@tensorlakeai/tensorlake 0.5.152 → 0.5.153

package/dist/index.js

@@ -46,7 +46,7 @@ var init_defaults = __esm({
   "src/defaults.ts"() {
     "use strict";
     init_esm_shims();
-    SDK_VERSION = "0.5.152";
+    SDK_VERSION = "0.5.153";
     API_URL = process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai";
     API_KEY = process.env.TENSORLAKE_API_KEY ?? void 0;
     NAMESPACE = process.env.INDEXIFY_NAMESPACE ?? "default";
@@ -495,7 +495,7 @@ var init_native_worker_client = __esm({
       }
     };
     runtimeKey = /* @__PURE__ */ Symbol.for(
-      `tensorlake.native.worker.${false ? "source" : "0.5.152"}.v1`
+      `tensorlake.native.worker.${false ? "source" : "0.5.153"}.v1`
     );
     runtimes = globalThis;
   }
@@ -595,6 +595,8 @@ var init_models = __esm({
       SnapshotStatus2["LOCAL_READY"] = "local_ready";
       SnapshotStatus2["COMPLETED"] = "completed";
       SnapshotStatus2["FAILED"] = "failed";
+      SnapshotStatus2["DELETING"] = "deleting";
+      SnapshotStatus2["REPLICATING"] = "replicating";
       return SnapshotStatus2;
     })(SnapshotStatus || {});
     ProcessStatus = /* @__PURE__ */ ((ProcessStatus2) => {
@@ -3883,9 +3885,8 @@ var init_sandbox = __esm({
        *
        * Resource targets use create's cpus, memoryMb, and diskMb names. Resize
        * waits by default; wait=false returns admission. Timeout does not cancel it.
-       * CPU-only CAS sandboxes support CPU, memory, and root-disk resize; GPU CAS sandboxes
-       * support only root-disk growth and reject CPU and memory changes.
-       * Non-CAS sandboxes do not support live resize.
+       * Which runtimes and dimensions support a live resize is decided by the
+       * server, whose policy error is thrown unchanged.
        * Wait, timeout, and pollInterval are ignored on non-resource updates.
        * A no-op returns current resources with absent or earlier resize metadata.
        *
@@ -4303,29 +4304,29 @@ var init_sandbox = __esm({
       }
       // --- File operations ---
       /** Read a file from the sandbox and return its raw bytes. */
-      async readFile(path4) {
+      async readFile(path5) {
         const proxy = await this.proxy.client();
-        const { traceId, data } = await callNative(() => proxy.readFile(path4), {
+        const { traceId, data } = await callNative(() => proxy.readFile(path5), {
           sandboxId: this.sandboxId
         });
         return Object.assign(Uint8Array.from(data), { traceId });
       }
       /** Write raw bytes to a file in the sandbox, creating it if it does not exist. */
-      async writeFile(path4, content) {
+      async writeFile(path5, content) {
         const proxy = await this.proxy.client();
-        await callNative(() => proxy.writeFile(path4, Buffer.from(content)), {
+        await callNative(() => proxy.writeFile(path5, Buffer.from(content)), {
           sandboxId: this.sandboxId
         });
       }
       /** Delete a file from the sandbox. */
-      async deleteFile(path4) {
+      async deleteFile(path5) {
         const proxy = await this.proxy.client();
-        await callNative(() => proxy.deleteFile(path4), { sandboxId: this.sandboxId });
+        await callNative(() => proxy.deleteFile(path5), { sandboxId: this.sandboxId });
       }
       /** List the contents of a directory in the sandbox. */
-      async listDirectory(path4) {
+      async listDirectory(path5) {
         const proxy = await this.proxy.client();
-        const { traceId, json } = await callNative(() => proxy.listDirectory(path4), {
+        const { traceId, json } = await callNative(() => proxy.listDirectory(path5), {
           sandboxId: this.sandboxId
         });
         return Object.assign(fromSnakeKeys(JSON.parse(json)), {
@@ -4991,9 +4992,9 @@ var init_client = __esm({
         });
       }
       /**
-       * Update properties or resize a running sandbox. CPU-only CAS sandboxes support
-       * CPU, memory, and root-disk resize; GPU CAS sandboxes support only root-disk
-       * growth. Non-CAS sandboxes do not support live resize.
+       * Update properties or resize a running sandbox. Which runtimes and
+       * dimensions support a live resize is decided by the server, whose policy
+       * error is thrown unchanged.
        * Resource names match create. Resize waits by default; wait=false returns
        * admission. Timeout leaves the resize running and reports its generation.
        * Wait, timeout, and pollInterval are ignored on non-resource updates.
@@ -5312,6 +5313,11 @@ var init_client = __esm({
               `Snapshot ${result.snapshotId} failed: ${info.error}`
             );
           }
+          if (info.status === "deleting" /* DELETING */) {
+            throw new SandboxError(
+              `Snapshot ${result.snapshotId} is being deleted`
+            );
+          }
           await sleep2(pollInterval * 1e3);
         }
         throw new SandboxError(
@@ -5569,585 +5575,6 @@ var init_client = __esm({
   }
 });
 
-// src/native-cloud.ts
-async function serializeRequest(method, path4, options) {
-  const headers = { ...options?.headers };
-  let body = options?.body;
-  if (options?.json !== void 0) {
-    body = JSON.stringify(options.json);
-    if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) {
-      headers["Content-Type"] = "application/json";
-    }
-  }
-  const request = {
-    method,
-    path: path4,
-    headersJson: JSON.stringify(headers),
-    statusOnlyCodes: [...options?.statusOnlyCodes ?? []]
-  };
-  if (body instanceof FormData) {
-    request.parts = [];
-    for (const [name, value] of body.entries()) {
-      request.parts.push(typeof value === "string" ? { name, data: Buffer.from(value) } : { name, data: Buffer.from(await value.arrayBuffer()), filename: value.name, contentType: value.type || "application/octet-stream" });
-    }
-  } else if (body !== void 0) {
-    if (body instanceof Blob) request.body = Buffer.from(await body.arrayBuffer());
-    else if (typeof body === "string") request.body = Buffer.from(body);
-    else if (body instanceof ArrayBuffer) request.body = Buffer.from(new Uint8Array(body));
-    else request.body = Buffer.from(body);
-  }
-  return request;
-}
-var NativeCloudTransport;
-var init_native_cloud = __esm({
-  "src/native-cloud.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_native_sandbox();
-    init_native_worker_client();
-    NativeCloudTransport = class {
-      constructor(options) {
-        this.options = options;
-        if (!Number.isSafeInteger(options.maxRetries) || options.maxRetries < 0 || options.maxRetries > 4294967295) {
-          throw new RangeError("maxRetries must be a non-negative 32-bit integer");
-        }
-        if (!Number.isFinite(options.retryBackoffMs) || options.retryBackoffMs < 0) {
-          throw new RangeError("retryBackoffMs must be a non-negative finite number");
-        }
-      }
-      native;
-      closed = false;
-      client() {
-        if (this.closed) throw new Error("Tensorlake native client is closed");
-        if (this.native) return this.native;
-        const ctor = loadNativeSandboxBinding().NativeCloudClient;
-        if (!ctor) throw new Error("Native binding does not export NativeCloudClient; rebuild with 'npm run build:native'");
-        return this.native = new ctor(JSON.stringify(this.options));
-      }
-      close() {
-        this.closed = true;
-        releaseNativeHandle(this.native ?? null);
-        this.native = void 0;
-      }
-      async requestResponse(method, path4, options) {
-        const request = await serializeRequest(method, path4, options);
-        const raw = await callNative(() => this.client().request(request));
-        const response = new Response(
-          [204, 205, 304].includes(raw.status) ? null : Uint8Array.from(raw.data).buffer,
-          { status: raw.status, headers: JSON.parse(raw.headersJson) }
-        );
-        return Object.assign(response, { traceId: raw.traceId });
-      }
-      async requestJson(method, path4) {
-        const response = await this.requestResponse(method, path4);
-        const text = await response.text();
-        const value = text ? JSON.parse(text) : null;
-        return Object.assign(value ?? {}, { traceId: response.traceId });
-      }
-      async *stream(method, path4, signal) {
-        if (signal?.aborted) return;
-        const request = await serializeRequest(method, path4, { headers: { Accept: "text/event-stream" } });
-        yield* nativeEventStream((emit) => this.client().stream(request, emit), void 0, signal);
-      }
-    };
-  }
-});
-
-// src/cloud-client.ts
-import { nanoid } from "nanoid";
-function secretFromMetadata(metadata) {
-  return {
-    id: metadata.id,
-    name: metadata.name,
-    createdAt: new Date(metadata.created_at_ms)
-  };
-}
-function applicationAllowsUnauthenticatedRequests(manifest) {
-  return Array.isArray(manifest.allow) && manifest.allow.includes(UNAUTHENTICATED_REQUESTS);
-}
-function publicEndpointIdFromManifest(manifest) {
-  for (const key of ["public_endpoint_id", "publicEndpointId"]) {
-    const value = manifest[key];
-    if (typeof value === "string" && value.length > 0) {
-      return value;
-    }
-  }
-  return void 0;
-}
-function generatePublicEndpointId() {
-  return `endpoint_${nanoid()}`;
-}
-function createApplicationBuildForm(request, imageContexts) {
-  const contextsByPartName = /* @__PURE__ */ new Map();
-  for (const context of imageContexts) {
-    if (contextsByPartName.has(context.contextTarPartName)) {
-      throw new Error(
-        `duplicate image context part name '${context.contextTarPartName}'`
-      );
-    }
-    contextsByPartName.set(context.contextTarPartName, context);
-  }
-  const form = new FormData();
-  form.append(
-    "app_version",
-    new Blob([JSON.stringify(request)], { type: "application/json" }),
-    "app_version"
-  );
-  for (const image of request.images) {
-    const context = contextsByPartName.get(image.contextTarPartName);
-    if (!context) {
-      throw new Error(
-        `missing image context for part '${image.contextTarPartName}'`
-      );
-    }
-    form.append(
-      image.contextTarPartName,
-      new Blob([toBlobPart(context.contextTarGz)]),
-      `${image.contextTarPartName}.tar.gz`
-    );
-  }
-  for (const context of imageContexts) {
-    if (!request.images.some((image) => image.contextTarPartName === context.contextTarPartName)) {
-      throw new Error(
-        `unexpected image context for part '${context.contextTarPartName}'`
-      );
-    }
-  }
-  return form;
-}
-function trimTrailingSlashes2(value) {
-  return value.endsWith("/") ? value.slice(0, -1) : value;
-}
-function nextRequestPath(next) {
-  const schemeIndex = next.indexOf("://");
-  if (schemeIndex !== -1) {
-    const afterScheme = next.slice(schemeIndex + 3);
-    const slashIndex = afterScheme.indexOf("/");
-    return slashIndex === -1 ? "/" : afterScheme.slice(slashIndex);
-  }
-  return next.startsWith("/") ? next : `/${next}`;
-}
-function toBlobPart(data) {
-  if (typeof data === "string" || data instanceof Blob) {
-    return data;
-  }
-  if (data instanceof Uint8Array) {
-    return Uint8Array.from(data).buffer;
-  }
-  return data;
-}
-function toRequestBody(data) {
-  return toBlobPart(data);
-}
-async function parseJsonResponse(response) {
-  const text = await response.text();
-  if (!text) {
-    return void 0;
-  }
-  return JSON.parse(text);
-}
-var CloudClient, UNAUTHENTICATED_REQUESTS;
-var init_cloud_client = __esm({
-  "src/cloud-client.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_defaults();
-    init_native_cloud();
-    init_models();
-    CloudClient = class _CloudClient {
-      transport;
-      organizationId;
-      projectId;
-      namespace;
-      constructor(options) {
-        this.organizationId = options?.organizationId;
-        this.projectId = options?.projectId;
-        this.namespace = options?.namespace ?? NAMESPACE;
-        this.transport = new NativeCloudTransport({
-          baseUrl: options?.apiUrl ?? API_URL,
-          apiKey: options?.apiKey ?? API_KEY,
-          organizationId: this.organizationId,
-          projectId: this.projectId,
-          maxRetries: options?.maxRetries ?? MAX_RETRIES,
-          retryBackoffMs: options?.retryBackoffMs ?? RETRY_BACKOFF_MS,
-          timeoutMs: DEFAULT_HTTP_TIMEOUT_MS,
-          userAgent: `tensorlake-typescript-sdk/${SDK_VERSION}`
-        });
-      }
-      static forCloud(options) {
-        return new _CloudClient(options);
-      }
-      close() {
-        this.transport.close();
-      }
-      async upsertApplication(manifest, codeZip, upgradeRunningRequests = false) {
-        const applicationManifest = { ...manifest };
-        let publicEndpointId = publicEndpointIdFromManifest(applicationManifest);
-        if (applicationAllowsUnauthenticatedRequests(applicationManifest) && publicEndpointId === void 0) {
-          const applicationName = applicationManifest.name;
-          if (typeof applicationName === "string" && applicationName.length > 0) {
-            publicEndpointId = await this.existingApplicationPublicEndpointId(applicationName);
-          }
-          publicEndpointId ??= generatePublicEndpointId();
-        }
-        if (publicEndpointId !== void 0) {
-          applicationManifest.public_endpoint_id = publicEndpointId;
-          delete applicationManifest.publicEndpointId;
-        }
-        const form = new FormData();
-        form.append(
-          "code",
-          new Blob([toBlobPart(codeZip)], { type: "application/zip" }),
-          "code.zip"
-        );
-        form.append("code_content_type", "application/zip");
-        form.append("application", JSON.stringify(applicationManifest));
-        form.append(
-          "upgrade_requests_to_latest_code",
-          String(upgradeRunningRequests)
-        );
-        await this.transport.requestResponse("POST", this.namespacePath("applications"), {
-          body: form
-        });
-      }
-      async deleteApplication(applicationName) {
-        await this.transport.requestResponse(
-          "DELETE",
-          this.namespacePath(`applications/${encodeURIComponent(applicationName)}`)
-        );
-      }
-      async deleteSandboxImage(imageName) {
-        await this.transport.requestResponse(
-          "DELETE",
-          this.namespacePath(`sandbox-images/${encodeURIComponent(imageName)}`)
-        );
-      }
-      /**
-       * Look up a registered sandbox image (template) by its registered name.
