@sandblocks/cli 0.4.0 → 0.5.0-b.1

package/dist/cli.js

@@ -11735,7 +11735,7 @@ var init_src = __esm(() => {
 init_src();
 import { randomUUID as randomUUID4 } from "crypto";
 import { lstat, readFile as readFile8, stat as stat3, writeFile as writeFile5 } from "fs/promises";
-import path5 from "path";
+import path6 from "path";
 
 // src/hooks.ts
 import { chmod, copyFile, mkdir, readFile as readFile3, rm, writeFile } from "fs/promises";
@@ -11877,11 +11877,100 @@ async function text(file) {
   }
 }
 
+// src/runtime.ts
+import { chmod as chmod2, mkdir as mkdir2, readdir, rm as rm2 } from "fs/promises";
+import path4 from "path";
+var RUNTIME_PATTERN = /^[a-z][a-z0-9-]{0,62}$/;
+var NODE_ENV_RUNTIME = {
+  production: "prod",
+  development: "dev",
+  test: "local"
+};
+async function runRuntimeCommand(args) {
+  const [action, ...rest] = args;
+  if (action !== "prepare")
+    throw new Error("runtime action must be prepare");
+  const options = parse(rest);
+  const root = path4.resolve(options.positionals[0] ?? process.cwd());
+  const runtime = normalizedRuntime(option(options, "runtime") ?? process.env.SANDBLOCKS_RUNTIME ?? "development" ?? "development");
+  const targetRoot = contained(root, option(options, "target") ?? ".locker", "runtime target");
+  const runtimeRoot = path4.join(targetRoot, runtime);
+  const config = contained(root, option(options, "config") ?? "config/dotlocker.config.ts", "Dotlocker config");
+  const dotlocker = path4.resolve(root, option(options, "dotlocker") ?? path4.join("node_modules", ".bin", "dotlocker"));
+  if (!await Bun.file(config).exists())
+    throw new Error(`Dotlocker config does not exist: ${config}`);
+  if (!await Bun.file(dotlocker).exists()) {
+    throw new Error("Dotlocker is not installed; add @dotlocker/dotlocker to the workspace");
+  }
+  await rm2(targetRoot, { recursive: true, force: true });
+  await mkdir2(runtimeRoot, { recursive: true, mode: 493 });
+  const child = Bun.spawn([dotlocker, "pull", "--config", config, "--runtime", runtime, "--out", runtimeRoot], { cwd: root, env: process.env, stdin: "inherit", stdout: "inherit", stderr: "inherit" });
+  const exitCode = await child.exited;
+  if (exitCode !== 0)
+    throw new Error(`Dotlocker pull failed with exit code ${exitCode}`);
+  const envFile = path4.join(runtimeRoot, ".env");
+  if (!await Bun.file(envFile).exists()) {
+    throw new Error(`Dotlocker did not materialize ${path4.relative(root, envFile)}`);
+  }
+  await normalizePermissions(targetRoot);
+  console.log(`runtime   ${runtime}
+environment ${path4.relative(root, envFile)}`);
+}
+function normalizedRuntime(value) {
+  const runtime = NODE_ENV_RUNTIME[value.trim()] ?? value.trim();
+  if (!RUNTIME_PATTERN.test(runtime))
+    throw new Error(`invalid runtime '${value}'`);
+  return runtime;
+}
+function contained(root, value, label) {
+  const resolved = path4.resolve(root, value);
+  const relative = path4.relative(root, resolved);
+  if (!relative || !relative.startsWith("..") && !path4.isAbsolute(relative))
+    return resolved;
+  throw new Error(`${label} must remain within the repository`);
+}
+async function normalizePermissions(directory) {
+  await chmod2(directory, 493);
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const child = path4.join(directory, entry.name);
+    if (entry.isSymbolicLink())
+      throw new Error("Dotlocker output must not contain symbolic links");
+    if (entry.isDirectory())
+      await normalizePermissions(child);
+    else if (entry.isFile())
+      await chmod2(child, 420);
+    else
+      throw new Error("Dotlocker output contains an unsupported file type");
+  }
+}
+function parse(args) {
+  const options = { positionals: [] };
+  for (let index = 0;index < args.length; index += 1) {
+    const value = args[index] ?? "";
+    if (!value.startsWith("--")) {
+      options.positionals.push(value);
+      continue;
+    }
+    const key = value.slice(2);
+    const next = args[index + 1];
+    if (next && !next.startsWith("--")) {
+      options[key] = next;
+      index += 1;
+    } else
+      options[key] = true;
+  }
+  return options;
+}
+function option(options, key) {
+  const value = options[key];
+  return typeof value === "string" ? value : undefined;
+}
+
 // src/sandbox.ts
 init_src();
 import { createHash as createHash2, randomUUID } from "crypto";
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile4, rename, rm as rm2 } from "fs/promises";
-import path4 from "path";
+import { chmod as chmod3, mkdir as mkdir3, readFile as readFile4, rename, rm as rm3 } from "fs/promises";
+import path5 from "path";
 var COMMANDS = new Set([
   "up",
   "create",
@@ -11933,7 +12022,7 @@ async function up(args, dependencies) {
 }
 async function create(args, dependencies) {
   const options = dependencies.parse(args);
