@sandblocks/cli 0.5.0-b.0 → 0.5.0-b.2

package/dist/cli.js

@@ -11735,7 +11735,7 @@ var init_src = __esm(() => {
 init_src();
 import { randomUUID as randomUUID4 } from "crypto";
 import { lstat, readFile as readFile8, stat as stat3, writeFile as writeFile5 } from "fs/promises";
-import path5 from "path";
+import path6 from "path";
 
 // src/hooks.ts
 import { chmod, copyFile, mkdir, readFile as readFile3, rm, writeFile } from "fs/promises";
@@ -11877,11 +11877,125 @@ async function text(file) {
   }
 }
 
+// src/runtime.ts
+import { spawn } from "child_process";
+import { access, chmod as chmod2, mkdir as mkdir2, readdir, rm as rm2 } from "fs/promises";
+import path4 from "path";
+import { pathToFileURL } from "url";
+var RUNTIME_PATTERN = /^[a-z][a-z0-9-]{0,62}$/;
+var NODE_ENV_RUNTIME = {
+  production: "prod",
+  development: "dev",
+  test: "local"
+};
+async function runRuntimeCommand(args) {
+  const [action, ...rest] = args;
+  if (action !== "prepare")
+    throw new Error("runtime action must be prepare");
+  const options = parse(rest);
+  const root = path4.resolve(options.positionals[0] ?? process.cwd());
+  const runtime = normalizedRuntime(option(options, "runtime") ?? process.env.SANDBLOCKS_RUNTIME ?? "development" ?? "development");
+  const targetRoot = contained(root, option(options, "target") ?? ".locker", "runtime target");
+  const runtimeRoot = path4.join(targetRoot, runtime);
+  const config = contained(root, option(options, "config") ?? "config/dotlocker.config.ts", "Dotlocker config");
+  const dotlocker = path4.resolve(root, option(options, "dotlocker") ?? path4.join("node_modules", ".bin", "dotlocker"));
+  if (!await exists2(config))
+    throw new Error(`Dotlocker config does not exist: ${config}`);
+  if (!await exists2(dotlocker)) {
+    throw new Error("Dotlocker is not installed; add @dotlocker/dotlocker to the workspace");
+  }
+  await rm2(targetRoot, { recursive: true, force: true });
+  await mkdir2(runtimeRoot, { recursive: true, mode: 493 });
+  await run(dotlocker, ["pull", "--config", config, "--runtime", runtime, "--out", runtimeRoot], root);
+  const envFile = path4.join(runtimeRoot, ".env");
+  if (!await exists2(envFile)) {
+    throw new Error(`Dotlocker did not materialize ${path4.relative(root, envFile)}`);
+  }
+  await normalizePermissions(targetRoot);
+  console.log(`runtime   ${runtime}
+environment ${path4.relative(root, envFile)}`);
+}
+function run(executable, args, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(executable, args, { cwd, env: process.env, stdio: "inherit" });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (code === 0)
+        resolve();
+      else
+        reject(new Error(`Dotlocker pull failed (${signal ? `signal ${signal}` : `exit ${code ?? "unknown"}`})`));
+    });
+  });
+}
+async function exists2(file) {
+  try {
+    await access(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function normalizedRuntime(value) {
+  const runtime = NODE_ENV_RUNTIME[value.trim()] ?? value.trim();
+  if (!RUNTIME_PATTERN.test(runtime))
+    throw new Error(`invalid runtime '${value}'`);
+  return runtime;
+}
+function contained(root, value, label) {
+  const resolved = path4.resolve(root, value);
+  const relative = path4.relative(root, resolved);
+  if (!relative || !relative.startsWith("..") && !path4.isAbsolute(relative))
+    return resolved;
+  throw new Error(`${label} must remain within the repository`);
+}
+async function normalizePermissions(directory) {
+  await chmod2(directory, 493);
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const child = path4.join(directory, entry.name);
+    if (entry.isSymbolicLink())
+      throw new Error("Dotlocker output must not contain symbolic links");
+    if (entry.isDirectory())
+      await normalizePermissions(child);
+    else if (entry.isFile())
+      await chmod2(child, 420);
+    else
+      throw new Error("Dotlocker output contains an unsupported file type");
+  }
+}
+function parse(args) {
+  const options = { positionals: [] };
+  for (let index = 0;index < args.length; index += 1) {
+    const value = args[index] ?? "";
+    if (!value.startsWith("--")) {
+      options.positionals.push(value);
+      continue;
+    }
+    const key = value.slice(2);
+    const next = args[index + 1];
+    if (next && !next.startsWith("--")) {
+      options[key] = next;
+      index += 1;
+    } else
+      options[key] = true;
+  }
+  return options;
+}
+function option(options, key) {
+  const value = options[key];
+  return typeof value === "string" ? value : undefined;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(path4.resolve(process.argv[1])).href) {
+  runRuntimeCommand(process.argv.slice(2)).catch((error) => {
+    console.error(`sandblocks-runtime: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+  });
+}
+
 // src/sandbox.ts
 init_src();
 import { createHash as createHash2, randomUUID } from "crypto";
-import { chmod as chmod2, mkdir as mkdir2, readFile as readFile4, rename, rm as rm2 } from "fs/promises";
-import path4 from "path";
+import { chmod as chmod3, mkdir as mkdir3, readFile as readFile4, rename, rm as rm3 } from "fs/promises";
+import path5 from "path";
 var COMMANDS = new Set([
   "up",
   "create",
@@ -11933,7 +12047,7 @@ async function up(args, dependencies) {
 }
 async function create(args, dependencies) {
   const options = dependencies.parse(args);
-  const root = path4.resolve(options.positionals[0] ?? process.cwd());
+  const root = path5.resolve(options.positionals[0] ?? process.cwd());
   await loadLocalEnvironment(root);
   const environment = dependencies.option(options, "environment") ?? "preview";