-       *
-       * Returns the template, or `null` when no image with that name exists.
-       * API-key clients may omit organization/project IDs and use the
-       * token-scoped Platform API route directly. Explicit scope remains
-       * available for PAT callers.
-       */
-      async findSandboxImageByName(imageName, options) {
-        const base = this.platformProjectPath(
-          "sandbox-templates",
-          options?.organizationId,
-          options?.projectId
-        );
-        const response = await this.transport.requestResponse(
-          "GET",
-          `${base}/by-name/${encodeURIComponent(imageName)}`,
-          { statusOnlyCodes: /* @__PURE__ */ new Set([404]) }
-        );
-        if (response.status === 404) {
-          return null;
-        }
-        const raw = await parseJsonResponse(response);
-        return fromSnakeKeys(raw);
-      }
-      /**
-       * List all registered sandbox images (templates), following pagination to
-       * the end. API-key clients may omit organization/project IDs and use the
-       * token-scoped Platform API route directly.
-       */
-      async listSandboxImages(options) {
-        const base = this.platformProjectPath(
-          "sandbox-templates",
-          options?.organizationId,
-          options?.projectId
-        );
-        let path4 = `${base}?pageSize=100`;
-        const templates = [];
-        while (path4 !== null) {
-          const page = await this.transport.requestJson(
-            "GET",
-            path4
-          );
-          for (const item of page.items ?? []) {
-            templates.push(fromSnakeKeys(item));
-          }
-          const next = page.pagination?.next;
-          path4 = next ? nextRequestPath(next) : null;
-        }
-        return templates;
-      }
-      async applications() {
-        const raw = await this.transport.requestJson(
-          "GET",
-          this.namespacePath("applications")
-        );
-        return (raw.applications ?? []).map(
-          (application) => fromSnakeKeys(application)
-        );
-      }
-      async applicationManifest(applicationName) {
-        const raw = await this.transport.requestJson(
-          "GET",
-          this.namespacePath(`applications/${encodeURIComponent(applicationName)}`)
-        );
-        return fromSnakeKeys(raw);
-      }
-      async runRequest(applicationName, inputs = []) {
-        const path4 = this.namespacePath(
-          `applications/${encodeURIComponent(applicationName)}`
-        );
-        const response = inputs.length === 0 ? await this.transport.requestResponse("POST", path4, {
-          body: new Uint8Array(),
-          headers: { Accept: "application/json" }
-        }) : inputs.length === 1 && inputs[0].name === "0" ? await this.transport.requestResponse("POST", path4, {
-          body: toRequestBody(inputs[0].data),
-          headers: {
-            Accept: "application/json",
-            "Content-Type": inputs[0].contentType
-          }
-        }) : await this.runMultipartRequest(path4, inputs);
-        const body = await parseJsonResponse(response);
-        const requestId = body?.request_id;
-        if (!requestId) {
-          throw new Error("missing request_id in run request response body");
-        }
-        return requestId;
-      }
-      async waitOnRequestCompletion(applicationName, requestId) {
-        const stream = this.transport.stream(
-          "GET",
-          this.namespacePath(
-            `applications/${encodeURIComponent(applicationName)}/requests/${encodeURIComponent(requestId)}/progress`
-          )
-        );
-        for await (const event of stream) {
-          if (Object.prototype.hasOwnProperty.call(event, "RequestFinished")) {
-            return;
-          }
-        }
-        throw new Error("progress stream ended before request completion");
-      }
-      async requestMetadata(applicationName, requestId) {
-        const raw = await this.transport.requestJson(
-          "GET",
-          this.namespacePath(
-            `applications/${encodeURIComponent(applicationName)}/requests/${encodeURIComponent(requestId)}`
-          )
-        );
-        return fromSnakeKeys(raw);
-      }
-      async requestOutput(applicationName, requestId) {
-        const response = await this.transport.requestResponse(
-          "GET",
-          this.namespacePath(
-            `applications/${encodeURIComponent(applicationName)}/requests/${encodeURIComponent(requestId)}/output`
-          )
-        );
-        const serializedValue = new Uint8Array(await response.arrayBuffer());
-        const contentType = response.headers.get("content-type") ?? "";
-        return {
-          serializedValue,
-          contentType
-        };
-      }
-      async listSecrets(options) {
-        const base = this.secretCollectionPath(
-          options?.organizationId,
-          options?.projectId
-        );
-        const raw = await this.transport.requestJson("GET", base);
-        const pageSize = Math.max(0, options?.pageSize ?? 100);
-        return Object.assign(
-          {
-            items: raw.slice(0, pageSize).map(secretFromMetadata),
-            pagination: { total: raw.length }
-          },
-          { traceId: raw.traceId }
-        );
-      }
-      async getSecret(secretId, options) {
-        const base = this.secretCollectionPath(
-          options?.organizationId,
-          options?.projectId
-        );
-        const raw = await this.transport.requestJson(
-          "GET",
-          `${base}/${encodeURIComponent(secretId)}`
-        );
-        return Object.assign(secretFromMetadata(raw), { traceId: raw.traceId });
-      }
-      async upsertSecrets(secrets, options) {
-        const base = this.secretCollectionPath(
-          options?.organizationId,
-          options?.projectId
-        );
-        if (Array.isArray(secrets)) {
-          const results = [];
-          for (const secret of secrets) {
-            results.push(await this.upsertSecret(base, secret));
-          }
-          return results;
-        }
-        return this.upsertSecret(base, secrets);
-      }
-      async deleteSecret(secretId, options) {
-        const base = this.secretCollectionPath(
-          options?.organizationId,
-          options?.projectId
-        );
-        await this.transport.requestResponse(
-          "DELETE",
-          `${base}/${encodeURIComponent(secretId)}`
-        );
-      }
-      async upsertSecret(base, secret) {
-        let response = await this.transport.requestResponse("POST", base, {
-          json: secret,
-          headers: { "Idempotency-Key": nanoid() },
-          statusOnlyCodes: /* @__PURE__ */ new Set([409])
-        });
-        if (response.status === 409) {
-          const prefix = base.slice(0, -"/secrets".length);
-          const existing = await this.transport.requestJson(
-            "GET",
-            `${prefix}/secret-names/${encodeURIComponent(secret.name)}`
-          );
-          response = await this.transport.requestResponse(
-            "POST",
-            `${base}/${encodeURIComponent(existing.id)}/versions`,
-            {
-              json: { value: secret.value },
-              headers: { "Idempotency-Key": nanoid() }
-            }
-          );
-        }
-        const metadata = await parseJsonResponse(response);
-        return Object.assign(secretFromMetadata(metadata), {
-          traceId: response.traceId
-        });
-      }
-      async startImageBuild(buildServicePath, request) {
-        const form = new FormData();
-        form.append("graph_name", request.applicationName);
-        form.append("graph_version", request.applicationVersion);
-        form.append("graph_function_name", request.functionName);
-        form.append("image_name", request.imageName);
-        form.append("image_id", request.imageId);
-        form.append(
-          "context",
-          new Blob([toBlobPart(request.buildContext)]),
-          "context.tar.gz"
-        );
-        const response = await this.transport.requestResponse(
-          "PUT",
-          `${trimTrailingSlashes2(buildServicePath)}/builds`,
-          { body: form }
-        );
-        const raw = await parseJsonResponse(response);
-        return fromSnakeKeys(raw);
-      }
-      async createApplicationBuild(buildServicePath, request, imageContexts) {
-        const form = createApplicationBuildForm(request, imageContexts);
-        const response = await this.transport.requestResponse(
-          "POST",
-          trimTrailingSlashes2(buildServicePath),
-          { body: form }
-        );
-        const raw = await parseJsonResponse(response);
-        return fromSnakeKeys(raw);
-      }
-      async applicationBuildInfo(buildServicePath, applicationBuildId) {
-        const raw = await this.transport.requestJson(
-          "GET",
-          `${trimTrailingSlashes2(buildServicePath)}/${encodeURIComponent(applicationBuildId)}`
-        );
-        return fromSnakeKeys(raw);
-      }
-      async cancelApplicationBuild(buildServicePath, applicationBuildId) {
-        const raw = await this.transport.requestJson(
-          "POST",
-          `${trimTrailingSlashes2(buildServicePath)}/${encodeURIComponent(applicationBuildId)}/cancel`
-        );
