@sandblocks/cli 0.5.0-b.8 → 0.5.0

package/dist/cli.js

@@ -60,6 +60,24 @@ function compileProjectGraph(manifest) {
             timeoutSeconds: service.health.timeout,
             failureThreshold: service.health.failures
           }
+        } : {},
+        ...service.development ? {
+          development: {
+            command: normalizeCommand(service.development.command),
+            ...service.development.health ? {
+              health: {
+                path: service.development.health.path,
+                intervalSeconds: service.development.health.interval,
+                timeoutSeconds: service.development.health.timeout,
+                failureThreshold: service.development.health.failures
+              }
+            } : {},
+            restart: service.development.restart,
+            ...service.development.resources ? {
+              memory: service.development.resources.memory,
+              cpus: service.development.resources.cpus
+            } : {}
+          }
         } : {}
       };
     }),
@@ -69,11 +87,19 @@ function compileProjectGraph(manifest) {
       context: check.context,
       ...check.command ? { command: check.command } : {},
       timeoutSeconds: check.timeout,
+      ...check.application ? { application: check.application } : {},
+      profile: check.profile,
+      inputs: check.inputs,
+      required: check.required,
       memory: check.resources.memory,
       cpus: check.resources.cpus
     })),
     environments: manifest.environments.map((environment) => ({
       id: environment.id,
+      mode: environment.mode,
+      managedEnvironment: environment.managedEnvironment ?? environment.id,
+      branches: environment.branches,
+      checkProfile: environment.checkProfile,
       pipeline: environment.pipeline,
       services: environment.services,
       checks: environment.checks,
@@ -4076,9 +4102,41 @@ function validateReferences(manifest, ctx) {
   }
   validateAcyclicServices(manifest, ctx);
   for (const [index, environment] of manifest.environments.entries()) {
+    if (environment.mode === "development" && environment.checkProfile === "none") {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        path: ["environments", index, "checkProfile"],
+        message: "development environments must keep a smoke or full quality gate"
+      });
+    }
+    if (environment.id === "prod" && environment.mode !== "immutable") {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        path: ["environments", index, "mode"],
+        message: "the prod environment must be immutable"
+      });
+    }
     validateReferencesTo(ctx, environment.pipeline, taskIds, ["environments", index, "pipeline"], "task");
     validateReferencesTo(ctx, environment.services, serviceIds, ["environments", index, "services"], "service");
     validateReferencesTo(ctx, environment.checks, checkIds, ["environments", index, "checks"], "check");
+    if (environment.mode === "development") {
+      for (const serviceId of environment.services) {
+        const serviceIndex = manifest.services.findIndex((service2) => service2.id === serviceId);
+        const service = manifest.services[serviceIndex];
+        if (service && !service.development) {
+          ctx.addIssue({
+            code: exports_external.ZodIssueCode.custom,
+            path: ["services", serviceIndex, "development"],
+            message: `service '${serviceId}' requires a development command`
+          });
+        }
+      }
+    }
+  }
+  for (const [index, check] of manifest.checks.entries()) {
+    if (check.application && !serviceIds.has(check.application)) {
+      addReferenceIssue(ctx, ["checks", index, "application"], "service", check.application);
+    }
   }
 }
 function validateAcyclicServices(manifest, ctx) {
@@ -4145,7 +4203,7 @@ function isSafeRepositoryPath(value) {
     return false;
   return !value.split("/").some((segment) => segment === "..");
 }
-var id, repositoryPath, localImage, imageReference, ProjectCommandSchema, duration, resources, WorkspaceValueSchema, WorkspaceSchema, TaskValueSchema, TaskSchema, TasksV2Schema, HealthValueSchema, HealthV2Schema, ServiceValueSchema, ServicesV2Schema, CheckValueSchema, ChecksV2Schema, EnvironmentValueSchema, EnvironmentsV2Schema, HooksV2Schema, ManifestV2Fields, SandblocksManifestV2DocumentSchema, CompleteSandblocksManifestV2Schema, SandblocksManifestV2Schema;
+var id, repositoryPath, localImage, imageReference, ProjectCommandSchema, duration, resources, WorkspaceValueSchema, WorkspaceSchema, TaskValueSchema, TaskSchema, TasksV2Schema, HealthValueSchema, HealthV2Schema, DevelopmentServiceSchema, ServiceValueSchema, ServicesV2Schema, CheckValueSchema, ChecksV2Schema, EnvironmentValueSchema, EnvironmentsV2Schema, HooksV2Schema, ManifestV2Fields, SandblocksManifestV2DocumentSchema, CompleteSandblocksManifestV2Schema, SandblocksManifestV2Schema;
 var init_schema = __esm(() => {
   init_zod();
   id = exports_external.string().min(1).max(63).regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/, "must be a lowercase kebab-case identifier");
@@ -4207,12 +4265,19 @@ var init_schema = __esm(() => {
     exports_external.string().startsWith("/").transform((path) => ({ path, interval: 10, timeout: 5, failures: 3 })),
     HealthValueSchema
   ]);
+  DevelopmentServiceSchema = exports_external.object({
+    command: ProjectCommandSchema,
+    health: HealthV2Schema.optional(),
+    restart: exports_external.enum(["no", "on-failure", "unless-stopped"]).default("on-failure"),
+    resources: resources.optional()
+  }).strict();
   ServiceValueSchema = exports_external.object({
     root: repositoryPath.default("."),
     command: ProjectCommandSchema.optional(),
     static: repositoryPath.optional(),
     port: exports_external.number().int().positive().max(65535).optional(),
     health: HealthV2Schema.optional(),
+    development: DevelopmentServiceSchema.optional(),
     dependsOn: exports_external.array(id).default([]),
     resources: resources.default({})
   }).strict().superRefine((service, ctx) => {
@@ -4237,6 +4302,13 @@ var init_schema = __esm(() => {
         message: "static services use Sandblocks's managed health check"
       });
     }
+    if (service.static && service.development) {
+      ctx.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        path: ["development"],
+        message: "static services cannot declare a development process"
+      });
+    }
   });
   ServicesV2Schema = keyedCollection(ServiceValueSchema);
   CheckValueSchema = exports_external.object({
@@ -4244,13 +4316,21 @@ var init_schema = __esm(() => {
     context: repositoryPath.default("."),
     command: exports_external.array(exports_external.string().min(1).max(2048)).max(64).optional(),
     timeout: duration.default(300),
+    application: id.optional(),
+    profile: exports_external.enum(["smoke", "full"]).default("full"),
+    inputs: exports_external.array(repositoryPath).default([]),
+    required: exports_external.boolean().default(true),
     resources: resources.default({ memory: "1g", cpus: "2" })
   }).strict();
   ChecksV2Schema = keyedCollection(CheckValueSchema);
   EnvironmentValueSchema = exports_external.object({
+    mode: exports_external.enum(["immutable", "development"]).default("immutable"),
+    managedEnvironment: id.optional(),
+    branches: exports_external.array(exports_external.string().min(1).max(255)).max(32).default([]),
     pipeline: exports_external.array(id).default([]),
     services: exports_external.array(id).min(1),
     checks: exports_external.array(id).default([]),
+    checkProfile: exports_external.enum(["none", "smoke", "full"]).default("full"),
     targetHost: exports_external.string().min(1).max(255).optional(),
     routing: exports_external.object({ sso: exports_external.boolean().optional() }).strict().default({})
   }).strict();
@@ -4295,6 +4375,8 @@ function resolveServiceSteps(manifest, environmentId) {
       command: graph.workspace.setup,
       workingDirectory: graph.workspace.root,
       timeoutSeconds: 1800,
+      inputs: ["package.json", "bun.lock", "pnpm-lock.yaml", "yarn.lock", "package-lock.json"],
+      outputs: [],
       required: true
     });
   }
@@ -4307,6 +4389,8 @@ function resolveServiceSteps(manifest, environmentId) {
       command: task.command,
       workingDirectory: task.root,
       timeoutSeconds: task.timeoutSeconds,
+      inputs: task.inputs,
+      outputs: task.outputs,
       required: true
     });
   }
@@ -4319,6 +4403,10 @@ function resolveEnvironment(manifest, id2) {
   const checks = new Map(graph.checks.map((check) => [check.id, check]));
   return {
     id: environment.id,
+    mode: environment.mode,
+    managedEnvironment: environment.managedEnvironment,
+    branches: environment.branches,
+    checkProfile: environment.checkProfile,
     goal: `${environment.id} sandbox`,
     deploymentType: environment.id,
     baseDomain: environment.baseDomain,
