@miosa/sdk 1.2.5 → 1.2.6

package/dist/index.js

@@ -1,4 +1,4 @@
-import { createHmac, timingSafeEqual, randomUUID } from 'crypto';
+import { randomUUID } from 'crypto';
 import EventEmitter from 'events';
 
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
@@ -592,6 +592,77 @@ var Admin = class {
       model_id: modelId
     });
   }
+  /** POST /api/v1/admin/impersonate — returns {token, expires_at}. */
+  impersonate(externalUserId, options = {}) {
+    return this.http.post("/admin/impersonate", {
+      external_user_id: externalUserId,
+      ttl_sec: options.ttlSec ?? 3600
+    });
+  }
+};
+
+// src/resources/agent-runs.ts
+function stripUndefined(input) {
+  return Object.fromEntries(Object.entries(input).filter(([, value]) => value !== void 0));
+}
+function createBody(params) {
+  return stripUndefined({
+    target_id: params.target_id ?? params.targetId ?? params.sandbox_id ?? params.sandboxId ?? params.computer_id ?? params.computerId,
+    target_kind: params.target_kind ?? params.targetKind,
+    provider: params.provider,
+    prompt: params.prompt,
+    instruction: params.instruction,
+    command: params.command,
+    model: params.model,
+    cwd: params.cwd,
+    timeout: params.timeout,
+    metadata: params.metadata
+  });
+}
+function listQuery(params) {
+  return {
+    target_id: params.target_id ?? params.targetId ?? params.sandbox_id ?? params.sandboxId ?? params.computer_id ?? params.computerId,
+    limit: params.limit
+  };
+}
+function unwrapRun(response) {
+  const run = response.data ?? response.run;
+  if (!run) {
+    throw new Error("Agent run response was empty.");
+  }
+  return run;
+}
+function unwrapRuns(response) {
+  if (Array.isArray(response)) return response;
+  return response.data ?? response.runs ?? [];
+}
+var AgentRuns = class {
+  constructor(http) {
+    this.http = http;
+  }
+  http;
+  /** Dispatch a prompt to a sandbox/computer and persist the run record. */
+  async create(params) {
+    const response = await this.http.post("/agent-runs", createBody(params));
+    return unwrapRun(response);
+  }
+  /** Alias for create(), matching the product language. */
+  async run(params) {
+    return this.create(params);
+  }
+  /** List recent agent runs for the authenticated tenant. */
+  async list(params = {}) {
+    const response = await this.http.get(
+      "/agent-runs",
+      listQuery(params)
+    );
+    return unwrapRuns(response);
+  }
+  /** Fetch one persisted agent run. */
+  async get(runId) {
+    const response = await this.http.get(`/agent-runs/${runId}`);
+    return unwrapRun(response);
+  }
 };
 
 // src/resources/analytics.ts
@@ -604,7 +675,7 @@ function unwrap(payload) {
   }
   return payload;
 }
-function stripUndefined(input) {
+function stripUndefined2(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -616,13 +687,13 @@ var Analytics = class {
   http;
   /** Get the platform analytics overview. */
   async overview(filters = {}) {
-    const query = stripUndefined(filters);
+    const query = stripUndefined2(filters);
     const data = await this.http.get("/analytics/overview", query);
     return unwrap(data);
   }
   /** Get a timeseries for a metric over a period. */
   async timeseries(params = {}) {
-    const query = stripUndefined(params);
+    const query = stripUndefined2(params);
     const data = await this.http.get("/analytics/timeseries", query);
     return unwrap(data);
   }
@@ -643,7 +714,7 @@ function listItems(payload, candidateKeys = ["data", "keys", "api_keys", "items"
   }
   return [];
 }
-function stripUndefined2(input) {
+function stripUndefined3(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -657,13 +728,13 @@ var ApiKeys = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined2({ ...params });
+    const query = stripUndefined3({ ...params });
     const data = await this.http.get("/api-keys", query);
     return listItems(data);
   }
   async create(params) {
     const { idempotencyKey: ikey, expiresAt, ...rest } = params;
-    const body = stripUndefined2({
+    const body = stripUndefined3({
       ...rest,
       expires_at: expiresAt ?? rest.expires_at
     });
@@ -674,6 +745,17 @@ var ApiKeys = class {
     });
     return unwrap2(data);
   }
+  /** POST /api/v1/api-keys/scoped — L2 delegation token bound to one external user. */
+  async createScoped(params) {
+    const body = stripUndefined3({
+      external_user_id: params.externalUserId,
+      scopes: params.scopes,
+      expires_at: params.expiresAt
+    });
+    return unwrap2(
+      await this.http.post("/api-keys/scoped", body)
+    );
+  }
   async delete(keyId) {
     await this.http.delete(`/api-keys/${keyId}`);
   }
@@ -689,7 +771,7 @@ function unwrap3(payload) {
   }
   return payload;
 }
-function stripUndefined3(input) {
+function stripUndefined4(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -701,7 +783,7 @@ var AuditLog = class {
   http;
   /** List audit-log events with optional filters. */
   async list(params = {}) {
-    const query = stripUndefined3(params);
+    const query = stripUndefined4(params);
     const data = await this.http.get("/audit-log", query);
     const result = unwrap3(data);
     if (Array.isArray(result)) return result;
@@ -839,7 +921,7 @@ function unwrap6(payload) {
   }
   return payload;
 }
-function stripUndefined4(input) {
+function stripUndefined5(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -856,7 +938,7 @@ var Channels = class {
   http;
   /** List all channels for the tenant. */
   async list(params = {}) {
-    const query = stripUndefined4(params);
+    const query = stripUndefined5(params);
     const data = await this.http.get("/channels", query);
     const result = unwrap6(data);
     if (Array.isArray(result)) return result;
@@ -1716,7 +1798,7 @@ function unwrapList8(payload) {
   }
   return [];
 }
-function stripUndefined5(input) {
+function stripUndefined6(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -1725,8 +1807,8 @@ function pickFirst(...values) {
   for (const v of values) if (v !== void 0) return v;
   return void 0;
 }
-function listQuery(params) {
-  return stripUndefined5({
+function listQuery2(params) {
+  return stripUndefined6({
     resource_id: pickFirst(params.resourceId, params.resource_id),
     resource_type: pickFirst(params.resourceType, params.resource_type),
     host: params.host,
@@ -1754,7 +1836,7 @@ var EgressAudit = class {
   async list(params = {}) {
     const data = await this.http.get(
       "/egress/audit",
-      listQuery(params)
+      listQuery2(params)
     );
     return unwrapList8(data);
   }
@@ -1781,7 +1863,7 @@ var EgressAudit = class {
       if (since !== void 0) queryParams.since = since;
       const data = await this.http.get(
         "/egress/audit",
-        listQuery(queryParams)
+        listQuery2(queryParams)
       );
       const events = unwrapList8(data);
       for (const event of events) {
@@ -1865,7 +1947,7 @@ function unwrapList9(payload) {
   }
   return [];
 }
-function stripUndefined6(input) {
+function stripUndefined7(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -1875,7 +1957,7 @@ function pickFirst2(...values) {
   return void 0;
 }
 function ruleBody(host, params, effect) {
-  return stripUndefined6({
+  return stripUndefined7({
     host,
     effect,
     methods: params.methods,
@@ -1910,7 +1992,7 @@ var EgressNetwork = class {
   }
   /** List allowlist rules. */
   async rules(params = {}) {
-    const query = stripUndefined6({
+    const query = stripUndefined7({
       policy_id: pickFirst2(params.policyId, params.policy_id),
       resource_id: pickFirst2(params.resourceId, params.resource_id),
       resource_type: pickFirst2(params.resourceType, params.resource_type)
@@ -1925,7 +2007,7 @@ var EgressNetwork = class {
   // ── policies ──────────────────────────────────────────────────────────────
   /** List egress policies. */
   async policies(params = {}) {
-    const query = stripUndefined6({
+    const query = stripUndefined7({
       resource_id: pickFirst2(params.resourceId, params.resource_id),
       resource_type: pickFirst2(params.resourceType, params.resource_type)
     });
@@ -1934,7 +2016,7 @@ var EgressNetwork = class {
   }
   /** Create an egress policy. */
   async createPolicy(params) {
-    const body = stripUndefined6({
+    const body = stripUndefined7({
       name: params.name,
       mode: params.mode ?? "enforce",
       default_effect: pickFirst2(
@@ -1954,7 +2036,7 @@ var EgressNetwork = class {
   }
   /** Update an egress policy by id. */
   async updatePolicy(policyId, params) {
-    const body = stripUndefined6({
+    const body = stripUndefined7({
       mode: params.mode,
       default_effect: pickFirst2(params.defaultEffect, params.default_effect),
       name: params.name,
@@ -1982,7 +2064,7 @@ var EgressNetwork = class {
     if (policyId) {
       return this.updatePolicy(policyId, { mode });
     }
-    const body = resourceId !== void 0 && resourceType !== void 0 ? stripUndefined6({
+    const body = resourceId !== void 0 && resourceType !== void 0 ? stripUndefined7({
       mode,
       resource_id: resourceId,
       resource_type: resourceType
@@ -1996,7 +2078,7 @@ var EgressNetwork = class {
   // ── suggestions ───────────────────────────────────────────────────────────
   /** AI-generated allowlist suggestions from recent denied egress. */
   async suggestions(params = {}) {
-    const query = stripUndefined6({
+    const query = stripUndefined7({
       resource_id: pickFirst2(params.resourceId, params.resource_id),
       resource_type: pickFirst2(params.resourceType, params.resource_type),
       since: params.since ?? "7d"
