@tensorlakeai/tensorlake 0.5.151 → 0.5.153

package/dist/sandbox-image.js

@@ -40,1179 +40,6 @@ var init_esm_shims = __esm({
   }
 });
 
-// src/defaults.ts
-var SDK_VERSION, API_URL, API_KEY, NAMESPACE, SANDBOX_PROXY_URL, DEFAULT_HTTP_TIMEOUT_MS, MAX_RETRIES, RETRY_BACKOFF_MS;
-var init_defaults = __esm({
-  "src/defaults.ts"() {
-    "use strict";
-    init_esm_shims();
-    SDK_VERSION = "0.5.151";
-    API_URL = process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai";
-    API_KEY = process.env.TENSORLAKE_API_KEY ?? void 0;
-    NAMESPACE = process.env.INDEXIFY_NAMESPACE ?? "default";
-    SANDBOX_PROXY_URL = process.env.TENSORLAKE_SANDBOX_PROXY_URL ?? "https://sandbox.tensorlake.ai";
-    DEFAULT_HTTP_TIMEOUT_MS = 3e5;
-    MAX_RETRIES = 3;
-    RETRY_BACKOFF_MS = 500;
-  }
-});
-
-// src/models.ts
-function snakeToCamel(str) {
-  return str.replace(/_([a-z])/g, (_, ch) => ch.toUpperCase());
-}
-function parseTimestamp(v) {
-  if (v == null) return void 0;
-  if (v instanceof Date) return v;
-  if (typeof v === "string") {
-    const parsed = Date.parse(v);
-    return Number.isNaN(parsed) ? void 0 : new Date(parsed);
-  }
-  const ts = Number(v);
-  if (isNaN(ts)) return void 0;
-  if (ts > 1e15) return new Date(ts / 1e3);
-  if (ts > 1e12) return new Date(ts);
-  return new Date(ts * 1e3);
-}
-function fromSnakeKeys(obj, idField) {
-  if (Array.isArray(obj))
-    return obj.map((item) => fromSnakeKeys(item, idField));
-  if (obj !== null && typeof obj === "object" && !(obj instanceof Date)) {
-    const result = {};
-    for (const [k, v] of Object.entries(obj)) {
-      let key;
-      if (k === "id" && idField) {
-        key = idField;
-      } else {
-        key = snakeToCamel(k);
-      }
-      if (key.endsWith("At") || key === "timestamp" || key === "startedAt" || key === "endedAt") {
-        result[key] = parseTimestamp(v);
-      } else if (typeof v === "object" && v !== null && !Array.isArray(v)) {
-        result[key] = fromSnakeKeys(v);
-      } else if (Array.isArray(v)) {
-        result[key] = v.map((item) => fromSnakeKeys(item));
-      } else {
-        result[key] = v === null ? void 0 : v;
-      }
-    }
-    return result;
-  }
-  return obj;
-}
-var CommandExitReason;
-var init_models = __esm({
-  "src/models.ts"() {
-    "use strict";
-    init_esm_shims();
-    CommandExitReason = /* @__PURE__ */ ((CommandExitReason2) => {
-      CommandExitReason2["EXITED"] = "exited";
-      CommandExitReason2["SIGNALED"] = "signaled";
-      CommandExitReason2["OOM_KILLED"] = "oom_killed";
-      CommandExitReason2["TIMED_OUT"] = "timed_out";
-      return CommandExitReason2;
-    })(CommandExitReason || {});
-  }
-});
-
-// src/errors.ts
-function formatErrorDetails(errorDetails) {
-  if (errorDetails == null) return void 0;
-  if (typeof errorDetails === "string") {
-    const detail = errorDetails.trim();
-    return detail || void 0;
-  }
-  if (Array.isArray(errorDetails)) {
-    const parts = errorDetails.map((item) => formatErrorDetails(item)).filter((item) => Boolean(item));
-    return parts.length > 0 ? parts.join("; ") : JSON.stringify(errorDetails);
-  }
-  if (typeof errorDetails === "object") {
-    for (const key of ["message", "detail", "error", "reason"]) {
-      const value = errorDetails[key];
-      if (typeof value === "string" && value.trim()) {
-        return value.trim();
-      }
-    }
-    return JSON.stringify(errorDetails);
-  }
-  return String(errorDetails);
-}
-var SandboxException, SandboxError, SandboxResizeError, SandboxConnectionError, SandboxNotFoundError, PoolNotFoundError, PoolInUseError, RemoteAPIError;
-var init_errors = __esm({
-  "src/errors.ts"() {
-    "use strict";
-    init_esm_shims();
-    SandboxException = class extends Error {
-      constructor(message) {
-        super(message);
-        this.name = "SandboxException";
-      }
-    };
-    SandboxError = class extends SandboxException {
-      reason;
-      sandboxId;
-      constructor(message, options) {
-        super(message);
-        this.name = "SandboxError";
-        if (options?.reason !== void 0) this.reason = options.reason;
-        if (options?.sandboxId !== void 0) this.sandboxId = options.sandboxId;
-      }
-    };
-    SandboxResizeError = class extends SandboxError {
-      generation;
-      info;
-      constructor(payload) {
-        const resources = payload.info?.resources;
-        const allocation = resources ? `${resources.cpus} CPUs, ${resources.memoryMb} MiB memory, ${resources.diskMb} MiB disk` : "unavailable";
-        super(
-          `Sandbox ${payload.sandboxId} resize generation ${payload.generation}: ${payload.message}; last confirmed allocation: ${allocation}`,
-          { reason: payload.reason, sandboxId: payload.sandboxId }
-        );
-        this.name = "SandboxResizeError";
-        this.generation = payload.generation;
-        this.info = payload.info ?? void 0;
-      }
-      /** Last confirmed allocation, if an observation was available. */
-      get confirmedResources() {
-        return this.info?.resources;
-      }
-    };
-    SandboxConnectionError = class extends SandboxError {
-      constructor(message, options) {
-        super(`Connection error: ${message}`);
-        this.name = "SandboxConnectionError";
-        if (options?.cause !== void 0) this.cause = options.cause;
-      }
-    };
-    SandboxNotFoundError = class extends SandboxError {
-      constructor(sandboxId) {
-        super(`Sandbox not found: ${sandboxId}`, { sandboxId });
-        this.name = "SandboxNotFoundError";
-      }
-    };
-    PoolNotFoundError = class extends SandboxError {
-      poolId;
-      constructor(poolId) {
-        super(`Sandbox pool not found: ${poolId}`);
-        this.name = "PoolNotFoundError";
-        this.poolId = poolId;
-      }
-    };
-    PoolInUseError = class extends SandboxError {
-      poolId;
-      constructor(poolId, message) {
-        const base = `Cannot delete pool ${poolId}: pool is in use`;
-        super(message ? `${base} - ${message}` : base);
-        this.name = "PoolInUseError";
-        this.poolId = poolId;
-      }
-    };
-    RemoteAPIError = class extends SandboxError {
-      statusCode;
-      /** Original response body, retained for compatibility and diagnostics. */
-      responseMessage;
-      errorDetails;
-      constructor(statusCode, message) {
-        let failure;
-        try {
-          const payload = JSON.parse(message);
-          if (payload && typeof payload === "object" && !Array.isArray(payload)) {
-            const record = payload;
-            if (typeof record.sandbox_id === "string" && record.sandbox_id.trim() && (record.status === "failed" || record.status === "terminated"))