-  const root = path4.resolve(options.positionals[0] ?? process.cwd());
+  const root = path5.resolve(options.positionals[0] ?? process.cwd());
   await loadLocalEnvironment(root);
   const environment = dependencies.option(options, "environment") ?? "preview";
   const file = statePath(root, environment);
@@ -11942,7 +12031,7 @@ async function create(args, dependencies) {
   const loaded = await dependencies.load(root, dependencies.option(options, "config") ?? dependencies.option(options, "manifest"));
   const preview = selectPreview(loaded, environment);
   const projectId = dependencies.option(options, "project") ?? process.env.SANDBLOCKS_PROJECT_ID ?? "default";
-  const repository = loaded.manifest.name ?? path4.basename(root).toLowerCase();
+  const repository = loaded.manifest.name ?? path5.basename(root).toLowerCase();
   const sandboxId = randomUUID();
   const workspaceId = `${sandboxId.replaceAll("-", "").slice(0, 8)}-${repository}`.slice(0, 63);
   const { apiUrl, apiKey } = client(options, dependencies.option, projectId);
@@ -12010,7 +12099,7 @@ async function status2(args, dependencies) {
     console.log(JSON.stringify({ state: redactedState(context.state), sandbox: sandbox.sandbox, session: session.session }, null, 2));
     return;
   }
-  console.log(`state     ${path4.relative(context.root, context.file)}`);
+  console.log(`state     ${path5.relative(context.root, context.file)}`);
   console.log(`sandbox   ${context.state.sandboxId} (${sandbox.sandbox.status})`);
   console.log(`workspace ${context.state.workspaceId}`);
   console.log(`host      ${context.state.hostId}`);
@@ -12023,12 +12112,12 @@ async function deploy(args, dependencies) {
 }
 async function withDeploymentLock(args, dependencies, action) {
   const options = dependencies.parse(args);
-  const root = path4.resolve(options.positionals[0] ?? process.cwd());
+  const root = path5.resolve(options.positionals[0] ?? process.cwd());
   const environment = dependencies.option(options, "environment") ?? "preview";
   const lock = `${statePath(root, environment)}.deploy.lock`;
-  await mkdir2(path4.dirname(lock), { recursive: true, mode: 448 });
+  await mkdir3(path5.dirname(lock), { recursive: true, mode: 448 });
   try {
-    await mkdir2(lock);
+    await mkdir3(lock);
   } catch (error) {
     if (error.code === "EEXIST") {
       throw new Error(`sandbox '${environment}' deployment is already running`);
@@ -12038,7 +12127,7 @@ async function withDeploymentLock(args, dependencies, action) {
   try {
     await action();
   } finally {
-    await rm2(lock, { recursive: true, force: true });
+    await rm3(lock, { recursive: true, force: true });
   }
 }
 async function deployUnlocked(args, dependencies) {
@@ -12271,7 +12360,7 @@ async function down(args, dependencies) {
   await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/sandboxes/${context.state.sandboxId}`, { method: "DELETE" }).catch(() => {
     return;
   });
-  await rm2(context.file, { force: true });
+  await rm3(context.file, { force: true });
   console.log(`sandbox ${context.state.sandboxId} destroyed`);
 }
 async function resolveAssignedTargetHost(context, fallback) {
@@ -12406,7 +12495,7 @@ async function dataOperation(context, action, body) {
 }
 async function getContext(args, dependencies) {
   const options = dependencies.parse(args);
-  const root = path4.resolve(options.positionals[0] ?? process.cwd());
+  const root = path5.resolve(options.positionals[0] ?? process.cwd());
   await loadLocalEnvironment(root);
   const environment = dependencies.option(options, "environment") ?? "preview";
   const file = statePath(root, environment);
@@ -12422,9 +12511,9 @@ async function getContext(args, dependencies) {
 function selectPreview(loaded, id2) {
   return resolveEnvironment(loaded.manifest, id2);
 }
-function client(options, option, projectId) {
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY ?? "";
+function client(options, option2, projectId) {
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY ?? "";
   if (!apiUrl || !apiKey)
     throw new Error("SANDBLOCKS_API_URL and SANDBLOCKS_API_KEY are required");
   return { apiUrl, apiKey, projectId };
@@ -12525,7 +12614,7 @@ async function waitLease(context, operationId) {
   throw new Error(`sandbox operation ${operationId} timed out`);
 }
 async function loadLocalEnvironment(root) {
-  const file = path4.join(root, ".sandblocks", "config.env");
+  const file = path5.join(root, ".sandblocks", "config.env");
   let contents;
   try {
     contents = await readFile4(file, "utf8");
@@ -12589,15 +12678,15 @@ function resolvedServiceDomain(sandboxId, deploymentId, service, preview) {
 function statePath(root, environment) {
   if (!/^[a-z][a-z0-9-]{0,62}$/.test(environment))
     throw new Error("sandbox environment is invalid");