-        return fromSnakeKeys(raw);
-      }
-      async buildInfo(buildServicePath, buildId) {
-        const raw = await this.transport.requestJson(
-          "GET",
-          `${trimTrailingSlashes2(buildServicePath)}/builds/${encodeURIComponent(buildId)}`
-        );
-        return fromSnakeKeys(raw);
-      }
-      async cancelBuild(buildServicePath, buildId) {
-        await this.transport.requestResponse(
-          "POST",
-          `${trimTrailingSlashes2(buildServicePath)}/builds/${encodeURIComponent(buildId)}/cancel`
-        );
-      }
-      async *streamBuildLogs(buildServicePath, buildId, signal) {
-        const stream = this.transport.stream(
-          "GET",
-          `${trimTrailingSlashes2(buildServicePath)}/builds/${encodeURIComponent(buildId)}/logs`,
-          signal
-        );
-        for await (const event of stream) {
-          yield fromSnakeKeys(event);
-        }
-      }
-      async runMultipartRequest(path4, inputs) {
-        const form = new FormData();
-        for (const input of inputs) {
-          form.append(
-            input.name,
-            new Blob([toBlobPart(input.data)], { type: input.contentType }),
-            input.name
-          );
-        }
-        return this.transport.requestResponse("POST", path4, {
-          body: form,
-          headers: { Accept: "application/json" }
-        });
-      }
-      namespacePath(subpath) {
-        return `/v1/namespaces/${encodeURIComponent(this.namespace)}/${subpath.replace(/^\/+/, "")}`;
-      }
-      async existingApplicationPublicEndpointId(applicationName) {
-        const response = await this.transport.requestResponse(
-          "GET",
-          this.namespacePath(`applications/${encodeURIComponent(applicationName)}`),
-          { statusOnlyCodes: /* @__PURE__ */ new Set([404]) }
-        );
-        if (response.status === 404) {
-          return void 0;
-        }
-        const application = await parseJsonResponse(response);
-        return publicEndpointIdFromManifest(application);
-      }
-      platformProjectPath(resource, organizationId, projectId) {
-        const resolvedOrganizationId = organizationId ?? this.organizationId;
-        const resolvedProjectId = projectId ?? this.projectId;
-        if (!resolvedOrganizationId && !resolvedProjectId) {
-          return `/platform/v1/${resource}`;
-        }
-        if (!resolvedOrganizationId || !resolvedProjectId) {
-          throw new Error(
-            "organizationId and projectId must be provided together"
-          );
-        }
-        return `/platform/v1/organizations/${encodeURIComponent(resolvedOrganizationId)}/projects/${encodeURIComponent(resolvedProjectId)}/${resource}`;
-      }
-      secretCollectionPath(organizationId, projectId) {
-        const resolvedOrganizationId = organizationId ?? this.organizationId;
-        const resolvedProjectId = projectId ?? this.projectId;
-        if (!resolvedOrganizationId && !resolvedProjectId) {
-          return this.namespacePath("secrets");
-        }
-        if (!resolvedOrganizationId || !resolvedProjectId) {
-          throw new Error("organizationId and projectId must be provided together");
-        }
-        return this.namespacePath("secrets");
-      }
-    };
-    UNAUTHENTICATED_REQUESTS = "unauthenticated_requests";
-  }
-});
-
 // src/image.ts
 import { randomUUID } from "crypto";
 function cloneOperation(op) {
@@ -6419,22 +5846,477 @@ var init_native_binding = __esm({
   }
 });
 
+// src/image-builds.ts
+import path3 from "path";
+import os from "os";
+import { existsSync as existsSync2, mkdtempSync, rmSync } from "fs";
+function camelize(key) {
+  return key.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
+}
+function toImageBuildError(error) {
+  if (!(error instanceof Error)) return error;
+  let payload;
+  try {
+    payload = JSON.parse(error.message);
+  } catch {
+    return error;
+  }
+  if (!payload || payload.category !== "image_build") return error;
+  const details = {};
+  for (const [key, value] of Object.entries(payload)) {
+    if (key === "category") continue;
+    details[camelize(key)] = value;
+  }
+  const typed = details;
+  switch (typed.code) {
+    case "not_found":
+      return new ImageBuildNotFoundError(typed);
+    case "image_build_in_progress":
+      return new ImageBuildInProgressError(typed);
+    case "failed":
+      return new ImageBuildFailedError(typed);
+    case "cancelled":
+      return new ImageBuildCancelledError(typed);
+    case "timeout":
+      return new ImageBuildTimeoutError(typed);
+    case "interrupted":
+      return new ImageBuildInterruptedError(typed);
+    default:
+      return new ImageBuildError(typed);
+  }
+}
+function camelizeRecord(value) {
+  const out = {};
+  for (const [key, inner] of Object.entries(value)) out[camelize(key)] = inner;
+  return out;
+}
+function parseBuildInfo(raw) {
+  const camel = camelizeRecord(raw);
+  const result = raw.result && typeof raw.result === "object" ? camelizeRecord(raw.result) : null;
+  return {
+    buildId: String(raw.build_id ?? ""),
+    clientRequestId: camel.clientRequestId ?? null,
+    kind: String(raw.kind ?? ""),
+    name: raw.name ?? null,
+    status: String(raw.status ?? ""),
+    phase: raw.phase ?? null,
+    attemptNo: Number(raw.attempt_no ?? 0),
+    builderSandboxId: camel.builderSandboxId ?? null,
+    error: raw.error ?? null,
+    result,
+    operationDeadlineMs: camel.operationDeadlineMs ?? null,
+    createdAtMs: camel.createdAtMs ?? null,
+    updatedAtMs: camel.updatedAtMs ?? null,
+    raw
+  };
+}
+function parseResult(json) {
+  return camelizeRecord(JSON.parse(json));
+}
+function credentialsFromEnv() {
+  const context = __imageBuildInternals.buildContextFromEnv();
+  if (!context.apiKey) {
+    if (context.personalAccessToken) {
+      throw new ImageBuildError({
+        code: "auth",
+        message: "Sandbox image SDKs require TENSORLAKE_API_KEY. Personal access tokens are CLI-only."
+      });
+    }
+    throw new ImageBuildError({ code: "auth", message: "Missing TENSORLAKE_API_KEY credentials." });
+  }
+  return { apiUrl: context.apiUrl, bearerToken: context.apiKey, namespace: context.namespace };
+}
+function clientOptions(credentials) {
+  return {
+    apiUrl: credentials.apiUrl,
+    bearerToken: credentials.bearerToken,
+    namespace: credentials.namespace,
+    useScopeHeaders: false
+  };
+}
+function rejectLegacyReference(buildId) {
+  if (typeof buildId !== "string" || buildId.trim().length === 0) {
+    throw new ImageBuildError({ code: "usage", message: "buildId must be a non-empty string" });
+  }
+  if (buildId.startsWith("sandbox_template_")) {
+    throw new ImageBuildError({
+      code: "usage",
+      message: `'${buildId}' is a legacy sandbox template id; legacy images have no build operation to get, wait for or cancel`,
+      buildId
+    });
+  }
+  if (buildId.startsWith("image_")) {
+    throw new ImageBuildError({
+      code: "usage",
+      message: `'${buildId}' is an image id, not a build id; look the image up with findSandboxImageByName or use the build id admission returned`,
+      buildId
+    });
+  }
+}
+async function __runWithInterrupt(signal, run) {
+  const binding = __imageBuildInternals.loadNativeBinding();
+  if (signal === void 0) {
+    try {
+      return await run(void 0);
+    } catch (error) {
+      throw toImageBuildError(error);
+    }
+  }
+  const interruptId = binding.createImageBuildInterrupt();
+  const onAbort = () => binding.triggerImageBuildInterrupt(interruptId);
+  if (signal.aborted) onAbort();
+  else signal.addEventListener("abort", onAbort, { once: true });
+  try {
+    return await run(interruptId);
+  } catch (error) {
+    throw toImageBuildError(error);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+    binding.releaseImageBuildInterrupt(interruptId);
+  }
+}
+function makeEmitter(options) {
+  const emit = options.emit ?? (options.verbose ? __imageBuildInternals.stderrEmit : __imageBuildInternals.noopEmit);
+  let emitError;
+  const forward = (event) => {
+    try {
+      emit(__imageBuildInternals.eventToEmitDict(event));
+    } catch (error) {
+      emitError ??= error;
+    }
+  };
+  return {
+    forward,
+    emit,
+    rethrow() {
+      if (emitError != null) throw emitError;
+    }
+  };
+}
+function decodeStarted(json, credentials) {
+  const payload = JSON.parse(json);
+  return new ImageBuildHandle(parseBuildInfo(payload.build ?? {}), credentials, payload.client_request_id);
+}
+async function startImageBuild(source, options = {}, deps = {}) {
+  const emitter = makeEmitter({ emit: deps.emit ?? options.emit, verbose: options.verbose });
+  let dockerfilePath;
+  let dockerfileText;
+  let contextDir;
+  let name;
+  let tempContextDir;
+  if (source instanceof Image) {
+    if (!source.baseImage) throw new Error("Image must have a baseImage to build");
+    if (options.contextDir != null) {
+      contextDir = path3.resolve(options.contextDir);
+    } else if (__imageBuildInternals.imageRequiresContext(source)) {
+      throw new Error(
+        "This image reads files from the host (via COPY/ADD or a RUN bind mount), so it needs a build context. Pass `contextDir` pointing at the directory that contains those sources; they resolve relative to it, like `docker build <contextDir>`."