-              failure = record;
-          }
-        } catch {
-        }
-        const sandboxId = failure?.sandbox_id;
-        const rawReason = failure?.reason ?? failure?.termination_reason;
-        const reason = typeof rawReason === "string" ? rawReason : void 0;
-        const errorDetails = failure?.error_details;
-        let displayMessage = message;
-        if (failure) {
-          displayMessage = `Sandbox ${sandboxId} ${failure.status}`;
-          if (reason) displayMessage += ` (${reason})`;
-          const detail = formatErrorDetails(errorDetails);
-          if (detail) displayMessage += `: ${detail}`;
-          if (!reason && !detail) displayMessage = message;
-        }
-        super(`API error (status ${statusCode}): ${displayMessage}`, {
-          reason,
-          sandboxId
-        });
-        this.errorDetails = errorDetails;
-        this.name = "RemoteAPIError";
-        this.statusCode = statusCode;
-        this.responseMessage = message;
-      }
-    };
-  }
-});
-
-// src/native-worker-protocol.ts
-var cancelNativeCall, closeNativeHandle;
-var init_native_worker_protocol = __esm({
-  "src/native-worker-protocol.ts"() {
-    "use strict";
-    init_esm_shims();
-    cancelNativeCall = /* @__PURE__ */ Symbol.for("tensorlake.native.cancel.v1");
-    closeNativeHandle = /* @__PURE__ */ Symbol.for("tensorlake.native.close.v1");
-  }
-});
-
-// src/url.ts
-function trimTrailingSlashes(url) {
-  return url.endsWith("/") ? url.slice(0, -1) : url;
-}
-function resolveProxyTarget(proxyUrl, sandboxId) {
-  try {
-    const parsed = new URL(proxyUrl);
-    const host = parsed.hostname;
-    if (host === "localhost" || host === "127.0.0.1") {
-      return {
-        baseUrl: trimTrailingSlashes(proxyUrl),
-        hostHeader: `${sandboxId}.local`,
-        sandboxIdHeader: void 0
-      };
-    }
-    const port = parsed.port ? `:${parsed.port}` : "";
-    return {
-      baseUrl: `${parsed.protocol}//${host}${port}`,
-      hostHeader: void 0,
-      sandboxIdHeader: sandboxId
-    };
-  } catch {
-    return {
-      baseUrl: `${trimTrailingSlashes(proxyUrl)}/${sandboxId}`,
-      hostHeader: void 0,
-      sandboxIdHeader: void 0
-    };
-  }
-}
-var init_url = __esm({
-  "src/url.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_defaults();
-  }
-});
-
-// src/native-worker-client.ts
-import { createRequire } from "module";
-import { Worker } from "worker_threads";
-function createWorkerBinding(runtime) {
-  return {
-    NativeCloudClient: class {
-      constructor(...args) {
-        return runtime.handle("NativeCloudClient", args);
-      }
-    },
-    NativeSandboxClient: class {
-      constructor(...args) {
-        return runtime.handle("NativeSandboxClient", args);
-      }
-    },
-    NativeSandboxProxyClient: class {
-      constructor(...args) {
-        return runtime.handle("NativeSandboxProxyClient", args);
-      }
-    },
-    NativeRepositoryClient: class {
-      constructor(...args) {
-        return runtime.handle("NativeRepositoryClient", args);
-      }
-    },
-    validateManagedName: (name) => runtime.call(void 0, "validateManagedName", [name])
-  };
-}
-function workerBinding() {
-  return createWorkerBinding(
-    runtimes[runtimeKey] ??= new NativeWorkerClient()
-  );
-}
-function releaseNativeHandle(handle) {
-  handle?.[closeNativeHandle]?.();
-}
-var NativeWorkerClient, runtimeKey, runtimes;
-var init_native_worker_client = __esm({
-  "src/native-worker-client.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_native_worker_protocol();
-    init_url();
-    NativeWorkerClient = class {
-      constructor(workerPath = () => createRequire(import.meta.url).resolve(
-        "@tensorlakeai/tensorlake/internal/native-worker"
-      )) {
-        this.workerPath = workerPath;
-      }
-      worker;
-      nextId = 1;
-      registered = /* @__PURE__ */ new Set();
-      pending = /* @__PURE__ */ new Map();
-      finalizers = new FinalizationRegistry(
-        (id) => this.release(id)
-      );
-      handle(kind, args, parent) {
-        const handle = { id: this.nextId++, kind, args, parent };
-        this.finalizers.register(handle, handle.id);
-        let closed = false;
-        return new Proxy(
-          {},
-          {
-            get: (_target, method) => {
-              if (method === "then") return void 0;
-              if (method === closeNativeHandle)
-                return () => {
-                  closed = true;
-                  this.release(handle.id);
-                };
-              if (method === "connectProxy")
-                return (...proxyArgs) => {
-                  if (closed) throw new Error("Tensorlake native client is closed");
-                  return this.handle("NativeSandboxProxyClient", proxyArgs, handle);
-                };
-              if (method === "baseUrl")
-                return () => resolveProxyTarget(String(args[0]), String(args[1])).baseUrl;
-              if (typeof method !== "string") return void 0;
-              return (...callArgs) => {
-                if (closed)
-                  return Promise.reject(
-                    new Error("Tensorlake native client is closed")
-                  );
-                const emit = typeof callArgs.at(-1) === "function" ? callArgs.pop() : void 0;
-                return this.call(handle, method, callArgs, emit);
-              };
-            }
-          }
-        );
-      }
-      call(handle, method, args, emit) {
-        const id = this.nextId++;
-        let worker;
-        const promise = new Promise((resolve, reject) => {
-          try {
-            worker = this.getWorker();
-            this.pending.set(id, { resolve, reject, emit, handle });
-            worker.ref();
-            if (handle) this.register(handle, worker);
-            this.send(worker, {
-              type: "call",
-              id,
-              handleId: handle?.id,
-              method,
-              args,
-              stream: !!emit
-            });
-          } catch (error) {
-            this.pending.delete(id);
-            this.unrefIfIdle();
-            reject(error);
-          }
-        });
-        promise[cancelNativeCall] = () => {
-          const pending = this.pending.get(id);
-          if (pending && worker) {
-            pending.emit = void 0;
-            this.send(worker, { type: "cancel", id });
-          }
-        };
-        return promise;
-      }
-      getWorker() {
-        if (this.worker) return this.worker;
-        const worker = new Worker(this.workerPath(), {
-          // The bundled worker needs no application loaders or telemetry preloads.
-          // NODE_OPTIONS is parsed independently of execArgv by Node.