-  return path4.join(root, ".sandblocks", `sandbox-${environment}.json`);
+  return path5.join(root, ".sandblocks", `sandbox-${environment}.json`);
 }
 async function writeState(file, state) {
-  await mkdir2(path4.dirname(file), { recursive: true, mode: 448 });
-  await chmod2(path4.dirname(file), 448);
+  await mkdir3(path5.dirname(file), { recursive: true, mode: 448 });
+  await chmod3(path5.dirname(file), 448);
   const temporary = `${file}.${process.pid}.tmp`;
   await Bun.write(temporary, `${JSON.stringify(state, null, 2)}
 `, { mode: 384 });
-  await chmod2(temporary, 384);
+  await chmod3(temporary, 384);
   await rename(temporary, file);
 }
 function redactedState(state) {
@@ -12613,12 +12702,12 @@ function printOutput(operation) {
 }
 
 // src/sdk.ts
-import { mkdir as mkdir4, readFile as readFile7, rm as rm5, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile7, rm as rm6, writeFile as writeFile4 } from "fs/promises";
 import { dirname as dirname2, resolve as resolve7 } from "path";
 
 // ../sdk/dist/index.js
 import { randomUUID as randomUUID2 } from "crypto";
-import { appendFile, cp, mkdir as mkdir3, readFile as readFile5, rm as rm3 } from "fs/promises";
+import { appendFile, cp, mkdir as mkdir4, readFile as readFile5, rm as rm4 } from "fs/promises";
 import { dirname, resolve } from "path";
 import { spawn } from "child_process";
 import { access, mkdir as mkdir22, writeFile as writeFile2 } from "fs/promises";
@@ -13062,7 +13151,7 @@ class SandblocksSandbox {
         "--force",
         this.git.worktree
       ]);
-      await rm3(this.git.worktree, { recursive: true, force: true });
+      await rm4(this.git.worktree, { recursive: true, force: true });
     }
   }
   async[Symbol.asyncDispose]() {
@@ -13092,7 +13181,7 @@ async function createSandbox(options) {
   for (const file of options.copyToWorktree ?? []) {
     const source = resolve(hostCwd, file);
     const destination = resolve(git3.runtimeCwd, file);
-    await mkdir3(dirname(destination), { recursive: true });
+    await mkdir4(dirname(destination), { recursive: true });
     await withTimeout(cp(source, destination, { recursive: true }), options.timeouts?.copyToWorktreeMs ?? 60000, `copying '${file}'`);
   }
   const id2 = options.id ?? randomUUID2();
@@ -13161,7 +13250,7 @@ async function prepareGit(hostCwd, strategy, timeoutMs = 30000) {
   }
   const branch = strategy.name ?? `sandblocks/${randomUUID2().slice(0, 8)}`;
   const worktree = resolve(hostCwd, ".sandblocks", "worktrees", branch.replace(/[^A-Za-z0-9_.-]/g, "-"));
-  await mkdir3(dirname(worktree), { recursive: true });
+  await mkdir4(dirname(worktree), { recursive: true });
   await checked(["git", "-C", hostCwd, "worktree", "add", "-B", branch, worktree, "HEAD"], timeoutMs);
   return {
     hostCwd,
@@ -13244,7 +13333,7 @@ function createLogger(options, cwd) {
       process.stdout.write(event.type === "text" ? event.text : event.type === "raw" ? `${event.line}
 ` : line);
     if (config.type !== "stdout" && config.type !== "silent") {
-      await mkdir3(dirname(file), { recursive: true });
+      await mkdir4(dirname(file), { recursive: true });
       await appendFile(file, line);
     }
     try {
@@ -13315,12 +13404,12 @@ SANDBLOCKS_API_KEY=
   };
   const written = [];
   for (const [relative, content] of Object.entries(files)) {
-    const path5 = resolve2(root, relative);
-    await mkdir22(resolve2(path5, ".."), { recursive: true });
-    if (!options.force && await access(path5).then(() => true).catch(() => false))
+    const path6 = resolve2(root, relative);
+    await mkdir22(resolve2(path6, ".."), { recursive: true });
+    if (!options.force && await access(path6).then(() => true).catch(() => false))
       continue;
-    await writeFile2(path5, content, { mode: relative.includes(".env") ? 384 : 420 });
-    written.push(path5);
+    await writeFile2(path6, content, { mode: relative.includes(".env") ? 384 : 420 });
+    written.push(path6);
   }
   return written;
 }
@@ -13390,12 +13479,12 @@ async function executeProcess2(command, options = {}) {
     options.signal?.removeEventListener("abort", stop);
   }
 }
-function expandHome(path5) {
-  if (path5 === "~")
-    return process.env.HOME ?? path5;
-  if (path5.startsWith("~/"))
-    return `${process.env.HOME ?? "~"}/${path5.slice(2)}`;
-  return path5;
+function expandHome(path6) {
+  if (path6 === "~")
+    return process.env.HOME ?? path6;
+  if (path6.startsWith("~/"))
+    return `${process.env.HOME ?? "~"}/${path6.slice(2)}`;
+  return path6;
 }
 var capabilities = {
   bindMounts: true,
@@ -13636,12 +13725,12 @@ async function executeProcess3(command, options = {}) {
     options.signal?.removeEventListener("abort", stop);
   }
 }
-function expandHome2(path5) {
-  if (path5 === "~")
-    return process.env.HOME ?? path5;