@@ -4334,7 +4422,7 @@ function resolveEnvironment(manifest, id2) {
       const service = services.get(serviceId);
       if (!service)
         throw new Error(`environment '${id2}' references unknown service '${serviceId}'`);
-      return executionService(service);
+      return executionService(service, environment.mode);
     }),
     steps: environment.checks.map((checkId) => {
       const check = checks.get(checkId);
@@ -4346,6 +4434,10 @@ function resolveEnvironment(manifest, id2) {
         context: check.context,
         ...check.command ? { command: check.command } : {},
         timeoutSeconds: check.timeoutSeconds,
+        ...check.application ? { application: check.application } : {},
+        profile: check.profile,
+        inputs: check.inputs,
+        required: check.required,
         memory: check.memory,
         cpus: check.cpus
       };
@@ -4358,7 +4450,7 @@ function selectEnvironment(graph, id2) {
     throw new Error(`sandblocks.yml does not define environment '${id2}'`);
   return environment;
 }
-function executionService(service) {
+function executionService(service, mode) {
   if (service.kind === "static") {
     return {
       id: service.id,
@@ -4368,15 +4460,19 @@ function executionService(service) {
       cpus: service.cpus
     };
   }
+  const development = mode === "development" ? service.development : undefined;
+  if (mode === "development" && !development) {
+    throw new Error(`service '${service.id}' has no development command`);
+  }
   return {
     id: service.id,
     kind: "process",
     root: service.root,
-    command: service.command,
+    command: development?.command ?? service.command,
     ...service.port ? { port: service.port } : {},
-    ...service.health ? { healthPath: service.health.path } : {},
-    memory: service.memory,
-    cpus: service.cpus
+    ...development?.health ? { healthPath: development.health.path } : service.health ? { healthPath: service.health.path } : {},
+    memory: development?.memory ?? service.memory,
+    cpus: development?.cpus ?? service.cpus
   };
 }
 var init_resolve = () => {};
@@ -11719,7 +11815,7 @@ var init_src = __esm(() => {
 
 // packages/libs/cli/src/cli.ts
 init_src();
-import { randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID4 } from "crypto";
 import { lstat, readFile as readFile8, readdir as readdir2, stat as stat3, writeFile as writeFile5 } from "fs/promises";
 import path6 from "path";
 
@@ -12508,6 +12604,42 @@ class SandblocksClient {
   cancelAgentSession(projectId, sandboxId, sessionId) {
     return this.request(`/v1/projects/${encodeURIComponent(projectId)}/sandboxes/${encodeURIComponent(sandboxId)}/agent-sessions/${encodeURIComponent(sessionId)}/cancel`, { method: "POST" });
   }
+  listWorkers(organizationId) {
+    return this.request(`/v1/organizations/${encodeURIComponent(organizationId)}/workers`);
+  }
+  createWorker(input) {
+    return this.request(`/v1/organizations/${encodeURIComponent(input.organizationId)}/workers`, {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+  }
+  moveWorkerDeployments(organizationId, workerId, targetWorkerIds) {
+    return this.request(`/v1/organizations/${encodeURIComponent(organizationId)}/workers/${encodeURIComponent(workerId)}/move`, { method: "POST", body: JSON.stringify({ targetWorkerIds }) });
+  }
+  rotateWorkerSecret(organizationId, workerId) {
+    return this.request(`/v1/organizations/${encodeURIComponent(organizationId)}/workers/${encodeURIComponent(workerId)}/rotate-credential`, { method: "POST" });
+  }
+  approveWorkerUpdate(organizationId, workerId, version) {
+    return this.request(`/v1/organizations/${encodeURIComponent(organizationId)}/workers/${encodeURIComponent(workerId)}/approve-update`, {
+      method: "POST",
+      body: JSON.stringify({ version })
+    });
+  }
+  listRegistries(organizationId) {
+    return this.request(`/v1/organizations/${encodeURIComponent(organizationId)}/registries`);
+  }
+  createRegistry(input) {
+    return this.request(`/v1/organizations/${encodeURIComponent(input.organizationId)}/registries`, {
+      method: "POST",
+      body: JSON.stringify(input)
+    });
+  }
+  assignProjectRegistry(projectId, input) {
+    return this.request(`/v1/projects/${encodeURIComponent(projectId)}/registries`, {
+      method: "PUT",
+      body: JSON.stringify(input)
+    });
+  }
   listHosts(projectId) {
     return this.request(`/v1/projects/${encodeURIComponent(projectId)}/hosts`);
   }
@@ -12635,7 +12767,12 @@ class SandblocksClient {
     const image = String(operation.result?.image ?? "");
     if (!/@sha256:[a-f0-9]{64}$/.test(image))
       throw new Error("Published artifact digest is invalid");
-    return { image, workspaceId: input.workspaceId, deploymentId: input.deploymentId, bytes: input.bundle.byteLength };
+    return {
+      image,
+      workspaceId: input.workspaceId,
+      deploymentId: input.deploymentId,
+      bytes: input.bundle.byteLength
+    };
   }
   async deployPrebuiltArtifact(input) {
     const { operation } = await this.request(`/v1/projects/${encodeURIComponent(input.projectId)}/operations`, {
@@ -12962,10 +13099,14 @@ function option(options, key) {
 // packages/libs/cli/src/sandbox.ts
 init_src();
 import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { watch as watchFiles } from "fs";
 import { chmod as chmod3, mkdir as mkdir6, readFile as readFile5, rename, rm as rm4 } from "fs/promises";
 import path5 from "path";
 var COMMANDS = new Set([
   "up",
+  "dev",
+  "sync",
+  "check",
   "create",
   "status",
   "deploy",
@@ -12982,6 +13123,12 @@ function isStatefulSandboxCommand(command) {
 async function runStatefulSandboxCommand(command, args, dependencies) {
   if (command === "up")
     return up(args, dependencies);
+  if (command === "dev")
+    return dev(args, dependencies);
+  if (command === "sync")
+    return sync(args, dependencies);
+  if (command === "check")
+    return check(args, dependencies);
   if (command === "create")
     return create(args, dependencies);
   if (command === "status")
@@ -13013,6 +13160,99 @@ async function up(args, dependencies) {
     }
   });
 }
+async function dev(args, dependencies) {
+  await up(withDefaultOption(withDefaultEnvironment(args, "develop"), "pool", "development-fleet"), dependencies);
+}
+async function sync(args, dependencies) {
+  const effectiveArgs = withDefaultEnvironment(args, "develop");
+  const context = await getContext(effectiveArgs, dependencies);
+  if (context.state.runtimeMode !== "development") {
+    throw new Error("sandbox sync requires a development environment");
+  }
+  let previousDigest = "";
+  const apply = async () => {
+    const source = await dependencies.source(context.root, context.state.sourceSyncInitialized === true ? context.state.sourceManifest : undefined);
+    const digest = createHash2("sha256").update(source.bundle).digest("hex");
+    if (digest === previousDigest)
+      return;
+    previousDigest = digest;
+    context.state.sequence += 1;
+    const response = await fetchWithRetry(`${context.apiUrl}/v1/projects/${encodeURIComponent(context.state.projectId)}/workspaces/${encodeURIComponent(context.state.workspaceId)}/sync`, {
+      method: "POST",
+      headers: {
+        "content-type": "application/x-tar",
+        "content-length": String(source.bundle.byteLength),
+        "x-sandblocks-api-key": context.apiKey,
+        "x-sandblocks-sandbox-id": context.state.sandboxId,
+        ...context.state.sourceRevision ? { "x-sandblocks-base-revision": context.state.sourceRevision } : {},
+        "idempotency-key": `sync:${context.state.sandboxId}:${context.state.sequence}:${digest}`
+      },
+      body: new Blob([Uint8Array.from(source.bundle)])
+    });
+    const submitted = await response.json().catch(() => ({}));
+    if (!response.ok)
+      throw new Error(String(submitted.error ?? `source sync failed (${response.status})`));
+    const completed = await wait(context.apiUrl, context.apiKey, submitted.operation.id, 5 * 60000);
+    context.state.sourceRevision = String(completed.result?.revision ?? digest);
+    context.state.sourceManifest = source.manifest;
+    context.state.sourceSyncInitialized = true;
+    await writeState(context.file, context.state);
+    console.log(`sync      revision=${context.state.sourceRevision} changed=${completed.result?.changed ?? 0} deleted=${completed.result?.deleted ?? 0}`);
+    if (context.options.checks !== "none") {
+      const changedPaths = [
+        ...Array.isArray(completed.result?.changedPaths) ? completed.result.changedPaths : [],
+        ...Array.isArray(completed.result?.deletedPaths) ? completed.result.deletedPaths : []
+      ].filter((value) => typeof value === "string");
+      await runDevelopmentChecks(context, dependencies, undefined, changedPaths);
+    }
+  };
+  await apply();
+  if (context.options.watch !== true)
+    return;
+  console.log("watch     waiting for source changes (Ctrl-C keeps the sandbox running)");