   const file = statePath(root, environment);
@@ -11942,7 +12056,7 @@ async function create(args, dependencies) {
   const loaded = await dependencies.load(root, dependencies.option(options, "config") ?? dependencies.option(options, "manifest"));
   const preview = selectPreview(loaded, environment);
   const projectId = dependencies.option(options, "project") ?? process.env.SANDBLOCKS_PROJECT_ID ?? "default";
-  const repository = loaded.manifest.name ?? path4.basename(root).toLowerCase();
+  const repository = loaded.manifest.name ?? path5.basename(root).toLowerCase();
   const sandboxId = randomUUID();
   const workspaceId = `${sandboxId.replaceAll("-", "").slice(0, 8)}-${repository}`.slice(0, 63);
   const { apiUrl, apiKey } = client(options, dependencies.option, projectId);
@@ -12010,7 +12124,7 @@ async function status2(args, dependencies) {
     console.log(JSON.stringify({ state: redactedState(context.state), sandbox: sandbox.sandbox, session: session.session }, null, 2));
     return;
   }
-  console.log(`state     ${path4.relative(context.root, context.file)}`);
+  console.log(`state     ${path5.relative(context.root, context.file)}`);
   console.log(`sandbox   ${context.state.sandboxId} (${sandbox.sandbox.status})`);
   console.log(`workspace ${context.state.workspaceId}`);
   console.log(`host      ${context.state.hostId}`);
@@ -12023,12 +12137,12 @@ async function deploy(args, dependencies) {
 }
 async function withDeploymentLock(args, dependencies, action) {
   const options = dependencies.parse(args);
-  const root = path4.resolve(options.positionals[0] ?? process.cwd());
+  const root = path5.resolve(options.positionals[0] ?? process.cwd());
   const environment = dependencies.option(options, "environment") ?? "preview";
   const lock = `${statePath(root, environment)}.deploy.lock`;
-  await mkdir2(path4.dirname(lock), { recursive: true, mode: 448 });
+  await mkdir3(path5.dirname(lock), { recursive: true, mode: 448 });
   try {
-    await mkdir2(lock);
+    await mkdir3(lock);
   } catch (error) {
     if (error.code === "EEXIST") {
       throw new Error(`sandbox '${environment}' deployment is already running`);
@@ -12038,7 +12152,7 @@ async function withDeploymentLock(args, dependencies, action) {
   try {
     await action();
   } finally {
-    await rm2(lock, { recursive: true, force: true });
+    await rm3(lock, { recursive: true, force: true });
   }
 }
 async function deployUnlocked(args, dependencies) {
@@ -12271,7 +12385,7 @@ async function down(args, dependencies) {
   await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/sandboxes/${context.state.sandboxId}`, { method: "DELETE" }).catch(() => {
     return;
   });
-  await rm2(context.file, { force: true });
+  await rm3(context.file, { force: true });
   console.log(`sandbox ${context.state.sandboxId} destroyed`);
 }
 async function resolveAssignedTargetHost(context, fallback) {
@@ -12406,7 +12520,7 @@ async function dataOperation(context, action, body) {
 }
 async function getContext(args, dependencies) {
   const options = dependencies.parse(args);
-  const root = path4.resolve(options.positionals[0] ?? process.cwd());
+  const root = path5.resolve(options.positionals[0] ?? process.cwd());
   await loadLocalEnvironment(root);
   const environment = dependencies.option(options, "environment") ?? "preview";
   const file = statePath(root, environment);
@@ -12422,9 +12536,9 @@ async function getContext(args, dependencies) {
 function selectPreview(loaded, id2) {
   return resolveEnvironment(loaded.manifest, id2);
 }
-function client(options, option, projectId) {
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY ?? "";
+function client(options, option2, projectId) {
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY ?? "";
   if (!apiUrl || !apiKey)
     throw new Error("SANDBLOCKS_API_URL and SANDBLOCKS_API_KEY are required");
   return { apiUrl, apiKey, projectId };
@@ -12525,7 +12639,7 @@ async function waitLease(context, operationId) {
   throw new Error(`sandbox operation ${operationId} timed out`);
 }
 async function loadLocalEnvironment(root) {
-  const file = path4.join(root, ".sandblocks", "config.env");
+  const file = path5.join(root, ".sandblocks", "config.env");
   let contents;
   try {
     contents = await readFile4(file, "utf8");
@@ -12589,15 +12703,15 @@ function resolvedServiceDomain(sandboxId, deploymentId, service, preview) {
 function statePath(root, environment) {
   if (!/^[a-z][a-z0-9-]{0,62}$/.test(environment))
     throw new Error("sandbox environment is invalid");
-  return path4.join(root, ".sandblocks", `sandbox-${environment}.json`);
+  return path5.join(root, ".sandblocks", `sandbox-${environment}.json`);
 }
 async function writeState(file, state) {
-  await mkdir2(path4.dirname(file), { recursive: true, mode: 448 });
-  await chmod2(path4.dirname(file), 448);
+  await mkdir3(path5.dirname(file), { recursive: true, mode: 448 });
+  await chmod3(path5.dirname(file), 448);
   const temporary = `${file}.${process.pid}.tmp`;
   await Bun.write(temporary, `${JSON.stringify(state, null, 2)}
 `, { mode: 384 });
-  await chmod2(temporary, 384);
+  await chmod3(temporary, 384);
   await rename(temporary, file);
 }
 function redactedState(state) {
@@ -12613,15 +12727,15 @@ function printOutput(operation) {
 }
 
 // src/sdk.ts
-import { mkdir as mkdir4, readFile as readFile7, rm as rm5, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile7, rm as rm6, writeFile as writeFile4 } from "fs/promises";
 import { dirname as dirname2, resolve as resolve7 } from "path";
 
 // ../sdk/dist/index.js