+      );
+    } else {
+      tempContextDir = mkdtempSync(path3.join(os.tmpdir(), "tl-build-context-"));
+      contextDir = tempContextDir;
+    }
+    dockerfilePath = path3.join(contextDir, "Dockerfile");
+    let text = dockerfileContent(source);
+    if (!text.endsWith("\n")) text += "\n";
+    dockerfileText = text;
+    name = options.registeredName ?? source.name;
+  } else if (typeof source === "string") {
+    const resolved = path3.resolve(source);
+    if (!existsSync2(resolved)) throw new Error(`Dockerfile not found: ${source}`);
+    dockerfilePath = resolved;
+    name = options.registeredName ?? __imageBuildInternals.defaultRegisteredName(resolved);
+  } else {
+    throw new TypeError(`source must be an Image or a Dockerfile path, got ${typeof source}`);
+  }
+  try {
+    const credentials = credentialsFromEnv();
+    const binding = __imageBuildInternals.loadNativeBinding();
+    emitter.emit({ type: "status", message: `Building image '${name}'...` });
+    const json = await __runWithInterrupt(
+      options.signal,
+      (interruptId) => binding.startImageBuild(
+        {
+          apiUrl: credentials.apiUrl,
+          bearerToken: credentials.bearerToken,
+          dockerfilePath,
+          registeredName: name,
+          diskMb: options.diskMb,
+          cpus: options.cpus,
+          memoryMb: options.memoryMb,
+          isPublic: options.isPublic ?? false,
+          namespace: credentials.namespace,
+          useScopeHeaders: false,
+          dockerConfigJson: options.dockerConfigJson,
+          dockerfileText,
+          contextDir,
+          cas: true,
+          buildArgs: options.buildArgs
+        },
+        emitter.forward,
+        interruptId
+      )
+    );
+    emitter.rethrow();
+    return decodeStarted(json, credentials);
+  } finally {
+    if (tempContextDir != null) rmSync(tempContextDir, { recursive: true, force: true });
+  }
+}
+async function startImageImport(imageReference, options = {}, deps = {}) {
+  if (typeof imageReference !== "string" || imageReference.trim().length === 0) {
+    throw new Error("image reference to import must not be empty");
+  }
+  const reference = imageReference.trim();
+  const name = options.registeredName ?? __imageBuildInternals.defaultRegisteredNameFromImage(reference);
+  const emitter = makeEmitter({ emit: deps.emit ?? options.emit, verbose: options.verbose });
+  const credentials = credentialsFromEnv();
+  const binding = __imageBuildInternals.loadNativeBinding();
+  emitter.emit({ type: "status", message: `Importing image '${reference}' as '${name}'...` });
+  const json = await __runWithInterrupt(
+    options.signal,
+    (interruptId) => binding.startImageImport(
+      {
+        apiUrl: credentials.apiUrl,
+        bearerToken: credentials.bearerToken,
+        imageReference: reference,
+        registeredName: name,
+        diskMb: options.diskMb,
+        cpus: options.cpus,
+        memoryMb: options.memoryMb,
+        isPublic: options.isPublic ?? false,
+        namespace: credentials.namespace,
+        useScopeHeaders: false,
+        dockerConfigJson: options.dockerConfigJson,
+        cas: true
+      },
+      emitter.forward,
+      interruptId
+    )
+  );
+  emitter.rethrow();
+  return decodeStarted(json, credentials);
+}
+async function getImageBuild(buildId) {
+  rejectLegacyReference(buildId);
+  const credentials = credentialsFromEnv();
+  const binding = __imageBuildInternals.loadNativeBinding();
+  let json;
+  try {
+    json = await binding.getImageBuild(clientOptions(credentials), buildId);
+  } catch (error) {
+    throw toImageBuildError(error);
+  }
+  return new ImageBuildHandle(parseBuildInfo(JSON.parse(json)), credentials);
+}
+async function waitImageBuild(buildId, options = {}) {
+  rejectLegacyReference(buildId);
+  const credentials = credentialsFromEnv();
+  const binding = __imageBuildInternals.loadNativeBinding();
+  const emitter = makeEmitter(options);
+  const json = await __runWithInterrupt(
+    options.signal,
+    (interruptId) => binding.waitImageBuild(
+      clientOptions(credentials),
+      buildId,
+      { timeoutMs: options.timeoutMs, followLogs: options.followLogs ?? false },
+      emitter.forward,
+      interruptId
+    )
+  );
+  emitter.rethrow();
+  return parseResult(json);
+}
+async function cancelImageBuildWith(credentials, selector) {
+  const binding = __imageBuildInternals.loadNativeBinding();
+  let json;
+  try {
+    json = await binding.cancelImageBuild(clientOptions(credentials), {
+      buildId: selector.buildId,
+      clientRequestId: selector.clientRequestId
+    });
+  } catch (error) {
+    throw toImageBuildError(error);
+  }
+  const payload = JSON.parse(json);
+  const outcome = String(payload.outcome ?? "");
+  return {
+    outcome,
+    build: payload.build ? parseBuildInfo(payload.build) : null,
+    confirmed: ["cancelled", "already_cancelled", "already_failed"].includes(outcome)
+  };
+}
+async function cancelImageBuild(selector) {
+  const hasBuild = selector.buildId != null;
+  const hasRequest = selector.clientRequestId != null;
+  if (hasBuild === hasRequest) {
+    throw new ImageBuildError({
+      code: "usage",
+      message: "pass exactly one of buildId or clientRequestId"
+    });
+  }
+  if (selector.buildId != null) rejectLegacyReference(selector.buildId);
+  return cancelImageBuildWith(credentialsFromEnv(), selector);
+}
+var ImageBuildError, ImageBuildNotFoundError, ImageBuildInProgressError, ImageBuildFailedError, ImageBuildCancelledError, ImageBuildTimeoutError, ImageBuildInterruptedError, ImageBuildHandle;
+var init_image_builds = __esm({
+  "src/image-builds.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_image();
+    init_sandbox_image();
+    ImageBuildError = class extends Error {
+      code;
+      buildId;
+      clientRequestId;
+      details;
+      constructor(details) {
+        super(details.message);
+        this.name = "ImageBuildError";
+        this.code = details.code;
+        this.details = details;
+        if (details.buildId) this.buildId = details.buildId;
+        if (details.clientRequestId) this.clientRequestId = details.clientRequestId;
+      }
+    };
+    ImageBuildNotFoundError = class extends ImageBuildError {
+      constructor(details) {
+        super(details);
+        this.name = "ImageBuildNotFoundError";
+      }
+    };
+    ImageBuildInProgressError = class extends ImageBuildError {
+      imageName;
+      activeBuildId;
+      activeKind;
+      activeStatus;
+      constructor(details) {
+        super(details);
+        this.name = "ImageBuildInProgressError";
+        if (details.imageName) this.imageName = details.imageName;
+        if (details.activeBuildId) this.activeBuildId = details.activeBuildId;
+        if (details.activeKind) this.activeKind = details.activeKind;
+        if (details.activeStatus) this.activeStatus = details.activeStatus;
+      }
+    };
+    ImageBuildFailedError = class extends ImageBuildError {
+      error;
+      info;
+      constructor(details) {
+        super(details);
+        this.name = "ImageBuildFailedError";
+        this.error = details.error ?? "no error recorded";
+        if (details.info) this.info = parseBuildInfo(details.info);
+      }
+    };
+    ImageBuildCancelledError = class extends ImageBuildError {
+      info;
+      constructor(details) {
+        super(details);
+        this.name = "ImageBuildCancelledError";
+        if (details.info) this.info = parseBuildInfo(details.info);
+      }
+    };
+    ImageBuildTimeoutError = class extends ImageBuildError {
+      constructor(details) {
+        super(details);
+        this.name = "ImageBuildTimeoutError";
+      }
+    };
+    ImageBuildInterruptedError = class extends ImageBuildError {
+      outcome;
+      confirmed;
+      result;
+      constructor(details) {
+        super(details);
+        this.name = "ImageBuildInterruptedError";
+        this.outcome = details.outcome ?? "unconfirmed";
+        this.confirmed = details.confirmed === true;
+        if (details.result) this.result = details.result;
+      }
+    };
+    ImageBuildHandle = class {
+      buildId;
+      /**
+       * The admission's request id, when this handle started the build. Never
+       * needed to cancel; a recovery aid for a lost admission answer.
+       */
+      clientRequestId;
+      #info;
+      #credentials;
+      /** @internal */
+      constructor(info, credentials, clientRequestId) {
+        this.buildId = info.buildId;
+        this.clientRequestId = clientRequestId ?? info.clientRequestId ?? null;
+        this.#info = info;
+        this.#credentials = credentials;
+      }
+      /** The last observed state. */
+      get info() {
+        return this.#info;
+      }
+      /** Re-read the current state. */
+      async refresh() {
+        const binding = __imageBuildInternals.loadNativeBinding();
+        let json;
+        try {
+          json = await binding.getImageBuild(clientOptions(this.#credentials), this.buildId);
+        } catch (error) {
+          throw toImageBuildError(error);
+        }
+        this.#info = parseBuildInfo(JSON.parse(json));
+        return this.#info;
+      }
+      /**
+       * Wait for publication and return this build's immutable result. See
+       * {@link ImageBuildWaitOptions} for the timeout/abort distinction.
+       */
+      async wait(options = {}) {
+        const binding = __imageBuildInternals.loadNativeBinding();
+        const emitter = makeEmitter(options);
+        const json = await __runWithInterrupt(
+          options.signal,
+          (interruptId) => binding.waitImageBuild(
+            clientOptions(this.#credentials),
+            this.buildId,
+            { timeoutMs: options.timeoutMs, followLogs: options.followLogs ?? false },
+            emitter.forward,
+            interruptId
+          )
+        );
+        emitter.rethrow();
+        const result = parseResult(json);
+        this.#info = { ...this.#info, status: "succeeded", result };
+        return result;
+      }
+      /** Cancel this build by its id (the sufficient selector). */
+      async cancel() {
+        return cancelImageBuildWith(this.#credentials, { buildId: this.buildId });
+      }
+    };
+  }
+});
+
 // src/sandbox-image.ts
 var sandbox_image_exports = {};
 __export(sandbox_image_exports, {
+  __imageBuildInternals: () => __imageBuildInternals,
   __setNativeBindingForTest: () => __setNativeBindingForTest,
   buildContextFromEnv: () => buildContextFromEnv,
   createSandboxImage: () => createSandboxImage,
   deleteSandboxImage: () => deleteSandboxImage,
+  deleteSandboxImageWithCredentials: () => deleteSandboxImageWithCredentials,
   findSandboxImageByName: () => findSandboxImageByName,
+  findSandboxImageByNameWithCredentials: () => findSandboxImageByNameWithCredentials,
   importSandboxImage: () => importSandboxImage,
   listSandboxImages: () => listSandboxImages,
+  listSandboxImagesWithCredentials: () => listSandboxImagesWithCredentials,
   runCreateSandboxImageCli: () => runCreateSandboxImageCli,
   runImportSandboxImageCli: () => runImportSandboxImageCli
 });
-import path3 from "path";
-import os from "os";
-import { existsSync as existsSync2, mkdtempSync, rmSync } from "fs";
+import path4 from "path";
+import os2 from "os";
+import { existsSync as existsSync3, mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "fs";
 import { parseArgs } from "util";
 function loadNativeBinding() {
   if (cachedNativeBinding) return cachedNativeBinding;
@@ -6468,9 +6350,9 @@ function buildContextFromEnv() {
   };
 }
 function defaultRegisteredName(dockerfilePath) {
-  const parsed = path3.parse(dockerfilePath);
+  const parsed = path4.parse(dockerfilePath);
   if (parsed.name.toLowerCase() === "dockerfile") {
-    const parentName = path3.basename(path3.dirname(dockerfilePath)).trim();
+    const parentName = path4.basename(path4.dirname(dockerfilePath)).trim();
     return parentName || "sandbox-image";
   }
   return parsed.name || "sandbox-image";
@@ -6506,6 +6388,15 @@ function eventToEmitDict(event) {
     message: event.message
   };
   if (event.stream != null) out.stream = event.stream;
+  if (event.buildId != null) out.build_id = event.buildId;
+  if (event.clientRequestId !== void 0 && event.eventType !== "status") {
+    out.client_request_id = event.clientRequestId;
+  }
+  if (event.status != null) out.status = event.status;
+  if (event.phase !== void 0 && event.eventType.startsWith("build_")) out.phase = event.phase;
+  if (event.attempt != null) out.attempt = event.attempt;
+  if (event.outcome != null) out.outcome = event.outcome;
+  if (event.confirmed != null) out.confirmed = event.confirmed;
   return out;
 }
 function runOpMountsContext(op) {
@@ -6560,24 +6451,24 @@ async function createSandboxImage(source, options = {}, deps = {}) {
     }
     let resolvedContext;
     if (options.contextDir != null) {
-      resolvedContext = path3.resolve(options.contextDir);
+      resolvedContext = path4.resolve(options.contextDir);
     } else if (imageRequiresContext(source)) {
       throw new Error(
         "This image reads files from the host (via COPY/ADD or a RUN bind mount), so it needs a build context. Pass `contextDir` pointing at the directory that contains those sources; they resolve relative to it, like `docker build <contextDir>`."
       );
     } else {
-      tempContextDir = mkdtempSync(path3.join(os.tmpdir(), "tl-build-context-"));
+      tempContextDir = mkdtempSync2(path4.join(os2.tmpdir(), "tl-build-context-"));
       resolvedContext = tempContextDir;
     }
-    dockerfilePath = path3.join(resolvedContext, "Dockerfile");
+    dockerfilePath = path4.join(resolvedContext, "Dockerfile");
     let text = dockerfileContent(source);
     if (!text.endsWith("\n")) text += "\n";
     dockerfileText = text;
     nativeContextDir = resolvedContext;
     effectiveName = options.registeredName ?? source.name;
   } else if (typeof source === "string") {
-    const resolvedPath = path3.resolve(source);
-    if (!existsSync2(resolvedPath)) {
+    const resolvedPath = path4.resolve(source);
+    if (!existsSync3(resolvedPath)) {
       throw new Error(`Dockerfile not found: ${source}`);
     }
     dockerfilePath = resolvedPath;
@@ -6607,38 +6498,47 @@ async function createSandboxImage(source, options = {}, deps = {}) {
         deps._allowPat ? "Missing TENSORLAKE_API_KEY or TENSORLAKE_PAT credentials." : "Missing TENSORLAKE_API_KEY credentials."
