@runcofactor/cli 0.55.0 → 0.56.0

package/dist/{sandbox-R6EMGOKR.js → sandbox-FBLJEYA2.js}

@@ -1,23 +1,23 @@
 import { createRequire as __cr } from "module"; import { fileURLToPath as __fup } from "url"; import { dirname as __dn } from "path"; const require = __cr(import.meta.url); const __filename = __fup(import.meta.url); const __dirname = __dn(__filename);
 import {
   parseDurationSeconds
-} from "./chunk-TGI2AAOZ.js";
+} from "./chunk-IV4HRGKX.js";
 import {
   resolveApplicationId,
   resolveOrCreateSandboxApplication
-} from "./chunk-QVMGXMP5.js";
-import "./chunk-ZH7HWVEE.js";
+} from "./chunk-6ILWJFKY.js";
+import "./chunk-VMJ7TBVM.js";
 import {
   SANDBOX_V2_GUIDE_SECTIONS,
   printServedGuide
-} from "./chunk-QHRWXCON.js";
+} from "./chunk-O7B2IYCZ.js";
 import {
   findOperation,
   getAllPlugins,
   getPlugin,
   getPluginIds,
   pluginOperations
-} from "./chunk-33U56YGD.js";
+} from "./chunk-CWICLBLU.js";
 import {
   UUID_RE,
   apiRequest,
@@ -27,9 +27,10 @@ import {
   getTargetOrg,
   selectProperty,
   stripOneTrailingNewline
-} from "./chunk-WWUEKQLR.js";
+} from "./chunk-EWK44F6V.js";
 import "./chunk-S3Q7MDCS.js";
 import {
+  activeConfigDir,
   apiFetch,
   decodeJwtPayload,
   exitOnFailure,
@@ -39,33 +40,33 @@ import {
   resolveConfig,
   resolveOrgAppUrl,
   splitAtSeparator
-} from "./chunk-BJHAVM7Z.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   SANDBOX_GUIDE_SECTIONS,
   writeRawOutput
-} from "./chunk-KL2ARGH6.js";
+} from "./chunk-2OHYMT3A.js";
 import {
   INSTANCE_SIZES,
   INSTANCE_SIZE_SPEC,
   SANDBOX_EGRESS_MODES,
   parseInstanceSize,
   sandboxPreviewPagePath
-} from "./chunk-U3MRXQZS.js";
+} from "./chunk-RHWPZKRV.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/sandbox.ts
-import process10 from "process";
-import { readFileSync as readFileSync6 } from "fs";
+import process11 from "process";
+import { readFileSync as readFileSync7 } from "fs";
 
 // src/sandbox-emulation.ts
-import process from "process";
+import process2 from "process";
 import { readFileSync } from "fs";
 var pad = (value, width) => value.padEnd(width);
 async function fetchEmulation(apiUrl, token, templateId) {
   const res = await apiRequest(apiUrl, token, "GET", `/org/environments/templates/${templateId}/emulation`);
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process.exit(1);
+    process2.exit(1);
   }
   return { config: res.config ?? { enabled: false, plugins: [] }, catalog: res.catalog ?? [] };
 }
@@ -80,14 +81,14 @@ async function patchEmulation(apiUrl, token, templateId, config) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process.exit(1);
+    process2.exit(1);
   }
 }
 function assertKnownPlugin(pluginId) {
   const ids = getPluginIds();
   if (!ids.includes(pluginId)) {
     console.error(`Error: unknown plugin '${pluginId}'. Available: ${ids.join(", ")}`);
-    process.exit(1);
+    process2.exit(1);
   }
 }
 function readJsonFileOrExit(path, flag) {
@@ -98,7 +99,7 @@ function readJsonFileOrExit(path, flag) {
     console.error(
       `Error reading ${flag} file '${path}': ${err instanceof Error ? err.message : String(err)}`
     );
-    process.exit(1);
+    process2.exit(1);
   }
   try {
     return JSON.parse(raw);
@@ -106,7 +107,7 @@ function readJsonFileOrExit(path, flag) {
     console.error(
       `Error parsing ${flag} file '${path}' as JSON: ${err instanceof Error ? err.message : String(err)}`
     );
-    process.exit(1);
+    process2.exit(1);
   }
 }
 function readJsonObjectOrExit(path, flag) {
@@ -115,7 +116,7 @@ function readJsonObjectOrExit(path, flag) {
     console.error(
       `Error: ${flag} file '${path}' must contain a JSON object, not ${Array.isArray(parsed) ? "an array" : typeof parsed}.`
     );
-    process.exit(1);
+    process2.exit(1);
   }
   return parsed;
 }
@@ -161,7 +162,7 @@ async function handleEmulationGet(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   if (!templateId) {
     console.error("Error: template ID required. Usage: canary sandbox emulation get <template-id>");
-    process.exit(1);
+    process2.exit(1);
   }
   const { config, catalog } = await fetchEmulation(apiUrl, token, templateId);
   const available = getAllPlugins().map((plugin) => ({ id: plugin.id, name: plugin.name }));
@@ -210,7 +211,7 @@ async function setEmulationEnabled(argv, apiUrl, token, enable) {
     console.error(
       `Error: template ID required. Usage: canary sandbox emulation ${verb} <template-id> [pluginId]`
     );
-    process.exit(1);
+    process2.exit(1);
   }
   const { config } = await fetchEmulation(apiUrl, token, templateId);
   let next;
@@ -221,7 +222,7 @@ async function setEmulationEnabled(argv, apiUrl, token, enable) {
     const exists = (config.plugins ?? []).some((plugin) => plugin.pluginId === pluginId);
     if (!enable && !exists) {
       console.error(`Error: plugin '${pluginId}' is not configured on this template.`);
-      process.exit(1);
+      process2.exit(1);
     }
     next = withPluginEnabled(config, pluginId, enable);
   }
@@ -237,7 +238,7 @@ async function handleEmulationSet(argv, apiUrl, token) {
     console.error(
       "Usage: canary sandbox emulation set <template-id> <pluginId> [--config <file>] [--fixture <file>] [--env-mapping <file>]"
     );
-    process.exit(1);
+    process2.exit(1);
   }
   assertKnownPlugin(pluginId);
   const configPath = getArgValue(argv, "--config");
@@ -245,7 +246,7 @@ async function handleEmulationSet(argv, apiUrl, token) {
   const envMappingPath = getArgValue(argv, "--env-mapping");
   if (!configPath && !fixturePath && !envMappingPath) {
     console.error("Error: provide at least one of --config, --fixture, --env-mapping");
-    process.exit(1);
+    process2.exit(1);
   }
   const pluginConfig = configPath ? readJsonObjectOrExit(configPath, "--config") : void 0;
   const fixture = fixturePath ? readJsonFileOrExit(fixturePath, "--fixture") : void 0;
@@ -270,12 +271,12 @@ async function handleEmulationRemove(argv, apiUrl, token) {
     console.error(
       "Error: template ID and pluginId required. Usage: canary sandbox emulation remove <template-id> <pluginId>"
     );
-    process.exit(1);
+    process2.exit(1);
   }
   const { config } = await fetchEmulation(apiUrl, token, templateId);
   if (!(config.plugins ?? []).some((plugin) => plugin.pluginId === pluginId)) {
     console.error(`Error: plugin '${pluginId}' is not configured on this template.`);
-    process.exit(1);
+    process2.exit(1);
   }
   const next = withoutPlugin(config, pluginId);
   await patchEmulation(apiUrl, token, templateId, next);
@@ -304,12 +305,12 @@ async function handleEmulation(argv, apiUrl, token) {
       console.error(
         `Unknown emulation action: ${action2 ?? "(none)"}. Use get/enable/disable/set/remove.`
       );
-      process.exit(1);
+      process2.exit(1);
   }
 }
 
 // src/sandbox-logs.ts
-import process2 from "process";
+import process3 from "process";
 var requestFailureLogsUrl = (apiUrl, token, instanceId) => apiRequest(
   apiUrl,
   token,
@@ -344,7 +345,7 @@ async function handleLogs(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   if (!instanceId) {
     console.error("Error: instance ID required. Usage: canary sandbox logs <instance-id>");
-    process2.exit(1);
+    process3.exit(1);
   }
   const service2 = getArgValue(argv, "--service");
   const tail = getArgValue(argv, "--tail") ?? "200";
@@ -354,13 +355,13 @@ async function handleLogs(argv, apiUrl, token) {
     const bundle = await fetchFailureLogsBundle(apiUrl, token, instanceId);
     if ("error" in bundle) {
       console.error(`Error: ${bundle.error}`);
-      process2.exit(1);
+      process3.exit(1);
     }
     if (json) {
       writeRawOutput(JSON.stringify(bundle, null, 2));
       return;
     }
-    process2.stdout.write(bundle.text || "(empty bundle)");
+    process3.stdout.write(bundle.text || "(empty bundle)");
     return;
   }
   const res = await apiRequest(
@@ -382,33 +383,33 @@ async function handleLogs(argv, apiUrl, token) {
       }
       console.error(`(live logs unavailable: ${res.error}; showing captured failure snapshot)
 `);
-      process2.stdout.write(bundle.text || "(empty bundle)");
+      process3.stdout.write(bundle.text || "(empty bundle)");
       return;
     }
     console.error(`Error: ${res.error}`);
-    process2.exit(1);
+    process3.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
     return;
   }
-  process2.stdout.write(res.data.logs ?? "(no logs)");
+  process3.stdout.write(res.data.logs ?? "(no logs)");
 }
 
 // src/sandbox-preview.ts
-import process3 from "process";
+import process4 from "process";
 async function handlePreview(argv, apiUrl, token, appSubdomain) {
   const pr = getArgValue(argv, "--pr");
   if (!pr) {
     console.error("Usage: cofactor sandbox preview --application <name|id> --pr <number> [--json]");
-    process3.exit(1);
+    process4.exit(1);
   }
   const application = await resolveApplicationId(argv, apiUrl, token);
   const query = new URLSearchParams({ application, pr });
   const res = await apiRequest(apiUrl, token, "GET", `/org/sandboxes-v2/previews?${query}`);
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process3.exit(1);
+    process4.exit(1);
   }
   const preview = res.data;
   if (hasFlag(argv, "--json")) {
@@ -428,8 +429,8 @@ async function handlePreview(argv, apiUrl, token, appSubdomain) {
 }
 
 // src/sandbox-v2.ts
-import process4 from "process";
-import { readFileSync as readFileSync2 } from "fs";
+import process6 from "process";
+import { readFileSync as readFileSync4 } from "fs";
 
 // ../sandbox-helper/src/manifest.ts
 import { createHash as createHash2, randomBytes } from "crypto";
@@ -1270,1616 +1271,1889 @@ var prepareInputSchema = z2.strictObject({
    */
   sync: z2.strictObject({ key: syncKeySchema })
 });
+function definitionFile(dir) {
+  if (dir === ".") return DEFINITION_FILE;
+  if (dir === "" || dir.startsWith("/") || dir.endsWith("/") || dir.split("/").includes("..")) {
+    throw new Error(`invalid definition directory "${dir}"`);
+  }
+  return `${dir}/${DEFINITION_FILE}`;
+}
 
-// src/sandbox-v2.ts
-function pad2(s, n) {
-  return s.padEnd(n);
+// src/sandbox-from-local.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { createHash as createHash3, randomUUID } from "crypto";
+import {
+  existsSync as existsSync2,
+  mkdirSync,
+  readFileSync as readFileSync3,
+  readdirSync,
+  renameSync,
+  rmSync as rmSync2,
+  writeFileSync
+} from "fs";
+import { relative as relative2, resolve as resolve2, join as join2 } from "path";
+import { z as z4 } from "zod";
+
+// src/sandbox-sync.ts
+import { spawnSync } from "child_process";
+import process5 from "process";
+import { copyFileSync, existsSync, lstatSync, mkdtempSync, readFileSync as readFileSync2, realpathSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join, relative, resolve, sep } from "path";
+
+// ../sandbox-helper/src/image-archive.ts
+import { z as z3 } from "zod";
+var MAX_BLOB_BYTES = 5 * 1024 ** 3;
+var ImageBlob = z3.object({
+  digest: z3.string().regex(/^sha256:[0-9a-f]{64}$/),
+  size: z3.number().int().nonnegative()
+});
+var ImageBlobs = z3.object({
+  config: ImageBlob,
+  // Docker allows at most 127 layers; each costs a storage lookup per push.
+  layers: z3.array(ImageBlob).min(1).max(128)
+});
+function withSandboxLayers(team, added, created) {
+  return {
+    ...team,
+    rootfs: { ...team.rootfs, diff_ids: [...team.rootfs.diff_ids, ...added.map((layer) => layer.digest)] },
+    history: [...team.history ?? [], ...added.map(() => ({ created, created_by: "cofactor sandbox push" }))],
+    config: { ...team.config, Entrypoint: ["/usr/local/bin/cofactor-sandbox", "boot"], Cmd: [] }
+  };
 }
-function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+var BLOCK = 512;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function tarHeader(name, size, mode = 420) {
+  if (encoder.encode(name).length > 100) throw new Error(`tar entry name too long: ${name}`);
+  const header = new Uint8Array(BLOCK);
+  const put = (offset, length, value) => header.set(encoder.encode(value).slice(0, length), offset);
+  const octal = (offset, length, value) => put(offset, length, `${value.toString(8).padStart(length - 1, "0")}\0`);
+  put(0, 100, name);
+  octal(100, 8, mode);
+  octal(108, 8, 0);
+  octal(116, 8, 0);
+  octal(124, 12, size);
+  octal(136, 12, 0);
+  put(148, 8, "        ");
+  put(156, 1, "0");
+  put(257, 6, "ustar\0");
+  put(263, 2, "00");
+  const checksum = header.reduce((sum, byte) => sum + byte, 0);
+  put(148, 8, `${checksum.toString(8).padStart(6, "0")}\0 `);
+  return header;
 }
-function indentLines(text, indent) {
-  return text.split("\n").map((line) => `${indent}${line}`).join("\n");
+function tarPadding(size) {
+  return new Uint8Array((BLOCK - size % BLOCK) % BLOCK);
 }
-function formatActionSignature(a) {
-  const inputs = Object.keys(a.input).join(", ");
-  const outputs = Object.keys(a.output).join(", ");
-  return `${a.slug}(${inputs})${outputs ? ` \u2192 ${outputs}` : ""}`;
+var TAR_END = new Uint8Array(BLOCK * 2);
+function tarOf(files) {
+  const parts = files.flatMap((file) => [tarHeader(file.name, file.data.length, file.mode), file.data, tarPadding(file.data.length)]);
+  parts.push(TAR_END);
+  const out = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+  let at = 0;
+  for (const part of parts) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
 }
-function jsonSchemaPropTypes(schema) {
-  const properties = schema.properties ?? {};
-  return Object.fromEntries(
-    Object.entries(properties).map(([key, prop]) => [key, typeof prop.type === "string" ? prop.type : "string"])
-  );
+var field = (block, offset, length) => decoder.decode(block.subarray(offset, offset + length)).replace(/\0.*$/s, "");
+async function tarEntries(read) {
+  const entries = [];
+  let longName = null;
+  for (let offset = 0; ; ) {
+    const block = await read(offset, BLOCK);
+    if (block.length < BLOCK) throw new Error(`the tar ends at byte ${offset + block.length}, before its end-of-archive block; it is truncated`);
+    if (block.every((byte) => byte === 0)) return entries;
+    const size = Number.parseInt(field(block, 124, 12).trim() || "0", 8);
+    if (!Number.isSafeInteger(size) || size < 0) throw new Error(`tar entry at ${offset} has an invalid size`);
+    const type = field(block, 156, 1) || "0";
+    const prefix = field(block, 345, 155);
+    const name = longName ?? (prefix ? `${prefix}/${field(block, 0, 100)}` : field(block, 0, 100));
+    const data = offset + BLOCK;
+    longName = null;
+    if (type === "x" || type === "L") {
+      const text = decoder.decode(await read(data, size)).replace(/\0+$/, "");
+      longName = type === "L" ? text : /(?:^|\n)\d+ path=([^\n]*)\n/.exec(text)?.[1] ?? null;
+    } else if (type === "0") {
+      entries.push({ name, offset: data, size });
+    }
+    offset = data + size + tarPadding(size).length;
+  }
 }
-function formatOperationSignature(op) {
-  const inputs = Object.keys(jsonSchemaPropTypes(op.inputSchema)).join(", ");
-  const outputs = Object.keys(jsonSchemaPropTypes(op.outputSchema)).join(", ");
-  return `${op.name}(${inputs})${outputs ? ` \u2192 ${outputs}` : ""}`;
+
+// src/sandbox-sync.ts
+var SyncError = class extends Error {
+};
+function git(args, options) {
+  const result = spawnSync("git", args, {
+    cwd: options.cwd,
+    env: options.env ?? process5.env,
+    input: options.input,
+    encoding: "utf8",
+    maxBuffer: 1 << 30
+    // Node defaults to 1 MiB; this repo's `ls-files -s -z` alone is 1.2 MB
+  });
+  if (result.error) throw new SyncError(`git ${args[0]} failed: ${result.error.message}`);
+  if (!(options.okCodes ?? [0]).includes(result.status ?? -1)) {
+    throw new SyncError(`git ${args[0]} failed (${result.signal ?? result.status}): ${result.stderr.trim()}`);
+  }
+  return result.stdout;
 }
-function exitOnRefusal(res) {
-  if (res.ok) return;
-  console.error(`Error: ${res.error}`);
-  if (res.code === "SANDBOX_V2_DEFINITION_INVALID") printIssues(res.issues, "  ");
-  process4.exit(1);
+var toPosix = (path) => path.split(sep).join("/");
+function repositoryOf(dir) {
+  const top = git(["rev-parse", "--show-toplevel"], { cwd: dir }).trim();
+  const gitDir = git(["rev-parse", "--absolute-git-dir"], { cwd: dir }).trim();
+  return { top: realpathSync(top), gitDir };
 }
-function printIssues(issues, indent) {
-  for (const issue of issues ?? []) {
-    console.log(`${indent}${issue.path || "(root)"}: ${issue.message}`);
+function indexEntries(output2, strip, top) {
+  const files = [];
+  const skipped = [];
+  for (const entry of output2.split("\0")) {
+    if (entry === "") continue;
+    const match = /^(\d{6}) ([0-9a-f]+) \d\t(.*)$/s.exec(entry);
+    if (!match) throw new SyncError(`unexpected git ls-files line: ${entry}`);
+    const [, mode, blob, repoPath] = match;
+    const path = strip === "" ? repoPath : repoPath.slice(strip.length + 1);
+    const onDisk = mode === "100644" || mode === "100755" ? lstatOrNull(join(top, repoPath)) : null;
+    if (onDisk?.isFile()) files.push({ path, blob, mode: mode === "100755" ? 493 : 420, size: onDisk.size });
+    else skipped.push(path);
   }
+  return { files, skipped };
 }
-function shortVersion(version) {
-  return /^[0-9a-f]{40}$/.test(version) ? version.slice(0, 12) : version;
+function workingTree(root) {
+  const { top, gitDir } = repositoryOf(root);
+  const prefix = toPosix(relative(top, realpathSync(root)));
+  const temp = mkdtempSync(join(tmpdir(), "cofactor-sync-"));
+  const cleanup = () => rmSync(temp, { recursive: true, force: true });
+  try {
+    const index = join(temp, "index");
+    const env = { ...process5.env, GIT_INDEX_FILE: index };
+    const userIndex = join(gitDir, "index");
+    if (existsSync(userIndex)) copyFileSync(userIndex, index);
+    else if (git(["rev-parse", "--verify", "-q", "HEAD"], { cwd: top, okCodes: [0, 1] }).trim() !== "") git(["read-tree", "HEAD"], { cwd: top, env });
+    const pathspec = prefix === "" ? "." : `:(literal)${prefix}`;
+    git(["add", "-A", "--", pathspec], { cwd: top, env });
+    const entries = indexEntries(git(["ls-files", "-s", "-z", "--", pathspec], { cwd: top, env }), prefix, top);
+    const files = withRawBlobs(entries.files, top, prefix);
+    const skipped = entries.skipped;
+    const tree = git(prefix === "" ? ["write-tree"] : ["write-tree", `--prefix=${prefix}/`], { cwd: top, env }).trim();
+    const untracked = new Set(
+      git(["ls-files", "--others", "--exclude-standard", "-z", "--", pathspec], { cwd: top }).split("\0").filter(Boolean).map((path) => prefix === "" ? path : path.slice(prefix.length + 1))
+    );
+    return { files, skipped, untracked, tree, repo: top, prefix, env, cleanup };
+  } catch (error) {
+    cleanup();
+    throw error;
+  }
 }
-function printApplicationHuman(app) {
-  console.log(
-    app.delivery === "github" ? `Delivered from GitHub: ${app.repo}${app.definitionDir && app.definitionDir !== "." ? `:${app.definitionDir}` : ""}` : "Delivered as pushed images"
-  );
-  console.log(`  version      ${app.version ? shortVersion(app.version) : "(none yet: run `cofactor sandbox push`)"}`);
-  if (app.pushes && app.pushes.length > 0) {
-    console.log("  pushes:");
-    for (const push2 of app.pushes) {
-      const tags = push2.tags.length > 0 ? ` [${push2.tags.join(", ")}]` : "";
-      console.log(`    ${push2.id}  ${pad2(push2.status, 9)} ${push2.createdAt}${tags}${push2.error ? `
-      ${push2.error}` : ""}`);
-    }
+function buildOutput(dir, to) {
+  const { gitDir } = repositoryOf(dir);
+  const temp = mkdtempSync(join(tmpdir(), "cofactor-sync-"));
+  try {
+    const env = { ...process5.env, GIT_INDEX_FILE: join(temp, "index"), GIT_DIR: gitDir, GIT_WORK_TREE: realpathSync(dir) };
+    git(["add", "-A", "-f", "--", "."], { cwd: dir, env });
+    const entries = indexEntries(git(["ls-files", "-s", "-z"], { cwd: dir, env }), "", realpathSync(dir));
+    const files = withRawBlobs(entries.files, realpathSync(dir), "", env);
+    const skipped = entries.skipped;
+    const tree = git(["write-tree"], { cwd: dir, env }).trim();
+    return { files: files.map((file) => ({ ...file, path: `${to}/${file.path}` })), skipped: skipped.map((path) => `${to}/${path}`), tree };
+  } finally {
+    rmSync(temp, { recursive: true, force: true });
   }
-  if (app.sandboxEnvironments.length > 0) {
-    console.log("  sandbox environments:");
-    for (const env of app.sandboxEnvironments) console.log(`    ${pad2(env.environment, 16)} ${env.name}`);
+}
+var FILTER_ATTRIBUTES = ["filter", "text", "eol", "ident", "working-tree-encoding"];
+function withRawBlobs(files, top, prefix, env) {
+  if (files.length === 0) return files;
+  const options = { cwd: top, ...env ? { env } : {} };
+  const repoPaths = files.map((file) => prefix === "" ? file.path : `${prefix}/${file.path}`);
+  const autocrlf = git(["config", "--get", "core.autocrlf"], { ...options, okCodes: [0, 1] }).trim();
+  const converts = autocrlf === "input" || autocrlf !== "" && git(["config", "--get", "--type=bool", "core.autocrlf"], options).trim() === "true";
+  let filtered;
+  if (converts) {
+    filtered = new Set(repoPaths);
+  } else {
+    const out = git(["check-attr", "-z", "--stdin", ...FILTER_ATTRIBUTES], { ...options, input: repoPaths.map((path) => `${path}\0`).join("") }).split("\0");
+    filtered = /* @__PURE__ */ new Set();
+    for (let i = 0; i + 2 < out.length; i += 3) if (out[i + 2] !== "unspecified") filtered.add(out[i]);
   }
-  if (app.heads && app.heads.length > 0) {
-    console.log("  heads (what flow runs and unpinned claims use; a warm environment switches after its warm-up; update with `cofactor sandbox refresh`):");
-    for (const head of app.heads) {
-      const version = head.version ? shortVersion(head.version) : "(none)";
-      const built = head.builtAt ? `, built ${head.builtAt}` : "";
-      const behind = head.behindMain && head.mainHead ? `  main has moved: now ${shortVersion(head.mainHead)}` : "";
-      console.log(`    ${pad2(head.environment, 16)} ${version} (${head.status}${built})${behind}`);
-      if (head.error) console.log(`      ${head.error}`);
-    }
+  return files.map(
+    (file, i) => filtered.has(repoPaths[i]) ? { ...file, blob: gitBlobId(readFileSync2(join(top, repoPaths[i]))) } : file
+  );
+}
+function lstatOrNull(path) {
+  try {
+    return lstatSync(path);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
   }
-  const def = app.definition;
-  if (!def) return;
-  console.log("  Environments:");
-  for (const env of def.environments) {
-    console.log(`    ${env.name}${env.extends ? ` (extends ${env.extends})` : ""}`);
-    console.log(indentLines(env.description, "      "));
-    if (env.seeds.length > 0) {
-      console.log("      seeds:");
-      for (const step of env.seeds) console.log(`        ${step.id}: ${step.action}`);
+}
+function chunked(items, fn) {
+  for (let i = 0; i < items.length; i += 200) fn(items.slice(i, i + 200));
+}
+function ignoredPaths(repo, env, paths) {
+  if (paths.length === 0) return /* @__PURE__ */ new Set();
+  const out = git(["check-ignore", "-z", "--stdin"], { cwd: repo, env, input: paths.map((p) => `${p}\0`).join(""), okCodes: [0, 1] });
+  return new Set(out.split("\0").filter(Boolean));
+}
+function everTracked(repo, pathspecs) {
+  const seen = /* @__PURE__ */ new Set();
+  if (pathspecs.length === 0) return seen;
+  if (git(["rev-parse", "--verify", "-q", "HEAD"], { cwd: repo, okCodes: [0, 1] }).trim() === "") return seen;
+  chunked(pathspecs, (chunk) => {
+    const out = git(["log", "--all", "--format=", "--name-only", "-z", "--", ...chunk.map((p) => `:(literal)${p}`)], { cwd: repo });
+    for (const path of out.split("\0")) {
+      const trimmed = path.replace(/^\n+/, "");
+      if (trimmed) seen.add(trimmed);
     }
-    if (env.envKeys.length > 0) console.log(`      env: ${env.envKeys.join(", ")}`);
-  }
-  if (def.actions.length > 0) {
-    console.log("  Actions:");
-    for (const a of def.actions) {
-      console.log(`    ${formatActionSignature(a)}`);
-      console.log(`      ${a.description}`);
+  });
+  return seen;
+}
+async function chooseDeletions(params) {
+  const repoPath = (path) => params.prefix === "" ? path : `${params.prefix}/${path}`;
+  const ignored = ignoredPaths(params.repo, params.env, params.copyOnly.map((entry) => repoPath(entry.path)));
+  const candidates = params.copyOnly.filter((entry) => !ignored.has(repoPath(entry.path)));
+  const history = everTracked(params.repo, candidates.map((entry) => repoPath(entry.path)));