 import { randomUUID as randomUUID2 } from "crypto";
-import { appendFile, cp, mkdir as mkdir3, readFile as readFile5, rm as rm3 } from "fs/promises";
+import { appendFile, cp, mkdir as mkdir4, readFile as readFile5, rm as rm4 } from "fs/promises";
 import { dirname, resolve } from "path";
-import { spawn } from "child_process";
-import { access, mkdir as mkdir22, writeFile as writeFile2 } from "fs/promises";
+import { spawn as spawn2 } from "child_process";
+import { access as access2, mkdir as mkdir22, writeFile as writeFile2 } from "fs/promises";
 import { resolve as resolve2 } from "path";
 
 class CommandAgent {
@@ -12877,7 +12991,7 @@ async function executeProcess(command, options = {}) {
   const [executable, ...args] = command;
   if (!executable)
     throw new Error("command executable is required");
-  const child = spawn(executable, args, {
+  const child = spawn2(executable, args, {
     cwd: options.cwd ?? options.hostCwd,
     env: options.env ? { ...process.env, ...options.env } : process.env,
     stdio: [options.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"]
@@ -13062,7 +13176,7 @@ class SandblocksSandbox {
         "--force",
         this.git.worktree
       ]);
-      await rm3(this.git.worktree, { recursive: true, force: true });
+      await rm4(this.git.worktree, { recursive: true, force: true });
     }
   }
   async[Symbol.asyncDispose]() {
@@ -13092,7 +13206,7 @@ async function createSandbox(options) {
   for (const file of options.copyToWorktree ?? []) {
     const source = resolve(hostCwd, file);
     const destination = resolve(git3.runtimeCwd, file);
-    await mkdir3(dirname(destination), { recursive: true });
+    await mkdir4(dirname(destination), { recursive: true });
     await withTimeout(cp(source, destination, { recursive: true }), options.timeouts?.copyToWorktreeMs ?? 60000, `copying '${file}'`);
   }
   const id2 = options.id ?? randomUUID2();
@@ -13134,7 +13248,7 @@ async function connectSandbox(options) {
   const runtime = await options.provider.reconnect({ id: options.id, cwd });
   return new SandblocksSandbox(runtime, { provider: options.provider, cwd, retention: options.retention ?? "always" }, { hostCwd: cwd, runtimeCwd: cwd });
 }
-async function run(options) {
+async function run2(options) {
   const sandbox = await createSandbox(options);
   try {
     return await sandbox.run(options);
@@ -13161,7 +13275,7 @@ async function prepareGit(hostCwd, strategy, timeoutMs = 30000) {
   }
   const branch = strategy.name ?? `sandblocks/${randomUUID2().slice(0, 8)}`;
   const worktree = resolve(hostCwd, ".sandblocks", "worktrees", branch.replace(/[^A-Za-z0-9_.-]/g, "-"));
-  await mkdir3(dirname(worktree), { recursive: true });
+  await mkdir4(dirname(worktree), { recursive: true });
   await checked(["git", "-C", hostCwd, "worktree", "add", "-B", branch, worktree, "HEAD"], timeoutMs);
   return {
     hostCwd,
@@ -13244,7 +13358,7 @@ function createLogger(options, cwd) {
       process.stdout.write(event.type === "text" ? event.text : event.type === "raw" ? `${event.line}
 ` : line);
     if (config.type !== "stdout" && config.type !== "silent") {
-      await mkdir3(dirname(file), { recursive: true });
+      await mkdir4(dirname(file), { recursive: true });
       await appendFile(file, line);
     }
     try {
@@ -13315,12 +13429,12 @@ SANDBLOCKS_API_KEY=
   };
   const written = [];
   for (const [relative, content] of Object.entries(files)) {
-    const path5 = resolve2(root, relative);
-    await mkdir22(resolve2(path5, ".."), { recursive: true });
-    if (!options.force && await access(path5).then(() => true).catch(() => false))
+    const path6 = resolve2(root, relative);
+    await mkdir22(resolve2(path6, ".."), { recursive: true });
+    if (!options.force && await access2(path6).then(() => true).catch(() => false))
       continue;
-    await writeFile2(path5, content, { mode: relative.includes(".env") ? 384 : 420 });
-    written.push(path5);
+    await writeFile2(path6, content, { mode: relative.includes(".env") ? 384 : 420 });
+    written.push(path6);
   }
   return written;
 }
@@ -13328,7 +13442,7 @@ SANDBLOCKS_API_KEY=
 // ../sdk/dist/providers/docker.js
 import { realpath as realpath3 } from "fs/promises";
 import { resolve as resolve3 } from "path";
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 async function executeProcess2(command, options = {}) {
   if (!command.length || command.some((part) => !part || part.includes("\x00"))) {
     throw new Error("command must contain safe non-empty arguments");
@@ -13337,7 +13451,7 @@ async function executeProcess2(command, options = {}) {
   const [executable, ...args] = command;
   if (!executable)
     throw new Error("command executable is required");
-  const child = spawn2(executable, args, {
+  const child = spawn3(executable, args, {
     cwd: options.cwd ?? options.hostCwd,
     env: options.env ? { ...process.env, ...options.env } : process.env,
     stdio: [options.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"]
@@ -13390,12 +13504,12 @@ async function executeProcess2(command, options = {}) {
     options.signal?.removeEventListener("abort", stop);
   }
 }
-function expandHome(path5) {
-  if (path5 === "~")
-    return process.env.HOME ?? path5;
-  if (path5.startsWith("~/"))
-    return `${process.env.HOME ?? "~"}/${path5.slice(2)}`;
-  return path5;
+function expandHome(path6) {
+  if (path6 === "~")
+    return process.env.HOME ?? path6;
+  if (path6.startsWith("~/"))
+    return `${process.env.HOME ?? "~"}/${path6.slice(2)}`;
+  return path6;
 }
 var capabilities = {
   bindMounts: true,