+  while (true) {
+    await waitForSourceChange(context.root);
+    await apply();
+  }
+}
+async function check(args, dependencies) {
+  const context = await getContext(withDefaultEnvironment(args, "develop"), dependencies);
+  await runDevelopmentChecks(context, dependencies, dependencies.option(context.options, "profile"));
+}
+async function waitForSourceChange(root) {
+  await new Promise((resolveChange) => {
+    let settled = false;
+    let debounce;
+    const watcher = watchFiles(root, { recursive: true }, (_event, filename) => {
+      const path6 = String(filename ?? "").replaceAll("\\", "/");
+      if (!path6 || path6 === ".git" || path6.startsWith(".git/") || path6 === ".sandblocks" || path6.startsWith(".sandblocks/") || path6 === "node_modules" || path6.includes("/node_modules/")) {
+        return;
+      }
+      if (debounce)
+        clearTimeout(debounce);
+      debounce = setTimeout(() => {
+        if (settled)
+          return;
+        settled = true;
+        watcher.close();
+        resolveChange();
+      }, 150);
+    });
+    watcher.on("error", () => {
+      if (settled)
+        return;
+      settled = true;
+      watcher.close();
+      setTimeout(resolveChange, 1000);
+    });
+  });
+}
+function withDefaultEnvironment(args, environment) {
+  return withDefaultOption(args, "environment", environment);
+}
+function withDefaultOption(args, option2, value) {
+  return args.some((candidate) => candidate === `--${option2}` || candidate.startsWith(`--${option2}=`)) ? args : [...args, `--${option2}`, value];
+}
 async function create(args, dependencies) {
   const options = dependencies.parse(args);
   const root = path5.resolve(options.positionals[0] ?? process.cwd());
@@ -13053,9 +13293,10 @@ async function create(args, dependencies) {
       source: dependencies.source,
       ..."image" in loaded.manifest.workspace && loaded.manifest.workspace.image ? { workspaceImage: loaded.manifest.workspace.image } : {}
     });
-    const hostId = String(imported.operation.assignedHostId ?? "");
-    if (!hostId)
-      throw new Error("workspace import did not bind a sandbox host");
+    const hostId = typeof imported.operation.assignedHostId === "string" ? imported.operation.assignedHostId : undefined;
+    const workerId = String(imported.operation.assignedWorkerId ?? imported.operation.assignedHostId ?? "");
+    if (!workerId)
+      throw new Error("workspace import did not bind a worker");
     const state = {
       version: 1,
       environment,
@@ -13065,14 +13306,17 @@ async function create(args, dependencies) {
       repository,
       leaseId: lease.lease.id,
       leaseToken: lease.token,
-      hostId,
+      ...hostId ? { hostId } : {},
+      workerId,
+      sourceRevision: typeof imported.operation.result?.sha === "string" ? imported.operation.result.sha : undefined,
+      sourceManifest: imported.manifest,
       sequence: 0,
       createdAt: new Date().toISOString()
     };
     await writeState(file, state);
     console.log(`sandbox   ${sandboxId}`);
     console.log(`workspace ${workspaceId}`);
-    console.log(`host      ${hostId}`);
+    console.log(`worker    ${workerId}`);
   } catch (error) {
     await request(apiUrl, apiKey, `/v1/projects/${encodeURIComponent(projectId)}/sandboxes/${sandboxId}`, {
       method: "DELETE"
@@ -13095,8 +13339,14 @@ async function status2(args, dependencies) {
   console.log(`state     ${path5.relative(context.root, context.file)}`);
   console.log(`sandbox   ${context.state.sandboxId} (${sandbox.sandbox.status})`);
   console.log(`workspace ${context.state.workspaceId}`);
-  console.log(`host      ${context.state.hostId}`);
+  console.log(`worker    ${context.state.workerId}`);
   console.log(`lease     expires ${session.session.expiresAt}`);
+  if (context.state.runtimeMode)
+    console.log(`mode      ${context.state.runtimeMode}`);
+  if (context.state.sourceRevision)
+    console.log(`revision  ${context.state.sourceRevision}`);
+  if (context.state.quality)
+    console.log(`quality   ${context.state.quality.status} (${context.state.quality.sourceRevision})`);
   for (const route of context.state.previewUrls ?? [])
     console.log(`${route.service ?? "service"} ${route.url}`);
 }
@@ -13125,15 +13375,22 @@ async function withDeploymentLock(args, dependencies, action) {
 }
 async function deployUnlocked(args, dependencies) {
   const context = await getContext(args, dependencies);
-  if (context.state.deploymentId)
+  const resume = context.options.resume === true;
+  if (context.state.deploymentId && !(resume && context.state.candidate?.deploymentId === context.state.deploymentId))
     throw new Error("preview is already deployed; use sandbox redeploy");
   const loaded = await dependencies.load(context.root, dependencies.option(context.options, "config") ?? dependencies.option(context.options, "manifest"));
   const stack = loaded.manifest.name ?? context.state.repository;
   const preview = await applyManagedRoutingPolicy(context, stack, selectPreview(loaded, context.state.environment));
+  await assertEnvironmentBranch(context.root, preview);
+  context.state.managedEnvironment = preview.managedEnvironment;
+  if (preview.mode === "development") {
+    await deployDevelopmentUnlocked(context, loaded, preview);
+    return;
+  }
   const deploymentTarget = await resolveDeploymentTarget(context, process.env.SANDBLOCKS_SANDBOX_TARGET_HOST ?? preview.targetHost);
   const targetHost = deploymentTarget.targetHost;
   context.state.deploymentHostId = deploymentTarget.hostId;
-  const resume = context.options.resume === true;
+  context.state.deploymentWorkerId = deploymentTarget.workerId;
   const previousCandidate = resume ? context.state.candidate : undefined;
   if (resume && !previousCandidate)
     throw new Error("no resumable candidate exists for this sandbox");
@@ -13143,13 +13400,14 @@ async function deployUnlocked(args, dependencies) {
     throw new Error("deployment ID must be a UUID");
   if (previousCandidate && requestedDeploymentId && requestedDeploymentId !== previousCandidate.deploymentId)
     throw new Error("--deployment-id does not match the resumable candidate");
-  const environmentSnapshotId = previousCandidate?.environmentSnapshotId ?? await createEnvironmentSnapshot(context);
-  context.state.candidate = previousCandidate ?? { deploymentId, environmentSnapshotId };
+  const environmentSnapshotId = resume ? await createEnvironmentSnapshot(context) : previousCandidate?.environmentSnapshotId ?? await createEnvironmentSnapshot(context);
+  context.state.candidate = previousCandidate ? { ...previousCandidate, environmentSnapshotId } : { deploymentId, environmentSnapshotId };
   await writeState(context.file, context.state);
   const serviceUrls = expectedPreviewServiceUrls(context.state.sandboxId, deploymentId, context.state.repository, preview);
   const serviceSteps = resolveServiceSteps(loaded.manifest, context.state.environment);
   let buildWorkspaceId = previousCandidate?.buildWorkspaceId;
   let buildHostId = previousCandidate?.buildHostId;
+  let buildWorkerId = previousCandidate?.buildWorkerId;
   const suppliedArtifact = dependencies.option(context.options, "artifact");
   if (suppliedArtifact && !/@sha256:[a-f0-9]{64}$/.test(suppliedArtifact))
     throw new Error("--artifact must be an immutable OCI image digest");
@@ -13173,10 +13431,17 @@ async function deployUnlocked(args, dependencies) {
           source: dependencies.source,
           ..."image" in loaded.manifest.workspace && loaded.manifest.workspace.image ? { workspaceImage: loaded.manifest.workspace.image } : {}
         });
-        buildHostId = String(imported.operation.assignedHostId ?? "");
-        if (!buildHostId)
-          throw new Error("build workspace did not bind a build host");
-        context.state.candidate = { deploymentId, environmentSnapshotId, buildWorkspaceId, buildHostId };
+        buildHostId = typeof imported.operation.assignedHostId === "string" ? imported.operation.assignedHostId : undefined;
+        buildWorkerId = String(imported.operation.assignedWorkerId ?? imported.operation.assignedHostId ?? "");
+        if (!buildWorkerId)
+          throw new Error("build workspace did not bind a build worker");
+        context.state.candidate = {
+          deploymentId,
+          environmentSnapshotId,
+          buildWorkspaceId,
+          buildHostId,
+          buildWorkerId
+        };
         await writeState(context.file, context.state);
         const stepOperation = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/operations`, {
           method: "POST",
@@ -13184,7 +13449,7 @@ async function deployUnlocked(args, dependencies) {
           body: JSON.stringify({
             kind: "workspace.step.run",
             stack: context.state.repository,
-            environmentId: context.state.environment,
+            environmentId: managedEnvironmentId(context),
             environmentSnapshotId,
