@miosa/sdk 1.2.3 → 1.2.5

package/dist/index.js

@@ -592,13 +592,6 @@ var Admin = class {
       model_id: modelId
     });
   }
-  /** POST /api/v1/admin/impersonate — returns {token, expires_at}. */
-  impersonate(externalUserId, options = {}) {
-    return this.http.post("/admin/impersonate", {
-      external_user_id: externalUserId,
-      ttl_sec: options.ttlSec ?? 3600
-    });
-  }
 };
 
 // src/resources/analytics.ts
@@ -681,17 +674,6 @@ var ApiKeys = class {
     });
     return unwrap2(data);
   }
-  /** POST /api/v1/api-keys/scoped — L2 delegation token bound to one external user. */
-  async createScoped(params) {
-    const body = stripUndefined2({
-      external_user_id: params.externalUserId,
-      scopes: params.scopes,
-      expires_at: params.expiresAt
-    });
-    return unwrap2(
-      await this.http.post("/api-keys/scoped", body)
-    );
-  }
   async delete(keyId) {
     await this.http.delete(`/api-keys/${keyId}`);
   }
@@ -3639,32 +3621,42 @@ function stripUndefined10(input) {
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
 }
-function dockerDeployMetadata(metadata) {
-  return {
+function dockerDeployMetadata(metadata, templateId) {
+  return stripUndefined10({
     ...metadata ?? {},
-    deployment_product: "docker_deploy"
-  };
-}
-function dockerDeployProduct(deployment) {
-  return deployment.deployment_product ?? deployment.metadata?.["deployment_product"];
+    deployment_product: "docker_deploy",
+    docker_deploy_template_id: templateId
+  });
 }
-function dockerDeployHostId(deployment) {
-  const metadataHost = deployment.metadata?.["docker_deploy_host_id"];
-  return deployment.docker_deploy_host_id ?? (typeof metadataHost === "string" ? metadataHost : null);
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
 }
-function addDoctorCheck(checks, name, ok, message, details) {
-  checks.push({ name, ok, message, ...details ? { details } : {} });
+function stringValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-function hostHealthy(host) {
-  return Boolean(
-    host && host.status === "active" && host.appliance_status === "healthy"
-  );
+function runtimeMetadata(metadata) {
+  const runtime = metadata.runtime;
+  return isRecord(runtime) ? runtime : void 0;
 }
-function probeUrl(publicUrl, probePath) {
+function publicProbeUrl(publicUrl, probePath) {
   const url = new URL(publicUrl);
-  url.pathname = probePath.startsWith("/") ? probePath : `/${probePath}`;
+  const normalizedPath = probePath.startsWith("/") ? probePath : `/${probePath}`;
+  url.pathname = normalizedPath;
   return url.toString();
 }
+function looksLikeMiosaGatewayJson(body) {
+  try {
+    const parsed = JSON.parse(body);
+    return isRecord(parsed) && parsed.ok === true && typeof parsed.run_id === "string" && Object.keys(parsed).every((key) => ["ok", "run_id"].includes(key));
+  } catch {
+    return false;
+  }
+}
+function addDoctorCheck(checks, name, ok, message, data) {
+  const check = { name, ok, message };
+  if (data !== void 0) check.data = data;
+  checks.push(check);
+}
 var DeploymentVersions = class {
   constructor(http, deploymentId) {
     this.http = http;
@@ -3837,6 +3829,7 @@ var Deployments = class {
       run_command: params.runCommand ?? params.run_command,
       auto_deploy: params.autoDeploy ?? params.auto_deploy,
       database: params.database,
+      docker_deploy_template_id: params.dockerDeployTemplateId ?? params.docker_deploy_template_id,
       metadata: params.metadata,
       ...attributionBody(params)
     });
@@ -3853,118 +3846,181 @@ var Deployments = class {
    * deployment so the control plane attaches it to the workspace Docker host.
    */
   async createDockerDeploy(params) {
+    const templateId = params.dockerDeployTemplateId ?? params.docker_deploy_template_id;
     return this.create({
       ...params,
-      metadata: dockerDeployMetadata(params.metadata)
+      metadata: dockerDeployMetadata(params.metadata, templateId)
     });
   }
+  async listDockerDeployHosts(params = {}) {
+    const data = await this.http.get(
+      "/docker-deploy/hosts",
+      stripUndefined10({
+        workspace_id: params.workspaceId ?? params.workspace_id
+      })
+    );
+    return listItems4(data, ["hosts", "items"]);
+  }
+  async ensureDockerDeployHost(params) {
+    const data = await this.http.request("/docker-deploy/hosts/ensure", {
+      method: "POST",
+      body: stripUndefined10({
+        workspace_id: params.workspaceId ?? params.workspace_id,
+        region: params.region,
+        size: params.size,
+        appliance_image: params.applianceImage ?? params.appliance_image,
+        metadata: params.metadata
+      }),
+      headers: { "Idempotency-Key": idempotencyKey4(params.idempotencyKey) }
+    });
+    return unwrap23(data);
+  }
+  async getDockerDeployHost(hostId) {
+    const data = await this.http.get(`/docker-deploy/hosts/${hostId}`);
+    return unwrap23(data);
+  }
   /**
-   * Verify a Docker Deploy deployment before telling a user or agent it is
-   * live. Checks product markers, appliance host health, route metadata, and
-   * optionally probes the public URL.
+   * Verify a Docker Deploy deployment end-to-end.
+   *
+   * This checks the deployment product marker, Docker Deploy host linkage,
+   * appliance health, route runtime metadata, and optionally the public URL.