@@ -13574,7 +13688,7 @@ class DockerProvider extends OciProvider {
 // ../sdk/dist/providers/podman.js
 import { realpath as realpath4 } from "fs/promises";
 import { resolve as resolve5 } from "path";
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 async function executeProcess3(command, options = {}) {
   if (!command.length || command.some((part) => !part || part.includes("\x00"))) {
     throw new Error("command must contain safe non-empty arguments");
@@ -13583,7 +13697,7 @@ async function executeProcess3(command, options = {}) {
   const [executable, ...args] = command;
   if (!executable)
     throw new Error("command executable is required");
-  const child = spawn3(executable, args, {
+  const child = spawn4(executable, args, {
     cwd: options.cwd ?? options.hostCwd,
     env: options.env ? { ...process.env, ...options.env } : process.env,
     stdio: [options.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"]
@@ -13636,12 +13750,12 @@ async function executeProcess3(command, options = {}) {
     options.signal?.removeEventListener("abort", stop);
   }
 }
-function expandHome2(path5) {
-  if (path5 === "~")
-    return process.env.HOME ?? path5;
-  if (path5.startsWith("~/"))
-    return `${process.env.HOME ?? "~"}/${path5.slice(2)}`;
-  return path5;
+function expandHome2(path6) {
+  if (path6 === "~")
+    return process.env.HOME ?? path6;
+  if (path6.startsWith("~/"))
+    return `${process.env.HOME ?? "~"}/${path6.slice(2)}`;
+  return path6;
 }
 var capabilities2 = {
   bindMounts: true,
@@ -13819,10 +13933,10 @@ class PodmanProvider extends OciProvider2 {
 
 // ../sdk/dist/providers/remote.js
 import { randomUUID as randomUUID3 } from "crypto";
-import { mkdtemp, readFile as readFile6, rm as rm4, stat as stat2, writeFile as writeFile3 } from "fs/promises";
+import { mkdtemp, readFile as readFile6, rm as rm5, stat as stat2, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir } from "os";
 import { join } from "path";
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 async function executeProcess4(command, options = {}) {
   if (!command.length || command.some((part) => !part || part.includes("\x00"))) {
     throw new Error("command must contain safe non-empty arguments");
@@ -13831,7 +13945,7 @@ async function executeProcess4(command, options = {}) {
   const [executable, ...args] = command;
   if (!executable)
     throw new Error("command executable is required");
-  const child = spawn4(executable, args, {
+  const child = spawn5(executable, args, {
     cwd: options.cwd ?? options.hostCwd,
     env: options.env ? { ...process.env, ...options.env } : process.env,
     stdio: [options.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"]
@@ -14097,12 +14211,12 @@ class RemoteSandblocksProvider {
     if (result.exitCode !== 0)
       throw new Error(result.stderr || "remote operation failed");
   }
-  async request(path5, init = {}) {
+  async request(path6, init = {}) {
     const headers = new Headers(init.headers);
     headers.set("x-sandblocks-api-key", this.options.apiKey);
     if (init.body)
       headers.set("content-type", "application/json");
-    const response = await this.fetchImpl(`${this.baseUrl}${path5}`, { ...init, headers });
+    const response = await this.fetchImpl(`${this.baseUrl}${path6}`, { ...init, headers });
     const body = await response.json().catch(() => ({}));
     if (!response.ok)
       throw new Error(body.error ?? `Sandblocks request failed (${response.status})`);
@@ -14126,7 +14240,7 @@ async function sourceBundle(cwd) {
     ]);
     if (listed.exitCode !== 0)
       throw new Error("remote source directory must be a Git worktree");
-    const files = listed.stdout.split("\x00").filter((path5) => path5 && path5 !== ".sandblocks" && !path5.startsWith(".sandblocks/") && path5 !== ".git");
+    const files = listed.stdout.split("\x00").filter((path6) => path6 && path6 !== ".sandblocks" && !path6.startsWith(".sandblocks/") && path6 !== ".git");
     if (!files.length || files.length > 50000)
       throw new Error("remote source bundle file count is invalid");
     await writeFile3(list, `${files.join("\x00")}\x00`);
@@ -14137,14 +14251,14 @@ async function sourceBundle(cwd) {
       throw new Error("remote source bundle exceeds 512 MiB");
     return new Uint8Array(await readFile6(file));
   } finally {
-    await rm4(temporary, { recursive: true, force: true });
+    await rm5(temporary, { recursive: true, force: true });
   }
 }
 
 // ../sdk/dist/providers/unsafe-host.js
 import { cp as cp2, realpath as realpath5 } from "fs/promises";
 import { resolve as resolve6 } from "path";
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn6 } from "child_process";
 async function executeProcess5(command, options = {}) {
   if (!command.length || command.some((part) => !part || part.includes("\x00"))) {
     throw new Error("command must contain safe non-empty arguments");
@@ -14153,7 +14267,7 @@ async function executeProcess5(command, options = {}) {
   const [executable, ...args] = command;
   if (!executable)
     throw new Error("command executable is required");
-  const child = spawn5(executable, args, {
+  const child = spawn6(executable, args, {
     cwd: options.cwd ?? options.hostCwd,
     env: options.env ? { ...process.env, ...options.env } : process.env,
     stdio: [options.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"]
@@ -14266,7 +14380,7 @@ async function runSdkCommand(args, helpers) {
     const provider = providerFrom(options, helpers, cwd);
     const agent = agentFrom(options, helpers);
     const outputTag = helpers.option(options, "output-tag");