+  const kept = params.copyOnly.filter((entry) => ignored.has(repoPath(entry.path))).map((entry) => ({ ...entry, why: "ignored here" }));
+  const remove = [];
+  for (const entry of candidates) {
+    if (!entry.path.endsWith("/")) {
+      if (history.has(repoPath(entry.path))) remove.push(entry.path);
+      else kept.push({ ...entry, why: "never tracked here" });
+      continue;
     }
+    const tracked = [...history].some((path) => path.startsWith(repoPath(entry.path)));
+    const listed = tracked ? await params.listDir(entry.path.slice(0, -1)) : [];
+    const ignoredInside = ignoredPaths(params.repo, params.env, listed.map(repoPath));
+    const files = listed.filter((path) => !ignoredInside.has(repoPath(path)) && history.has(repoPath(path)));
+    remove.push(...files);
+    if (files.length < entry.files) kept.push({ path: entry.path, files: entry.files - files.length, why: "never tracked here" });
   }
-  if (def.operations.length > 0) {
-    console.log("  Operations:");
-    for (const op of def.operations) {
-      console.log(`    ${formatOperationSignature(op)}`);
-      console.log(`      ${op.description}`);
+  return { delete: remove.sort(), kept: kept.sort((a, b) => a.path.localeCompare(b.path)) };
+}
+function applyBatches(files, remove) {
+  const budget = SYNC_MAX_APPLY_BYTES - 1024 * 1024;
+  const cost = (file) => 512 + Math.ceil(file.bytes.length / 512) * 512 + 100 + file.path.length;
+  const batches = [[]];
+  let size = 0;
+  for (const file of files) {
+    if (cost(file) > budget) throw new SyncError(`${file.path} is ${Math.ceil(file.bytes.length / 1024 / 1024)} MiB; a sync sends files of at most ${budget / 1024 / 1024} MiB`);
+    if (size + cost(file) > budget && batches.at(-1).length > 0) {
+      batches.push([]);
+      size = 0;
     }
+    batches.at(-1).push(file);
+    size += cost(file);
   }
-  console.log(`  Personas: ${def.personas.join(", ") || "(none)"}`);
-  console.log(`  Ports: ${def.ports.map((p) => `${p.name} (${p.access})`).join(", ") || "(none)"}`);
+  return batches.map((batch, index) => {
+    const manifest = {
+      files: batch.map(({ path, blob, mode }) => ({ path, blob, mode })),
+      delete: index === 0 ? remove : []
+    };
+    return tarOf([
+      { name: "manifest.json", data: new TextEncoder().encode(JSON.stringify(manifest)) },
+      ...batch.map((file, i) => ({ name: syncApplyEntryName(i), data: file.bytes }))
+    ]);
+  });
 }
-function printSandbox(data) {
-  console.log(`Sandbox ${data.id}: ${data.status}${data.expired ? " (expired)" : ""}`);
-  console.log(`  environment  ${data.environment}`);
-  console.log(`  version      ${shortVersion(data.version)}`);
-  if (data.error) console.log(`  error        ${data.error}`);
-  if (data.readyMs !== null) {
-    const seconds = (ms) => `${(ms / 1e3).toFixed(1)}s`;
-    const phases = data.phases ? ` (snapshot ${seconds(data.phases.snapshotMs)}, restore ${seconds(data.phases.restoreMs)}, prepare ${seconds(data.phases.prepareMs)})` : "";
-    console.log(`  ready in     ${seconds(data.readyMs)}${phases}`);
+async function copyRequest(session, path, init) {
+  let response;
+  try {
+    response = await fetch(`${session.url}${path}`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${session.token}`, "content-type": init.contentType },
+      body: init.body
+    });
+  } catch (error) {
+    throw new SyncError(`could not reach the sandbox for ${path}: ${error instanceof Error ? error.message : String(error)}`);
   }
-  if (data.snapshot?.buildPhases) {
-    const { buildMs, prepareMs, seeds } = data.snapshot.buildPhases;
-    const seedsMs = seeds.reduce((total, step) => total + step.ms, 0);
-    console.log(
-      `  snapshot     built ${data.snapshot.builtAt} (build ${(buildMs / 1e3).toFixed(1)}s, prepare ${(prepareMs / 1e3).toFixed(1)}s, ${seeds.length} seeds ${(seedsMs / 1e3).toFixed(1)}s)`
-    );
-    for (const step of seeds) console.log(`            ${step.id}  ${step.action}  ${(step.ms / 1e3).toFixed(1)}s`);
-    const ran = data.snapshot.buildPhases.build?.steps.filter((step) => step.ran) ?? [];
-    if (ran.length > 0) {
-      console.log(`               build steps: ${ran.map((step) => `${step.name} ${(step.ms / 1e3).toFixed(1)}s`).join(", ")}`);
+  if (!response.ok) {
+    const text = await response.text();
+    let message = text;
+    try {
+      message = JSON.parse(text).error ?? text;
+    } catch {
     }
+    throw new SyncError(`the sandbox refused ${path} (${response.status}): ${message.slice(0, 2e3)}`);
   }
-  if (data.leaseExpiresAt) console.log(`  expires      ${data.leaseExpiresAt}`);
-  if (data.synced) {
-    writeRawOutput(`  synced       ${data.synced.buildOutput ? "build output" : "tree"} ${data.synced.tree} at ${data.synced.at}`);
+  return response;
+}
+async function plan(session, local, to) {
+  const body = JSON.stringify(to === void 0 ? { local } : { local, to });
+  if (Buffer.byteLength(body) > SYNC_MAX_APPLY_BYTES) {
+    throw new SyncError(
+      `the file list (${local.length} files) is over the ${SYNC_MAX_APPLY_BYTES / 1024 / 1024} MiB a sync can plan in one request; ignore what the sandbox doesn't need (.gitignore)`
+    );
   }
-  if (Object.keys(data.portUrls).length > 0) {
-    console.log("");
-    console.log("  URLs:");
-    for (const [name, url] of Object.entries(data.portUrls)) writeRawOutput(`    ${pad2(name, 10)} ${url}`);
+  const response = await copyRequest(session, "/sync/plan", { body, contentType: "application/json" });
+  return parseAnswer(syncPlanResponseSchema, await response.text(), "/sync/plan");
+}
+function parseAnswer(schema, text, path) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw new SyncError(`the sandbox answered ${path} with something other than JSON: ${text.slice(0, 300)}`);
   }
-  if (data.personas.length > 0) {
-    console.log("");
-    console.log("  Logins:");
-    for (const p of data.personas) writeRawOutput(`    ${pad2(p.name, 14)} ${p.email}  ${p.password}`);
-    if (data.nativeLogin !== void 0) {
-      console.log(
-        data.nativeLogin ? "    (native Login nodes sign these in via authentication.run)" : "    (no authentication.run: native Login nodes fail with script_not_declared)"
-      );
+  const parsed = schema.safeParse(value);
+  if (!parsed.success) throw new SyncError(`the sandbox answered ${path} unexpectedly: ${text.slice(0, 300)}`);
+  return parsed.data;
+}
+async function apply(session, batches, build, json) {
+  let written = 0;
+  let deleted = 0;
+  let restarted = [];
+  const steps = [];
+  for (const [index, body] of batches.entries()) {
+    const last = index === batches.length - 1;
+    const response = await copyRequest(session, `/sync/apply${build && last ? "?build=1" : ""}`, { body, contentType: "application/x-tar" });
+    if (!(build && last)) {
+      const result = parseAnswer(syncApplyResultSchema, await response.text(), "/sync/apply");
+      written += result.written;
+      deleted += result.deleted;
+      continue;
     }
-  }
-  if (data.signInUrl) {
-    console.log("");
-    writeRawOutput(`  Open sign-in: ${data.signInUrl}`);
-  }
-  const seedIds = Object.keys(data.seedOutputs);
-  if (seedIds.length > 0) {
-    console.log("");
-    console.log("  Seed outputs:");
-    for (const id of seedIds) {
-      for (const [key, value] of Object.entries(data.seedOutputs[id])) {
-        writeRawOutput(`    ${id}.${key}: ${JSON.stringify(value)}`);
+    let buffer = "";
+    const decoder2 = new TextDecoder();
+    let finished = false;
+    for await (const chunk of response.body) {
+      buffer += decoder2.decode(chunk, { stream: true });
+      let newline = buffer.indexOf("\n");
+      while (newline >= 0) {
+        const event = parseAnswer(syncBuildEventSchema, buffer.slice(0, newline), "/sync/apply?build=1");
+        buffer = buffer.slice(newline + 1);
+        newline = buffer.indexOf("\n");
+        if (event.type === "applied") {
+          written += event.result.written;
+          deleted += event.result.deleted;
+        } else if (event.type === "output") {
+          if (!json) process5.stderr.write(event.text);
+        } else if (event.type === "step") {
+          steps.push({ name: event.name, ran: event.ran, ms: event.ms });
+          if (!json) process5.stderr.write(`  build step ${event.name}: ${event.ran ? `ran in ${(event.ms / 1e3).toFixed(1)} s` : "unchanged"}
+`);
+        } else if (event.type === "done") {
+          restarted = event.restarted;
+          finished = true;
+        } else if (event.type === "error") {
+          throw new SyncError(`the build failed after the files were synced: ${event.message}`);
+        }
       }
     }
+    if (!finished) throw new SyncError("the build stream ended early; check the copy with `cofactor sandbox exec <id> -- cofactor-sandbox status`");
   }
-  if (data.actions.length > 0) {
-    console.log("");
-    console.log("  Actions:");
-    for (const a of data.actions) console.log(`    ${formatActionSignature(a)}`);
-  }
-  if (data.operations.length > 0) {
-    console.log("");
-    console.log("  Operations:");
-    for (const op of data.operations) console.log(`    ${formatOperationSignature(op)}`);
-  }
+  return { written, deleted, restarted, steps };
 }
-function handleSandboxValidate(argv) {
-  const file = argv.find((a) => !a.startsWith("-")) ?? "./cofactor.sandbox.yaml";
+var SYNC_USAGE = "Usage: cofactor sandbox sync <id> [--build] [--json]\n       cofactor sandbox sync <id> <local-dir> --to <path-in-sandbox> [--json]";
+var LIST_LIMIT = 20;
+async function handleSandboxSync(positionals, argv, apiUrl, token) {
+  const [id, localDir] = positionals;
+  const to = getArgValue(argv, "--to");
+  const build = hasFlag(argv, "--build");
   const json = hasFlag(argv, "--json");
-  const delivery = hasFlag(argv, "--upload") ? "upload" : "github";
-  let yamlText;
-  try {
-    yamlText = readFileSync2(file, "utf-8");
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (json) {
-      writeRawOutput(JSON.stringify({ ok: false, issues: [{ path: "", message }] }, null, 2));
-    } else {
-      console.error(`Error reading "${file}": ${message}`);
-    }
-    process4.exit(1);
-  }
-  const { definition, issues } = validateDefinition(yamlText, delivery);
-  if (json) {
-    writeRawOutput(JSON.stringify({ ok: issues.length === 0, issues }, null, 2));
-    process4.exit(issues.length === 0 ? 0 : 1);
+  const fail4 = (message) => {
+    console.error(`Error: ${message}`);
+    process5.exit(1);
+  };
+  if (!id) return fail4(`sandbox id required.
+${SYNC_USAGE}`);
+  if (localDir === void 0 !== (to === void 0)) return fail4(`a local directory and --to go together.
+${SYNC_USAGE}`);
+  if (to !== void 0 && build) return fail4("--build reruns the build of a working-tree sync; build output is already built (`sync <id> <dir> --to <path>`).");
+  if (to !== void 0 && (to === "" || to.startsWith("/") || to.split("/").some((part) => part === "" || part === "." || part === ".."))) {
+    return fail4("--to is a path under the sandbox's sync root, like `static` or `frontend/dist` (no leading `/`, no `..`).");
   }
-  if (issues.length > 0) {
-    for (const issue of issues) console.error(`${issue.path || "(root)"}: ${issue.message}`);
-    process4.exit(1);
+  if (localDir !== void 0 && (!existsSync(localDir) || !lstatSync(localDir).isDirectory())) return fail4(`${localDir} is not a directory`);
+  if (!isInsideRepo(to === void 0 ? process5.cwd() : resolve(localDir))) {
+    return fail4("run this inside a git repository: the files to sync and the synced tree come from git.");
   }
-  const environmentCount = Object.keys(definition.environments).length;
-  const actionCount = Object.keys(definition.actions).length;
-  const operationCount = Object.keys(definition.emulation).reduce(
-    (sum, pluginId) => sum + pluginOperations(pluginId).length,
-    0
+  const started = Date.now();
+  const sessionRes = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/sandboxes-v2/sandboxes/${id}/sync-session`
   );
-  console.log(`\u2713 ${file} is valid`);
-  console.log(`  ${environmentCount} environment(s), ${actionCount} action(s), ${operationCount} operation(s)`);
-}
-async function fetchApplicationSandbox(apiUrl, token, applicationId) {
-  const res = await apiRequest(apiUrl, token, "GET", `/org/applications/${applicationId}/sandbox`);
-  exitOnRefusal(res);
-  return res.data;
-}
-var V2_ARGS = {
-  envs: { values: ["--application", "--property"], flags: ["--json"], positionals: 0 },
-  refresh: { values: ["--application", "--property", "--environment"], flags: ["--wait", "--json"], positionals: 0 },
-  connect: { values: ["--application", "--property", "--repo", "--dir"], flags: ["--json"], positionals: 0 },
-  push: { values: ["--application", "--property", "--definition", "--tag"], flags: ["--wait", "--json"], positionals: 1 },
-  claim: { values: ["--application", "--property", "--environment", "--at", "--timeout"], flags: ["--wait", "--json"], positionals: 0 },
-  show: { values: [], flags: ["--json"], positionals: 1 },
-  claims: { values: ["--application", "--property"], flags: ["--json"], positionals: 0 },
-  run: { values: ["--input", "--json-input"], flags: ["--json"], positionals: 2 },
-  exec: { values: ["--timeout"], flags: ["--json"], positionals: 1 },
-  sync: { values: ["--to"], flags: ["--build", "--json"], positionals: 2 },
-  "verify-env": { values: ["--application", "--property", "--environment"], flags: ["--json"], positionals: 0 },
-  destroy: { values: [], flags: [], positionals: 1 },
-  secret: { values: ["--application", "--property", "--environment"], flags: ["--json"], positionals: 2 }
-};
-function rejectUnknownSandboxV2Args(command, argv) {
-  const spec = V2_ARGS[command];
-  if (!spec) return;
-  let positionals = 0;
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (spec.values.includes(arg)) {
-      i++;
-      continue;
+  if (!sessionRes.ok) return fail4(sessionRes.error ?? "could not start a sync");
+  const session = sessionRes.data;
+  try {
+    let local;
+    let decide;
+    let cleanup = () => {
+    };
+    if (to !== void 0) {
+      const dir = resolve(localDir);
+      const output2 = buildOutput(dir, to);
+      local = { ...output2, untracked: /* @__PURE__ */ new Set(), root: dir };
+      decide = async (planned) => ({ delete: planned.copyOnly.map((entry) => entry.path), kept: [] });
+    } else {
+      const root = session.delivery === "github" ? repositoryOf(process5.cwd()).top : process5.cwd();
+      if (session.delivery === "upload" && !existsSync(join(root, "cofactor.sandbox.yaml"))) {
+        return fail4("run this from the directory holding cofactor.sandbox.yaml: a pushed image's WORKDIR mirrors it.");
+      }
+      const tree = workingTree(root);
+      cleanup = tree.cleanup;
+      local = { ...tree, root };
+      decide = (planned) => chooseDeletions({
+        copyOnly: planned.copyOnly,
+        repo: tree.repo,
+        prefix: tree.prefix,
+        env: tree.env,
+        listDir: async (dir) => (await plan(session, [], dir)).copyOnly.map((entry) => entry.path)
+      });
     }
-    if (["--input", "--tag"].some((value) => spec.values.includes(value) && arg.startsWith(`${value}=`))) continue;
-    if (spec.flags.includes(arg) || arg === "--debug") continue;
-    if (!arg.startsWith("-") && ++positionals <= spec.positionals) continue;
-    if (command === "secret" && !arg.startsWith("-")) {
-      console.error(
-        "Error: `cofactor sandbox secret` takes no value argument: pipe the value on stdin. If you typed a real key on the command line, rotate it."
+    try {
+      const planStarted = Date.now();
+      const planned = await plan(session, local.files, to);
+      const skipped = new Set(local.skipped.flatMap((path) => [path, `${path}/`]));
+      const { delete: remove, kept } = await decide({ ...planned, copyOnly: planned.copyOnly.filter((entry) => !skipped.has(entry.path)) });
+      const planMs = Date.now() - planStarted;
+      const need = new Set(planned.need);
+      const sending = local.files.filter((file) => need.has(file.path));
+      if (!json) {
+        writeRawOutput(`Syncing ${local.root} into sandbox ${id} (${session.delivery === "github" ? "GitHub" : "pushed image"}, version ${session.version.slice(0, 12)})`);
+        writeRawOutput(`  plan: ${sending.length} to write, ${remove.length} to delete, ${local.files.length - sending.length} unchanged (${(planMs / 1e3).toFixed(1)} s)`);
+        const untracked = sending.filter((file) => local.untracked.has(file.path));
+        const tracked = sending.filter((file) => !local.untracked.has(file.path));
+        if (sending.length > 0) writeRawOutput("  write:");
+        for (const file of tracked.slice(0, LIST_LIMIT)) writeRawOutput(`    ${file.path}`);
+        if (tracked.length > LIST_LIMIT) writeRawOutput(`    ...and ${tracked.length - LIST_LIMIT} more`);
+        for (const file of untracked) writeRawOutput(`    ${file.path}  (untracked)`);
+        if (remove.length > 0) writeRawOutput("  delete:");
+        for (const path of remove) writeRawOutput(`    ${path}`);
+        if (kept.length > 0) {
+          writeRawOutput("  kept (only in the sandbox):");
+          for (const entry of kept.slice(0, LIST_LIMIT)) {
+            writeRawOutput(`    ${entry.path}${entry.files > 1 ? ` (${entry.files} files)` : ""}, ${entry.why}`);
+          }
+          if (kept.length > LIST_LIMIT) writeRawOutput(`    ...and ${kept.length - LIST_LIMIT} more`);
+        }
+        if (local.skipped.length > 0) writeRawOutput(`  not synced (symlinks and submodules): ${local.skipped.join(", ")}`);
+      }
+      const applyStarted = Date.now();
+      const batches = sending.length === 0 && remove.length === 0 && !build ? [] : applyBatches(
+        sending.map((file) => ({ ...file, bytes: readFileSync2(join(local.root, to === void 0 ? file.path : file.path.slice(to.length + 1))) })),
+        remove
       );
-      process4.exit(1);
+      const applied = await apply(session, batches, build, json);
+      const applyMs = Date.now() - applyStarted;
+      const ms = Date.now() - started;
+      const recorded = await apiRequest(apiUrl, token, "POST", `/org/sandboxes-v2/sandboxes/${id}/syncs`, {
+        tree: local.tree,
+        buildOutput: to !== void 0,
+        written: applied.written,
+        deleted: applied.deleted,
+        ms
+      });
+      if (!recorded.ok) throw new SyncError(`the files were synced, but recording the sync failed: ${recorded.error}`);
+      if (json) {
+        writeRawOutput(
+          JSON.stringify(
+            {
+              id,
+              tree: local.tree,
+              buildOutput: to !== void 0,
+              written: sending.map((file) => file.path),
+              deleted: remove,
+              kept,
+              build: build ? { steps: applied.steps, restarted: applied.restarted } : null,
+              ms: { total: ms, plan: planMs, apply: applyMs }
+            },
+            null,
+            2
+          )
+        );
+        return;
+      }
+      writeRawOutput(`  applied: ${applied.written} written, ${applied.deleted} deleted (${(applyMs / 1e3).toFixed(1)} s)`);
+      if (build) writeRawOutput(`  restarted: ${applied.restarted.join(", ") || "nothing"}`);
+      writeRawOutput(`Synced ${to === void 0 ? "tree" : "build output"} ${local.tree} in ${(ms / 1e3).toFixed(1)} s.`);
+      if (!build) {
+        writeRawOutput(`  Restart what runs it: cofactor sandbox exec ${id} -- cofactor-sandbox restart <service>`);
+      }
+      const shown = await apiRequest(apiUrl, token, "GET", `/org/sandboxes-v2/sandboxes/${id}`);
+      for (const [name, url] of Object.entries(shown.data?.portUrls ?? {})) writeRawOutput(`  ${name.padEnd(10)} ${url}`);
+    } finally {
+      cleanup();
     }
-    console.error(`Error: \`cofactor sandbox ${command}\` does not take ${JSON.stringify(arg)}. See \`cofactor sandbox --help\`.`);
-    process4.exit(1);
+  } catch (error) {
+    if (error instanceof SyncError) return fail4(error.message);
+    throw error;
   }
 }
-function v2Positionals(command, argv) {
-  const values = V2_ARGS[command]?.values ?? [];
-  const result = [];
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (values.includes(arg)) i++;
-    else if (!arg.startsWith("-")) result.push(arg);
-  }
-  return result;
+function isInsideRepo(dir) {
+  return git(["rev-parse", "--is-inside-work-tree"], { cwd: dir, okCodes: [0, 128] }).trim() === "true";
 }
-async function handleSandboxEnvs(argv, apiUrl, token) {
-  const applicationId = await resolveApplicationId(argv, apiUrl, token);
-  const app = await fetchApplicationSandbox(apiUrl, token, applicationId);
-  if (hasFlag(argv, "--json")) {
-    writeRawOutput(JSON.stringify(app, null, 2));
-    return;
-  }
-  printApplicationHuman(app);
+
+// src/sandbox-from-local.ts
+var TTL_MS = 7 * 24 * 3600 * 1e3;
+var RecordSchema = z4.strictObject({
+  repo: z4.string(),
+  repoName: z4.string(),
+  remoteIdentity: z4.string(),
+  application: z4.string(),
+  applicationId: z4.string().nullable(),
+  claims: z4.array(z4.string()),
+  apiUrl: z4.string(),
+  version: z4.string().regex(/^[0-9a-f]{40}$/),
+  ref: z4.string().regex(/^refs\/cofactor\/wip\/[0-9a-f]{40}$/),
+  updatedAt: z4.number()
+});
+function git2(repo, args, env = process.env) {
+  const result = spawnSync2("git", args, {
+    cwd: repo,
+    env,
+    encoding: "utf8",
+    maxBuffer: 64 * 1024 * 1024
+  });
+  if (result.error || result.status !== 0) {
+    const reason = (result.error?.message ?? result.stderr).replace(
+      /https?:\/\/[^\s/@]+(?::[^\s/@]*)?@/g,
+      "https://***@"
+    );
+    throw new Error(`git ${args[0]} failed: ${reason.trim()}`);
+  }
+  return result.stdout.trim();
+}
+function remoteIdentity(remote) {
+  if (!/^https?:\/\//.test(remote)) return remote;
+  const url = new URL(remote);
+  url.username = "";
+  url.password = "";
+  return url.href;
+}
+var stateDir = () => join2(activeConfigDir(), "sandbox-wip");
+function save(file, record) {
+  mkdirSync(stateDir(), { recursive: true, mode: 448 });
+  const temp = `${file}.${randomUUID()}.tmp`;
+  writeFileSync(temp, JSON.stringify(record), { mode: 384 });
+  renameSync(temp, file);
+}
+function records() {
+  if (!existsSync2(stateDir())) return [];
+  return readdirSync(stateDir()).filter((name) => name.endsWith(".json")).map((name) => {
+    const file = join2(stateDir(), name);
+    return { file, record: RecordSchema.parse(JSON.parse(readFileSync3(file, "utf8"))) };
+  });
 }
-async function handleSandboxConnect(argv, apiUrl, token) {
-  const repo = getArgValue(argv, "--repo");
-  if (!repo) {
-    console.error("Usage: cofactor sandbox connect --application <name|id> --repo <owner/name> [--dir <path>] [--json]");
-    process4.exit(1);
-  }
-  const body = { repo, definitionDir: getArgValue(argv, "--dir") ?? "." };
-  const checkCanConnect = async () => {
-    exitOnRefusal(await apiRequest(apiUrl, token, "POST", "/org/sandboxes-v2/connect-check", body));
-  };
-  const applicationId = await resolveOrCreateSandboxApplication(argv, apiUrl, token, checkCanConnect);
-  const res = await apiRequest(apiUrl, token, "PUT", `/org/applications/${applicationId}/sandbox`, body);
-  exitOnRefusal(res);
-  if (hasFlag(argv, "--json")) {
-    writeRawOutput(JSON.stringify(res.data, null, 2));
-    return;
+function publishLocalSource(argv, apiUrl) {
+  const application = getArgValue(argv, "--application") ?? getArgValue(argv, "--property");
+  if (!application) throw new Error("--from-local requires --application <name|id>.");
+  const { top } = repositoryOf(process.cwd());
+  const remote = git2(top, ["remote", "get-url", "--push", "origin"]);
+  const inferred = /^(?:git@github\.com:|ssh:\/\/git@github\.com\/|https:\/\/github\.com\/)([^/]+\/[^/]+?)(?:\.git)?$/.exec(
+    remote
+  )?.[1];
+  const repoName = getArgValue(argv, "--repo") ?? inferred;
+  if (!repoName)
+    throw new Error("Cannot infer a GitHub repository from origin; pass --repo <owner/name>.");
+  if (inferred && inferred.toLowerCase() !== repoName.toLowerCase())
+    throw new Error("--repo must match the origin push repository.");
+  const directory = getArgValue(argv, "--dir") ?? relative2(top, process.cwd());
+  const definitionDir = relative2(top, resolve2(top, directory)).split("\\").join("/") || ".";
+  if (definitionDir === ".." || definitionDir.startsWith("../"))
+    throw new Error("--dir must be inside the repository.");
+  const tree = workingTree(top);
+  try {
+    const yaml = git2(top, ["show", `${tree.tree}:${definitionFile(definitionDir)}`], tree.env);
+    const { definition, issues } = validateDefinition(yaml, "github");