+   * It is intentionally agent-friendly: use this after sandbox.deployDocker()
+   * or createDockerDeploy() before telling a user the app is live.
    */
   async doctorDockerDeploy(deploymentId, params = {}) {
     const checks = [];
     const deployment = await this.get(deploymentId);
-    const metadata = deployment.metadata ?? {};
-    const product = dockerDeployProduct(deployment);
-    const hostId = dockerDeployHostId(deployment);
+    const metadata = isRecord(deployment.metadata) ? deployment.metadata : {};
+    const product = stringValue(deployment.deployment_product) ?? stringValue(metadata.deployment_product);
+    const hostId = stringValue(deployment.docker_deploy_host_id) ?? stringValue(metadata.docker_deploy_host_id);
     addDoctorCheck(
       checks,
       "deployment_product",
       product === "docker_deploy",
-      product === "docker_deploy" ? "Deployment is marked for Docker Deploy." : `Expected deployment_product=docker_deploy, got ${String(product ?? "missing")}.`,
-      { deployment_product: product ?? null }
+      product === "docker_deploy" ? "Deployment is marked as Docker Deploy." : `Expected deployment_product=docker_deploy, got ${product ?? "missing"}.`,
+      { product: product ?? null }
     );
     addDoctorCheck(
       checks,
       "docker_deploy_host_id",
-      Boolean(hostId),
-      hostId ? "Deployment has a Docker Deploy host id." : "Deployment has no docker_deploy_host_id.",
-      { docker_deploy_host_id: hostId }
+      !!hostId,
+      hostId ? "Deployment is linked to a Docker Deploy appliance host." : "Deployment has no docker_deploy_host_id.",
+      { docker_deploy_host_id: hostId ?? null }
     );
     let host;
     if (hostId) {
       try {
-        const rawHost = await this.http.get(
-          `/docker-deploy/hosts/${hostId}`
-        );
-        host = unwrap23(rawHost);
+        host = await this.getDockerDeployHost(hostId);
+        const status = host.status ?? null;
+        const applianceStatus = host.appliance_status ?? null;
+        const badHostStates = /* @__PURE__ */ new Set(["failed", "error", "destroyed"]);
+        const badApplianceStates = /* @__PURE__ */ new Set(["failed", "error", "unhealthy"]);
+        const ok = !badHostStates.has(String(status)) && !badApplianceStates.has(String(applianceStatus));
         addDoctorCheck(
           checks,
           "docker_deploy_host_health",
-          hostHealthy(host),
-          hostHealthy(host) ? "Docker Deploy host is active and healthy." : `Docker Deploy host status=${host.status} appliance=${host.appliance_status}.`,
-          {
-            status: host.status,
-            appliance_status: host.appliance_status
-          }
+          ok,
+          ok ? "Docker Deploy host is not reporting a failed state." : `Docker Deploy host is unhealthy: status=${status}, appliance_status=${applianceStatus}.`,
+          { status, appliance_status: applianceStatus }
         );
-      } catch (error) {
+      } catch (err) {
         addDoctorCheck(
           checks,
           "docker_deploy_host_health",
           false,
-          error instanceof Error ? error.message : String(error)
+          `Could not fetch Docker Deploy host ${hostId}: ${err instanceof Error ? err.message : String(err)}`
         );
       }
     }
-    const runtime = metadata["runtime"];
-    const hasRuntimeRoute = typeof runtime === "object" && runtime !== null && typeof runtime["ip"] === "string" && typeof runtime["port"] === "number";
+    const runtime = runtimeMetadata(metadata);
+    const runtimeIp = runtime ? stringValue(runtime.ip) ?? stringValue(runtime.ip_address) : void 0;
+    const runtimePort = runtime?.port;
     addDoctorCheck(
       checks,
-      "runtime_route",
-      hasRuntimeRoute,
-      hasRuntimeRoute ? "Deployment has appliance runtime route metadata." : "Deployment is missing appliance runtime route metadata.",
-      typeof runtime === "object" && runtime !== null ? runtime : void 0
+      "route_runtime",
+      !!runtimeIp && runtimePort !== void 0 && runtimePort !== null,
+      runtimeIp && runtimePort !== void 0 && runtimePort !== null ? "Deployment route metadata points at a runtime target." : "Deployment metadata has no runtime ip/port target.",
+      { ip: runtimeIp ?? null, port: runtimePort ?? null }
+    );
+    const publicUrl = stringValue(deployment.public_url) ?? stringValue(metadata.public_url);
+    addDoctorCheck(
+      checks,
+      "public_url",
+      !!publicUrl,
+      publicUrl ? "Deployment has a public URL." : "Deployment has no public URL to probe.",
+      { public_url: publicUrl ?? null }
     );
     let probe;
-    const publicUrl = deployment.public_url;
-    const path = params.probePath ?? params.probe_path ?? "/";
-    if (publicUrl && typeof fetch === "function") {
-      const url = probeUrl(publicUrl, path);
+    if (params.probe !== false && publicUrl) {
+      const fetchImpl = params.fetchImpl ?? fetch;
+      const url = publicProbeUrl(publicUrl, params.probePath ?? "/");
       const controller = new AbortController();
-      const timeout = setTimeout(
-        () => controller.abort(),
-        params.timeoutMs ?? params.timeout_ms ?? 1e4
-      );
+      const timer = setTimeout(() => controller.abort(), params.timeoutMs ?? 2e4);
       try {
-        const response = await fetch(url, {
-          method: "GET",
+        const response = await fetchImpl(url, {
+          headers: { Accept: "*/*" },
           signal: controller.signal
         });
-        probe = { url, ok: response.ok, status: response.status };
+        const text = await response.text();
+        const gatewayJson = looksLikeMiosaGatewayJson(text);
+        const ok = response.ok && !gatewayJson;
+        probe = {
+          url,
+          status: response.status,
+          ok,
+          responseSnippet: text.slice(0, 500)
+        };