             payload: {
               workspaceId: buildWorkspaceId,
@@ -13194,7 +13459,11 @@ async function deployUnlocked(args, dependencies) {
               serviceUrls,
               steps: serviceSteps,
               ..."image" in loaded.manifest.workspace && loaded.manifest.workspace.image ? { workspaceImage: loaded.manifest.workspace.image } : {},
-              placement: { hostId: buildHostId, memoryReservationBytes: 2 * 1024 * 1024 * 1024 }
+              placement: {
+                workerId: buildWorkerId,
+                ...buildHostId ? { hostId: buildHostId } : {},
+                memoryReservationBytes: 2 * 1024 * 1024 * 1024
+              }
             },
             maxAttempts: 1
           })
@@ -13205,22 +13474,29 @@ async function deployUnlocked(args, dependencies) {
           environmentSnapshotId,
           buildWorkspaceId,
           buildHostId,
+          buildWorkerId,
           buildCompleted: true
         };
         await writeState(context.file, context.state);
       }
-      if (!buildHostId)
-        throw new Error("resumable build host is unavailable");
+      if (!buildWorkerId)
+        throw new Error("resumable build worker is unavailable");
       const publish = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/operations`, {
         method: "POST",
-        headers: { "idempotency-key": `preview:${deploymentId}:artifact` },
+        headers: {
+          "idempotency-key": resume ? `preview:${deploymentId}:artifact:resume:${randomUUID2()}` : `preview:${deploymentId}:artifact`
+        },
         body: JSON.stringify({
           kind: "workspace.artifact.publish",
           payload: {
             workspaceId: buildWorkspaceId,
             deploymentId,
             stack,
-            placement: { hostId: buildHostId, memoryReservationBytes: 1024 * 1024 * 1024 }
+            placement: {
+              workerId: buildWorkerId,
+              ...buildHostId ? { hostId: buildHostId } : {},
+              memoryReservationBytes: 1024 * 1024 * 1024
+            }
           },
           maxAttempts: 1
         })
@@ -13234,6 +13510,7 @@ async function deployUnlocked(args, dependencies) {
         environmentSnapshotId,
         buildWorkspaceId,
         buildHostId,
+        buildWorkerId,
         buildCompleted: true,
         artifactImage
       };
@@ -13257,7 +13534,9 @@ async function deployUnlocked(args, dependencies) {
   if (!artifactImage) {
     const publish = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/operations`, {
       method: "POST",
-      headers: { "idempotency-key": `preview:${deploymentId}:artifact` },
+      headers: {
+        "idempotency-key": resume ? `preview:${deploymentId}:artifact:resume:${randomUUID2()}` : `preview:${deploymentId}:artifact`
+      },
       body: JSON.stringify({
         kind: "workspace.artifact.publish",
         payload: {
@@ -13265,7 +13544,8 @@ async function deployUnlocked(args, dependencies) {
           deploymentId,
           stack,
           placement: {
-            hostId: context.state.hostId,
+            workerId: context.state.workerId,
+            ...context.state.hostId ? { hostId: context.state.hostId } : {},
             memoryReservationBytes: 1024 * 1024 * 1024
           }
         },
@@ -13282,12 +13562,12 @@ async function deployUnlocked(args, dependencies) {
     const submitted = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/operations`, {
       method: "POST",
       headers: {
-        "idempotency-key": `preview:${deploymentId}:deploy`
+        "idempotency-key": resume ? `preview:${deploymentId}:deploy:resume:${randomUUID2()}` : `preview:${deploymentId}:deploy`
       },
       body: JSON.stringify({
         kind: "workspace.service.deploy",
         stack: context.state.repository,
-        environmentId: context.state.environment,
+        environmentId: managedEnvironmentId(context),
         environmentSnapshotId,
         payload: {
           workspaceId: context.state.workspaceId,
@@ -13301,7 +13581,8 @@ async function deployUnlocked(args, dependencies) {
           serviceUrls,
           services: preview.services,
           placement: {
-            hostId: deploymentTarget.hostId,
+            workerId: deploymentTarget.workerId,
+            ...deploymentTarget.hostId ? { hostId: deploymentTarget.hostId } : {},
             requiredWorkerRole: "runtime",
             pool: deploymentTarget.pool,
             memoryReservationBytes: serviceMemoryReservation(preview.services)
@@ -13313,14 +13594,14 @@ async function deployUnlocked(args, dependencies) {
     operation = await wait(context.apiUrl, context.apiKey, submitted.operation.id, 30 * 60000);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`${message}; retry with ` + "`sandblocks sandbox deploy . --resume`");
+    throw new Error(`${message}; retry with \`sandblocks sandbox deploy . --resume\``);
   }
   context.state.deploymentId = deploymentId;
   await writeState(context.file, context.state);
   const routes = operation.result?.serviceRoutes ?? [];
   const images = operation.result?.images ?? [];
   if (typeof preview.ssoEnabled === "boolean") {
-    await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/routing-policies/${encodeURIComponent(stack)}/${encodeURIComponent(preview.deploymentType)}`, { method: "PUT", body: JSON.stringify({ ssoEnabled: preview.ssoEnabled }) });
+    await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/routing-policies/${encodeURIComponent(stack)}/${encodeURIComponent(preview.managedEnvironment)}`, { method: "PUT", body: JSON.stringify({ ssoEnabled: preview.ssoEnabled }) });
   }
   let sandbox = await recordSandbox(context, loaded, preview, routes, operation.result?.healthEvidence ?? [], images, preview.steps.length ? "active" : "available");
   let checkEvidence = [];
@@ -13334,15 +13615,15 @@ async function deployUnlocked(args, dependencies) {
           route.url
         ]
       ] : []));
-      const check = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/operations`, {
+      const check2 = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/operations`, {
         method: "POST",
         headers: {
-          "idempotency-key": `preview:${deploymentId}:checks`
+          "idempotency-key": resume ? `preview:${deploymentId}:checks:resume:${randomUUID2()}` : `preview:${deploymentId}:checks`
         },
         body: JSON.stringify({
           kind: "workspace.check.run",
           stack: context.state.repository,
-          environmentId: context.state.environment,
+          environmentId: managedEnvironmentId(context),
           environmentSnapshotId,
           payload: {
             workspaceId: buildWorkspaceId ?? context.state.workspaceId,
@@ -13351,12 +13632,15 @@ async function deployUnlocked(args, dependencies) {
             runtimeType: preview.deploymentType,
             checks: preview.steps,
             serviceUrls: serviceUrls2,
-            placement: { hostId: buildHostId ?? context.state.hostId }
+            placement: {
+              workerId: buildWorkerId ?? context.state.workerId,
+              ...buildHostId ?? context.state.hostId ? { hostId: buildHostId ?? context.state.hostId } : {}
+            }
           },
           maxAttempts: 1
         })
       });
-      const checked2 = await wait(context.apiUrl, context.apiKey, check.operation.id, 60 * 60000);
+      const checked2 = await wait(context.apiUrl, context.apiKey, check2.operation.id, 60 * 60000);
       checkEvidence = checked2.result?.checks ?? [];
       if (checked2.result?.passed !== true) {
         throw new Error(`one or more post-deploy checks failed: ${JSON.stringify(checkEvidence)}`);
@@ -13367,13 +13651,6 @@ async function deployUnlocked(args, dependencies) {
     await recordSandbox(context, loaded, preview, routes, [...operation.result?.healthEvidence ?? [], ...checkEvidence], images, "failed").catch(() => {
       return;
     });
-    if (buildWorkspaceId)
-      await destroyDetachedWorkspace(context, buildWorkspaceId, `preview:${deploymentId}:build-cleanup`).catch(() => {
-        return;
-      });
-    await releaseEnvironmentSnapshot(context, environmentSnapshotId).catch(() => {
-      return;
-    });
     throw error;
   }
   if (buildWorkspaceId)
@@ -13388,6 +13665,219 @@ async function deployUnlocked(args, dependencies) {
   for (const route of previewUrls)
     console.log(`${route.service ?? "service"} ${route.url}`);
 }
+async function deployDevelopmentUnlocked(context, loaded, preview) {
+  if (context.state.deploymentId)
+    throw new Error("development sandbox is already running; use sandbox sync");
+  const stack = loaded.manifest.name ?? context.state.repository;
+  const target = await resolveDevelopmentTarget(context, preview.targetHost);
+  const deploymentId = randomUUID2();
+  const environmentSnapshotId = await createEnvironmentSnapshot(context);
+  context.state.deploymentId = deploymentId;