+    if (!definition || issues.length)
+      throw new Error(
+        `Invalid sandbox definition:
+${issues.map((issue) => `${issue.path}: ${issue.message}`).join("\n")}`
+      );
+    const env = {
+      ...tree.env,
+      GIT_AUTHOR_NAME: "Cofactor",
+      GIT_AUTHOR_EMAIL: "sandbox@example.com",
+      GIT_COMMITTER_NAME: "Cofactor",
+      GIT_COMMITTER_EMAIL: "sandbox@example.com",
+      GIT_AUTHOR_DATE: "2000-01-01T00:00:00Z",
+      GIT_COMMITTER_DATE: "2000-01-01T00:00:00Z"
+    };
+    const version = git2(
+      top,
+      ["commit-tree", "--no-gpg-sign", tree.tree, "-m", "Cofactor working tree"],
+      env
+    );
+    const key = createHash3("sha256").update(JSON.stringify([top, repoName, application, apiUrl, version])).digest("hex");
+    const file = join2(stateDir(), `${key}.json`);
+    const previous = existsSync2(file) ? RecordSchema.parse(JSON.parse(readFileSync3(file, "utf8"))) : null;
+    const record = {
+      repo: top,
+      repoName,
+      remoteIdentity: remoteIdentity(remote),
+      application,
+      applicationId: previous?.applicationId ?? null,
+      claims: previous?.claims ?? [],
+      apiUrl,
+      version,
+      ref: `refs/cofactor/wip/${tree.tree}`,
+      updatedAt: Date.now()
+    };
+    save(file, record);
+    git2(top, ["push", "--porcelain", "origin", `${version}:${record.ref}`]);
+    return { record, file, definitionDir };
+  } finally {
+    tree.cleanup();
   }
-  printApplicationHuman(res.data);
 }
-var CLAIM_POLL_INTERVAL_MS = 3e3;
-var CLAIM_TIMEOUT_SECONDS = 2 * 3600;
-var CLAIM_POLL_GRACE_MS = 2 * 60 * 1e3;
-async function pollSandboxUntilReady(apiUrl, token, id, timeoutSeconds) {
-  const deadline = Date.now() + timeoutSeconds * 1e3 + CLAIM_POLL_GRACE_MS;
-  let toldUpgrading = false;
-  while (Date.now() < deadline) {
-    const res = await apiRequest(apiUrl, token, "GET", `/org/sandboxes-v2/sandboxes/${id}`);
-    if (!res.ok) return { error: res.error ?? "unknown error" };
-    if (res.data.status === "ready" || res.data.status === "failed") return { data: res.data };
-    if (res.data.upgrading && !toldUpgrading) {
-      toldUpgrading = true;
-      console.error("  updating this push to the current sandbox platform (once; the claim continues after)...");
-    }
-    await sleep(CLAIM_POLL_INTERVAL_MS);
-  }
-  return { error: `timed out waiting for sandbox ${id} to become ready (${Math.round(timeoutSeconds / 60)} min)` };
+function rememberLocalApplication(source, applicationId) {
+  source.record.applicationId = applicationId;
+  save(source.file, source.record);
 }
-async function handleSandboxClaim(argv, apiUrl, token) {
-  const applicationId = await resolveApplicationId(argv, apiUrl, token);
-  const environment2 = getArgValue(argv, "--environment") ?? "default";
-  const version = getArgValue(argv, "--at");
-  const timeout = parseDurationSeconds(getArgValue(argv, "--timeout"), "--timeout");
-  const timeoutSeconds = timeout ?? CLAIM_TIMEOUT_SECONDS;
-  const wait = hasFlag(argv, "--wait");
-  const json = hasFlag(argv, "--json");
-  const body = { applicationId, environment: environment2 };
-  if (version) body.version = version;
-  if (timeout !== void 0) body.timeoutSeconds = timeout;
-  if (wait) body.wait = true;
-  const res = await apiRequest(apiUrl, token, "POST", "/org/sandboxes-v2/sandboxes", body);
-  if (!res.ok) {
-    console.error(`Error: ${res.error}`);
-    if (res.code === "SANDBOX_V2_DEFINITION_INVALID") printIssues(res.issues, "  ");
-    process4.exit(1);
-  }
-  const id = res.data.id;
-  if (!wait) {
-    if (json) {
-      writeRawOutput(JSON.stringify({ id }, null, 2));
-    } else {
-      console.log(`Sandbox claiming: ${id}`);
-      console.log(`  Poll with: cofactor sandbox show ${id}`);
+function rememberLocalClaim(source, id) {
+  const latest = RecordSchema.parse(JSON.parse(readFileSync3(source.file, "utf8")));
+  source.record.claims = [.../* @__PURE__ */ new Set([...latest.claims, id])];
+  save(source.file, source.record);
+}
+function trackedLocalSandbox(id, apiUrl) {
+  const entry = records().find(
+    ({ record }) => record.apiUrl === apiUrl && record.claims.includes(id)
+  );
+  if (!entry || entry.record.applicationId === null) return null;
+  return { applicationId: entry.record.applicationId, version: entry.record.version };
+}
+async function cleanupLocalRefs(apiUrl, token, applicationId, application, destroyed) {
+  const candidates = records().filter(
+    ({ record }) => record.apiUrl === apiUrl && (record.applicationId === applicationId || record.applicationId === null && record.application === application) && (destroyed ? record.version === destroyed.version : Date.now() - record.updatedAt >= TTL_MS)
+  );
+  if (!candidates.length) return;
+  const live = /* @__PURE__ */ new Set();
+  let cursor = null;
+  do {
+    const query = new URLSearchParams({ status: "claiming,ready", limit: "100" });
+    if (cursor) query.set("cursor", cursor);
+    const page = await apiRequest(apiUrl, token, "GET", `/org/sandboxes-v2/sandboxes?${query}`);
+    if (!page.ok)
+      throw new Error(page.error ?? "Could not check live claims; wip refs were retained.");
+    for (const row of page.data) if (row.id !== destroyed?.id) live.add(row.version);
+    cursor = page.nextCursor ?? null;
+  } while (cursor);
+  for (const { file, record } of candidates) {
+    if (live.has(record.version)) continue;
+    if (remoteIdentity(git2(record.repo, ["remote", "get-url", "--push", "origin"])) !== record.remoteIdentity) {
+      throw new Error("The origin push repository changed; wip cleanup left it intact.");
     }
-    return;
-  }
-  const settled = "status" in res.data && (res.data.status === "ready" || res.data.status === "failed") ? res.data : null;
-  if (!json && !settled) console.log(`Claiming sandbox ${id}...`);
-  const waited = settled ? { data: settled } : await pollSandboxUntilReady(apiUrl, token, id, timeoutSeconds);
-  if ("error" in waited) {
-    console.error(`Error: ${waited.error}`);
-    process4.exit(1);
-  }
-  const { data } = waited;
-  if (json) {
-    writeRawOutput(JSON.stringify(data, null, 2));
-  } else {
-    printSandbox(data);
+    const remoteSha = git2(record.repo, ["ls-remote", "--refs", "origin", record.ref]).split(
+      /\s/
+    )[0];
+    if (remoteSha) {
+      if (remoteSha !== record.version)
+        throw new Error("Wip ref changed remotely; cleanup left it intact.");
+      git2(record.repo, [
+        "push",
+        `--force-with-lease=${record.ref}:${record.version}`,
+        "origin",
+        `:${record.ref}`
+      ]);
+    }
+    rmSync2(file);
   }
-  if (data.status === "failed") process4.exit(1);
 }
-async function handleSandboxShow(argv, apiUrl, token) {
-  const [id] = argv.filter((a) => !a.startsWith("-"));
-  if (!id) {
-    console.error("Usage: cofactor sandbox show <id> [--json]");
-    process4.exit(1);
-  }
-  const json = hasFlag(argv, "--json");
-  const res = await apiRequest(apiUrl, token, "GET", `/org/sandboxes-v2/sandboxes/${id}`);
-  if (!res.ok) {
-    console.error(`Error: ${res.error}`);
-    process4.exit(1);
-  }
-  if (json) {
-    writeRawOutput(JSON.stringify(res.data, null, 2));
-    return;
+
+// src/sandbox-v2.ts
+function pad2(s, n) {
+  return s.padEnd(n);
+}
+function sleep(ms) {
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
+}
+function indentLines(text, indent) {
+  return text.split("\n").map((line) => `${indent}${line}`).join("\n");
+}
+function formatActionSignature(a) {
+  const inputs = Object.keys(a.input).join(", ");
+  const outputs = Object.keys(a.output).join(", ");
+  return `${a.slug}(${inputs})${outputs ? ` \u2192 ${outputs}` : ""}`;
+}
+function jsonSchemaPropTypes(schema) {
+  const properties = schema.properties ?? {};
+  return Object.fromEntries(
+    Object.entries(properties).map(([key, prop]) => [key, typeof prop.type === "string" ? prop.type : "string"])
+  );
+}
+function formatOperationSignature(op) {
+  const inputs = Object.keys(jsonSchemaPropTypes(op.inputSchema)).join(", ");
+  const outputs = Object.keys(jsonSchemaPropTypes(op.outputSchema)).join(", ");
+  return `${op.name}(${inputs})${outputs ? ` \u2192 ${outputs}` : ""}`;
+}
+function exitOnRefusal(res) {
+  if (res.ok) return;
+  console.error(`Error: ${res.error}`);
+  if (res.code === "SANDBOX_V2_DEFINITION_INVALID") printIssues(res.issues, "  ");
+  process6.exit(1);
+}
+function printIssues(issues, indent) {
+  for (const issue of issues ?? []) {
+    console.log(`${indent}${issue.path || "(root)"}: ${issue.message}`);
   }
-  printSandbox(res.data);
 }
-async function handleSandboxClaims(argv, apiUrl, token) {
-  const json = hasFlag(argv, "--json");
-  const applicationArg = getArgValue(argv, "--application") ?? getArgValue(argv, "--property");
-  const applicationId = applicationArg ? await resolveApplicationId(argv, apiUrl, token) : void 0;
-  const claims = [];
-  let cursor = null;
-  do {
-    const query = new URLSearchParams({ mine: "true", status: "claiming,ready", limit: "100" });
-    if (applicationId) query.set("applicationId", applicationId);
-    if (cursor) query.set("cursor", cursor);
-    const res = await apiRequest(
-      apiUrl,
-      token,
-      "GET",
-      `/org/sandboxes-v2/sandboxes?${query}`
-    );
-    if (!res.ok) {
-      console.error(`Error: ${res.error ?? "could not list sandboxes"}`);
-      process4.exit(1);
+function shortVersion(version) {
+  return /^[0-9a-f]{40}$/.test(version) ? version.slice(0, 12) : version;
+}
+function printApplicationHuman(app) {
+  console.log(
+    app.delivery === "github" ? `Delivered from GitHub: ${app.repo}${app.definitionDir && app.definitionDir !== "." ? `:${app.definitionDir}` : ""}` : "Delivered as pushed images"
+  );
+  console.log(
+    `  version      ${app.version ? shortVersion(app.version) : app.delivery === "github" ? "(no definition on the default branch yet; use --at <sha>)" : "(none yet: run `cofactor sandbox push`)"}`
+  );
+  if (app.pushes && app.pushes.length > 0) {
+    console.log("  pushes:");
+    for (const push2 of app.pushes) {
+      const tags = push2.tags.length > 0 ? ` [${push2.tags.join(", ")}]` : "";
+      console.log(`    ${push2.id}  ${pad2(push2.status, 9)} ${push2.createdAt}${tags}${push2.error ? `
+      ${push2.error}` : ""}`);
     }
-    claims.push(...res.data);
-    cursor = res.nextCursor ?? null;
-  } while (cursor);
-  if (json) {
-    writeRawOutput(JSON.stringify(claims, null, 2));
-    return;
-  }
-  if (claims.length === 0) {
-    console.log("No live claims.");
-    return;
   }
-  const names = new Map((await fetchProperties(apiUrl, token)).map((p) => [p.id, p.name]));
-  console.log(`${pad2("ID", 38)} ${pad2("Application", 24)} ${pad2("Environment", 14)} ${pad2("Status", 10)} ${pad2("Claimed", 26)} Expires`);
-  for (const c of claims) {
-    console.log(
-      `${pad2(c.id, 38)} ${pad2(names.get(c.applicationId) ?? c.applicationId, 24)} ${pad2(c.environment, 14)} ${pad2(c.status, 10)} ${pad2(c.createdAt, 26)} ${c.leaseExpiresAt ?? "-"}`
-    );
+  if (app.sandboxEnvironments.length > 0) {
+    console.log("  sandbox environments:");
+    for (const env of app.sandboxEnvironments) console.log(`    ${pad2(env.environment, 16)} ${env.name}`);
   }
-  console.log("\nTear one down with: cofactor sandbox destroy <id>");
-}
-function coerceInputValue(raw, type) {
-  switch (type) {
-    case "integer": {
-      if (!/^-?\d+$/.test(raw)) throw new Error(`must be an integer, got "${raw}"`);
-      return Number(raw);
-    }
-    case "number": {
-      const value = Number(raw);
-      if (Number.isNaN(value)) throw new Error(`must be a number, got "${raw}"`);
-      return value;
-    }
-    case "boolean": {
-      if (raw === "true") return true;
-      if (raw === "false") return false;
-      throw new Error(`must be "true" or "false", got "${raw}"`);
+  if (app.heads && app.heads.length > 0) {
+    console.log("  heads (what flow runs and unpinned claims use; a warm environment switches after its warm-up; update with `cofactor sandbox refresh`):");
+    for (const head of app.heads) {
+      const version = head.version ? shortVersion(head.version) : "(none)";
+      const built = head.builtAt ? `, built ${head.builtAt}` : "";
+      const behind = head.behindMain && head.mainHead ? `  main has moved: now ${shortVersion(head.mainHead)}` : "";
+      console.log(`    ${pad2(head.environment, 16)} ${version} (${head.status}${built})${behind}`);
+      if (head.error) console.log(`      ${head.error}`);
     }
-    default:
-      return raw;
   }
-}
-function buildRunInputFromFlags(argv, propTypes) {
-  const pairs = getArgValues(argv, "--input");
-  const input = {};
-  for (const pair of pairs) {
-    const eq = pair.indexOf("=");
-    if (eq <= 0) {
-      console.error(`Error: invalid --input "${pair}". Use key=value.`);
-      process4.exit(1);
+  const def = app.definition;
+  if (!def) return;
+  console.log("  Environments:");
+  for (const env of def.environments) {
+    console.log(`    ${env.name}${env.extends ? ` (extends ${env.extends})` : ""}`);
+    console.log(indentLines(env.description, "      "));
+    if (env.seeds.length > 0) {
+      console.log("      seeds:");
+      for (const step of env.seeds) console.log(`        ${step.id}: ${step.action}`);
     }
-    const key = pair.slice(0, eq);
-    const raw = pair.slice(eq + 1);
-    const type = propTypes[key];
-    if (!type) {
-      console.error(`Error: unknown input "${key}". Known: ${Object.keys(propTypes).join(", ") || "(none)"}`);
-      process4.exit(1);
+    if (env.envKeys.length > 0) console.log(`      env: ${env.envKeys.join(", ")}`);
+  }
+  if (def.actions.length > 0) {
+    console.log("  Actions:");
+    for (const a of def.actions) {
+      console.log(`    ${formatActionSignature(a)}`);
+      console.log(`      ${a.description}`);
     }
-    try {
-      input[key] = coerceInputValue(raw, type);
-    } catch (error) {
-      console.error(`Error: --input ${key}: ${error instanceof Error ? error.message : String(error)}`);
-      process4.exit(1);
+  }
+  if (def.operations.length > 0) {
+    console.log("  Operations:");
+    for (const op of def.operations) {
+      console.log(`    ${formatOperationSignature(op)}`);
+      console.log(`      ${op.description}`);
     }
   }
-  return input;
+  console.log(`  Personas: ${def.personas.join(", ") || "(none)"}`);
+  console.log(`  Ports: ${def.ports.map((p) => `${p.name} (${p.access})`).join(", ") || "(none)"}`);
 }
-async function pollRunUntilDone(apiUrl, token, runId, timeoutMs, timeoutNote = "") {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const pollRes = await apiRequest(apiUrl, token, "GET", `/org/sandboxes-v2/runs/${runId}`);
-    if (!pollRes.ok) {
-      console.error(`Error: ${pollRes.error}`);
-      process4.exit(1);
+function printSandbox(data) {
+  console.log(`Sandbox ${data.id}: ${data.status}${data.expired ? " (expired)" : ""}`);
+  console.log(`  environment  ${data.environment}`);
+  console.log(`  version      ${shortVersion(data.version)}`);
+  if (data.error) console.log(`  error        ${data.error}`);
+  if (data.readyMs !== null) {
+    const seconds = (ms) => `${(ms / 1e3).toFixed(1)}s`;
+    const phases = data.phases ? ` (snapshot ${seconds(data.phases.snapshotMs)}, restore ${seconds(data.phases.restoreMs)}, prepare ${seconds(data.phases.prepareMs)})` : "";
+    console.log(`  ready in     ${seconds(data.readyMs)}${phases}`);
+  }
+  if (data.snapshot?.buildPhases) {
+    const { buildMs, prepareMs, seeds } = data.snapshot.buildPhases;
+    const seedsMs = seeds.reduce((total, step) => total + step.ms, 0);
+    console.log(
+      `  snapshot     built ${data.snapshot.builtAt} (build ${(buildMs / 1e3).toFixed(1)}s, prepare ${(prepareMs / 1e3).toFixed(1)}s, ${seeds.length} seeds ${(seedsMs / 1e3).toFixed(1)}s)`
+    );
+    for (const step of seeds) console.log(`            ${step.id}  ${step.action}  ${(step.ms / 1e3).toFixed(1)}s`);
+    const ran = data.snapshot.buildPhases.build?.steps.filter((step) => step.ran) ?? [];
+    if (ran.length > 0) {
+      console.log(`               build steps: ${ran.map((step) => `${step.name} ${(step.ms / 1e3).toFixed(1)}s`).join(", ")}`);
     }
-    if (pollRes.data.status !== "running") return pollRes.data;
-    await sleep(2e3);
   }
-  console.error(`Timed out waiting for run ${runId}${timeoutNote}.`);
-  process4.exit(1);
-}
-async function handleSandboxRun(argv, apiUrl, token) {
-  const positional = argv.filter((a) => !a.startsWith("-"));
-  const [id, actionRef] = positional;
-  if (!id || !actionRef) {
-    console.error("Usage: cofactor sandbox run <id> <action|plugin.op> [--input k=v ...] [--json-input '{...}'] [--json]");
-    process4.exit(1);
+  if (data.leaseExpiresAt) console.log(`  expires      ${data.leaseExpiresAt}`);
+  if (data.synced) {
+    writeRawOutput(`  synced       ${data.synced.buildOutput ? "build output" : "tree"} ${data.synced.tree} at ${data.synced.at}`);
   }
-  const json = hasFlag(argv, "--json");
-  const jsonInput = getArgValue(argv, "--json-input");
-  const showRes = await apiRequest(apiUrl, token, "GET", `/org/sandboxes-v2/sandboxes/${id}`);
-  if (!showRes.ok) {
-    console.error(`Error: ${showRes.error}`);
-    process4.exit(1);
+  if (Object.keys(data.portUrls).length > 0) {
+    console.log("");
+    console.log("  URLs:");
+    for (const [name, url] of Object.entries(data.portUrls)) writeRawOutput(`    ${pad2(name, 10)} ${url}`);
   }
-  const sandbox = showRes.data;
-  const repoAction = sandbox.actions.find((a) => a.slug === actionRef);
-  const operation = sandbox.operations.find((op) => op.name === actionRef);
-  if (!repoAction && !operation) {
-    console.error(`Error: unknown action or operation "${actionRef}".`);
-    console.error(`  Actions: ${sandbox.actions.map((a) => a.slug).join(", ") || "(none)"}`);
-    console.error(`  Operations: ${sandbox.operations.map((op) => op.name).join(", ") || "(none)"}`);
-    process4.exit(1);
+  if (data.personas.length > 0) {
+    console.log("");
+    console.log("  Logins:");
+    for (const p of data.personas) writeRawOutput(`    ${pad2(p.name, 14)} ${p.email}  ${p.password}`);
+    if (data.nativeLogin !== void 0) {
+      console.log(
+        data.nativeLogin ? "    (native Login nodes sign these in via authentication.run)" : "    (no authentication.run: native Login nodes fail with script_not_declared)"
+      );
+    }
   }
-  let input;
-  if (jsonInput !== void 0) {
-    try {
-      input = JSON.parse(jsonInput);
-    } catch (error) {
-      console.error(`Error: invalid --json-input: ${error instanceof Error ? error.message : String(error)}`);
-      process4.exit(1);
+  if (data.signInUrl) {
+    console.log("");
+    writeRawOutput(`  Open sign-in: ${data.signInUrl}`);
+  }
+  const seedIds = Object.keys(data.seedOutputs);
+  if (seedIds.length > 0) {
+    console.log("");
+    console.log("  Seed outputs:");
+    for (const id of seedIds) {
+      for (const [key, value] of Object.entries(data.seedOutputs[id])) {
+        writeRawOutput(`    ${id}.${key}: ${JSON.stringify(value)}`);
+      }
     }
-  } else if (repoAction) {
-    const propTypes = Object.fromEntries(Object.entries(repoAction.input).map(([key, prop]) => [key, prop.type]));
-    input = buildRunInputFromFlags(argv, propTypes);
-  } else {
-    input = buildRunInputFromFlags(argv, jsonSchemaPropTypes(operation.inputSchema));
   }
-  const enqueueRes = await apiRequest(
+  if (data.actions.length > 0) {
+    console.log("");
+    console.log("  Actions:");
+    for (const a of data.actions) console.log(`    ${formatActionSignature(a)}`);
+  }
+  if (data.operations.length > 0) {
+    console.log("");
+    console.log("  Operations:");
+    for (const op of data.operations) console.log(`    ${formatOperationSignature(op)}`);
+  }
+}
+function handleSandboxValidate(argv) {
+  const file = argv.find((a) => !a.startsWith("-")) ?? "./cofactor.sandbox.yaml";
+  const json = hasFlag(argv, "--json");
+  const delivery = hasFlag(argv, "--upload") ? "upload" : "github";
+  let yamlText;
+  try {
+    yamlText = readFileSync4(file, "utf-8");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (json) {
+      writeRawOutput(JSON.stringify({ ok: false, issues: [{ path: "", message }] }, null, 2));
+    } else {
+      console.error(`Error reading "${file}": ${message}`);
+    }
+    process6.exit(1);
+  }
+  const { definition, issues } = validateDefinition(yamlText, delivery);
+  if (json) {
+    writeRawOutput(JSON.stringify({ ok: issues.length === 0, issues }, null, 2));
+    process6.exit(issues.length === 0 ? 0 : 1);
+  }
+  if (issues.length > 0) {
+    for (const issue of issues) console.error(`${issue.path || "(root)"}: ${issue.message}`);
+    process6.exit(1);
+  }
+  const environmentCount = Object.keys(definition.environments).length;
+  const actionCount = Object.keys(definition.actions).length;
+  const operationCount = Object.keys(definition.emulation).reduce(
+    (sum, pluginId) => sum + pluginOperations(pluginId).length,
+    0
+  );
+  console.log(`\u2713 ${file} is valid`);
+  console.log(`  ${environmentCount} environment(s), ${actionCount} action(s), ${operationCount} operation(s)`);
+}
+async function fetchApplicationSandbox(apiUrl, token, applicationId, at) {
+  const res = await apiRequest(
     apiUrl,
     token,
-    "POST",
-    `/org/sandboxes-v2/sandboxes/${id}/runs`,
-    { action: actionRef, input }
+    "GET",
+    `/org/applications/${applicationId}/sandbox${at ? `?at=${encodeURIComponent(at)}` : ""}`
   );
-  if (!enqueueRes.ok) {
-    if (enqueueRes.code === "SANDBOX_V2_ACTION_INVALID_INPUT") {
-      console.error(`Error: invalid input for "${actionRef}":`);
-      for (const issue of enqueueRes.issues ?? []) {
-        if (typeof issue === "string") console.error(`  ${issue}`);
-        else console.error(`  ${(issue.path ?? []).join(".")}: ${issue.message ?? ""}`);
+  exitOnRefusal(res);
+  return res.data;
+}
+var V2_ARGS = {
+  envs: { values: ["--application", "--property"], flags: ["--json"], positionals: 0 },
+  refresh: {
+    values: ["--application", "--property", "--environment"],
+    flags: ["--wait", "--json"],
+    positionals: 0
+  },
+  connect: {
+    values: ["--application", "--property", "--repo", "--dir", "--at"],
+    flags: ["--json"],
+    positionals: 0
+  },
+  push: {
+    values: ["--application", "--property", "--definition", "--tag"],
+    flags: ["--wait", "--json"],
+    positionals: 1
+  },
+  claim: {
+    values: ["--application", "--property", "--environment", "--at", "--timeout", "--repo", "--dir"],
+    flags: ["--wait", "--json", "--from-local"],
+    positionals: 0
+  },
+  show: { values: [], flags: ["--json"], positionals: 1 },
+  claims: { values: ["--application", "--property"], flags: ["--json"], positionals: 0 },
+  run: { values: ["--input", "--json-input"], flags: ["--json"], positionals: 2 },
+  exec: { values: ["--timeout"], flags: ["--json"], positionals: 1 },
+  sync: { values: ["--to"], flags: ["--build", "--json"], positionals: 2 },
+  "auth-check": { values: ["--persona"], flags: ["--json"], positionals: 1 },
+  "verify-env": {
+    values: ["--application", "--property", "--environment", "--at"],
+    flags: ["--json"],
+    positionals: 0
+  },
+  destroy: { values: [], flags: [], positionals: 1 },
+  secret: { values: ["--application", "--property", "--environment"], flags: ["--json"], positionals: 2 }
+};
+function rejectUnknownSandboxV2Args(command, argv) {
+  const spec = V2_ARGS[command];
+  if (!spec) return;
+  let positionals = 0;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (spec.values.includes(arg)) {
+      const value = argv[i + 1];
+      if (!value || value.startsWith("--")) {
+        console.error(`Error: ${arg} requires a value. See \`cofactor sandbox --help\`.`);
+        process6.exit(1);
       }
-      console.error("");
-      console.error("Input schema:");
-      writeRawOutput(JSON.stringify(repoAction ? repoAction.input : operation.inputSchema, null, 2));
-    } else {
-      console.error(`Error: ${enqueueRes.error}`);
+      i++;
+      continue;
     }
-    process4.exit(1);
+    if (["--input", "--tag"].some((value) => spec.values.includes(value) && arg.startsWith(`${value}=`))) continue;
+    if (spec.flags.includes(arg) || arg === "--debug") continue;
+    if (!arg.startsWith("-") && ++positionals <= spec.positionals) continue;
+    if (command === "secret" && !arg.startsWith("-")) {
+      console.error(
+        "Error: `cofactor sandbox secret` takes no value argument: pipe the value on stdin. If you typed a real key on the command line, rotate it."