+        if (gatewayJson) probe.gatewayJson = true;
         addDoctorCheck(
           checks,
           "public_url_probe",
-          response.ok,
-          response.ok ? `Public URL returned HTTP ${response.status}.` : `Public URL returned HTTP ${response.status}.`,
-          { url, status: response.status }
+          ok,
+          ok ? `Public URL returned HTTP ${response.status}.` : gatewayJson ? "Public URL returned MIOSA gateway JSON instead of the app." : `Public URL returned HTTP ${response.status}.`,
+          { status: response.status, gateway_json: gatewayJson }
         );
-      } catch (error) {
-        probe = {
-          url,
-          ok: false,
-          error: error instanceof Error ? error.message : String(error)
-        };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        probe = { url, status: null, ok: false, responseSnippet: message };
         addDoctorCheck(
           checks,
           "public_url_probe",
           false,
-          probe.error ?? "Public URL probe failed.",
-          { url }
+          `Public URL probe failed: ${message}`
         );
       } finally {
-        clearTimeout(timeout);
+        clearTimeout(timer);
       }
     }
-    return {
+    const result = {
       ok: checks.every((check) => check.ok),
       deployment,
-      ...host ? { host } : {},
-      checks,
-      ...probe ? { probe } : {}
+      checks
     };
+    if (host) result.host = host;
+    if (publicUrl !== void 0) result.publicUrl = publicUrl;
+    if (probe) result.probe = probe;
+    return result;
+  }
+  async listDockerDeployTemplates(params = {}) {
+    const query = {
+      category: params.category,
+      runtime: params.runtime,
+      framework: params.framework,
+      include_preview: params.includePreview ?? params.include_preview
+    };
+    const data = await this.http.get(
+      "/docker-deploy/templates",
+      stripUndefined10(query)
+    );
+    const templates = unwrap23(data);
+    if (Array.isArray(templates)) return templates;
+    return (templates?.templates ?? templates?.items ?? templates?.data ?? []) || [];
+  }
+  async getDockerDeployTemplate(templateId) {
+    const data = await this.http.get(
+      `/docker-deploy/templates/${templateId}`
+    );
+    return unwrap23(data);
   }
   async update(deploymentId, params) {
     const body = stripUndefined10({
@@ -3988,7 +4044,15 @@ var Deployments = class {
       source_sandbox_id: params.sourceSandboxId ?? params.source_sandbox_id,
       output_path: params.outputPath ?? params.output_path,
       entrypoint: params.entrypoint,
-      promote: params.promote
+      promote: params.promote,
+      build_command: params.buildCommand ?? params.build_command,
+      run_command: params.runCommand ?? params.run_command,
+      port: params.port,
+      health_check_path: params.healthCheckPath ?? params.health_check_path,
+      deployment_type: params.deploymentType ?? params.deployment_type,
+      docker_deploy_template_id: params.dockerDeployTemplateId ?? params.docker_deploy_template_id,
+      data_services: params.dataServices ?? params.data_services,
+      ...attributionBody(params)
     });
     const data = await this.http.request(
       `/deployments/${deploymentId}/publish`,
@@ -4013,7 +4077,15 @@ var Deployments = class {
       source_snapshot_path: params.sourceSnapshotPath ?? params.source_snapshot_path,
       entrypoint: params.entrypoint,
       domain: params.domain,
-      custom_domain: params.customDomain ?? params.custom_domain
+      custom_domain: params.customDomain ?? params.custom_domain,
+      build_command: params.buildCommand ?? params.build_command,
+      run_command: params.runCommand ?? params.run_command,
+      port: params.port,
+      health_check_path: params.healthCheckPath ?? params.health_check_path,
+      deployment_type: params.deploymentType ?? params.deployment_type,
+      docker_deploy_template_id: params.dockerDeployTemplateId ?? params.docker_deploy_template_id,
+      data_services: params.dataServices ?? params.data_services,
+      ...attributionBody(params)
     });
     const data = await this.http.request(
       `/sandboxes/${sandboxId}/deploy`,
@@ -4082,89 +4154,205 @@ var Deployments = class {
   }
 };
 
-// src/resources/docker-deploy.ts
-function workspaceId(params) {
-  return params?.workspace_id ?? params?.workspaceId;
-}
-function ensureBody(params) {
-  const body = {};
-  const id = params.workspace_id ?? params.workspaceId;
-  const externalId = params.external_workspace_id ?? params.externalWorkspaceId;
-  if (id) body.workspace_id = id;
-  if (externalId) body.external_workspace_id = externalId;
-  return body;
-}
-function unwrapHost(response) {
-  const host = response.data ?? response.host;
-  if (!host) {
-    throw new Error("Docker Deploy host response was empty.");
-  }
-  return host;
-}
-function unwrapTemplates(response) {
-  return response.data ?? response.templates ?? [];
-}
-function unwrapTemplate(response) {
-  const template = response.data ?? response.template;
-  if (!template) {
-    throw new Error("Docker Deploy template response was empty.");
-  }
-  return template;
-}
-var DockerDeploy = class {
+// src/resources/devices.ts
+var DEVICE_CATALOG = [
+  {
+    kind: "sandbox_worker",
+    label: "Sandbox Worker",
+    purpose: "Isolated Linux workspace for agents to create files, run code, preview apps, snapshot, fork, and publish.",
+    lifecycle: "Persistent by default; use stop/resume/snapshot/fork where the account backend supports saved state.",
+    persistence: "Use one-hour timeouts for interactive builds and checkpoint before long pauses.",
+    primaryCommands: [
+      "miosa.sandboxes.create({ templateId: 'nextjs', timeoutSec: 3600 })",
+      "sandbox.exec.run('codex ...', { cwd: '/workspace' })",
+      "sandbox.files.write('/workspace/app/page.jsx', source)",
+      "miosa.deployments.publishFromSandbox(...)"
