2B/3 lands.
    */
   async publishFromSandbox(sandboxId, params = {}) {
-    const body = stripUndefined7({
+    const body = stripUndefined10({
       name: params.name,
       deployment_id: params.deploymentId ?? params.deployment_id,
       output_path: params.outputPath ?? params.output_path,
@@ -3163,10 +3858,10 @@ var Deployments = class {
         headers: { "Idempotency-Key": idempotencyKey4(params.idempotencyKey) }
       }
     );
-    return unwrap20(data);
+    return unwrap23(data);
   }
   async rollback(deploymentId, params = {}) {
-    const body = stripUndefined7({
+    const body = stripUndefined10({
       version_id: params.versionId ?? params.version_id
     });
     const data = await this.http.request(
@@ -3177,7 +3872,7 @@ var Deployments = class {
         headers: { "Idempotency-Key": idempotencyKey4(params.idempotencyKey) }
       }
     );
-    return unwrap20(data);
+    return unwrap23(data);
   }
   async listBuilds(deploymentId) {
     const data = await this.http.get(
@@ -3189,16 +3884,18 @@ var Deployments = class {
     const data = await this.http.get(
       `/deployments/${deploymentId}/builds/${buildId}`
     );
-    return unwrap20(data);
+    return unwrap23(data);
   }
-  async listEnv(deploymentId) {
+  async listEnv(deploymentId, opts = {}) {
+    const query = stripUndefined10({ environment: opts.environment });
     const data = await this.http.get(
-      `/deployments/${deploymentId}/env`
+      `/deployments/${deploymentId}/env`,
+      Object.keys(query).length ? query : void 0
     );
     return listItems4(data);
   }
   async setEnv(deploymentId, vars, opts = {}) {
-    const body = stripUndefined7({ env: vars, environment: opts.environment });
+    const body = stripUndefined10({ env: vars, environment: opts.environment });
     const data = await this.http.post(
       `/deployments/${deploymentId}/env`,
       body
@@ -3223,7 +3920,7 @@ var Deployments = class {
 };
 
 // src/resources/email.ts
-function unwrap21(data) {
+function unwrap24(data) {
   if (data && typeof data === "object") {
     const d = data;
     for (const k of [
@@ -3239,7 +3936,7 @@ function unwrap21(data) {
   }
   return data;
 }
-function unwrapList8(data) {
+function unwrapList11(data) {
   if (Array.isArray(data)) return data;
   if (data && typeof data === "object") {
     const d = data;
@@ -3267,7 +3964,7 @@ var EmailCampaigns = class {
   }
   http;
   async list(filters = {}) {
-    return unwrapList8(
+    return unwrapList11(
       await this.http.get(
         "/admin/email-campaigns",
         filters
@@ -3275,12 +3972,12 @@ var EmailCampaigns = class {
     );
   }
   async create(attrs) {
-    return unwrap21(
+    return unwrap24(
       await this.http.post("/admin/email-campaigns", strip(attrs))
     );
   }
   async recipientCount(filters = {}) {
-    return unwrap21(
+    return unwrap24(
       await this.http.get(
         "/admin/email-campaigns/recipient-count",
         filters
@@ -3288,7 +3985,7 @@ var EmailCampaigns = class {
     );
   }
   async send(campaignId, opts = {}) {
-    return unwrap21(
+    return unwrap24(
       await this.http.post(
         `/admin/email-campaigns/${campaignId}/send`,
         strip(opts)
@@ -3296,14 +3993,14 @@ var EmailCampaigns = class {
     );
   }
   async cancel(campaignId) {
-    return unwrap21(
+    return unwrap24(
       await this.http.post(
         `/admin/email-campaigns/${campaignId}/cancel`
       )
     );
   }
   async deliveries(campaignId, filters = {}) {
-    return unwrapList8(
+    return unwrapList11(
       await this.http.get(
         `/admin/email-campaigns/${campaignId}/deliveries`,
         filters
@@ -3317,12 +4014,12 @@ var EmailTemplates = class {
   }
   http;
   async list(filters = {}) {
-    return unwrapList8(
+    return unwrapList11(
       await this.http.get("/admin/email-templates", filters)
     );
   }
   async create(key, attrs = {}) {
-    return unwrap21(
+    return unwrap24(
       await this.http.post("/admin/email-templates", {
         key,
         ...strip(attrs)
@@ -3330,7 +4027,7 @@ var EmailTemplates = class {
     );
   }
   async update(key, attrs) {
-    return unwrap21(
+    return unwrap24(
       await this.http.put(
         `/admin/email-templates/${key}`,
         strip(attrs)
@@ -3338,7 +4035,7 @@ var EmailTemplates = class {
     );
   }
   async reset(key) {
-    return unwrap21(
+    return unwrap24(
       await this.http.post(`/admin/email-templates/${key}/reset`)
     );
   }
@@ -3349,22 +4046,22 @@ var EmailInbox = class {
   }
   http;
   async list(filters = {}) {
-    return unwrapList8(
+    return unwrapList11(
       await this.http.get("/admin/email-inbox", filters)
     );
   }
   async send(attrs) {
-    return unwrap21(
+    return unwrap24(
       await this.http.post("/admin/email-inbox/send", strip(attrs))
     );
   }
   async markRead(messageId) {
-    return unwrap21(
+    return unwrap24(
       await this.http.post(`/admin/email-inbox/${messageId}/read`)
     );
   }
   async archive(messageId) {
-    return unwrap21(
+    return unwrap24(
       await this.http.post(`/admin/email-inbox/${messageId}/archive`)
     );
   }
@@ -3404,7 +4101,7 @@ var Embeddings = class {
 };
 
 // src/resources/external-keys.ts
-function unwrap22(payload) {
+function unwrap25(payload) {
   if (payload && typeof payload === "object") {
     const p = payload;
     for (const k of ["data", "external_keys", "items"]) {
@@ -3413,7 +4110,7 @@ function unwrap22(payload) {
   }
   return payload;
 }
-function stripUndefined8(input) {
+function stripUndefined11(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -3426,22 +4123,22 @@ var ExternalKeys = class {
   /** List configured external keys. */
   async list() {
     const data = await this.http.get("/external-keys");
-    const result = unwrap22(data);
+    const result = unwrap25(data);
     if (Array.isArray(result)) return result;
     return [];
   }
   /** Create / register an external provider key. */
   async create(params) {
-    const body = stripUndefined8(params);
+    const body = stripUndefined11(params);
     const data = await this.http.post("/external-keys", body);
-    return unwrap22(data);
+    return unwrap25(data);
   }
   /** Resolve (preview) the stored key for a provider. */
   async resolve(provider) {
     const data = await this.http.get(
       `/external-keys/${provider}/resolve`
     );
-    return unwrap22(data);
+    return unwrap25(data);
   }
   /**
    * Delete the stored key for a provider.
@@ -3451,7 +4148,7 @@ var ExternalKeys = class {
     await this.http.delete(`/external-keys/${provider}`);
   }
 };
-function unwrap23(payload) {
+function unwrap26(payload) {
   if (payload && typeof payload === "object" && "data" in payload) {
     return payload.data;
   }
@@ -3467,7 +4164,7 @@ function listItems5(payload, candidateKeys = ["data", "domains", "items"]) {
   }
   return [];
 }
-function stripUndefined9(input) {
+function stripUndefined12(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -3481,7 +4178,7 @@ var FlatCustomDomains = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined9({ ...params });
+    const query = stripUndefined12({ ...params });
     const data = await this.http.get("/custom-domains", query);
     return listItems5(data);
   }
@@ -3493,7 +4190,7 @@ var FlatCustomDomains = class {
       redirectPolicy,
       ...rest
     } = params;
-    const body = stripUndefined9({
+    const body = stripUndefined12({
       ...rest,
       resource_type: resourceType ?? rest.resource_type,
       resource_id: resourceId ?? rest.resource_id,
@@ -3504,13 +4201,13 @@ var FlatCustomDomains = class {
       body,
       headers: { "Idempotency-Key": idempotencyKey5(ikey) }
     });
-    return unwrap23(data);
+    return unwrap26(data);
   }
   async delete(domainId) {
     await this.http.delete(`/custom-domains/${domainId}`);
   }
 };
-function unwrap24(payload) {
+function unwrap27(payload) {
   if (payload && typeof payload === "object" && "data" in payload) {
     return payload.data;
   }
@@ -3526,7 +4223,7 @@ function listItems6(payload, candidateKeys = ["data", "functions", "items"]) {
   }
   return [];
 }
-function stripUndefined10(input) {
+function stripUndefined13(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -3540,17 +4237,17 @@ var Functions = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined10({ ...params });
+    const query = stripUndefined13({ ...params });
     const data = await this.http.get("/functions", query);
     return listItems6(data);
   }
   async get(functionId) {
     const data = await this.http.get(`/functions/${functionId}`);
-    return unwrap24(data);
+    return unwrap27(data);
   }
   async create(params) {
     const { idempotencyKey: ikey, memoryMb, timeoutSec, ...rest } = params;
-    const body = stripUndefined10({
+    const body = stripUndefined13({
       ...rest,
       memory_mb: memoryMb ?? rest.memory_mb,
       timeout_sec: timeoutSec ?? rest.timeout_sec
@@ -3560,11 +4257,11 @@ var Functions = class {
       body,
       headers: { "Idempotency-Key": idempotencyKey6(ikey) }
     });
-    return unwrap24(data);
+    return unwrap27(data);
   }
   async update(functionId, params) {
     const { memoryMb, timeoutSec, ...rest } = params;
-    const body = stripUndefined10({
+    const body = stripUndefined13({
       ...rest,
       memory_mb: memoryMb ?? rest.memory_mb,
       timeout_sec: timeoutSec ?? rest.timeout_sec
@@ -3573,7 +4270,7 @@ var Functions = class {
       `/functions/${functionId}`,
       body
     );
-    return unwrap24(data);
+    return unwrap27(data);
   }
   async delete(functionId) {
     await this.http.delete(`/functions/${functionId}`);
@@ -3594,7 +4291,7 @@ var Functions = class {
     return data ?? {};
   }
 };
-function unwrap25(payload) {
+function unwrap28(payload) {
   if (payload && typeof payload === "object" && "data" in payload) {
     return payload.data;
   }
@@ -3610,7 +4307,7 @@ function listItems7(payload, candidateKeys = ["data", "health_checks", "items"])
   }
   return [];
 }
-function stripUndefined11(input) {
+function stripUndefined14(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -3624,13 +4321,13 @@ var HealthChecks = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined11({ ...params });
+    const query = stripUndefined14({ ...params });
     const data = await this.http.get("/health-checks", query);
     return listItems7(data);
   }
   async get(checkId) {
     const data = await this.http.get(`/health-checks/${checkId}`);
-    return unwrap25(data);
+    return unwrap28(data);
   }
   async create(params) {
     const {
@@ -3640,7 +4337,7 @@ var HealthChecks = class {
       expectedStatus,
       ...rest
     } = params;
-    const body = stripUndefined11({
+    const body = stripUndefined14({
       ...rest,
       interval_sec: intervalSec ?? rest.interval_sec,
       timeout_sec: timeoutSec ?? rest.timeout_sec,
@@ -3651,11 +4348,11 @@ var HealthChecks = class {
       body,
       headers: { "Idempotency-Key": idempotencyKey7(ikey) }
     });
-    return unwrap25(data);
+    return unwrap28(data);
   }
   async update(checkId, params) {
     const { intervalSec, timeoutSec, expectedStatus, ...rest } = params;
-    const body = stripUndefined11({
+    const body = stripUndefined14({
       ...rest,
       interval_sec: intervalSec ?? rest.interval_sec,
       timeout_sec: timeoutSec ?? rest.timeout_sec,
@@ -3665,7 +4362,7 @@ var HealthChecks = class {
       `/health-checks/${checkId}`,
       body
     );
-    return unwrap25(data);
+    return unwrap28(data);
   }
   async delete(checkId) {
     await this.http.delete(`/health-checks/${checkId}`);
@@ -3673,7 +4370,7 @@ var HealthChecks = class {
 };
 