-  if (path5.startsWith("~/"))
-    return `${process.env.HOME ?? "~"}/${path5.slice(2)}`;
-  return path5;
+function expandHome2(path6) {
+  if (path6 === "~")
+    return process.env.HOME ?? path6;
+  if (path6.startsWith("~/"))
+    return `${process.env.HOME ?? "~"}/${path6.slice(2)}`;
+  return path6;
 }
 var capabilities2 = {
   bindMounts: true,
@@ -13819,7 +13908,7 @@ class PodmanProvider extends OciProvider2 {
 
 // ../sdk/dist/providers/remote.js
 import { randomUUID as randomUUID3 } from "crypto";
-import { mkdtemp, readFile as readFile6, rm as rm4, stat as stat2, writeFile as writeFile3 } from "fs/promises";
+import { mkdtemp, readFile as readFile6, rm as rm5, stat as stat2, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir } from "os";
 import { join } from "path";
 import { spawn as spawn4 } from "child_process";
@@ -14097,12 +14186,12 @@ class RemoteSandblocksProvider {
     if (result.exitCode !== 0)
       throw new Error(result.stderr || "remote operation failed");
   }
-  async request(path5, init = {}) {
+  async request(path6, init = {}) {
     const headers = new Headers(init.headers);
     headers.set("x-sandblocks-api-key", this.options.apiKey);
     if (init.body)
       headers.set("content-type", "application/json");
-    const response = await this.fetchImpl(`${this.baseUrl}${path5}`, { ...init, headers });
+    const response = await this.fetchImpl(`${this.baseUrl}${path6}`, { ...init, headers });
     const body = await response.json().catch(() => ({}));
     if (!response.ok)
       throw new Error(body.error ?? `Sandblocks request failed (${response.status})`);
@@ -14126,7 +14215,7 @@ async function sourceBundle(cwd) {
     ]);
     if (listed.exitCode !== 0)
       throw new Error("remote source directory must be a Git worktree");
-    const files = listed.stdout.split("\x00").filter((path5) => path5 && path5 !== ".sandblocks" && !path5.startsWith(".sandblocks/") && path5 !== ".git");
+    const files = listed.stdout.split("\x00").filter((path6) => path6 && path6 !== ".sandblocks" && !path6.startsWith(".sandblocks/") && path6 !== ".git");
     if (!files.length || files.length > 50000)
       throw new Error("remote source bundle file count is invalid");
     await writeFile3(list, `${files.join("\x00")}\x00`);
@@ -14137,7 +14226,7 @@ async function sourceBundle(cwd) {
       throw new Error("remote source bundle exceeds 512 MiB");
     return new Uint8Array(await readFile6(file));
   } finally {
-    await rm4(temporary, { recursive: true, force: true });
+    await rm5(temporary, { recursive: true, force: true });
   }
 }
 
@@ -14317,7 +14406,7 @@ async function sdkSandbox(args, helpers, defaultCwd) {
       hooks: hooksFrom(options),
       copyToWorktree: multi(options["copy-to-worktree"])
     });
-    await mkdir4(dirname2(stateFile), { recursive: true });
+    await mkdir5(dirname2(stateFile), { recursive: true });
     const strategy = branchFrom(options, helpers);
     const worktree = strategy.type === "worktree" || strategy.type === "merge-to-head" ? sandbox2.cwd : undefined;
     await writeFile4(stateFile, JSON.stringify({
@@ -14392,7 +14481,7 @@ async function sdkSandbox(args, helpers, defaultCwd) {
       const child = Bun.spawn(["git", "-C", state.cwd, "worktree", "remove", "--force", state.worktree]);
       await child.exited;
     }
-    await rm5(stateFile, { force: true });
+    await rm6(stateFile, { force: true });
     console.log(`sandbox ${state.id} destroyed`);
   } else
     throw new Error("unsupported sdk sandbox command");
@@ -14504,10 +14593,10 @@ function hooksFrom(options) {
   };
 }
 async function withSdkConfig(options, cwd, file) {
-  const path5 = resolve7(cwd, file ?? ".sandblocks/config.json");
-  if (!await Bun.file(path5).exists())
+  const path6 = resolve7(cwd, file ?? ".sandblocks/config.json");
+  if (!await Bun.file(path6).exists())
     return options;
-  const config = JSON.parse(await readFile7(path5, "utf8"));
+  const config = JSON.parse(await readFile7(path6, "utf8"));
   const mapped = {};
   if (typeof config.provider === "string")
     mapped.provider = config.provider;
@@ -14575,6 +14664,8 @@ var HELP = `Sandblocks CLI
   sandblocks whoami [directory] [--api-url <url>] [--api-key <key>] [--json]
   sandblocks hooks <install|status|uninstall> [directory]
   sandblocks hooks run post-commit [directory]
+  sandblocks runtime prepare [directory] [--runtime <id>]
+                  [--config <path>] [--target <path>]
   sandblocks stack <list|get|settings|settings-set> --project <id> [--stack <id>] [--file <json>] [--json]
   sandblocks app <list|get|settings|settings-set> --project <id> [--stack <id>] [--app <id>] [--file <json>] [--json]
   sandblocks secret <list|set|delete> --project <id> --stack <id> --app <id>
@@ -14634,8 +14725,8 @@ async function run2(argv = process.argv.slice(2)) {