+    ],
+    useWhen: [
+      "Coding agents should build inside the remote filesystem.",
+      "You need command execution, file writes, package installs, previews, artifacts, or app publish.",
+      "You want virtual-device behavior without a GUI desktop."
+    ],
+    avoidWhen: [
+      "The workflow requires full browser/desktop control.",
+      "The app is ready for production; publish it to a deployment runtime."
+    ]
+  },
+  {
+    kind: "computer",
+    label: "Computer",
+    purpose: "Durable VM/desktop device for browser automation, CUA sessions, SSH, tunnels, and persistent agent control.",
+    lifecycle: "Managed as a Computer with desktop/browser and operator-style control surfaces.",
+    persistence: "Use checkpoints, volumes, tunnels, and agent sessions for long-lived desktop workflows.",
+    primaryCommands: [
+      "miosa.computers.create({ name: 'browser-agent' })",
+      "computer.exec.run('npm test')",
+      "computer.desktop.open()"
+    ],
+    useWhen: [
+      "The agent needs Chromium or a full desktop.",
+      "The workflow logs into dashboards, fills forms, clicks buttons, or captures screenshots.",
+      "A human and agent share the same persistent machine state."
+    ],
+    avoidWhen: [
+      "Simple code generation/build/test work fits a cheaper sandbox worker.",
+      "You only need durable app hosting."
+    ]
+  },
+  {
+    kind: "local_device",
+    label: "Local Device",
+    purpose: "Developer-owned machine connected through CLI/MCP for local discovery and private tooling.",
+    lifecycle: "Not hosted by MIOSA; the user owns uptime and state.",
+    persistence: "State is local machine state. Do not assume cloud resume semantics.",
+    primaryCommands: ["miosa mcp install", "miosa doctor --json"],
+    useWhen: [
+      "The agent needs local repository discovery before cloud execution.",
+      "The user intentionally wants local private tools."
+    ],
+    avoidWhen: [
+      "Customer code must stay isolated in MIOSA-hosted infrastructure.",
+      "The workflow needs reproducible shared cloud state."
+    ]
+  },
+  {
+    kind: "docker_deploy_host",
+    label: "Docker Deploy Host",
+    purpose: "Workspace appliance VM that runs Docker containers for durable apps published from sandboxes.",
+    lifecycle: "Always-on deployment capacity; not an interactive coding workspace.",
+    persistence: "Versioned releases and routing are durable; edits happen in sandboxes before publish.",
+    primaryCommands: [
+      "miosa sandbox publish <id> --docker-deploy",
+      "miosa deploy --docker-deploy"
+    ],
+    useWhen: [
+      "You need many small apps, APIs, funnels, or client sites in one workspace appliance.",
+      "You want stable public URLs backed by Docker containers."
+    ],
+    avoidWhen: [
+      "Interactive agent work is still happening.",
+      "The app needs the standard MIOSA Deploy runtime."
+    ]
+  }
+];
+var Devices = class {
+  http;
   constructor(http) {
     this.http = http;
   }
-  http;
   /**
-   * List Docker Deploy appliance hosts scoped to the current tenant.
-   *
-   * Pass a workspace ID to inspect the dedicated always-on appliance machine
-   * for one white-label workspace.
+   * Return the static device catalog used by orchestration apps to choose the
+   * right MIOSA execution surface before creating resources.
    */
-  async listHosts(params = {}) {
-    const res = await this.http.get(
-      "/docker-deploy/hosts",
-      { workspace_id: workspaceId(params) }
-    );
-    return res.data ?? res.hosts ?? [];
+  catalog() {
+    return DEVICE_CATALOG.map((entry) => ({ ...entry }));
   }
   /**
-   * Ensure a workspace has its dedicated Docker Deploy appliance host.
-   *
-   * The host may still be `pending`, `provisioning`, or `bootstrapping` after
-   * this call. Treat `status === "active"` and `appliance_status === "healthy"`
-   * as the ready condition before sending app/container traffic to it.
+   * List hosted devices by normalizing existing sandboxes and computers.
+   * Partial backend failures are returned in `errors` so orchestration UIs can
+   * still show usable inventory instead of failing the whole page.