+      );
+      process6.exit(1);
+    }
+    console.error(`Error: \`cofactor sandbox ${command}\` does not take ${JSON.stringify(arg)}. See \`cofactor sandbox --help\`.`);
+    process6.exit(1);
   }
-  const runId = enqueueRes.data.id;
-  const run = await pollRunUntilDone(apiUrl, token, runId, ((repoAction?.timeout ?? 60) + 60) * 1e3);
-  if (json) {
-    writeRawOutput(JSON.stringify(run, null, 2));
-    if (run.status === "failed") process4.exit(1);
+}
+function v2Positionals(command, argv) {
+  const values = V2_ARGS[command]?.values ?? [];
+  const result = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (values.includes(arg)) i++;
+    else if (!arg.startsWith("-")) result.push(arg);
+  }
+  return result;
+}
+async function handleSandboxEnvs(argv, apiUrl, token) {
+  const applicationId = await resolveApplicationId(argv, apiUrl, token);
+  const app = await fetchApplicationSandbox(apiUrl, token, applicationId);
+  if (hasFlag(argv, "--json")) {
+    writeRawOutput(JSON.stringify(app, null, 2));
     return;
   }
-  if (run.status === "failed") {
-    console.error(`Run failed: ${run.error ?? "unknown error"}`);
-    if (run.stderrTail) {
-      console.error("");
-      console.error("stderr:");
-      console.error(run.stderrTail);
-    }
-    process4.exit(1);
+  printApplicationHuman(app);
+}
+async function connectSandboxApplication(argv, apiUrl, token) {
+  const repo = getArgValue(argv, "--repo");
+  if (!repo) {
+    console.error("Usage: cofactor sandbox connect --application <name|id> --repo <owner/name> [--dir <path>] [--json]");
+    process6.exit(1);
   }
-  writeRawOutput(JSON.stringify(run.output ?? {}, null, 2));
+  const body = {
+    repo,
+    definitionDir: getArgValue(argv, "--dir") ?? ".",
+    at: getArgValue(argv, "--at")
+  };
+  const checkCanConnect = async () => {
+    exitOnRefusal(await apiRequest(apiUrl, token, "POST", "/org/sandboxes-v2/connect-check", body));
+  };
+  const applicationId = await resolveOrCreateSandboxApplication(argv, apiUrl, token, checkCanConnect);
+  const res = await apiRequest(apiUrl, token, "PUT", `/org/applications/${applicationId}/sandbox`, body);
+  exitOnRefusal(res);
+  return res.data;
 }
-var EXEC_USAGE = "Usage: cofactor sandbox exec <id> [--timeout <seconds>] [--json] -- <command...>";
-function parseExecArgs(options, commandWords) {
-  const command = commandWords.join(" ");
-  if (command.trim() === "") return { ok: false, error: `a command is required after \`--\`. ${EXEC_USAGE}` };
-  const id = v2Positionals("exec", options)[0];
-  if (!id) return { ok: false, error: `sandbox id required. ${EXEC_USAGE}` };
-  const timeout = getArgValue(options, "--timeout");
-  let timeoutSeconds;
-  if (timeout !== void 0) {
-    timeoutSeconds = /^\d+$/.test(timeout) ? Number(timeout) : NaN;
-    if (!Number.isInteger(timeoutSeconds) || timeoutSeconds < 1 || timeoutSeconds > EXEC_MAX_TIMEOUT_SECONDS) {
-      return { ok: false, error: `--timeout must be a whole number of seconds from 1 to ${EXEC_MAX_TIMEOUT_SECONDS}.` };
+async function handleSandboxConnect(argv, apiUrl, token) {
+  const app = await connectSandboxApplication(argv, apiUrl, token);
+  if (hasFlag(argv, "--json")) writeRawOutput(JSON.stringify(app, null, 2));
+  else printApplicationHuman(app);
+}
+var CLAIM_POLL_INTERVAL_MS = 3e3;
+var CLAIM_TIMEOUT_SECONDS = 2 * 3600;
+var CLAIM_POLL_GRACE_MS = 2 * 60 * 1e3;
+async function pollSandboxUntilReady(apiUrl, token, id, timeoutSeconds) {
+  const deadline = Date.now() + timeoutSeconds * 1e3 + CLAIM_POLL_GRACE_MS;
+  let toldUpgrading = false;
+  while (Date.now() < deadline) {
+    const res = await apiRequest(apiUrl, token, "GET", `/org/sandboxes-v2/sandboxes/${id}`);
+    if (!res.ok) return { error: res.error ?? "unknown error" };
+    if (res.data.status === "ready" || res.data.status === "failed") return { data: res.data };
+    if (res.data.upgrading && !toldUpgrading) {
+      toldUpgrading = true;
+      console.error("  updating this push to the current sandbox platform (once; the claim continues after)...");
     }
+    await sleep(CLAIM_POLL_INTERVAL_MS);
   }
-  return { ok: true, args: { id, timeoutSeconds, json: hasFlag(options, "--json"), command } };
-}
-function execExitCode(run) {
-  if (run.status === "succeeded") return 0;
-  return run.exitCode ?? 1;
+  return { error: `timed out waiting for sandbox ${id} to become ready (${Math.round(timeoutSeconds / 60)} min)` };
 }
-async function handleSandboxExec(options, commandWords, apiUrl, token) {
-  const parsed = parseExecArgs(options, commandWords);
-  if (!parsed.ok) {
-    console.error(`Error: ${parsed.error}`);
-    process4.exit(1);
+async function handleSandboxClaim(argv, apiUrl, token) {
+  const timeout = parseDurationSeconds(getArgValue(argv, "--timeout"), "--timeout");
+  const fromLocal = hasFlag(argv, "--from-local");
+  if (fromLocal && hasFlag(argv, "--at")) throw new Error("--from-local and --at are mutually exclusive.");
+  if (!fromLocal && (hasFlag(argv, "--repo") || hasFlag(argv, "--dir"))) throw new Error("--repo and --dir on claim require --from-local.");
+  const source = fromLocal ? publishLocalSource(argv, apiUrl) : null;
+  const applicationId = source ? (await connectSandboxApplication(["--application", source.record.application, "--repo", source.record.repoName, "--dir", source.definitionDir, "--at", source.record.version], apiUrl, token)).applicationId : await resolveApplicationId(argv, apiUrl, token);
+  if (source) {
+    rememberLocalApplication(source, applicationId);
+    await cleanupLocalRefs(apiUrl, token, applicationId, source.record.application);
   }
-  const { id, timeoutSeconds, json, command } = parsed.args;
-  const enqueueRes = await apiRequest(
-    apiUrl,
-    token,
-    "POST",
-    `/org/sandboxes-v2/sandboxes/${id}/exec`,
-    timeoutSeconds === void 0 ? { command } : { command, timeoutSeconds }
-  );
-  if (!enqueueRes.ok) {
-    console.error(`Error: ${enqueueRes.error}`);
-    process4.exit(1);
+  const environment2 = getArgValue(argv, "--environment") ?? "default";
+  const version = source?.record.version ?? getArgValue(argv, "--at");
+  const timeoutSeconds = timeout ?? CLAIM_TIMEOUT_SECONDS;
+  const wait = hasFlag(argv, "--wait");
+  const json = hasFlag(argv, "--json");
+  const body = { applicationId, environment: environment2 };
+  if (version) body.version = version;
+  if (timeout !== void 0) body.timeoutSeconds = timeout;
+  if (wait) body.wait = true;
+  const res = await apiRequest(apiUrl, token, "POST", "/org/sandboxes-v2/sandboxes", body);
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    if (res.code === "SANDBOX_V2_DEFINITION_INVALID") printIssues(res.issues, "  ");
+    process6.exit(1);
   }
-  const runId = enqueueRes.data.id;
-  const run = await pollRunUntilDone(
-    apiUrl,
-    token,
-    runId,
-    ((timeoutSeconds ?? EXEC_DEFAULT_TIMEOUT_SECONDS) + 60) * 1e3,
-    "; the command may still be running in the sandbox"
-  );
-  const code = execExitCode(run);
-  if (json) {
-    writeRawOutput(JSON.stringify(run, null, 2));
-    process4.exit(code);
+  const id = res.data.id;
+  if (source) rememberLocalClaim(source, id);
+  if (source && wait && !json) console.log(`Source commit: ${version}`);
+  if (!wait) {
+    if (json) {
+      writeRawOutput(JSON.stringify(source ? { id, version } : { id }, null, 2));
+    } else {
+      console.log(`Sandbox claiming: ${id}`);
+      if (source) console.log(`  Source commit: ${version}`);
+      console.log(`  Poll with: cofactor sandbox show ${id}`);
+    }
+    return;
   }
-  if (run.status === "failed" && run.exitCode === null) {
-    process4.stderr.write(`Error: ${run.error ?? "unknown error"}
-`);
-    if (run.stdoutTail) process4.stderr.write(run.stdoutTail);
-    if (run.stdoutTail && !run.stdoutTail.endsWith("\n") && run.stderrTail) process4.stderr.write("\n");
-    if (run.stderrTail) process4.stderr.write(run.stderrTail);
-    process4.exit(1);
+  const settled = "status" in res.data && (res.data.status === "ready" || res.data.status === "failed") ? res.data : null;
+  if (!json && !settled) console.log(`Claiming sandbox ${id}...`);
+  const waited = settled ? { data: settled } : await pollSandboxUntilReady(apiUrl, token, id, timeoutSeconds);
+  if ("error" in waited) {
+    console.error(`Error: ${waited.error}`);
+    process6.exit(1);
   }
-  if (run.stdoutTail) process4.stdout.write(run.stdoutTail);
-  if (run.stderrTail) process4.stderr.write(run.stderrTail);
-  if (code === 124 && run.error) process4.stderr.write(`
-${run.error}
-`);
-  process4.exit(code);
+  const { data } = waited;
+  if (json) {
+    writeRawOutput(JSON.stringify(data, null, 2));
+  } else {
+    printSandbox(data);
+  }
+  if (data.status === "failed") process6.exit(1);
 }
-async function handleSandboxDestroy(argv, apiUrl, token) {
+async function handleSandboxShow(argv, apiUrl, token) {
   const [id] = argv.filter((a) => !a.startsWith("-"));
   if (!id) {
-    console.error("Usage: cofactor sandbox destroy <id>");
-    process4.exit(1);
+    console.error("Usage: cofactor sandbox show <id> [--json]");
+    process6.exit(1);
   }
-  const res = await apiRequest(
-    apiUrl,
-    token,
-    "DELETE",
-    `/org/sandboxes-v2/sandboxes/${id}`
-  );
+  const json = hasFlag(argv, "--json");
+  const res = await apiRequest(apiUrl, token, "GET", `/org/sandboxes-v2/sandboxes/${id}`);
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process4.exit(1);
+    process6.exit(1);
   }
-  console.log(`Sandbox ${id} destroying.`);
-}
-async function handleSandboxVerifyEnv(argv, apiUrl, token) {
-  const applicationId = await resolveApplicationId(argv, apiUrl, token);
-  const onlyEnvironment = getArgValue(argv, "--environment");
-  const json = hasFlag(argv, "--json");
-  const log = (line) => json ? console.error(line) : console.log(line);
-  const app = await fetchApplicationSandbox(apiUrl, token, applicationId);
-  if (!app.version || !app.definition) {
-    console.error("Error: this application has no version to verify yet: run `cofactor sandbox push` first.");
-    process4.exit(1);
-  }
-  const version = app.version;
-  const allEnvironments = app.definition.environments.map((e) => e.name);
-  if (onlyEnvironment && !allEnvironments.includes(onlyEnvironment)) {
-    console.error(`Error: environment "${onlyEnvironment}" not found. Known: ${allEnvironments.join(", ")}`);
-    process4.exit(1);
+  if (json) {
+    writeRawOutput(JSON.stringify(res.data, null, 2));
+    return;
   }
-  const environments = onlyEnvironment ? [onlyEnvironment] : allEnvironments;
-  const results = [];
-  for (const environment2 of environments) {
-    log(`
-=== ${environment2} ===`);
-    const started = Date.now();
-    const claimRes = await apiRequest(
+  printSandbox(res.data);
+}
+async function handleSandboxClaims(argv, apiUrl, token) {
+  const json = hasFlag(argv, "--json");
+  const applicationArg = getArgValue(argv, "--application") ?? getArgValue(argv, "--property");
+  const applicationId = applicationArg ? await resolveApplicationId(argv, apiUrl, token) : void 0;
+  const claims = [];
+  let cursor = null;
+  do {
+    const query = new URLSearchParams({ mine: "true", status: "claiming,ready", limit: "100" });
+    if (applicationId) query.set("applicationId", applicationId);
+    if (cursor) query.set("cursor", cursor);
+    const res = await apiRequest(
       apiUrl,
       token,
-      "POST",
-      "/org/sandboxes-v2/sandboxes",
-      { applicationId, environment: environment2, version }
+      "GET",
+      `/org/sandboxes-v2/sandboxes?${query}`
     );
-    if (!claimRes.ok) {
-      const seconds2 = (Date.now() - started) / 1e3;
-      console.error(`  claim failed: ${claimRes.error}`);
-      results.push({ environment: environment2, ok: false, seconds: seconds2, error: claimRes.error });
-      continue;
-    }
-    const id = claimRes.data.id;
-    log(`  claimed ${id}, waiting...`);
-    const waited = await pollSandboxUntilReady(apiUrl, token, id, CLAIM_TIMEOUT_SECONDS);
-    const seconds = (Date.now() - started) / 1e3;
-    if ("error" in waited || waited.data.status !== "ready") {
-      const error = "error" in waited ? waited.error : waited.data.error ?? "failed";
-      console.error(`  failed: ${error}`);
-      results.push({ environment: environment2, ok: false, seconds, error });
-    } else {
-      const { data } = waited;
-      log(`  ready in ${data.readyMs !== null ? (data.readyMs / 1e3).toFixed(1) : "?"}s`);
-      for (const [stepId, outputs] of Object.entries(data.seedOutputs)) {
-        for (const [key, value] of Object.entries(outputs)) {
-          log(`    ${stepId}.${key}: ${JSON.stringify(value)}`);
-        }
-      }
-      const personas = [];
-      if (data.nativeLogin) {
-        for (const { name } of data.personas) {
-          const checked = await apiRequest(
-            apiUrl,
-            token,
-            "POST",
-            `/org/sandboxes-v2/sandboxes/${id}/auth-check`,
-            { persona: name },
-            // The API waits on the script (up to 60 s) and the sandbox connection.
-            { timeoutMs: 9e4 }
-          );
-          const check = checked.ok ? checked.data : { persona: name, ok: false, error: checked.error ?? "unknown error" };
-          personas.push(check);
-          if (check.ok) log(`    persona ${name}: signed in`);
-          else console.error(`    persona ${name}: FAILED
-${indentLines(check.error ?? "", "      ")}`);
-        }
-      }
-      const failedPersonas = personas.filter((p) => !p.ok).map((p) => p.persona);
-      results.push({
-        environment: environment2,
-        ok: failedPersonas.length === 0,
-        seconds,
-        ...failedPersonas.length > 0 ? { error: `persona sign-in failed: ${failedPersonas.join(", ")}` } : {},
-        ...data.nativeLogin ? { personas } : {}
-      });
+    if (!res.ok) {
+      console.error(`Error: ${res.error ?? "could not list sandboxes"}`);
+      process6.exit(1);
     }
-    log(`  destroying ${id}...`);
-    await apiRequest(apiUrl, token, "DELETE", `/org/sandboxes-v2/sandboxes/${id}`);
+    claims.push(...res.data);
+    cursor = res.nextCursor ?? null;
+  } while (cursor);
+  if (json) {
+    writeRawOutput(JSON.stringify(claims, null, 2));
+    return;
   }
-  log("");
-  log("Summary:");
-  log(`  ${pad2("Environment", 20)} ${pad2("Result", 6)} Seconds`);
-  for (const r of results) {
-    const errSuffix = r.error ? `  (${r.error})` : "";
-    log(`  ${pad2(r.environment, 20)} ${pad2(r.ok ? "OK" : "FAIL", 6)} ${r.seconds.toFixed(1)}${errSuffix}`);
+  if (claims.length === 0) {
+    console.log("No live claims.");
+    return;
   }
-  if (json) writeRawOutput(JSON.stringify(results, null, 2));
-  if (results.some((r) => !r.ok)) process4.exit(1);
-}
-
-// src/sandbox-push.ts
-import process5 from "process";
-import { spawnSync as spawnSync2 } from "child_process";
-import { createHash as createHash3 } from "crypto";
-import { createReadStream, createWriteStream, mkdtempSync as mkdtempSync2, readFileSync as readFileSync4, rmSync as rmSync2 } from "fs";
-import { open } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
-import { pipeline } from "stream/promises";
-import { createGunzip } from "zlib";
-
-// src/sandbox-push-syncable.ts
-import { spawnSync } from "child_process";
-import { existsSync, mkdtempSync, readFileSync as readFileSync3, rmSync, statSync } from "fs";
-import { tmpdir } from "os";
-import { dirname, join, resolve } from "path";
-var realDocker = (args) => {
-  const result = spawnSync("docker", args, { encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
-  if (result.error) return { status: null, stdout: "", stderr: result.error.message };
-  return { status: result.status, stdout: result.stdout, stderr: result.stderr };
-};
-var SAMPLE = 20;
-function sampleOf(paths) {
-  const sorted = [...paths].sort();
-  if (sorted.length <= SAMPLE) return sorted;
-  return Array.from({ length: SAMPLE }, (_, i) => sorted[Math.floor(i * sorted.length / SAMPLE)]);
-}
-var SYNCABLE_RULE = "a syncable image has your definition file at its WORKDIR, as `COPY . .` gives you";
-function syncabilityLine(params) {
-  const docker2 = params.docker ?? realDocker;
-  const git2 = spawnSync("git", ["ls-files", "-s", "-z"], { cwd: params.definitionDir, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
-  if (git2.status !== 0) return "Sync: not checked (the definition is not in a git repository).";
-  const tracked = git2.stdout.split("\0").flatMap((entry) => /^(100644|100755) [0-9a-f]+ \d\t(.*)$/s.exec(entry)?.[2] ?? []).filter((path) => path !== "cofactor.sandbox.yaml").filter((path) => existsSync(join(params.definitionDir, path)));
-  const temp = mkdtempSync(join(tmpdir(), "cofactor-syncable-"));
-  const created = docker2(["create", params.image]);
-  if (created.status !== 0) {
-    rmSync(temp, { recursive: true, force: true });
-    return `Sync: not checked (docker create failed: ${created.stderr.trim()}).`;
+  const names = new Map((await fetchProperties(apiUrl, token)).map((p) => [p.id, p.name]));
+  console.log(`${pad2("ID", 38)} ${pad2("Application", 24)} ${pad2("Environment", 14)} ${pad2("Status", 10)} ${pad2("Claimed", 26)} Expires`);
+  for (const c of claims) {
+    console.log(
+      `${pad2(c.id, 38)} ${pad2(names.get(c.applicationId) ?? c.applicationId, 24)} ${pad2(c.environment, 14)} ${pad2(c.status, 10)} ${pad2(c.createdAt, 26)} ${c.leaseExpiresAt ?? "-"}`
+    );
   }
-  const container = created.stdout.trim();
-  let copies = 0;
-  try {
-    const copyOut = (path) => {
-      const target = join(temp, String(copies++));
-      if (docker2(["cp", "-L", `${container}:${params.workdir}/${path}`, target]).status !== 0) return null;
-      return statSync(target).isFile() ? readFileSync3(target) : null;
-    };
-    const anchor = copyOut("cofactor.sandbox.yaml");
-    if (!anchor) {
-      return `Sync: not syncable: cofactor.sandbox.yaml isn't at ${params.workdir}/cofactor.sandbox.yaml (${SYNCABLE_RULE}).`;
+  console.log("\nTear one down with: cofactor sandbox destroy <id>");
+}
+function coerceInputValue(raw, type) {
+  switch (type) {
+    case "integer": {
+      if (!/^-?\d+$/.test(raw)) throw new Error(`must be an integer, got "${raw}"`);
+      return Number(raw);
     }
-    const sample = sampleOf(tracked);
-    let differ = 0;
-    let missing = 0;
-    for (const path of sample) {
-      const bytes = copyOut(path);
-      if (!bytes) missing += 1;
-      else if (gitBlobId(bytes) !== gitBlobId(readFileSync3(join(params.definitionDir, path)))) differ += 1;
+    case "number": {
+      const value = Number(raw);
+      if (Number.isNaN(value)) throw new Error(`must be a number, got "${raw}"`);
+      return value;
     }
-    const anchorOlder = gitBlobId(anchor) !== gitBlobId(readFileSync3(params.definitionFile));
-    const notes = [
-      ...anchorOlder || differ > 0 ? ["the image is older than your working tree, which is fine"] : [],
-      ...missing > 0 ? [`${missing} of ${sample.length} sampled files aren't in the image (fine for sources it doesn't ship)`] : []
-    ];
-    return `Sync: syncable${notes.length > 0 ? ` (${notes.join("; ")})` : ""}.`;
-  } finally {
-    docker2(["rm", container]);
-    rmSync(temp, { recursive: true, force: true });
+    case "boolean": {
+      if (raw === "true") return true;
+      if (raw === "false") return false;
+      throw new Error(`must be "true" or "false", got "${raw}"`);
+    }
+    default:
+      return raw;
   }
 }
-function syncabilityLineOrSkipped(params) {
-  try {
-    const definitionFile = resolve(params.definitionFile);
-    return syncabilityLine({ ...params, definitionFile, definitionDir: dirname(definitionFile) });
-  } catch (error) {
-    return `Sync: not checked (${error instanceof Error ? error.message : String(error)}).`;
+function buildRunInputFromFlags(argv, propTypes) {
+  const pairs = getArgValues(argv, "--input");
+  const input = {};
+  for (const pair of pairs) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0) {
+      console.error(`Error: invalid --input "${pair}". Use key=value.`);
+      process6.exit(1);
+    }
+    const key = pair.slice(0, eq);
+    const raw = pair.slice(eq + 1);
+    const type = propTypes[key];
+    if (!type) {
+      console.error(`Error: unknown input "${key}". Known: ${Object.keys(propTypes).join(", ") || "(none)"}`);
+      process6.exit(1);
+    }
+    try {
+      input[key] = coerceInputValue(raw, type);
+    } catch (error) {
+      console.error(`Error: --input ${key}: ${error instanceof Error ? error.message : String(error)}`);
+      process6.exit(1);
+    }
   }
+  return input;
 }
-
-// ../sandbox-helper/src/image-archive.ts
-import { z as z3 } from "zod";
-var MAX_BLOB_BYTES = 5 * 1024 ** 3;
-var ImageBlob = z3.object({
-  digest: z3.string().regex(/^sha256:[0-9a-f]{64}$/),
-  size: z3.number().int().nonnegative()
-});
-var ImageBlobs = z3.object({
-  config: ImageBlob,
-  // Docker allows at most 127 layers; each costs a storage lookup per push.
-  layers: z3.array(ImageBlob).min(1).max(128)
-});
-function withSandboxLayers(team, added, created) {
-  return {
-    ...team,
-    rootfs: { ...team.rootfs, diff_ids: [...team.rootfs.diff_ids, ...added.map((layer) => layer.digest)] },
-    history: [...team.history ?? [], ...added.map(() => ({ created, created_by: "cofactor sandbox push" }))],
-    config: { ...team.config, Entrypoint: ["/usr/local/bin/cofactor-sandbox", "boot"], Cmd: [] }
-  };
+async function pollRunUntilDone(apiUrl, token, runId, timeoutMs, timeoutNote = "") {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const pollRes = await apiRequest(apiUrl, token, "GET", `/org/sandboxes-v2/runs/${runId}`);
+    if (!pollRes.ok) {
+      console.error(`Error: ${pollRes.error}`);
+      process6.exit(1);
+    }
+    if (pollRes.data.status !== "running") return pollRes.data;
+    await sleep(2e3);
+  }
+  console.error(`Timed out waiting for run ${runId}${timeoutNote}.`);
+  process6.exit(1);
 }
-var BLOCK = 512;
-var encoder = new TextEncoder();
-var decoder = new TextDecoder();
-function tarHeader(name, size, mode = 420) {
-  if (encoder.encode(name).length > 100) throw new Error(`tar entry name too long: ${name}`);
-  const header = new Uint8Array(BLOCK);
-  const put = (offset, length, value) => header.set(encoder.encode(value).slice(0, length), offset);
-  const octal = (offset, length, value) => put(offset, length, `${value.toString(8).padStart(length - 1, "0")}\0`);
-  put(0, 100, name);
-  octal(100, 8, mode);
-  octal(108, 8, 0);
-  octal(116, 8, 0);
-  octal(124, 12, size);
-  octal(136, 12, 0);
-  put(148, 8, "        ");
-  put(156, 1, "0");
-  put(257, 6, "ustar\0");
-  put(263, 2, "00");
-  const checksum = header.reduce((sum, byte) => sum + byte, 0);
-  put(148, 8, `${checksum.toString(8).padStart(6, "0")}\0 `);
-  return header;
-}
-function tarPadding(size) {
-  return new Uint8Array((BLOCK - size % BLOCK) % BLOCK);
-}
-var TAR_END = new Uint8Array(BLOCK * 2);
-function tarOf(files) {
-  const parts = files.flatMap((file) => [tarHeader(file.name, file.data.length, file.mode), file.data, tarPadding(file.data.length)]);
-  parts.push(TAR_END);
-  const out = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
-  let at = 0;
-  for (const part of parts) {
-    out.set(part, at);
-    at += part.length;
+async function handleSandboxRun(argv, apiUrl, token) {
+  const positional = argv.filter((a) => !a.startsWith("-"));
+  const [id, actionRef] = positional;
+  if (!id || !actionRef) {
+    console.error(
+      "Usage: cofactor sandbox run <id> <action|plugin.op> [--input k=v ...] [--json-input '{...}'] [--json]"
+    );
+    process6.exit(1);
   }
-  return out;
-}
-var field = (block, offset, length) => decoder.decode(block.subarray(offset, offset + length)).replace(/\0.*$/s, "");
-async function tarEntries(read) {
-  const entries = [];
-  let longName = null;
-  for (let offset = 0; ; ) {
-    const block = await read(offset, BLOCK);
-    if (block.length < BLOCK) throw new Error(`the tar ends at byte ${offset + block.length}, before its end-of-archive block; it is truncated`);
-    if (block.every((byte) => byte === 0)) return entries;
-    const size = Number.parseInt(field(block, 124, 12).trim() || "0", 8);
-    if (!Number.isSafeInteger(size) || size < 0) throw new Error(`tar entry at ${offset} has an invalid size`);
-    const type = field(block, 156, 1) || "0";
-    const prefix = field(block, 345, 155);
-    const name = longName ?? (prefix ? `${prefix}/${field(block, 0, 100)}` : field(block, 0, 100));
-    const data = offset + BLOCK;
-    longName = null;
-    if (type === "x" || type === "L") {
-      const text = decoder.decode(await read(data, size)).replace(/\0+$/, "");
-      longName = type === "L" ? text : /(?:^|\n)\d+ path=([^\n]*)\n/.exec(text)?.[1] ?? null;
-    } else if (type === "0") {
-      entries.push({ name, offset: data, size });
+  const json = hasFlag(argv, "--json");
+  const jsonInput = getArgValue(argv, "--json-input");
+  const showRes = await apiRequest(apiUrl, token, "GET", `/org/sandboxes-v2/sandboxes/${id}`);
+  if (!showRes.ok) {
+    console.error(`Error: ${showRes.error}`);
+    process6.exit(1);
+  }
+  const sandbox = showRes.data;
+  const repoAction = sandbox.actions.find((a) => a.slug === actionRef);
+  const operation = sandbox.operations.find((op) => op.name === actionRef);
+  if (!repoAction && !operation) {
+    console.error(`Error: unknown action or operation "${actionRef}".`);
+    console.error(`  Actions: ${sandbox.actions.map((a) => a.slug).join(", ") || "(none)"}`);
+    console.error(`  Operations: ${sandbox.operations.map((op) => op.name).join(", ") || "(none)"}`);
+    process6.exit(1);
+  }
+  let input;
+  if (jsonInput !== void 0) {
+    try {
+      input = JSON.parse(jsonInput);
+    } catch (error) {
+      console.error(`Error: invalid --json-input: ${error instanceof Error ? error.message : String(error)}`);
+      process6.exit(1);
     }
-    offset = data + size + tarPadding(size).length;
+  } else if (repoAction) {
+    const propTypes = Object.fromEntries(Object.entries(repoAction.input).map(([key, prop]) => [key, prop.type]));
+    input = buildRunInputFromFlags(argv, propTypes);
+  } else {
+    input = buildRunInputFromFlags(argv, jsonSchemaPropTypes(operation.inputSchema));
+  }
+  const enqueueRes = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/sandboxes-v2/sandboxes/${id}/runs`,
+    { action: actionRef, input }
+  );
+  if (!enqueueRes.ok) {
+    if (enqueueRes.code === "SANDBOX_V2_ACTION_INVALID_INPUT") {
+      console.error(`Error: invalid input for "${actionRef}":`);
+      for (const issue of enqueueRes.issues ?? []) {
+        if (typeof issue === "string") console.error(`  ${issue}`);
+        else console.error(`  ${(issue.path ?? []).join(".")}: ${issue.message ?? ""}`);
+      }
+      console.error("");
+      console.error("Input schema:");
+      writeRawOutput(JSON.stringify(repoAction ? repoAction.input : operation.inputSchema, null, 2));
+    } else {
+      console.error(`Error: ${enqueueRes.error}`);
+    }
+    process6.exit(1);
+  }
+  const runId = enqueueRes.data.id;
+  const run = await pollRunUntilDone(apiUrl, token, runId, ((repoAction?.timeout ?? 60) + 60) * 1e3);
+  if (json) {
+    writeRawOutput(JSON.stringify(run, null, 2));
+    if (run.status === "failed") process6.exit(1);
+    return;
+  }
+  if (run.status === "failed") {
+    console.error(`Run failed: ${run.error ?? "unknown error"}`);
+    if (run.stderrTail) {
+      console.error("");
+      console.error("stderr:");
+      console.error(run.stderrTail);
+    }
+    process6.exit(1);
   }
+  writeRawOutput(JSON.stringify(run.output ?? {}, null, 2));
 }
-
-// src/sandbox-push.ts
-var USAGE = [
-  "Usage: cofactor sandbox push --application <name|id> <image> [--definition <file>] [--tag <tag>]... [--wait] [--json]",
-  "",
-  "Tag main builds `main` (or `nightly`): once an application has a push with either tag, its head is the",
-  "newest such push, and only those runs move the visual-review baseline. Other pushes are claimed with --at."