       );
     }
+    if (options.signal !== void 0 && !options.cas) {
+      throw new Error(
+        "signal is only supported for CAS image builds (cas: true); a legacy build has no Image Service build operation to cancel"
+      );
+    }
     emit({ type: "status", message: `Building image '${effectiveName}'...` });
     const binding = loadNativeBinding();
     let emitError;
-    const resultJson = await binding.buildSandboxImage(
-      {
-        apiUrl: context.apiUrl,
-        bearerToken,
-        dockerfilePath,
-        registeredName: effectiveName,
-        diskMb: options.diskMb,
-        builderDiskMb: options.builderDiskMb,
-        cpus: options.cpus,
-        memoryMb: options.memoryMb,
-        isPublic: options.isPublic ?? false,
-        organizationId: usePat ? context.organizationId : void 0,
-        projectId: usePat ? context.projectId : void 0,
-        namespace: context.namespace,
-        useScopeHeaders: usePat,
-        userAgent: void 0,
-        dockerCompat: options.dockerCompat ?? false,
-        dockerConfigJson: options.dockerConfigJson,
-        dockerfileText,
-        contextDir: nativeContextDir
-      },
-      (event) => {
-        try {
-          emit(eventToEmitDict(event));
-        } catch (error) {
-          emitError ??= error;
-        }
+    const nativeOptions = {
+      apiUrl: context.apiUrl,
+      bearerToken,
+      dockerfilePath,
+      registeredName: effectiveName,
+      diskMb: options.diskMb,
+      builderDiskMb: options.builderDiskMb,
+      cpus: options.cpus,
+      memoryMb: options.memoryMb,
+      isPublic: options.isPublic ?? false,
+      organizationId: usePat ? context.organizationId : void 0,
+      projectId: usePat ? context.projectId : void 0,
+      namespace: context.namespace,
+      useScopeHeaders: usePat,
+      userAgent: void 0,
+      dockerCompat: options.dockerCompat ?? false,
+      dockerConfigJson: options.dockerConfigJson,
+      dockerfileText,
+      contextDir: nativeContextDir,
+      cas: options.cas ?? false,
+      buildArgs: options.buildArgs
+    };
+    const forward = (event) => {
+      try {
+        emit(eventToEmitDict(event));
+      } catch (error) {
+        emitError ??= error;
       }
-    );
+    };
+    const resultJson = options.cas ? await __runWithInterrupt(
+      options.signal,
+      (interruptId) => binding.buildSandboxImage(nativeOptions, forward, interruptId)
+    ) : await binding.buildSandboxImage(nativeOptions, forward);
     if (emitError != null) {
       throw emitError;
     }
@@ -6655,7 +6555,7 @@ async function createSandboxImage(source, options = {}, deps = {}) {
     return result;
   } finally {
     if (tempContextDir != null) {
-      rmSync(tempContextDir, { recursive: true, force: true });
+      rmSync2(tempContextDir, { recursive: true, force: true });
     }
   }
 }
@@ -6684,39 +6584,47 @@ async function importSandboxImage(imageReference, options = {}, deps = {}) {
       deps._allowPat ? "Missing TENSORLAKE_API_KEY or TENSORLAKE_PAT credentials." : "Missing TENSORLAKE_API_KEY credentials."
     );
   }
+  if (options.signal !== void 0 && !options.cas) {
+    throw new Error(
+      "signal is only supported for CAS image imports (cas: true); a legacy import has no Image Service build operation to cancel"
+    );
+  }
   emit({
     type: "status",
     message: `Importing image '${reference}' as '${effectiveName}'...`
   });
   const binding = loadNativeBinding();
   let emitError;
-  const resultJson = await binding.importSandboxImage(
-    {
-      apiUrl: context.apiUrl,
-      bearerToken,
-      imageReference: reference,
-      registeredName: effectiveName,
-      diskMb: options.diskMb,
-      builderDiskMb: options.builderDiskMb,
-      cpus: options.cpus,
-      memoryMb: options.memoryMb,
-      isPublic: options.isPublic ?? false,
-      organizationId: usePat ? context.organizationId : void 0,
-      projectId: usePat ? context.projectId : void 0,
-      namespace: context.namespace,
-      useScopeHeaders: usePat,
-      userAgent: void 0,
-      dockerCompat: options.dockerCompat ?? false,
-      dockerConfigJson: options.dockerConfigJson
-    },
-    (event) => {
-      try {
-        emit(eventToEmitDict(event));
-      } catch (error) {
-        emitError ??= error;
-      }
+  const nativeOptions = {
+    apiUrl: context.apiUrl,
+    bearerToken,
+    imageReference: reference,
+    registeredName: effectiveName,
+    diskMb: options.diskMb,
+    builderDiskMb: options.builderDiskMb,
+    cpus: options.cpus,
+    memoryMb: options.memoryMb,
+    isPublic: options.isPublic ?? false,
+    organizationId: usePat ? context.organizationId : void 0,
+    projectId: usePat ? context.projectId : void 0,
+    namespace: context.namespace,
+    useScopeHeaders: usePat,
+    userAgent: void 0,
+    dockerCompat: options.dockerCompat ?? false,
+    dockerConfigJson: options.dockerConfigJson,
+    cas: options.cas ?? false
+  };
+  const forward = (event) => {
+    try {
+      emit(eventToEmitDict(event));
+    } catch (error) {
+      emitError ??= error;
     }
-  );
+  };
+  const resultJson = options.cas ? await __runWithInterrupt(
+    options.signal,
+    (interruptId) => binding.importSandboxImage(nativeOptions, forward, interruptId)
+  ) : await binding.importSandboxImage(nativeOptions, forward);
   if (emitError != null) {
     throw emitError;
   }
@@ -6732,10 +6640,7 @@ async function importSandboxImage(imageReference, options = {}, deps = {}) {
   emit({ type: "done" });
   return result;
 }
-async function deleteSandboxImage(imageName) {
-  if (typeof imageName !== "string" || imageName.length === 0) {
-    throw new TypeError("imageName must be a non-empty string");
-  }
+function catalogOptionsFromEnv() {
   const context = buildContextFromEnv();
   const bearerToken = context.apiKey;
   if (!bearerToken) {
@@ -6746,63 +6651,73 @@ async function deleteSandboxImage(imageName) {
     }
     throw new Error("Missing TENSORLAKE_API_KEY credentials.");
   }
-  const client = new CloudClient({
-    apiUrl: context.apiUrl,
-    apiKey: bearerToken,
-    namespace: context.namespace
-  });
-  try {
-    await client.deleteSandboxImage(imageName);
-  } finally {
-    client.close();
-  }
+  return { apiUrl: context.apiUrl, bearerToken, useScopeHeaders: false };
 }
-async function findSandboxImageByName(imageName) {
-  if (typeof imageName !== "string" || imageName.length === 0) {
-    throw new TypeError("imageName must be a non-empty string");
-  }
+function catalogOptionsFromCredentials(credentials) {
   const context = buildContextFromEnv();
-  const bearerToken = context.apiKey;
+  const bearerToken = credentials.apiKey ?? context.apiKey;
   if (!bearerToken) {
-    if (context.personalAccessToken) {
-      throw new Error(
-        "Sandbox image SDKs require TENSORLAKE_API_KEY. Personal access tokens are CLI-only."
-      );
-    }
     throw new Error("Missing TENSORLAKE_API_KEY credentials.");
   }
-  const client = new CloudClient({
-    apiUrl: context.apiUrl,
-    apiKey: bearerToken,
-    namespace: context.namespace
-  });
-  try {
-    return await client.findSandboxImageByName(imageName);
-  } finally {
-    client.close();
+  const { organizationId, projectId } = credentials;
+  if (organizationId === void 0 !== (projectId === void 0)) {
+    throw new TypeError("organizationId and projectId must be given together");
   }
+  return {
+    apiUrl: credentials.apiUrl ?? context.apiUrl,
+    bearerToken,
+    organizationId,
+    projectId,
+    useScopeHeaders: organizationId !== void 0
+  };
 }
-async function listSandboxImages() {
-  const context = buildContextFromEnv();
-  const bearerToken = context.apiKey;
-  if (!bearerToken) {
-    if (context.personalAccessToken) {
-      throw new Error(
-        "Sandbox image SDKs require TENSORLAKE_API_KEY. Personal access tokens are CLI-only."