-          execArgv: [],
-          env: { ...process.env, NODE_OPTIONS: "" },
-          name: "tensorlake-native"
-        });
-        this.worker = worker;
-        worker.on("message", (message) => {
-          const pending = this.pending.get(message.id);
-          if (!pending || this.worker !== worker) return;
-          if (message.type === "event") {
-            Promise.resolve().then(() => pending.emit?.(message.value)).then(
-              () => {
-                if (this.worker === worker)
-                  this.send(worker, { type: "ack", id: message.id });
-              },
-              (error) => {
-                this.send(worker, { type: "cancel", id: message.id });
-                pending.reject(error);
-              }
-            );
-            return;
-          }
-          this.pending.delete(message.id);
-          if (message.type === "error") {
-            const error = new Error(message.error.message);
-            error.name = message.error.name;
-            error.stack = message.error.stack ?? error.stack;
-            pending.reject(error);
-          } else {
-            pending.resolve(message.value);
-          }
-          this.unrefIfIdle();
-        });
-        const fail = (error) => {
-          if (this.worker !== worker) return;
-          this.worker = void 0;
-          this.registered.clear();
-          for (const pending of this.pending.values()) pending.reject(error);
-          this.pending.clear();
-          void worker.terminate();
-        };
-        worker.on("error", fail);
-        worker.on("messageerror", fail);
-        worker.on(
-          "exit",
-          (code) => fail(
-            new Error(
-              `Tensorlake native worker exited (${code}); in-flight operations were not retried`
-            )
-          )
-        );
-        worker.unref();
-        return worker;
-      }
-      register(handle, worker) {
-        if (this.registered.has(handle.id)) return;
-        if (handle.parent) this.register(handle.parent, worker);
-        this.send(worker, {
-          type: "create",
-          handle: { id: handle.id, kind: handle.kind, args: handle.args },
-          parentId: handle.parent?.id
-        });
-        this.registered.add(handle.id);
-      }
-      release(handleId) {
-        if (this.worker && this.registered.delete(handleId))
-          this.send(this.worker, { type: "release", handleId });
-      }
-      send(worker, message) {
-        worker.postMessage(message);
-      }
-      unrefIfIdle() {
-        if (this.pending.size === 0) this.worker?.unref();
-      }
-    };
-    runtimeKey = /* @__PURE__ */ Symbol.for(
-      `tensorlake.native.worker.${false ? "source" : "0.5.151"}.v1`
-    );
-    runtimes = globalThis;
-  }
-});
-
-// src/native-sandbox.ts
-function loadNativeSandboxBinding() {
-  return cachedBinding ??= workerBinding();
-}
-function parseNativeError(error) {
-  const message = error instanceof Error ? error.message : typeof error === "string" ? error : "";
-  if (!message) return null;
-  try {
-    const parsed = JSON.parse(message);
-    if (parsed && typeof parsed.category === "string") {
-      return {
-        category: parsed.category,
-        status: typeof parsed.status === "number" ? parsed.status : null,
-        message: typeof parsed.message === "string" ? parsed.message : message
-      };
-    }
-  } catch {
-  }
-  return null;
-}
-function translateNativeError(error, context) {
-  const payload = parseNativeError(error);
-  if (!payload) {
-    if (error instanceof Error) return error;
-    return new SandboxError(String(error));
-  }
-  const { category, status, message } = payload;
-  if (category === "resize") {
-    return new SandboxResizeError(
-      fromSnakeKeys(JSON.parse(message), "sandboxId")
-    );
-  }
-  if (category === "connection") {
-    return new SandboxConnectionError(message, { cause: error });
-  }
-  if (status === 404) {
-    if (context?.notFoundKind === "pool" && context.poolId) {
-      return new PoolNotFoundError(context.poolId);
-    }
-    if (context?.notFoundKind === "sandbox" && context.sandboxId) {
-      return new SandboxNotFoundError(context.sandboxId);
-    }
-    return new RemoteAPIError(404, message);
-  }
-  if (status === 409 && context?.poolId) {
-    return new PoolInUseError(context.poolId, message);
-  }
-  if (typeof status === "number") {
-    return new RemoteAPIError(status, message);
-  }
-  return new SandboxError(message);
-}
-async function callNative(fn, context) {
-  try {
-    return await fn();
-  } catch (error) {
-    throw translateNativeError(error, context);
-  }
-}
-async function* nativeEventStream(start, context, signal) {
-  if (signal?.aborted) return;
-  const queue = [];
-  let wake;
-  let finished = false;
-  let stopped = false;
-  let failure;
-  const notify = () => {
-    const resolve = wake;
-    wake = void 0;
-    resolve?.();
-  };
-  const emit = (value) => {
-    if (stopped) return Promise.resolve();
-    return new Promise((consumed) => {
-      queue.push({ value, consumed });
-      notify();
-    });
-  };
-  let call;
-  const onAbort = () => {
-    stopped = true;
-    call?.[cancelNativeCall]?.();
-    notify();
-  };
-  signal?.addEventListener("abort", onAbort, { once: true });
-  try {
-    call = start(emit);
-    void call.catch((error) => {
-      failure = error;
-    }).finally(() => {
-      finished = true;
-      notify();
-    });
-    while (!stopped) {
-      const event = queue.shift();
-      if (event) {
-        try {
-          yield JSON.parse(event.value);
-        } finally {
-          event.consumed();
-        }
-      } else if (finished) {
-        break;
-      } else {
-        await new Promise((resolve) => {
-          wake = resolve;
-        });
-      }
-    }
-    if (!stopped && failure !== void 0) throw translateNativeError(failure, context);
-  } finally {
-    stopped = true;
-    signal?.removeEventListener("abort", onAbort);
-    call?.[cancelNativeCall]?.();
-    for (const event of queue) event.consumed();
-  }
-}
-var cachedBinding, KNOWN_EXIT_REASONS;
-var init_native_sandbox = __esm({
-  "src/native-sandbox.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_models();
-    init_errors();
-    init_native_worker_client();
-    init_native_worker_protocol();
-    KNOWN_EXIT_REASONS = new Set(Object.values(CommandExitReason));
-  }
-});
-
-// src/native-cloud.ts
-async function serializeRequest(method, path4, options) {
-  const headers = { ...options?.headers };
-  let body = options?.body;
-  if (options?.json !== void 0) {
-    body = JSON.stringify(options.json);
-    if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) {
-      headers["Content-Type"] = "application/json";
-    }
-  }
-  const request = {
-    method,
-    path: path4,
-    headersJson: JSON.stringify(headers),
-    statusOnlyCodes: [...options?.statusOnlyCodes ?? []]
-  };
-  if (body instanceof FormData) {
-    request.parts = [];
-    for (const [name, value] of body.entries()) {
-      request.parts.push(typeof value === "string" ? { name, data: Buffer.from(value) } : { name, data: Buffer.from(await value.arrayBuffer()), filename: value.name, contentType: value.type || "application/octet-stream" });
-    }
-  } else if (body !== void 0) {
-    if (body instanceof Blob) request.body = Buffer.from(await body.arrayBuffer());
-    else if (typeof body === "string") request.body = Buffer.from(body);
-    else if (body instanceof ArrayBuffer) request.body = Buffer.from(new Uint8Array(body));
-    else request.body = Buffer.from(body);
-  }
-  return request;
-}
-var NativeCloudTransport;
-var init_native_cloud = __esm({
-  "src/native-cloud.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_native_sandbox();
-    init_native_worker_client();
-    NativeCloudTransport = class {
-      constructor(options) {
-        this.options = options;
-        if (!Number.isSafeInteger(options.maxRetries) || options.maxRetries < 0 || options.maxRetries > 4294967295) {
-          throw new RangeError("maxRetries must be a non-negative 32-bit integer");
-        }
-        if (!Number.isFinite(options.retryBackoffMs) || options.retryBackoffMs < 0) {
-          throw new RangeError("retryBackoffMs must be a non-negative finite number");
-        }
-      }
-      native;
-      closed = false;
-      client() {
-        if (this.closed) throw new Error("Tensorlake native client is closed");
-        if (this.native) return this.native;
-        const ctor = loadNativeSandboxBinding().NativeCloudClient;