-].join("\n");
-var UPLOAD_CONCURRENCY = 4;
-var UPLOAD_ATTEMPTS = 3;
-var HASH_CHUNK_BYTES = 8 * 1024 * 1024;
-var IMPORT_TIMEOUT_MS = 50 * 6e4;
-var IMPORT_POLL_MS = 5e3;
-var PushError = class extends Error {
-  constructor(message, issues = []) {
-    super(message);
-    this.issues = issues;
+var EXEC_USAGE = "Usage: cofactor sandbox exec <id> [--timeout <seconds>] [--json] -- <command...>";
+function parseExecArgs(options, commandWords) {
+  const command = commandWords.join(" ");
+  if (command.trim() === "") return { ok: false, error: `a command is required after \`--\`. ${EXEC_USAGE}` };
+  const id = v2Positionals("exec", options)[0];
+  if (!id) return { ok: false, error: `sandbox id required. ${EXEC_USAGE}` };
+  const timeout = getArgValue(options, "--timeout");
+  let timeoutSeconds;
+  if (timeout !== void 0) {
+    timeoutSeconds = /^\d+$/.test(timeout) ? Number(timeout) : NaN;
+    if (!Number.isInteger(timeoutSeconds) || timeoutSeconds < 1 || timeoutSeconds > EXEC_MAX_TIMEOUT_SECONDS) {
+      return { ok: false, error: `--timeout must be a whole number of seconds from 1 to ${EXEC_MAX_TIMEOUT_SECONDS}.` };
+    }
   }
-  issues;
-};
-function fail(message, issues) {
-  throw new PushError(message, issues);
+  return { ok: true, args: { id, timeoutSeconds, json: hasFlag(options, "--json"), command } };
 }
-function docker(args, options) {
-  const result = spawnSync2("docker", args, {
-    encoding: "utf8",
-    stdio: ["ignore", "pipe", options.quiet ? "pipe" : "inherit"],
-    maxBuffer: 64 * 1024 * 1024
-  });
-  if (result.error) fail(`could not run docker (${result.error.message}); is Docker installed and running?`);
-  if (result.status !== 0) fail(`docker ${args.slice(0, 2).join(" ")} failed:
-${result.stderr ?? ""}`.trimEnd());
-  return result.stdout;
+function execExitCode(run) {
+  if (run.status === "succeeded") return 0;
+  return run.exitCode ?? 1;
 }
-function imageConfigOf(image) {
-  const result = spawnSync2("docker", ["image", "inspect", image], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
-  if (result.error) fail(`could not run docker (${result.error.message}); is Docker installed and running?`);
-  const [inspected] = result.status === 0 ? JSON.parse(result.stdout) : [];
-  if (!inspected) fail(`Docker has no local image ${image}: build or pull it first`);
-  if (inspected.Os !== "linux" || inspected.Architecture !== "amd64") {
-    fail(
-      `${image} is ${inspected.Os}/${inspected.Architecture}; sandboxes run linux/amd64. Rebuild it with
-  docker buildx build --platform linux/amd64 -t ${image} --load <context>`
-    );
+async function handleSandboxExec(options, commandWords, apiUrl, token) {
+  const parsed = parseExecArgs(options, commandWords);
+  if (!parsed.ok) {
+    console.error(`Error: ${parsed.error}`);
+    process6.exit(1);
   }
-  const user = inspected.Config.User ?? "";
-  if (!["", "0", "root"].includes(user.split(":")[0])) {
-    fail(
-      `${image} runs as USER ${user}; a sandbox image must leave USER as root (the sandbox drops to uid 1000 itself). Remove the final \`USER\` line from the Dockerfile, or end it with \`USER root\`.`
-    );
+  const { id, timeoutSeconds, json, command } = parsed.args;
+  const enqueueRes = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/sandboxes-v2/sandboxes/${id}/exec`,
+    timeoutSeconds === void 0 ? { command } : { command, timeoutSeconds }
+  );
+  if (!enqueueRes.ok) {
+    console.error(`Error: ${enqueueRes.error}`);
+    process6.exit(1);
   }
-  const env = Object.fromEntries(
-    (inspected.Config.Env ?? []).map((entry) => {
-      const separator = entry.indexOf("=");
-      return [entry.slice(0, separator), entry.slice(separator + 1)];
-    })
+  const runId = enqueueRes.data.id;
+  const run = await pollRunUntilDone(
+    apiUrl,
+    token,
+    runId,
+    ((timeoutSeconds ?? EXEC_DEFAULT_TIMEOUT_SECONDS) + 60) * 1e3,
+    "; the command may still be running in the sandbox"
   );
-  const parsed = imageConfigSchema.safeParse({ workdir: inspected.Config.WorkingDir ?? "", env });
-  if (!parsed.success) {
-    const workdir = inspected.Config.WorkingDir || "(none)";
-    fail(
-      `${image}'s WORKDIR ${workdir} can't be used: ${parsed.error.issues[0]?.message ?? "invalid"}. Set one for your app in its Dockerfile (e.g. \`WORKDIR /app\`): services, prepare commands and actions run from it, and the sandbox makes it writable by the app.`
-    );
+  const code = execExitCode(run);
+  if (json) {
+    writeRawOutput(JSON.stringify(run, null, 2));
+    process6.exit(code);
   }
-  return parsed.data;
-}
-function shellWord(value) {
-  return /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
-}
-async function apiOrFail(result) {
-  const res = await result;
-  if (!res.ok) fail(res.error ?? "unknown error", res.issues);
-  return res.data;
-}
-var mib = (bytes) => `${(bytes / 1024 / 1024).toFixed(bytes < 10 * 1024 * 1024 ? 1 : 0)} MB`;
-async function readAt(file, offset, size) {
-  const bytes = new Uint8Array(size);
-  for (let at = 0; at < size; ) {
-    const { bytesRead } = await file.read(bytes, at, size - at, offset + at);
-    if (bytesRead === 0) return bytes.subarray(0, at);
-    at += bytesRead;
+  if (run.status === "failed" && run.exitCode === null) {
+    process6.stderr.write(`Error: ${run.error ?? "unknown error"}
+`);
+    if (run.stdoutTail) process6.stderr.write(run.stdoutTail);
+    if (run.stdoutTail && !run.stdoutTail.endsWith("\n") && run.stderrTail) process6.stderr.write("\n");
+    if (run.stderrTail) process6.stderr.write(run.stderrTail);
+    process6.exit(1);
   }
-  return bytes;
+  if (run.stdoutTail) process6.stdout.write(run.stdoutTail);
+  if (run.stderrTail) process6.stderr.write(run.stderrTail);
+  if (code === 124 && run.error) process6.stderr.write(`
+${run.error}
+`);
+  process6.exit(code);
 }
-async function digestOf(file, offset, size) {
-  const hash = createHash3("sha256");
-  for (let at = 0; at < size; at += HASH_CHUNK_BYTES) {
-    hash.update(await readAt(file, offset + at, Math.min(HASH_CHUNK_BYTES, size - at)));
+async function handleSandboxDestroy(argv, apiUrl, token) {
+  const [id] = argv.filter((a) => !a.startsWith("-"));
+  if (!id) {
+    console.error("Usage: cofactor sandbox destroy <id>");
+    process6.exit(1);
   }
-  return `sha256:${hash.digest("hex")}`;
+  const local = trackedLocalSandbox(id, apiUrl);
+  const res = await apiRequest(
+    apiUrl,
+    token,
+    "DELETE",
+    `/org/sandboxes-v2/sandboxes/${id}`
+  );
+  if (!res.ok) {
+    console.error(`Error: ${res.error}`);
+    process6.exit(1);
+  }
+  console.log(`Sandbox ${id} destroying.`);
+  if (local) await cleanupLocalRefs(apiUrl, token, local.applicationId, local.applicationId, { id, version: local.version });
 }
-function partOf(bytes) {
-  return { digest: `sha256:${createHash3("sha256").update(bytes).digest("hex")}`, size: bytes.length, body: () => bytes };
-}
-async function putBlob(url, headers, part) {
-  const digest = part.digest;
-  for (let attempt = 1; ; attempt++) {
-    let response;
-    try {
-      const init = {
-        method: "PUT",
-        headers: { ...headers, "content-length": String(part.size) },
-        body: part.body(),
-        duplex: "half"
-      };
-      response = await fetch(url, init);
-    } catch (error) {
-      if (attempt >= UPLOAD_ATTEMPTS) throw error;
-      await new Promise((resolve3) => setTimeout(resolve3, 2e3 * attempt));
-      continue;
-    }
-    if (response.ok) return;
-    const detail = `${response.status}: ${(await response.text()).slice(0, 300)}`;
-    if (response.status < 500 || attempt >= UPLOAD_ATTEMPTS) {
-      fail(`uploading ${digest} was refused (HTTP ${detail}); run the push again to upload what is still missing`);
-    }
-    await new Promise((resolve3) => setTimeout(resolve3, 2e3 * attempt));
-  }
-}
-async function savedImage(archive) {
-  const file = await open(archive);
-  try {
-    const entries = await tarEntries((offset, length) => readAt(file, offset, length)).catch(
-      (error) => fail(`reading the saved image: ${error instanceof Error ? error.message : String(error)}`)
-    );
-    const byName = new Map(entries.map((entry) => [entry.name.replace(/^\.\//, ""), entry]));
-    const entryOf = (name) => {
-      const entry = byName.get(name);
-      if (!entry) fail(`the saved image has no ${name}; is this a \`docker save\` archive?`);
-      return entry;
-    };
-    const json = async (name) => {
-      const entry = entryOf(name);
-      return JSON.parse(new TextDecoder().decode(await readAt(file, entry.offset, entry.size)));
-    };
-    const layerOf = async (name) => {
-      const entry = entryOf(name);
-      const tooLarge = (bytes) => fail(`a layer of the image is ${(bytes / 1024 ** 3).toFixed(1)} GB; a push takes at most 5 GB per layer. Slim the image.`);
-      if (entry.size > MAX_BLOB_BYTES) tooLarge(entry.size);
-      const range = { start: entry.offset, end: entry.offset + entry.size - 1 };
-      const [first, second] = await readAt(file, entry.offset, 2);
-      if (first === 31 && second === 139) {
-        const unpacked = join2(dirname2(archive), `layer-${entry.offset}.tar`);
-        await pipeline(createReadStream(archive, range), createGunzip(), createWriteStream(unpacked)).catch(
-          (error) => fail(`unpacking a compressed layer of the image: ${error instanceof Error ? error.message : String(error)}`)
-        );
-        const plain = await open(unpacked);
-        try {
-          const { size } = await plain.stat();
-          if (size > MAX_BLOB_BYTES) tooLarge(size);
-          return { digest: await digestOf(plain, 0, size), size, body: () => createReadStream(unpacked) };
-        } finally {
-          await plain.close();
-        }
-      }
-      return { digest: await digestOf(file, entry.offset, entry.size), size: entry.size, body: () => createReadStream(archive, range) };
-    };
-    const [manifest] = await json("manifest.json");
-    if (!manifest) fail("the saved image lists no image");
-    const layers = [];
-    for (const name of manifest.Layers) layers.push(await layerOf(name));
-    return { config: await json(manifest.Config), layers };
-  } finally {
-    await file.close();
-  }
-}
-async function pushedImage(archive, cofactorLayers, definitionYaml, config) {
-  const saved = await savedImage(archive);
-  const own = partOf(
-    tarOf([
-      { name: IMAGE_DEFINITION_FILE.slice(1), data: new TextEncoder().encode(definitionYaml) },
-      { name: IMAGE_CONFIG_FILE.slice(1), data: new TextEncoder().encode(JSON.stringify(config)) }
-    ])
-  );
-  const added = [...cofactorLayers, own];
-  const pushed = withSandboxLayers(saved.config, added, (/* @__PURE__ */ new Date()).toISOString());
-  const imageConfig = partOf(new TextEncoder().encode(JSON.stringify(pushed)));
-  const blob = ({ digest, size }) => ({ digest, size });
-  return {
-    config: blob(imageConfig),
-    layers: [...saved.layers, ...added].map(blob),
-    blobs: new Map([imageConfig, ...saved.layers, own].map((part) => [part.digest, part]))
-  };
-}
-async function handleSandboxPush(argv, apiUrl, token) {
-  try {
-    await push(argv, apiUrl, token);
-  } catch (error) {
-    if (!(error instanceof PushError)) throw error;
-    console.error(`Error: ${error.message}`);
-    for (const issue of error.issues) console.error(`  ${issue.path || "(root)"}: ${issue.message}`);
-    process5.exit(1);
-  }
-}
-async function push(argv, apiUrl, token) {
-  const valueFlags = /* @__PURE__ */ new Set(["--application", "--property", "--definition", "--tag", "--env", "--org", "--token", "--api-url", "--app-url"]);
-  const positional = argv.filter((arg, i) => !arg.startsWith("-") && !valueFlags.has(argv[i - 1] ?? ""));
-  const image = positional[0];
-  if (!image) fail(`an image is required
-${USAGE}`);
-  const definitionFile = getArgValue(argv, "--definition") ?? "./cofactor.sandbox.yaml";
-  const tags = getArgValues(argv, "--tag");
-  const badTag = tags.find((tag) => !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(tag));
-  if (badTag !== void 0) fail(`--tag ${badTag}: use letters, digits, '.', '_' and '-' (at most 64, starting with a letter or digit)`);
-  if (tags.length > 10) fail("a push takes at most 10 tags");
-  const wait = hasFlag(argv, "--wait");
+async function handleSandboxVerifyEnv(argv, apiUrl, token) {
+  const applicationId = await resolveApplicationId(argv, apiUrl, token);
+  const onlyEnvironment = getArgValue(argv, "--environment");
   const json = hasFlag(argv, "--json");
   const log = (line) => json ? console.error(line) : console.log(line);
-  let definitionYaml;
-  try {
-    definitionYaml = readFileSync4(definitionFile, "utf8");
-  } catch (error) {
-    fail(`reading ${definitionFile}: ${error instanceof Error ? error.message : String(error)}`);
-  }
-  const { definition, issues } = validateDefinition(definitionYaml, "upload");
-  if (!definition || issues.length > 0) fail(`${definitionFile} is not a valid definition for pushed images:`, issues);
-  const storageProvider = definition.object_storage?.provider;
-  const applicationId = await resolveOrCreateSandboxApplication(argv, apiUrl, token);
-  const config = imageConfigOf(image);
-  log(syncabilityLineOrSkipped({ image, workdir: config.workdir, definitionFile }));
-  const work = mkdtempSync2(join2(tmpdir2(), "cofactor-push-"));
-  const cleanUp = () => rmSync2(work, { recursive: true, force: true });
-  const interrupted = (signal) => {
-    cleanUp();
-    process5.exit(signal === "SIGINT" ? 130 : 143);
-  };
-  process5.once("SIGINT", interrupted);
-  process5.once("SIGTERM", interrupted);
-  process5.exitCode = 1;
-  try {
-    const ours = await apiOrFail(
-      apiRequest(
-        apiUrl,
-        token,
-        "GET",
-        "/org/sandboxes-v2/helper-layer"
-      )
-    );
-    if (!ours.helper) fail("this Cofactor takes pushes from an older cofactor CLI; use the version it ships with");
-    const cofactorLayers = [ours.helper, ...storageProvider ? [ours.objectStorage[storageProvider]] : []];
-    const archive = join2(work, "image.tar");
-    log("Saving the image...");
-    docker(["save", "--output", archive, image], { quiet: json });
-    const pushing = await pushedImage(archive, cofactorLayers, definitionYaml, config);
-    const { layers } = pushing;
-    const created = await apiOrFail(
-      apiRequest(
-        apiUrl,
-        token,
-        "POST",
-        `/org/applications/${applicationId}/sandbox/uploads`,
-        { definitionYaml, platformVersion: ours.platformVersion, tags, image: { config: pushing.config, layers } }
-      )
-    );
-    const partsByDigest = pushing.blobs;
-    const uploadBytes = created.uploads.reduce((total, upload) => total + (partsByDigest.get(upload.digest)?.size ?? 0), 0);
-    const imageBytes = layers.reduce((total, layer) => total + layer.size, 0);
-    log(`Pushing ${created.id}: uploading ${created.uploads.length} of ${layers.length + 1} blobs (${mib(uploadBytes)}); ${mib(imageBytes - uploadBytes)} already in Cofactor`);
-    const queue = [...created.uploads];
-    let sent = 0;
-    await Promise.all(
-      Array.from({ length: UPLOAD_CONCURRENCY }, async () => {
-        for (let next = queue.shift(); next; next = queue.shift()) {
-          const part = partsByDigest.get(next.digest);
-          if (!part) fail(`Cofactor asked for ${next.digest}, which this image doesn't have`);
-          await putBlob(next.url, next.headers, part);
-          sent += part.size;
-          if (part.size > 10 * 1024 * 1024) log(`  ${mib(sent)} of ${mib(uploadBytes)}`);
-        }
-      })
+  const app = await fetchApplicationSandbox(
+    apiUrl,
+    token,
+    applicationId,
+    getArgValue(argv, "--at")
+  );
+  if (!app.version || !app.definition) {
+    console.error(
+      "Error: no sandbox definition at the default version. For GitHub, push it and use --at <sha>; for images, run `cofactor sandbox push`."
     );
-    rmSync2(archive);
-    let pushed = await apiOrFail(
-      apiRequest(
-        apiUrl,
-        token,
-        "POST",
-        `/org/applications/${applicationId}/sandbox/uploads/${created.id}/complete`
-      )
+    process6.exit(1);
+  }
+  const version = app.version;
+  const allEnvironments = app.definition.environments.map((e) => e.name);
+  if (onlyEnvironment && !allEnvironments.includes(onlyEnvironment)) {
+    console.error(`Error: environment "${onlyEnvironment}" not found. Known: ${allEnvironments.join(", ")}`);
+    process6.exit(1);
+  }
+  const environments = onlyEnvironment ? [onlyEnvironment] : allEnvironments;
+  const results = [];
+  for (const environment2 of environments) {
+    log(`
+=== ${environment2} ===`);
+    const started = Date.now();
+    const claimRes = await apiRequest(
+      apiUrl,
+      token,
+      "POST",
+      "/org/sandboxes-v2/sandboxes",
+      { applicationId, environment: environment2, version }
     );
-    if (wait) {
-      log("Importing (Cofactor boots the image until its services are healthy)...");
-      const deadline = Date.now() + IMPORT_TIMEOUT_MS;
-      const importStarted = Date.now();
-      let reported = importStarted;
-      while ((pushed.status === "importing" || pushed.status === "uploading") && Date.now() < deadline) {
-        await new Promise((resolve3) => setTimeout(resolve3, IMPORT_POLL_MS));
-        if (Date.now() - reported >= 6e4) {
-          reported = Date.now();
-          log(`  still importing (${Math.round((reported - importStarted) / 6e4)} min)`);
-        }
-        pushed = await apiOrFail(
-          apiRequest(apiUrl, token, "GET", `/org/applications/${applicationId}/sandbox/uploads/${created.id}`)
-        );
-      }
+    if (!claimRes.ok) {
+      const seconds2 = (Date.now() - started) / 1e3;
+      console.error(`  claim failed: ${claimRes.error}`);
+      results.push({ environment: environment2, ok: false, seconds: seconds2, error: claimRes.error });
+      continue;
     }
-    const uploaded = { blobs: created.uploads.length, of: layers.length + 1, bytes: uploadBytes, reusedBytes: imageBytes - uploadBytes };
-    const application = shellWord(getArgValue(argv, "--application") ?? getArgValue(argv, "--property") ?? applicationId);
-    const target = ["--env", "--org"].map((flag) => {
-      const value = getArgValue(process5.argv, flag);
-      return value ? ` ${flag} ${shellWord(value)}` : "";
-    }).join("");
-    if (json) {
-      writeRawOutput(JSON.stringify({ ...pushed, uploaded }, null, 2));
+    const id = claimRes.data.id;
+    log(`  claimed ${id}, waiting...`);
+    const waited = await pollSandboxUntilReady(apiUrl, token, id, CLAIM_TIMEOUT_SECONDS);
+    const seconds = (Date.now() - started) / 1e3;
+    if ("error" in waited || waited.data.status !== "ready") {
+      const error = "error" in waited ? waited.error : waited.data.error ?? "failed";
+      console.error(`  failed: ${error}`);
+      results.push({ environment: environment2, ok: false, seconds, error });
     } else {
-      console.log(`Push ${pushed.id}: ${pushed.status}${pushed.tags.length > 0 ? ` [${pushed.tags.join(", ")}]` : ""}`);
-      if (pushed.status === "ready") {
-        console.log(`  Claim it: cofactor sandbox claim --application ${application} --environment default --wait${target}`);
-      } else if (pushed.status !== "failed") {
-        console.log(`  Importing; follow it with: cofactor sandbox envs --application ${application}${target}`);
+      const { data } = waited;
+      log(`  ready in ${data.readyMs !== null ? (data.readyMs / 1e3).toFixed(1) : "?"}s`);
+      for (const [stepId, outputs] of Object.entries(data.seedOutputs)) {
+        for (const [key, value] of Object.entries(outputs)) {
+          log(`    ${stepId}.${key}: ${JSON.stringify(value)}`);
+        }
       }
-    }
-    if (pushed.status === "failed") fail(`push ${pushed.id} failed:
-${pushed.error ?? "no reason given"}`);
-    process5.exitCode = 0;
-  } finally {
-    process5.off("SIGINT", interrupted);
-    process5.off("SIGTERM", interrupted);
-    cleanUp();
-  }
-}
-
-// src/sandbox-sync.ts
-import { spawnSync as spawnSync3 } from "child_process";
-import process6 from "process";
-import { copyFileSync, existsSync as existsSync2, lstatSync, mkdtempSync as mkdtempSync3, readFileSync as readFileSync5, realpathSync, rmSync as rmSync3 } from "fs";
-import { tmpdir as tmpdir3 } from "os";
-import { join as join3, relative, resolve as resolve2, sep } from "path";
-var SyncError = class extends Error {
-};
-function git(args, options) {
-  const result = spawnSync3("git", args, {
-    cwd: options.cwd,
-    env: options.env ?? process6.env,
-    input: options.input,
-    encoding: "utf8",
-    maxBuffer: 1 << 30
-    // Node defaults to 1 MiB; this repo's `ls-files -s -z` alone is 1.2 MB
-  });
-  if (result.error) throw new SyncError(`git ${args[0]} failed: ${result.error.message}`);
-  if (!(options.okCodes ?? [0]).includes(result.status ?? -1)) {
-    throw new SyncError(`git ${args[0]} failed (${result.signal ?? result.status}): ${result.stderr.trim()}`);
-  }
-  return result.stdout;
-}
-var toPosix = (path) => path.split(sep).join("/");
-function repositoryOf(dir) {
-  const top = git(["rev-parse", "--show-toplevel"], { cwd: dir }).trim();
-  const gitDir = git(["rev-parse", "--absolute-git-dir"], { cwd: dir }).trim();
-  return { top: realpathSync(top), gitDir };
-}
-function indexEntries(output2, strip, top) {
-  const files = [];
-  const skipped = [];
-  for (const entry of output2.split("\0")) {
-    if (entry === "") continue;
-    const match = /^(\d{6}) ([0-9a-f]+) \d\t(.*)$/s.exec(entry);
-    if (!match) throw new SyncError(`unexpected git ls-files line: ${entry}`);
-    const [, mode, blob, repoPath] = match;
-    const path = strip === "" ? repoPath : repoPath.slice(strip.length + 1);
-    const onDisk = mode === "100644" || mode === "100755" ? lstatOrNull(join3(top, repoPath)) : null;
-    if (onDisk?.isFile()) files.push({ path, blob, mode: mode === "100755" ? 493 : 420, size: onDisk.size });
-    else skipped.push(path);
+      const personas = [];
+      if (data.nativeLogin) {
+        for (const { name } of data.personas) {
+          const checked = await apiRequest(
+            apiUrl,
+            token,
+            "POST",
+            `/org/sandboxes-v2/sandboxes/${id}/auth-check`,
+            { persona: name },
+            // The API waits on the script (up to 60 s) and the sandbox connection.