-    const result = await run({
+    const result = await run2({
       provider,
       cwd,
       image: helpers.option(options, "image"),
@@ -14317,7 +14431,7 @@ async function sdkSandbox(args, helpers, defaultCwd) {
       hooks: hooksFrom(options),
       copyToWorktree: multi(options["copy-to-worktree"])
     });
-    await mkdir4(dirname2(stateFile), { recursive: true });
+    await mkdir5(dirname2(stateFile), { recursive: true });
     const strategy = branchFrom(options, helpers);
     const worktree = strategy.type === "worktree" || strategy.type === "merge-to-head" ? sandbox2.cwd : undefined;
     await writeFile4(stateFile, JSON.stringify({
@@ -14392,7 +14506,7 @@ async function sdkSandbox(args, helpers, defaultCwd) {
       const child = Bun.spawn(["git", "-C", state.cwd, "worktree", "remove", "--force", state.worktree]);
       await child.exited;
     }
-    await rm5(stateFile, { force: true });
+    await rm6(stateFile, { force: true });
     console.log(`sandbox ${state.id} destroyed`);
   } else
     throw new Error("unsupported sdk sandbox command");
@@ -14504,10 +14618,10 @@ function hooksFrom(options) {
   };
 }
 async function withSdkConfig(options, cwd, file) {
-  const path5 = resolve7(cwd, file ?? ".sandblocks/config.json");
-  if (!await Bun.file(path5).exists())
+  const path6 = resolve7(cwd, file ?? ".sandblocks/config.json");
+  if (!await Bun.file(path6).exists())
     return options;
-  const config = JSON.parse(await readFile7(path5, "utf8"));
+  const config = JSON.parse(await readFile7(path6, "utf8"));
   const mapped = {};
   if (typeof config.provider === "string")
     mapped.provider = config.provider;
@@ -14575,6 +14689,8 @@ var HELP = `Sandblocks CLI
   sandblocks whoami [directory] [--api-url <url>] [--api-key <key>] [--json]
   sandblocks hooks <install|status|uninstall> [directory]
   sandblocks hooks run post-commit [directory]
+  sandblocks runtime prepare [directory] [--runtime <id>]
+                  [--config <path>] [--target <path>]
   sandblocks stack <list|get|settings|settings-set> --project <id> [--stack <id>] [--file <json>] [--json]
   sandblocks app <list|get|settings|settings-set> --project <id> [--stack <id>] [--app <id>] [--file <json>] [--json]
   sandblocks secret <list|set|delete> --project <id> --stack <id> --app <id>
@@ -14617,7 +14733,7 @@ Low-level deploy remains available with --workspace, --sandbox, --host,
 Authentication: --api-key or SANDBLOCKS_API_KEY
 API endpoint:   --api-url or SANDBLOCKS_API_URL
 `;
-async function run2(argv = process.argv.slice(2)) {
+async function run3(argv = process.argv.slice(2)) {
   await loadCliEnvironment(process.cwd());
   const [command = "help", ...args] = argv;
   if (command === "configure" || command === "init")
@@ -14634,8 +14750,8 @@ async function run2(argv = process.argv.slice(2)) {
     await runHooksCommand(args, {
       load,
       runSandbox: (hookCommand2, hookArgs) => runStatefulSandboxCommand(hookCommand2, hookArgs, {
-        parse,
-        option,
+        parse: parse2,
+        option: option2,
         load,
         source: async (root) => {
           const bundle = await createSourceTar(root);
@@ -14643,6 +14759,8 @@ async function run2(argv = process.argv.slice(2)) {
         }
       })
     });
+  else if (command === "runtime")
+    await runRuntimeCommand(args);
   else if (command === "stack" || command === "app")
     await resource(command, args);
   else if (command === "secret")
@@ -14650,7 +14768,7 @@ async function run2(argv = process.argv.slice(2)) {
   else if (command === "sandbox")
     await sandbox(args);
   else if (command === "sdk")
-    await runSdkCommand(args, { parse, option });
+    await runSdkCommand(args, { parse: parse2, option: option2 });
   else {
     console.log(HELP);
     if (!["help", "--help", "-h"].includes(command))
@@ -14658,9 +14776,9 @@ async function run2(argv = process.argv.slice(2)) {
   }
 }
 async function configure(args) {
-  const options = parse(args);
-  const root = path5.resolve(options.positionals[0] ?? process.cwd());
-  const manifestPath = path5.join(root, "sandblocks.yml");
+  const options = parse2(args);
+  const root = path6.resolve(options.positionals[0] ?? process.cwd());
+  const manifestPath = path6.join(root, "sandblocks.yml");
   if (await Bun.file(manifestPath).exists() && !options.force) {
     const loaded2 = await load(root, manifestPathOption(options));
     console.log(`Sandblocks already configured
@@ -14668,8 +14786,8 @@ async function configure(args) {
   digest:   ${loaded2.digest}`);
     return;
   }
-  const packageJson = await json(path5.join(root, "package.json"));
-  const name = slug(option(options, "name") ?? path5.basename(root));
+  const packageJson = await json(path6.join(root, "package.json"));
+  const name = slug(option2(options, "name") ?? path6.basename(root));
   const checks = ["build", "typecheck", "test"].filter((script) => packageJson?.scripts?.[script]);
   const manager = packageJson?.packageManager?.split("@")[0] ?? "npm";
   const command = (script) => `[${manager}, ${manager === "npm" ? "run, " : ""}${script}]`;
@@ -14690,8 +14808,8 @@ async function configure(args) {
   digest:   ${loaded.digest}`);
 }
 async function validate(args) {
-  const options = parse(args);
-  const root = path5.resolve(options.positionals[0] ?? process.cwd());
+  const options = parse2(args);
+  const root = path6.resolve(options.positionals[0] ?? process.cwd());
   const loaded = await load(root, manifestPathOption(options));
   if (options.json) {
     console.log(JSON.stringify({ manifest: loaded.entrypoint, digest: loaded.digest, sources: loaded.sources }, null, 2));