-        if (!ctor) throw new Error("Native binding does not export NativeCloudClient; rebuild with 'npm run build:native'");
-        return this.native = new ctor(JSON.stringify(this.options));
-      }
-      close() {
-        this.closed = true;
-        releaseNativeHandle(this.native ?? null);
-        this.native = void 0;
-      }
-      async requestResponse(method, path4, options) {
-        const request = await serializeRequest(method, path4, options);
-        const raw = await callNative(() => this.client().request(request));
-        const response = new Response(
-          [204, 205, 304].includes(raw.status) ? null : Uint8Array.from(raw.data).buffer,
-          { status: raw.status, headers: JSON.parse(raw.headersJson) }
-        );
-        return Object.assign(response, { traceId: raw.traceId });
-      }
-      async requestJson(method, path4) {
-        const response = await this.requestResponse(method, path4);
-        const text = await response.text();
-        const value = text ? JSON.parse(text) : null;
-        return Object.assign(value ?? {}, { traceId: response.traceId });
-      }
-      async *stream(method, path4, signal) {
-        if (signal?.aborted) return;
-        const request = await serializeRequest(method, path4, { headers: { Accept: "text/event-stream" } });
-        yield* nativeEventStream((emit) => this.client().stream(request, emit), void 0, signal);
-      }
-    };
-  }
-});
-
-// src/cloud-client.ts
-import { nanoid } from "nanoid";
-function secretFromMetadata(metadata) {
-  return {
-    id: metadata.id,
-    name: metadata.name,
-    createdAt: new Date(metadata.created_at_ms)
-  };
-}
-function applicationAllowsUnauthenticatedRequests(manifest) {
-  return Array.isArray(manifest.allow) && manifest.allow.includes(UNAUTHENTICATED_REQUESTS);
-}
-function publicEndpointIdFromManifest(manifest) {
-  for (const key of ["public_endpoint_id", "publicEndpointId"]) {
-    const value = manifest[key];
-    if (typeof value === "string" && value.length > 0) {
-      return value;
-    }
-  }
-  return void 0;
-}
-function generatePublicEndpointId() {
-  return `endpoint_${nanoid()}`;
-}
-function createApplicationBuildForm(request, imageContexts) {
-  const contextsByPartName = /* @__PURE__ */ new Map();
-  for (const context of imageContexts) {
-    if (contextsByPartName.has(context.contextTarPartName)) {
-      throw new Error(
-        `duplicate image context part name '${context.contextTarPartName}'`
-      );
-    }
-    contextsByPartName.set(context.contextTarPartName, context);
-  }
-  const form = new FormData();
-  form.append(
-    "app_version",
-    new Blob([JSON.stringify(request)], { type: "application/json" }),
-    "app_version"
-  );
-  for (const image of request.images) {
-    const context = contextsByPartName.get(image.contextTarPartName);
-    if (!context) {
-      throw new Error(
-        `missing image context for part '${image.contextTarPartName}'`
-      );
-    }
-    form.append(
-      image.contextTarPartName,
-      new Blob([toBlobPart(context.contextTarGz)]),
-      `${image.contextTarPartName}.tar.gz`
-    );
-  }
-  for (const context of imageContexts) {
-    if (!request.images.some((image) => image.contextTarPartName === context.contextTarPartName)) {
-      throw new Error(
-        `unexpected image context for part '${context.contextTarPartName}'`
-      );
-    }
-  }
-  return form;
-}
-function trimTrailingSlashes2(value) {
-  return value.endsWith("/") ? value.slice(0, -1) : value;
-}
-function nextRequestPath(next) {
-  const schemeIndex = next.indexOf("://");
-  if (schemeIndex !== -1) {
-    const afterScheme = next.slice(schemeIndex + 3);
-    const slashIndex = afterScheme.indexOf("/");
-    return slashIndex === -1 ? "/" : afterScheme.slice(slashIndex);
-  }
-  return next.startsWith("/") ? next : `/${next}`;
-}
-function toBlobPart(data) {
-  if (typeof data === "string" || data instanceof Blob) {
-    return data;
-  }
-  if (data instanceof Uint8Array) {
-    return Uint8Array.from(data).buffer;
-  }
-  return data;
-}
-function toRequestBody(data) {
-  return toBlobPart(data);
-}
-async function parseJsonResponse(response) {
-  const text = await response.text();
-  if (!text) {
-    return void 0;
-  }
-  return JSON.parse(text);
-}
-var CloudClient, UNAUTHENTICATED_REQUESTS;
-var init_cloud_client = __esm({
-  "src/cloud-client.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_defaults();
-    init_native_cloud();
-    init_models();
-    CloudClient = class _CloudClient {
-      transport;
-      organizationId;
-      projectId;
-      namespace;
-      constructor(options) {
-        this.organizationId = options?.organizationId;
-        this.projectId = options?.projectId;
-        this.namespace = options?.namespace ?? NAMESPACE;
-        this.transport = new NativeCloudTransport({
-          baseUrl: options?.apiUrl ?? API_URL,
-          apiKey: options?.apiKey ?? API_KEY,
-          organizationId: this.organizationId,
-          projectId: this.projectId,
-          maxRetries: options?.maxRetries ?? MAX_RETRIES,
-          retryBackoffMs: options?.retryBackoffMs ?? RETRY_BACKOFF_MS,
-          timeoutMs: DEFAULT_HTTP_TIMEOUT_MS,
-          userAgent: `tensorlake-typescript-sdk/${SDK_VERSION}`
-        });
-      }
-      static forCloud(options) {
-        return new _CloudClient(options);
-      }
-      close() {
-        this.transport.close();
-      }
-      async upsertApplication(manifest, codeZip, upgradeRunningRequests = false) {
-        const applicationManifest = { ...manifest };
-        let publicEndpointId = publicEndpointIdFromManifest(applicationManifest);
-        if (applicationAllowsUnauthenticatedRequests(applicationManifest) && publicEndpointId === void 0) {
-          const applicationName = applicationManifest.name;
-          if (typeof applicationName === "string" && applicationName.length > 0) {
-            publicEndpointId = await this.existingApplicationPublicEndpointId(applicationName);
-          }
-          publicEndpointId ??= generatePublicEndpointId();
-        }
-        if (publicEndpointId !== void 0) {
-          applicationManifest.public_endpoint_id = publicEndpointId;
-          delete applicationManifest.publicEndpointId;
-        }
-        const form = new FormData();
-        form.append(
-          "code",
-          new Blob([toBlobPart(codeZip)], { type: "application/zip" }),
-          "code.zip"
-        );
-        form.append("code_content_type", "application/zip");
-        form.append("application", JSON.stringify(applicationManifest));
-        form.append(
-          "upgrade_requests_to_latest_code",
-          String(upgradeRunningRequests)
-        );
-        await this.transport.requestResponse("POST", this.namespacePath("applications"), {
-          body: form
-        });
-      }
-      async deleteApplication(applicationName) {
-        await this.transport.requestResponse(
-          "DELETE",
-          this.namespacePath(`applications/${encodeURIComponent(applicationName)}`)
-        );
-      }
-      async deleteSandboxImage(imageName) {
-        await this.transport.requestResponse(
-          "DELETE",
-          this.namespacePath(`sandbox-images/${encodeURIComponent(imageName)}`)
-        );
-      }
-      /**
-       * Look up a registered sandbox image (template) by its registered name.
-       *
-       * Returns the template, or `null` when no image with that name exists.
-       * API-key clients may omit organization/project IDs and use the
-       * token-scoped Platform API route directly. Explicit scope remains
-       * available for PAT callers.
-       */
-      async findSandboxImageByName(imageName, options) {
-        const base = this.platformProjectPath(
-          "sandbox-templates",
-          options?.organizationId,
-          options?.projectId
-        );
-        const response = await this.transport.requestResponse(
-          "GET",
-          `${base}/by-name/${encodeURIComponent(imageName)}`,
-          { statusOnlyCodes: /* @__PURE__ */ new Set([404]) }
-        );
-        if (response.status === 404) {
-          return null;
-        }
-        const raw = await parseJsonResponse(response);
-        return fromSnakeKeys(raw);
-      }
-      /**
-       * List all registered sandbox images (templates), following pagination to
-       * the end. API-key clients may omit organization/project IDs and use the
-       * token-scoped Platform API route directly.