@@ -2101,7 +2183,7 @@ function unwrapList10(payload) {
   }
   return [];
 }
-function stripUndefined7(input) {
+function stripUndefined8(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -2111,7 +2193,7 @@ function pickFirst3(...values) {
   return void 0;
 }
 function setBody(params) {
-  return stripUndefined7({
+  return stripUndefined8({
     name: params.name,
     value: params.value,
     type: params.type ?? "api_key",
@@ -2131,8 +2213,8 @@ function setBody(params) {
     metadata: params.metadata
   });
 }
-function listQuery2(params) {
-  return stripUndefined7({
+function listQuery3(params) {
+  return stripUndefined8({
     scope: params.scope,
     type: params.type,
     workspace_id: pickFirst3(params.workspaceId, params.workspace_id),
@@ -2147,14 +2229,14 @@ function listQuery2(params) {
   });
 }
 function rotateBody(params) {
-  return stripUndefined7({
+  return stripUndefined8({
     value: pickFirst3(params.newValue, params.new_value, params.value),
     refresh_token: pickFirst3(params.refreshToken, params.refresh_token),
     expires_at: pickFirst3(params.expiresAt, params.expires_at)
   });
 }
 function bindingBody(params) {
-  return stripUndefined7({
+  return stripUndefined8({
     secret_id: pickFirst3(params.secretId, params.secret_id),
     resource_id: pickFirst3(params.resourceId, params.resource_id),
     resource_type: pickFirst3(params.resourceType, params.resource_type),
@@ -2162,14 +2244,14 @@ function bindingBody(params) {
   });
 }
 function bindingQuery(params) {
-  return stripUndefined7({
+  return stripUndefined8({
     resource_id: pickFirst3(params.resourceId, params.resource_id),
     resource_type: pickFirst3(params.resourceType, params.resource_type),
     secret_id: pickFirst3(params.secretId, params.secret_id)
   });
 }
 function oauthBody(params) {
-  return stripUndefined7({
+  return stripUndefined8({
     provider: params.provider,
     expose_as_env: pickFirst3(params.exposeAsEnv, params.expose_as_env),
     scope: params.scope,
@@ -2256,7 +2338,7 @@ var EgressSecrets = class {
   async list(params = {}) {
     const data = await this.http.get(
       "/egress/secrets",
-      listQuery2(params)
+      listQuery3(params)
     );
     return unwrapList10(data);
   }
@@ -3381,7 +3463,7 @@ function listItems2(payload, candidateKeys = ["data", "cron_jobs", "executions",
   }
   return [];
 }
-function stripUndefined8(input) {
+function stripUndefined9(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -3395,7 +3477,7 @@ var CronJobs = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined8({ ...params });
+    const query = stripUndefined9({ ...params });
     const data = await this.http.get("/cron-jobs", query);
     return listItems2(data);
   }
@@ -3405,7 +3487,7 @@ var CronJobs = class {
   }
   async create(params) {
     const { idempotencyKey: ikey, ...rest } = params;
-    const body = stripUndefined8(rest);
+    const body = stripUndefined9(rest);
     const data = await this.http.request("/cron-jobs", {
       method: "POST",
       body,
@@ -3414,7 +3496,7 @@ var CronJobs = class {
     return unwrap20(data);
   }
   async update(jobId, params) {
-    const body = stripUndefined8(params);
+    const body = stripUndefined9(params);
     const data = await this.http.patch(`/cron-jobs/${jobId}`, body);
     return unwrap20(data);
   }
@@ -3499,7 +3581,7 @@ function listItems3(payload, candidateKeys = ["data", "databases", "items"]) {
   }
   return [];
 }
-function stripUndefined9(input) {
+function stripUndefined10(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -3513,7 +3595,7 @@ var Databases = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined9({ ...params });
+    const query = stripUndefined10({ ...params });
     const data = await this.http.get("/databases", query);
     return listItems3(data);
   }
@@ -3530,7 +3612,7 @@ var Databases = class {
       size: _deprecatedSize,
       ...rest
     } = params;
-    const body = stripUndefined9({
+    const body = stripUndefined10({
       ...rest,
       engine_version: engine_version ?? version
     });
@@ -3573,7 +3655,7 @@ var Databases = class {
     return unwrap22(data);
   }
   async logs(databaseId, params = {}) {
-    const query = stripUndefined9({
+    const query = stripUndefined10({
       lines: params.lines,
       since: params.since
     });
@@ -3616,46 +3698,16 @@ function listItems4(payload, candidateKeys = ["items", "deployments", "versions"
   }
   return [];
 }
-function stripUndefined10(input) {
+function stripUndefined11(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
 }
-function dockerDeployMetadata(metadata, templateId) {
-  return stripUndefined10({
+function dockerDeployMetadata(metadata) {
+  return {
     ...metadata ?? {},
-    deployment_product: "docker_deploy",
-    docker_deploy_template_id: templateId
-  });
-}
-function isRecord(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
-}
-function stringValue(value) {
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function runtimeMetadata(metadata) {
-  const runtime = metadata.runtime;
-  return isRecord(runtime) ? runtime : void 0;
-}
-function publicProbeUrl(publicUrl, probePath) {
-  const url = new URL(publicUrl);
-  const normalizedPath = probePath.startsWith("/") ? probePath : `/${probePath}`;
-  url.pathname = normalizedPath;
-  return url.toString();
-}
-function looksLikeMiosaGatewayJson(body) {
-  try {
-    const parsed = JSON.parse(body);
-    return isRecord(parsed) && parsed.ok === true && typeof parsed.run_id === "string" && Object.keys(parsed).every((key) => ["ok", "run_id"].includes(key));
-  } catch {
-    return false;
-  }
-}
-function addDoctorCheck(checks, name, ok, message, data) {
-  const check = { name, ok, message };
-  if (data !== void 0) check.data = data;
-  checks.push(check);
+    deployment_product: "docker_deploy"
+  };
 }
 var DeploymentVersions = class {
   constructor(http, deploymentId) {
@@ -3665,7 +3717,7 @@ var DeploymentVersions = class {
   http;
   deploymentId;
   async list(params = {}) {
-    const query = stripUndefined10({
+    const query = stripUndefined11({
       state: params.state,
       limit: params.limit,
       cursor: params.cursor,
@@ -3684,7 +3736,7 @@ var DeploymentVersions = class {
     return unwrap23(data);
   }
   async promote(versionId, opts = {}) {
-    const body = stripUndefined10({ environment: opts.environment });
+    const body = stripUndefined11({ environment: opts.environment });
     const data = await this.http.request(
       `/deployments/${this.deploymentId}/versions/${versionId}/promote`,
       {
@@ -3771,7 +3823,7 @@ var DeploymentDomains = class {
       `/deployments/${this.deploymentId}/domains`,
       {
         method: "POST",
-        body: stripUndefined10(body),
+        body: stripUndefined11(body),
         headers: { "Idempotency-Key": idempotencyKey4(params.idempotencyKey) }
       }
     );
@@ -3803,7 +3855,7 @@ var Deployments = class {
   http;
   async list(params = {}) {
     const projectId = params.projectId ?? params.project_id;
-    const query = stripUndefined10({
+    const query = stripUndefined11({
       project_id: projectId,
       state: params.state,
       limit: params.limit,
@@ -3821,7 +3873,7 @@ var Deployments = class {
     return unwrap23(data);
   }
   async create(params) {
-    const body = stripUndefined10({
+    const body = stripUndefined11({
       name: params.name,
       repo_url: params.repoUrl ?? params.repo_url,
       branch: params.branch,
@@ -3829,7 +3881,6 @@ var Deployments = class {
       run_command: params.runCommand ?? params.run_command,
       auto_deploy: params.autoDeploy ?? params.auto_deploy,
       database: params.database,
-      docker_deploy_template_id: params.dockerDeployTemplateId ?? params.docker_deploy_template_id,
       metadata: params.metadata,
       ...attributionBody(params)
     });
@@ -3846,184 +3897,13 @@ var Deployments = class {
    * deployment so the control plane attaches it to the workspace Docker host.
    */
   async createDockerDeploy(params) {
-    const templateId = params.dockerDeployTemplateId ?? params.docker_deploy_template_id;
     return this.create({
       ...params,
-      metadata: dockerDeployMetadata(params.metadata, templateId)
+      metadata: dockerDeployMetadata(params.metadata)
     });
   }
-  async listDockerDeployHosts(params = {}) {
-    const data = await this.http.get(
-      "/docker-deploy/hosts",
-      stripUndefined10({
-        workspace_id: params.workspaceId ?? params.workspace_id
-      })
-    );
-    return listItems4(data, ["hosts", "items"]);
-  }
-  async ensureDockerDeployHost(params) {
-    const data = await this.http.request("/docker-deploy/hosts/ensure", {
-      method: "POST",
-      body: stripUndefined10({
-        workspace_id: params.workspaceId ?? params.workspace_id,
-        region: params.region,
-        size: params.size,
-        appliance_image: params.applianceImage ?? params.appliance_image,
-        metadata: params.metadata
-      }),
-      headers: { "Idempotency-Key": idempotencyKey4(params.idempotencyKey) }
-    });
-    return unwrap23(data);
-  }
-  async getDockerDeployHost(hostId) {
-    const data = await this.http.get(`/docker-deploy/hosts/${hostId}`);
-    return unwrap23(data);
-  }
-  /**
-   * Verify a Docker Deploy deployment end-to-end.
-   *
-   * This checks the deployment product marker, Docker Deploy host linkage,
-   * appliance health, route runtime metadata, and optionally the public URL.
-   * It is intentionally agent-friendly: use this after sandbox.deployDocker()
-   * or createDockerDeploy() before telling a user the app is live.