+  context.state.deploymentHostId = target.hostId;
+  context.state.deploymentWorkerId = target.workerId;
+  context.state.runtimeMode = "development";
+  await writeState(context.file, context.state);
+  try {
+    const serviceUrls = expectedPreviewServiceUrls(context.state.sandboxId, deploymentId, context.state.repository, preview);
+    const steps = resolveServiceSteps(loaded.manifest, context.state.environment);
+    if (steps.length) {
+      const submitted2 = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/operations`, {
+        method: "POST",
+        headers: { "idempotency-key": `development:${deploymentId}:setup` },
+        body: JSON.stringify({
+          kind: "workspace.step.run",
+          stack,
+          environmentId: managedEnvironmentId(context),
+          environmentSnapshotId,
+          payload: {
+            workspaceId: context.state.workspaceId,
+            sandboxId: context.state.sandboxId,
+            revisionId: context.state.sourceRevision ?? deploymentId,
+            runtimeType: preview.deploymentType,
+            serviceUrls,
+            steps,
+            ..."image" in loaded.manifest.workspace && loaded.manifest.workspace.image ? { workspaceImage: loaded.manifest.workspace.image } : {},
+            placement: {
+              workerId: context.state.workerId,
+              ...context.state.hostId ? { hostId: context.state.hostId } : {},
+              requiredWorkerRole: "development"
+            }
+          },
+          maxAttempts: 1
+        })
+      });
+      await wait(context.apiUrl, context.apiKey, submitted2.operation.id, 30 * 60000);
+    }
+    const submitted = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/operations`, {
+      method: "POST",
+      headers: { "idempotency-key": `development:${deploymentId}:services` },
+      body: JSON.stringify({
+        kind: "workspace.service.deploy",
+        stack,
+        environmentId: managedEnvironmentId(context),
+        environmentSnapshotId,
+        payload: {
+          workspaceId: context.state.workspaceId,
+          deploymentId,
+          sandboxId: context.state.sandboxId,
+          runtimeType: preview.deploymentType,
+          stack,
+          workspace: preview.workspace,
+          mutableDevelopment: true,
+          sourceRevision: context.state.sourceRevision ?? deploymentId,
+          targetHost: target.targetHost,
+          serviceUrls,
+          services: preview.services,
+          placement: {
+            workerId: context.state.workerId,
+            ...context.state.hostId ? { hostId: context.state.hostId } : {},
+            requiredWorkerRole: "development",
+            memoryReservationBytes: serviceMemoryReservation(preview.services)
+          }
+        },
+        maxAttempts: 1
+      })
+    });
+    const operation = await wait(context.apiUrl, context.apiKey, submitted.operation.id, 30 * 60000);
+    if (typeof preview.ssoEnabled === "boolean") {
+      await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/routing-policies/${encodeURIComponent(stack)}/${encodeURIComponent(preview.managedEnvironment)}`, { method: "PUT", body: JSON.stringify({ ssoEnabled: preview.ssoEnabled }) });
+    }
+    const sandbox = await recordSandbox(context, loaded, preview, operation.result?.serviceRoutes ?? [], operation.result?.healthEvidence ?? [], operation.result?.images ?? [], "available");
+    const previewUrls = sandbox.previewUrls ?? [];
+    context.state.previewUrls = previewUrls;
+    await writeState(context.file, context.state);
+    console.log(`development ${deploymentId} available`);
+    for (const route of previewUrls)
+      console.log(`${route.service ?? "service"} ${route.url}`);
+    await runDevelopmentChecks(context, {
+      parse: () => context.options,
+      option: (options, key) => typeof options[key] === "string" ? options[key] : undefined,
+      load: async () => loaded,
+      source: async () => ({ bundle: new Uint8Array, files: 0 })
+    });
+  } catch (error) {
+    context.state.runtimeMode = "development";
+    await writeState(context.file, context.state);
+    throw error;
+  } finally {
+    await releaseEnvironmentSnapshot(context, environmentSnapshotId).catch(() => {
+      return;
+    });
+  }
+}
+async function runDevelopmentChecks(context, dependencies, requestedProfile, changedPaths = []) {
+  if (!context.state.deploymentId || !context.state.previewUrls?.length) {
+    throw new Error("development services must be available before checks run");
+  }
+  const loaded = await dependencies.load(context.root, dependencies.option(context.options, "config") ?? dependencies.option(context.options, "manifest"));
+  const environment = resolveEnvironment(loaded.manifest, context.state.environment);
+  if (environment.mode !== "development")
+    throw new Error("continuous checks require a development environment");
+  const profile = requestedProfile ?? environment.checkProfile;
+  if (!["none", "smoke", "full"].includes(profile))
+    throw new Error("check profile must be none, smoke, or full");
+  const sourceRevision = context.state.sourceRevision ?? context.state.deploymentId;
+  if (profile === "none") {
+    context.state.quality = { sourceRevision, status: "unchecked", checks: [] };
+    await writeState(context.file, context.state);
+    console.log(`quality   unchecked revision=${sourceRevision}`);
+    return;
+  }
+  const profileChecks = environment.steps.filter((candidate) => profile === "full" || candidate.profile === "smoke");
+  const checks = profile === "full" || !changedPaths.length ? profileChecks : profileChecks.filter((candidate) => !candidate.inputs.length || candidate.inputs.some((input) => changedPaths.some((path6) => repositoryPatternMatches(input, path6))));
+  if (!profileChecks.length)
+    throw new Error(`environment '${environment.id}' has no ${profile} checks`);
+  if (!checks.length) {
+    context.state.quality = {
+      sourceRevision,
+      status: context.state.quality?.status === "failed" ? "failed" : "passed",
+      checks: context.state.quality?.checks ?? []
+    };
+    await writeState(context.file, context.state);
+    console.log(`quality   reused revision=${sourceRevision} (no affected application suites)`);
+    return;
+  }
+  await waitForPublishedRoutes(context.state.previewUrls);
+  const serviceUrls = Object.fromEntries(context.state.previewUrls.flatMap((route) => route.service ? [[`SANDBLOCKS_SERVICE_${route.service.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_URL`, route.url]] : []));
+  context.state.sequence += 1;
+  const snapshotId = await createEnvironmentSnapshot(context);
+  try {
+    const submitted = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/operations`, {
+      method: "POST",
+      headers: {
+        "idempotency-key": `development:${context.state.deploymentId}:checks:${sourceRevision}:${profile}:${context.state.sequence}`
+      },
+      body: JSON.stringify({
+        kind: "workspace.check.run",
+        stack: loaded.manifest.name ?? context.state.repository,
+        environmentId: managedEnvironmentId(context),
+        environmentSnapshotId: snapshotId,
+        payload: {
+          workspaceId: context.state.workspaceId,
+          deploymentId: context.state.deploymentId,
+          sandboxId: context.state.sandboxId,
+          runtimeType: environment.deploymentType,
+          sourceRevision,
+          checks,
+          serviceUrls,
+          placement: {
+            workerId: context.state.workerId,
+            ...context.state.hostId ? { hostId: context.state.hostId } : {},
+            requiredWorkerRole: "development"
+          }
+        },
+        maxAttempts: 1
+      })
+    });
+    const completed = await wait(context.apiUrl, context.apiKey, submitted.operation.id, 60 * 60000);
+    const checksResult = Array.isArray(completed.result?.checks) ? completed.result.checks : [];
+    const selectedIds = new Set(checks.map((item) => item.id));
+    const reused = (context.state.quality?.checks ?? []).filter((item) => item && !selectedIds.has(String(item.check ?? ""))).map((item) => ({
+      ...item,
+      sourceRevision,
+      status: item.status === "passed" || item.status === "reused" ? "reused" : item.status,
+      reusedFromRevision: item.sourceRevision
+    }));
+    const combined = [...checksResult, ...reused];
+    const status3 = completed.result?.passed === true && combined.every((item) => item.required === false || ["passed", "reused"].includes(item.status)) ? "passed" : "failed";
+    context.state.quality = { sourceRevision, status: status3, checks: combined };
+    await writeState(context.file, context.state);
+    console.log(`quality   ${status3} revision=${sourceRevision}`);
+    for (const result of checksResult) {
+      const item = result;
+      console.log(`  ${String(item.application ?? item.check ?? "check").padEnd(12)} ${item.status} ${item.durationMs ?? 0}ms`);
+    }
+  } finally {