     await runHooksCommand(args, {
       load,
       runSandbox: (hookCommand2, hookArgs) => runStatefulSandboxCommand(hookCommand2, hookArgs, {
-        parse,
-        option,
+        parse: parse2,
+        option: option2,
         load,
         source: async (root) => {
           const bundle = await createSourceTar(root);
@@ -14643,6 +14734,8 @@ async function run2(argv = process.argv.slice(2)) {
         }
       })
     });
+  else if (command === "runtime")
+    await runRuntimeCommand(args);
   else if (command === "stack" || command === "app")
     await resource(command, args);
   else if (command === "secret")
@@ -14650,7 +14743,7 @@ async function run2(argv = process.argv.slice(2)) {
   else if (command === "sandbox")
     await sandbox(args);
   else if (command === "sdk")
-    await runSdkCommand(args, { parse, option });
+    await runSdkCommand(args, { parse: parse2, option: option2 });
   else {
     console.log(HELP);
     if (!["help", "--help", "-h"].includes(command))
@@ -14658,9 +14751,9 @@ async function run2(argv = process.argv.slice(2)) {
   }
 }
 async function configure(args) {
-  const options = parse(args);
-  const root = path5.resolve(options.positionals[0] ?? process.cwd());
-  const manifestPath = path5.join(root, "sandblocks.yml");
+  const options = parse2(args);
+  const root = path6.resolve(options.positionals[0] ?? process.cwd());
+  const manifestPath = path6.join(root, "sandblocks.yml");
   if (await Bun.file(manifestPath).exists() && !options.force) {
     const loaded2 = await load(root, manifestPathOption(options));
     console.log(`Sandblocks already configured
@@ -14668,8 +14761,8 @@ async function configure(args) {
   digest:   ${loaded2.digest}`);
     return;
   }
-  const packageJson = await json(path5.join(root, "package.json"));
-  const name = slug(option(options, "name") ?? path5.basename(root));
+  const packageJson = await json(path6.join(root, "package.json"));
+  const name = slug(option2(options, "name") ?? path6.basename(root));
   const checks = ["build", "typecheck", "test"].filter((script) => packageJson?.scripts?.[script]);
   const manager = packageJson?.packageManager?.split("@")[0] ?? "npm";
   const command = (script) => `[${manager}, ${manager === "npm" ? "run, " : ""}${script}]`;
@@ -14690,8 +14783,8 @@ async function configure(args) {
   digest:   ${loaded.digest}`);
 }
 async function validate(args) {
-  const options = parse(args);
-  const root = path5.resolve(options.positionals[0] ?? process.cwd());
+  const options = parse2(args);
+  const root = path6.resolve(options.positionals[0] ?? process.cwd());
   const loaded = await load(root, manifestPathOption(options));
   if (options.json) {
     console.log(JSON.stringify({ manifest: loaded.entrypoint, digest: loaded.digest, sources: loaded.sources }, null, 2));
@@ -14701,11 +14794,11 @@ async function validate(args) {
 digest    ${loaded.digest}`);
 }
 async function register(args) {
-  const options = parse(args);
-  const root = path5.resolve(options.positionals[0] ?? process.cwd());
-  const projectId = option(options, "project");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(args);
+  const root = path6.resolve(options.positionals[0] ?? process.cwd());
+  const projectId = option2(options, "project");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId)
     throw new Error("register requires --project");
   if (!apiUrl)
@@ -14713,7 +14806,7 @@ async function register(args) {
   if (!apiKey)
     throw new Error("register requires --api-key or SANDBLOCKS_API_KEY");
   const loaded = await load(root, manifestPathOption(options));
-  const repositoryUrl = option(options, "repository-url") ?? await git3(root, ["config", "--get", "remote.origin.url"]);
+  const repositoryUrl = option2(options, "repository-url") ?? await git3(root, ["config", "--get", "remote.origin.url"]);
   if (!repositoryUrl)
     throw new Error("register requires --repository-url or git remote.origin.url");
   const branch = await git3(root, ["branch", "--show-current"]) || "main";
@@ -14721,7 +14814,7 @@ async function register(args) {
     method: "POST",
     headers: { "content-type": "application/json", "x-sandblocks-api-key": apiKey },
     body: JSON.stringify({
-      slug: loaded.manifest.name ?? slug(path5.basename(root)),
+      slug: loaded.manifest.name ?? slug(path6.basename(root)),
       name: loaded.manifest.name,
       url: repositoryUrl,
       defaultBranch: branch,
@@ -14737,24 +14830,24 @@ async function register(args) {
     console.log(response.status === 409 ? "repository already registered" : "repository registered");
 }
 async function doctor(args) {
-  const options = parse(args);
-  const root = path5.resolve(options.positionals[0] ?? process.cwd());
+  const options = parse2(args);