-   */
-  async doctorDockerDeploy(deploymentId, params = {}) {
-    const checks = [];
-    const deployment = await this.get(deploymentId);
-    const metadata = isRecord(deployment.metadata) ? deployment.metadata : {};
-    const product = stringValue(deployment.deployment_product) ?? stringValue(metadata.deployment_product);
-    const hostId = stringValue(deployment.docker_deploy_host_id) ?? stringValue(metadata.docker_deploy_host_id);
-    addDoctorCheck(
-      checks,
-      "deployment_product",
-      product === "docker_deploy",
-      product === "docker_deploy" ? "Deployment is marked as Docker Deploy." : `Expected deployment_product=docker_deploy, got ${product ?? "missing"}.`,
-      { product: product ?? null }
-    );
-    addDoctorCheck(
-      checks,
-      "docker_deploy_host_id",
-      !!hostId,
-      hostId ? "Deployment is linked to a Docker Deploy appliance host." : "Deployment has no docker_deploy_host_id.",
-      { docker_deploy_host_id: hostId ?? null }
-    );
-    let host;
-    if (hostId) {
-      try {
-        host = await this.getDockerDeployHost(hostId);
-        const status = host.status ?? null;
-        const applianceStatus = host.appliance_status ?? null;
-        const badHostStates = /* @__PURE__ */ new Set(["failed", "error", "destroyed"]);
-        const badApplianceStates = /* @__PURE__ */ new Set(["failed", "error", "unhealthy"]);
-        const ok = !badHostStates.has(String(status)) && !badApplianceStates.has(String(applianceStatus));
-        addDoctorCheck(
-          checks,
-          "docker_deploy_host_health",
-          ok,
-          ok ? "Docker Deploy host is not reporting a failed state." : `Docker Deploy host is unhealthy: status=${status}, appliance_status=${applianceStatus}.`,
-          { status, appliance_status: applianceStatus }
-        );
-      } catch (err) {
-        addDoctorCheck(
-          checks,
-          "docker_deploy_host_health",
-          false,
-          `Could not fetch Docker Deploy host ${hostId}: ${err instanceof Error ? err.message : String(err)}`
-        );
-      }
-    }
-    const runtime = runtimeMetadata(metadata);
-    const runtimeIp = runtime ? stringValue(runtime.ip) ?? stringValue(runtime.ip_address) : void 0;
-    const runtimePort = runtime?.port;
-    addDoctorCheck(
-      checks,
-      "route_runtime",
-      !!runtimeIp && runtimePort !== void 0 && runtimePort !== null,
-      runtimeIp && runtimePort !== void 0 && runtimePort !== null ? "Deployment route metadata points at a runtime target." : "Deployment metadata has no runtime ip/port target.",
-      { ip: runtimeIp ?? null, port: runtimePort ?? null }
-    );
-    const publicUrl = stringValue(deployment.public_url) ?? stringValue(metadata.public_url);
-    addDoctorCheck(
-      checks,
-      "public_url",
-      !!publicUrl,
-      publicUrl ? "Deployment has a public URL." : "Deployment has no public URL to probe.",
-      { public_url: publicUrl ?? null }
-    );
-    let probe;
-    if (params.probe !== false && publicUrl) {
-      const fetchImpl = params.fetchImpl ?? fetch;
-      const url = publicProbeUrl(publicUrl, params.probePath ?? "/");
-      const controller = new AbortController();
-      const timer = setTimeout(() => controller.abort(), params.timeoutMs ?? 2e4);
-      try {
-        const response = await fetchImpl(url, {
-          headers: { Accept: "*/*" },
-          signal: controller.signal
-        });
-        const text = await response.text();
-        const gatewayJson = looksLikeMiosaGatewayJson(text);
-        const ok = response.ok && !gatewayJson;
-        probe = {
-          url,
-          status: response.status,
-          ok,
-          responseSnippet: text.slice(0, 500)
-        };
-        if (gatewayJson) probe.gatewayJson = true;
-        addDoctorCheck(
-          checks,
-          "public_url_probe",
-          ok,
-          ok ? `Public URL returned HTTP ${response.status}.` : gatewayJson ? "Public URL returned MIOSA gateway JSON instead of the app." : `Public URL returned HTTP ${response.status}.`,
-          { status: response.status, gateway_json: gatewayJson }
-        );
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        probe = { url, status: null, ok: false, responseSnippet: message };
-        addDoctorCheck(
-          checks,
-          "public_url_probe",
-          false,
-          `Public URL probe failed: ${message}`
-        );
-      } finally {
-        clearTimeout(timer);
-      }
-    }
-    const result = {
-      ok: checks.every((check) => check.ok),
-      deployment,
-      checks
-    };
-    if (host) result.host = host;
-    if (publicUrl !== void 0) result.publicUrl = publicUrl;
-    if (probe) result.probe = probe;
-    return result;
-  }
-  async listDockerDeployTemplates(params = {}) {
-    const query = {
-      category: params.category,
-      runtime: params.runtime,
-      framework: params.framework,
-      include_preview: params.includePreview ?? params.include_preview
-    };
-    const data = await this.http.get(
-      "/docker-deploy/templates",
-      stripUndefined10(query)
-    );
-    const templates = unwrap23(data);
-    if (Array.isArray(templates)) return templates;
-    return (templates?.templates ?? templates?.items ?? templates?.data ?? []) || [];
-  }
-  async getDockerDeployTemplate(templateId) {
-    const data = await this.http.get(
-      `/docker-deploy/templates/${templateId}`
-    );
-    return unwrap23(data);
-  }
   async update(deploymentId, params) {
-    const body = stripUndefined10({
+    const body = stripUndefined11({
       name: params.name,
       branch: params.branch,
       build_command: params.buildCommand ?? params.build_command,
@@ -4040,19 +3920,11 @@ var Deployments = class {
     await this.http.delete(`/deployments/${deploymentId}`);
   }
   async publish(deploymentId, params) {
-    const body = stripUndefined10({
+    const body = stripUndefined11({
       source_sandbox_id: params.sourceSandboxId ?? params.source_sandbox_id,
       output_path: params.outputPath ?? params.output_path,
       entrypoint: params.entrypoint,
-      promote: params.promote,
-      build_command: params.buildCommand ?? params.build_command,
-      run_command: params.runCommand ?? params.run_command,
-      port: params.port,
-      health_check_path: params.healthCheckPath ?? params.health_check_path,
-      deployment_type: params.deploymentType ?? params.deployment_type,
-      docker_deploy_template_id: params.dockerDeployTemplateId ?? params.docker_deploy_template_id,
-      data_services: params.dataServices ?? params.data_services,
-      ...attributionBody(params)
+      promote: params.promote
     });
     const data = await this.http.request(
       `/deployments/${deploymentId}/publish`,
@@ -4070,22 +3942,14 @@ var Deployments = class {
    * phase. Prefer `publish()` once Phase 2B/3 lands.
    */
   async publishFromSandbox(sandboxId, params = {}) {
-    const body = stripUndefined10({
+    const body = stripUndefined11({
       name: params.name,
       deployment_id: params.deploymentId ?? params.deployment_id,
       output_path: params.outputPath ?? params.output_path,
       source_snapshot_path: params.sourceSnapshotPath ?? params.source_snapshot_path,
       entrypoint: params.entrypoint,
       domain: params.domain,
-      custom_domain: params.customDomain ?? params.custom_domain,
-      build_command: params.buildCommand ?? params.build_command,
-      run_command: params.runCommand ?? params.run_command,
-      port: params.port,
-      health_check_path: params.healthCheckPath ?? params.health_check_path,
-      deployment_type: params.deploymentType ?? params.deployment_type,
-      docker_deploy_template_id: params.dockerDeployTemplateId ?? params.docker_deploy_template_id,
-      data_services: params.dataServices ?? params.data_services,
-      ...attributionBody(params)
+      custom_domain: params.customDomain ?? params.custom_domain
     });
     const data = await this.http.request(
       `/sandboxes/${sandboxId}/deploy`,
@@ -4098,7 +3962,7 @@ var Deployments = class {
     return unwrap23(data);
   }
   async rollback(deploymentId, params = {}) {
-    const body = stripUndefined10({
+    const body = stripUndefined11({
       version_id: params.versionId ?? params.version_id
     });
     const data = await this.http.request(
@@ -4130,7 +3994,7 @@ var Deployments = class {
     return listItems4(data);
   }
   async setEnv(deploymentId, vars, opts = {}) {
-    const body = stripUndefined10({ env: vars, environment: opts.environment });
+    const body = stripUndefined11({ env: vars, environment: opts.environment });
     const data = await this.http.post(
       `/deployments/${deploymentId}/env`,
       body
@@ -4154,205 +4018,89 @@ var Deployments = class {
   }
 };
 
-// src/resources/devices.ts
-var DEVICE_CATALOG = [
-  {
-    kind: "sandbox_worker",
-    label: "Sandbox Worker",
-    purpose: "Isolated Linux workspace for agents to create files, run code, preview apps, snapshot, fork, and publish.",
-    lifecycle: "Persistent by default; use stop/resume/snapshot/fork where the account backend supports saved state.",
-    persistence: "Use one-hour timeouts for interactive builds and checkpoint before long pauses.",
-    primaryCommands: [
-      "miosa.sandboxes.create({ templateId: 'nextjs', timeoutSec: 3600 })",
-      "sandbox.exec.run('codex ...', { cwd: '/workspace' })",
-      "sandbox.files.write('/workspace/app/page.jsx', source)",
-      "miosa.deployments.publishFromSandbox(...)"
-    ],
-    useWhen: [
-      "Coding agents should build inside the remote filesystem.",
-      "You need command execution, file writes, package installs, previews, artifacts, or app publish.",
-      "You want virtual-device behavior without a GUI desktop."
-    ],
-    avoidWhen: [
-      "The workflow requires full browser/desktop control.",
-      "The app is ready for production; publish it to a deployment runtime."
-    ]
-  },
-  {
-    kind: "computer",
-    label: "Computer",
-    purpose: "Durable VM/desktop device for browser automation, CUA sessions, SSH, tunnels, and persistent agent control.",
-    lifecycle: "Managed as a Computer with desktop/browser and operator-style control surfaces.",
-    persistence: "Use checkpoints, volumes, tunnels, and agent sessions for long-lived desktop workflows.",
-    primaryCommands: [
-      "miosa.computers.create({ name: 'browser-agent' })",
-      "computer.exec.run('npm test')",
-      "computer.desktop.open()"
-    ],
-    useWhen: [
-      "The agent needs Chromium or a full desktop.",
-      "The workflow logs into dashboards, fills forms, clicks buttons, or captures screenshots.",
-      "A human and agent share the same persistent machine state."
-    ],
-    avoidWhen: [
-      "Simple code generation/build/test work fits a cheaper sandbox worker.",
-      "You only need durable app hosting."