    */
-  async ensureHost(params = {}) {
-    const res = await this.http.post(
-      "/docker-deploy/hosts/ensure",
-      ensureBody(params)
-    );
-    return { host: unwrapHost(res), queued: res.queued ?? false };
-  }
-  /** Fetch one Docker Deploy host by ID. */
-  async getHost(hostId) {
-    const res = await this.http.get(
-      `/docker-deploy/hosts/${hostId}`
-    );
-    return unwrapHost(res);
-  }
-  /** List Docker Deploy starter templates. */
-  async listTemplates() {
-    const res = await this.http.get(
-      "/docker-deploy/templates"
-    );
-    return unwrapTemplates(res);
-  }
-  /** Fetch one Docker Deploy starter template by ID. */
-  async getTemplate(templateId) {
-    const res = await this.http.get(
-      `/docker-deploy/templates/${encodeURIComponent(templateId)}`
-    );
-    return unwrapTemplate(res);
+  async list(params = {}) {
+    const kind = normalizeKind(params.kind ?? "all");
+    const devices = [];
+    const errors = [];
+    if (kind === "all" || kind === "sandbox_worker") {
+      try {
+        const sandboxes = await this.http.get("/sandboxes");
+        devices.push(...unwrapList11(sandboxes, ["sandboxes"]).map(normalizeSandbox));
+      } catch (err) {
+        errors.push(toListError("sandboxes", err));
+      }
+    }
+    if (kind === "all" || kind === "computer") {
+      try {
+        const computers = await this.http.get("/computers");
+        devices.push(...unwrapList11(computers, ["computers"]).map(normalizeComputer));
+      } catch (err) {
+        errors.push(toListError("computers", err));
+      }
+    }
+    return { devices, errors };
   }
 };
+function normalizeKind(kind) {
+  if (kind === "all") return "all";
+  if (kind === "sandbox" || kind === "sandbox_worker") {
+    return "sandbox_worker";
+  }
+  if (kind === "computer") return "computer";
+  throw new Error(`Unsupported device kind: ${kind}`);
+}
+function normalizeSandbox(row) {
+  return compactRecord({
+    id: stringField(row, "id"),
+    kind: "sandbox_worker",
+    source: "sandboxes",
+    name: optionalString(row, "name"),
+    state: optionalString(row, "state") ?? optionalString(row, "status"),
+    ready: optionalBoolean(row, "ready"),
+    persistent: optionalBoolean(row, "persistent"),
+    alwaysOn: optionalBoolean(row, "always_on"),
+    template: optionalString(row, "template_id") ?? optionalString(row, "template"),
+    previewUrl: optionalString(row, "preview_url"),
+    timeoutRemainingMs: optionalNumber(row, "timeout_remaining_ms")
+  });
+}
+function normalizeComputer(row) {
+  return compactRecord({
+    id: stringField(row, "id"),
+    kind: "computer",
+    source: "computers",
+    name: optionalString(row, "name"),
+    state: optionalString(row, "status") ?? optionalString(row, "state"),
+    ready: optionalBoolean(row, "ready"),
+    region: optionalString(row, "region"),
+    template: optionalString(row, "template_type") ?? optionalString(row, "template")
+  });
+}
+function compactRecord(record) {
+  return Object.fromEntries(
+    Object.entries(record).filter(([, value]) => value !== void 0)
+  );
+}
+function unwrapList11(payload, keys) {
+  const value = isRecord2(payload) && "data" in payload ? payload.data : payload;
+  if (Array.isArray(value)) return value.filter(isRecord2);
+  if (isRecord2(value)) {
+    for (const key of keys) {
+      const nested = value[key];
+      if (Array.isArray(nested)) return nested.filter(isRecord2);
+    }
+  }
+  return [];
+}
+function toListError(source, err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return {
+    source,
+    message,
+    retryable: /fetch failed|ECONNRESET|HTTP 502|other side closed|socket hang up|bad gateway/i.test(
+      message
+    )
+  };
+}
+function stringField(row, key) {
+  const value = row[key];
+  return typeof value === "string" ? value : String(value ?? "");
+}
+function optionalString(row, key) {
+  const value = row[key];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function optionalBoolean(row, key) {
+  return typeof row[key] === "boolean" ? row[key] : void 0;
+}
+function optionalNumber(row, key) {
+  return typeof row[key] === "number" ? row[key] : void 0;
+}
+function isRecord2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 
 // src/resources/email.ts
 function unwrap24(data) {
@@ -4183,7 +4371,7 @@ function unwrap24(data) {
   }
   return data;
 }
-function unwrapList11(data) {
+function unwrapList12(data) {
   if (Array.isArray(data)) return data;
   if (data && typeof data === "object") {
     const d = data;
@@ -4211,7 +4399,7 @@ var EmailCampaigns = class {
   }
   http;
   async list(filters = {}) {
-    return unwrapList11(
+    return unwrapList12(
       await this.http.get(
         "/admin/email-campaigns",
         filters
@@ -4247,7 +4435,7 @@ var EmailCampaigns = class {
     );
   }
   async deliveries(campaignId, filters = {}) {
-    return unwrapList11(
+    return unwrapList12(
       await this.http.get(
         `/admin/email-campaigns/${campaignId}/deliveries`,
         filters
@@ -4261,7 +4449,7 @@ var EmailTemplates = class {
   }
   http;
   async list(filters = {}) {
-    return unwrapList11(
+    return unwrapList12(
       await this.http.get("/admin/email-templates", filters)
     );
   }
@@ -4293,7 +4481,7 @@ var EmailInbox = class {
   }
   http;
   async list(filters = {}) {
-    return unwrapList11(
+    return unwrapList12(
       await this.http.get("/admin/email-inbox", filters)
     );
   }
@@ -5317,49 +5505,49 @@ var OcWorkspaces = class {
   /**
    * Fetch a single workspace.
    */
-  async get(hostId, workspaceId2) {
+  async get(hostId, workspaceId) {
     return this.http.get(
-      `${this.base(hostId)}/${workspaceId2}`
+      `${this.base(hostId)}/${workspaceId}`
     );
   }
   /**
    * Update workspace metadata (name, branch).