@@ -14701,11 +14819,11 @@ async function validate(args) {
 digest    ${loaded.digest}`);
 }
 async function register(args) {
-  const options = parse(args);
-  const root = path5.resolve(options.positionals[0] ?? process.cwd());
-  const projectId = option(options, "project");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(args);
+  const root = path6.resolve(options.positionals[0] ?? process.cwd());
+  const projectId = option2(options, "project");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId)
     throw new Error("register requires --project");
   if (!apiUrl)
@@ -14713,7 +14831,7 @@ async function register(args) {
   if (!apiKey)
     throw new Error("register requires --api-key or SANDBLOCKS_API_KEY");
   const loaded = await load(root, manifestPathOption(options));
-  const repositoryUrl = option(options, "repository-url") ?? await git3(root, ["config", "--get", "remote.origin.url"]);
+  const repositoryUrl = option2(options, "repository-url") ?? await git3(root, ["config", "--get", "remote.origin.url"]);
   if (!repositoryUrl)
     throw new Error("register requires --repository-url or git remote.origin.url");
   const branch = await git3(root, ["branch", "--show-current"]) || "main";
@@ -14721,7 +14839,7 @@ async function register(args) {
     method: "POST",
     headers: { "content-type": "application/json", "x-sandblocks-api-key": apiKey },
     body: JSON.stringify({
-      slug: loaded.manifest.name ?? slug(path5.basename(root)),
+      slug: loaded.manifest.name ?? slug(path6.basename(root)),
       name: loaded.manifest.name,
       url: repositoryUrl,
       defaultBranch: branch,
@@ -14737,24 +14855,24 @@ async function register(args) {
     console.log(response.status === 409 ? "repository already registered" : "repository registered");
 }
 async function doctor(args) {
-  const options = parse(args);
-  const root = path5.resolve(options.positionals[0] ?? process.cwd());
+  const options = parse2(args);
+  const root = path6.resolve(options.positionals[0] ?? process.cwd());
   const loaded = await load(root, manifestPathOption(options));
   console.log(`manifest  ok (${loaded.entrypoint})`);
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
   if (apiUrl) {
     const response = await fetch(`${apiUrl}/v1/health`);
     if (!response.ok)
       throw new Error(`API health failed (${response.status})`);
     console.log(`api       ok (${apiUrl})`);
   }
-  const gitDetected = await stat3(path5.join(root, ".git")).then(() => true).catch(() => false);
+  const gitDetected = await stat3(path6.join(root, ".git")).then(() => true).catch(() => false);
   console.log(`git       ${gitDetected ? "ok" : "not detected"}`);
 }
 async function whoami(args) {
-  const options = parse(args);
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(args);
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!apiUrl)
     throw new Error("whoami requires --api-url or SANDBLOCKS_API_URL");
   if (!apiKey)
@@ -14777,12 +14895,12 @@ async function whoami(args) {
 }
 async function resource(kind, args) {
   const [action = "list", ...rest] = args;
-  const options = parse(rest);
-  const projectId = option(options, "project");
-  const stack = option(options, "stack");
-  const app = option(options, "app");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(rest);
+  const projectId = option2(options, "project");
+  const stack = option2(options, "stack");
+  const app = option2(options, "app");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId)
     throw new Error(`${kind} ${action} requires --project`);
   if (!apiUrl)
@@ -14802,10 +14920,10 @@ async function resource(kind, args) {
     throw new Error(`unsupported ${kind} command`);
   let body;
   if (action === "settings-set") {
-    const file = option(options, "file");
+    const file = option2(options, "file");
     if (!file)
       throw new Error(`${kind} settings-set requires --file <json>`);
-    const values = JSON.parse(await readFile8(path5.resolve(file), "utf8"));
+    const values = JSON.parse(await readFile8(path6.resolve(file), "utf8"));
     const current = await sandblocksRequest(apiUrl, apiKey, requestPath);
     body = await sandblocksRequest(apiUrl, apiKey, requestPath, {
       method: "PUT",
@@ -14820,12 +14938,12 @@ async function resource(kind, args) {
 }
 async function secret(args) {
   const [action = "list", ...rest] = args;
-  const options = parse(rest);
-  const projectId = option(options, "project");
-  const stack = option(options, "stack");
-  const app = option(options, "app");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(rest);
+  const projectId = option2(options, "project");
+  const stack = option2(options, "stack");
+  const app = option2(options, "app");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId || !stack || !app)
     throw new Error("secret commands require --project, --stack, and --app");
   if (!apiUrl || !apiKey)
@@ -14835,9 +14953,9 @@ async function secret(args) {
   if (action === "list")
     body = await sandblocksRequest(apiUrl, apiKey, root);
   else if (action === "set") {
-    const environment = option(options, "environment");
-    const name = option(options, "name");
-    const value = option(options, "value");
+    const environment = option2(options, "environment");
+    const name = option2(options, "name");
+    const value = option2(options, "value");
     if (!environment || !name || value === undefined)
       throw new Error("secret set requires --environment, --name, and --value");
     body = await sandblocksRequest(apiUrl, apiKey, root, {