-       */
-      async listSandboxImages(options) {
-        const base = this.platformProjectPath(
-          "sandbox-templates",
-          options?.organizationId,
-          options?.projectId
-        );
-        let path4 = `${base}?pageSize=100`;
-        const templates = [];
-        while (path4 !== null) {
-          const page = await this.transport.requestJson(
-            "GET",
-            path4
-          );
-          for (const item of page.items ?? []) {
-            templates.push(fromSnakeKeys(item));
-          }
-          const next = page.pagination?.next;
-          path4 = next ? nextRequestPath(next) : null;
-        }
-        return templates;
-      }
-      async applications() {
-        const raw = await this.transport.requestJson(
-          "GET",
-          this.namespacePath("applications")
-        );
-        return (raw.applications ?? []).map(
-          (application) => fromSnakeKeys(application)
-        );
-      }
-      async applicationManifest(applicationName) {
-        const raw = await this.transport.requestJson(
-          "GET",
-          this.namespacePath(`applications/${encodeURIComponent(applicationName)}`)
-        );
-        return fromSnakeKeys(raw);
-      }
-      async runRequest(applicationName, inputs = []) {
-        const path4 = this.namespacePath(
-          `applications/${encodeURIComponent(applicationName)}`
-        );
-        const response = inputs.length === 0 ? await this.transport.requestResponse("POST", path4, {
-          body: new Uint8Array(),
-          headers: { Accept: "application/json" }
-        }) : inputs.length === 1 && inputs[0].name === "0" ? await this.transport.requestResponse("POST", path4, {
-          body: toRequestBody(inputs[0].data),
-          headers: {
-            Accept: "application/json",
-            "Content-Type": inputs[0].contentType
-          }
-        }) : await this.runMultipartRequest(path4, inputs);
-        const body = await parseJsonResponse(response);
-        const requestId = body?.request_id;
-        if (!requestId) {
-          throw new Error("missing request_id in run request response body");
-        }
-        return requestId;
-      }
-      async waitOnRequestCompletion(applicationName, requestId) {
-        const stream = this.transport.stream(
-          "GET",
-          this.namespacePath(
-            `applications/${encodeURIComponent(applicationName)}/requests/${encodeURIComponent(requestId)}/progress`
-          )
-        );
-        for await (const event of stream) {
-          if (Object.prototype.hasOwnProperty.call(event, "RequestFinished")) {
-            return;
-          }
-        }
-        throw new Error("progress stream ended before request completion");
-      }
-      async requestMetadata(applicationName, requestId) {
-        const raw = await this.transport.requestJson(
-          "GET",
-          this.namespacePath(
-            `applications/${encodeURIComponent(applicationName)}/requests/${encodeURIComponent(requestId)}`
-          )
-        );
-        return fromSnakeKeys(raw);
-      }
-      async requestOutput(applicationName, requestId) {
-        const response = await this.transport.requestResponse(
-          "GET",
-          this.namespacePath(
-            `applications/${encodeURIComponent(applicationName)}/requests/${encodeURIComponent(requestId)}/output`
-          )
-        );
-        const serializedValue = new Uint8Array(await response.arrayBuffer());
-        const contentType = response.headers.get("content-type") ?? "";
-        return {
-          serializedValue,
-          contentType
-        };
-      }
-      async listSecrets(options) {
-        const base = this.secretCollectionPath(
-          options?.organizationId,
-          options?.projectId
-        );
-        const raw = await this.transport.requestJson("GET", base);
-        const pageSize = Math.max(0, options?.pageSize ?? 100);
-        return Object.assign(
-          {
-            items: raw.slice(0, pageSize).map(secretFromMetadata),
-            pagination: { total: raw.length }
-          },
-          { traceId: raw.traceId }
-        );
-      }
-      async getSecret(secretId, options) {
-        const base = this.secretCollectionPath(
-          options?.organizationId,
-          options?.projectId
-        );
-        const raw = await this.transport.requestJson(
-          "GET",
-          `${base}/${encodeURIComponent(secretId)}`
-        );
-        return Object.assign(secretFromMetadata(raw), { traceId: raw.traceId });
-      }
-      async upsertSecrets(secrets, options) {
-        const base = this.secretCollectionPath(
-          options?.organizationId,
-          options?.projectId
-        );
-        if (Array.isArray(secrets)) {
-          const results = [];
-          for (const secret of secrets) {
-            results.push(await this.upsertSecret(base, secret));
-          }
-          return results;
-        }
-        return this.upsertSecret(base, secrets);
-      }
-      async deleteSecret(secretId, options) {
-        const base = this.secretCollectionPath(
-          options?.organizationId,
-          options?.projectId
-        );
-        await this.transport.requestResponse(
-          "DELETE",
-          `${base}/${encodeURIComponent(secretId)}`
-        );
-      }
-      async upsertSecret(base, secret) {
-        let response = await this.transport.requestResponse("POST", base, {
-          json: secret,
-          headers: { "Idempotency-Key": nanoid() },
-          statusOnlyCodes: /* @__PURE__ */ new Set([409])
-        });
-        if (response.status === 409) {
-          const prefix = base.slice(0, -"/secrets".length);
-          const existing = await this.transport.requestJson(
-            "GET",
-            `${prefix}/secret-names/${encodeURIComponent(secret.name)}`
-          );
-          response = await this.transport.requestResponse(
-            "POST",
-            `${base}/${encodeURIComponent(existing.id)}/versions`,
-            {
-              json: { value: secret.value },
-              headers: { "Idempotency-Key": nanoid() }
-            }
-          );
-        }
-        const metadata = await parseJsonResponse(response);
-        return Object.assign(secretFromMetadata(metadata), {
-          traceId: response.traceId
-        });
-      }
-      async startImageBuild(buildServicePath, request) {
-        const form = new FormData();
-        form.append("graph_name", request.applicationName);
-        form.append("graph_version", request.applicationVersion);
-        form.append("graph_function_name", request.functionName);
-        form.append("image_name", request.imageName);
-        form.append("image_id", request.imageId);
-        form.append(
-          "context",
-          new Blob([toBlobPart(request.buildContext)]),
-          "context.tar.gz"
-        );
-        const response = await this.transport.requestResponse(
-          "PUT",
-          `${trimTrailingSlashes2(buildServicePath)}/builds`,
-          { body: form }
-        );
-        const raw = await parseJsonResponse(response);
-        return fromSnakeKeys(raw);
-      }
-      async createApplicationBuild(buildServicePath, request, imageContexts) {
-        const form = createApplicationBuildForm(request, imageContexts);
-        const response = await this.transport.requestResponse(
-          "POST",
-          trimTrailingSlashes2(buildServicePath),
-          { body: form }
-        );
-        const raw = await parseJsonResponse(response);
-        return fromSnakeKeys(raw);
-      }
-      async applicationBuildInfo(buildServicePath, applicationBuildId) {
-        const raw = await this.transport.requestJson(
-          "GET",
-          `${trimTrailingSlashes2(buildServicePath)}/${encodeURIComponent(applicationBuildId)}`
-        );
-        return fromSnakeKeys(raw);
-      }
-      async cancelApplicationBuild(buildServicePath, applicationBuildId) {
-        const raw = await this.transport.requestJson(
-          "POST",
-          `${trimTrailingSlashes2(buildServicePath)}/${encodeURIComponent(applicationBuildId)}/cancel`
-        );
-        return fromSnakeKeys(raw);
-      }
-      async buildInfo(buildServicePath, buildId) {
-        const raw = await this.transport.requestJson(
-          "GET",
-          `${trimTrailingSlashes2(buildServicePath)}/builds/${encodeURIComponent(buildId)}`
-        );
-        return fromSnakeKeys(raw);
-      }
-      async cancelBuild(buildServicePath, buildId) {
-        await this.transport.requestResponse(
-          "POST",
-          `${trimTrailingSlashes2(buildServicePath)}/builds/${encodeURIComponent(buildId)}/cancel`
-        );
-      }
-      async *streamBuildLogs(buildServicePath, buildId, signal) {
-        const stream = this.transport.stream(
-          "GET",
-          `${trimTrailingSlashes2(buildServicePath)}/builds/${encodeURIComponent(buildId)}/logs`,
-          signal
-        );
-        for await (const event of stream) {
-          yield fromSnakeKeys(event);
-        }
-      }
-      async runMultipartRequest(path4, inputs) {
-        const form = new FormData();
-        for (const input of inputs) {
-          form.append(
-            input.name,
-            new Blob([toBlobPart(input.data)], { type: input.contentType }),
-            input.name
-          );
-        }
-        return this.transport.requestResponse("POST", path4, {
-          body: form,
-          headers: { Accept: "application/json" }
-        });
-      }
-      namespacePath(subpath) {
-        return `/v1/namespaces/${encodeURIComponent(this.namespace)}/${subpath.replace(/^\/+/, "")}`;
-      }
-      async existingApplicationPublicEndpointId(applicationName) {
-        const response = await this.transport.requestResponse(
-          "GET",
-          this.namespacePath(`applications/${encodeURIComponent(applicationName)}`),
-          { statusOnlyCodes: /* @__PURE__ */ new Set([404]) }
-        );
-        if (response.status === 404) {
-          return void 0;
-        }
-        const application = await parseJsonResponse(response);
-        return publicEndpointIdFromManifest(application);
-      }
-      platformProjectPath(resource, organizationId, projectId) {
-        const resolvedOrganizationId = organizationId ?? this.organizationId;
-        const resolvedProjectId = projectId ?? this.projectId;
-        if (!resolvedOrganizationId && !resolvedProjectId) {