+  const root = path6.resolve(options.positionals[0] ?? process.cwd());
   const loaded = await load(root, manifestPathOption(options));
   console.log(`manifest  ok (${loaded.entrypoint})`);
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
   if (apiUrl) {
     const response = await fetch(`${apiUrl}/v1/health`);
     if (!response.ok)
       throw new Error(`API health failed (${response.status})`);
     console.log(`api       ok (${apiUrl})`);
   }
-  const gitDetected = await stat3(path5.join(root, ".git")).then(() => true).catch(() => false);
+  const gitDetected = await stat3(path6.join(root, ".git")).then(() => true).catch(() => false);
   console.log(`git       ${gitDetected ? "ok" : "not detected"}`);
 }
 async function whoami(args) {
-  const options = parse(args);
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(args);
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!apiUrl)
     throw new Error("whoami requires --api-url or SANDBLOCKS_API_URL");
   if (!apiKey)
@@ -14777,12 +14870,12 @@ async function whoami(args) {
 }
 async function resource(kind, args) {
   const [action = "list", ...rest] = args;
-  const options = parse(rest);
-  const projectId = option(options, "project");
-  const stack = option(options, "stack");
-  const app = option(options, "app");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(rest);
+  const projectId = option2(options, "project");
+  const stack = option2(options, "stack");
+  const app = option2(options, "app");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId)
     throw new Error(`${kind} ${action} requires --project`);
   if (!apiUrl)
@@ -14802,10 +14895,10 @@ async function resource(kind, args) {
     throw new Error(`unsupported ${kind} command`);
   let body;
   if (action === "settings-set") {
-    const file = option(options, "file");
+    const file = option2(options, "file");
     if (!file)
       throw new Error(`${kind} settings-set requires --file <json>`);
-    const values = JSON.parse(await readFile8(path5.resolve(file), "utf8"));
+    const values = JSON.parse(await readFile8(path6.resolve(file), "utf8"));
     const current = await sandblocksRequest(apiUrl, apiKey, requestPath);
     body = await sandblocksRequest(apiUrl, apiKey, requestPath, {
       method: "PUT",
@@ -14820,12 +14913,12 @@ async function resource(kind, args) {
 }
 async function secret(args) {
   const [action = "list", ...rest] = args;
-  const options = parse(rest);
-  const projectId = option(options, "project");
-  const stack = option(options, "stack");
-  const app = option(options, "app");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(rest);
+  const projectId = option2(options, "project");
+  const stack = option2(options, "stack");
+  const app = option2(options, "app");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId || !stack || !app)
     throw new Error("secret commands require --project, --stack, and --app");
   if (!apiUrl || !apiKey)
@@ -14835,9 +14928,9 @@ async function secret(args) {
   if (action === "list")
     body = await sandblocksRequest(apiUrl, apiKey, root);
   else if (action === "set") {
-    const environment = option(options, "environment");
-    const name = option(options, "name");
-    const value = option(options, "value");
+    const environment = option2(options, "environment");
+    const name = option2(options, "name");
+    const value = option2(options, "value");
     if (!environment || !name || value === undefined)
       throw new Error("secret set requires --environment, --name, and --value");
     body = await sandblocksRequest(apiUrl, apiKey, root, {
@@ -14845,7 +14938,7 @@ async function secret(args) {
       body: JSON.stringify({ environment, name, value })
     });
   } else if (action === "delete") {
-    const id2 = option(options, "id");
+    const id2 = option2(options, "id");
     if (!id2)
       throw new Error("secret delete requires --id");
     await sandblocksRequest(apiUrl, apiKey, `${root}/${encodeURIComponent(id2)}`, { method: "DELETE" });
@@ -14885,8 +14978,8 @@ async function sandbox(args) {
   const [subcommand, ...rest] = args;
   if (isStatefulSandboxCommand(subcommand) && !(subcommand === "deploy" && rest.includes("--workspace"))) {
     return runStatefulSandboxCommand(subcommand, rest, {
-      parse,
-      option,
+      parse: parse2,
+      option: option2,
       load,
       source: async (root2) => {
         const bundle2 = await createSourceTar(root2);
@@ -14902,12 +14995,12 @@ async function sandbox(args) {
     return sandboxAgent(rest);
   if (subcommand !== "import")
     throw new Error("unsupported sandbox command");
-  const options = parse(rest);
-  const root = path5.resolve(options.positionals[0] ?? process.cwd());
-  const projectId = option(options, "project");