 // src/resources/integrations.ts
-function unwrap26(payload) {
+function unwrap29(payload) {
   if (payload && typeof payload === "object") {
     const p = payload;
     for (const k of ["data", "integrations", "catalog", "items"]) {
@@ -3683,11 +4380,11 @@ function unwrap26(payload) {
   return payload;
 }
 function listItems8(payload) {
-  const result = unwrap26(payload);
+  const result = unwrap29(payload);
   if (Array.isArray(result)) return result;
   return [];
 }
-function stripUndefined12(input) {
+function stripUndefined15(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -3712,14 +4409,14 @@ var Integrations = class {
     const data = await this.http.get(
       `/integrations/${provider}/start`
     );
-    return unwrap26(data);
+    return unwrap29(data);
   }
   /** Force-refresh the access token for a provider. */
   async refresh(provider) {
     const data = await this.http.post(
       `/integrations/${provider}/refresh`
     );
-    return unwrap26(data);
+    return unwrap29(data);
   }
   /** Disconnect (revoke) an integration. */
   async disconnect(provider) {
@@ -3739,41 +4436,41 @@ var Integrations = class {
   // ── Test hooks ─────────────────────────────────────────────────────────────
   /** Send a test message to the connected Slack channel. */
   async slackSendTest(params = {}) {
-    const body = stripUndefined12(params);
+    const body = stripUndefined15(params);
     const data = await this.http.post(
       "/integrations/slack/send-test",
       body
     );
-    return unwrap26(data);
+    return unwrap29(data);
   }
   /** Send a test message to the connected Discord channel. */
   async discordSendTest(params = {}) {
-    const body = stripUndefined12(params);
+    const body = stripUndefined15(params);
     const data = await this.http.post(
       "/integrations/discord/send-test",
       body
     );
-    return unwrap26(data);
+    return unwrap29(data);
   }
   // ── Linear dedicated controller ────────────────────────────────────────────
   /** Begin Linear OAuth — Linear has provider-specific error shapes. */
   async linearStart() {
     const data = await this.http.get("/integrations/linear/start");
-    return unwrap26(data);
+    return unwrap29(data);
   }
   /** Create a Linear issue via the connected workspace. */
   async linearCreateIssue(params = {}) {
-    const body = stripUndefined12(params);
+    const body = stripUndefined15(params);
     const data = await this.http.post(
       "/integrations/linear/create-issue",
       body
     );
-    return unwrap26(data);
+    return unwrap29(data);
   }
 };
 
 // src/resources/mcp.ts
-function unwrap27(payload) {
+function unwrap30(payload) {
   if (payload && typeof payload === "object") {
     const p = payload;
     for (const k of ["data", "mcp", "result", "items"]) {
@@ -3782,7 +4479,7 @@ function unwrap27(payload) {
   }
   return payload;
 }
-function stripUndefined13(input) {
+function stripUndefined16(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -3794,12 +4491,12 @@ var Mcp = class {
   http;
   /** Send a JSON-RPC request to the MCP endpoint. */
   async dispatch(params = {}) {
-    const body = stripUndefined13(params);
+    const body = stripUndefined16(params);
     const data = await this.http.post(
       "/mcp",
       Object.keys(body).length > 0 ? body : void 0
     );
-    return unwrap27(data);
+    return unwrap30(data);
   }
   /**
    * Open the MCP listen channel (GET).
@@ -3809,7 +4506,7 @@ var Mcp = class {
    */
   async listen() {
     const data = await this.http.get("/mcp");
-    return unwrap27(data);
+    return unwrap30(data);
   }
   /** Close (terminate) the MCP session. */
   async close() {
@@ -3818,7 +4515,7 @@ var Mcp = class {
 };
 
 // src/resources/models.ts
-function unwrap28(data) {
+function unwrap31(data) {
   if (Array.isArray(data)) return data;
   if (data && typeof data === "object") {
     const d = data;
@@ -3839,7 +4536,7 @@ var Models = class {
       Object.entries(filters).filter(([, v]) => v !== void 0)
     );
     const data = await this.http.get("/intelligence/models", query);
-    return unwrap28(data);
+    return unwrap31(data);
   }
   /**
    * Get a single model by id.
@@ -4469,7 +5166,7 @@ function resourcePayload(params) {
   return { resource_type, resource_id };
 }
 function authConfig(params) {
-  return stripUndefined14({
+  return stripUndefined17({
     ...params.config ?? {},
     signup_enabled: params.signup_enabled ?? params.signupEnabled,
     email_confirm_required: params.email_confirm_required ?? params.emailConfirmRequired,
@@ -4477,12 +5174,12 @@ function authConfig(params) {
   });
 }
 function requestBody(params) {
-  return stripUndefined14({
+  return stripUndefined17({
     ...resourcePayload(params),
     config: authConfig(params)
   });
 }
-function unwrap29(payload) {
+function unwrap32(payload) {
   if (payload && typeof payload === "object") {
     const p = payload;
     for (const k of ["data", "project_auth", "config", "items"]) {
@@ -4491,7 +5188,7 @@ function unwrap29(payload) {
   }
   return payload;
 }
-function stripUndefined14(input) {
+function stripUndefined17(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -4507,13 +5204,13 @@ var ProjectAuth = class {
       "/project-auth/status",
       resourcePayload(params)
     );
-    return unwrap29(data);
+    return unwrap32(data);
   }
   /** Enable project auth. */
   async enable(params) {
     const body = requestBody(params);
     const data = await this.http.post("/project-auth/enable", body);
-    return unwrap29(data);
+    return unwrap32(data);
   }
   /** Disable project auth. */
   async disable(params) {
@@ -4521,18 +5218,18 @@ var ProjectAuth = class {
       "/project-auth/disable",
       resourcePayload(params)
     );
-    return unwrap29(data);
+    return unwrap32(data);
   }
   /** Update project-auth configuration. */
   async update(params) {
     const body = requestBody(params);
     const data = await this.http.patch("/project-auth/config", body);
-    return unwrap29(data);
+    return unwrap32(data);
   }
 };
 