+            { timeoutMs: 9e4 }
+          );
+          const check = checked.ok ? checked.data : { persona: name, ok: false, error: checked.error ?? "unknown error" };
+          personas.push(check);
+          if (check.ok) log(`    persona ${name}: signed in`);
+          else console.error(`    persona ${name}: FAILED
+${indentLines(check.error ?? "", "      ")}`);
+        }
+      }
+      const failedPersonas = personas.filter((p) => !p.ok).map((p) => p.persona);
+      results.push({
+        environment: environment2,
+        ok: failedPersonas.length === 0,
+        seconds,
+        ...failedPersonas.length > 0 ? { error: `persona sign-in failed: ${failedPersonas.join(", ")}` } : {},
+        ...data.nativeLogin ? { personas } : {}
+      });
+    }
+    log(`  destroying ${id}...`);
+    await apiRequest(apiUrl, token, "DELETE", `/org/sandboxes-v2/sandboxes/${id}`);
   }
-  return { files, skipped };
+  log("");
+  log("Summary:");
+  log(`  ${pad2("Environment", 20)} ${pad2("Result", 6)} Seconds`);
+  for (const r of results) {
+    const errSuffix = r.error ? `  (${r.error})` : "";
+    log(`  ${pad2(r.environment, 20)} ${pad2(r.ok ? "OK" : "FAIL", 6)} ${r.seconds.toFixed(1)}${errSuffix}`);
+  }
+  if (json) writeRawOutput(JSON.stringify(results, null, 2));
+  if (results.some((r) => !r.ok)) process6.exit(1);
 }
-function workingTree(root) {
-  const { top, gitDir } = repositoryOf(root);
-  const prefix = toPosix(relative(top, realpathSync(root)));
-  const temp = mkdtempSync3(join3(tmpdir3(), "cofactor-sync-"));
-  const cleanup = () => rmSync3(temp, { recursive: true, force: true });
-  try {
-    const index = join3(temp, "index");
-    const env = { ...process6.env, GIT_INDEX_FILE: index };
-    const userIndex = join3(gitDir, "index");
-    if (existsSync2(userIndex)) copyFileSync(userIndex, index);
-    else if (git(["rev-parse", "--verify", "-q", "HEAD"], { cwd: top, okCodes: [0, 1] }).trim() !== "") git(["read-tree", "HEAD"], { cwd: top, env });
-    const pathspec = prefix === "" ? "." : `:(literal)${prefix}`;
-    git(["add", "-A", "--", pathspec], { cwd: top, env });
-    const entries = indexEntries(git(["ls-files", "-s", "-z", "--", pathspec], { cwd: top, env }), prefix, top);
-    const files = withRawBlobs(entries.files, top, prefix);
-    const skipped = entries.skipped;
-    const tree = git(prefix === "" ? ["write-tree"] : ["write-tree", `--prefix=${prefix}/`], { cwd: top, env }).trim();
-    const untracked = new Set(
-      git(["ls-files", "--others", "--exclude-standard", "-z", "--", pathspec], { cwd: top }).split("\0").filter(Boolean).map((path) => prefix === "" ? path : path.slice(prefix.length + 1))
-    );
-    return { files, skipped, untracked, tree, repo: top, prefix, env, cleanup };
-  } catch (error) {
-    cleanup();
-    throw error;
+async function handleSandboxAuthCheck(argv, apiUrl, token) {
+  const id = v2Positionals("auth-check", argv)[0];
+  const persona = getArgValue(argv, "--persona");
+  if (!id || !persona) {
+    console.error("Usage: cofactor sandbox auth-check <id> --persona <name> [--json]");
+    process6.exit(1);
   }
+  const checked = await apiRequest(
+    apiUrl,
+    token,
+    "POST",
+    `/org/sandboxes-v2/sandboxes/${encodeURIComponent(id)}/auth-check`,
+    { persona },
+    { timeoutMs: 9e4 }
+  );
+  exitOnRefusal(checked);
+  if (hasFlag(argv, "--json")) writeRawOutput(JSON.stringify(checked.data, null, 2));
+  else if (checked.data.ok) console.log(`Persona ${persona}: signed in`);
+  else console.error(`Persona ${persona}: FAILED
+${checked.data.error ?? "unknown error"}`);
+  if (!checked.data.ok) process6.exit(1);
 }
-function buildOutput(dir, to) {
-  const { gitDir } = repositoryOf(dir);
-  const temp = mkdtempSync3(join3(tmpdir3(), "cofactor-sync-"));
+
+// src/sandbox-push.ts
+import process7 from "process";
+import { spawnSync as spawnSync4 } from "child_process";
+import { createHash as createHash4 } from "crypto";
+import { createReadStream, createWriteStream, mkdtempSync as mkdtempSync3, readFileSync as readFileSync6, rmSync as rmSync4 } from "fs";
+import { open } from "fs/promises";
+import { tmpdir as tmpdir3 } from "os";
+import { dirname as dirname2, join as join4 } from "path";
+import { pipeline } from "stream/promises";
+import { createGunzip } from "zlib";
+
+// src/sandbox-push-syncable.ts
+import { spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync3, mkdtempSync as mkdtempSync2, readFileSync as readFileSync5, rmSync as rmSync3, statSync } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { dirname, join as join3, resolve as resolve3 } from "path";
+var realDocker = (args) => {
+  const result = spawnSync3("docker", args, { encoding: "utf8", maxBuffer: 16 * 1024 * 1024 });
+  if (result.error) return { status: null, stdout: "", stderr: result.error.message };
+  return { status: result.status, stdout: result.stdout, stderr: result.stderr };
+};
+var SAMPLE = 20;
+function sampleOf(paths) {
+  const sorted = [...paths].sort();
+  if (sorted.length <= SAMPLE) return sorted;
+  return Array.from({ length: SAMPLE }, (_, i) => sorted[Math.floor(i * sorted.length / SAMPLE)]);
+}
+var SYNCABLE_RULE = "a syncable image has your definition file at its WORKDIR, as `COPY . .` gives you";
+function syncabilityLine(params) {
+  const docker2 = params.docker ?? realDocker;
+  const git3 = spawnSync3("git", ["ls-files", "-s", "-z"], { cwd: params.definitionDir, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+  if (git3.status !== 0) return "Sync: not checked (the definition is not in a git repository).";
+  const tracked = git3.stdout.split("\0").flatMap((entry) => /^(100644|100755) [0-9a-f]+ \d\t(.*)$/s.exec(entry)?.[2] ?? []).filter((path) => path !== "cofactor.sandbox.yaml").filter((path) => existsSync3(join3(params.definitionDir, path)));
+  const temp = mkdtempSync2(join3(tmpdir2(), "cofactor-syncable-"));
+  const created = docker2(["create", params.image]);
+  if (created.status !== 0) {
+    rmSync3(temp, { recursive: true, force: true });
+    return `Sync: not checked (docker create failed: ${created.stderr.trim()}).`;
+  }
+  const container = created.stdout.trim();
+  let copies = 0;
   try {
-    const env = { ...process6.env, GIT_INDEX_FILE: join3(temp, "index"), GIT_DIR: gitDir, GIT_WORK_TREE: realpathSync(dir) };
-    git(["add", "-A", "-f", "--", "."], { cwd: dir, env });
-    const entries = indexEntries(git(["ls-files", "-s", "-z"], { cwd: dir, env }), "", realpathSync(dir));
-    const files = withRawBlobs(entries.files, realpathSync(dir), "", env);
-    const skipped = entries.skipped;
-    const tree = git(["write-tree"], { cwd: dir, env }).trim();
-    return { files: files.map((file) => ({ ...file, path: `${to}/${file.path}` })), skipped: skipped.map((path) => `${to}/${path}`), tree };
+    const copyOut = (path) => {
+      const target = join3(temp, String(copies++));
+      if (docker2(["cp", "-L", `${container}:${params.workdir}/${path}`, target]).status !== 0) return null;
+      return statSync(target).isFile() ? readFileSync5(target) : null;
+    };
+    const anchor = copyOut("cofactor.sandbox.yaml");
+    if (!anchor) {
+      return `Sync: not syncable: cofactor.sandbox.yaml isn't at ${params.workdir}/cofactor.sandbox.yaml (${SYNCABLE_RULE}).`;
+    }
+    const sample = sampleOf(tracked);
+    let differ = 0;
+    let missing = 0;
+    for (const path of sample) {
+      const bytes = copyOut(path);
+      if (!bytes) missing += 1;
+      else if (gitBlobId(bytes) !== gitBlobId(readFileSync5(join3(params.definitionDir, path)))) differ += 1;
+    }
+    const anchorOlder = gitBlobId(anchor) !== gitBlobId(readFileSync5(params.definitionFile));
+    const notes = [
+      ...anchorOlder || differ > 0 ? ["the image is older than your working tree, which is fine"] : [],
+      ...missing > 0 ? [`${missing} of ${sample.length} sampled files aren't in the image (fine for sources it doesn't ship)`] : []
+    ];
+    return `Sync: syncable${notes.length > 0 ? ` (${notes.join("; ")})` : ""}.`;
   } finally {
+    docker2(["rm", container]);
     rmSync3(temp, { recursive: true, force: true });
   }
 }
-var FILTER_ATTRIBUTES = ["filter", "text", "eol", "ident", "working-tree-encoding"];
-function withRawBlobs(files, top, prefix, env) {
-  if (files.length === 0) return files;
-  const options = { cwd: top, ...env ? { env } : {} };
-  const repoPaths = files.map((file) => prefix === "" ? file.path : `${prefix}/${file.path}`);
-  const autocrlf = git(["config", "--get", "core.autocrlf"], { ...options, okCodes: [0, 1] }).trim();
-  const converts = autocrlf === "input" || autocrlf !== "" && git(["config", "--get", "--type=bool", "core.autocrlf"], options).trim() === "true";
-  let filtered;
-  if (converts) {
-    filtered = new Set(repoPaths);
-  } else {
-    const out = git(["check-attr", "-z", "--stdin", ...FILTER_ATTRIBUTES], { ...options, input: repoPaths.map((path) => `${path}\0`).join("") }).split("\0");
-    filtered = /* @__PURE__ */ new Set();
-    for (let i = 0; i + 2 < out.length; i += 3) if (out[i + 2] !== "unspecified") filtered.add(out[i]);
-  }
-  return files.map(
-    (file, i) => filtered.has(repoPaths[i]) ? { ...file, blob: gitBlobId(readFileSync5(join3(top, repoPaths[i]))) } : file
-  );
-}
-function lstatOrNull(path) {
+function syncabilityLineOrSkipped(params) {
   try {
-    return lstatSync(path);
+    const definitionFile2 = resolve3(params.definitionFile);
+    return syncabilityLine({ ...params, definitionFile: definitionFile2, definitionDir: dirname(definitionFile2) });
   } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
+    return `Sync: not checked (${error instanceof Error ? error.message : String(error)}).`;
   }
 }
-function chunked(items, fn) {
-  for (let i = 0; i < items.length; i += 200) fn(items.slice(i, i + 200));
-}
-function ignoredPaths(repo, env, paths) {
-  if (paths.length === 0) return /* @__PURE__ */ new Set();
-  const out = git(["check-ignore", "-z", "--stdin"], { cwd: repo, env, input: paths.map((p) => `${p}\0`).join(""), okCodes: [0, 1] });
-  return new Set(out.split("\0").filter(Boolean));
-}
-function everTracked(repo, pathspecs) {
-  const seen = /* @__PURE__ */ new Set();
-  if (pathspecs.length === 0) return seen;
-  if (git(["rev-parse", "--verify", "-q", "HEAD"], { cwd: repo, okCodes: [0, 1] }).trim() === "") return seen;
-  chunked(pathspecs, (chunk) => {
-    const out = git(["log", "--all", "--format=", "--name-only", "-z", "--", ...chunk.map((p) => `:(literal)${p}`)], { cwd: repo });
-    for (const path of out.split("\0")) {
-      const trimmed = path.replace(/^\n+/, "");
-      if (trimmed) seen.add(trimmed);
-    }
-  });
-  return seen;
-}
-async function chooseDeletions(params) {
-  const repoPath = (path) => params.prefix === "" ? path : `${params.prefix}/${path}`;
-  const ignored = ignoredPaths(params.repo, params.env, params.copyOnly.map((entry) => repoPath(entry.path)));
-  const candidates = params.copyOnly.filter((entry) => !ignored.has(repoPath(entry.path)));
-  const history = everTracked(params.repo, candidates.map((entry) => repoPath(entry.path)));
-  const kept = params.copyOnly.filter((entry) => ignored.has(repoPath(entry.path))).map((entry) => ({ ...entry, why: "ignored here" }));
-  const remove = [];
-  for (const entry of candidates) {
-    if (!entry.path.endsWith("/")) {
-      if (history.has(repoPath(entry.path))) remove.push(entry.path);
-      else kept.push({ ...entry, why: "never tracked here" });
-      continue;
-    }
-    const tracked = [...history].some((path) => path.startsWith(repoPath(entry.path)));
-    const listed = tracked ? await params.listDir(entry.path.slice(0, -1)) : [];
-    const ignoredInside = ignoredPaths(params.repo, params.env, listed.map(repoPath));
-    const files = listed.filter((path) => !ignoredInside.has(repoPath(path)) && history.has(repoPath(path)));
-    remove.push(...files);
-    if (files.length < entry.files) kept.push({ path: entry.path, files: entry.files - files.length, why: "never tracked here" });
+
+// src/sandbox-push.ts
+var USAGE = [
+  "Usage: cofactor sandbox push --application <name|id> <image> [--definition <file>] [--tag <tag>]... [--wait] [--json]",
+  "",
+  "Tag main builds `main` (or `nightly`): once an application has a push with either tag, its head is the",
+  "newest such push, and only those runs move the visual-review baseline. Other pushes are claimed with --at."
+].join("\n");
+var UPLOAD_CONCURRENCY = 4;
+var UPLOAD_ATTEMPTS = 3;
+var HASH_CHUNK_BYTES = 8 * 1024 * 1024;
+var IMPORT_TIMEOUT_MS = 50 * 6e4;
+var IMPORT_POLL_MS = 5e3;
+var PushError = class extends Error {
+  constructor(message, issues = []) {
+    super(message);
+    this.issues = issues;
   }
-  return { delete: remove.sort(), kept: kept.sort((a, b) => a.path.localeCompare(b.path)) };
+  issues;
+};
+function fail(message, issues) {
+  throw new PushError(message, issues);
 }
-function applyBatches(files, remove) {
-  const budget = SYNC_MAX_APPLY_BYTES - 1024 * 1024;
-  const cost = (file) => 512 + Math.ceil(file.bytes.length / 512) * 512 + 100 + file.path.length;
-  const batches = [[]];
-  let size = 0;
-  for (const file of files) {
-    if (cost(file) > budget) throw new SyncError(`${file.path} is ${Math.ceil(file.bytes.length / 1024 / 1024)} MiB; a sync sends files of at most ${budget / 1024 / 1024} MiB`);
-    if (size + cost(file) > budget && batches.at(-1).length > 0) {
-      batches.push([]);
-      size = 0;
-    }
-    batches.at(-1).push(file);
-    size += cost(file);
-  }
-  return batches.map((batch, index) => {
-    const manifest = {
-      files: batch.map(({ path, blob, mode }) => ({ path, blob, mode })),
-      delete: index === 0 ? remove : []
-    };
-    return tarOf([
-      { name: "manifest.json", data: new TextEncoder().encode(JSON.stringify(manifest)) },
-      ...batch.map((file, i) => ({ name: syncApplyEntryName(i), data: file.bytes }))
-    ]);
+function docker(args, options) {
+  const result = spawnSync4("docker", args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", options.quiet ? "pipe" : "inherit"],
+    maxBuffer: 64 * 1024 * 1024
   });
+  if (result.error) fail(`could not run docker (${result.error.message}); is Docker installed and running?`);
+  if (result.status !== 0) fail(`docker ${args.slice(0, 2).join(" ")} failed:
+${result.stderr ?? ""}`.trimEnd());
+  return result.stdout;
 }
-async function copyRequest(session, path, init) {
-  let response;
-  try {
-    response = await fetch(`${session.url}${path}`, {
-      method: "POST",
-      headers: { authorization: `Bearer ${session.token}`, "content-type": init.contentType },
-      body: init.body
-    });
-  } catch (error) {
-    throw new SyncError(`could not reach the sandbox for ${path}: ${error instanceof Error ? error.message : String(error)}`);
+function imageConfigOf(image) {
+  const result = spawnSync4("docker", ["image", "inspect", image], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+  if (result.error) fail(`could not run docker (${result.error.message}); is Docker installed and running?`);
+  const [inspected] = result.status === 0 ? JSON.parse(result.stdout) : [];
+  if (!inspected) fail(`Docker has no local image ${image}: build or pull it first`);
+  if (inspected.Os !== "linux" || inspected.Architecture !== "amd64") {
+    fail(
+      `${image} is ${inspected.Os}/${inspected.Architecture}; sandboxes run linux/amd64. Rebuild it with
+  docker buildx build --platform linux/amd64 -t ${image} --load <context>`
+    );
   }
-  if (!response.ok) {
-    const text = await response.text();
-    let message = text;
-    try {
-      message = JSON.parse(text).error ?? text;
-    } catch {
-    }
-    throw new SyncError(`the sandbox refused ${path} (${response.status}): ${message.slice(0, 2e3)}`);
+  const user = inspected.Config.User ?? "";
+  if (!["", "0", "root"].includes(user.split(":")[0])) {
+    fail(
+      `${image} runs as USER ${user}; a sandbox image must leave USER as root (the sandbox drops to uid 1000 itself). Remove the final \`USER\` line from the Dockerfile, or end it with \`USER root\`.`
+    );
+  }
+  const env = Object.fromEntries(
+    (inspected.Config.Env ?? []).map((entry) => {
+      const separator = entry.indexOf("=");
+      return [entry.slice(0, separator), entry.slice(separator + 1)];
+    })
+  );
+  const parsed = imageConfigSchema.safeParse({ workdir: inspected.Config.WorkingDir ?? "", env });
+  if (!parsed.success) {
+    const workdir = inspected.Config.WorkingDir || "(none)";
+    fail(
+      `${image}'s WORKDIR ${workdir} can't be used: ${parsed.error.issues[0]?.message ?? "invalid"}. Set one for your app in its Dockerfile (e.g. \`WORKDIR /app\`): services, prepare commands and actions run from it, and the sandbox makes it writable by the app.`
+    );
   }
-  return response;
+  return parsed.data;
 }
-async function plan(session, local, to) {
-  const body = JSON.stringify(to === void 0 ? { local } : { local, to });
-  if (Buffer.byteLength(body) > SYNC_MAX_APPLY_BYTES) {
-    throw new SyncError(
-      `the file list (${local.length} files) is over the ${SYNC_MAX_APPLY_BYTES / 1024 / 1024} MiB a sync can plan in one request; ignore what the sandbox doesn't need (.gitignore)`
-    );
+function shellWord(value) {
+  return /^[\w@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
+}
+async function apiOrFail(result) {
+  const res = await result;
+  if (!res.ok) fail(res.error ?? "unknown error", res.issues);
+  return res.data;
+}
+var mib = (bytes) => `${(bytes / 1024 / 1024).toFixed(bytes < 10 * 1024 * 1024 ? 1 : 0)} MB`;
+async function readAt(file, offset, size) {
+  const bytes = new Uint8Array(size);
+  for (let at = 0; at < size; ) {
+    const { bytesRead } = await file.read(bytes, at, size - at, offset + at);
+    if (bytesRead === 0) return bytes.subarray(0, at);
+    at += bytesRead;
   }
-  const response = await copyRequest(session, "/sync/plan", { body, contentType: "application/json" });
-  return parseAnswer(syncPlanResponseSchema, await response.text(), "/sync/plan");
+  return bytes;
 }
-function parseAnswer(schema, text, path) {
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch {
-    throw new SyncError(`the sandbox answered ${path} with something other than JSON: ${text.slice(0, 300)}`);
+async function digestOf(file, offset, size) {
+  const hash = createHash4("sha256");
+  for (let at = 0; at < size; at += HASH_CHUNK_BYTES) {
+    hash.update(await readAt(file, offset + at, Math.min(HASH_CHUNK_BYTES, size - at)));
   }
-  const parsed = schema.safeParse(value);
-  if (!parsed.success) throw new SyncError(`the sandbox answered ${path} unexpectedly: ${text.slice(0, 300)}`);
-  return parsed.data;
+  return `sha256:${hash.digest("hex")}`;
 }
-async function apply(session, batches, build, json) {
-  let written = 0;
-  let deleted = 0;
-  let restarted = [];
-  const steps = [];
-  for (const [index, body] of batches.entries()) {
-    const last = index === batches.length - 1;
-    const response = await copyRequest(session, `/sync/apply${build && last ? "?build=1" : ""}`, { body, contentType: "application/x-tar" });
-    if (!(build && last)) {
-      const result = parseAnswer(syncApplyResultSchema, await response.text(), "/sync/apply");
-      written += result.written;
-      deleted += result.deleted;
+function partOf(bytes) {
+  return { digest: `sha256:${createHash4("sha256").update(bytes).digest("hex")}`, size: bytes.length, body: () => bytes };
+}
+async function putBlob(url, headers, part) {
+  const digest = part.digest;
+  for (let attempt = 1; ; attempt++) {
+    let response;
+    try {
+      const init = {
+        method: "PUT",
+        headers: { ...headers, "content-length": String(part.size) },
+        body: part.body(),
+        duplex: "half"
+      };
+      response = await fetch(url, init);
+    } catch (error) {
+      if (attempt >= UPLOAD_ATTEMPTS) throw error;
+      await new Promise((resolve4) => setTimeout(resolve4, 2e3 * attempt));
       continue;
     }
-    let buffer = "";
-    const decoder2 = new TextDecoder();
-    let finished = false;
-    for await (const chunk of response.body) {
-      buffer += decoder2.decode(chunk, { stream: true });
-      let newline = buffer.indexOf("\n");
-      while (newline >= 0) {
-        const event = parseAnswer(syncBuildEventSchema, buffer.slice(0, newline), "/sync/apply?build=1");
-        buffer = buffer.slice(newline + 1);
-        newline = buffer.indexOf("\n");
-        if (event.type === "applied") {
-          written += event.result.written;
-          deleted += event.result.deleted;
-        } else if (event.type === "output") {
-          if (!json) process6.stderr.write(event.text);
-        } else if (event.type === "step") {
-          steps.push({ name: event.name, ran: event.ran, ms: event.ms });
-          if (!json) process6.stderr.write(`  build step ${event.name}: ${event.ran ? `ran in ${(event.ms / 1e3).toFixed(1)} s` : "unchanged"}
-`);
-        } else if (event.type === "done") {
-          restarted = event.restarted;
-          finished = true;
-        } else if (event.type === "error") {
-          throw new SyncError(`the build failed after the files were synced: ${event.message}`);
-        }
-      }
+    if (response.ok) return;
+    const detail = `${response.status}: ${(await response.text()).slice(0, 300)}`;
+    if (response.status < 500 || attempt >= UPLOAD_ATTEMPTS) {
+      fail(`uploading ${digest} was refused (HTTP ${detail}); run the push again to upload what is still missing`);
     }
-    if (!finished) throw new SyncError("the build stream ended early; check the copy with `cofactor sandbox exec <id> -- cofactor-sandbox status`");
+    await new Promise((resolve4) => setTimeout(resolve4, 2e3 * attempt));
   }
-  return { written, deleted, restarted, steps };
 }
-var SYNC_USAGE = "Usage: cofactor sandbox sync <id> [--build] [--json]\n       cofactor sandbox sync <id> <local-dir> --to <path-in-sandbox> [--json]";
-var LIST_LIMIT = 20;
-async function handleSandboxSync(positionals, argv, apiUrl, token) {
-  const [id, localDir] = positionals;
-  const to = getArgValue(argv, "--to");
-  const build = hasFlag(argv, "--build");
-  const json = hasFlag(argv, "--json");
-  const fail4 = (message) => {
-    console.error(`Error: ${message}`);
-    process6.exit(1);
-  };
-  if (!id) return fail4(`sandbox id required.
-${SYNC_USAGE}`);
-  if (localDir === void 0 !== (to === void 0)) return fail4(`a local directory and --to go together.