    */
-  async update(hostId, workspaceId2, params) {
+  async update(hostId, workspaceId, params) {
     return this.http.patch(
-      `${this.base(hostId)}/${workspaceId2}`,
+      `${this.base(hostId)}/${workspaceId}`,
       params
     );
   }
   /**
    * Delete a workspace.
    */
-  async delete(hostId, workspaceId2) {
-    return this.http.delete(`${this.base(hostId)}/${workspaceId2}`);
+  async delete(hostId, workspaceId) {
+    return this.http.delete(`${this.base(hostId)}/${workspaceId}`);
   }
   /**
    * Pull the latest changes from the remote repository.
    */
-  async pull(hostId, workspaceId2) {
+  async pull(hostId, workspaceId) {
     return this.http.post(
-      `${this.base(hostId)}/${workspaceId2}/pull`
+      `${this.base(hostId)}/${workspaceId}/pull`
     );
   }
   /**
    * Open a terminal session scoped to the workspace root directory.
    * Returns a short-lived WebSocket ticket.
    */
-  async openTerminal(hostId, workspaceId2) {
+  async openTerminal(hostId, workspaceId) {
     return this.http.post(
-      `${this.base(hostId)}/${workspaceId2}/open-terminal`
+      `${this.base(hostId)}/${workspaceId}/open-terminal`
     );
   }
   /**
    * Stream workspace setup / clone / install events.
    */
-  events(hostId, workspaceId2) {
+  events(hostId, workspaceId) {
     return this.http.stream(
-      `${this.base(hostId)}/${workspaceId2}/events`
+      `${this.base(hostId)}/${workspaceId}/events`
     );
   }
 };
@@ -6286,6 +6474,7 @@ var Sandbox = class _Sandbox {
         port: params.port,
         health_check_path: params.healthCheckPath ?? params.health_check_path,
         deployment_type: params.deploymentType ?? params.deployment_type,
+        docker_deploy_template_id: params.dockerDeployTemplateId ?? params.docker_deploy_template_id,
         type: params.type,
         mode: params.mode,
         database: params.database,
@@ -6750,7 +6939,7 @@ function unwrap39(data) {
   }
   return data;
 }
-function unwrapList12(data) {
+function unwrapList13(data) {
   if (Array.isArray(data)) return data;
   if (data && typeof data === "object") {
     const d = data;
@@ -6769,7 +6958,7 @@ var SnapshotsStandalone = class {
     const query = Object.fromEntries(
       Object.entries(filters).filter(([, v]) => v !== void 0)
     );
-    return unwrapList12(await this.http.get("/admin/snapshots", query));
+    return unwrapList13(await this.http.get("/admin/snapshots", query));
   }
   async get(snapshotId) {
     return unwrap39(
@@ -6965,96 +7154,22 @@ var OrgInvites = class {
 function unwrap41(payload) {
   if (payload && typeof payload === "object") {
     const p = payload;
-    for (const k of ["data", "tenant", "branding", "items"]) {
+    for (const k of ["data", "tenant", "items"]) {
       if (k in p) return p[k];
     }
   }
   return payload;
 }
-var PreviewDomain = class {
-  constructor(http) {
-    this.http = http;
-  }
-  http;
-  /** Get the tenant's white-label preview domain settings. */
-  async get() {
-    const data = await this.http.get("/tenant/preview-domain");
-    return unwrap41(data);
-  }
-  /** Set the tenant's white-label preview domain. */
-  async set(domain) {
-    const data = await this.http.put("/tenant/preview-domain", {
-      preview_domain: domain
-    });
-    return unwrap41(data);
-  }
-  /** Re-run DNS verification for the configured preview domain. */
-  async verify() {
-    const data = await this.http.post(
-      "/tenant/preview-domain/verify",
-      {}
-    );
-    return unwrap41(data);
-  }
-  /** Remove the tenant's custom preview domain. */
-  async delete() {
-    await this.http.delete("/tenant/preview-domain");
-  }
-};
-var Branding = class {
-  constructor(http) {
-    this.http = http;
-  }
-  http;
-  /** Get tenant branding used by white-label hosted surfaces. */
-  async get() {
-    const data = await this.http.get("/tenant/branding");
-    return unwrap41(data);
-  }
-  /** Update tenant branding used by white-label hosted surfaces. */
-  async set(params) {
-    const body = Object.fromEntries(
-      Object.entries(params).filter(([, v]) => v !== void 0)
-    );
-    const data = await this.http.put("/tenant/branding", {
-      branding: body
-    });
-    return unwrap41(data);
-  }
-  /** Reset tenant branding to platform defaults. */
-  async delete() {
-    await this.http.delete("/tenant/branding");
-  }
-};
 var Tenant = class {
-  http;
-  preview_domain;
-  branding;
-  /** camelCase alias for SDK consumers that avoid snake_case properties. */
-  previewDomain;
   constructor(http) {
     this.http = http;
-    this.preview_domain = new PreviewDomain(http);
-    this.previewDomain = this.preview_domain;
-    this.branding = new Branding(http);
   }
+  http;
   /** Get the current tenant's plan, limits, and live usage counters. */
   async current() {
     const data = await this.http.get("/tenant/plan");
     return unwrap41(data);
   }