+    await releaseEnvironmentSnapshot(context, snapshotId).catch(() => {
+      return;
+    });
+  }
+}
+async function assertEnvironmentBranch(root, environment) {
+  if (!environment.branches.length)
+    return;
+  const result = Bun.spawnSync(["git", "branch", "--show-current"], { cwd: root });
+  const branch = result.exitCode === 0 ? result.stdout.toString().trim() : "";
+  if (!branch)
+    throw new Error(`environment '${environment.id}' requires a named Git branch`);
+  const allowed = environment.branches.some((pattern) => {
+    const expression = new RegExp(`^${pattern.split("*").map(escapeRegExp).join(".*")}$`);
+    return expression.test(branch);
+  });
+  if (!allowed) {
+    throw new Error(`branch '${branch}' cannot deploy to environment '${environment.id}' (allowed: ${environment.branches.join(", ")})`);
+  }
+}
+function escapeRegExp(value) {
+  return value.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+}
+function repositoryPatternMatches(pattern, path6) {
+  const normalized = pattern.replace(/^\.\//, "").replace(/\/\*\*$/, "").replace(/\/$/, "");
+  if (!normalized.includes("*"))
+    return path6 === normalized || path6.startsWith(`${normalized}/`);
+  const expression = new RegExp(`^${normalized.split("**").map((part) => part.split("*").map(escapeRegExp).join("[^/]*")).join(".*")}(?:/.*)?$`);
+  return expression.test(path6);
+}
 async function redeploy(args, dependencies) {
   const context = await getContext(args, dependencies);
   const routing = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/routing-aliases`);
@@ -13415,10 +13905,12 @@ async function redeploy(args, dependencies) {
       source: dependencies.source,
       ..."image" in loaded.manifest.workspace && loaded.manifest.workspace.image ? { workspaceImage: loaded.manifest.workspace.image } : {}
     });
-    const hostId = String(imported.operation.assignedHostId ?? "");
-    if (!hostId)
-      throw new Error("workspace re-import did not bind a sandbox host");
+    const hostId = typeof imported.operation.assignedHostId === "string" ? imported.operation.assignedHostId : undefined;
+    const workerId = String(imported.operation.assignedWorkerId ?? imported.operation.assignedHostId ?? "");
+    if (!workerId)
+      throw new Error("workspace re-import did not bind a worker");
     context.state.hostId = hostId;
+    context.state.workerId = workerId;
     await writeState(context.file, context.state);
     await deploy(args, dependencies);
     if (previousDeploymentId)
@@ -13494,25 +13986,47 @@ async function down(args, dependencies) {
   await rm4(context.file, { force: true });
   console.log(`sandbox ${context.state.sandboxId} destroyed`);
 }
+async function resolveDevelopmentTarget(context, fallback) {
+  const project = encodeURIComponent(context.state.projectId);
+  const workerBody = await request(context.apiUrl, context.apiKey, `/v1/projects/${project}/workers`);
+  const workers = Array.isArray(workerBody.workers) ? workerBody.workers : [];
+  const worker = workers.find((candidate) => candidate?.id === context.state.workerId);
+  if (!worker || worker.status !== "online")
+    throw new Error("development workspace worker is offline");
+  const configuredTarget = worker?.configuration?.targetAddress;
+  const targetHost = typeof fallback === "string" && fallback.trim() ? fallback.trim() : typeof configuredTarget === "string" && configuredTarget.trim() ? configuredTarget.trim() : undefined;
+  if (!targetHost)
+    throw new Error("development worker targetAddress or environment targetHost is required");
+  return {
+    workerId: String(worker.id),
+    ...worker.hostId ? { hostId: String(worker.hostId) } : {},
+    targetHost
+  };
+}
 async function resolveDeploymentTarget(context, fallback) {
   const project = encodeURIComponent(context.state.projectId);
-  const [hostBody, workerBody] = await Promise.all([
-    request(context.apiUrl, context.apiKey, `/v1/projects/${project}/hosts`),
-    request(context.apiUrl, context.apiKey, `/v1/projects/${project}/workers`)
-  ]);
+  const workerBody = await request(context.apiUrl, context.apiKey, `/v1/projects/${project}/workers`);
   const workers = Array.isArray(workerBody.workers) ? workerBody.workers : [];
   const requestedPool = process.env.SANDBLOCKS_DEPLOYMENT_WORKER_POOL?.trim() || process.env.SANDBLOCKS_RUNTIME_WORKER_POOL?.trim();
   const eligible = workers.filter((worker2) => worker2?.status === "online" && Array.isArray(worker2.roles) && worker2.roles.includes("runtime"));
-  const worker = eligible.find((candidate) => requestedPool && candidate.pool === requestedPool) ?? eligible[0];
-  if (!worker?.hostId)
+  const worker = eligible.find((candidate) => typeof fallback === "string" && candidate?.configuration?.targetAddress === fallback.trim()) ?? eligible.find((candidate) => requestedPool && candidate.pool === requestedPool) ?? eligible[0];
+  if (!worker?.id)
     throw new Error("no online deployment worker is available");
-  const hosts = Array.isArray(hostBody.hosts) ? hostBody.hosts : [];
-  const host = hosts.find((candidate) => candidate?.id === worker.hostId);
-  const configuredTarget = worker?.configuration?.targetAddress ?? host?.labels?.targetHost;
+  let configuredTarget = worker?.configuration?.targetAddress;
+  if (!configuredTarget && worker.hostId) {
+    const legacyHosts = await request(context.apiUrl, context.apiKey, `/v1/projects/${project}/hosts`);
+    const host = Array.isArray(legacyHosts.hosts) ? legacyHosts.hosts.find((candidate) => candidate?.id === worker.hostId) : undefined;
+    configuredTarget = host?.labels?.targetHost;
+  }
   const targetHost = typeof fallback === "string" && fallback.trim() ? fallback.trim() : typeof configuredTarget === "string" && configuredTarget.trim() ? configuredTarget.trim() : undefined;
   if (!targetHost)
-    throw new Error("deployment host targetHost label or preview targetHost is required");
-  return { hostId: String(worker.hostId), targetHost, pool: String(worker.pool ?? "unpooled") };
+    throw new Error("deployment worker targetAddress or preview targetHost is required");
+  return {
+    workerId: String(worker.id),
+    ...worker.hostId ? { hostId: String(worker.hostId) } : {},
+    targetHost,
+    pool: String(worker.pool ?? "unpooled")
+  };
 }
 async function recordSandbox(context, loaded, preview, serviceRoutes, healthEvidence, images, status3) {
   const deploymentId = context.state.deploymentId;
@@ -13525,7 +14039,7 @@ async function recordSandbox(context, loaded, preview, serviceRoutes, healthEvid
       goal: preview.goal,
       status: status3,
       stack: loaded.manifest.name ?? context.state.repository,
-      deploymentType: preview.deploymentType,
+      deploymentType: preview.managedEnvironment,
       revisionId: deploymentId,
       generation: Date.now(),
       baseDomain: preview.baseDomain,
@@ -13553,7 +14067,7 @@ async function createEnvironmentSnapshot(context) {
     body: JSON.stringify({
       stack: context.state.repository,
       app: "*",
-      environmentId: context.state.environment
+      environmentId: managedEnvironmentId(context)
     })
   });
   const id2 = body.snapshot?.id;
@@ -13562,6 +14076,9 @@ async function createEnvironmentSnapshot(context) {
   }
   return id2;
 }
+function managedEnvironmentId(context) {
+  return context.state.managedEnvironment ?? context.state.environment;
+}
 async function releaseEnvironmentSnapshot(context, snapshotId) {
   await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/environment-snapshots/${snapshotId}`, { method: "DELETE" });
 }
@@ -13581,7 +14098,13 @@ async function destroyDeploymentById(context, deploymentId) {
       kind: "workspace.service.destroy",
       payload: {
         deploymentId,
-        placement: { hostId: context.state.deploymentHostId ?? context.state.hostId }
+        placement: context.state.deploymentWorkerId ? {
+          workerId: context.state.deploymentWorkerId,
+          requiredWorkerRole: context.state.runtimeMode === "development" ? "development" : "runtime"
+        } : {
+          hostId: context.state.deploymentHostId ?? context.state.hostId,
+          requiredWorkerRole: context.state.runtimeMode === "development" ? "development" : "runtime"
+        }
       },
       maxAttempts: 1
     })
@@ -13629,6 +14152,7 @@ async function importSource(input) {
   return {
     files: source.files,
     bytes: source.bundle.byteLength,
+    manifest: source.manifest,
     operation: await wait(input.apiUrl, input.apiKey, submitted.operation.id)
   };
 }
@@ -13651,6 +14175,10 @@ async function getContext(args, dependencies) {
   let state;
   try {
     state = JSON.parse(await readFile5(file, "utf8"));
+    if (!state.workerId && state.hostId)
+      state.workerId = state.hostId;
+    if (!state.workerId)
+      throw new Error("sandbox state has no bound worker");
   } catch {
     throw new Error(`sandbox '${environment}' does not exist; use sandbox create or up`);
   }