-      );
-    }
-    throw new Error("Missing TENSORLAKE_API_KEY credentials.");
+function parseTemplate(json) {
+  return JSON.parse(json);
+}
+async function deleteSandboxImage(imageName) {
+  if (typeof imageName !== "string" || imageName.length === 0) {
+    throw new TypeError("imageName must be a non-empty string");
+  }
+  await loadNativeBinding().deleteSandboxImage(catalogOptionsFromEnv(), imageName);
+}
+async function deleteSandboxImageWithCredentials(credentials, imageName) {
+  if (typeof imageName !== "string" || imageName.length === 0) {
+    throw new TypeError("imageName must be a non-empty string");
+  }
+  await loadNativeBinding().deleteSandboxImage(
+    catalogOptionsFromCredentials(credentials),
+    imageName
+  );
+}
+async function findSandboxImageByName(imageName) {
+  if (typeof imageName !== "string" || imageName.length === 0) {
+    throw new TypeError("imageName must be a non-empty string");
   }
-  const client = new CloudClient({
-    apiUrl: context.apiUrl,
-    apiKey: bearerToken,
-    namespace: context.namespace
-  });
-  try {
-    return await client.listSandboxImages();
-  } finally {
-    client.close();
+  const json = await loadNativeBinding().findSandboxImage(
+    catalogOptionsFromEnv(),
+    imageName
+  );
+  return json == null ? null : parseTemplate(json);
+}
+async function findSandboxImageByNameWithCredentials(credentials, imageName) {
+  if (typeof imageName !== "string" || imageName.length === 0) {
+    throw new TypeError("imageName must be a non-empty string");
   }
+  const json = await loadNativeBinding().findSandboxImage(
+    catalogOptionsFromCredentials(credentials),
+    imageName
+  );
+  return json == null ? null : parseTemplate(json);
+}
+async function listSandboxImages() {
+  const json = await loadNativeBinding().listSandboxImages(catalogOptionsFromEnv());
+  return JSON.parse(json);
+}
+async function listSandboxImagesWithCredentials(credentials) {
+  const json = await loadNativeBinding().listSandboxImages(
+    catalogOptionsFromCredentials(credentials)
+  );
+  return JSON.parse(json);
 }
 async function runCreateSandboxImageCli(argv = process.argv.slice(2)) {
   const parsed = parseArgs({
@@ -6912,15 +6827,25 @@ async function runImportSandboxImageCli(argv = process.argv.slice(2)) {
     { emit: ndjsonStdoutEmit, _allowPat: true }
   );
 }
-var cachedNativeBinding, cachedNativeBindingError, DEFAULT_IMAGE_NAME2;
+var cachedNativeBinding, cachedNativeBindingError, DEFAULT_IMAGE_NAME2, __imageBuildInternals;
 var init_sandbox_image = __esm({
   "src/sandbox-image.ts"() {
     "use strict";
     init_esm_shims();
-    init_cloud_client();
     init_image();
     init_native_binding();
+    init_image_builds();
     DEFAULT_IMAGE_NAME2 = "default";
+    __imageBuildInternals = {
+      loadNativeBinding: () => loadNativeBinding(),
+      buildContextFromEnv: () => buildContextFromEnv(),
+      stderrEmit: (event) => stderrEmit(event),
+      noopEmit: (event) => noopEmit(event),
+      eventToEmitDict: (event) => eventToEmitDict(event),
+      imageRequiresContext: (image) => imageRequiresContext(image),
+      defaultRegisteredName: (dockerfilePath) => defaultRegisteredName(dockerfilePath),
+      defaultRegisteredNameFromImage: (reference) => defaultRegisteredNameFromImage(reference)
+    };
   }
 });
 
@@ -6932,11 +6857,546 @@ init_pending_sandbox();
 init_sandbox();
 init_desktop();
 init_tunnel();
-init_cloud_client();
+
+// src/cloud-client.ts
+init_esm_shims();
+init_defaults();
+import { nanoid } from "nanoid";
+
+// src/native-cloud.ts
+init_esm_shims();
+init_native_sandbox();
+init_native_worker_client();
+var NativeCloudTransport = class {
+  constructor(options) {
+    this.options = options;
+    if (!Number.isSafeInteger(options.maxRetries) || options.maxRetries < 0 || options.maxRetries > 4294967295) {
+      throw new RangeError("maxRetries must be a non-negative 32-bit integer");
+    }
+    if (!Number.isFinite(options.retryBackoffMs) || options.retryBackoffMs < 0) {
+      throw new RangeError("retryBackoffMs must be a non-negative finite number");
+    }
+  }
+  native;
+  closed = false;
+  client() {
+    if (this.closed) throw new Error("Tensorlake native client is closed");
+    if (this.native) return this.native;
+    const ctor = loadNativeSandboxBinding().NativeCloudClient;
+    if (!ctor) throw new Error("Native binding does not export NativeCloudClient; rebuild with 'npm run build:native'");
+    return this.native = new ctor(JSON.stringify(this.options));
+  }
+  close() {
+    this.closed = true;
+    releaseNativeHandle(this.native ?? null);
+    this.native = void 0;
+  }
+  async requestResponse(method, path5, options) {
+    const request = await serializeRequest(method, path5, options);
+    const raw = await callNative(() => this.client().request(request));
+    const response = new Response(
+      [204, 205, 304].includes(raw.status) ? null : Uint8Array.from(raw.data).buffer,
+      { status: raw.status, headers: JSON.parse(raw.headersJson) }
+    );
+    return Object.assign(response, { traceId: raw.traceId });
+  }
+  async requestJson(method, path5) {
+    const response = await this.requestResponse(method, path5);
+    const text = await response.text();
+    const value = text ? JSON.parse(text) : null;
+    return Object.assign(value ?? {}, { traceId: response.traceId });
+  }
+  async *stream(method, path5, signal) {
+    if (signal?.aborted) return;
+    const request = await serializeRequest(method, path5, { headers: { Accept: "text/event-stream" } });
+    yield* nativeEventStream((emit) => this.client().stream(request, emit), void 0, signal);
+  }
+};
+async function serializeRequest(method, path5, options) {
+  const headers = { ...options?.headers };
+  let body = options?.body;
+  if (options?.json !== void 0) {
+    body = JSON.stringify(options.json);
+    if (!Object.keys(headers).some((key) => key.toLowerCase() === "content-type")) {
+      headers["Content-Type"] = "application/json";
+    }
+  }
+  const request = {
+    method,
+    path: path5,
+    headersJson: JSON.stringify(headers),
+    statusOnlyCodes: [...options?.statusOnlyCodes ?? []]
+  };
+  if (body instanceof FormData) {
+    request.parts = [];
+    for (const [name, value] of body.entries()) {
+      request.parts.push(typeof value === "string" ? { name, data: Buffer.from(value) } : { name, data: Buffer.from(await value.arrayBuffer()), filename: value.name, contentType: value.type || "application/octet-stream" });
+    }
+  } else if (body !== void 0) {
+    if (body instanceof Blob) request.body = Buffer.from(await body.arrayBuffer());
+    else if (typeof body === "string") request.body = Buffer.from(body);
+    else if (body instanceof ArrayBuffer) request.body = Buffer.from(new Uint8Array(body));
+    else request.body = Buffer.from(body);
+  }
+  return request;
+}
+
+// src/cloud-client.ts
+init_models();
+init_sandbox_image();
+var CloudClient = class _CloudClient {
+  transport;
+  apiUrl;
+  apiKey;
+  organizationId;
+  projectId;
+  namespace;
+  constructor(options) {
+    this.apiUrl = options?.apiUrl ?? API_URL;
+    this.apiKey = options?.apiKey ?? API_KEY;
+    this.organizationId = options?.organizationId;
+    this.projectId = options?.projectId;
+    this.namespace = options?.namespace ?? NAMESPACE;
+    this.transport = new NativeCloudTransport({
+      baseUrl: options?.apiUrl ?? API_URL,
+      apiKey: options?.apiKey ?? API_KEY,
+      organizationId: this.organizationId,
+      projectId: this.projectId,
+      maxRetries: options?.maxRetries ?? MAX_RETRIES,
+      retryBackoffMs: options?.retryBackoffMs ?? RETRY_BACKOFF_MS,
+      timeoutMs: DEFAULT_HTTP_TIMEOUT_MS,
+      userAgent: `tensorlake-typescript-sdk/${SDK_VERSION}`
+    });
+  }
+  static forCloud(options) {
+    return new _CloudClient(options);
+  }
+  close() {
+    this.transport.close();
+  }
+  async upsertApplication(manifest, codeZip, upgradeRunningRequests = false) {
+    const applicationManifest = { ...manifest };
+    let publicEndpointId = publicEndpointIdFromManifest(applicationManifest);
+    if (applicationAllowsUnauthenticatedRequests(applicationManifest) && publicEndpointId === void 0) {
+      const applicationName = applicationManifest.name;
+      if (typeof applicationName === "string" && applicationName.length > 0) {
+        publicEndpointId = await this.existingApplicationPublicEndpointId(applicationName);
+      }
+      publicEndpointId ??= generatePublicEndpointId();
+    }
+    if (publicEndpointId !== void 0) {
+      applicationManifest.public_endpoint_id = publicEndpointId;
+      delete applicationManifest.publicEndpointId;
+    }
+    const form = new FormData();
+    form.append(
+      "code",
+      new Blob([toBlobPart(codeZip)], { type: "application/zip" }),
+      "code.zip"
+    );
+    form.append("code_content_type", "application/zip");
+    form.append("application", JSON.stringify(applicationManifest));
+    form.append(
+      "upgrade_requests_to_latest_code",
+      String(upgradeRunningRequests)
+    );
+    await this.transport.requestResponse("POST", this.namespacePath("applications"), {
+      body: form
+    });
+  }
+  async deleteApplication(applicationName) {
+    await this.transport.requestResponse(
+      "DELETE",
+      this.namespacePath(`applications/${encodeURIComponent(applicationName)}`)
+    );
+  }
+  /**
+   * Delete a registered sandbox image by name or id through the merged
+   * catalog, with this client's credentials: an `image_` id or a name the
+   * Image Service knows deletes a CAS image, a `sandbox_template_` id or a
+   * name registered only in the platform registry deletes a legacy image.
+   * Rejects when neither catalog knows the reference. The same semantics
+   * and accepted differences as the module-level `deleteSandboxImage`.
+   */
+  async deleteSandboxImage(imageName) {
+    await deleteSandboxImageWithCredentials(this.catalogCredentials(), imageName);
+  }
+  /**
+   * Look up a registered sandbox image by name or id through the merged
+   * catalog, with this client's credentials. Returns the image in the
+   * sandbox-template shape, or `null` when neither the Image Service nor the
+   * platform registry knows the reference. An explicit organization/project
+   * scope (the client's, or the call's override) addresses that project's
+   * routes directly, as before; without one the key's own scope applies.
+   */
+  async findSandboxImageByName(imageName, options) {
+    return findSandboxImageByNameWithCredentials(
+      this.catalogCredentials(options),
+      imageName
+    );
+  }
+  /**
+   * List every registered sandbox image of the project (CAS and legacy, in
+   * the sandbox-template shape, newest first) through the merged catalog,
+   * with this client's credentials. An explicit organization/project scope
+   * (the client's, or the call's override) addresses that project's routes
+   * directly, as before; without one the key's own scope applies.