-  /** Convenience alias for `tenant.branding.get()`. */
-  async getBranding() {
-    return this.branding.get();
-  }
-  /** Convenience alias for `tenant.branding.set(...)`. */
-  async setBranding(params) {
-    return this.branding.set(params);
-  }
-  /** Convenience alias for `tenant.branding.delete()`. */
-  async deleteBranding() {
-    await this.branding.delete();
-  }
 };
 
 // src/resources/usage.ts
@@ -7176,35 +7291,43 @@ function stripUndefined25(input) {
 function idempotencyKey10(key) {
   return key ?? randomUUID();
 }
-function bodyBuffer(body) {
-  if (Buffer.isBuffer(body)) return body;
-  if (typeof body === "string") return Buffer.from(body, "utf8");
-  return Buffer.from(body);
-}
-function verifySignature(body, header, secret, toleranceSec = 300) {
-  const parts = Object.fromEntries(
-    header.split(",").map((chunk) => chunk.split("=", 2)).filter(([key, value]) => key && value)
-  );
-  const timestamp = parts.t;
-  const received = parts.v1;
-  if (!timestamp || !received || !secret) return false;
-  const unixSeconds = Number(timestamp);
-  if (!Number.isFinite(unixSeconds)) return false;
-  const ageSec = Math.abs(Date.now() / 1e3 - unixSeconds);
-  if (ageSec > toleranceSec) {
-    throw new Error("webhook timestamp too old");
-  }
-  const rawBody = bodyBuffer(body);
-  const signed = Buffer.concat([Buffer.from(`${timestamp}.`), rawBody]);
-  const expected = createHmac("sha256", secret).update(signed).digest("hex");
-  try {
-    return timingSafeEqual(
-      Buffer.from(expected, "utf8"),
-      Buffer.from(received, "utf8")
-    );
-  } catch {
-    return false;
+function parseSignatureHeader(header) {
+  const parts = header.split(",").map((part) => part.trim());
+  let timestamp = null;
+  const signatures = [];
+  for (const part of parts) {
+    const [key, value] = part.split("=", 2);
+    if (!key || !value) continue;
+    if (key === "t") {
+      const parsed = Number(value);
+      if (Number.isFinite(parsed)) timestamp = parsed;
+    } else if (key === "v1") {
+      signatures.push(value);
+    }
   }
+  if (timestamp == null || signatures.length === 0) return null;
+  return { timestamp, signatures };
+}
+function verifySignature(body, header, secret, options = {}) {
+  const parsed = parseSignatureHeader(header);
+  if (!parsed) return false;
+  const toleranceSeconds = options.toleranceSeconds ?? 300;
+  const ageSeconds = Math.abs(Math.floor(Date.now() / 1e3) - parsed.timestamp);
+  if (ageSeconds > toleranceSeconds) {
+    throw new Error("Webhook signature timestamp is too old");
+  }
+  const bodyBuffer = Buffer.isBuffer(body) ? body : Buffer.from(body);
+  const signedPayload = Buffer.concat([
+    Buffer.from(`${parsed.timestamp}.`),
+    bodyBuffer
+  ]);
+  const expected = createHmac("sha256", secret).update(signedPayload).digest("hex");
+  const expectedBuffer = Buffer.from(expected, "hex");
+  return parsed.signatures.some((signature) => {
+    const actualBuffer = Buffer.from(signature, "hex");
+    if (actualBuffer.length !== expectedBuffer.length) return false;
+    return timingSafeEqual(actualBuffer, expectedBuffer);
+  });
 }
 var Webhooks = class {
   constructor(http) {
@@ -7212,6 +7335,7 @@ var Webhooks = class {
   }
   http;
   static verifySignature = verifySignature;
+  static verify_signature = verifySignature;
   async list(params = {}) {
     const query = stripUndefined25({ ...params });
     const data = await this.http.get("/webhooks", query);
@@ -7276,9 +7400,9 @@ var WorkspaceInvites = class {
    *
    * `POST /workspaces/:id/invites`
    */
-  async create(workspaceId2, params) {
+  async create(workspaceId, params) {
     return this.http.post(
-      `/workspaces/${workspaceId2}/invites`,
+      `/workspaces/${workspaceId}/invites`,
       params
     );
   }
@@ -7287,9 +7411,9 @@ var WorkspaceInvites = class {
    *
    * `GET /workspaces/:id/invites`
    */
-  async list(workspaceId2) {
+  async list(workspaceId) {
     const res = await this.http.get(
-      `/workspaces/${workspaceId2}/invites`
+      `/workspaces/${workspaceId}/invites`
     );
     return res.data ?? [];
   }
@@ -7301,9 +7425,9 @@ var WorkspaceInvites = class {
    *
    * `DELETE /workspaces/:id/invites/:invite_id`
    */
-  async revoke(workspaceId2, inviteId) {
+  async revoke(workspaceId, inviteId) {
     return this.http.delete(
-      `/workspaces/${workspaceId2}/invites/${inviteId}`
+      `/workspaces/${workspaceId}/invites/${inviteId}`
     );
   }
   /**
@@ -7357,9 +7481,9 @@ var WorkspaceMembers = class {
    *
    * `GET /workspaces/:id/members`
    */
-  async list(workspaceId2) {
+  async list(workspaceId) {
     const res = await this.http.get(
-      `/workspaces/${workspaceId2}/members`
+      `/workspaces/${workspaceId}/members`
     );
     return res.data ?? res;
   }
@@ -7375,9 +7499,9 @@ var WorkspaceMembers = class {
    * @throws `MiosaError` with code `NOT_TENANT_MEMBER` if the user is not an
    *   org member.