-  const workspaceId = option(options, "workspace");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(rest);
+  const root = path6.resolve(options.positionals[0] ?? process.cwd());
+  const projectId = option2(options, "project");
+  const workspaceId = option2(options, "workspace");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId)
     throw new Error("sandbox import requires --project");
   if (!workspaceId)
@@ -14924,8 +15017,8 @@ async function sandbox(args) {
       "content-length": String(bundle.byteLength),
       "x-sandblocks-api-key": apiKey,
       "x-sandblocks-workspace-id": workspaceId,
-      "x-sandblocks-worker-pool": option(options, "pool") ?? "sandbox-development",
-      "idempotency-key": option(options, "idempotency-key") ?? `local-import:${workspaceId}`
+      "x-sandblocks-worker-pool": option2(options, "pool") ?? "sandbox-development",
+      "idempotency-key": option2(options, "idempotency-key") ?? `local-import:${workspaceId}`
     },
     body: new Blob([Uint8Array.from(bundle)])
   });
@@ -14945,12 +15038,12 @@ async function sandbox(args) {
   }
 }
 async function sandboxAgent(args) {
-  const options = parse(args);
+  const options = parse2(args);
   const action = options.positionals[0] ?? "list";
-  const projectId = option(options, "project");
-  const sandboxId = option(options, "sandbox");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const projectId = option2(options, "project");
+  const sandboxId = option2(options, "sandbox");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId || !sandboxId)
     throw new Error("sandbox agent requires --project and --sandbox");
   if (!apiUrl || !apiKey)
@@ -14958,25 +15051,25 @@ async function sandboxAgent(args) {
   const collection = `/v1/projects/${encodeURIComponent(projectId)}/sandboxes/${encodeURIComponent(sandboxId)}/agent-sessions`;
   let result;
   if (action === "run") {
-    const promptFile = option(options, "prompt-file");
-    const prompt = option(options, "prompt") ?? (promptFile ? await readFile8(path5.resolve(promptFile), "utf8") : undefined);
+    const promptFile = option2(options, "prompt-file");
+    const prompt = option2(options, "prompt") ?? (promptFile ? await readFile8(path6.resolve(promptFile), "utf8") : undefined);
     if (!prompt)
       throw new Error("sandbox agent run requires --prompt or --prompt-file");
-    const repository = option(options, "repository");
-    const provider = option(options, "provider") ?? "codex";
-    const model = option(options, "model");
+    const repository = option2(options, "repository");
+    const provider = option2(options, "provider") ?? "codex";
+    const model = option2(options, "model");
     if (!repository || !model)
       throw new Error("sandbox agent run requires --repository and --model");
     result = await sandblocksRequest(apiUrl, apiKey, collection, {
       method: "POST",
-      headers: { "idempotency-key": option(options, "idempotency-key") ?? randomUUID4() },
+      headers: { "idempotency-key": option2(options, "idempotency-key") ?? randomUUID4() },
       body: JSON.stringify({
         repository,
         provider,
         model,
         prompt,
-        credentialEnvironment: option(options, "credential-env"),
-        timeoutSeconds: option(options, "timeout-seconds") ? Number(option(options, "timeout-seconds")) : undefined
+        credentialEnvironment: option2(options, "credential-env"),
+        timeoutSeconds: option2(options, "timeout-seconds") ? Number(option2(options, "timeout-seconds")) : undefined
       })
     });
     if (options.wait)
@@ -14984,12 +15077,12 @@ async function sandboxAgent(args) {
   } else if (action === "list") {
     result = await sandblocksRequest(apiUrl, apiKey, collection);
   } else if (action === "get" || action === "cancel" || action === "redeploy") {
-    const sessionId = option(options, "session");
+    const sessionId = option2(options, "session");
     if (!sessionId)
       throw new Error(`sandbox agent ${action} requires --session`);
     result = await sandblocksRequest(apiUrl, apiKey, `${collection}/${encodeURIComponent(sessionId)}${action === "cancel" ? "/cancel" : action === "redeploy" ? "/redeploy" : ""}`, action === "cancel" || action === "redeploy" ? {
       method: "POST",
-      headers: action === "redeploy" ? { "idempotency-key": option(options, "idempotency-key") ?? randomUUID4() } : undefined
+      headers: action === "redeploy" ? { "idempotency-key": option2(options, "idempotency-key") ?? randomUUID4() } : undefined
     } : undefined);
   } else
     throw new Error("sandbox agent action must be run, list, get, cancel, or redeploy");
@@ -15002,20 +15095,20 @@ async function sandboxAgent(args) {
   }
 }
 async function waitForAgentSession(apiUrl, apiKey, projectId, sandboxId, sessionId) {