 // src/resources/project-integrations.ts
-function unwrap30(payload) {
+function unwrap33(payload) {
   if (payload && typeof payload === "object") {
     const p = payload;
     for (const k of ["data", "project_integrations", "catalog", "items"]) {
@@ -4542,11 +5239,11 @@ function unwrap30(payload) {
   return payload;
 }
 function listItems9(payload) {
-  const result = unwrap30(payload);
+  const result = unwrap33(payload);
   if (Array.isArray(result)) return result;
   return [];
 }
-function stripUndefined15(input) {
+function stripUndefined18(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -4563,7 +5260,7 @@ var ProjectIntegrations = class {
   http;
   /** List project integrations. */
   async list(params = {}) {
-    const query = stripUndefined15(params);
+    const query = stripUndefined18(params);
     const data = await this.http.get("/project-integrations", query);
     return listItems9(data);
   }
@@ -4577,13 +5274,13 @@ var ProjectIntegrations = class {
     const data = await this.http.get(
       `/project-integrations/${integrationId}`
     );
-    return unwrap30(data);
+    return unwrap33(data);
   }
   /** Create a project integration. */
   async create(params) {
     const body = stripUndefObj2(params);
     const data = await this.http.post("/project-integrations", body);
-    return unwrap30(data);
+    return unwrap33(data);
   }
   /** Update a project integration. */
   async update(integrationId, params) {
@@ -4592,7 +5289,7 @@ var ProjectIntegrations = class {
       `/project-integrations/${integrationId}`,
       body
     );
-    return unwrap30(data);
+    return unwrap33(data);
   }
   /** Delete a project integration. */
   async delete(integrationId) {
@@ -4601,7 +5298,7 @@ var ProjectIntegrations = class {
 };
 
 // src/resources/provider-defaults.ts
-function unwrap31(data) {
+function unwrap34(data) {
   if (data && typeof data === "object") {
     const d = data;
     for (const k of ["data", "defaults", "provider_defaults", "config"]) {
@@ -4617,7 +5314,7 @@ var ProviderDefaults = class {
   http;
   /** Get the current fleet-wide provider defaults. */
   async list() {
-    return unwrap31(await this.http.get("/admin/provider-defaults"));
+    return unwrap34(await this.http.get("/admin/provider-defaults"));
   }
   /** Return the defaults entry for a single provider, or {} if missing. */
   async get(provider) {
@@ -4633,13 +5330,13 @@ var ProviderDefaults = class {
     const body = Object.fromEntries(
       Object.entries(opts).filter(([, v]) => v !== void 0)
     );
-    return unwrap31(
+    return unwrap34(
       await this.http.put("/admin/provider-defaults", body)
     );
   }
   // ── Per-tenant overrides ────────────────────────────────────────────────
   async getTenant(tenantId) {
-    return unwrap31(
+    return unwrap34(
       await this.http.get(
         `/admin/tenants/${tenantId}/provider-config`
       )
@@ -4649,7 +5346,7 @@ var ProviderDefaults = class {
     const body = Object.fromEntries(
       Object.entries(opts).filter(([, v]) => v !== void 0)
     );
-    return unwrap31(
+    return unwrap34(
       await this.http.put(
         `/admin/tenants/${tenantId}/provider-config`,
         body
@@ -4662,7 +5359,7 @@ var ProviderDefaults = class {
 };
 
 // src/resources/regions.ts
-function unwrap32(payload) {
+function unwrap35(payload) {
   if (payload && typeof payload === "object") {
     const p = payload;
     for (const k of [
@@ -4679,7 +5376,7 @@ function unwrap32(payload) {
   return payload;
 }
 function listItems10(payload) {
-  const result = unwrap32(payload);
+  const result = unwrap35(payload);
   if (Array.isArray(result)) return result;
   return [];
 }
@@ -4701,7 +5398,7 @@ var Regions = class {
   /** Get static compute pricing data. */
   async pricing() {
     const data = await this.http.get("/compute/pricing");
-    return unwrap32(data);
+    return unwrap35(data);
   }
   /** List community computer templates. */
   async listTemplates() {
@@ -4713,13 +5410,21 @@ var Regions = class {
     const data = await this.http.get(
       `/compute/templates/${templateId}`
     );
-    return unwrap32(data);
+    return unwrap35(data);
   }
 };
 