-    ]
-  },
-  {
-    kind: "local_device",
-    label: "Local Device",
-    purpose: "Developer-owned machine connected through CLI/MCP for local discovery and private tooling.",
-    lifecycle: "Not hosted by MIOSA; the user owns uptime and state.",
-    persistence: "State is local machine state. Do not assume cloud resume semantics.",
-    primaryCommands: ["miosa mcp install", "miosa doctor --json"],
-    useWhen: [
-      "The agent needs local repository discovery before cloud execution.",
-      "The user intentionally wants local private tools."
-    ],
-    avoidWhen: [
-      "Customer code must stay isolated in MIOSA-hosted infrastructure.",
-      "The workflow needs reproducible shared cloud state."
-    ]
-  },
-  {
-    kind: "docker_deploy_host",
-    label: "Docker Deploy Host",
-    purpose: "Workspace appliance VM that runs Docker containers for durable apps published from sandboxes.",
-    lifecycle: "Always-on deployment capacity; not an interactive coding workspace.",
-    persistence: "Versioned releases and routing are durable; edits happen in sandboxes before publish.",
-    primaryCommands: [
-      "miosa sandbox publish <id> --docker-deploy",
-      "miosa deploy --docker-deploy"
-    ],
-    useWhen: [
-      "You need many small apps, APIs, funnels, or client sites in one workspace appliance.",
-      "You want stable public URLs backed by Docker containers."
-    ],
-    avoidWhen: [
-      "Interactive agent work is still happening.",
-      "The app needs the standard MIOSA Deploy runtime."
-    ]
-  }
-];
-var Devices = class {
-  http;
+// src/resources/docker-deploy.ts
+function workspaceId(params) {
+  return params?.workspace_id ?? params?.workspaceId;
+}
+function ensureBody(params) {
+  const body = {};
+  const id = params.workspace_id ?? params.workspaceId;
+  const externalId = params.external_workspace_id ?? params.externalWorkspaceId;
+  if (id) body.workspace_id = id;
+  if (externalId) body.external_workspace_id = externalId;
+  return body;
+}
+function unwrapHost(response) {
+  const host = response.data ?? response.host;
+  if (!host) {
+    throw new Error("Docker Deploy host response was empty.");
+  }
+  return host;
+}
+function unwrapTemplates(response) {
+  return response.data ?? response.templates ?? [];
+}
+function unwrapTemplate(response) {
+  const template = response.data ?? response.template;
+  if (!template) {
+    throw new Error("Docker Deploy template response was empty.");
+  }
+  return template;
+}
+var DockerDeploy = class {
   constructor(http) {
     this.http = http;
   }
+  http;
   /**
-   * Return the static device catalog used by orchestration apps to choose the
-   * right MIOSA execution surface before creating resources.
+   * List Docker Deploy appliance hosts scoped to the current tenant.
+   *
+   * Pass a workspace ID to inspect the dedicated always-on appliance machine
+   * for one white-label workspace.
    */
-  catalog() {
-    return DEVICE_CATALOG.map((entry) => ({ ...entry }));
+  async listHosts(params = {}) {
+    const res = await this.http.get(
+      "/docker-deploy/hosts",
+      { workspace_id: workspaceId(params) }
+    );
+    return res.data ?? res.hosts ?? [];
   }
   /**
-   * List hosted devices by normalizing existing sandboxes and computers.
-   * Partial backend failures are returned in `errors` so orchestration UIs can
-   * still show usable inventory instead of failing the whole page.
+   * Ensure a workspace has its dedicated Docker Deploy appliance host.
+   *
+   * The host may still be `pending`, `provisioning`, or `bootstrapping` after
+   * this call. Treat `status === "active"` and `appliance_status === "healthy"`
+   * as the ready condition before sending app/container traffic to it.
    */
-  async list(params = {}) {
-    const kind = normalizeKind(params.kind ?? "all");
-    const devices = [];
-    const errors = [];
-    if (kind === "all" || kind === "sandbox_worker") {
-      try {
-        const sandboxes = await this.http.get("/sandboxes");
-        devices.push(...unwrapList11(sandboxes, ["sandboxes"]).map(normalizeSandbox));
-      } catch (err) {
-        errors.push(toListError("sandboxes", err));
-      }
-    }
-    if (kind === "all" || kind === "computer") {
-      try {
-        const computers = await this.http.get("/computers");
-        devices.push(...unwrapList11(computers, ["computers"]).map(normalizeComputer));
-      } catch (err) {
-        errors.push(toListError("computers", err));
-      }
-    }
-    return { devices, errors };
+  async ensureHost(params = {}) {
+    const res = await this.http.post(
+      "/docker-deploy/hosts/ensure",
+      ensureBody(params)
+    );
+    return { host: unwrapHost(res), queued: res.queued ?? false };
   }
-};
-function normalizeKind(kind) {
-  if (kind === "all") return "all";
-  if (kind === "sandbox" || kind === "sandbox_worker") {
-    return "sandbox_worker";
-  }
-  if (kind === "computer") return "computer";
-  throw new Error(`Unsupported device kind: ${kind}`);
-}
-function normalizeSandbox(row) {
-  return compactRecord({
-    id: stringField(row, "id"),
-    kind: "sandbox_worker",
-    source: "sandboxes",
-    name: optionalString(row, "name"),
-    state: optionalString(row, "state") ?? optionalString(row, "status"),
-    ready: optionalBoolean(row, "ready"),
-    persistent: optionalBoolean(row, "persistent"),
-    alwaysOn: optionalBoolean(row, "always_on"),
-    template: optionalString(row, "template_id") ?? optionalString(row, "template"),
-    previewUrl: optionalString(row, "preview_url"),
-    timeoutRemainingMs: optionalNumber(row, "timeout_remaining_ms")
-  });
-}
-function normalizeComputer(row) {
-  return compactRecord({
-    id: stringField(row, "id"),
-    kind: "computer",
-    source: "computers",
-    name: optionalString(row, "name"),
-    state: optionalString(row, "status") ?? optionalString(row, "state"),
-    ready: optionalBoolean(row, "ready"),
-    region: optionalString(row, "region"),
-    template: optionalString(row, "template_type") ?? optionalString(row, "template")
-  });
-}
-function compactRecord(record) {
-  return Object.fromEntries(
-    Object.entries(record).filter(([, value]) => value !== void 0)
-  );
-}
-function unwrapList11(payload, keys) {
-  const value = isRecord2(payload) && "data" in payload ? payload.data : payload;
-  if (Array.isArray(value)) return value.filter(isRecord2);
-  if (isRecord2(value)) {
-    for (const key of keys) {
-      const nested = value[key];
-      if (Array.isArray(nested)) return nested.filter(isRecord2);
-    }
+  /** Fetch one Docker Deploy host by ID. */
+  async getHost(hostId) {
+    const res = await this.http.get(
+      `/docker-deploy/hosts/${hostId}`
+    );
+    return unwrapHost(res);
   }
-  return [];
-}
-function toListError(source, err) {
-  const message = err instanceof Error ? err.message : String(err);
-  return {
-    source,
-    message,
-    retryable: /fetch failed|ECONNRESET|HTTP 502|other side closed|socket hang up|bad gateway/i.test(
-      message
-    )
-  };
-}
-function stringField(row, key) {
-  const value = row[key];
-  return typeof value === "string" ? value : String(value ?? "");
-}
-function optionalString(row, key) {
-  const value = row[key];
-  return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-function optionalBoolean(row, key) {
-  return typeof row[key] === "boolean" ? row[key] : void 0;
-}
-function optionalNumber(row, key) {
-  return typeof row[key] === "number" ? row[key] : void 0;
-}
-function isRecord2(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
+  /** List Docker Deploy starter templates. */
+  async listTemplates() {
+    const res = await this.http.get(
+      "/docker-deploy/templates"
+    );
+    return unwrapTemplates(res);
+  }
+  /** Fetch one Docker Deploy starter template by ID. */
+  async getTemplate(templateId) {
+    const res = await this.http.get(
+      `/docker-deploy/templates/${encodeURIComponent(templateId)}`
+    );
+    return unwrapTemplate(res);
+  }
+};
 
 // src/resources/email.ts
 function unwrap24(data) {
@@ -4371,7 +4119,7 @@ function unwrap24(data) {
   }
   return data;
 }
-function unwrapList12(data) {
+function unwrapList11(data) {
   if (Array.isArray(data)) return data;
   if (data && typeof data === "object") {
     const d = data;
@@ -4399,7 +4147,7 @@ var EmailCampaigns = class {
   }
   http;
   async list(filters = {}) {
-    return unwrapList12(
+    return unwrapList11(
       await this.http.get(
         "/admin/email-campaigns",
         filters
@@ -4435,7 +4183,7 @@ var EmailCampaigns = class {
     );
   }
   async deliveries(campaignId, filters = {}) {
-    return unwrapList12(
+    return unwrapList11(
       await this.http.get(
         `/admin/email-campaigns/${campaignId}/deliveries`,
         filters
@@ -4449,7 +4197,7 @@ var EmailTemplates = class {
   }
   http;
   async list(filters = {}) {
-    return unwrapList12(
+    return unwrapList11(
       await this.http.get("/admin/email-templates", filters)
     );
   }
@@ -4481,7 +4229,7 @@ var EmailInbox = class {
   }
   http;
   async list(filters = {}) {
-    return unwrapList12(
+    return unwrapList11(
       await this.http.get("/admin/email-inbox", filters)
     );
   }
@@ -4545,7 +4293,7 @@ function unwrap25(payload) {
   }
   return payload;
 }
-function stripUndefined11(input) {
+function stripUndefined12(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -4564,7 +4312,7 @@ var ExternalKeys = class {
   }
   /** Create / register an external provider key. */
   async create(params) {
-    const body = stripUndefined11(params);
+    const body = stripUndefined12(params);
     const data = await this.http.post("/external-keys", body);
     return unwrap25(data);
   }
@@ -4599,7 +4347,7 @@ function listItems5(payload, candidateKeys = ["data", "domains", "items"]) {
   }
   return [];
 }
-function stripUndefined12(input) {
+function stripUndefined13(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -4613,7 +4361,7 @@ var FlatCustomDomains = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined12({ ...params });
+    const query = stripUndefined13({ ...params });
     const data = await this.http.get("/custom-domains", query);
     return listItems5(data);
   }
@@ -4625,7 +4373,7 @@ var FlatCustomDomains = class {
       redirectPolicy,
       ...rest
     } = params;
-    const body = stripUndefined12({
+    const body = stripUndefined13({
       ...rest,
       resource_type: resourceType ?? rest.resource_type,
       resource_id: resourceId ?? rest.resource_id,