-  const path6 = `/v1/projects/${encodeURIComponent(projectId)}/sandboxes/${encodeURIComponent(sandboxId)}/agent-sessions/${encodeURIComponent(sessionId)}`;
+  const path7 = `/v1/projects/${encodeURIComponent(projectId)}/sandboxes/${encodeURIComponent(sandboxId)}/agent-sessions/${encodeURIComponent(sessionId)}`;
   for (;; ) {
-    const result = await sandblocksRequest(apiUrl, apiKey, path6);
+    const result = await sandblocksRequest(apiUrl, apiKey, path7);
     if (!["queued", "running"].includes(String(result.session?.state)))
       return result.session;
     await Bun.sleep(1000);
   }
 }
 async function sandboxPromote(args) {
-  const options = parse(args);
-  const projectId = option(options, "project");
-  const sandboxId = option(options, "sandbox");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(args);
+  const projectId = option2(options, "project");
+  const sandboxId = option2(options, "sandbox");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId)
     throw new Error("sandbox promote requires --project");
   if (!sandboxId)
@@ -15057,7 +15150,7 @@ async function createSourceTar(root) {
     if (name.includes("\x00") || name.includes("\\") || name.startsWith("/") || name.split("/").includes("..")) {
       throw new Error(`local source path is unsafe: ${name}`);
     }
-    const file = path5.join(root, name);
+    const file = path6.join(root, name);
     let info;
     try {
       info = await lstat(file);
@@ -15150,25 +15243,25 @@ function tarOctal(header, offset, length, value) {
   header[offset + length - 1] = 0;
 }
 async function sandboxDeploy(args) {
-  const options = parse(args);
-  const root = path5.resolve(options.positionals[0] ?? process.cwd());
-  const projectId = option(options, "project");
-  const workspaceId = option(options, "workspace");
-  const sandboxId = option(options, "sandbox");
-  const hostId = option(options, "host");
-  const targetHost = option(options, "target-host");
-  const specPath = option(options, "spec");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(args);
+  const root = path6.resolve(options.positionals[0] ?? process.cwd());
+  const projectId = option2(options, "project");
+  const workspaceId = option2(options, "workspace");
+  const sandboxId = option2(options, "sandbox");
+  const hostId = option2(options, "host");
+  const targetHost = option2(options, "target-host");
+  const specPath = option2(options, "spec");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId || !workspaceId || !sandboxId || !hostId || !targetHost || !specPath) {
     throw new Error("sandbox deploy requires --project, --workspace, --sandbox, --host, --target-host, and --spec");
   }
   if (!apiUrl || !apiKey)
     throw new Error("sandbox deploy requires Sandblocks API URL and key");
-  const spec = JSON.parse(await readFile8(path5.resolve(root, specPath), "utf8"));
+  const spec = JSON.parse(await readFile8(path6.resolve(root, specPath), "utf8"));
   if (!Array.isArray(spec.services) || !spec.services.length)
     throw new Error("preview spec requires services");
-  const deploymentId = option(options, "deployment") ?? randomUUID4();
+  const deploymentId = option2(options, "deployment") ?? randomUUID4();
   const submitted = await sandblocksRequest(apiUrl, apiKey, `/v1/projects/${encodeURIComponent(projectId)}/operations`, {
     method: "POST",
     headers: { "idempotency-key": `preview:${deploymentId}:deploy` },
@@ -15249,7 +15342,7 @@ async function waitForOperation(apiUrl, apiKey, id2) {
 async function load(root, entrypoint) {
   return loadSandblocksManifest({ repositoryRoot: root, ...entrypoint ? { entrypoint } : {} });
 }
-function parse(args) {
+function parse2(args) {
   const output = { positionals: [] };
   for (let index = 0;index < args.length; index++) {
     const value = args[index];
@@ -15287,11 +15380,11 @@ function parse(args) {
   }
   return output;
 }
-function option(options, key) {
+function option2(options, key) {
   return typeof options[key] === "string" ? options[key] : undefined;
 }
 function manifestPathOption(options) {
-  return option(options, "config") ?? option(options, "manifest");
+  return option2(options, "config") ?? option2(options, "manifest");
 }
 function slug(value) {
   const normalized = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
@@ -15314,7 +15407,7 @@ async function git3(cwd, args) {
 async function loadCliEnvironment(root) {
   let contents;
   try {
-    contents = await readFile8(path5.join(root, ".sandblocks", "config.env"), "utf8");
+    contents = await readFile8(path6.join(root, ".sandblocks", "config.env"), "utf8");
   } catch {
     return;
   }
@@ -15338,7 +15431,7 @@ if (import.meta.main) {
 }
 export {
   run2 as run,
-  parse
+  parse2 as parse
 };
 
-//# debugId=64EF599DFAEB049264756E2164756E21
+//# debugId=EB337A76C8A48F0564756E2164756E21