 // src/resources/sandboxes.ts
+function encodeContent(content) {
+  const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
+  const maybeBuffer = globalThis.Buffer;
+  if (maybeBuffer) return maybeBuffer.from(bytes).toString("base64");
+  let bin = "";
+  for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]);
+  return btoa(bin);
+}
 var SANDBOX_TEMPLATE = "miosa-sandbox";
-function unwrap33(payload) {
+function unwrap36(payload) {
   if (payload !== null && typeof payload === "object" && "data" in payload && payload.data !== void 0) {
     return payload.data;
   }
@@ -4735,7 +5440,7 @@ function listItems11(payload) {
 }
 function createBody(params = {}) {
   const templateId = params.templateId ?? params.template_id ?? params.image ?? SANDBOX_TEMPLATE;
-  return stripUndefined16({
+  return stripUndefined19({
     template_id: templateId,
     cpu_count: params.cpuCount ?? params.cpu_count,
     memory_mb: params.memoryMb ?? params.memory_mb,
@@ -4756,20 +5461,21 @@ function createBody(params = {}) {
     region: params.region,
     entrypoint: params.entrypoint,
     tags: params.tags,
+    slug: params.slug,
     external_workspace_id: params.externalWorkspaceId ?? params.external_workspace_id,
     external_user_id: params.externalUserId ?? params.external_user_id,
     external_project_id: params.externalProjectId ?? params.external_project_id
   });
 }
 function execBody(command, options = {}) {
-  return stripUndefined16({
+  return stripUndefined19({
     command,
     cwd: options.cwd ?? options.workingDir ?? options.working_dir,
     env: options.env,
     timeout: options.timeout ?? options.timeoutSec ?? options.timeout_sec
   });
 }
-function stripUndefined16(input) {
+function stripUndefined19(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, value]) => value !== void 0)
   );
@@ -4812,6 +5518,41 @@ var SandboxFiles = class {
   download(path) {
     return this.read(path);
   }
+  /** GET /api/v1/sandboxes/{id}/files/tree — recursive directory tree. */
+  async tree(path = "/workspace", depth = 3) {
+    const http = this.sandbox.http;
+    const response = await http.get(
+      `/sandboxes/${this.sandbox.id}/files/tree`,
+      { path, depth }
+    );
+    if (response && typeof response === "object" && "data" in response) {
+      return response.data;
+    }
+    return response;
+  }
+  /** POST /api/v1/sandboxes/{id}/files/write-many — write multiple files atomically. */
+  async writeMany(files) {
+    const http = this.sandbox.http;
+    const payload = files.map((f) => ({
+      path: f.path,
+      content_base64: encodeContent(f.content)
+    }));
+    const response = await http.post(
+      `/sandboxes/${this.sandbox.id}/files/write-many`,
+      { files: payload }
+    );
+    if (response && typeof response === "object" && "data" in response) {
+      return response.data;
+    }
+    return response;
+  }
+  /** GET /api/v1/sandboxes/{id}/files/watch (SSE) — live file change events. */
+  watch() {
+    const http = this.sandbox.http;
+    return http.stream(
+      `/sandboxes/${this.sandbox.id}/files/watch`
+    );
+  }
 };
 var SandboxPreview = class {
   constructor(sandbox) {
@@ -4870,7 +5611,7 @@ var SandboxTerminal = class {
     const body = Object.fromEntries(
       Object.entries(params).filter(([, v]) => v !== void 0)
     );
-    const response = unwrap33(
+    const response = unwrap36(
       await this.sandbox.http.post(`/sandboxes/${this.sandbox.id}/terminal`, body)
     );
     return response;
@@ -4919,7 +5660,7 @@ var SandboxPreviews = class {
         Object.entries(opts).filter(([, v]) => v !== void 0)
       )
     };
-    return unwrap33(
+    return unwrap36(
       await this.http.post(
         `/sandboxes/${this.sandbox.id}/previews`,
         body
@@ -4927,7 +5668,7 @@ var SandboxPreviews = class {
     );
   }
   async get(previewId) {
-    return unwrap33(
+    return unwrap36(
       await this.http.get(
         `/sandboxes/${this.sandbox.id}/previews/${previewId}`
       )
@@ -4940,7 +5681,7 @@ var SandboxPreviews = class {
   }
   /** Mint a share token for previewId. */
   async share(previewId, opts = {}) {
-    return unwrap33(
+    return unwrap36(
       await this.http.post(
         `/sandboxes/${this.sandbox.id}/previews/${previewId}/share`,
         { ttl_seconds: opts.ttl_seconds ?? opts.expires_in_sec ?? 3600 }
@@ -4959,13 +5700,46 @@ var SandboxEnv = class {
     this.sandbox = sandbox;
   }
   sandbox;
-  /**
-   * Read-only listing of sandbox env vars.
-   * The backend has no per-name CRUD route; use Sandbox.create(env=...) to set values.
-   */
+  get http() {
+    return this.sandbox.http;
+  }
+  /** GET /api/v1/sandboxes/{id}/env → list of env vars. */
+  async get() {
+    const response = await this.http.get(
+      `/sandboxes/${this.sandbox.id}/env`
+    );
+    if (Array.isArray(response)) return response;
+    if (response && typeof response === "object") {
+      const r = response;
+      for (const k of ["data", "vars", "env", "items"]) {
+        if (Array.isArray(r[k])) return r[k];
+      }
+    }
+    return [];
+  }
+  /** @deprecated Use get() */
   async list() {
-    return unwrap33(
-      await this.sandbox.http.get(`/sandboxes/${this.sandbox.id}/env`)
+    return this.get();
+  }
+  /** PUT /api/v1/sandboxes/{id}/env — set (replace) env vars. */
+  async set(vars) {
+    const response = await this.http.put(
+      `/sandboxes/${this.sandbox.id}/env`,
+      { vars }
+    );
+    if (Array.isArray(response)) return response;
+    if (response && typeof response === "object") {
+      const r = response;
+      for (const k of ["data", "vars", "env", "items"]) {
+        if (Array.isArray(r[k])) return r[k];
+      }
+    }
+    return [];
+  }
+  /** DELETE /api/v1/sandboxes/{id}/env/{key} — remove a single env var. */
+  async delete(key) {
+    await this.http.delete(
+      `/sandboxes/${this.sandbox.id}/env/${encodeURIComponent(key)}`
     );
   }
 };
@@ -4976,7 +5750,7 @@ var SandboxTags = class {
   sandbox;
   /** Replace the full tag list with tags. */
   async set(tags) {
-    return unwrap33(
+    return unwrap36(
       await this.sandbox.http.patch(`/sandboxes/${this.sandbox.id}/tags`, { tags })
     );
   }
@@ -5001,6 +5775,10 @@ var Sandbox = class _Sandbox {
     this.previews = new SandboxPreviews(this);
     this.env = new SandboxEnv(this);
     this.tags = new SandboxTags(this);
+    const sandboxId = data.id;
+    this.secrets = new SandboxSecrets(http, sandboxId);
+    this.network = new SandboxNetwork(http, sandboxId);
+    this.audit = new SandboxAudit(http, sandboxId);
   }
   http;
   data;
@@ -5021,6 +5799,12 @@ var Sandbox = class _Sandbox {
   env;
   /** Tag replacement. */
   tags;
+  /** Encrypted secrets + OAuth credentials scoped to this sandbox. */
+  secrets;
+  /** Egress allowlist + policies scoped to this sandbox. */
+  network;
+  /** Egress audit log + live tail scoped to this sandbox. */
+  audit;
   get id() {
     return this.data.id;
   }
@@ -5034,14 +5818,14 @@ var Sandbox = class _Sandbox {
     return this.data.template_id ?? this.data.image_id ?? "";
   }
   async refresh() {
-    this.data = unwrap33(
+    this.data = unwrap36(
       await this.http.get(`/sandboxes/${this.id}`)
     );
     return this;
   }
   async runExec(command, options) {
     this.assertRunning("exec");
-    const response = unwrap33(
+    const response = unwrap36(
       await this.http.post(
         `/sandboxes/${this.id}/exec`,
         execBody(command, options)
@@ -5089,7 +5873,7 @@ var Sandbox = class _Sandbox {
   }
   async listFiles(path = "/workspace") {
     this.assertRunning("files.list");
-    const response = unwrap33(
+    const response = unwrap36(
       await this.http.get(
         `/sandboxes/${this.id}/files`,
         { path }
@@ -5099,7 +5883,7 @@ var Sandbox = class _Sandbox {
   }
   async statFile(path) {
     this.assertRunning("files.stat");
-    return unwrap33(
+    return unwrap36(
       await this.http.post(
         `/sandboxes/${this.id}/files/stat`,
         { path }
@@ -5108,7 +5892,7 @@ var Sandbox = class _Sandbox {
   }
   async expose(port) {
     this.assertRunning("expose");
-    const response = unwrap33(
+    const response = unwrap36(
       await this.http.post(
         `/sandboxes/${this.id}/expose`,
         port === void 0 ? {} : { port }
@@ -5118,7 +5902,7 @@ var Sandbox = class _Sandbox {
   }
   async startTemplate(options = {}) {
     this.assertRunning("startTemplate");
-    return unwrap33(
+    return unwrap36(
       await this.http.post(
         `/sandboxes/${this.id}/template/start`,
         options
@@ -5126,7 +5910,7 @@ var Sandbox = class _Sandbox {
     );
   }
   async getArtifacts() {
-    return unwrap33(
+    return unwrap36(
       await this.http.get(
         `/sandboxes/${this.id}/artifacts`
       )
@@ -5137,7 +5921,7 @@ var Sandbox = class _Sandbox {
       `/sandboxes/${this.id}/logs`,
       { lines }
     );
-    return unwrap33(response);
+    return unwrap36(response);
   }
   streamLogs() {
     return this.http.stream(
@@ -5146,7 +5930,7 @@ var Sandbox = class _Sandbox {
   }
   async createSnapshot(comment) {
     this.assertRunning("snapshots.create");
-    return unwrap33(
+    return unwrap36(
       await this.http.post(
         `/sandboxes/${this.id}/snapshots`,
         comment ? { comment } : {}
@@ -5154,14 +5938,14 @@ var Sandbox = class _Sandbox {
     );
   }
   async listSnapshots() {
-    return unwrap33(
+    return unwrap36(
       await this.http.get(
         `/sandboxes/${this.id}/snapshots`
       )
     );
   }
   async restoreSnapshot(snapshotId) {
-    const data = unwrap33(
+    const data = unwrap36(
       await this.http.post(
         `/sandboxes/${this.id}/restore/${snapshotId}`,
         {}
@@ -5172,8 +5956,55 @@ var Sandbox = class _Sandbox {
   async deleteSnapshot(snapshotId) {
     await this.http.delete(`/sandboxes/${this.id}/snapshots/${snapshotId}`);
   }
+  /**
+   * Fork (clone) this sandbox into a new sandbox via copy-on-write snapshot.
+   * The original sandbox continues running unchanged.
+   */
+  async fork(opts = {}) {
+    this.assertRunning("fork");
+    const body = {};
+    if (opts.name !== void 0) body.name = opts.name;
+    if (opts.metadata !== void 0) body.metadata = opts.metadata;
+    const data = unwrap36(
+      await this.http.post(
+        `/sandboxes/${this.id}/fork`,
+        body
+      )
+    );
+    return new _Sandbox(this.http, data);
+  }
+  /**
+   * PATCH /api/v1/sandboxes/{id} — update mutable sandbox fields.
+   */
+  async update(params) {
+    const body = {};
+    for (const [k, v] of Object.entries(params)) {
+      if (v !== void 0) body[k] = v;
+    }
+    const data = unwrap36(
+      await this.http.patch(
+        `/sandboxes/${this.id}`,
+        body
+      )
+    );
+    this.data = data;
+    return this;
+  }
+  /**
+   * POST /api/v1/sandboxes/{id}/preview-token → {token, url, expires_at, scope}
+   */
+  async previewToken(expiresIn = 3600, scope = "read") {
+    const raw = await this.http.post(
+      `/sandboxes/${this.id}/preview-token`,
+      { expires_in: expiresIn, scope }
+    );
+    if (raw && typeof raw === "object" && "data" in raw) {
+      return raw.data;
+    }
+    return raw;
+  }
   async pause() {
-    const data = unwrap33(
+    const data = unwrap36(
       await this.http.post(
         `/sandboxes/${this.id}/pause`,
         {}
@@ -5183,7 +6014,7 @@ var Sandbox = class _Sandbox {
     return this;
   }
   async resume() {
-    const data = unwrap33(
+    const data = unwrap36(
       await this.http.post(
         `/sandboxes/${this.id}/resume`,
         {}
@@ -5196,7 +6027,7 @@ var Sandbox = class _Sandbox {
     const idempotencyKey11 = params.idempotencyKey ?? params.idempotency_key;
     const requestOptions = {
       method: "POST",
-      body: stripUndefined16({
+      body: stripUndefined19({
         name: params.name,
         deployment_id: params.deploymentId ?? params.deployment_id,
         output_path: params.outputPath ?? params.output_path ?? params.path ?? params.sourcePath ?? params.source_path,
@@ -5209,7 +6040,7 @@ var Sandbox = class _Sandbox {
     if (idempotencyKey11) {
       requestOptions.headers = { "Idempotency-Key": idempotencyKey11 };
     }
-    return unwrap33(
+    return unwrap36(
       await this.http.request(
         `/sandboxes/${this.id}/deploy`,
         requestOptions
@@ -5218,12 +6049,102 @@ var Sandbox = class _Sandbox {
   }
   /** Check readiness of the sandbox (GET /sandboxes/:id/readiness). */
   async readiness() {
-    return unwrap33(
+    return unwrap36(
       await this.http.get(
         `/sandboxes/${this.id}/readiness`
       )
     );
   }
+  /**
+   * Block until the sandbox reports ready, or *timeout* seconds elapse.
+   *
+   * When `stream` is `true` (the default) this opens an SSE connection
+   * to `GET /sandboxes/:id/readiness/stream` and waits for an
+   * `event: ready` frame. The server emits `ready` immediately if the
+   * sandbox is already ready, otherwise as soon as the readiness PubSub
+   * message fires.
+   *
+   * Returns `true` once the sandbox is ready, `false` on `event: timeout`
+   * or when the local timeout elapses before ready.
+   *
+   * If the SSE endpoint returns 404 (server pre-dates the streaming
+   * endpoint) this transparently falls back to polling
+   * {@link readiness} every 10 ms until ready or timeout.
+   */
+  async waitUntilReady(options = {}) {
+    const timeout = options.timeout ?? 30;
+    const stream = options.stream ?? true;
+    if (stream) {
+      const sseResult = await this.tryReadinessStream(timeout);
+      if (sseResult !== null) return sseResult;
+    }
+    const deadlineMs = Date.now() + timeout * 1e3;
+    while (Date.now() < deadlineMs) {
+      try {
+        const data = await this.readiness();
+        if (data.ready === true || data.status === "ready") return true;
+      } catch {
+      }
+      await new Promise((resolve) => setTimeout(resolve, 10));
+    }
+    return false;
+  }
+  /**
+   * Returns `true` / `false` for terminal SSE events, or `null` if the
+   * stream endpoint is unavailable (404 or transport error) so callers
+   * can fall back to polling.
+   */
+  async tryReadinessStream(timeoutSec) {
+    const abort = new AbortController();
+    const timer = setTimeout(() => abort.abort(), (timeoutSec + 5) * 1e3);
+    try {
+      const headers = {
+        Authorization: `Bearer ${this.http.apiKey}`,
+        Accept: "text/event-stream",
+        "User-Agent": "@miosa/sdk/1.0.0"
+      };
+      const response = await fetch(
+        `${this.http.baseUrl}/sandboxes/${this.id}/readiness/stream`,
+        { method: "GET", headers, signal: abort.signal }
+      );
+      if (response.status === 404) return null;
+      if (!response.ok || !response.body) return null;
+      const reader = response.body.getReader();
+      const decoder = new TextDecoder();
+      let buffer = "";
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          buffer += decoder.decode(value, { stream: true });
+          let newlineIdx;
+          while ((newlineIdx = buffer.indexOf("\n")) !== -1) {
+            const line = buffer.slice(0, newlineIdx).replace(/\r$/, "");
+            buffer = buffer.slice(newlineIdx + 1);
+            if (line.startsWith("event:")) {
+              const evt = line.slice(6).trim();
+              if (evt === "ready") return true;
+              if (evt === "timeout") return false;
+            }
+          }
+        }
+      } finally {
+        try {
+          reader.releaseLock();
+        } catch {
+        }
+      }
+      return null;
+    } catch {
+      return null;
+    } finally {
+      clearTimeout(timer);
+      try {
+        abort.abort();
+      } catch {
+      }
+    }
+  }
   async destroy() {
     if (this.data.state === "destroyed") return;
     await this.http.delete(`/sandboxes/${this.id}`);
@@ -5267,7 +6188,7 @@ var Sandboxes = class {
     if (idempotencyKey11) {
       requestOptions.headers = { "Idempotency-Key": idempotencyKey11 };
     }
-    const data = unwrap33(
+    const data = unwrap36(
       await this.http.request(
         "/sandboxes",
         requestOptions
@@ -5286,7 +6207,7 @@ var Sandboxes = class {
     return listItems11(data).map((item) => new Sandbox(this.http, item));
   }
   async get(id) {
-    const data = unwrap33(
+    const data = unwrap36(
       await this.http.get(`/sandboxes/${id}`)
     );
     return new Sandbox(this.http, data);
@@ -5321,7 +6242,7 @@ var Sandboxes = class {
   async createTemplate(params) {
     const response = await this.http.post(
       "/sandbox-templates",
-      stripUndefined16({
+      stripUndefined19({
         name: params.name,
         slug: params.slug,
         description: params.description,
@@ -5329,29 +6250,29 @@ var Sandboxes = class {
         metadata: params.metadata
       })
     );
-    return unwrap33(response);
+    return unwrap36(response);
   }
   async createTemplateBuild(templateId, params = {}) {
     const response = await this.http.post(
       `/sandbox-templates/${templateId}/builds`,
-      stripUndefined16({
+      stripUndefined19({
         build_spec: params.buildSpec ?? params.build_spec,
         metadata: params.metadata
       })
     );
-    return unwrap33(response);
+    return unwrap36(response);
   }
   async listTemplateBuilds(templateId) {
     const response = await this.http.get(
       `/sandbox-templates/${templateId}/builds`
     );
-    return unwrap33(response);
+    return unwrap36(response);
   }
   async getTemplateBuild(buildId) {
     const response = await this.http.get(
       `/sandbox-template-builds/${buildId}`
     );
-    return unwrap33(response);
+    return unwrap36(response);
   }
 };
 function toBase642(bytes) {
@@ -5363,7 +6284,7 @@ function toBase642(bytes) {
   }
   return btoa(binary);
 }
-function unwrap34(payload) {
+function unwrap37(payload) {
   if (payload && typeof payload === "object" && "data" in payload) {
     return payload.data;
   }
@@ -5379,7 +6300,7 @@ function listItems12(payload, candidateKeys = ["data", "templates", "builds", "i
   }
   return [];
 }
-function stripUndefined17(input) {
+function stripUndefined20(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -5406,7 +6327,7 @@ var SandboxTemplates = class {
     const data = await this.http.get(
       `/sandbox-templates/${templateId}`
     );
-    return unwrap34(data);
+    return unwrap37(data);
   }
   async create(params) {
     const {
@@ -5416,7 +6337,7 @@ var SandboxTemplates = class {
       name,
       ...rest
     } = params;
-    const body = stripUndefined17({
+    const body = stripUndefined20({
       name,
       build_spec: buildSpec ?? build_spec,
       ...rest
@@ -5426,7 +6347,7 @@ var SandboxTemplates = class {
       body,
       headers: { "Idempotency-Key": idempotencyKey8(ikey) }
     });
-    return unwrap34(data);
+    return unwrap37(data);
   }
   async buildSpecSchema() {
     const data = await this.http.get("/sandbox-templates/build-spec");
@@ -5450,7 +6371,7 @@ var SandboxTemplates = class {
   }
   async createBuild(templateId, params = {}) {
     const { idempotencyKey: ikey, ...rest } = params;
-    const body = stripUndefined17(rest);
+    const body = stripUndefined20(rest);
     const data = await this.http.request(
       `/sandbox-templates/${templateId}/builds`,
       {
@@ -5459,12 +6380,12 @@ var SandboxTemplates = class {
         headers: { "Idempotency-Key": idempotencyKey8(ikey) }
       }
     );
-    return unwrap34(data);
+    return unwrap37(data);
   }
 };
 