-${SYNC_USAGE}`);
-  if (to !== void 0 && build) return fail4("--build reruns the build of a working-tree sync; build output is already built (`sync <id> <dir> --to <path>`).");
-  if (to !== void 0 && (to === "" || to.startsWith("/") || to.split("/").some((part) => part === "" || part === "." || part === ".."))) {
-    return fail4("--to is a path under the sandbox's sync root, like `static` or `frontend/dist` (no leading `/`, no `..`).");
-  }
-  if (localDir !== void 0 && (!existsSync2(localDir) || !lstatSync(localDir).isDirectory())) return fail4(`${localDir} is not a directory`);
-  if (!isInsideRepo(to === void 0 ? process6.cwd() : resolve2(localDir))) {
-    return fail4("run this inside a git repository: the files to sync and the synced tree come from git.");
-  }
-  const started = Date.now();
-  const sessionRes = await apiRequest(
-    apiUrl,
-    token,
-    "POST",
-    `/org/sandboxes-v2/sandboxes/${id}/sync-session`
-  );
-  if (!sessionRes.ok) return fail4(sessionRes.error ?? "could not start a sync");
-  const session = sessionRes.data;
+async function savedImage(archive) {
+  const file = await open(archive);
   try {
-    let local;
-    let decide;
-    let cleanup = () => {
+    const entries = await tarEntries((offset, length) => readAt(file, offset, length)).catch(
+      (error) => fail(`reading the saved image: ${error instanceof Error ? error.message : String(error)}`)
+    );
+    const byName = new Map(entries.map((entry) => [entry.name.replace(/^\.\//, ""), entry]));
+    const entryOf = (name) => {
+      const entry = byName.get(name);
+      if (!entry) fail(`the saved image has no ${name}; is this a \`docker save\` archive?`);
+      return entry;
     };
-    if (to !== void 0) {
-      const dir = resolve2(localDir);
-      const output2 = buildOutput(dir, to);
-      local = { ...output2, untracked: /* @__PURE__ */ new Set(), root: dir };
-      decide = async (planned) => ({ delete: planned.copyOnly.map((entry) => entry.path), kept: [] });
-    } else {
-      const root = session.delivery === "github" ? repositoryOf(process6.cwd()).top : process6.cwd();
-      if (session.delivery === "upload" && !existsSync2(join3(root, "cofactor.sandbox.yaml"))) {
-        return fail4("run this from the directory holding cofactor.sandbox.yaml: a pushed image's WORKDIR mirrors it.");
+    const json = async (name) => {
+      const entry = entryOf(name);
+      return JSON.parse(new TextDecoder().decode(await readAt(file, entry.offset, entry.size)));
+    };
+    const layerOf = async (name) => {
+      const entry = entryOf(name);
+      const tooLarge = (bytes) => fail(`a layer of the image is ${(bytes / 1024 ** 3).toFixed(1)} GB; a push takes at most 5 GB per layer. Slim the image.`);
+      if (entry.size > MAX_BLOB_BYTES) tooLarge(entry.size);
+      const range = { start: entry.offset, end: entry.offset + entry.size - 1 };
+      const [first, second] = await readAt(file, entry.offset, 2);
+      if (first === 31 && second === 139) {
+        const unpacked = join4(dirname2(archive), `layer-${entry.offset}.tar`);
+        await pipeline(createReadStream(archive, range), createGunzip(), createWriteStream(unpacked)).catch(
+          (error) => fail(`unpacking a compressed layer of the image: ${error instanceof Error ? error.message : String(error)}`)
+        );
+        const plain = await open(unpacked);
+        try {
+          const { size } = await plain.stat();
+          if (size > MAX_BLOB_BYTES) tooLarge(size);
+          return { digest: await digestOf(plain, 0, size), size, body: () => createReadStream(unpacked) };
+        } finally {
+          await plain.close();
+        }
       }
-      const tree = workingTree(root);
-      cleanup = tree.cleanup;
-      local = { ...tree, root };
-      decide = (planned) => chooseDeletions({
-        copyOnly: planned.copyOnly,
-        repo: tree.repo,
-        prefix: tree.prefix,
-        env: tree.env,
-        listDir: async (dir) => (await plan(session, [], dir)).copyOnly.map((entry) => entry.path)
-      });
-    }
-    try {
-      const planStarted = Date.now();
-      const planned = await plan(session, local.files, to);
-      const skipped = new Set(local.skipped.flatMap((path) => [path, `${path}/`]));
-      const { delete: remove, kept } = await decide({ ...planned, copyOnly: planned.copyOnly.filter((entry) => !skipped.has(entry.path)) });
-      const planMs = Date.now() - planStarted;
-      const need = new Set(planned.need);
-      const sending = local.files.filter((file) => need.has(file.path));
-      if (!json) {
-        writeRawOutput(`Syncing ${local.root} into sandbox ${id} (${session.delivery === "github" ? "GitHub" : "pushed image"}, version ${session.version.slice(0, 12)})`);
-        writeRawOutput(`  plan: ${sending.length} to write, ${remove.length} to delete, ${local.files.length - sending.length} unchanged (${(planMs / 1e3).toFixed(1)} s)`);
-        const untracked = sending.filter((file) => local.untracked.has(file.path));
-        const tracked = sending.filter((file) => !local.untracked.has(file.path));
-        if (sending.length > 0) writeRawOutput("  write:");
-        for (const file of tracked.slice(0, LIST_LIMIT)) writeRawOutput(`    ${file.path}`);
-        if (tracked.length > LIST_LIMIT) writeRawOutput(`    ...and ${tracked.length - LIST_LIMIT} more`);
-        for (const file of untracked) writeRawOutput(`    ${file.path}  (untracked)`);
-        if (remove.length > 0) writeRawOutput("  delete:");
-        for (const path of remove) writeRawOutput(`    ${path}`);
-        if (kept.length > 0) {
-          writeRawOutput("  kept (only in the sandbox):");
-          for (const entry of kept.slice(0, LIST_LIMIT)) {
-            writeRawOutput(`    ${entry.path}${entry.files > 1 ? ` (${entry.files} files)` : ""}, ${entry.why}`);
-          }
-          if (kept.length > LIST_LIMIT) writeRawOutput(`    ...and ${kept.length - LIST_LIMIT} more`);
+      return { digest: await digestOf(file, entry.offset, entry.size), size: entry.size, body: () => createReadStream(archive, range) };
+    };
+    const [manifest] = await json("manifest.json");
+    if (!manifest) fail("the saved image lists no image");
+    const layers = [];
+    for (const name of manifest.Layers) layers.push(await layerOf(name));
+    return { config: await json(manifest.Config), layers };
+  } finally {
+    await file.close();
+  }
+}
+async function pushedImage(archive, cofactorLayers, definitionYaml, config) {
+  const saved = await savedImage(archive);
+  const own = partOf(
+    tarOf([
+      { name: IMAGE_DEFINITION_FILE.slice(1), data: new TextEncoder().encode(definitionYaml) },
+      { name: IMAGE_CONFIG_FILE.slice(1), data: new TextEncoder().encode(JSON.stringify(config)) }
+    ])
+  );
+  const added = [...cofactorLayers, own];
+  const pushed = withSandboxLayers(saved.config, added, (/* @__PURE__ */ new Date()).toISOString());
+  const imageConfig = partOf(new TextEncoder().encode(JSON.stringify(pushed)));
+  const blob = ({ digest, size }) => ({ digest, size });
+  return {
+    config: blob(imageConfig),
+    layers: [...saved.layers, ...added].map(blob),
+    blobs: new Map([imageConfig, ...saved.layers, own].map((part) => [part.digest, part]))
+  };
+}
+async function handleSandboxPush(argv, apiUrl, token) {
+  try {
+    await push(argv, apiUrl, token);
+  } catch (error) {
+    if (!(error instanceof PushError)) throw error;
+    console.error(`Error: ${error.message}`);
+    for (const issue of error.issues) console.error(`  ${issue.path || "(root)"}: ${issue.message}`);
+    process7.exit(1);
+  }
+}
+async function push(argv, apiUrl, token) {
+  const valueFlags = /* @__PURE__ */ new Set(["--application", "--property", "--definition", "--tag", "--env", "--org", "--token", "--api-url", "--app-url"]);
+  const positional = argv.filter((arg, i) => !arg.startsWith("-") && !valueFlags.has(argv[i - 1] ?? ""));
+  const image = positional[0];
+  if (!image) fail(`an image is required
+${USAGE}`);
+  const definitionFile2 = getArgValue(argv, "--definition") ?? "./cofactor.sandbox.yaml";
+  const tags = getArgValues(argv, "--tag");
+  const badTag = tags.find((tag) => !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(tag));
+  if (badTag !== void 0) fail(`--tag ${badTag}: use letters, digits, '.', '_' and '-' (at most 64, starting with a letter or digit)`);
+  if (tags.length > 10) fail("a push takes at most 10 tags");
+  const wait = hasFlag(argv, "--wait");
+  const json = hasFlag(argv, "--json");
+  const log = (line) => json ? console.error(line) : console.log(line);
+  let definitionYaml;
+  try {
+    definitionYaml = readFileSync6(definitionFile2, "utf8");
+  } catch (error) {
+    fail(`reading ${definitionFile2}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const { definition, issues } = validateDefinition(definitionYaml, "upload");
+  if (!definition || issues.length > 0) fail(`${definitionFile2} is not a valid definition for pushed images:`, issues);
+  const storageProvider = definition.object_storage?.provider;
+  const applicationId = await resolveOrCreateSandboxApplication(argv, apiUrl, token);
+  const config = imageConfigOf(image);
+  log(syncabilityLineOrSkipped({ image, workdir: config.workdir, definitionFile: definitionFile2 }));
+  const work = mkdtempSync3(join4(tmpdir3(), "cofactor-push-"));
+  const cleanUp = () => rmSync4(work, { recursive: true, force: true });
+  const interrupted = (signal) => {
+    cleanUp();
+    process7.exit(signal === "SIGINT" ? 130 : 143);
+  };
+  process7.once("SIGINT", interrupted);
+  process7.once("SIGTERM", interrupted);
+  process7.exitCode = 1;
+  try {
+    const ours = await apiOrFail(
+      apiRequest(
+        apiUrl,
+        token,
+        "GET",
+        "/org/sandboxes-v2/helper-layer"
+      )
+    );
+    if (!ours.helper) fail("this Cofactor takes pushes from an older cofactor CLI; use the version it ships with");
+    const cofactorLayers = [ours.helper, ...storageProvider ? [ours.objectStorage[storageProvider]] : []];
+    const archive = join4(work, "image.tar");
+    log("Saving the image...");
+    docker(["save", "--output", archive, image], { quiet: json });
+    const pushing = await pushedImage(archive, cofactorLayers, definitionYaml, config);
+    const { layers } = pushing;
+    const created = await apiOrFail(
+      apiRequest(
+        apiUrl,
+        token,
+        "POST",
+        `/org/applications/${applicationId}/sandbox/uploads`,
+        { definitionYaml, platformVersion: ours.platformVersion, tags, image: { config: pushing.config, layers } }
+      )
+    );
+    const partsByDigest = pushing.blobs;
+    const uploadBytes = created.uploads.reduce((total, upload) => total + (partsByDigest.get(upload.digest)?.size ?? 0), 0);
+    const imageBytes = layers.reduce((total, layer) => total + layer.size, 0);
+    log(`Pushing ${created.id}: uploading ${created.uploads.length} of ${layers.length + 1} blobs (${mib(uploadBytes)}); ${mib(imageBytes - uploadBytes)} already in Cofactor`);
+    const queue = [...created.uploads];
+    let sent = 0;
+    await Promise.all(
+      Array.from({ length: UPLOAD_CONCURRENCY }, async () => {
+        for (let next = queue.shift(); next; next = queue.shift()) {
+          const part = partsByDigest.get(next.digest);
+          if (!part) fail(`Cofactor asked for ${next.digest}, which this image doesn't have`);
+          await putBlob(next.url, next.headers, part);
+          sent += part.size;
+          if (part.size > 10 * 1024 * 1024) log(`  ${mib(sent)} of ${mib(uploadBytes)}`);
         }
-        if (local.skipped.length > 0) writeRawOutput(`  not synced (symlinks and submodules): ${local.skipped.join(", ")}`);
-      }
-      const applyStarted = Date.now();
-      const batches = sending.length === 0 && remove.length === 0 && !build ? [] : applyBatches(
-        sending.map((file) => ({ ...file, bytes: readFileSync5(join3(local.root, to === void 0 ? file.path : file.path.slice(to.length + 1))) })),
-        remove
-      );
-      const applied = await apply(session, batches, build, json);
-      const applyMs = Date.now() - applyStarted;
-      const ms = Date.now() - started;
-      const recorded = await apiRequest(apiUrl, token, "POST", `/org/sandboxes-v2/sandboxes/${id}/syncs`, {
-        tree: local.tree,
-        buildOutput: to !== void 0,
-        written: applied.written,
-        deleted: applied.deleted,
-        ms
-      });
-      if (!recorded.ok) throw new SyncError(`the files were synced, but recording the sync failed: ${recorded.error}`);
-      if (json) {
-        writeRawOutput(
-          JSON.stringify(
-            {
-              id,
-              tree: local.tree,
-              buildOutput: to !== void 0,
-              written: sending.map((file) => file.path),
-              deleted: remove,
-              kept,
-              build: build ? { steps: applied.steps, restarted: applied.restarted } : null,
-              ms: { total: ms, plan: planMs, apply: applyMs }
-            },
-            null,
-            2
-          )
+      })
+    );
+    rmSync4(archive);
+    let pushed = await apiOrFail(
+      apiRequest(
+        apiUrl,
+        token,
+        "POST",
+        `/org/applications/${applicationId}/sandbox/uploads/${created.id}/complete`
+      )
+    );
+    if (wait) {
+      log("Importing (Cofactor boots the image until its services are healthy)...");
+      const deadline = Date.now() + IMPORT_TIMEOUT_MS;
+      const importStarted = Date.now();
+      let reported = importStarted;
+      while ((pushed.status === "importing" || pushed.status === "uploading") && Date.now() < deadline) {
+        await new Promise((resolve4) => setTimeout(resolve4, IMPORT_POLL_MS));
+        if (Date.now() - reported >= 6e4) {
+          reported = Date.now();
+          log(`  still importing (${Math.round((reported - importStarted) / 6e4)} min)`);
+        }
+        pushed = await apiOrFail(
+          apiRequest(apiUrl, token, "GET", `/org/applications/${applicationId}/sandbox/uploads/${created.id}`)
         );
-        return;
       }
-      writeRawOutput(`  applied: ${applied.written} written, ${applied.deleted} deleted (${(applyMs / 1e3).toFixed(1)} s)`);
-      if (build) writeRawOutput(`  restarted: ${applied.restarted.join(", ") || "nothing"}`);
-      writeRawOutput(`Synced ${to === void 0 ? "tree" : "build output"} ${local.tree} in ${(ms / 1e3).toFixed(1)} s.`);
-      if (!build) {
-        writeRawOutput(`  Restart what runs it: cofactor sandbox exec ${id} -- cofactor-sandbox restart <service>`);
+    }
+    const uploaded = { blobs: created.uploads.length, of: layers.length + 1, bytes: uploadBytes, reusedBytes: imageBytes - uploadBytes };
+    const application = shellWord(getArgValue(argv, "--application") ?? getArgValue(argv, "--property") ?? applicationId);
+    const target = ["--env", "--org"].map((flag) => {
+      const value = getArgValue(process7.argv, flag);
+      return value ? ` ${flag} ${shellWord(value)}` : "";
+    }).join("");
+    if (json) {
+      writeRawOutput(JSON.stringify({ ...pushed, uploaded }, null, 2));
+    } else {
+      console.log(`Push ${pushed.id}: ${pushed.status}${pushed.tags.length > 0 ? ` [${pushed.tags.join(", ")}]` : ""}`);
+      if (pushed.status === "ready") {
+        console.log(`  Claim it: cofactor sandbox claim --application ${application} --environment default --wait${target}`);
+      } else if (pushed.status !== "failed") {
+        console.log(`  Importing; follow it with: cofactor sandbox envs --application ${application}${target}`);
       }
-      const shown = await apiRequest(apiUrl, token, "GET", `/org/sandboxes-v2/sandboxes/${id}`);
-      for (const [name, url] of Object.entries(shown.data?.portUrls ?? {})) writeRawOutput(`  ${name.padEnd(10)} ${url}`);
-    } finally {
-      cleanup();
     }
-  } catch (error) {
-    if (error instanceof SyncError) return fail4(error.message);
-    throw error;
+    if (pushed.status === "failed") fail(`push ${pushed.id} failed:
+${pushed.error ?? "no reason given"}`);
+    process7.exitCode = 0;
+  } finally {
+    process7.off("SIGINT", interrupted);
+    process7.off("SIGTERM", interrupted);
+    cleanUp();
   }
 }
-function isInsideRepo(dir) {
-  return git(["rev-parse", "--is-inside-work-tree"], { cwd: dir, okCodes: [0, 128] }).trim() === "true";
-}
 
 // src/sandbox-refresh.ts
-import process7 from "process";
+import process8 from "process";
 var POLL_INTERVAL_MS = 5e3;
 var WAIT_TIMEOUT_MS = 50 * 6e4;
 function shortVersion2(version) {
   return /^[0-9a-f]{40}$/.test(version) ? version.slice(0, 12) : version;
 }
 function sleep2(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 async function handleSandboxRefresh(argv, apiUrl, token) {
   const applicationId = await resolveApplicationId(argv, apiUrl, token);
@@ -2892,7 +3166,7 @@ async function handleSandboxRefresh(argv, apiUrl, token) {
     });
     if (!res.ok) {
       console.error(`Error: ${res.error}`);
-      process7.exit(1);
+      process8.exit(1);
     }
     return res.data;
   };
@@ -2912,7 +3186,7 @@ async function handleSandboxRefresh(argv, apiUrl, token) {
       );
       if (!res.ok) {
         console.error(`Error: ${res.error}`);
-        process7.exit(1);
+        process8.exit(1);
       }
       if (res.data.status === "ready" && !res.data.isHead && !askedAgain) {
         askedAgain = true;
@@ -2942,11 +3216,11 @@ async function handleSandboxRefresh(argv, apiUrl, token) {
       }
     }
   }
-  if (latest.head.status === "failed" || wait && latest.head.status === "building") process7.exit(1);
+  if (latest.head.status === "failed" || wait && latest.head.status === "building") process8.exit(1);
 }
 
 // src/sandbox-warm.ts
-import process8 from "process";
+import process9 from "process";
 var STATE_LABELS = {
   warming: "Filling",
   warm: "On",
@@ -2973,7 +3247,7 @@ function isSandboxV2WarmCommand(first) {
 }
 function fail2(message) {
   console.error(`Error: ${message}`);
-  process8.exit(1);
+  process9.exit(1);
 }
 function rejectUnknownWarmArgs(command, argv) {
   const spec = COMMANDS[command];
@@ -3047,7 +3321,7 @@ async function handleSandboxWarm(argv, apiUrl, token) {
   if (!command || !isSandboxV2WarmCommand(command)) {
     console.error(command ? `Unknown warm command: ${command}
 ${USAGE2}` : USAGE2);
-    process8.exit(1);
+    process9.exit(1);
   }
   rejectUnknownWarmArgs(command, rest);
   if (command === "list") {
@@ -3078,7 +3352,7 @@ ${USAGE2}` : USAGE2);
 }
 
 // src/sandbox-secrets.ts
-import process9 from "process";
+import process10 from "process";
 function scopeText(environment2) {
   return environment2 === null ? "all environments" : `environment ${environment2}`;
 }
@@ -3102,7 +3376,7 @@ function stdinRefusal(isTTY) {
 }
 function fail3(message) {
   console.error(`Error: ${message}`);
-  process9.exit(1);
+  process10.exit(1);
 }
 function decodeSecretValue(bytes) {
   let text;
@@ -3116,7 +3390,7 @@ function decodeSecretValue(bytes) {
 }
 async function readStdin() {
   const chunks = [];
-  for await (const chunk of process9.stdin) chunks.push(chunk);
+  for await (const chunk of process10.stdin) chunks.push(chunk);
   return Buffer.concat(chunks);
 }
 function environmentArg(argv) {
@@ -3132,7 +3406,7 @@ function printUsage() {
   console.error("Usage: cofactor sandbox secret set <NAME> --application <name|id> [--environment <e>] [--json]  (value on stdin)");
   console.error("       cofactor sandbox secret list --application <name|id> [--json]");
   console.error("       cofactor sandbox secret rm <NAME> --application <name|id> [--environment <e>] [--json]");
-  process9.exit(1);
+  process10.exit(1);
 }
 async function handleSandboxSecret(argv, apiUrl, token) {
   const [action2, name, ...extra] = v2Positionals("secret", argv);
@@ -3148,10 +3422,10 @@ async function handleSandboxSecret(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   const application = getArgValue(argv, "--application") ?? getArgValue(argv, "--property") ?? "";
   if (action2 === "set") {
-    const refusal = stdinRefusal(process9.stdin.isTTY);
+    const refusal = stdinRefusal(process10.stdin.isTTY);
     if (refusal) {
       console.error(`Error: ${refusal}`);
-      process9.exit(1);
+      process10.exit(1);
     }
   }
   let value;
@@ -3170,7 +3444,7 @@ async function handleSandboxSecret(argv, apiUrl, token) {
     );
     if (!res2.ok) {
       console.error(`Error: ${res2.error}`);
-      process9.exit(1);
+      process10.exit(1);
     }
     if (json) {
       writeRawOutput(JSON.stringify(res2.data, null, 2));
@@ -3199,7 +3473,7 @@ async function handleSandboxSecret(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process9.exit(1);
+    process10.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -3217,7 +3491,7 @@ var parseEgressMode = (value) => {
   console.error(
     `Error: invalid --egress-mode '${value}'. Must be one of: ${SANDBOX_EGRESS_MODES.join(", ")}`
   );
-  process10.exit(1);
+  process11.exit(1);
 };
 var parseEgressAllowlist = (argv) => {
   const rawEntries = getArgValues(argv, "--egress-allow").flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean);
@@ -3227,13 +3501,13 @@ var parseEgressAllowlist = (argv) => {
       console.error(
         `Error: invalid --egress-allow '${entry}'. Use domain:example.com or cidr:203.0.113.0/24`
       );
-      process10.exit(1);
+      process11.exit(1);
     }
     const kind = entry.slice(0, separator);
     const value = entry.slice(separator + 1);
     if (kind !== "domain" && kind !== "cidr") {
       console.error(`Error: invalid --egress-allow kind '${kind}'. Must be domain or cidr.`);
-      process10.exit(1);
+      process11.exit(1);
     }
     return { kind, value };
   });
@@ -3290,7 +3564,8 @@ function printHelp() {
       '  sync <id> <local-dir> --to <path>        Mirror local build output into <path> in the sandbox (see "Sync options" below)',
       "  destroy <id>                             Tear a claimed sandbox down",
       '  warm list|set|show|clear [options]       Keep an environment warm so claims start in about a second (staff only; see "Warm options" below)',
-      "  verify-env --application <a> [options]  Claim each environment of the current version, sign its personas in, destroy",
+      "  auth-check <id> --persona <p>           Prove sign-in on an existing sandbox",
+      "  verify-env --application <a> [options]  Claim each environment (optionally --at <sha>), sign its personas in, destroy",
       "  preview --application <a> --pr <n>      A pull request's preview and its logins",
       "  guide [topic]                            Show the Sandboxes v2 guide (`guide v2 [topic]` is the same)",
       `                                           topics: ${SANDBOX_V2_GUIDE_SECTIONS.map((section) => section.slug).join(", ")}`,
@@ -3309,6 +3584,9 @@ function printHelp() {
       "  --wait                 Block until Cofactor has imported (booted) the image",
       "",
       "Claim options (Sandboxes v2):",
+      "  --from-local          Claim local tracked and nonignored untracked files without committing or merging",
+      "  --repo <owner/name>   With --from-local: GitHub repository (default: origin)",
+      "  --dir <path>          With --from-local: definition directory relative to the repository root (default: cwd)",
       '  --environment <name>  Environment to claim (default: "default")',
       "  --at <version>        A commit SHA, or a push id or tag (default: the default branch head / push head)",
       "  --timeout <duration>  The claim's time limit: not ready by then, it fails (e.g. 45m, 3h; default 2h,",
@@ -3498,11 +3776,11 @@ async function handleList(argv, apiUrl, token) {
   ]);
   if (!templatesRes.ok) {
     console.error(`Error: ${templatesRes.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (!instancesRes.ok) {
     console.error(`Error loading instances: ${instancesRes.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify({ templates: templatesRes.data, instances: instancesRes.data }, null, 2));
@@ -3550,7 +3828,7 @@ async function handleTemplate(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -3579,7 +3857,7 @@ async function handleArtifacts(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   if (!templateId) {
     console.error("Error: template ID required. Usage: canary sandbox artifacts <template-id>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -3589,7 +3867,7 @@ async function handleArtifacts(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -3619,7 +3897,7 @@ async function handleChecklist(argv, apiUrl, token) {
   const templateId = positional[0];
   if (!templateId) {
     console.error("Error: template ID required. Usage: canary sandbox checklist <template-id>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -3629,7 +3907,7 @@ async function handleChecklist(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -3664,7 +3942,7 @@ async function handleChecklistSkip(argv, apiUrl, token) {
   const itemId = positional[1];
   if (!templateId || !itemId) {
     console.error("Error: both template ID and item ID required. Usage: canary sandbox checklist skip <template-id> <item-id>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -3674,7 +3952,7 @@ async function handleChecklistSkip(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   console.log(`Skipped checklist item: ${itemId}`);
 }
@@ -3686,7 +3964,7 @@ async function handleChecklistComplete(argv, apiUrl, token) {
   if (!templateId || !itemId) {
     console.error("Error: both template ID and item ID required.");
     console.error('Usage: canary sandbox checklist complete <template-id> <item-id> [--status success|failed] [--summary "..."]');
-    process10.exit(1);
+    process11.exit(1);
   }
   const status = getArgValue(argv, "--status") ?? "success";
   const summary = getArgValue(argv, "--summary");
@@ -3698,11 +3976,11 @@ async function handleChecklistComplete(argv, apiUrl, token) {
       configSchema = JSON.parse(configSchemaArg);
     } catch {
       try {
-        configSchema = JSON.parse(readFileSync6(configSchemaArg, "utf-8"));
+        configSchema = JSON.parse(readFileSync7(configSchemaArg, "utf-8"));
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         console.error(`Error reading config schema from "${configSchemaArg}": ${msg}`);
-        process10.exit(1);
+        process11.exit(1);
       }
     }
   }
@@ -3721,7 +3999,7 @@ async function handleChecklistComplete(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -3735,7 +4013,7 @@ async function handleConfigList(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   if (!templateId) {
     console.error("Error: template ID required. Usage: canary sandbox config list <template-id>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -3745,7 +4023,7 @@ async function handleConfigList(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   const t = res.data;
   const schema = t.configSchema ?? [];
@@ -3795,16 +4073,16 @@ async function handleConfigSet(argv, apiUrl, token) {
     console.error("Error: template ID and key required.");
     console.error("Usage: canary sandbox config set <template-id> <key> <value>");
     console.error('  For sensitive values: echo "sk-ant-..." | canary sandbox config set <template-id> <key> --value-stdin');
-    process10.exit(1);
+    process11.exit(1);
   }
   if (fromStdin) {
     const chunks = [];
-    for await (const chunk of process10.stdin) chunks.push(chunk);
+    for await (const chunk of process11.stdin) chunks.push(chunk);
     value = Buffer.concat(chunks).toString("utf-8").trim();
   }
   if (value === void 0) {
     console.error("Error: value required. Pass as argument or use --value-stdin");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -3818,7 +4096,7 @@ async function handleConfigSet(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   console.log(`Config set: ${key}`);
 }
@@ -3826,7 +4104,7 @@ async function handleConfigUnset(argv, apiUrl, token) {
   const [templateId, key] = argv.filter((arg) => !arg.startsWith("-"));
   if (!templateId || !key) {
     console.error("Usage: canary sandbox config unset <template-id> <key>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -3838,7 +4116,7 @@ async function handleConfigUnset(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   console.log(`Config unset: ${key}`);
 }
@@ -3847,12 +4125,12 @@ async function handleSetSize(argv, apiUrl, token) {
   if (!templateId || !sizeArg) {
     console.error("Error: template ID and size required.");
     console.error(`Usage: canary sandbox set-size <template-id> <${INSTANCE_SIZES.join("|")}>`);
-    process10.exit(1);
+    process11.exit(1);
   }
   const size = parseInstanceSize(sizeArg);
   if (!size) {
     console.error(`Error: invalid size '${sizeArg}'. Must be one of: ${INSTANCE_SIZES.join(", ")}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -3863,7 +4141,7 @@ async function handleSetSize(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   console.log(`Instance size set to ${size}`);
 }
@@ -3872,12 +4150,12 @@ async function handlePoolSetSize(argv, apiUrl, token) {
   if (!templateId || countArg === void 0) {
     console.error("Error: template ID and count required.");
     console.error("Usage: canary sandbox pool set-size <template-id> <count>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const poolMinReady = /^\d+$/.test(countArg) ? Number(countArg) : Number.NaN;
   if (!Number.isInteger(poolMinReady)) {
     console.error(`Error: invalid count '${countArg}'. Must be a non-negative integer.`);
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -3888,7 +4166,7 @@ async function handlePoolSetSize(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   console.log(`Warm stopped-pool size set to ${poolMinReady}`);
 }
@@ -3897,7 +4175,7 @@ async function handleCreate(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   const propertyHint = positional[0] ?? getArgValue(argv, "--property");
   const property = await selectProperty(apiUrl, token, propertyHint ?? void 0);
-  if (!property) process10.exit(1);
+  if (!property) process11.exit(1);
   const reposRes = await apiRequest(
     apiUrl,
     token,
@@ -3906,7 +4184,7 @@ async function handleCreate(argv, apiUrl, token) {
   );
   if (!reposRes.ok || !reposRes.items?.length) {
     console.error(`No GitHub repos linked to property "${property.name}". Link one first in the web app.`);
-    process10.exit(1);
+    process11.exit(1);
   }
   const linkedRepo = reposRes.items[0];
   const branch = getArgValue(argv, "--branch") ?? linkedRepo.defaultBranch ?? "main";
@@ -3916,7 +4194,7 @@ async function handleCreate(argv, apiUrl, token) {
   const instanceSize = sizeArg ? parseInstanceSize(sizeArg) : void 0;
   if (sizeArg && !instanceSize) {
     console.error(`Error: invalid --size '${sizeArg}'. Must be one of: ${INSTANCE_SIZES.join(", ")}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   const body = {
     name,
@@ -3936,7 +4214,7 @@ async function handleCreate(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -3956,7 +4234,7 @@ async function handleProvision(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   if (!templateId) {
     console.error("Error: template ID required. Usage: canary sandbox provision <template-id> [--ttl 8]");
-    process10.exit(1);
+    process11.exit(1);
   }
   const name = getArgValue(argv, "--name") ?? `instance-${Date.now()}`;
   const ttl = parseInt(getArgValue(argv, "--ttl") ?? "8", 10);
@@ -3983,7 +4261,7 @@ async function handleProvision(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -4008,7 +4286,7 @@ async function handleWarm(argv, apiUrl, token) {
       "Error: template ID required. Usage: canary sandbox warm <template-id> [--wait] [--timeout <sec>]"
     );
     console.error("Find the template id with: canary sandbox list");
-    process10.exit(1);
+    process11.exit(1);
   }
   const ensure = () => apiRequest(
     apiUrl,
@@ -4023,7 +4301,7 @@ async function handleWarm(argv, apiUrl, token) {
     } else {
       console.error(`Error: ${first.error ?? "Failed to warm sandbox"}`);
     }
-    process10.exit(1);
+    process11.exit(1);
   }
   const terminalOk = /* @__PURE__ */ new Set(["running"]);
   const terminalFail = /* @__PURE__ */ new Set(["failed", "terminated", "stopping"]);
@@ -4036,7 +4314,7 @@ async function handleWarm(argv, apiUrl, token) {
       const poll = await ensure();
       if (!poll.ok || !poll.data) {
         console.error(`Error polling sandbox: ${poll.error ?? "Unknown error"}`);
-        process10.exit(1);
+        process11.exit(1);
       }
       current = poll.data;
       if (terminalOk.has(current.status) || terminalFail.has(current.status)) break;
@@ -4060,8 +4338,8 @@ async function handleWarm(argv, apiUrl, token) {
       console.log("\nWarming in the background. Poll with: canary sandbox warm " + templateId + " --wait");
     }
   }
-  if (terminalFail.has(current.status)) process10.exit(1);
-  if (wait && current.status !== "running") process10.exit(1);
+  if (terminalFail.has(current.status)) process11.exit(1);
+  if (wait && current.status !== "running") process11.exit(1);
 }
 function parseDockerPs(stdout) {
   const lines = stdout.split("\n").map((l) => l.trim()).filter(Boolean);
@@ -4106,7 +4384,7 @@ async function handleVerify(argv, apiUrl, token) {
   const autoTerminateOnFailure = hasFlag(argv, "--auto-terminate-on-failure");
   if (!templateId) {
     console.error("Error: template ID required. Usage: canary sandbox verify <template-id>");
-    process10.exit(1);
+    process11.exit(1);
   }
   console.log(`Verifying template ${templateId}...`);
   const verifyRes = await apiRequest(
@@ -4118,7 +4396,7 @@ async function handleVerify(argv, apiUrl, token) {
   );
   if (!verifyRes.ok) {
     console.error(`Error: ${verifyRes.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   const instanceId = verifyRes.data.instanceId;
   console.log(`  Verification instance: ${instanceId}`);
@@ -4133,7 +4411,7 @@ async function handleVerify(argv, apiUrl, token) {
   let routes = [];
   let routesFetched = false;
   while (Date.now() - startTime < TIMEOUT_MS) {
-    await new Promise((resolve3) => setTimeout(resolve3, POLL_INTERVAL_MS2));
+    await new Promise((resolve4) => setTimeout(resolve4, POLL_INTERVAL_MS2));
     const diag = await apiRequest(
       apiUrl,
       token,
@@ -4154,23 +4432,23 @@ async function handleVerify(argv, apiUrl, token) {
     const containers = parseDockerPs(dockerOutput);
     const broken = containers.filter(isBrokenContainer);
     const ttl = remaining > 60 ? `${elapsed}s elapsed` : `${remaining}s remaining`;
-    process10.stdout.write(
+    process11.stdout.write(
       `\r  [${ttl}] status: ${status}, app: ${appUp ? "up" : "waiting"}, containers: ${containers.length}, unhealthy: ${broken.length}        `
     );
     if (status === "running" && appUp) {
-      process10.stdout.write("\n");
+      process11.stdout.write("\n");
       finalStatus = "running";
       break;
     }
     if (status === "failed" || status === "terminated") {
-      process10.stdout.write("\n");
+      process11.stdout.write("\n");
       finalStatus = status;
       break;
     }
     const shouldDump = !appUp && broken.length > 0 && now - lastDetailDumpAt >= DETAIL_DUMP_INTERVAL_MS;
     if (shouldDump) {
       lastDetailDumpAt = now;
-      process10.stdout.write("\n");
+      process11.stdout.write("\n");
       console.log("");
       console.log(`  App unreachable after ${elapsed}s. Container state:`);
       for (const c of containers) {
@@ -4235,7 +4513,7 @@ async function handleVerify(argv, apiUrl, token) {
       console.error(`  Terminate manually with:`);
       console.error(`                canary sandbox terminate ${instanceId}`);
     }
-    process10.exit(1);
+    process11.exit(1);
   }
   const evidenceSummary = `Verified via canary sandbox verify \u2014 fresh instance ${instanceId} came up healthy.`;
   for (const itemId of ["server-running", "server-accessible"]) {
@@ -4261,7 +4539,7 @@ async function handleVerify(argv, apiUrl, token) {
   if (!completeRes.ok) {
     console.error(`Failed to record verification: ${completeRes.error}`);
     console.error(`Instance ${instanceId} left running for inspection.`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (!keepInstance) {
     await apiRequest(apiUrl, token, "POST", `/org/environments/instances/${instanceId}/terminate`);
@@ -4306,7 +4584,7 @@ async function handleVerify(argv, apiUrl, token) {
     console.log('Complete:  canary sandbox checklist complete <template-id> <item-id> --status success --summary "..."');
     console.log("Skip:      canary sandbox checklist skip     <template-id> <item-id>");
   }
-  process10.exit(1);
+  process11.exit(1);
 }
 async function handleArtifactGet(argv, apiUrl, token) {
   const positional = argv.filter((a) => !a.startsWith("-"));
@@ -4315,7 +4593,7 @@ async function handleArtifactGet(argv, apiUrl, token) {
   const outputFile = getArgValue(argv, "--output");
   if (!templateId || !type) {
     console.error("Error: template ID and artifact type required. Usage: canary sandbox artifact get <template-id> <type>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -4325,14 +4603,14 @@ async function handleArtifactGet(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (outputFile) {
-    const { writeFileSync } = await import("fs");
-    writeFileSync(outputFile, res.data.content ?? "", "utf-8");
+    const { writeFileSync: writeFileSync2 } = await import("fs");
+    writeFileSync2(outputFile, res.data.content ?? "", "utf-8");
     console.log(`Written to ${outputFile}`);
   } else {
-    process10.stdout.write(res.data.content ?? "");
+    process11.stdout.write(res.data.content ?? "");
   }
 }
 async function handleArtifactCreate(argv, apiUrl, token) {
@@ -4343,17 +4621,17 @@ async function handleArtifactCreate(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   if (!templateId || !type || !filePath) {
     console.error("Error: all args required. Usage: canary sandbox artifact create <template-id> <type> <file>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const WELL_KNOWN_TYPES = ["docker-compose", "dockerfile", "startup-script", "setup-script", "seed-script", "environment-config", "file"];
   if (!WELL_KNOWN_TYPES.includes(type)) {
     console.error(`Error: invalid artifact type "${type}". Valid types: ${WELL_KNOWN_TYPES.join(", ")}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   const destinationPath = getArgValue(argv, "--path");
   if (type === "file" && !destinationPath) {
     console.error("Error: file artifacts require --path <destination>. Example: --path /workspace/.canary/vite.sandbox.config.ts");
-    process10.exit(1);
+    process11.exit(1);
   }
   if (destinationPath && !destinationPath.startsWith("/workspace/.canary/")) {
     const suggestedName = destinationPath.split("/").filter(Boolean).pop() ?? "yourfile";
@@ -4361,14 +4639,14 @@ async function handleArtifactCreate(argv, apiUrl, token) {
       `Error: --path must be under /workspace/.canary/ (the repo tree is user-owned \u2014 sandbox files live in .canary/).