@@ -4658,7 +4406,7 @@ function listItems6(payload, candidateKeys = ["data", "functions", "items"]) {
   }
   return [];
 }
-function stripUndefined13(input) {
+function stripUndefined14(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -4672,7 +4420,7 @@ var Functions = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined13({ ...params });
+    const query = stripUndefined14({ ...params });
     const data = await this.http.get("/functions", query);
     return listItems6(data);
   }
@@ -4682,7 +4430,7 @@ var Functions = class {
   }
   async create(params) {
     const { idempotencyKey: ikey, memoryMb, timeoutSec, ...rest } = params;
-    const body = stripUndefined13({
+    const body = stripUndefined14({
       ...rest,
       memory_mb: memoryMb ?? rest.memory_mb,
       timeout_sec: timeoutSec ?? rest.timeout_sec
@@ -4696,7 +4444,7 @@ var Functions = class {
   }
   async update(functionId, params) {
     const { memoryMb, timeoutSec, ...rest } = params;
-    const body = stripUndefined13({
+    const body = stripUndefined14({
       ...rest,
       memory_mb: memoryMb ?? rest.memory_mb,
       timeout_sec: timeoutSec ?? rest.timeout_sec
@@ -4742,7 +4490,7 @@ function listItems7(payload, candidateKeys = ["data", "health_checks", "items"])
   }
   return [];
 }
-function stripUndefined14(input) {
+function stripUndefined15(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -4756,7 +4504,7 @@ var HealthChecks = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined14({ ...params });
+    const query = stripUndefined15({ ...params });
     const data = await this.http.get("/health-checks", query);
     return listItems7(data);
   }
@@ -4772,7 +4520,7 @@ var HealthChecks = class {
       expectedStatus,
       ...rest
     } = params;
-    const body = stripUndefined14({
+    const body = stripUndefined15({
       ...rest,
       interval_sec: intervalSec ?? rest.interval_sec,
       timeout_sec: timeoutSec ?? rest.timeout_sec,
@@ -4787,7 +4535,7 @@ var HealthChecks = class {
   }
   async update(checkId, params) {
     const { intervalSec, timeoutSec, expectedStatus, ...rest } = params;
-    const body = stripUndefined14({
+    const body = stripUndefined15({
       ...rest,
       interval_sec: intervalSec ?? rest.interval_sec,
       timeout_sec: timeoutSec ?? rest.timeout_sec,
@@ -4819,7 +4567,7 @@ function listItems8(payload) {
   if (Array.isArray(result)) return result;
   return [];
 }
-function stripUndefined15(input) {
+function stripUndefined16(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -4871,7 +4619,7 @@ var Integrations = class {
   // ── Test hooks ─────────────────────────────────────────────────────────────
   /** Send a test message to the connected Slack channel. */
   async slackSendTest(params = {}) {
-    const body = stripUndefined15(params);
+    const body = stripUndefined16(params);
     const data = await this.http.post(
       "/integrations/slack/send-test",
       body
@@ -4880,7 +4628,7 @@ var Integrations = class {
   }
   /** Send a test message to the connected Discord channel. */
   async discordSendTest(params = {}) {
-    const body = stripUndefined15(params);
+    const body = stripUndefined16(params);
     const data = await this.http.post(
       "/integrations/discord/send-test",
       body
@@ -4895,7 +4643,7 @@ var Integrations = class {
   }
   /** Create a Linear issue via the connected workspace. */
   async linearCreateIssue(params = {}) {
-    const body = stripUndefined15(params);
+    const body = stripUndefined16(params);
     const data = await this.http.post(
       "/integrations/linear/create-issue",
       body
@@ -4914,7 +4662,7 @@ function unwrap30(payload) {
   }
   return payload;
 }
-function stripUndefined16(input) {
+function stripUndefined17(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -4926,7 +4674,7 @@ var Mcp = class {
   http;
   /** Send a JSON-RPC request to the MCP endpoint. */
   async dispatch(params = {}) {
-    const body = stripUndefined16(params);
+    const body = stripUndefined17(params);
     const data = await this.http.post(
       "/mcp",
       Object.keys(body).length > 0 ? body : void 0
@@ -5505,49 +5253,49 @@ var OcWorkspaces = class {
   /**
    * Fetch a single workspace.
    */
-  async get(hostId, workspaceId) {
+  async get(hostId, workspaceId2) {
     return this.http.get(
-      `${this.base(hostId)}/${workspaceId}`
+      `${this.base(hostId)}/${workspaceId2}`
     );
   }
   /**
    * Update workspace metadata (name, branch).
    */
-  async update(hostId, workspaceId, params) {
+  async update(hostId, workspaceId2, params) {
     return this.http.patch(
-      `${this.base(hostId)}/${workspaceId}`,
+      `${this.base(hostId)}/${workspaceId2}`,
       params
     );
   }
   /**
    * Delete a workspace.
    */
-  async delete(hostId, workspaceId) {
-    return this.http.delete(`${this.base(hostId)}/${workspaceId}`);
+  async delete(hostId, workspaceId2) {
+    return this.http.delete(`${this.base(hostId)}/${workspaceId2}`);
   }
   /**
    * Pull the latest changes from the remote repository.
    */
-  async pull(hostId, workspaceId) {
+  async pull(hostId, workspaceId2) {
     return this.http.post(
-      `${this.base(hostId)}/${workspaceId}/pull`
+      `${this.base(hostId)}/${workspaceId2}/pull`
     );
   }
   /**
    * Open a terminal session scoped to the workspace root directory.
    * Returns a short-lived WebSocket ticket.
    */
-  async openTerminal(hostId, workspaceId) {
+  async openTerminal(hostId, workspaceId2) {
     return this.http.post(
-      `${this.base(hostId)}/${workspaceId}/open-terminal`
+      `${this.base(hostId)}/${workspaceId2}/open-terminal`
     );
   }
   /**
    * Stream workspace setup / clone / install events.
    */
-  events(hostId, workspaceId) {
+  events(hostId, workspaceId2) {
     return this.http.stream(
-      `${this.base(hostId)}/${workspaceId}/events`
+      `${this.base(hostId)}/${workspaceId2}/events`
     );
   }
 };
@@ -5601,7 +5349,7 @@ function resourcePayload(params) {
   return { resource_type, resource_id };
 }
 function authConfig(params) {
-  return stripUndefined17({
+  return stripUndefined18({
     ...params.config ?? {},
     signup_enabled: params.signup_enabled ?? params.signupEnabled,
     email_confirm_required: params.email_confirm_required ?? params.emailConfirmRequired,
@@ -5609,7 +5357,7 @@ function authConfig(params) {
   });
 }
 function requestBody(params) {
-  return stripUndefined17({
+  return stripUndefined18({
     ...resourcePayload(params),
     config: authConfig(params)
   });
@@ -5623,7 +5371,7 @@ function unwrap32(payload) {
   }
   return payload;
 }
-function stripUndefined17(input) {
+function stripUndefined18(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -5678,7 +5426,7 @@ function listItems9(payload) {
   if (Array.isArray(result)) return result;
   return [];
 }
-function stripUndefined18(input) {
+function stripUndefined19(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -5695,7 +5443,7 @@ var ProjectIntegrations = class {
   http;
   /** List project integrations. */
   async list(params = {}) {
-    const query = stripUndefined18(params);
+    const query = stripUndefined19(params);
     const data = await this.http.get("/project-integrations", query);
     return listItems9(data);
   }
@@ -5859,6 +5607,10 @@ function encodeContent(content) {
   return btoa(bin);
 }
 var SANDBOX_TEMPLATE = "miosa-sandbox";
+var AGENT_WORKSPACE_TIMEOUT_SEC = 86400;
+var AGENT_WORKSPACE_IDLE_TIMEOUT_SEC = 1800;
+var AGENT_WORKSPACE_SNAPSHOT_EXPIRATION_DAYS = 30;
+var AGENT_WORKSPACE_KEEP_LAST_SNAPSHOTS = 1;
 function unwrap36(payload) {
   if (payload !== null && typeof payload === "object" && "data" in payload && payload.data !== void 0) {
     return payload.data;
@@ -5873,19 +5625,30 @@ function listItems11(payload) {
   if ("items" in payload && Array.isArray(payload.items)) return payload.items;
   return [];
 }
-function createBody(params = {}) {
+function createBody2(params = {}) {
   const templateId = params.templateId ?? params.template_id ?? params.image ?? SANDBOX_TEMPLATE;
-  return stripUndefined19({
+  const persistent = params.persistent;
+  const snapshotExpirationSec = snapshotExpirationSeconds(params);
+  const keepLastSnapshots = params.keepLastSnapshots ?? params.keep_last_snapshots;
+  const metadata = { ...params.metadata ?? {} };
+  if (persistent !== void 0) metadata.miosa_persistent = persistent;
+  if (snapshotExpirationSec !== void 0) {
+    metadata.snapshot_expiration_sec = snapshotExpirationSec;
+  }
+  if (keepLastSnapshots !== void 0) {
+    metadata.keep_last_snapshots = keepLastSnapshots;
+  }
+  return stripUndefined20({
     template_id: templateId,
     cpu_count: params.cpuCount ?? params.cpu_count,
     memory_mb: params.memoryMb ?? params.memory_mb,
     disk_mb: params.diskMb ?? params.disk_mb,
     disk_size_mb: params.diskSizeMb ?? params.disk_size_mb,
-    timeout_sec: params.timeoutSec ?? params.timeout_sec,
-    idle_timeout_sec: params.idleTimeoutSec ?? params.idle_timeout_sec,
+    timeout_sec: params.timeoutSec ?? params.timeout_sec ?? (persistent === true ? 86400 : void 0),
+    idle_timeout_sec: params.idleTimeoutSec ?? params.idle_timeout_sec ?? (persistent === true ? 1800 : void 0),
     always_on: params.alwaysOn ?? params.always_on,
     env: params.env,
-    metadata: params.metadata,
+    metadata: Object.keys(metadata).length > 0 ? metadata : void 0,
     services: params.services,
     readiness_probe: params.readinessProbe ?? params.readiness_probe,
     database: params.database,
@@ -5903,18 +5666,24 @@ function createBody(params = {}) {
   });
 }
 function execBody(command, options = {}) {
-  return stripUndefined19({
+  return stripUndefined20({
     command,
     cwd: options.cwd ?? options.workingDir ?? options.working_dir,
     env: options.env,
     timeout: options.timeout ?? options.timeoutSec ?? options.timeout_sec
   });
 }
-function stripUndefined19(input) {
+function stripUndefined20(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, value]) => value !== void 0)
   );
 }
+function snapshotExpirationSeconds(params) {
+  const seconds = params.snapshotExpirationSec ?? params.snapshot_expiration_sec;
+  if (seconds !== void 0) return seconds;
+  const days = params.snapshotExpirationDays ?? params.snapshot_expiration_days;
+  return days === void 0 ? void 0 : days * 86400;
+}
 var SandboxCommands = class {
   constructor(sandbox) {
     this.sandbox = sandbox;
@@ -6412,10 +6181,25 @@ var Sandbox = class _Sandbox {
    * PATCH /api/v1/sandboxes/{id} — update mutable sandbox fields.