 // src/resources/settings.ts
-function unwrap35(payload) {
+function unwrap38(payload) {
   if (payload && typeof payload === "object") {
     const p = payload;
     for (const k of [
@@ -5480,11 +6401,11 @@ function unwrap35(payload) {
   return payload;
 }
 function listItems13(payload) {
-  const result = unwrap35(payload);
+  const result = unwrap38(payload);
   if (Array.isArray(result)) return result;
   return [];
 }
-function stripUndefined18(input) {
+function stripUndefined21(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -5497,46 +6418,46 @@ var Settings = class {
   /** Get the current tenant settings. */
   async get() {
     const data = await this.http.get("/settings");
-    return unwrap35(data);
+    return unwrap38(data);
   }
   /** Update tenant settings. */
   async update(params) {
-    const body = stripUndefined18(params);
+    const body = stripUndefined21(params);
     const data = await this.http.put("/settings", body);
-    return unwrap35(data);
+    return unwrap38(data);
   }
   // ── Branding ──────────────────────────────────────────────────────────────
   /** Get tenant branding (logo, colors, custom wordmark). */
   async getBranding() {
     const data = await this.http.get("/settings/branding");
-    return unwrap35(data);
+    return unwrap38(data);
   }
   /** Update tenant branding. */
   async updateBranding(params) {
-    const body = stripUndefined18(params);
+    const body = stripUndefined21(params);
     const data = await this.http.put("/settings/branding", body);
-    return unwrap35(data);
+    return unwrap38(data);
   }
   // ── Read-only reference data ───────────────────────────────────────────────
   /** Get tenant-scoped compute pricing. */
   async computePricing() {
     const data = await this.http.get("/settings/compute-pricing");
-    return unwrap35(data);
+    return unwrap38(data);
   }
   /** Get tenant-scoped GPU pricing. */
   async gpuPricing() {
     const data = await this.http.get("/settings/gpu-pricing");
-    return unwrap35(data);
+    return unwrap38(data);
   }
   /** List models available to this tenant. */
   async availableModels() {
     const data = await this.http.get("/settings/available-models");
-    return unwrap35(data);
+    return unwrap38(data);
   }
   /** List regions enabled for this tenant. */
   async regions() {
     const data = await this.http.get("/settings/regions");
-    return unwrap35(data);
+    return unwrap38(data);
   }
   // ── BYOK provider keys ────────────────────────────────────────────────────
   /** List tenant-level BYOK provider keys (Anthropic, OpenAI, etc.). */
@@ -5546,12 +6467,12 @@ var Settings = class {
   }
   /** Create or update a BYOK provider key. */
   async upsertProviderKey(provider, params) {
-    const body = stripUndefined18(params);
+    const body = stripUndefined21(params);
     const data = await this.http.put(
       `/settings/provider-keys/${provider}`,
       body
     );
-    return unwrap35(data);
+    return unwrap38(data);
   }
   /** Delete a BYOK provider key. */
   async deleteProviderKey(provider) {
@@ -5560,7 +6481,7 @@ var Settings = class {
 };
 
 // src/resources/snapshots-standalone.ts
-function unwrap36(data) {
+function unwrap39(data) {
   if (data && typeof data === "object") {
     const d = data;
     for (const k of ["data", "snapshots", "items"]) {
@@ -5569,7 +6490,7 @@ function unwrap36(data) {
   }
   return data;
 }
-function unwrapList9(data) {
+function unwrapList12(data) {
   if (Array.isArray(data)) return data;
   if (data && typeof data === "object") {
     const d = data;
@@ -5588,17 +6509,17 @@ var SnapshotsStandalone = class {
     const query = Object.fromEntries(
       Object.entries(filters).filter(([, v]) => v !== void 0)
     );
-    return unwrapList9(await this.http.get("/admin/snapshots", query));
+    return unwrapList12(await this.http.get("/admin/snapshots", query));
   }
   async get(snapshotId) {
-    return unwrap36(
+    return unwrap39(
       await this.http.get(`/admin/snapshots/${snapshotId}`)
     );
   }
 };
 