-          return `/platform/v1/${resource}`;
-        }
-        if (!resolvedOrganizationId || !resolvedProjectId) {
-          throw new Error(
-            "organizationId and projectId must be provided together"
-          );
-        }
-        return `/platform/v1/organizations/${encodeURIComponent(resolvedOrganizationId)}/projects/${encodeURIComponent(resolvedProjectId)}/${resource}`;
-      }
-      secretCollectionPath(organizationId, projectId) {
-        const resolvedOrganizationId = organizationId ?? this.organizationId;
-        const resolvedProjectId = projectId ?? this.projectId;
-        if (!resolvedOrganizationId && !resolvedProjectId) {
-          return this.namespacePath("secrets");
-        }
-        if (!resolvedOrganizationId || !resolvedProjectId) {
-          throw new Error("organizationId and projectId must be provided together");
-        }
-        return this.namespacePath("secrets");
-      }
-    };
-    UNAUTHENTICATED_REQUESTS = "unauthenticated_requests";
-  }
-});
-
 // src/image.ts
 import { randomUUID } from "crypto";
 function cloneOperation(op) {
@@ -1404,7 +231,7 @@ var require_libc = __commonJS({
 
 // src/native-binding.ts
 import * as fs from "fs";
-import { createRequire as createRequire2 } from "module";
+import { createRequire } from "module";
 import path2 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function packageRoot() {
@@ -1448,7 +275,7 @@ function nativePackageName(platform = process.platform, arch = process.arch, opt
 function loadNative() {
   const target = nativeTargetId();
   const bindingPath = nativeBindingPath();
-  const require2 = createRequire2(import.meta.url);
+  const require2 = createRequire(import.meta.url);
   if (fs.existsSync(bindingPath)) return require2(bindingPath);
   const packageName = nativePackageName();
   if (!packageName) {
@@ -1484,22 +311,192 @@ var init_native_binding = __esm({
   }
 });
 
+// src/image-builds.ts
+import path3 from "path";
+import os from "os";
+import { existsSync as existsSync2, mkdtempSync, rmSync } from "fs";
+function camelize(key) {
+  return key.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+}
+function toImageBuildError(error) {
+  if (!(error instanceof Error)) return error;
+  let payload;
+  try {
+    payload = JSON.parse(error.message);
+  } catch {
+    return error;
+  }
+  if (!payload || payload.category !== "image_build") return error;
+  const details = {};
+  for (const [key, value] of Object.entries(payload)) {
+    if (key === "category") continue;
+    details[camelize(key)] = value;
+  }
+  const typed = details;
+  switch (typed.code) {
+    case "not_found":
+      return new ImageBuildNotFoundError(typed);
+    case "image_build_in_progress":
+      return new ImageBuildInProgressError(typed);
+    case "failed":
+      return new ImageBuildFailedError(typed);
+    case "cancelled":
+      return new ImageBuildCancelledError(typed);
+    case "timeout":
+      return new ImageBuildTimeoutError(typed);
+    case "interrupted":
+      return new ImageBuildInterruptedError(typed);
+    default:
+      return new ImageBuildError(typed);
+  }
+}
+function camelizeRecord(value) {
+  const out = {};
+  for (const [key, inner] of Object.entries(value)) out[camelize(key)] = inner;
+  return out;
+}
+function parseBuildInfo(raw) {
+  const camel = camelizeRecord(raw);
+  const result = raw.result && typeof raw.result === "object" ? camelizeRecord(raw.result) : null;
+  return {
+    buildId: String(raw.build_id ?? ""),
+    clientRequestId: camel.clientRequestId ?? null,
+    kind: String(raw.kind ?? ""),
+    name: raw.name ?? null,
+    status: String(raw.status ?? ""),
+    phase: raw.phase ?? null,
+    attemptNo: Number(raw.attempt_no ?? 0),
+    builderSandboxId: camel.builderSandboxId ?? null,
+    error: raw.error ?? null,
+    result,
+    operationDeadlineMs: camel.operationDeadlineMs ?? null,
+    createdAtMs: camel.createdAtMs ?? null,
+    updatedAtMs: camel.updatedAtMs ?? null,
+    raw
+  };
+}
+async function __runWithInterrupt(signal, run) {
+  const binding = __imageBuildInternals.loadNativeBinding();
+  if (signal === void 0) {
+    try {
+      return await run(void 0);
+    } catch (error) {
+      throw toImageBuildError(error);
+    }
+  }
+  const interruptId = binding.createImageBuildInterrupt();
+  const onAbort = () => binding.triggerImageBuildInterrupt(interruptId);
+  if (signal.aborted) onAbort();
+  else signal.addEventListener("abort", onAbort, { once: true });
+  try {
+    return await run(interruptId);
+  } catch (error) {
+    throw toImageBuildError(error);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+    binding.releaseImageBuildInterrupt(interruptId);
+  }
+}
+var ImageBuildError, ImageBuildNotFoundError, ImageBuildInProgressError, ImageBuildFailedError, ImageBuildCancelledError, ImageBuildTimeoutError, ImageBuildInterruptedError;
+var init_image_builds = __esm({
+  "src/image-builds.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_image();
+    init_sandbox_image();
+    ImageBuildError = class extends Error {
+      code;
+      buildId;
+      clientRequestId;
+      details;
+      constructor(details) {
+        super(details.message);
+        this.name = "ImageBuildError";
+        this.code = details.code;
+        this.details = details;
+        if (details.buildId) this.buildId = details.buildId;
+        if (details.clientRequestId) this.clientRequestId = details.clientRequestId;
+      }
+    };
+    ImageBuildNotFoundError = class extends ImageBuildError {
+      constructor(details) {
+        super(details);
+        this.name = "ImageBuildNotFoundError";
+      }
+    };
+    ImageBuildInProgressError = class extends ImageBuildError {
+      imageName;
+      activeBuildId;
+      activeKind;
+      activeStatus;
+      constructor(details) {
+        super(details);
+        this.name = "ImageBuildInProgressError";
+        if (details.imageName) this.imageName = details.imageName;
+        if (details.activeBuildId) this.activeBuildId = details.activeBuildId;
+        if (details.activeKind) this.activeKind = details.activeKind;
+        if (details.activeStatus) this.activeStatus = details.activeStatus;
+      }
+    };
+    ImageBuildFailedError = class extends ImageBuildError {
+      error;
+      info;
+      constructor(details) {
+        super(details);
+        this.name = "ImageBuildFailedError";
+        this.error = details.error ?? "no error recorded";
+        if (details.info) this.info = parseBuildInfo(details.info);
+      }
+    };
+    ImageBuildCancelledError = class extends ImageBuildError {
+      info;
+      constructor(details) {
+        super(details);
+        this.name = "ImageBuildCancelledError";
+        if (details.info) this.info = parseBuildInfo(details.info);
+      }
+    };
+    ImageBuildTimeoutError = class extends ImageBuildError {
+      constructor(details) {
+        super(details);
+        this.name = "ImageBuildTimeoutError";
+      }
+    };
+    ImageBuildInterruptedError = class extends ImageBuildError {
+      outcome;
+      confirmed;
+      result;
+      constructor(details) {
+        super(details);
+        this.name = "ImageBuildInterruptedError";
+        this.outcome = details.outcome ?? "unconfirmed";
+        this.confirmed = details.confirmed === true;
+        if (details.result) this.result = details.result;
+      }
+    };
+  }
+});
+
 // src/sandbox-image.ts
 var sandbox_image_exports = {};
 __export(sandbox_image_exports, {
+  __imageBuildInternals: () => __imageBuildInternals,
   __setNativeBindingForTest: () => __setNativeBindingForTest,
   buildContextFromEnv: () => buildContextFromEnv,
   createSandboxImage: () => createSandboxImage,
   deleteSandboxImage: () => deleteSandboxImage,
+  deleteSandboxImageWithCredentials: () => deleteSandboxImageWithCredentials,
   findSandboxImageByName: () => findSandboxImageByName,
+  findSandboxImageByNameWithCredentials: () => findSandboxImageByNameWithCredentials,
   importSandboxImage: () => importSandboxImage,
   listSandboxImages: () => listSandboxImages,
+  listSandboxImagesWithCredentials: () => listSandboxImagesWithCredentials,
   runCreateSandboxImageCli: () => runCreateSandboxImageCli,
   runImportSandboxImageCli: () => runImportSandboxImageCli
 });
-import path3 from "path";
-import os from "os";
-import { existsSync as existsSync2, mkdtempSync, rmSync } from "fs";
+import path4 from "path";
+import os2 from "os";
+import { existsSync as existsSync3, mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "fs";
 import { parseArgs } from "util";
 function loadNativeBinding() {
   if (cachedNativeBinding) return cachedNativeBinding;
@@ -1533,9 +530,9 @@ function buildContextFromEnv() {
   };
 }
 function defaultRegisteredName(dockerfilePath) {
-  const parsed = path3.parse(dockerfilePath);
+  const parsed = path4.parse(dockerfilePath);
   if (parsed.name.toLowerCase() === "dockerfile") {
-    const parentName = path3.basename(path3.dirname(dockerfilePath)).trim();
+    const parentName = path4.basename(path4.dirname(dockerfilePath)).trim();
     return parentName || "sandbox-image";
   }
   return parsed.name || "sandbox-image";
@@ -1571,6 +568,15 @@ function eventToEmitDict(event) {
     message: event.message
   };
   if (event.stream != null) out.stream = event.stream;
+  if (event.buildId != null) out.build_id = event.buildId;
+  if (event.clientRequestId !== void 0 && event.eventType !== "status") {
+    out.client_request_id = event.clientRequestId;
+  }
+  if (event.status != null) out.status = event.status;
+  if (event.phase !== void 0 && event.eventType.startsWith("build_")) out.phase = event.phase;
+  if (event.attempt != null) out.attempt = event.attempt;
+  if (event.outcome != null) out.outcome = event.outcome;
+  if (event.confirmed != null) out.confirmed = event.confirmed;
   return out;
 }
 function runOpMountsContext(op) {
@@ -1625,24 +631,24 @@ async function createSandboxImage(source, options = {}, deps = {}) {
     }
     let resolvedContext;
     if (options.contextDir != null) {
-      resolvedContext = path3.resolve(options.contextDir);
+      resolvedContext = path4.resolve(options.contextDir);
     } else if (imageRequiresContext(source)) {
       throw new Error(
         "This image reads files from the host (via COPY/ADD or a RUN bind mount), so it needs a build context. Pass `contextDir` pointing at the directory that contains those sources; they resolve relative to it, like `docker build <contextDir>`."