        try: --path /workspace/.canary/${suggestedName}`
     );
-    process10.exit(1);
+    process11.exit(1);
   }
   let content;
   try {
-    content = readFileSync6(filePath, "utf-8");
+    content = readFileSync7(filePath, "utf-8");
   } catch (err) {
     console.error(`Error reading file: ${err}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   const filename = filePath.split("/").pop() ?? filePath;
   const res = await apiRequest(
@@ -4386,7 +4664,7 @@ async function handleArtifactCreate(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -4406,7 +4684,7 @@ async function handleBuild(argv, apiUrl, token) {
   const instanceId = positional[0];
   if (!instanceId) {
     console.error("Error: instance ID required. Usage: canary sandbox build <instance-id>");
-    process10.exit(1);
+    process11.exit(1);
   }
   console.log("Building sandbox (this takes a few minutes)...");
   const KICKOFF_TIMEOUT_MS = 8e3;
@@ -4428,7 +4706,7 @@ async function handleBuild(argv, apiUrl, token) {
       buildResult = data.data;
     } else if (data && !data.ok) {
       console.error(`Error: ${data.error ?? "build failed"}`);
-      process10.exit(1);
+      process11.exit(1);
     }
   } else {
     const { failure } = result;
@@ -4436,7 +4714,7 @@ async function handleBuild(argv, apiUrl, token) {
     if (!isExpectedAsync) {
       if (isTerminalFailure(failure)) exitOnFailure(failure);
       console.error(`Error: ${failure.message}`);
-      process10.exit(1);
+      process11.exit(1);
     }
   }
   if (buildCompleted && buildResult) {
@@ -4445,18 +4723,18 @@ async function handleBuild(argv, apiUrl, token) {
       return;
     }
     if (buildResult.stdout) {
-      process10.stdout.write(buildResult.stdout);
-      if (!buildResult.stdout.endsWith("\n")) process10.stdout.write("\n");
+      process11.stdout.write(buildResult.stdout);
+      if (!buildResult.stdout.endsWith("\n")) process11.stdout.write("\n");
     }
     if (buildResult.stderr) {
-      process10.stderr.write(`STDERR: ${buildResult.stderr}`);
-      if (!buildResult.stderr.endsWith("\n")) process10.stderr.write("\n");
+      process11.stderr.write(`STDERR: ${buildResult.stderr}`);
+      if (!buildResult.stderr.endsWith("\n")) process11.stderr.write("\n");
     }
     if (buildResult.exitCode === 0) {
       console.log("Build complete.");
     } else {
       console.error(`Build failed with exit code ${buildResult.exitCode}`);
-      process10.exit(1);
+      process11.exit(1);
     }
     return;
   }
@@ -4470,7 +4748,7 @@ async function handleBuild(argv, apiUrl, token) {
   const POLL_INTERVAL_MS2 = 1e4;
   const startTime = Date.now();
   while (Date.now() - startTime < BUILD_POLL_TIMEOUT_MS) {
-    await new Promise((resolve3) => setTimeout(resolve3, POLL_INTERVAL_MS2));
+    await new Promise((resolve4) => setTimeout(resolve4, POLL_INTERVAL_MS2));
     const diag = await apiRequest(
       apiUrl,
       token,
@@ -4486,18 +4764,18 @@ async function handleBuild(argv, apiUrl, token) {
     const appUp = appOutput.length > 0 && !appOutput.includes("UNREACHABLE");
     const containerCount = (dockerOutput.match(/\n/g) || []).length + (dockerOutput ? 1 : 0);
     const healthyCount = (dockerOutput.match(/\(healthy\)/g) || []).length;
-    process10.stdout.write(`\r  [${elapsed}s] containers: ${containerCount}, healthy: ${healthyCount}, app: ${appUp ? "up" : "waiting"}  `);
+    process11.stdout.write(`\r  [${elapsed}s] containers: ${containerCount}, healthy: ${healthyCount}, app: ${appUp ? "up" : "waiting"}  `);
     if (appUp) {
-      process10.stdout.write("\n");
+      process11.stdout.write("\n");
       console.log("Build complete.");
       return;
     }
   }
-  process10.stdout.write("\n");
+  process11.stdout.write("\n");
   console.error("Build timed out waiting for the app to respond. Check diagnostics and logs:");
   console.error(`  canary sandbox diagnostics ${instanceId}`);
   console.error(`  canary sandbox logs ${instanceId} --service <name>`);
-  process10.exit(1);
+  process11.exit(1);
 }
 async function handleRunCommand(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
@@ -4514,7 +4792,7 @@ async function handleRunCommand(argv, apiUrl, token) {
   const command = firstNonFlag >= 0 ? filtered.slice(firstNonFlag + 1).join(" ") : "";
   if (!instanceId || !command) {
     console.error("Error: instance ID and command required. Usage: canary sandbox run-command <instance-id> [--service <name>] [--timeout <ms>] <command...>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const timeoutMs = timeoutFlag ? Math.max(parseInt(timeoutFlag, 10), 1e3) : 6e4;
   const res = await apiRequest(
@@ -4527,19 +4805,19 @@ async function handleRunCommand(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
     return;
   }
   if (res.data.stdout) {
-    process10.stdout.write(res.data.stdout);
-    if (!res.data.stdout.endsWith("\n")) process10.stdout.write("\n");
+    process11.stdout.write(res.data.stdout);
+    if (!res.data.stdout.endsWith("\n")) process11.stdout.write("\n");
   }
   if (res.data.stderr) {
-    process10.stderr.write(`STDERR: ${res.data.stderr}`);
-    if (!res.data.stderr.endsWith("\n")) process10.stderr.write("\n");
+    process11.stderr.write(`STDERR: ${res.data.stderr}`);
+    if (!res.data.stderr.endsWith("\n")) process11.stderr.write("\n");
   }
   if (res.data.exitCode !== 0) {
     console.log(`Exit code: ${res.data.exitCode}`);
@@ -4551,7 +4829,7 @@ async function handleDiagnostics(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   if (!instanceId) {
     console.error("Error: instance ID required. Usage: canary sandbox diagnostics <instance-id>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -4563,7 +4841,7 @@ async function handleDiagnostics(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   const routes = await fetchInstanceRoutes(apiUrl, token, instanceId);
   const data = { ...res.data, routes };
@@ -4618,7 +4896,7 @@ async function handleTerminate(argv, apiUrl, token) {
   const instanceId = positional[0];
   if (!instanceId) {
     console.error("Error: instance ID required. Usage: canary sandbox terminate <instance-id>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -4628,7 +4906,7 @@ async function handleTerminate(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   console.log(`Instance ${instanceId} termination initiated.`);
 }
@@ -4637,7 +4915,7 @@ async function handleDelete(argv, apiUrl, token) {
   const templateId = positional[0];
   if (!templateId) {
     console.error("Error: template ID required. Usage: canary sandbox delete <template-id>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -4647,7 +4925,7 @@ async function handleDelete(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   console.log(`Template ${templateId} deleted.`);
 }
@@ -4657,7 +4935,7 @@ async function handleActionList(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   if (!templateId) {
     console.error("Error: template ID required. Usage: canary sandbox action list <template-id>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -4667,7 +4945,7 @@ async function handleActionList(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -4691,7 +4969,7 @@ async function handleActionGet(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   if (!templateId || !slug) {
     console.error("Error: template ID and slug required. Usage: canary sandbox action get <template-id> <slug>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -4701,7 +4979,7 @@ async function handleActionGet(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -4734,7 +5012,7 @@ async function handleActionCreate(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   if (!templateId || !slug) {
     console.error("Error: template ID and slug required. Usage: canary sandbox action create <template-id> <slug> [options]");
-    process10.exit(1);
+    process11.exit(1);
   }
   const scriptPath = getArgValue(argv, "--script");
   const inputSchemaPath = getArgValue(argv, "--input-schema");
@@ -4752,63 +5030,63 @@ async function handleActionCreate(argv, apiUrl, token) {
   const provisionOrderStr = getArgValue(argv, "--provision-order");
   if (provisioningMode && provisioningMode !== "shared" && provisioningMode !== "unique") {
     console.error("Error: --provisioning-mode must be 'shared' or 'unique'");
-    process10.exit(1);
+    process11.exit(1);
   }
   if (provisionOrderStr && !/^-?\d+$/.test(provisionOrderStr)) {
     console.error("Error: --provision-order must be an integer");
-    process10.exit(1);
+    process11.exit(1);
   }
   if (!scriptPath) {
     console.error("Error: --script <file> is required");
-    process10.exit(1);
+    process11.exit(1);
   }
   if (!inputSchemaPath) {
     console.error("Error: --input-schema <file> is required");
-    process10.exit(1);
+    process11.exit(1);
   }
   let scriptContent;
   try {
-    scriptContent = readFileSync6(scriptPath, "utf-8");
+    scriptContent = readFileSync7(scriptPath, "utf-8");
   } catch (err) {
     console.error(`Error reading script file: ${err}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   let inputSchema;
   try {
-    inputSchema = JSON.parse(readFileSync6(inputSchemaPath, "utf-8"));
+    inputSchema = JSON.parse(readFileSync7(inputSchemaPath, "utf-8"));
   } catch (err) {
     console.error(`Error reading input schema file: ${err}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   let outputSchema;
   if (outputSchemaPath) {
     try {
-      outputSchema = JSON.parse(readFileSync6(outputSchemaPath, "utf-8"));
+      outputSchema = JSON.parse(readFileSync7(outputSchemaPath, "utf-8"));
     } catch (err) {
       console.error(`Error reading output schema file: ${err}`);
-      process10.exit(1);
+      process11.exit(1);
     }
   }
   let credentialOutputConfig;
   if (credentialOutputConfigPath) {
     try {
-      credentialOutputConfig = JSON.parse(readFileSync6(credentialOutputConfigPath, "utf-8"));
+      credentialOutputConfig = JSON.parse(readFileSync7(credentialOutputConfigPath, "utf-8"));
     } catch (err) {
       console.error(`Error reading credential output config file: ${err}`);
-      process10.exit(1);
+      process11.exit(1);
     }
   }
   let outputConfig;
   if (outputConfigPath) {
     try {
-      outputConfig = JSON.parse(readFileSync6(outputConfigPath, "utf-8"));
+      outputConfig = JSON.parse(readFileSync7(outputConfigPath, "utf-8"));
     } catch (err) {
       console.error(`Error reading output config file: ${err}`);
-      process10.exit(1);
+      process11.exit(1);
     }
     if (!Array.isArray(outputConfig)) {
       console.error("Error: --output-config must contain a JSON array of output slots");
-      process10.exit(1);
+      process11.exit(1);
     }
   }
   const body = {
@@ -4836,7 +5114,7 @@ async function handleActionCreate(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -4850,7 +5128,7 @@ async function handleActionDelete(argv, apiUrl, token) {
   const slug = positional[1];
   if (!templateId || !slug) {
     console.error("Error: template ID and slug required. Usage: canary sandbox action delete <template-id> <slug>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -4860,7 +5138,7 @@ async function handleActionDelete(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   console.log(`Action '${slug}' deleted.`);
 }
@@ -4871,16 +5149,16 @@ async function handleActionExecute(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   if (!instanceId || !slug) {
     console.error("Error: instance ID and slug required. Usage: canary sandbox action execute <instance-id> <slug> [options]");
-    process10.exit(1);
+    process11.exit(1);
   }
   let params = {};
   const paramsFile = getArgValue(argv, "--params-file");
   if (paramsFile) {
     try {
-      params = JSON.parse(readFileSync6(paramsFile, "utf-8"));
+      params = JSON.parse(readFileSync7(paramsFile, "utf-8"));
     } catch (err) {
       console.error(`Error reading params file: ${err}`);
-      process10.exit(1);
+      process11.exit(1);
     }
   }
   for (let i = 0; i < argv.length; i++) {
@@ -4899,11 +5177,11 @@ async function handleActionExecute(argv, apiUrl, token) {
     const parsed = Number(timeoutArg);
     if (!Number.isFinite(parsed) || parsed <= 0) {
       console.error(`Error: --timeout-ms must be a positive number, got '${timeoutArg}'`);
-      process10.exit(1);
+      process11.exit(1);
     }
     if (!runAsync) {
       console.error("Error: --timeout-ms only applies with --async");
-      process10.exit(1);
+      process11.exit(1);
     }
     executionTimeoutMs = parsed;
   }
@@ -4921,7 +5199,7 @@ async function handleActionExecute(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -4962,7 +5240,7 @@ async function handleActionExecutions(argv, apiUrl, token) {
   const json = hasFlag(argv, "--json");
   if (!instanceId) {
     console.error("Error: instance ID required. Usage: canary sandbox action executions <instance-id>");
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -4972,7 +5250,7 @@ async function handleActionExecutions(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -5016,7 +5294,7 @@ async function handleActionExecutionGet(argv, apiUrl, token) {
     console.error(
       "Error: instance ID and execution ID required. Usage: cofactor sandbox action execution get <instance-id> <execution-id>"
     );
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -5026,7 +5304,7 @@ async function handleActionExecutionGet(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -5043,7 +5321,7 @@ async function handleActionExecutionCancel(argv, apiUrl, token) {
     console.error(
       "Error: instance ID and execution ID required. Usage: cofactor sandbox action execution cancel <instance-id> <execution-id>"
     );
-    process10.exit(1);
+    process11.exit(1);
   }
   const res = await apiRequest(
     apiUrl,
@@ -5053,7 +5331,7 @@ async function handleActionExecutionCancel(argv, apiUrl, token) {
   );
   if (!res.ok) {
     console.error(`Error: ${res.error}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(res.data, null, 2));
@@ -5088,7 +5366,7 @@ async function handleRepoList(argv, apiUrl, token) {
   const templateId = getArgValue(argv, "--template");
   if (!templateId) {
     console.error("Error: --template is required.");
-    process10.exit(1);
+    process11.exit(1);
   }
   const result = await apiRequest(
     apiUrl,
@@ -5098,7 +5376,7 @@ async function handleRepoList(argv, apiUrl, token) {
   );
   if (!result.ok) {
     console.error(`Error: ${result.error ?? "Unknown error"}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) {
     writeRawOutput(JSON.stringify(result.items ?? [], null, 2));
@@ -5127,7 +5405,7 @@ async function handleRepoAdd(argv, apiUrl, token) {
   if (!templateId || !propertyGithubRepoId) {
     console.error("Error: --template and --property-github-repo-id are required.");
     console.error("Tip: link the repo to the property first via `canary property repo link`, then pass its id here.");
-    process10.exit(1);
+    process11.exit(1);
   }
   const parsed = spec ? parseRepoSpec(spec) : {};
   const body = { propertyGithubRepoId };
@@ -5148,7 +5426,7 @@ async function handleRepoAdd(argv, apiUrl, token) {
   if (!result.ok) {
     if (json) writeRawOutput(JSON.stringify(result, null, 2));
     else console.error(`Error: ${result.error ?? "Unknown error"}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) writeRawOutput(JSON.stringify(result.data, null, 2));
   else console.log(`Linked repo to template ${templateId} (link=${result.data?.id})`);
@@ -5163,7 +5441,7 @@ async function handleRepoUpdate(argv, apiUrl, token) {
   const serviceName = getArgValue(argv, "--service-name");
   if (!templateId || !linkId) {
     console.error("Error: --template and --link-id are required.");
-    process10.exit(1);
+    process11.exit(1);
   }
   const body = {};
   if (role !== void 0) body.role = role;
@@ -5180,7 +5458,7 @@ async function handleRepoUpdate(argv, apiUrl, token) {
   if (!result.ok) {
     if (json) writeRawOutput(JSON.stringify(result, null, 2));
     else console.error(`Error: ${result.error ?? "Unknown error"}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) writeRawOutput(JSON.stringify(result.data, null, 2));
   else console.log(`Updated repo link ${linkId}`);
@@ -5191,7 +5469,7 @@ async function handleRepoRemove(argv, apiUrl, token) {
   const linkId = getArgValue(argv, "--link-id");
   if (!templateId || !linkId) {
     console.error("Error: --template and --link-id are required.");
-    process10.exit(1);
+    process11.exit(1);
   }
   const result = await apiRequest(
     apiUrl,
@@ -5202,7 +5480,7 @@ async function handleRepoRemove(argv, apiUrl, token) {
   if (!result.ok) {
     if (json) writeRawOutput(JSON.stringify(result, null, 2));
     else console.error(`Error: ${result.error ?? "Unknown error"}`);
-    process10.exit(1);
+    process11.exit(1);
   }
   if (json) writeRawOutput(JSON.stringify(result, null, 2));
   else console.log(`Removed repo link ${linkId} from template ${templateId}`);
@@ -5231,7 +5509,7 @@ Examples:
   canary sandbox repo add --template <template-id> --property-github-repo-id <uuid> --role frontend
   canary sandbox repo add --template <template-id> --property-github-repo-id <uuid> --spec frontend=owner/web@main:/apps/web`
       );
-      process10.exit(1);
+      process11.exit(1);
   }
 }
 async function runSandbox(argv) {
@@ -5250,7 +5528,7 @@ async function runSandbox(argv) {
     const sections = legacy ? SANDBOX_GUIDE_SECTIONS : SANDBOX_V2_GUIDE_SECTIONS;
     if (section && !sections.some((s) => s.slug === section) && SANDBOX_GUIDE_SECTIONS.some((s) => s.slug === section)) {
       console.error(`"${section}" is a section of the v1 sandbox guide: run "cofactor sandbox guide v1 ${section}".`);
-      process10.exit(1);
+      process11.exit(1);
     }
     await printServedGuide(legacy ? "sandbox" : "sandbox-v2", guideRest);
     return;
@@ -5305,7 +5583,7 @@ async function runSandbox(argv) {
         await handlePoolSetSize(poolRest, apiUrl, token);
       } else {
         console.error(`Unknown pool action: ${poolAction}. Use "set-size".`);
-        process10.exit(1);
+        process11.exit(1);
       }
       break;
     }
@@ -5317,7 +5595,7 @@ async function runSandbox(argv) {
         await handleArtifactCreate(actionRest, apiUrl, token);
       } else {
         console.error(`Unknown artifact action: ${action2}. Use "get" or "create".`);
-        process10.exit(1);
+        process11.exit(1);
       }
       break;
     }
@@ -5331,7 +5609,7 @@ async function runSandbox(argv) {
         await handleConfigUnset(configRest, apiUrl, token);
       } else {
         console.error(`Unknown config action: ${configAction}. Use "list", "set", or "unset".`);
-        process10.exit(1);
+        process11.exit(1);
       }
       break;
     }
@@ -5367,13 +5645,13 @@ async function runSandbox(argv) {
             await handleActionExecutionCancel(execRest, apiUrl, token);
           } else {
             console.error(`Unknown execution sub-command: ${execSub}. Use "get" or "cancel".`);
-            process10.exit(1);
+            process11.exit(1);
           }
           break;
         }
         default:
           console.error(`Unknown action sub-command: ${actionSub}. Use "list", "get", "create", "delete", "execute", "executions", or "execution".`);
-          process10.exit(1);
+          process11.exit(1);
       }
       break;
     }
@@ -5425,6 +5703,9 @@ async function runSandbox(argv) {
     case "sync":
       await handleSandboxSync(v2Positionals("sync", args), args, apiUrl, token);
       break;
+    case "auth-check":
+      await handleSandboxAuthCheck(args, apiUrl, token);
+      break;
     case "verify-env":
       await handleSandboxVerifyEnv(args, apiUrl, token);
       break;
@@ -5440,7 +5721,7 @@ async function runSandbox(argv) {
     default:
       console.error(`Unknown sub-command: ${subCommand}`);
       printHelp();
-      process10.exit(1);
+      process11.exit(1);
   }
 }
 export {
@@ -5457,4 +5738,4 @@ export {
   withPluginEnabled,
   withoutPlugin
 };
-//# sourceMappingURL=sandbox-R6EMGOKR.js.map
+//# sourceMappingURL=sandbox-FBLJEYA2.js.map