 // src/resources/storage.ts
-function unwrap37(payload) {
+function unwrap40(payload) {
   if (payload && typeof payload === "object" && "data" in payload) {
     return payload.data;
   }
@@ -5614,7 +6535,7 @@ function listItems14(payload, candidateKeys = ["data", "buckets", "objects", "it
   }
   return [];
 }
-function stripUndefined19(input) {
+function stripUndefined22(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -5631,24 +6552,24 @@ var Storage = class {
   }
   async createBucket(params) {
     const { name, public: isPublic, visibility, ...rest } = params;
-    const body = stripUndefined19({
+    const body = stripUndefined22({
       name,
       visibility: visibility ?? (isPublic === void 0 ? void 0 : isPublic ? "public" : "private"),
       ...rest
     });
     const data = await this.http.post("/storage/buckets", body);
-    return unwrap37(data);
+    return unwrap40(data);
   }
   async getBucket(bucketId) {
     const data = await this.http.get(`/storage/buckets/${bucketId}`);
-    return unwrap37(data);
+    return unwrap40(data);
   }
   async deleteBucket(bucketId) {
     await this.http.delete(`/storage/buckets/${bucketId}`);
   }
   // ── Objects ────────────────────────────────────────────────────────────────
   async listObjects(bucketId, params = {}) {
-    const query = stripUndefined19({
+    const query = stripUndefined22({
       prefix: params.prefix,
       max_keys: params.max_keys ?? params.maxKeys ?? params.limit,
       marker: params.marker ?? params.cursor
@@ -5679,46 +6600,179 @@ var Storage = class {
       `/storage/buckets/${bucketId}/objects/${key}`
     );
   }
-  // ── Presigned URLs ─────────────────────────────────────────────────────────
-  async presign(bucketId, params) {
-    const operationMethod = params.operation === "put" ? "PUT" : params.operation === "get" ? "GET" : void 0;
-    const body = stripUndefined19({
-      key: params.key,
-      method: params.method ?? operationMethod ?? "GET",
-      expires_in: params.expiresIn ?? params.expires_in ?? params.expiresInSec ?? params.expires_in_sec ?? 3600
-    });
-    const data = await this.http.post(
-      `/storage/buckets/${bucketId}/presign`,
-      body
+  // ── Presigned URLs ─────────────────────────────────────────────────────────
+  async presign(bucketId, params) {
+    const operationMethod = params.operation === "put" ? "PUT" : params.operation === "get" ? "GET" : void 0;
+    const body = stripUndefined22({
+      key: params.key,
+      method: params.method ?? operationMethod ?? "GET",
+      expires_in: params.expiresIn ?? params.expires_in ?? params.expiresInSec ?? params.expires_in_sec ?? 3600
+    });
+    const data = await this.http.post(
+      `/storage/buckets/${bucketId}/presign`,
+      body
+    );
+    return unwrap40(data);
+  }
+};
+
+// src/resources/org-invites.ts
+var OrgInvites = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /**
+   * Create an org invite and dispatch the invite email.
+   *
+   * The invite URL in the response is host-aware: on white-label tenants it
+   * uses the custom domain so the recipient lands on the branded experience.
+   * Requires `admin` or `owner` role in the tenant.
+   *
+   * `POST /tenants/:id/invites`
+   */
+  async create(tenantId, params) {
+    const res = await this.http.post(
+      `/tenants/${tenantId}/invites`,
+      params
+    );
+    return res.data;
+  }
+  /**
+   * List all pending (non-expired, non-accepted, non-revoked) org invites.
+   *
+   * Requires `admin` or `owner` role.
+   *
+   * `GET /tenants/:id/invites`
+   */
+  async list(tenantId) {
+    const res = await this.http.get(
+      `/tenants/${tenantId}/invites`
+    );
+    return res.data ?? [];
+  }
+  /**
+   * Revoke a pending org invite.
+   *
+   * Returns `409` when the invite was already legitimately accepted.
+   * Requires `admin` or `owner` role.
+   *
+   * `DELETE /tenants/:id/invites/:invite_id`
+   */
+  async revoke(tenantId, inviteId) {
+    return this.http.delete(
+      `/tenants/${tenantId}/invites/${inviteId}`
+    );
+  }
+  /**
+   * Preview an org invite by token (no auth required).
+   *
+   * Returns `null` when the token is unknown or has been revoked.
+   *
+   * `GET /invites/:token`
+   */
+  async preview(token) {
+    try {
+      const res = await this.http.get(
+        `/invites/${token}`
+      );
+      return res.data ?? null;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Accept an org invite on behalf of the authenticated user.
+   *
+   * The caller's JWT email must match the invite email (case-insensitive).
+   * On success inserts a `tenant_members` row.
+   *
+   * Error responses:
+   * - `400` — invalid or expired token.
+   * - `422 EMAIL_MISMATCH` — JWT email does not match the invite email.
+   *
+   * `POST /invites/:token/accept`
+   */
+  async accept(token) {
+    return this.http.post(
+      `/invites/${token}/accept`,
+      {}
     );
-    return unwrap37(data);
   }
 };
 
 // src/resources/tenant.ts
-function unwrap38(payload) {
+function unwrap41(payload) {
   if (payload && typeof payload === "object") {
     const p = payload;
-    for (const k of ["data", "tenant", "items"]) {
+    for (const k of ["data", "tenant", "branding", "preview_domain", "items"]) {
       if (k in p) return p[k];
     }
   }
   return payload;
 }
+var PreviewDomain = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** GET /api/v1/tenant/preview-domain → {domain, verified_at, cname_target} */
+  async get() {
+    return unwrap41(await this.http.get("/tenant/preview-domain"));
+  }
+  /** PUT /api/v1/tenant/preview-domain — set the preview domain. */
+  async set(domain) {
+    return unwrap41(
+      await this.http.put("/tenant/preview-domain", { domain })
+    );
+  }
+  /** POST /api/v1/tenant/preview-domain/verify → {verified, target, records} */
+  async verify() {
+    return unwrap41(
+      await this.http.post("/tenant/preview-domain/verify", {})
+    );
+  }
+  /** DELETE /api/v1/tenant/preview-domain */
+  async delete() {
+    await this.http.delete("/tenant/preview-domain");
+  }
+};
+var Branding = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** GET /api/v1/tenant/branding */
+  async get() {
+    return unwrap41(await this.http.get("/tenant/branding"));
+  }
+  /** PUT /api/v1/tenant/branding — keys: product_name, logo_url, support_url, support_email, primary_color, background_color */
+  async set(branding) {
+    return unwrap41(await this.http.put("/tenant/branding", branding));
+  }
+  /** DELETE /api/v1/tenant/branding */
+  async delete() {
+    await this.http.delete("/tenant/branding");
+  }
+};
 var Tenant = class {
   constructor(http) {
     this.http = http;
+    this.preview_domain = new PreviewDomain(http);
+    this.branding = new Branding(http);
   }
   http;
+  preview_domain;
+  branding;
   /** Get the current tenant's plan, limits, and live usage counters. */
   async current() {
     const data = await this.http.get("/tenant/plan");
-    return unwrap38(data);
+    return unwrap41(data);
   }
 };
 