@@ -13674,8 +14202,10 @@ async function request(apiUrl, apiKey, pathname, init = {}) {
     headers.set("content-type", "application/json");
   const response = await fetchWithRetry(`${apiUrl}${pathname}`, { ...init, headers });
   const body = await response.json().catch(() => ({}));
-  if (!response.ok)
-    throw new Error(String(body.error ?? `Sandblocks request failed (${response.status})`));
+  if (!response.ok) {
+    const placement = body.placement ? `: ${JSON.stringify(body.placement)}` : "";
+    throw new Error(`${String(body.error ?? `Sandblocks request failed (${response.status})`)}${placement}`);
+  }
   return body;
 }
 async function leaseRequest(context, pathname, init = {}) {
@@ -13781,7 +14311,7 @@ async function loadLocalEnvironment(root) {
   }
 }
 async function applyManagedRoutingPolicy(context, stack, preview) {
-  const body = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/routing-policies/${encodeURIComponent(stack)}/${encodeURIComponent(preview.deploymentType)}`);
+  const body = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/routing-policies/${encodeURIComponent(stack)}/${encodeURIComponent(preview.managedEnvironment)}`);
   const policy = body.policy;
   const primaryDomains = Object.fromEntries(Object.entries(policy.domains ?? {}).flatMap(([service, domains]) => {
     const domain = Array.isArray(domains) ? domains[0] : domains;
@@ -13801,7 +14331,7 @@ function expectedPreviewServiceUrls(sandboxId, deploymentId, stack, preview) {
     const name = service.id.toUpperCase().replace(/[^A-Z0-9]/g, "_");
     const host = resolvedServiceDomain(sandboxId, deploymentId, service.id, preview);
     const configuredStableHosts = preview.stableDomains[service.id];
-    const stableHost = (Array.isArray(configuredStableHosts) ? configuredStableHosts[0] : configuredStableHosts) ?? `${preview.deploymentType}-${stack}-${service.id}.${preview.baseDomain}`;
+    const stableHost = (Array.isArray(configuredStableHosts) ? configuredStableHosts[0] : configuredStableHosts) ?? `${preview.managedEnvironment}-${stack}-${service.id}.${preview.baseDomain}`;
     return [
       [`SANDBLOCKS_SERVICE_${name}_URL`, `https://${host}`],
       [`SANDBLOCKS_STABLE_SERVICE_${name}_URL`, `https://${stableHost}`]
@@ -13809,7 +14339,7 @@ function expectedPreviewServiceUrls(sandboxId, deploymentId, stack, preview) {
   }));
 }
 async function managedServiceDomains(context, stack, preview, deploymentId) {
-  const body = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/routing-policies/${encodeURIComponent(stack)}/${encodeURIComponent(preview.deploymentType)}`);
+  const body = await request(context.apiUrl, context.apiKey, `/v1/projects/${encodeURIComponent(context.state.projectId)}/routing-policies/${encodeURIComponent(stack)}/${encodeURIComponent(preview.managedEnvironment)}`);
   const domains = body.policy.domains ?? {};
   return Object.keys(domains).length ? domains : resolvedServiceDomains(context.state.sandboxId, deploymentId, preview);
 }
@@ -13820,7 +14350,7 @@ function resolvedServiceDomains(sandboxId, deploymentId, preview) {
   ]));
 }
 function resolvedServiceDomain(sandboxId, deploymentId, service, preview) {
-  const routeId = `${sandboxId.replaceAll("-", "").slice(0, 8)}-${createHash2("sha256").update(`${sandboxId}/${deploymentId}/${service}`).digest("hex").slice(0, 8)}`;
+  const routeId = `${sandboxId.replaceAll("-", "").slice(0, 8)}-${createHash2("sha256").update(`${sandboxId}/${service}`).digest("hex").slice(0, 8)}`;
   const template = preview.domains[service] ?? `{route}.${preview.baseDomain}`;
   return template.replaceAll("{route}", routeId).replaceAll("{sandbox}", sandboxId.replaceAll("-", "").slice(0, 8)).replaceAll("{revision}", deploymentId.replaceAll("-", "").slice(0, 8)).replaceAll("{service}", service).toLowerCase();
 }
@@ -15120,7 +15650,16 @@ var HELP = `Sandblocks CLI
   sandblocks secret <list|set|delete> --project <id> --stack <id> --app <id>
                     [--environment <id>] [--name <name>] [--value <value>] [--id <id>] [--json]
   sandblocks artifact push <directory> --project <id> --stack <id> [--pool <pool>] [--json]
+  sandblocks worker <list|create|rotate-secret|drain|resume|approve-update> --organization <id>
+                    [--worker <uuid>] [--name <name>] [--type <build|deployment>]
+                    [--pool-id <uuid>] [--project <id>] [--version <version>] [--json]
+  sandblocks registry <list|create|assign> --organization <id> [--project <id>]
+                    [--name <name>] [--endpoint <url>] [--registry <uuid>]
+                    [--purpose <build-cache|artifact-publication|deployment-pull>] [--json]
   sandblocks sandbox up [directory] [--environment <id>] [--project <id>] [--build-pool <pool>]
+  sandblocks sandbox dev [directory] [--environment <id>] [--checks <smoke|full|none>]
+  sandblocks sandbox sync [directory] [--environment <id>] [--watch] [--checks <smoke|full|none>]
+  sandblocks sandbox check [directory] [--environment <id>] [--profile <smoke|full>]
   sandblocks sandbox create [directory] [--environment <id>] [--project <id>]
   sandblocks sandbox deploy [directory] [--environment <id>] [--build-pool <pool>]
                            [--artifact <image@sha256:digest>] [--deployment-id <uuid>] [--resume]
@@ -15179,10 +15718,7 @@ async function run3(argv = process.argv.slice(2)) {
         parse: parse2,
         option: option2,
         load,
-        source: async (root) => {
-          const bundle = await createSourceTar(root);
-          return { bundle, files: sourceFileCount };
-        }
+        source: createSourceTar
       })
     });
   else if (command === "runtime")
@@ -15193,6 +15729,10 @@ async function run3(argv = process.argv.slice(2)) {
     await secret(args);
   else if (command === "artifact")
     await artifact(args);
+  else if (command === "worker")
+    await worker(args);
+  else if (command === "registry")
+    await registry(args);
   else if (command === "sandbox")
     await sandbox(args);
   else if (command === "sdk")
@@ -15303,21 +15843,21 @@ async function doctor(args) {
         { label: "artifact publish", kind: "workspace.artifact.publish", role: "build", memory: 1024 ** 3 },
         { label: "service deploy", kind: "workspace.service.deploy", role: "runtime", memory: 6 * 1024 ** 3 }
       ];
-      const explanations = await Promise.all(checks.map(async (check) => {
+      const explanations = await Promise.all(checks.map(async (check2) => {
         const query = new URLSearchParams({
-          kind: check.kind,
-          role: check.role,
-          memoryReservationBytes: String(check.memory)
+          kind: check2.kind,
+          role: check2.role,
+          memoryReservationBytes: String(check2.memory)
         });
         const result = await sandblocksRequest(apiUrl, apiKey, `/v1/projects/${encodeURIComponent(projectId)}/placement/explain?${query}`);
-        return { ...check, explanation: result.explanation };
+        return { ...check2, explanation: result.explanation };
       }));
       if (options.json)
         console.log(JSON.stringify({ projectId, explanations }, null, 2));
       else
-        for (const check of explanations) {
-          const explanation = objectRecord(check.explanation);
-          console.log(`${check.label.padEnd(16)} ${explanation.eligible ? "eligible" : "blocked"}`);
+        for (const check2 of explanations) {
+          const explanation = objectRecord(check2.explanation);
+          console.log(`${check2.label.padEnd(16)} ${explanation.eligible ? "eligible" : "blocked"}`);
           if (!explanation.eligible && Array.isArray(explanation.candidates))
             for (const candidate of explanation.candidates) {
               const row = objectRecord(candidate);
@@ -15479,6 +16019,102 @@ async function artifact(args) {
     console.log(`deploy with: sandblocks sandbox deploy . --artifact ${result.image} --deployment-id ${result.deploymentId}`);
   }
 }
+async function worker(args) {
+  const [action = "list", ...rest] = args;
+  const options = parse2(rest);
+  const organizationId = option2(options, "organization");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  if (!organizationId)
+    throw new Error("worker command requires --organization");
+  if (!apiUrl || !apiKey)
+    throw new Error("worker command requires Sandblocks API URL and key");
+  const client2 = new SandblocksClient({ baseUrl: apiUrl, apiKey });
+  let body;
+  if (action === "list")
+    body = await client2.listWorkers(organizationId);
+  else if (action === "create") {
+    const name = option2(options, "name");
+    const type = option2(options, "type");
+    if (!name || type !== "build" && type !== "deployment")
+      throw new Error("worker create requires --name and --type build|deployment");
+    body = await client2.createWorker({
+      organizationId,
+      name,
+      type,
+      ...option2(options, "pool-id") ? { poolId: option2(options, "pool-id") } : {},