    */
-  async add(workspaceId2, params) {
+  async add(workspaceId, params) {
     const res = await this.http.post(
-      `/workspaces/${workspaceId2}/members`,
+      `/workspaces/${workspaceId}/members`,
       params
     );
     return res.data ?? res;
@@ -7387,9 +7511,9 @@ var WorkspaceMembers = class {
    *
    * `PATCH /workspaces/:id/members/:user_id`
    */
-  async updateRole(workspaceId2, userId, params) {
+  async updateRole(workspaceId, userId, params) {
     const res = await this.http.patch(
-      `/workspaces/${workspaceId2}/members/${userId}`,
+      `/workspaces/${workspaceId}/members/${userId}`,
       params
     );
     return res.data ?? res;
@@ -7404,9 +7528,9 @@ var WorkspaceMembers = class {
    *
    * @throws `MiosaError` with code `LAST_OWNER` if the target is the sole owner.
    */
-  async remove(workspaceId2, userId) {
+  async remove(workspaceId, userId) {
     return this.http.delete(
-      `/workspaces/${workspaceId2}/members/${userId}`
+      `/workspaces/${workspaceId}/members/${userId}`
     );
   }
 };
@@ -7458,13 +7582,13 @@ var Miosa = class {
   computers;
   /** Sandboxes — native code-execution environments under `/sandboxes`. */
   sandboxes;
+  /** Agent device facade — route work across Sandboxes, Computers, and deploy hosts. */
+  devices;
   /**
    * Deployments — publish from a sandbox to a stable production URL.
    * Versions, releases, rollback, custom domains.
    */
   deployments;
-  /** Docker Deploy appliance hosts — one always-on workspace host, many apps. */
-  dockerDeploy;
   /** Credit balance and usage. */
   credits;
   /** Admin surface (`/api/v1/admin/*`) — requires an admin credential. */
@@ -7558,8 +7682,8 @@ var Miosa = class {
     this.mcp = new Mcp(this.http);
     this.computers = new Computers(this.http);
     this.sandboxes = new Sandboxes(this.http);
+    this.devices = new Devices(this.http);
     this.deployments = new Deployments(this.http);
-    this.dockerDeploy = new DockerDeploy(this.http);
     this.credits = new Credits(this.http);
     this.admin = new Admin(this.http);
     this.openComputers = new OpenComputers(this.http);
@@ -7589,6 +7713,6 @@ var Miosa = class {
   }
 };
 
-export { Admin, Analytics, ApiKeys, AuditLog, AuthError, Benchmarks, BuilderSessions, Channels, Checkpoints, CommandCenter, Community, Completions, Computer, ComputerAudit, ComputerAutoStop, ComputerEnv, ComputerInbox, ComputerLogs, ComputerNetwork, ComputerOsa, ComputerPorts, ComputerSecrets, ComputerTerminal, ComputerVolumes, Computers, Credits, CronJobs, Dashboard, Databases, DeploymentDomains, DeploymentReleases, DeploymentRuntimeInstances, DeploymentVersions, Deployments, Desktop, DockerDeploy, EgressAudit, EgressNetwork, EgressSecrets, Email, EmailCampaigns, EmailInbox, EmailTemplates, Embeddings, Exec, ExternalKeys, Files, FlatCustomDomains, Functions, HealthChecks, InsufficientCreditsError, Integrations, Mcp, Miosa, MiosaError, Models, NetworkError, NetworkPolicy, NotFoundError, OAuthFlow, OpenComputers, OrgInvites, ProjectAuth, ProjectIntegrations, ProviderDefaults, RateLimitError, Regions, SANDBOX_TEMPLATE, Sandbox, SandboxArtifacts, SandboxAudit, SandboxCommands, SandboxEnv, SandboxEvents, SandboxFiles, SandboxNetwork, SandboxPreview, SandboxPreviews, SandboxSecrets, SandboxTags, SandboxTemplates, SandboxTerminal, Sandboxes, ScopedFs, Settings, SnapshotsStandalone, Storage, Tenant, TimeoutError, Usage, ValidationError, Volumes, Webhooks, WorkspaceInvites, WorkspaceMembers, verifySignature };
+export { Admin, Analytics, ApiKeys, AuditLog, AuthError, Benchmarks, BuilderSessions, Channels, Checkpoints, CommandCenter, Community, Completions, Computer, ComputerAudit, ComputerAutoStop, ComputerEnv, ComputerInbox, ComputerLogs, ComputerNetwork, ComputerOsa, ComputerPorts, ComputerSecrets, ComputerTerminal, ComputerVolumes, Computers, Credits, CronJobs, Dashboard, Databases, DeploymentDomains, DeploymentReleases, DeploymentRuntimeInstances, DeploymentVersions, Deployments, Desktop, Devices, EgressAudit, EgressNetwork, EgressSecrets, Email, EmailCampaigns, EmailInbox, EmailTemplates, Embeddings, Exec, ExternalKeys, Files, FlatCustomDomains, Functions, HealthChecks, InsufficientCreditsError, Integrations, Mcp, Miosa, MiosaError, Models, NetworkError, NetworkPolicy, NotFoundError, OAuthFlow, OpenComputers, OrgInvites, ProjectAuth, ProjectIntegrations, ProviderDefaults, RateLimitError, Regions, SANDBOX_TEMPLATE, Sandbox, SandboxArtifacts, SandboxAudit, SandboxCommands, SandboxEnv, SandboxEvents, SandboxFiles, SandboxNetwork, SandboxPreview, SandboxPreviews, SandboxSecrets, SandboxTags, SandboxTemplates, SandboxTerminal, Sandboxes, ScopedFs, Settings, SnapshotsStandalone, Storage, Tenant, TimeoutError, Usage, ValidationError, Volumes, Webhooks, WorkspaceInvites, WorkspaceMembers, verifySignature };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map