 // src/resources/usage.ts
-function unwrap39(payload) {
+function unwrap42(payload) {
   if (payload && typeof payload === "object") {
     const p = payload;
     for (const k of ["data", "usage", "sessions", "summary", "items"]) {
@@ -5727,7 +6781,7 @@ function unwrap39(payload) {
   }
   return payload;
 }
-function stripUndefined20(input) {
+function stripUndefined23(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -5740,24 +6794,24 @@ var Usage = class {
   /** Get the current period usage summary. */
   async current() {
     const data = await this.http.get("/usage/summary");
-    return unwrap39(data);
+    return unwrap42(data);
   }
   /** List per-session metering events. */
   async sessions(params = {}) {
-    const query = stripUndefined20(params);
+    const query = stripUndefined23(params);
     const data = await this.http.get("/usage/sessions", query);
-    const result = unwrap39(data);
+    const result = unwrap42(data);
     if (Array.isArray(result)) return result;
     return [];
   }
   /** Get a usage report for a period. */
   async report(params = {}) {
-    const query = stripUndefined20(params);
+    const query = stripUndefined23(params);
     const data = await this.http.get("/usage/summary", query);
-    return unwrap39(data);
+    return unwrap42(data);
   }
 };
-function unwrap40(payload) {
+function unwrap43(payload) {
   if (payload && typeof payload === "object" && "data" in payload) {
     return payload.data;
   }
@@ -5773,7 +6827,7 @@ function listItems15(payload, candidateKeys = ["data", "volumes", "items"]) {
   }
   return [];
 }
-function stripUndefined21(input) {
+function stripUndefined24(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -5787,17 +6841,17 @@ var Volumes = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined21({ ...params });
+    const query = stripUndefined24({ ...params });
     const data = await this.http.get("/volumes", query);
     return listItems15(data);
   }
   async get(volumeId) {
     const data = await this.http.get(`/volumes/${volumeId}`);
-    return unwrap40(data);
+    return unwrap43(data);
   }
   async create(params) {
     const { idempotencyKey: ikey, sizeGb, ...rest } = params;
-    const body = stripUndefined21({
+    const body = stripUndefined24({
       ...rest,
       size_gb: sizeGb ?? rest.size_gb
     });
@@ -5806,13 +6860,36 @@ var Volumes = class {
       body,
       headers: { "Idempotency-Key": idempotencyKey9(ikey) }
     });
-    return unwrap40(data);
+    return unwrap43(data);
   }
   async delete(volumeId) {
     await this.http.delete(`/volumes/${volumeId}`);
   }
 };
-function unwrap41(payload) {
+var MAX_TIMESTAMP_AGE_MS = 5 * 60 * 1e3;
+function verifySignature(payload, signatureHeader, secret) {
+  const parts = {};
+  for (const part of signatureHeader.split(",")) {
+    const idx = part.indexOf("=");
+    if (idx > 0) parts[part.slice(0, idx).trim()] = part.slice(idx + 1).trim();
+  }
+  const tsStr = parts["t"];
+  const sig = parts["v1"];
+  if (!tsStr || !sig) return false;
+  const ts = parseInt(tsStr, 10);
+  if (isNaN(ts)) return false;
+  if (Date.now() - ts * 1e3 > MAX_TIMESTAMP_AGE_MS) {
+    throw new Error(`Webhook timestamp is too old: ${ts}`);
+  }
+  const body = payload instanceof Uint8Array ? payload : Buffer.from(payload, "utf-8");
+  const signed = Buffer.concat([Buffer.from(`${tsStr}.`, "utf-8"), body]);
+  const expected = createHmac("sha256", secret).update(signed).digest("hex");
+  return timingSafeEqual(
+    Buffer.from(expected, "utf-8"),
+    Buffer.from(sig, "utf-8")
+  );
+}
+function unwrap44(payload) {
   if (payload && typeof payload === "object" && "data" in payload) {
     return payload.data;
   }
@@ -5828,7 +6905,7 @@ function listItems16(payload, candidateKeys = ["data", "webhooks", "deliveries",
   }
   return [];
 }
-function stripUndefined22(input) {
+function stripUndefined25(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -5842,28 +6919,28 @@ var Webhooks = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined22({ ...params });
+    const query = stripUndefined25({ ...params });
     const data = await this.http.get("/webhooks", query);
     return listItems16(data);
   }
   async get(webhookId) {
     const data = await this.http.get(`/webhooks/${webhookId}`);
-    return unwrap41(data);
+    return unwrap44(data);
   }
   async create(params) {
     const { idempotencyKey: ikey, ...rest } = params;
-    const body = stripUndefined22(rest);
+    const body = stripUndefined25(rest);
     const data = await this.http.request("/webhooks", {
       method: "POST",
       body,
       headers: { "Idempotency-Key": idempotencyKey10(ikey) }
     });
-    return unwrap41(data);
+    return unwrap44(data);
   }
   async update(webhookId, params) {
-    const body = stripUndefined22(params);
+    const body = stripUndefined25(params);
     const data = await this.http.patch(`/webhooks/${webhookId}`, body);
-    return unwrap41(data);
+    return unwrap44(data);
   }
   async delete(webhookId) {
     await this.http.delete(`/webhooks/${webhookId}`);
@@ -5876,7 +6953,7 @@ var Webhooks = class {
         headers: { "Idempotency-Key": idempotencyKey10(opts.idempotencyKey) }
       }
     );
-    return unwrap41(data);
+    return unwrap44(data);
   }
   async deliveries(webhookId) {
     const data = await this.http.get(
@@ -5888,6 +6965,347 @@ var Webhooks = class {
       "items"
     ]);
   }
+  /**
+   * Verify an incoming ``X-Miosa-Signature`` header.
+   *
+   * Header format: ``t=<unix_ts>,v1=<hex_hmac>``
+   * HMAC body:     ``<t>.<raw_payload>``
+   *
+   * Throws if timestamp is older than 5 minutes.
+   * Returns true if signature matches.
+   */
+  static verifySignature(payload, signatureHeader, secret) {
+    return verifySignature(payload, signatureHeader, secret);
+  }
+};
+
+// src/resources/workspace-invites.ts
+var WorkspaceInvites = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /**
+   * Create a workspace invite or add a member directly.
+   *
+   * If `email` already maps to a tenant member the user is added directly and
+   * `type === "added"` is returned with a `WorkspaceMemberRecord`. Otherwise
+   * an invite row is created and `type === "invited"` is returned.
+   *
+   * `POST /workspaces/:id/invites`
+   */
+  async create(workspaceId, params) {
+    return this.http.post(
+      `/workspaces/${workspaceId}/invites`,
+      params
+    );
+  }
+  /**
+   * List all pending (non-expired, non-accepted, non-revoked) workspace invites.
+   *
+   * `GET /workspaces/:id/invites`
+   */
+  async list(workspaceId) {
+    const res = await this.http.get(
+      `/workspaces/${workspaceId}/invites`
+    );
+    return res.data ?? [];
+  }
+  /**
+   * Revoke a pending workspace invite.
+   *
+   * Already-revoked invites are idempotent (returns `revoked: true`). An invite
+   * that was legitimately accepted throws `409 ALREADY_ACCEPTED`.
+   *
+   * `DELETE /workspaces/:id/invites/:invite_id`
+   */
+  async revoke(workspaceId, inviteId) {
+    return this.http.delete(
+      `/workspaces/${workspaceId}/invites/${inviteId}`
+    );
+  }
+  /**
+   * Preview a workspace invite by token (no auth required).
+   *
+   * Use this to render the invite landing page before prompting the user to
+   * log in or sign up. Returns `null` when the token is unknown or revoked.
+   *
+   * `GET /workspace-invites/:token`
+   */
+  async preview(token) {
+    try {
+      const res = await this.http.get(
+        `/workspace-invites/${token}`
+      );
+      return res.data ?? null;
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * Accept a workspace invite on behalf of the authenticated user.
+   *
+   * The caller's JWT email must match the invite email (case-insensitive).
+   *
+   * Error codes:
+   * - `INVALID_TOKEN` (404) — token not found.
+   * - `EXPIRED` (410) — invite TTL elapsed.
+   * - `REVOKED` (409) — invite was revoked.
+   * - `ALREADY_ACCEPTED` (409) — already used.
+   * - `EMAIL_MISMATCH` (422) — JWT email differs from invite email.
+   *
+   * `POST /workspace-invites/:token/accept`
+   */
+  async accept(token) {
+    return this.http.post(
+      `/workspace-invites/${token}/accept`,
+      {}
+    );
+  }
+};
+
+// src/resources/workspace-members.ts
+var WorkspaceMembers = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /**
+   * List all members of a workspace.
+   *
+   * `GET /workspaces/:id/members`
+   */
+  async list(workspaceId) {
+    const res = await this.http.get(
+      `/workspaces/${workspaceId}/members`
+    );
+    return res.data ?? res;
+  }
+  /**
+   * Add an existing tenant user to a workspace.
+   *
+   * The `user_id` must already hold a `tenant_members` row for the parent org.
+   * Use {@link WorkspaceInvites.create} to invite someone who is not yet an org
+   * member.
+   *
+   * `POST /workspaces/:id/members`
+   *
+   * @throws `MiosaError` with code `NOT_TENANT_MEMBER` if the user is not an
+   *   org member.
+   */
+  async add(workspaceId, params) {
+    const res = await this.http.post(
+      `/workspaces/${workspaceId}/members`,
+      params
+    );
+    return res.data ?? res;
+  }
+  /**
+   * Change a workspace member's role.
+   *
+   * `PATCH /workspaces/:id/members/:user_id`
+   */
+  async updateRole(workspaceId, userId, params) {
+    const res = await this.http.patch(
+      `/workspaces/${workspaceId}/members/${userId}`,
+      params
+    );
+    return res.data ?? res;
+  }
+  /**
+   * Remove a user from a workspace.
+   *
+   * The last `owner` of a workspace cannot be removed. Promote another member
+   * to `owner` first using {@link updateRole}.
+   *
+   * `DELETE /workspaces/:id/members/:user_id`
+   *
+   * @throws `MiosaError` with code `LAST_OWNER` if the target is the sole owner.
+   */
+  async remove(workspaceId, userId) {
+    return this.http.delete(
+      `/workspaces/${workspaceId}/members/${userId}`
+    );
+  }
+};
+
+// src/resources/workspaces.ts
+function unwrap45(payload) {
+  if (payload && typeof payload === "object" && "data" in payload) {
+    return payload.data;
+  }
+  return payload;
+}
+function listItems17(payload, candidateKeys = ["data", "items"]) {
+  if (Array.isArray(payload)) return payload;
+  if (!payload || typeof payload !== "object") return [];
+  const p = payload;
+  if (Array.isArray(p.data)) return p.data;
+  for (const key of candidateKeys) {
+    if (Array.isArray(p[key])) return p[key];
+  }
+  return [];
+}
+var Workspaces = class {
+  http;
+  constructor(http) {
+    this.http = http;
+  }
+  /**
+   * Create a new workspace.
+   */
+  async create(params) {
+    const payload = await this.http.post("/workspaces", params);
+    return unwrap45(payload);
+  }
+  /**
+   * List all workspaces visible to the current credential.
+   */
+  async list() {
+    const payload = await this.http.get("/workspaces");
+    if (payload && typeof payload === "object" && "workspaces" in payload) {
+      const p = payload;
+      return p["workspaces"] ?? [];
+    }
+    return listItems17(payload, ["data", "workspaces", "items"]);
+  }
+  /**
+   * Get a single workspace by ID.
+   */
+  async get(id) {
+    const payload = await this.http.get(`/workspaces/${id}`);
+    return unwrap45(payload);
+  }
+  /**
+   * Update a workspace's metadata.
+   */
+  async update(id, params) {
+    const payload = await this.http.patch(`/workspaces/${id}`, params);
+    return unwrap45(payload);
+  }
+  /**
+   * Delete a workspace. Does not delete member computers.
+   */
+  async delete(id) {
+    await this.http.delete(`/workspaces/${id}`);
+  }
+  /**
+   * Update workspace-level settings.
+   */
+  async updateSettings(id, settings) {
+    const payload = await this.http.put(
+      `/workspaces/${id}/settings`,
+      settings
+    );
+    return unwrap45(payload);
+  }
+  /**
+   * List all computers that belong to the given workspace.
+   */
+  async listComputers(id) {
+    const payload = await this.http.get(`/workspaces/${id}/computers`);
+    const items = listItems17(payload, [
+      "data",
+      "computers",
+      "items"
+    ]);
+    return items.map((d) => new Computer(this.http, d));
+  }
+  /**
+   * List all sandboxes that belong to this workspace.
+   */
+  async listSandboxes(id) {
+    const payload = await this.http.get(`/workspaces/${id}/sandboxes`);
+    return listItems17(payload, [
+      "data",
+      "sandboxes",
+      "items"
+    ]);
+  }
+  /**
+   * List all deployments that belong to this workspace.
+   */
+  async listDeployments(id) {
+    const payload = await this.http.get(
+      `/workspaces/${id}/deployments`
+    );
+    return listItems17(payload, [
+      "data",
+      "deployments",
+      "items"
+    ]);
+  }
+  /**
+   * List all managed databases that belong to this workspace.
+   */
+  async listDatabases(id) {
+    const payload = await this.http.get(`/workspaces/${id}/databases`);
+    return listItems17(payload, [
+      "data",
+      "databases",
+      "items"
+    ]);
+  }
+  /**
+   * List all projects that belong to this workspace.
+   */
+  async listProjects(id) {
+    const payload = await this.http.get(`/workspaces/${id}/projects`);
+    return listItems17(payload, [
+      "data",
+      "projects",
+      "items"
+    ]);
+  }
+  /**
+   * Return aggregate resource stats for this workspace.
+   */
+  async stats(id) {
+    const payload = await this.http.get(`/workspaces/${id}/stats`);
+    return unwrap45(payload);
+  }
+  /**
+   * Return metered usage data for this workspace.
+   */
+  async usage(id) {
+    const payload = await this.http.get(`/workspaces/${id}/usage`);
+    return unwrap45(payload);
+  }
+  /**
+   * Return activity feed for this workspace.
+   */
+  async activity(id) {
+    const payload = await this.http.get(`/workspaces/${id}/activity`);
+    return listItems17(payload, [
+      "data",
+      "activity",
+      "events",
+      "items"
+    ]);
+  }
+  /**
+   * List computer templates available in this workspace.
+   */
+  async listComputerTemplates(id) {
+    const payload = await this.http.get(
+      `/workspaces/${id}/computer-templates`
+    );
+    return listItems17(payload, [
+      "data",
+      "templates",
+      "items"
+    ]);
+  }
+  /**
+   * Create a computer template scoped to this workspace.
+   */
+  async createComputerTemplate(id, params) {
+    const payload = await this.http.post(
+      `/workspaces/${id}/computer-templates`,
+      params
+    );
+    return unwrap45(payload);
+  }
 };
 