    */
   async update(params) {
-    const body = {};
-    for (const [k, v] of Object.entries(params)) {
-      if (v !== void 0) body[k] = v;
+    const snapshotExpirationSec = snapshotExpirationSeconds(params);
+    const metadata = { ...params.metadata ?? {} };
+    if (params.persistent !== void 0) metadata.miosa_persistent = params.persistent;
+    if (snapshotExpirationSec !== void 0) {
+      metadata.snapshot_expiration_sec = snapshotExpirationSec;
+    }
+    const keepLastSnapshots = params.keepLastSnapshots ?? params.keep_last_snapshots;
+    if (keepLastSnapshots !== void 0) {
+      metadata.keep_last_snapshots = keepLastSnapshots;
     }
+    const body = stripUndefined20({
+      name: params.name,
+      slug: params.slug,
+      tags: params.tags,
+      metadata: Object.keys(metadata).length > 0 ? metadata : void 0,
+      always_on: params.always_on ?? params.alwaysOn,
+      timeout_sec: params.timeout_sec ?? params.timeoutSec,
+      idle_timeout_sec: params.idle_timeout_sec ?? params.idleTimeoutSec
+    });
     const data = unwrap36(
       await this.http.patch(
         `/sandboxes/${this.id}`,
@@ -6425,6 +6209,16 @@ var Sandbox = class _Sandbox {
     this.data = data;
     return this;
   }
+  async extend(timeoutSec) {
+    const data = unwrap36(
+      await this.http.post(
+        `/sandboxes/${this.id}/extend`,
+        { timeout_sec: timeoutSec }
+      )
+    );
+    this.data = data;
+    return this;
+  }
   /**
    * POST /api/v1/sandboxes/{id}/preview-token → {token, url, expires_at, scope}
    */
@@ -6462,7 +6256,7 @@ var Sandbox = class _Sandbox {
     const idempotencyKey11 = params.idempotencyKey ?? params.idempotency_key;
     const requestOptions = {
       method: "POST",
-      body: stripUndefined19({
+      body: stripUndefined20({
         name: params.name,
         deployment_id: params.deploymentId ?? params.deployment_id,
         output_path: params.outputPath ?? params.output_path ?? params.path ?? params.sourcePath ?? params.source_path,
@@ -6474,7 +6268,6 @@ var Sandbox = class _Sandbox {
         port: params.port,
         health_check_path: params.healthCheckPath ?? params.health_check_path,
         deployment_type: params.deploymentType ?? params.deployment_type,
-        docker_deploy_template_id: params.dockerDeployTemplateId ?? params.docker_deploy_template_id,
         type: params.type,
         mode: params.mode,
         database: params.database,
@@ -6628,11 +6421,37 @@ var Sandboxes = class {
     this.http = http;
   }
   http;
+  /**
+   * Create a persistent agent workspace.
+   *
+   * This is the preferred entry point for AI builders, coding agents, and
+   * product workspaces. It gives the sandbox a stable name, a longer interactive
+   * timeout, and metadata that makes the workspace easy to identify later. The
+   * agent should create/edit files in `/workspace`, run installs/tests/builds
+   * inside the sandbox, expose previews from the sandbox, and publish from the
+   * sandbox when ready.
+   */
+  async createAgentWorkspace(params) {
+    const metadata = {
+      ...params.metadata ?? {},
+      miosa_workspace_kind: "agent_workspace"
+    };
+    return this.getOrCreate({
+      persistent: true,
+      timeoutSec: AGENT_WORKSPACE_TIMEOUT_SEC,
+      idleTimeoutSec: AGENT_WORKSPACE_IDLE_TIMEOUT_SEC,
+      snapshotExpirationDays: AGENT_WORKSPACE_SNAPSHOT_EXPIRATION_DAYS,
+      keepLastSnapshots: AGENT_WORKSPACE_KEEP_LAST_SNAPSHOTS,
+      waitUntilReady: true,
+      ...params,
+      metadata
+    });
+  }
   async create(params = {}) {
     const idempotencyKey11 = params.idempotencyKey ?? params.idempotency_key;
     const requestOptions = {
       method: "POST",
-      body: createBody(params)
+      body: createBody2(params)
     };
     if (idempotencyKey11) {
       requestOptions.headers = { "Idempotency-Key": idempotencyKey11 };
@@ -6664,6 +6483,37 @@ var Sandboxes = class {
   connect(id) {
     return this.get(id);
   }
+  async getByName(name) {
+    const data = unwrap36(
+      await this.http.get(
+        `/sandboxes/by-name/${encodeURIComponent(name)}`
+      )
+    );
+    return new Sandbox(this.http, data);
+  }
+  /**
+   * Idempotently obtain a persistent sandbox by stable name.
+   *
+   * If the sandbox exists, it is returned. If it is paused and `resume !== false`,
+   * it is resumed first. If it does not exist, it is created with the supplied
+   * params. Destroyed sandboxes are permanent and are not resumed by this helper.
+   */
+  async getOrCreate(params) {
+    let sandbox;
+    try {
+      sandbox = await this.getByName(params.name);
+    } catch (error) {
+      if (!(error instanceof NotFoundError)) throw error;
+      sandbox = await this.create(params);
+    }
+    if (sandbox.state === "paused" && params.resume !== false) {
+      await sandbox.resume();
+    }
+    if (params.waitUntilReady === true) {
+      await sandbox.waitUntilReady({ timeout: params.waitTimeoutSec ?? 60 });
+    }
+    return sandbox;
+  }
   async delete(id) {
     await this.http.delete(`/sandboxes/${id}`);
   }
@@ -6691,7 +6541,7 @@ var Sandboxes = class {
   async createTemplate(params) {
     const response = await this.http.post(
       "/sandbox-templates",
-      stripUndefined19({
+      stripUndefined20({
         name: params.name,
         slug: params.slug,
         description: params.description,
@@ -6704,7 +6554,7 @@ var Sandboxes = class {
   async createTemplateBuild(templateId, params = {}) {
     const response = await this.http.post(
       `/sandbox-templates/${templateId}/builds`,
-      stripUndefined19({
+      stripUndefined20({
         build_spec: params.buildSpec ?? params.build_spec,
         metadata: params.metadata
       })
@@ -6749,7 +6599,7 @@ function listItems12(payload, candidateKeys = ["data", "templates", "builds", "i
   }
   return [];
 }
-function stripUndefined20(input) {
+function stripUndefined21(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -6786,7 +6636,7 @@ var SandboxTemplates = class {
       name,
       ...rest
     } = params;
-    const body = stripUndefined20({
+    const body = stripUndefined21({
       name,
       build_spec: buildSpec ?? build_spec,
       ...rest
@@ -6820,7 +6670,7 @@ var SandboxTemplates = class {
   }
   async createBuild(templateId, params = {}) {
     const { idempotencyKey: ikey, ...rest } = params;
-    const body = stripUndefined20(rest);
+    const body = stripUndefined21(rest);
     const data = await this.http.request(
       `/sandbox-templates/${templateId}/builds`,
       {
@@ -6854,7 +6704,7 @@ function listItems13(payload) {
   if (Array.isArray(result)) return result;
   return [];
 }
-function stripUndefined21(input) {
+function stripUndefined22(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -6871,7 +6721,7 @@ var Settings = class {
   }
   /** Update tenant settings. */
   async update(params) {
-    const body = stripUndefined21(params);
+    const body = stripUndefined22(params);
     const data = await this.http.put("/settings", body);
     return unwrap38(data);
   }
@@ -6883,7 +6733,7 @@ var Settings = class {
   }
   /** Update tenant branding. */
   async updateBranding(params) {
-    const body = stripUndefined21(params);
+    const body = stripUndefined22(params);
     const data = await this.http.put("/settings/branding", body);
     return unwrap38(data);
   }
@@ -6916,7 +6766,7 @@ var Settings = class {
   }
   /** Create or update a BYOK provider key. */
   async upsertProviderKey(provider, params) {
-    const body = stripUndefined21(params);
+    const body = stripUndefined22(params);
     const data = await this.http.put(
       `/settings/provider-keys/${provider}`,
       body
@@ -6939,7 +6789,7 @@ function unwrap39(data) {
   }
   return data;
 }
-function unwrapList13(data) {
+function unwrapList12(data) {
   if (Array.isArray(data)) return data;
   if (data && typeof data === "object") {
     const d = data;
@@ -6958,7 +6808,7 @@ var SnapshotsStandalone = class {
     const query = Object.fromEntries(
       Object.entries(filters).filter(([, v]) => v !== void 0)
     );
-    return unwrapList13(await this.http.get("/admin/snapshots", query));
+    return unwrapList12(await this.http.get("/admin/snapshots", query));
   }
   async get(snapshotId) {
     return unwrap39(
@@ -6984,7 +6834,7 @@ function listItems14(payload, candidateKeys = ["data", "buckets", "objects", "it
   }
   return [];
 }
-function stripUndefined22(input) {
+function stripUndefined23(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -7001,7 +6851,7 @@ var Storage = class {
   }
   async createBucket(params) {
     const { name, public: isPublic, visibility, ...rest } = params;
-    const body = stripUndefined22({
+    const body = stripUndefined23({
       name,
       visibility: visibility ?? (isPublic === void 0 ? void 0 : isPublic ? "public" : "private"),