@@ -14845,7 +14963,7 @@ async function secret(args) {
       body: JSON.stringify({ environment, name, value })
     });
   } else if (action === "delete") {
-    const id2 = option(options, "id");
+    const id2 = option2(options, "id");
     if (!id2)
       throw new Error("secret delete requires --id");
     await sandblocksRequest(apiUrl, apiKey, `${root}/${encodeURIComponent(id2)}`, { method: "DELETE" });
@@ -14885,8 +15003,8 @@ async function sandbox(args) {
   const [subcommand, ...rest] = args;
   if (isStatefulSandboxCommand(subcommand) && !(subcommand === "deploy" && rest.includes("--workspace"))) {
     return runStatefulSandboxCommand(subcommand, rest, {
-      parse,
-      option,
+      parse: parse2,
+      option: option2,
       load,
       source: async (root2) => {
         const bundle2 = await createSourceTar(root2);
@@ -14902,12 +15020,12 @@ async function sandbox(args) {
     return sandboxAgent(rest);
   if (subcommand !== "import")
     throw new Error("unsupported sandbox command");
-  const options = parse(rest);
-  const root = path5.resolve(options.positionals[0] ?? process.cwd());
-  const projectId = option(options, "project");
-  const workspaceId = option(options, "workspace");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(rest);
+  const root = path6.resolve(options.positionals[0] ?? process.cwd());
+  const projectId = option2(options, "project");
+  const workspaceId = option2(options, "workspace");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId)
     throw new Error("sandbox import requires --project");
   if (!workspaceId)
@@ -14924,8 +15042,8 @@ async function sandbox(args) {
       "content-length": String(bundle.byteLength),
       "x-sandblocks-api-key": apiKey,
       "x-sandblocks-workspace-id": workspaceId,
-      "x-sandblocks-worker-pool": option(options, "pool") ?? "sandbox-development",
-      "idempotency-key": option(options, "idempotency-key") ?? `local-import:${workspaceId}`
+      "x-sandblocks-worker-pool": option2(options, "pool") ?? "sandbox-development",
+      "idempotency-key": option2(options, "idempotency-key") ?? `local-import:${workspaceId}`
     },
     body: new Blob([Uint8Array.from(bundle)])
   });
@@ -14945,12 +15063,12 @@ async function sandbox(args) {
   }
 }
 async function sandboxAgent(args) {
-  const options = parse(args);
+  const options = parse2(args);
   const action = options.positionals[0] ?? "list";
-  const projectId = option(options, "project");
-  const sandboxId = option(options, "sandbox");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const projectId = option2(options, "project");
+  const sandboxId = option2(options, "sandbox");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId || !sandboxId)
     throw new Error("sandbox agent requires --project and --sandbox");
   if (!apiUrl || !apiKey)
@@ -14958,25 +15076,25 @@ async function sandboxAgent(args) {
   const collection = `/v1/projects/${encodeURIComponent(projectId)}/sandboxes/${encodeURIComponent(sandboxId)}/agent-sessions`;
   let result;
   if (action === "run") {
-    const promptFile = option(options, "prompt-file");
-    const prompt = option(options, "prompt") ?? (promptFile ? await readFile8(path5.resolve(promptFile), "utf8") : undefined);
+    const promptFile = option2(options, "prompt-file");
+    const prompt = option2(options, "prompt") ?? (promptFile ? await readFile8(path6.resolve(promptFile), "utf8") : undefined);
     if (!prompt)
       throw new Error("sandbox agent run requires --prompt or --prompt-file");
-    const repository = option(options, "repository");
-    const provider = option(options, "provider") ?? "codex";
-    const model = option(options, "model");
+    const repository = option2(options, "repository");
+    const provider = option2(options, "provider") ?? "codex";
+    const model = option2(options, "model");
     if (!repository || !model)
       throw new Error("sandbox agent run requires --repository and --model");
     result = await sandblocksRequest(apiUrl, apiKey, collection, {
       method: "POST",
-      headers: { "idempotency-key": option(options, "idempotency-key") ?? randomUUID4() },
+      headers: { "idempotency-key": option2(options, "idempotency-key") ?? randomUUID4() },
       body: JSON.stringify({
         repository,
         provider,
         model,
         prompt,
-        credentialEnvironment: option(options, "credential-env"),
-        timeoutSeconds: option(options, "timeout-seconds") ? Number(option(options, "timeout-seconds")) : undefined
+        credentialEnvironment: option2(options, "credential-env"),
+        timeoutSeconds: option2(options, "timeout-seconds") ? Number(option2(options, "timeout-seconds")) : undefined
       })
     });
     if (options.wait)
@@ -14984,12 +15102,12 @@ async function sandboxAgent(args) {
   } else if (action === "list") {
     result = await sandblocksRequest(apiUrl, apiKey, collection);
   } else if (action === "get" || action === "cancel" || action === "redeploy") {
-    const sessionId = option(options, "session");
+    const sessionId = option2(options, "session");
     if (!sessionId)
       throw new Error(`sandbox agent ${action} requires --session`);
     result = await sandblocksRequest(apiUrl, apiKey, `${collection}/${encodeURIComponent(sessionId)}${action === "cancel" ? "/cancel" : action === "redeploy" ? "/redeploy" : ""}`, action === "cancel" || action === "redeploy" ? {
       method: "POST",
-      headers: action === "redeploy" ? { "idempotency-key": option(options, "idempotency-key") ?? randomUUID4() } : undefined