+   */
+  async listSandboxImages(options) {
+    return listSandboxImagesWithCredentials(this.catalogCredentials(options));
+  }
+  catalogCredentials(options) {
+    return {
+      apiUrl: this.apiUrl,
+      apiKey: this.apiKey,
+      organizationId: options?.organizationId ?? this.organizationId,
+      projectId: options?.projectId ?? this.projectId
+    };
+  }
+  async applications() {
+    const raw = await this.transport.requestJson(
+      "GET",
+      this.namespacePath("applications")
+    );
+    return (raw.applications ?? []).map(
+      (application) => fromSnakeKeys(application)
+    );
+  }
+  async applicationManifest(applicationName) {
+    const raw = await this.transport.requestJson(
+      "GET",
+      this.namespacePath(`applications/${encodeURIComponent(applicationName)}`)
+    );
+    return fromSnakeKeys(raw);
+  }
+  async runRequest(applicationName, inputs = []) {
+    const path5 = this.namespacePath(
+      `applications/${encodeURIComponent(applicationName)}`
+    );
+    const response = inputs.length === 0 ? await this.transport.requestResponse("POST", path5, {
+      body: new Uint8Array(),
+      headers: { Accept: "application/json" }
+    }) : inputs.length === 1 && inputs[0].name === "0" ? await this.transport.requestResponse("POST", path5, {
+      body: toRequestBody(inputs[0].data),
+      headers: {
+        Accept: "application/json",
+        "Content-Type": inputs[0].contentType
+      }
+    }) : await this.runMultipartRequest(path5, inputs);
+    const body = await parseJsonResponse(response);
+    const requestId = body?.request_id;
+    if (!requestId) {
+      throw new Error("missing request_id in run request response body");
+    }
+    return requestId;
+  }
+  async waitOnRequestCompletion(applicationName, requestId) {
+    const stream = this.transport.stream(
+      "GET",
+      this.namespacePath(
+        `applications/${encodeURIComponent(applicationName)}/requests/${encodeURIComponent(requestId)}/progress`
+      )
+    );
+    for await (const event of stream) {
+      if (Object.prototype.hasOwnProperty.call(event, "RequestFinished")) {
+        return;
+      }
+    }
+    throw new Error("progress stream ended before request completion");
+  }
+  async requestMetadata(applicationName, requestId) {
+    const raw = await this.transport.requestJson(
+      "GET",
+      this.namespacePath(
+        `applications/${encodeURIComponent(applicationName)}/requests/${encodeURIComponent(requestId)}`
+      )
+    );
+    return fromSnakeKeys(raw);
+  }
+  async requestOutput(applicationName, requestId) {
+    const response = await this.transport.requestResponse(
+      "GET",
+      this.namespacePath(
+        `applications/${encodeURIComponent(applicationName)}/requests/${encodeURIComponent(requestId)}/output`
+      )
+    );
+    const serializedValue = new Uint8Array(await response.arrayBuffer());
+    const contentType = response.headers.get("content-type") ?? "";
+    return {
+      serializedValue,
+      contentType
+    };
+  }
+  async listSecrets(options) {
+    const base = this.secretCollectionPath(
+      options?.organizationId,
+      options?.projectId
+    );
+    const raw = await this.transport.requestJson("GET", base);
+    const pageSize = Math.max(0, options?.pageSize ?? 100);
+    return Object.assign(
+      {
+        items: raw.slice(0, pageSize).map(secretFromMetadata),
+        pagination: { total: raw.length }
+      },
+      { traceId: raw.traceId }
+    );
+  }
+  async getSecret(secretId, options) {
+    const base = this.secretCollectionPath(
+      options?.organizationId,
+      options?.projectId
+    );
+    const raw = await this.transport.requestJson(
+      "GET",
+      `${base}/${encodeURIComponent(secretId)}`
+    );
+    return Object.assign(secretFromMetadata(raw), { traceId: raw.traceId });
+  }
+  async upsertSecrets(secrets, options) {
+    const base = this.secretCollectionPath(
+      options?.organizationId,
+      options?.projectId
+    );
+    if (Array.isArray(secrets)) {
+      const results = [];
+      for (const secret of secrets) {
+        results.push(await this.upsertSecret(base, secret));
+      }
+      return results;
+    }
+    return this.upsertSecret(base, secrets);
+  }
+  async deleteSecret(secretId, options) {
+    const base = this.secretCollectionPath(
+      options?.organizationId,
+      options?.projectId
+    );
+    await this.transport.requestResponse(
+      "DELETE",
+      `${base}/${encodeURIComponent(secretId)}`
+    );
+  }
+  async upsertSecret(base, secret) {
+    let response = await this.transport.requestResponse("POST", base, {
+      json: secret,
+      headers: { "Idempotency-Key": nanoid() },
+      statusOnlyCodes: /* @__PURE__ */ new Set([409])
+    });
+    if (response.status === 409) {
+      const prefix = base.slice(0, -"/secrets".length);
+      const existing = await this.transport.requestJson(
+        "GET",
+        `${prefix}/secret-names/${encodeURIComponent(secret.name)}`
+      );
+      response = await this.transport.requestResponse(
+        "POST",
+        `${base}/${encodeURIComponent(existing.id)}/versions`,
+        {
+          json: { value: secret.value },
+          headers: { "Idempotency-Key": nanoid() }
+        }
+      );
+    }
+    const metadata = await parseJsonResponse(response);
+    return Object.assign(secretFromMetadata(metadata), {
+      traceId: response.traceId
+    });
+  }
+  async startImageBuild(buildServicePath, request) {
+    const form = new FormData();
+    form.append("graph_name", request.applicationName);
+    form.append("graph_version", request.applicationVersion);
+    form.append("graph_function_name", request.functionName);
+    form.append("image_name", request.imageName);
+    form.append("image_id", request.imageId);
+    form.append(
+      "context",
+      new Blob([toBlobPart(request.buildContext)]),
+      "context.tar.gz"
+    );
+    const response = await this.transport.requestResponse(
+      "PUT",
+      `${trimTrailingSlashes2(buildServicePath)}/builds`,
+      { body: form }
+    );
+    const raw = await parseJsonResponse(response);
+    return fromSnakeKeys(raw);
+  }
+  async createApplicationBuild(buildServicePath, request, imageContexts) {
+    const form = createApplicationBuildForm(request, imageContexts);
+    const response = await this.transport.requestResponse(
+      "POST",
+      trimTrailingSlashes2(buildServicePath),
+      { body: form }
+    );
+    const raw = await parseJsonResponse(response);
+    return fromSnakeKeys(raw);
+  }
+  async applicationBuildInfo(buildServicePath, applicationBuildId) {
+    const raw = await this.transport.requestJson(
+      "GET",
+      `${trimTrailingSlashes2(buildServicePath)}/${encodeURIComponent(applicationBuildId)}`
+    );
+    return fromSnakeKeys(raw);
+  }
+  async cancelApplicationBuild(buildServicePath, applicationBuildId) {
+    const raw = await this.transport.requestJson(
+      "POST",
+      `${trimTrailingSlashes2(buildServicePath)}/${encodeURIComponent(applicationBuildId)}/cancel`
+    );
+    return fromSnakeKeys(raw);
+  }
+  async buildInfo(buildServicePath, buildId) {
+    const raw = await this.transport.requestJson(
+      "GET",
+      `${trimTrailingSlashes2(buildServicePath)}/builds/${encodeURIComponent(buildId)}`
+    );
+    return fromSnakeKeys(raw);
+  }
+  async cancelBuild(buildServicePath, buildId) {
+    await this.transport.requestResponse(
+      "POST",
+      `${trimTrailingSlashes2(buildServicePath)}/builds/${encodeURIComponent(buildId)}/cancel`
+    );
+  }
+  async *streamBuildLogs(buildServicePath, buildId, signal) {
+    const stream = this.transport.stream(
+      "GET",
+      `${trimTrailingSlashes2(buildServicePath)}/builds/${encodeURIComponent(buildId)}/logs`,
+      signal
+    );
+    for await (const event of stream) {
+      yield fromSnakeKeys(event);
+    }
+  }
+  async runMultipartRequest(path5, inputs) {
+    const form = new FormData();
+    for (const input of inputs) {
+      form.append(
+        input.name,
+        new Blob([toBlobPart(input.data)], { type: input.contentType }),
+        input.name
+      );
+    }
+    return this.transport.requestResponse("POST", path5, {
+      body: form,
+      headers: { Accept: "application/json" }
+    });
+  }
+  namespacePath(subpath) {
+    return `/v1/namespaces/${encodeURIComponent(this.namespace)}/${subpath.replace(/^\/+/, "")}`;
+  }
+  async existingApplicationPublicEndpointId(applicationName) {
+    const response = await this.transport.requestResponse(
+      "GET",
+      this.namespacePath(`applications/${encodeURIComponent(applicationName)}`),
+      { statusOnlyCodes: /* @__PURE__ */ new Set([404]) }
+    );
+    if (response.status === 404) {
+      return void 0;
+    }
+    const application = await parseJsonResponse(response);
+    return publicEndpointIdFromManifest(application);
+  }
+  secretCollectionPath(organizationId, projectId) {
+    const resolvedOrganizationId = organizationId ?? this.organizationId;
+    const resolvedProjectId = projectId ?? this.projectId;
+    if (!resolvedOrganizationId && !resolvedProjectId) {
+      return this.namespacePath("secrets");
+    }
+    if (!resolvedOrganizationId || !resolvedProjectId) {
+      throw new Error("organizationId and projectId must be provided together");
+    }
+    return this.namespacePath("secrets");
+  }
+};
+function secretFromMetadata(metadata) {
+  return {
+    id: metadata.id,
+    name: metadata.name,
+    createdAt: new Date(metadata.created_at_ms)
+  };
+}
+var UNAUTHENTICATED_REQUESTS = "unauthenticated_requests";
+function applicationAllowsUnauthenticatedRequests(manifest) {
+  return Array.isArray(manifest.allow) && manifest.allow.includes(UNAUTHENTICATED_REQUESTS);
+}
+function publicEndpointIdFromManifest(manifest) {
+  for (const key of ["public_endpoint_id", "publicEndpointId"]) {
+    const value = manifest[key];
+    if (typeof value === "string" && value.length > 0) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function generatePublicEndpointId() {
+  return `endpoint_${nanoid()}`;
+}
+function createApplicationBuildForm(request, imageContexts) {
+  const contextsByPartName = /* @__PURE__ */ new Map();
+  for (const context of imageContexts) {
+    if (contextsByPartName.has(context.contextTarPartName)) {
+      throw new Error(
+        `duplicate image context part name '${context.contextTarPartName}'`
+      );
+    }
+    contextsByPartName.set(context.contextTarPartName, context);
+  }
+  const form = new FormData();
+  form.append(
+    "app_version",
+    new Blob([JSON.stringify(request)], { type: "application/json" }),
+    "app_version"
+  );
+  for (const image of request.images) {
+    const context = contextsByPartName.get(image.contextTarPartName);
+    if (!context) {
+      throw new Error(
+        `missing image context for part '${image.contextTarPartName}'`
+      );
+    }
+    form.append(
+      image.contextTarPartName,
+      new Blob([toBlobPart(context.contextTarGz)]),
+      `${image.contextTarPartName}.tar.gz`
+    );
+  }
+  for (const context of imageContexts) {
+    if (!request.images.some((image) => image.contextTarPartName === context.contextTarPartName)) {
+      throw new Error(
+        `unexpected image context for part '${context.contextTarPartName}'`
+      );
+    }
+  }
+  return form;
+}
+function trimTrailingSlashes2(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+function toBlobPart(data) {
+  if (typeof data === "string" || data instanceof Blob) {
+    return data;
+  }
+  if (data instanceof Uint8Array) {
+    return Uint8Array.from(data).buffer;
+  }
+  return data;
+}
+function toRequestBody(data) {
+  return toBlobPart(data);
+}
+async function parseJsonResponse(response) {
+  const text = await response.text();
+  if (!text) {
+    return void 0;
+  }
+  return JSON.parse(text);
+}
 
 // src/api-client.ts
 init_esm_shims();
-init_cloud_client();
 
 // src/filesystem.ts
 init_esm_shims();
@@ -6954,12 +7414,12 @@ import { promisify } from "util";
 init_esm_shims();
 var GIT_MODE_DIR = 16384;
 var GIT_MODE_SYMLINK = 40960;
-function trimSlashes(path4) {
+function trimSlashes(path5) {
   let start = 0;
-  let end = path4.length;
-  while (start < end && path4.charCodeAt(start) === 47) start += 1;
-  while (end > start && path4.charCodeAt(end - 1) === 47) end -= 1;
-  return path4.slice(start, end);
+  let end = path5.length;
+  while (start < end && path5.charCodeAt(start) === 47) start += 1;
+  while (end > start && path5.charCodeAt(end - 1) === 47) end -= 1;
+  return path5.slice(start, end);
 }
 function fileEntryFromWire(entry, dirPath) {
   const mode = entry.mode ?? 33188;
@@ -6977,9 +7437,9 @@ function fileEntryFromWire(entry, dirPath) {
 }
 function mountStatusFromRaw(raw, localPath) {
   const mounted = "mounted" in raw ? Boolean(raw.mounted) : "active" in raw ? Boolean(raw.active) : true;
-  const path4 = String(raw.path || raw.mount_path || localPath || "");
+  const path5 = String(raw.path || raw.mount_path || localPath || "");
   const filesystem = raw.filesystem || raw.file_system || raw.repository || null;
-  return { path: path4, filesystem, mounted, raw };
+  return { path: path5, filesystem, mounted, raw };
 }
 var FilesystemError = class extends Error {
   constructor(message) {
@@ -6998,11 +7458,11 @@ var FilesystemNotFoundError = class extends FilesystemError {
 var FileNotFoundInFilesystemError = class extends FilesystemError {
   filesystem;
   path;
-  constructor(filesystem, path4) {
-    super(`File not found in filesystem ${filesystem}: ${path4}`);
+  constructor(filesystem, path5) {
+    super(`File not found in filesystem ${filesystem}: ${path5}`);
     this.name = "FileNotFoundInFilesystemError";
     this.filesystem = filesystem;
-    this.path = path4;
+    this.path = path5;
   }
 };
 var FilesystemAPIError = class extends FilesystemError {
@@ -7356,8 +7816,8 @@ var Filesystem = class {
   }
   // -- writes -------------------------------------------------------------------
   /** Write one file. Returns the snapshot (version) the write produced. */
-  async writeFile(path4, data, message) {
-    return await this.writeFiles(/* @__PURE__ */ new Map([[path4, data]]), message);
+  async writeFile(path5, data, message) {
+    return await this.writeFiles(/* @__PURE__ */ new Map([[path5, data]]), message);
   }
   /** Write several files (and/or delete paths) in one atomic snapshot. */
   async writeFiles(files, message, deletes = []) {
@@ -7365,8 +7825,8 @@ var Filesystem = class {
     if (entries.length === 0 && deletes.length === 0) {
       throw new FilesystemError("nothing to write: no files or deletions given");
     }
-    const writes = entries.map(([path4, data]) => ({
-      path: path4,
+    const writes = entries.map(([path5, data]) => ({
+      path: path5,
       content: toBuffer(data)
     }));
     const resolvedMessage = message || `write ${writes.length} file(s) via SDK`;
@@ -7382,9 +7842,9 @@ var Filesystem = class {
    * Stream one local file directly to object storage in bounded parts.