       );
     } else {
-      tempContextDir = mkdtempSync(path3.join(os.tmpdir(), "tl-build-context-"));
+      tempContextDir = mkdtempSync2(path4.join(os2.tmpdir(), "tl-build-context-"));
       resolvedContext = tempContextDir;
     }
-    dockerfilePath = path3.join(resolvedContext, "Dockerfile");
+    dockerfilePath = path4.join(resolvedContext, "Dockerfile");
     let text = dockerfileContent(source);
     if (!text.endsWith("\n")) text += "\n";
     dockerfileText = text;
     nativeContextDir = resolvedContext;
     effectiveName = options.registeredName ?? source.name;
   } else if (typeof source === "string") {
-    const resolvedPath = path3.resolve(source);
-    if (!existsSync2(resolvedPath)) {
+    const resolvedPath = path4.resolve(source);
+    if (!existsSync3(resolvedPath)) {
       throw new Error(`Dockerfile not found: ${source}`);
     }
     dockerfilePath = resolvedPath;
@@ -1672,38 +678,47 @@ async function createSandboxImage(source, options = {}, deps = {}) {
         deps._allowPat ? "Missing TENSORLAKE_API_KEY or TENSORLAKE_PAT credentials." : "Missing TENSORLAKE_API_KEY credentials."
       );
     }
+    if (options.signal !== void 0 && !options.cas) {
+      throw new Error(
+        "signal is only supported for CAS image builds (cas: true); a legacy build has no Image Service build operation to cancel"
+      );
+    }
     emit({ type: "status", message: `Building image '${effectiveName}'...` });
     const binding = loadNativeBinding();
     let emitError;
-    const resultJson = await binding.buildSandboxImage(
-      {
-        apiUrl: context.apiUrl,
-        bearerToken,
-        dockerfilePath,
-        registeredName: effectiveName,
-        diskMb: options.diskMb,
-        builderDiskMb: options.builderDiskMb,
-        cpus: options.cpus,
-        memoryMb: options.memoryMb,
-        isPublic: options.isPublic ?? false,
-        organizationId: usePat ? context.organizationId : void 0,
-        projectId: usePat ? context.projectId : void 0,
-        namespace: context.namespace,
-        useScopeHeaders: usePat,
-        userAgent: void 0,
-        dockerCompat: options.dockerCompat ?? false,
-        dockerConfigJson: options.dockerConfigJson,
-        dockerfileText,
-        contextDir: nativeContextDir
-      },
-      (event) => {
-        try {
-          emit(eventToEmitDict(event));
-        } catch (error) {
-          emitError ??= error;
-        }
+    const nativeOptions = {
+      apiUrl: context.apiUrl,
+      bearerToken,
+      dockerfilePath,
+      registeredName: effectiveName,
+      diskMb: options.diskMb,
+      builderDiskMb: options.builderDiskMb,
+      cpus: options.cpus,
+      memoryMb: options.memoryMb,
+      isPublic: options.isPublic ?? false,
+      organizationId: usePat ? context.organizationId : void 0,
+      projectId: usePat ? context.projectId : void 0,
+      namespace: context.namespace,
+      useScopeHeaders: usePat,
+      userAgent: void 0,
+      dockerCompat: options.dockerCompat ?? false,
+      dockerConfigJson: options.dockerConfigJson,
+      dockerfileText,
+      contextDir: nativeContextDir,
+      cas: options.cas ?? false,
+      buildArgs: options.buildArgs
+    };
+    const forward = (event) => {
+      try {
+        emit(eventToEmitDict(event));
+      } catch (error) {
+        emitError ??= error;
       }
-    );
+    };
+    const resultJson = options.cas ? await __runWithInterrupt(
+      options.signal,
+      (interruptId) => binding.buildSandboxImage(nativeOptions, forward, interruptId)
+    ) : await binding.buildSandboxImage(nativeOptions, forward);
     if (emitError != null) {
       throw emitError;
     }
@@ -1720,7 +735,7 @@ async function createSandboxImage(source, options = {}, deps = {}) {
     return result;
   } finally {
     if (tempContextDir != null) {
-      rmSync(tempContextDir, { recursive: true, force: true });
+      rmSync2(tempContextDir, { recursive: true, force: true });
     }
   }
 }
@@ -1749,39 +764,47 @@ async function importSandboxImage(imageReference, options = {}, deps = {}) {
       deps._allowPat ? "Missing TENSORLAKE_API_KEY or TENSORLAKE_PAT credentials." : "Missing TENSORLAKE_API_KEY credentials."