       ...rest
@@ -7018,7 +6868,7 @@ var Storage = class {
   }
   // ── Objects ────────────────────────────────────────────────────────────────
   async listObjects(bucketId, params = {}) {
-    const query = stripUndefined22({
+    const query = stripUndefined23({
       prefix: params.prefix,
       max_keys: params.max_keys ?? params.maxKeys ?? params.limit,
       marker: params.marker ?? params.cursor
@@ -7052,7 +6902,7 @@ var Storage = class {
   // ── Presigned URLs ─────────────────────────────────────────────────────────
   async presign(bucketId, params) {
     const operationMethod = params.operation === "put" ? "PUT" : params.operation === "get" ? "GET" : void 0;
-    const body = stripUndefined22({
+    const body = stripUndefined23({
       key: params.key,
       method: params.method ?? operationMethod ?? "GET",
       expires_in: params.expiresIn ?? params.expires_in ?? params.expiresInSec ?? params.expires_in_sec ?? 3600
@@ -7182,7 +7032,7 @@ function unwrap42(payload) {
   }
   return payload;
 }
-function stripUndefined23(input) {
+function stripUndefined24(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -7199,7 +7049,7 @@ var Usage = class {
   }
   /** List per-session metering events. */
   async sessions(params = {}) {
-    const query = stripUndefined23(params);
+    const query = stripUndefined24(params);
     const data = await this.http.get("/usage/sessions", query);
     const result = unwrap42(data);
     if (Array.isArray(result)) return result;
@@ -7207,7 +7057,7 @@ var Usage = class {
   }
   /** Get a usage report for a period. */
   async report(params = {}) {
-    const query = stripUndefined23(params);
+    const query = stripUndefined24(params);
     const data = await this.http.get("/usage/summary", query);
     return unwrap42(data);
   }
@@ -7228,7 +7078,7 @@ function listItems15(payload, candidateKeys = ["data", "volumes", "items"]) {
   }
   return [];
 }
-function stripUndefined24(input) {
+function stripUndefined25(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -7242,7 +7092,7 @@ var Volumes = class {
   }
   http;
   async list(params = {}) {
-    const query = stripUndefined24({ ...params });
+    const query = stripUndefined25({ ...params });
     const data = await this.http.get("/volumes", query);
     return listItems15(data);
   }
@@ -7252,7 +7102,7 @@ var Volumes = class {
   }
   async create(params) {
     const { idempotencyKey: ikey, sizeGb, ...rest } = params;
-    const body = stripUndefined24({
+    const body = stripUndefined25({
       ...rest,
       size_gb: sizeGb ?? rest.size_gb
     });
@@ -7283,7 +7133,7 @@ function listItems16(payload, candidateKeys = ["data", "webhooks", "deliveries",
   }
   return [];
 }
-function stripUndefined25(input) {
+function stripUndefined26(input) {
   return Object.fromEntries(
     Object.entries(input).filter(([, v]) => v !== void 0)
   );
@@ -7291,53 +7141,13 @@ function stripUndefined25(input) {
 function idempotencyKey10(key) {
   return key ?? randomUUID();
 }
-function parseSignatureHeader(header) {
-  const parts = header.split(",").map((part) => part.trim());
-  let timestamp = null;
-  const signatures = [];
-  for (const part of parts) {
-    const [key, value] = part.split("=", 2);
-    if (!key || !value) continue;
-    if (key === "t") {
-      const parsed = Number(value);
-      if (Number.isFinite(parsed)) timestamp = parsed;
-    } else if (key === "v1") {
-      signatures.push(value);
-    }
-  }
-  if (timestamp == null || signatures.length === 0) return null;
-  return { timestamp, signatures };
-}
-function verifySignature(body, header, secret, options = {}) {
-  const parsed = parseSignatureHeader(header);
-  if (!parsed) return false;
-  const toleranceSeconds = options.toleranceSeconds ?? 300;
-  const ageSeconds = Math.abs(Math.floor(Date.now() / 1e3) - parsed.timestamp);
-  if (ageSeconds > toleranceSeconds) {
-    throw new Error("Webhook signature timestamp is too old");
-  }
-  const bodyBuffer = Buffer.isBuffer(body) ? body : Buffer.from(body);
-  const signedPayload = Buffer.concat([
-    Buffer.from(`${parsed.timestamp}.`),
-    bodyBuffer
-  ]);
-  const expected = createHmac("sha256", secret).update(signedPayload).digest("hex");
-  const expectedBuffer = Buffer.from(expected, "hex");
-  return parsed.signatures.some((signature) => {
-    const actualBuffer = Buffer.from(signature, "hex");
-    if (actualBuffer.length !== expectedBuffer.length) return false;
-    return timingSafeEqual(actualBuffer, expectedBuffer);
-  });
-}
 var Webhooks = class {
   constructor(http) {
     this.http = http;
   }
   http;
-  static verifySignature = verifySignature;
-  static verify_signature = verifySignature;
   async list(params = {}) {
-    const query = stripUndefined25({ ...params });
+    const query = stripUndefined26({ ...params });
     const data = await this.http.get("/webhooks", query);
     return listItems16(data);
   }
@@ -7347,7 +7157,7 @@ var Webhooks = class {
   }
   async create(params) {
     const { idempotencyKey: ikey, ...rest } = params;
-    const body = stripUndefined25(rest);
+    const body = stripUndefined26(rest);
     const data = await this.http.request("/webhooks", {
       method: "POST",
       body,
@@ -7356,7 +7166,7 @@ var Webhooks = class {
     return unwrap44(data);
   }
   async update(webhookId, params) {
-    const body = stripUndefined25(params);
+    const body = stripUndefined26(params);
     const data = await this.http.patch(`/webhooks/${webhookId}`, body);
     return unwrap44(data);
   }
@@ -7400,9 +7210,9 @@ var WorkspaceInvites = class {
    *
    * `POST /workspaces/:id/invites`
    */
-  async create(workspaceId, params) {
+  async create(workspaceId2, params) {
     return this.http.post(
-      `/workspaces/${workspaceId}/invites`,
+      `/workspaces/${workspaceId2}/invites`,
       params
     );
   }
@@ -7411,9 +7221,9 @@ var WorkspaceInvites = class {
    *
    * `GET /workspaces/:id/invites`
    */
-  async list(workspaceId) {
+  async list(workspaceId2) {
     const res = await this.http.get(
-      `/workspaces/${workspaceId}/invites`
+      `/workspaces/${workspaceId2}/invites`
     );
     return res.data ?? [];
   }
@@ -7425,9 +7235,9 @@ var WorkspaceInvites = class {
    *
    * `DELETE /workspaces/:id/invites/:invite_id`
    */
-  async revoke(workspaceId, inviteId) {
+  async revoke(workspaceId2, inviteId) {
     return this.http.delete(
-      `/workspaces/${workspaceId}/invites/${inviteId}`
+      `/workspaces/${workspaceId2}/invites/${inviteId}`
     );
   }
   /**
@@ -7481,9 +7291,9 @@ var WorkspaceMembers = class {
    *
    * `GET /workspaces/:id/members`
    */
-  async list(workspaceId) {
+  async list(workspaceId2) {
     const res = await this.http.get(
-      `/workspaces/${workspaceId}/members`
+      `/workspaces/${workspaceId2}/members`
     );
     return res.data ?? res;
   }
@@ -7499,9 +7309,9 @@ var WorkspaceMembers = class {
    * @throws `MiosaError` with code `NOT_TENANT_MEMBER` if the user is not an
    *   org member.
    */
-  async add(workspaceId, params) {
+  async add(workspaceId2, params) {
     const res = await this.http.post(
-      `/workspaces/${workspaceId}/members`,
+      `/workspaces/${workspaceId2}/members`,
       params
     );
     return res.data ?? res;
@@ -7511,9 +7321,9 @@ var WorkspaceMembers = class {
    *
    * `PATCH /workspaces/:id/members/:user_id`
    */
-  async updateRole(workspaceId, userId, params) {
+  async updateRole(workspaceId2, userId, params) {
     const res = await this.http.patch(
-      `/workspaces/${workspaceId}/members/${userId}`,
+      `/workspaces/${workspaceId2}/members/${userId}`,
       params
     );
     return res.data ?? res;
@@ -7528,9 +7338,9 @@ var WorkspaceMembers = class {
    *
    * @throws `MiosaError` with code `LAST_OWNER` if the target is the sole owner.
    */
-  async remove(workspaceId, userId) {
+  async remove(workspaceId2, userId) {
     return this.http.delete(
-      `/workspaces/${workspaceId}/members/${userId}`
+      `/workspaces/${workspaceId2}/members/${userId}`
     );
   }
 };
@@ -7542,6 +7352,8 @@ var DEFAULT_MAX_RETRIES2 = 3;
 var Miosa = class {
   /** Per-workspace user roster — list, add, update role, remove. */
   workspaceMembers;
+  /** Target-agnostic prompt dispatch to sandboxes/computers with durable records. */
+  agentRuns;
   /**
    * Workspace invite flow — create invite, list, revoke, preview, accept.
    * Sending to an email already in the org adds the user directly.
@@ -7582,13 +7394,13 @@ var Miosa = class {
   computers;
   /** Sandboxes — native code-execution environments under `/sandboxes`. */
   sandboxes;
-  /** Agent device facade — route work across Sandboxes, Computers, and deploy hosts. */
-  devices;
   /**
    * Deployments — publish from a sandbox to a stable production URL.
    * Versions, releases, rollback, custom domains.