+      ...option2(options, "project") ? { projectIds: [option2(options, "project")] } : {}
+    });
+  } else {
+    const workerId = option2(options, "worker");
+    if (!workerId)
+      throw new Error(`worker ${action} requires --worker`);
+    if (action === "rotate-secret")
+      body = await client2.rotateWorkerSecret(organizationId, workerId);
+    else if (action === "move") {
+      const targetWorkerIds = (option2(options, "target-workers") ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+      if (!targetWorkerIds.length)
+        throw new Error("worker move requires --target-workers <id,id,...>");
+      body = await sandblocksRequest(apiUrl, apiKey, `/v1/organizations/${encodeURIComponent(organizationId)}/workers/${encodeURIComponent(workerId)}/move`, { method: "POST", body: JSON.stringify({ targetWorkerIds }) });
+    } else if (action === "approve-update") {
+      const version = option2(options, "version");
+      if (!version)
+        throw new Error("worker approve-update requires --version");
+      body = await client2.approveWorkerUpdate(organizationId, workerId, version);
+    } else if (action === "drain" || action === "resume")
+      body = await sandblocksRequest(apiUrl, apiKey, `/v1/organizations/${encodeURIComponent(organizationId)}/workers/${encodeURIComponent(workerId)}/${action}`, { method: "POST" });
+    else
+      throw new Error(`unsupported worker command '${action}'`);
+  }
+  if (options.json || action !== "list")
+    console.log(JSON.stringify(body, null, 2));
+  else
+    for (const candidate of Array.isArray(body.workers) ? body.workers : []) {
+      const row = objectRecord(candidate);
+      console.log(`${row.id ?? "unknown"}	${row.name ?? "unknown"}	${row.type ?? "unknown"}	${row.state ?? "unknown"}`);
+    }
+}
+async function registry(args) {
+  const [action = "list", ...rest] = args;
+  const options = parse2(rest);
+  const organizationId = option2(options, "organization");
+  const apiUrl = (option2(options, "api-url") ?? process.env.SANDBLOCKS_API_URL ?? "").replace(/\/$/, "");
+  const apiKey = option2(options, "api-key") ?? process.env.SANDBLOCKS_API_KEY;
+  if (!organizationId)
+    throw new Error("registry command requires --organization");
+  if (!apiUrl || !apiKey)
+    throw new Error("registry command requires Sandblocks API URL and key");
+  const client2 = new SandblocksClient({ baseUrl: apiUrl, apiKey });
+  let body;
+  if (action === "list")
+    body = await client2.listRegistries(organizationId);
+  else if (action === "create") {
+    const name = option2(options, "name");
+    const endpoint = option2(options, "endpoint");
+    if (!name || !endpoint)
+      throw new Error("registry create requires --name and --endpoint");
+    body = await client2.createRegistry({ organizationId, name, endpoint });
+  } else if (action === "assign") {
+    const projectId = option2(options, "project");
+    const registryId = option2(options, "registry");
+    const purpose = option2(options, "purpose");
+    if (!projectId || !registryId || !["build-cache", "artifact-publication", "deployment-pull"].includes(purpose ?? ""))
+      throw new Error("registry assign requires --project, --registry, and a valid --purpose");
+    body = await client2.assignProjectRegistry(projectId, {
+      purpose,
+      registryId,
+      ...option2(options, "repository-prefix") ? { repositoryPrefix: option2(options, "repository-prefix") } : {}
+    });
+  } else
+    throw new Error(`unsupported registry command '${action}'`);
+  if (options.json || action !== "list")
+    console.log(JSON.stringify(body, null, 2));
+  else
+    for (const candidate of Array.isArray(body.registries) ? body.registries : []) {
+      const row = objectRecord(candidate);
+      console.log(`${row.id ?? "unknown"}	${row.name ?? "unknown"}	${row.endpoint ?? "unknown"}`);
+    }
+}
 function printResources(kind, action, body) {
   if (action === "settings") {
     console.log(JSON.stringify(body.settings ?? {}, null, 2));
@@ -15505,10 +16141,7 @@ async function sandbox(args) {
       parse: parse2,
       option: option2,
       load,
-      source: async (root2) => {
-        const bundle2 = await createSourceTar(root2);
-        return { bundle: bundle2, files: sourceFileCount };
-      }
+      source: createSourceTar
     });
   }
   if (subcommand === "deploy")
@@ -15533,7 +16166,8 @@ async function sandbox(args) {
     throw new Error("sandbox import requires --api-url or SANDBLOCKS_API_URL");
   if (!apiKey)
     throw new Error("sandbox import requires --api-key or SANDBLOCKS_API_KEY");
-  const bundle = await createSourceTar(root);
+  const source = await createSourceTar(root);
+  const bundle = source.bundle;
   const response = await fetch(`${apiUrl}/v1/projects/${encodeURIComponent(projectId)}/workspaces/import`, {
     method: "POST",
     headers: {
@@ -15550,11 +16184,11 @@ async function sandbox(args) {
   if (!response.ok)
     throw new Error(String(submitted.error ?? `sandbox import failed (${response.status})`));
   const operation = options.wait ? await waitForOperation(apiUrl, apiKey, String(submitted.operation.id)) : submitted.operation;
-  const output = { workspaceId, files: sourceFileCount, bytes: bundle.byteLength, operation };
+  const output = { workspaceId, files: source.files, bytes: bundle.byteLength, operation };
   if (options.json)
     console.log(JSON.stringify(output, null, 2));
   else {
-    console.log(`source    ${sourceFileCount} files (${bundle.byteLength} bytes)`);
+    console.log(`source    ${source.files} files (${bundle.byteLength} bytes)`);
     console.log(`workspace ${workspaceId}`);
     console.log(`operation ${operation.id} (${operation.state})`);
     if (operation.result?.container)
@@ -15647,7 +16281,6 @@ async function sandboxPromote(args) {
   else
     console.log(`promoted ${sandboxId} to production`);
 }
-var sourceFileCount = 0;
 async function createPrebuiltTar(root) {
   const names = [];
   const visit2 = async (directory, prefix = "") => {
@@ -15693,7 +16326,7 @@ async function createPrebuiltTar(root) {
   }
   return output;
 }
-async function createSourceTar(root) {
+async function createSourceTar(root, previous) {
   const process2 = Bun.spawn(["git", "ls-files", "-z", "--cached", "--others", "--exclude-standard"], {
     cwd: root,
     stdout: "pipe",
@@ -15714,6 +16347,7 @@ async function createSourceTar(root) {
   if (names.length > 20000)
     throw new Error("local source contains more than 20000 files");
   const chunks = [];
+  const manifest = {};
   let total = 1024;
   for (const name of names) {
     if (name.includes("\x00") || name.includes("\\") || name.startsWith("/") || name.split("/").includes("..")) {
@@ -15733,6 +16367,11 @@ async function createSourceTar(root) {
     if (!info.isFile())
       continue;
     const contents = new Uint8Array(await readFile8(file));
+    const mode = info.mode & 511;
+    const sha256 = createHash3("sha256").update(contents).digest("hex");
+    manifest[name] = { sha256, mode, bytes: contents.byteLength };
+    if (previous?.[name]?.sha256 === sha256 && previous[name]?.mode === mode)
+      continue;
     const header = tarHeader(name, contents.byteLength, info.mode, Math.floor(info.mtimeMs / 1000));
     const padding = (512 - contents.byteLength % 512) % 512;
     total += 512 + contents.byteLength + padding;
@@ -15740,9 +16379,15 @@ async function createSourceTar(root) {
       throw new Error("local source bundle exceeds 256 MiB");
     chunks.push(header, contents, new Uint8Array(padding));
   }
-  sourceFileCount = chunks.length / 3;
-  if (!sourceFileCount)
+  if (!Object.keys(manifest).length)
     throw new Error("local directory has no regular source files");
+  if (previous) {
+    const contents = new TextEncoder().encode(JSON.stringify({ version: 1, files: manifest }));
+    const name = ".sandblocks-sync-manifest.json";
+    const padding = (512 - contents.byteLength % 512) % 512;
+    total += 512 + contents.byteLength + padding;
+    chunks.push(tarHeader(name, contents.byteLength, 384, Math.floor(Date.now() / 1000)), contents, new Uint8Array(padding));
+  }
   chunks.push(new Uint8Array(1024));
   const output = new Uint8Array(total);
   let offset = 0;
@@ -15750,7 +16395,7 @@ async function createSourceTar(root) {
     output.set(chunk, offset);
     offset += chunk.byteLength;
   }
-  return output;
+  return { bundle: output, files: Object.keys(manifest).length, manifest };
 }
 async function gitIgnoredFiles(root, names) {
   if (!names.length)
@@ -15936,7 +16581,8 @@ function parse2(args) {
       "allow-host",
       "rootless",
       "allow-unpinned-images",
-      "read-only-root"
+      "read-only-root",
+      "resume"
     ].includes(rawKey)) {
       output[rawKey] = inline === undefined ? true : inline !== "false";
       continue;
@@ -16003,4 +16649,4 @@ export {
   parse2 as parse
 };
 
-//# debugId=E7F4E37BF2F49E8E64756E2164756E21
+//# debugId=4AF73097AAEEBCD964756E2164756E21