     );
   }
+  if (options.signal !== void 0 && !options.cas) {
+    throw new Error(
+      "signal is only supported for CAS image imports (cas: true); a legacy import has no Image Service build operation to cancel"
+    );
+  }
   emit({
     type: "status",
     message: `Importing image '${reference}' as '${effectiveName}'...`
   });
   const binding = loadNativeBinding();
   let emitError;
-  const resultJson = await binding.importSandboxImage(
-    {
-      apiUrl: context.apiUrl,
-      bearerToken,
-      imageReference: reference,
-      registeredName: effectiveName,
-      diskMb: options.diskMb,
-      builderDiskMb: options.builderDiskMb,
-      cpus: options.cpus,
-      memoryMb: options.memoryMb,
-      isPublic: options.isPublic ?? false,
-      organizationId: usePat ? context.organizationId : void 0,
-      projectId: usePat ? context.projectId : void 0,
-      namespace: context.namespace,
-      useScopeHeaders: usePat,
-      userAgent: void 0,
-      dockerCompat: options.dockerCompat ?? false,
-      dockerConfigJson: options.dockerConfigJson
-    },
-    (event) => {
-      try {
-        emit(eventToEmitDict(event));
-      } catch (error) {
-        emitError ??= error;
-      }
+  const nativeOptions = {
+    apiUrl: context.apiUrl,
+    bearerToken,
+    imageReference: reference,
+    registeredName: effectiveName,
+    diskMb: options.diskMb,
+    builderDiskMb: options.builderDiskMb,
+    cpus: options.cpus,
+    memoryMb: options.memoryMb,
+    isPublic: options.isPublic ?? false,
+    organizationId: usePat ? context.organizationId : void 0,
+    projectId: usePat ? context.projectId : void 0,
+    namespace: context.namespace,
+    useScopeHeaders: usePat,
+    userAgent: void 0,
+    dockerCompat: options.dockerCompat ?? false,
+    dockerConfigJson: options.dockerConfigJson,
+    cas: options.cas ?? false
+  };
+  const forward = (event) => {
+    try {
+      emit(eventToEmitDict(event));
+    } catch (error) {
+      emitError ??= error;
     }
-  );
+  };
+  const resultJson = options.cas ? await __runWithInterrupt(
+    options.signal,
+    (interruptId) => binding.importSandboxImage(nativeOptions, forward, interruptId)
+  ) : await binding.importSandboxImage(nativeOptions, forward);
   if (emitError != null) {
     throw emitError;
   }
@@ -1797,10 +820,7 @@ async function importSandboxImage(imageReference, options = {}, deps = {}) {
   emit({ type: "done" });
   return result;
 }
-async function deleteSandboxImage(imageName) {
-  if (typeof imageName !== "string" || imageName.length === 0) {
-    throw new TypeError("imageName must be a non-empty string");
-  }
+function catalogOptionsFromEnv() {
   const context = buildContextFromEnv();
   const bearerToken = context.apiKey;
   if (!bearerToken) {
@@ -1811,63 +831,73 @@ async function deleteSandboxImage(imageName) {
     }
     throw new Error("Missing TENSORLAKE_API_KEY credentials.");
   }
-  const client = new CloudClient({
-    apiUrl: context.apiUrl,
-    apiKey: bearerToken,
-    namespace: context.namespace
-  });
-  try {
-    await client.deleteSandboxImage(imageName);
-  } finally {
-    client.close();
-  }
+  return { apiUrl: context.apiUrl, bearerToken, useScopeHeaders: false };
 }
-async function findSandboxImageByName(imageName) {
-  if (typeof imageName !== "string" || imageName.length === 0) {
-    throw new TypeError("imageName must be a non-empty string");
-  }
+function catalogOptionsFromCredentials(credentials) {
   const context = buildContextFromEnv();
-  const bearerToken = context.apiKey;
+  const bearerToken = credentials.apiKey ?? context.apiKey;
   if (!bearerToken) {
-    if (context.personalAccessToken) {
-      throw new Error(
-        "Sandbox image SDKs require TENSORLAKE_API_KEY. Personal access tokens are CLI-only."
-      );
-    }
     throw new Error("Missing TENSORLAKE_API_KEY credentials.");
   }
-  const client = new CloudClient({
-    apiUrl: context.apiUrl,
-    apiKey: bearerToken,
-    namespace: context.namespace
-  });
-  try {
-    return await client.findSandboxImageByName(imageName);
-  } finally {
-    client.close();
+  const { organizationId, projectId } = credentials;
+  if (organizationId === void 0 !== (projectId === void 0)) {
+    throw new TypeError("organizationId and projectId must be given together");
   }
+  return {
+    apiUrl: credentials.apiUrl ?? context.apiUrl,
+    bearerToken,
+    organizationId,
+    projectId,
+    useScopeHeaders: organizationId !== void 0
+  };
 }
-async function listSandboxImages() {
-  const context = buildContextFromEnv();
-  const bearerToken = context.apiKey;
-  if (!bearerToken) {
-    if (context.personalAccessToken) {
-      throw new Error(
-        "Sandbox image SDKs require TENSORLAKE_API_KEY. Personal access tokens are CLI-only."
-      );
-    }
-    throw new Error("Missing TENSORLAKE_API_KEY credentials.");
+function parseTemplate(json) {
+  return JSON.parse(json);
+}
+async function deleteSandboxImage(imageName) {
+  if (typeof imageName !== "string" || imageName.length === 0) {
+    throw new TypeError("imageName must be a non-empty string");
   }
-  const client = new CloudClient({
-    apiUrl: context.apiUrl,
-    apiKey: bearerToken,
-    namespace: context.namespace
-  });
-  try {
-    return await client.listSandboxImages();
-  } finally {
-    client.close();
+  await loadNativeBinding().deleteSandboxImage(catalogOptionsFromEnv(), imageName);
+}
+async function deleteSandboxImageWithCredentials(credentials, imageName) {
+  if (typeof imageName !== "string" || imageName.length === 0) {
+    throw new TypeError("imageName must be a non-empty string");
   }
+  await loadNativeBinding().deleteSandboxImage(
+    catalogOptionsFromCredentials(credentials),
+    imageName
+  );
+}
+async function findSandboxImageByName(imageName) {
+  if (typeof imageName !== "string" || imageName.length === 0) {
+    throw new TypeError("imageName must be a non-empty string");
+  }
+  const json = await loadNativeBinding().findSandboxImage(
+    catalogOptionsFromEnv(),
+    imageName
+  );
+  return json == null ? null : parseTemplate(json);
+}
+async function findSandboxImageByNameWithCredentials(credentials, imageName) {
+  if (typeof imageName !== "string" || imageName.length === 0) {
+    throw new TypeError("imageName must be a non-empty string");
+  }
+  const json = await loadNativeBinding().findSandboxImage(
+    catalogOptionsFromCredentials(credentials),
+    imageName
+  );
+  return json == null ? null : parseTemplate(json);
+}
+async function listSandboxImages() {
+  const json = await loadNativeBinding().listSandboxImages(catalogOptionsFromEnv());
+  return JSON.parse(json);
+}
+async function listSandboxImagesWithCredentials(credentials) {
+  const json = await loadNativeBinding().listSandboxImages(
+    catalogOptionsFromCredentials(credentials)
+  );
+  return JSON.parse(json);
 }
 async function runCreateSandboxImageCli(argv = process.argv.slice(2)) {
   const parsed = parseArgs({
@@ -1977,25 +1007,39 @@ async function runImportSandboxImageCli(argv = process.argv.slice(2)) {
     { emit: ndjsonStdoutEmit, _allowPat: true }
   );
 }
-var cachedNativeBinding, cachedNativeBindingError, DEFAULT_IMAGE_NAME2;
+var cachedNativeBinding, cachedNativeBindingError, DEFAULT_IMAGE_NAME2, __imageBuildInternals;
 var init_sandbox_image = __esm({
   "src/sandbox-image.ts"() {
     init_esm_shims();
-    init_cloud_client();
     init_image();
     init_native_binding();
+    init_image_builds();
     DEFAULT_IMAGE_NAME2 = "default";
+    __imageBuildInternals = {
+      loadNativeBinding: () => loadNativeBinding(),
+      buildContextFromEnv: () => buildContextFromEnv(),
+      stderrEmit: (event) => stderrEmit(event),
+      noopEmit: (event) => noopEmit(event),
+      eventToEmitDict: (event) => eventToEmitDict(event),
+      imageRequiresContext: (image) => imageRequiresContext(image),
+      defaultRegisteredName: (dockerfilePath) => defaultRegisteredName(dockerfilePath),
+      defaultRegisteredNameFromImage: (reference) => defaultRegisteredNameFromImage(reference)
+    };
   }
 });
 init_sandbox_image();
 export {
+  __imageBuildInternals,
   __setNativeBindingForTest,
   buildContextFromEnv,
   createSandboxImage,
   deleteSandboxImage,
+  deleteSandboxImageWithCredentials,
   findSandboxImageByName,
+  findSandboxImageByNameWithCredentials,
   importSandboxImage,
   listSandboxImages,
+  listSandboxImagesWithCredentials,
   runCreateSandboxImageCli,
   runImportSandboxImageCli
 };