    */
   deployments;
+  /** Docker Deploy appliance hosts — one always-on workspace host, many apps. */
+  dockerDeploy;
   /** Credit balance and usage. */
   credits;
   /** Admin surface (`/api/v1/admin/*`) — requires an admin credential. */
@@ -7664,6 +7476,7 @@ var Miosa = class {
       timeout: config.timeout ?? DEFAULT_TIMEOUT2,
       maxRetries: config.maxRetries ?? DEFAULT_MAX_RETRIES2
     });
+    this.agentRuns = new AgentRuns(this.http);
     this.workspaceMembers = new WorkspaceMembers(this.http);
     this.workspaceInvites = new WorkspaceInvites(this.http);
     this.orgInvites = new OrgInvites(this.http);
@@ -7682,8 +7495,8 @@ var Miosa = class {
     this.mcp = new Mcp(this.http);
     this.computers = new Computers(this.http);
     this.sandboxes = new Sandboxes(this.http);
-    this.devices = new Devices(this.http);
     this.deployments = new Deployments(this.http);
+    this.dockerDeploy = new DockerDeploy(this.http);
     this.credits = new Credits(this.http);
     this.admin = new Admin(this.http);
     this.openComputers = new OpenComputers(this.http);
@@ -7713,6 +7526,162 @@ var Miosa = class {
   }
 };
 
-export { Admin, Analytics, ApiKeys, AuditLog, AuthError, Benchmarks, BuilderSessions, Channels, Checkpoints, CommandCenter, Community, Completions, Computer, ComputerAudit, ComputerAutoStop, ComputerEnv, ComputerInbox, ComputerLogs, ComputerNetwork, ComputerOsa, ComputerPorts, ComputerSecrets, ComputerTerminal, ComputerVolumes, Computers, Credits, CronJobs, Dashboard, Databases, DeploymentDomains, DeploymentReleases, DeploymentRuntimeInstances, DeploymentVersions, Deployments, Desktop, Devices, EgressAudit, EgressNetwork, EgressSecrets, Email, EmailCampaigns, EmailInbox, EmailTemplates, Embeddings, Exec, ExternalKeys, Files, FlatCustomDomains, Functions, HealthChecks, InsufficientCreditsError, Integrations, Mcp, Miosa, MiosaError, Models, NetworkError, NetworkPolicy, NotFoundError, OAuthFlow, OpenComputers, OrgInvites, ProjectAuth, ProjectIntegrations, ProviderDefaults, RateLimitError, Regions, SANDBOX_TEMPLATE, Sandbox, SandboxArtifacts, SandboxAudit, SandboxCommands, SandboxEnv, SandboxEvents, SandboxFiles, SandboxNetwork, SandboxPreview, SandboxPreviews, SandboxSecrets, SandboxTags, SandboxTemplates, SandboxTerminal, Sandboxes, ScopedFs, Settings, SnapshotsStandalone, Storage, Tenant, TimeoutError, Usage, ValidationError, Volumes, Webhooks, WorkspaceInvites, WorkspaceMembers, verifySignature };
+// src/resources/app-auth.ts
+function unwrapSession(data) {
+  const d = data && typeof data === "object" && "data" in data ? data.data : data;
+  const userId = d.user_id ?? d.userId;
+  const token = d.token ?? d.access_token;
+  const expiresAt = d.expires_at ?? d.expiresAt ?? "";
+  if (!userId || !token) {
+    throw new Error(
+      `AppAuth: unexpected response shape \u2014 got: ${JSON.stringify(d)}`
+    );
+  }
+  return {
+    userId,
+    token,
+    expiresAt
+  };
+}
+function base64UrlDecode(s) {
+  const padded = s.replace(/-/g, "+").replace(/_/g, "/");
+  const bin = atob(padded);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) {
+    bytes[i] = bin.charCodeAt(i);
+  }
+  return bytes;
+}
+var AppAuth = class {
+  baseUrl;
+  resourceType;
+  resourceId;
+  jwtSecret;
+  constructor(config) {
+    const authUrl = config.authUrl ?? (typeof process !== "undefined" ? process.env["AUTH_URL"] : void 0);
+    if (!authUrl) {
+      throw new Error(
+        "AppAuth: authUrl is required. Pass authUrl in config or set AUTH_URL env var."
+      );
+    }
+    if (!config.resourceType || !config.resourceId) {
+      throw new Error("AppAuth: resourceType and resourceId are required.");
+    }
+    this.baseUrl = authUrl.replace(/\/$/, "");
+    this.resourceType = config.resourceType;
+    this.resourceId = config.resourceId;
+    this.jwtSecret = config.jwtSecret ?? (typeof process !== "undefined" ? process.env["AUTH_JWT_SECRET"] : void 0);
+  }
+  /** POST /app-auth/:resourceType/:resourceId/signup */
+  async signup(email, password) {
+    return unwrapSession(await this._post("signup", { email, password }));
+  }
+  /** POST /app-auth/:resourceType/:resourceId/login */
+  async login(email, password) {
+    return unwrapSession(await this._post("login", { email, password }));
+  }
+  /**
+   * POST /app-auth/:resourceType/:resourceId/verify
+   * Verifies an email confirmation or magic-link token issued by the backend.
+   */
+  async verify(token) {
+    return unwrapSession(await this._post("verify", { token }));
+  }
+  /** POST /app-auth/:resourceType/:resourceId/password-reset */
+  async passwordReset(email) {
+    const data = await this._post("password-reset", { email });
+    return { ok: true, ...data };
+  }
+  /**
+   * POST /app-auth/:resourceType/:resourceId/logout
+   * Invalidates the given bearer token server-side.
+   */
+  async logout(token) {
+    const data = await this._post("logout", { token });
+    return { ok: true, ...data };
+  }
+  /**
+   * GET /app-auth/:resourceType/:resourceId/me
+   * Returns the session for the bearer token.
+   */
+  async me(token) {
+    const url = `${this.baseUrl}/app-auth/${this.resourceType}/${this.resourceId}/me`;
+    const resp = await fetch(url, {
+      method: "GET",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`
+      }
+    });
+    if (!resp.ok) {
+      const body = await resp.text();
+      throw new Error(`AppAuth me failed (${resp.status}): ${body}`);
+    }
+    return unwrapSession(await resp.json());
+  }
+  /**
+   * Verifies a JWT token locally using HS256 + AUTH_JWT_SECRET.
+   *
+   * Does NOT make a network call. Throws if the signature is invalid or the
+   * token is expired. Returns the decoded payload on success.
+   */
+  async verifyToken(token) {
+    if (!this.jwtSecret) {
+      throw new Error(
+        "AppAuth.verifyToken: jwtSecret is required. Pass jwtSecret in config or set AUTH_JWT_SECRET env var."
+      );
+    }
+    const parts = token.split(".");
+    if (parts.length !== 3) {
+      throw new Error("AppAuth.verifyToken: malformed JWT \u2014 expected 3 parts");
+    }
+    const [headerB64, payloadB64, signatureB64] = parts;
+    const payloadJson = new TextDecoder().decode(base64UrlDecode(payloadB64));
+    const payload = JSON.parse(payloadJson);
+    const now = Math.floor(Date.now() / 1e3);
+    if (typeof payload.exp === "number" && payload.exp < now) {
+      throw new Error(
+        `AppAuth.verifyToken: token expired at ${new Date(payload.exp * 1e3).toISOString()}`
+      );
+    }
+    const encoder = new TextEncoder();
+    const signingInput = `${headerB64}.${payloadB64}`;
+    const secretBytes = encoder.encode(this.jwtSecret);
+    const key = await crypto.subtle.importKey(
+      "raw",
+      secretBytes,
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["verify"]
+    );
+    const signatureBytes = base64UrlDecode(signatureB64).buffer;
+    const valid = await crypto.subtle.verify(
+      "HMAC",
+      key,
+      signatureBytes,
+      encoder.encode(signingInput)
+    );
+    if (!valid) {
+      throw new Error("AppAuth.verifyToken: invalid JWT signature");
+    }
+    return payload;
+  }
+  // ── Private ──────────────────────────────────────────────────────────────────
+  async _post(action, body) {
+    const url = `${this.baseUrl}/app-auth/${this.resourceType}/${this.resourceId}/${action}`;
+    const resp = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!resp.ok) {
+      const text = await resp.text();
+      throw new Error(`AppAuth ${action} failed (${resp.status}): ${text}`);
+    }
+    return resp.json();
+  }
+};
+
+export { Admin, AgentRuns, Analytics, ApiKeys, AppAuth, AuditLog, AuthError, Benchmarks, BuilderSessions, Channels, Checkpoints, CommandCenter, Community, Completions, Computer, ComputerAudit, ComputerAutoStop, ComputerEnv, ComputerInbox, ComputerLogs, ComputerNetwork, ComputerOsa, ComputerPorts, ComputerSecrets, ComputerTerminal, ComputerVolumes, Computers, Credits, CronJobs, Dashboard, Databases, DeploymentDomains, DeploymentReleases, DeploymentRuntimeInstances, DeploymentVersions, Deployments, Desktop, DockerDeploy, EgressAudit, EgressNetwork, EgressSecrets, Email, EmailCampaigns, EmailInbox, EmailTemplates, Embeddings, Exec, ExternalKeys, Files, FlatCustomDomains, Functions, HealthChecks, InsufficientCreditsError, Integrations, Mcp, Miosa, MiosaError, Models, NetworkError, NetworkPolicy, NotFoundError, OAuthFlow, OpenComputers, OrgInvites, ProjectAuth, ProjectIntegrations, ProviderDefaults, RateLimitError, Regions, SANDBOX_TEMPLATE, Sandbox, SandboxArtifacts, SandboxAudit, SandboxCommands, SandboxEnv, SandboxEvents, SandboxFiles, SandboxNetwork, SandboxPreview, SandboxPreviews, SandboxSecrets, SandboxTags, SandboxTemplates, SandboxTerminal, Sandboxes, ScopedFs, Settings, SnapshotsStandalone, Storage, Tenant, TimeoutError, Usage, ValidationError, Volumes, Webhooks, WorkspaceInvites, WorkspaceMembers };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map