 // src/client.ts
@@ -5895,6 +7313,20 @@ var DEFAULT_BASE_URL = "https://api.miosa.ai/api/v1";
 var DEFAULT_TIMEOUT2 = 3e4;
 var DEFAULT_MAX_RETRIES2 = 3;
 var Miosa = class {
+  /** Workspace CRUD — create, list, get, update, delete, and sub-resource queries. */
+  workspaces;
+  /** Per-workspace user roster — list, add, update role, remove. */
+  workspaceMembers;
+  /**
+   * Workspace invite flow — create invite, list, revoke, preview, accept.
+   * Sending to an email already in the org adds the user directly.
+   */
+  workspaceInvites;
+  /**
+   * Org invite flow — create invite, list, revoke, preview, accept.
+   * Requires admin/owner role for write operations.
+   */
+  orgInvites;
   /** Current tenant plan, limits, and live usage counters. */
   tenant;
   /** Datacenter regions, compute sizes, pricing, community templates. */
@@ -5980,6 +7412,13 @@ var Miosa = class {
   builderSessions;
   /** Admin: fleet-wide snapshot index. */
   snapshotsStandalone;
+  // ── Egress (security) namespaces ───────────────────────────────────────────
+  /** Encrypted secret + OAuth credential vault (`/egress/secrets`). */
+  secrets;
+  /** Egress allowlist + policies — host-level firewall (`/egress/policies`). */
+  network;
+  /** Egress audit log — every outbound request, paginated query + tail. */
+  audit;
   http;
   constructor(config) {
     if (!config.apiKey) {
@@ -5998,6 +7437,10 @@ var Miosa = class {
       timeout: config.timeout ?? DEFAULT_TIMEOUT2,
       maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES2
     });
+    this.workspaces = new Workspaces(this.http);
+    this.workspaceMembers = new WorkspaceMembers(this.http);
+    this.workspaceInvites = new WorkspaceInvites(this.http);
+    this.orgInvites = new OrgInvites(this.http);
     this.tenant = new Tenant(this.http);
     this.regions = new Regions(this.http);
     this.settings = new Settings(this.http);
@@ -6037,9 +7480,12 @@ var Miosa = class {
     this.email = new Email(this.http);
     this.builderSessions = new BuilderSessions(this.http);
     this.snapshotsStandalone = new SnapshotsStandalone(this.http);
+    this.secrets = new EgressSecrets(this.http);
+    this.network = new EgressNetwork(this.http);
+    this.audit = new EgressAudit(this.http);
   }
 };
 
-export { Admin, Analytics, ApiKeys, AuditLog, AuthError, Benchmarks, BuilderSessions, Channels, Checkpoints, CommandCenter, Community, Completions, Computer, ComputerAutoStop, ComputerEnv, ComputerInbox, ComputerLogs, ComputerOsa, ComputerPorts, ComputerTerminal, ComputerVolumes, Computers, Credits, CronJobs, Dashboard, Databases, DeploymentDomains, DeploymentReleases, DeploymentRuntimeInstances, DeploymentVersions, Deployments, Desktop, Email, EmailCampaigns, EmailInbox, EmailTemplates, Embeddings, Exec, ExternalKeys, Files, FlatCustomDomains, Functions, HealthChecks, InsufficientCreditsError, Integrations, Mcp, Miosa, MiosaError, Models, NetworkError, NetworkPolicy, NotFoundError, OpenComputers, ProjectAuth, ProjectIntegrations, ProviderDefaults, RateLimitError, Regions, SANDBOX_TEMPLATE, Sandbox, SandboxArtifacts, SandboxCommands, SandboxEnv, SandboxEvents, SandboxFiles, SandboxPreview, SandboxPreviews, SandboxTags, SandboxTemplates, SandboxTerminal, Sandboxes, ScopedFs, Settings, SnapshotsStandalone, Storage, Tenant, TimeoutError, Usage, ValidationError, Volumes, Webhooks };
+export { Admin, Analytics, ApiKeys, AuditLog, AuthError, Benchmarks, BuilderSessions, Channels, Checkpoints, CommandCenter, Community, Completions, Computer, ComputerAudit, ComputerAutoStop, ComputerEnv, ComputerInbox, ComputerLogs, ComputerNetwork, ComputerOsa, ComputerPorts, ComputerSecrets, ComputerTerminal, ComputerVolumes, Computers, Credits, CronJobs, Dashboard, Databases, DeploymentDomains, DeploymentReleases, DeploymentRuntimeInstances, DeploymentVersions, Deployments, Desktop, EgressAudit, EgressNetwork, EgressSecrets, Email, EmailCampaigns, EmailInbox, EmailTemplates, Embeddings, Exec, ExternalKeys, Files, FlatCustomDomains, Functions, HealthChecks, InsufficientCreditsError, Integrations, Mcp, Miosa, MiosaError, Models, NetworkError, NetworkPolicy, NotFoundError, OAuthFlow, OpenComputers, OrgInvites, ProjectAuth, ProjectIntegrations, ProviderDefaults, RateLimitError, Regions, SANDBOX_TEMPLATE, Sandbox, SandboxArtifacts, SandboxAudit, SandboxCommands, SandboxEnv, SandboxEvents, SandboxFiles, SandboxNetwork, SandboxPreview, SandboxPreviews, SandboxSecrets, SandboxTags, SandboxTemplates, SandboxTerminal, Sandboxes, ScopedFs, Settings, SnapshotsStandalone, Storage, Tenant, TimeoutError, Usage, ValidationError, Volumes, Webhooks, WorkspaceInvites, WorkspaceMembers, Workspaces };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map