+      headers: action === "redeploy" ? { "idempotency-key": option2(options, "idempotency-key") ?? randomUUID4() } : undefined
     } : undefined);
   } else
     throw new Error("sandbox agent action must be run, list, get, cancel, or redeploy");
@@ -15002,20 +15120,20 @@ async function sandboxAgent(args) {
   }
 }
 async function waitForAgentSession(apiUrl, apiKey, projectId, sandboxId, sessionId) {
-  const path6 = `/v1/projects/${encodeURIComponent(projectId)}/sandboxes/${encodeURIComponent(sandboxId)}/agent-sessions/${encodeURIComponent(sessionId)}`;
+  const path7 = `/v1/projects/${encodeURIComponent(projectId)}/sandboxes/${encodeURIComponent(sandboxId)}/agent-sessions/${encodeURIComponent(sessionId)}`;
   for (;; ) {
-    const result = await sandblocksRequest(apiUrl, apiKey, path6);
+    const result = await sandblocksRequest(apiUrl, apiKey, path7);
     if (!["queued", "running"].includes(String(result.session?.state)))
       return result.session;
     await Bun.sleep(1000);
   }
 }
 async function sandboxPromote(args) {
-  const options = parse(args);
-  const projectId = option(options, "project");
-  const sandboxId = option(options, "sandbox");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(args);
+  const projectId = option2(options, "project");
+  const sandboxId = option2(options, "sandbox");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId)
     throw new Error("sandbox promote requires --project");
   if (!sandboxId)
@@ -15057,7 +15175,7 @@ async function createSourceTar(root) {
     if (name.includes("\x00") || name.includes("\\") || name.startsWith("/") || name.split("/").includes("..")) {
       throw new Error(`local source path is unsafe: ${name}`);
     }
-    const file = path5.join(root, name);
+    const file = path6.join(root, name);
     let info;
     try {
       info = await lstat(file);
@@ -15150,25 +15268,25 @@ function tarOctal(header, offset, length, value) {
   header[offset + length - 1] = 0;
 }
 async function sandboxDeploy(args) {
-  const options = parse(args);
-  const root = path5.resolve(options.positionals[0] ?? process.cwd());
-  const projectId = option(options, "project");
-  const workspaceId = option(options, "workspace");
-  const sandboxId = option(options, "sandbox");
-  const hostId = option(options, "host");
-  const targetHost = option(options, "target-host");
-  const specPath = option(options, "spec");
-  const apiUrl = (option(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
-  const apiKey = option(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  const options = parse2(args);
+  const root = path6.resolve(options.positionals[0] ?? process.cwd());
+  const projectId = option2(options, "project");
+  const workspaceId = option2(options, "workspace");
+  const sandboxId = option2(options, "sandbox");
+  const hostId = option2(options, "host");
+  const targetHost = option2(options, "target-host");
+  const specPath = option2(options, "spec");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
   if (!projectId || !workspaceId || !sandboxId || !hostId || !targetHost || !specPath) {
     throw new Error("sandbox deploy requires --project, --workspace, --sandbox, --host, --target-host, and --spec");
   }
   if (!apiUrl || !apiKey)
     throw new Error("sandbox deploy requires Sandblocks API URL and key");
-  const spec = JSON.parse(await readFile8(path5.resolve(root, specPath), "utf8"));
+  const spec = JSON.parse(await readFile8(path6.resolve(root, specPath), "utf8"));
   if (!Array.isArray(spec.services) || !spec.services.length)
     throw new Error("preview spec requires services");
-  const deploymentId = option(options, "deployment") ?? randomUUID4();
+  const deploymentId = option2(options, "deployment") ?? randomUUID4();
   const submitted = await sandblocksRequest(apiUrl, apiKey, `/v1/projects/${encodeURIComponent(projectId)}/operations`, {
     method: "POST",
     headers: { "idempotency-key": `preview:${deploymentId}:deploy` },
@@ -15249,7 +15367,7 @@ async function waitForOperation(apiUrl, apiKey, id2) {
 async function load(root, entrypoint) {
   return loadSandblocksManifest({ repositoryRoot: root, ...entrypoint ? { entrypoint } : {} });
 }
-function parse(args) {
+function parse2(args) {
   const output = { positionals: [] };
   for (let index = 0;index < args.length; index++) {
     const value = args[index];
@@ -15287,11 +15405,11 @@ function parse(args) {
   }
   return output;
 }
-function option(options, key) {
+function option2(options, key) {
   return typeof options[key] === "string" ? options[key] : undefined;
 }
 function manifestPathOption(options) {
-  return option(options, "config") ?? option(options, "manifest");
+  return option2(options, "config") ?? option2(options, "manifest");
 }
 function slug(value) {
   const normalized = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
@@ -15314,7 +15432,7 @@ async function git3(cwd, args) {
 async function loadCliEnvironment(root) {
   let contents;
   try {
-    contents = await readFile8(path5.join(root, ".sandblocks", "config.env"), "utf8");
+    contents = await readFile8(path6.join(root, ".sandblocks", "config.env"), "utf8");
   } catch {
     return;
   }
@@ -15330,15 +15448,15 @@ async function loadCliEnvironment(root) {
 }
 if (import.meta.main) {
   try {
-    await run2();
+    await run3();
   } catch (error) {
     console.error(`sandblocks: ${error instanceof Error ? error.message : String(error)}`);
     process.exitCode = 1;
   }
 }
 export {
-  run2 as run,
-  parse
+  run3 as run,
+  parse2 as parse
 };
 
-//# debugId=64EF599DFAEB049264756E2164756E21
+//# debugId=96A687238FDBFB8A64756E2164756E21