    * This is the memory-bounded API for multi-GiB files.
    */
-  async writeFileFromPath(path4, localPath, message) {
+  async writeFileFromPath(path5, localPath, message) {
     return await this.writeFilesFromPaths(
-      /* @__PURE__ */ new Map([[path4, localPath]]),
+      /* @__PURE__ */ new Map([[path5, localPath]]),
       message
     );
   }
@@ -7397,7 +7857,7 @@ var Filesystem = class {
     if (entries.length === 0) {
       throw new FilesystemError("nothing to write: no local files given");
     }
-    const writes = entries.map(([path4, localPath]) => ({ path: path4, localPath }));
+    const writes = entries.map(([path5, localPath]) => ({ path: path5, localPath }));
     const resolvedMessage = message || `write ${writes.length} local file(s) via SDK`;
     const branch = await this.branch();
     const traced = await callNative2(
@@ -7474,11 +7934,11 @@ var Filesystem = class {
     };
   }
   /** Delete one file. Returns the durable version the deletion produced. */
-  async deleteFile(path4, message) {
+  async deleteFile(path5, message) {
     return await this.writeFiles(
       /* @__PURE__ */ new Map(),
-      message || `delete ${path4} via SDK`,
-      [path4]
+      message || `delete ${path5} via SDK`,
+      [path5]
     );
   }
   /**
@@ -7529,15 +7989,15 @@ var Filesystem = class {
    * Read a file's bytes at `version` (the current `main` head or a retained
    * snapshot id; defaults to the filesystem's current head).
    */
-  async readFile(path4, version) {
-    return (await this.readFileWithMetadata(path4, { version })).data;
+  async readFile(path5, version) {
+    return (await this.readFileWithMetadata(path5, { version })).data;
   }
   /**
    * Read bytes and immutable metadata in one request. A range is executed by
    * Artifact Storage, so callers never download the unrequested remainder.
    */
-  async readFileWithMetadata(path4, options = {}) {
-    if (trimSlashes(path4) === "") {
+  async readFileWithMetadata(path5, options = {}) {
+    if (trimSlashes(path5) === "") {
       throw new FilesystemError("file path must not be empty");
     }
     const range = options.range;
@@ -7550,12 +8010,12 @@ var Filesystem = class {
     const traced = await callNative2(
       () => this.native.readFilesystemFile(
         this.name,
-        path4,
+        path5,
         resolvedVersion,
         range?.offset,
         range?.length
       ),
-      new FileNotFoundInFilesystemError(this.name, path4)
+      new FileNotFoundInFilesystemError(this.name, path5)
     );
     const fullSize = traced.fullSize;
     if (!traced.contentId || fullSize === void 0 || !Number.isSafeInteger(fullSize) || fullSize < 0 || traced.data.byteLength > fullSize) {
@@ -7570,9 +8030,9 @@ var Filesystem = class {
     };
   }
   /** Read a file as UTF-8 text at `version`. Throws on non-UTF-8 content. */
-  async readText(path4, version) {
+  async readText(path5, version) {
     return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(
-      await this.readFile(path4, version)
+      await this.readFile(path5, version)
     );
   }
   /** List one directory (non-recursive) at `version`. */
@@ -7635,11 +8095,11 @@ var FilesystemMount = class {
   path;
   readonly;
   /** @internal — obtain instances via `FilesystemClient.mount()`. */
-  constructor(client, cli, filesystem, path4, readonly) {
+  constructor(client, cli, filesystem, path5, readonly) {
     this.client = client;
     this.cli = cli;
     this.filesystem = filesystem;
-    this.path = path4;
+    this.path = path5;
     this.readonly = readonly;
   }
   /** Flush pending local changes into a durable snapshot. */
@@ -7657,6 +8117,7 @@ var FilesystemMount = class {
 };
 
 // src/api-client.ts
+init_sandbox_image();
 init_errors();
 var APIClient = class {
   cloudClient;
@@ -7684,7 +8145,7 @@ var APIClient = class {
     await this.cloudClient.deleteApplication(applicationName);
   }
   async deleteSandboxImage(imageName) {
-    await this.cloudClient.deleteSandboxImage(imageName);
+    await deleteSandboxImageWithCredentials(this.filesystemOptions, imageName);
   }
   async createFileSystem(name, description, options) {
     const filesystem = await new FilesystemClient(this.filesystemOptions).create(
@@ -7771,14 +8232,14 @@ var GitCli = class extends MountCli {
     if (options.readOnly && (options.publish || options.workspace !== void 0) || options.publish && options.workspace !== void 0) {
       throw new TypeError("readOnly, publish, and workspace are mutually exclusive");
     }
-    const path4 = resolve(localPath);
+    const path5 = resolve(localPath);
     const args = ["mount"];
     if (options.readOnly) args.push("--ro");
     if (options.publish) args.push("--publish");
     if (options.workspace !== void 0) args.push(`--workspace=${options.workspace}`);
-    args.push("--", target, path4);
+    args.push("--", target, path5);
     await this.run(args);
-    return new RepositoryMount(this, target, path4, options.readOnly ?? false);
+    return new RepositoryMount(this, target, path5, options.readOnly ?? false);
   }
   async unmount(localPath, options = {}) {
     requireNonEmpty(localPath, "localPath");
@@ -7816,44 +8277,44 @@ var GitCli = class extends MountCli {
       raw
     };
   }
-  async snapshot(path4, message) {
+  async snapshot(path5, message) {
     const args = ["snapshot"];
     if (message !== void 0) args.push(`--message=${message}`);
-    args.push("--", path4);
+    args.push("--", path5);
     await this.run(args);
   }
-  async sync(path4, target) {
-    const args = ["sync", "--", path4];
+  async sync(path5, target) {
+    const args = ["sync", "--", path5];
     if (target !== void 0) {
       requireNonEmpty(target, "target");
       args.push(target);
     }
     await this.run(args);
   }
-  async rebase(path4, target, failOnConflict) {
+  async rebase(path5, target, failOnConflict) {
     requireNonEmpty(target, "target");
     const args = ["rebase"];
     if (failOnConflict) args.push("--fail-on-conflict");
-    args.push("--", path4, target);
+    args.push("--", path5, target);
     await this.run(args);
   }
-  async promote(path4, branch, merge) {
+  async promote(path5, branch, merge) {
     requireNonEmpty(branch, "branch");
     const args = ["promote"];
     if (merge) args.push("--merge");
-    args.push("--", path4, branch);
+    args.push("--", path5, branch);
     await this.run(args);
   }
-  async prefetch(path4) {
-    await this.run(["prefetch", "--", path4]);
+  async prefetch(path5) {
+    await this.run(["prefetch", "--", path5]);
   }
 };
 var RepositoryMount = class {
   /** @internal Obtain instances via RepositoryClient.mount(). */
-  constructor(cli, target, path4, readOnly) {
+  constructor(cli, target, path5, readOnly) {
     this.cli = cli;
     this.target = target;
-    this.path = path4;
+    this.path = path5;
     this.readOnly = readOnly;
   }
   /** Inspect workspace state, pending changes, and daemon diagnostics. */
@@ -8088,6 +8549,7 @@ function validateTimeoutMs2(timeoutMs) {
 
 // src/index.ts
 init_sandbox_image();
+init_image_builds();
 
 // src/file-system.ts
 init_esm_shims();
@@ -9471,38 +9933,38 @@ init_esm_shims();
 import { createHash } from "crypto";
 var textEncoder = new TextEncoder();
 var textDecoder = new TextDecoder("utf-8", { fatal: true });
-function assertJSONValue(value, path4, seen) {
+function assertJSONValue(value, path5, seen) {
   if (value === null || typeof value === "string" || typeof value === "boolean") return;
   if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new SerializationError(`${path4} contains a non-finite number`);
+    if (!Number.isFinite(value)) throw new SerializationError(`${path5} contains a non-finite number`);
     return;
   }
   if (typeof value !== "object") {
-    throw new SerializationError(`${path4} contains unsupported ${typeof value}`);
+    throw new SerializationError(`${path5} contains unsupported ${typeof value}`);
   }
   if (isFile(value)) {
-    throw new SerializationError(`${path4} contains a nested File; File is only supported as a direct value`);
+    throw new SerializationError(`${path5} contains a nested File; File is only supported as a direct value`);
   }
   if (isHttpBody(value)) {
     throw new SerializationError(
-      `${path4} contains a nested HttpBody; HttpBody is only supported as a direct value`
+      `${path5} contains a nested HttpBody; HttpBody is only supported as a direct value`
     );
   }
-  if (seen.has(value)) throw new SerializationError(`${path4} contains a cycle`);
+  if (seen.has(value)) throw new SerializationError(`${path5} contains a cycle`);
   if (Object.getPrototypeOf(value) !== Object.prototype && !Array.isArray(value)) {
-    throw new SerializationError(`${path4} contains unsupported ${value.constructor?.name ?? "object"}`);
+    throw new SerializationError(`${path5} contains unsupported ${value.constructor?.name ?? "object"}`);
   }
   seen.add(value);
   if (Array.isArray(value)) {
     for (let index = 0; index < value.length; index += 1) {
       if (!Object.prototype.hasOwnProperty.call(value, index)) {
-        throw new SerializationError(`${path4} contains a sparse array entry at index ${index}`);
+        throw new SerializationError(`${path5} contains a sparse array entry at index ${index}`);
       }
-      assertJSONValue(value[index], `${path4}[${index}]`, seen);
+      assertJSONValue(value[index], `${path5}[${index}]`, seen);
     }
   } else {
     for (const [key, item] of Object.entries(value)) {
-      assertJSONValue(item, `${path4}.${key}`, seen);
+      assertJSONValue(item, `${path5}.${key}`, seen);
     }
   }
   seen.delete(value);
@@ -9951,7 +10413,15 @@ export {
   Headers,
   HttpBody,
   Image,
+  ImageBuildCancelledError,
+  ImageBuildError,
+  ImageBuildFailedError,
+  ImageBuildHandle,
+  ImageBuildInProgressError,
+  ImageBuildInterruptedError,
+  ImageBuildNotFoundError,
   ImageBuildOperationType,
+  ImageBuildTimeoutError,
   MountError,
   OutputMode,
   PendingSandbox,
@@ -9984,12 +10454,14 @@ export {
   TERMINATION_REASON_CANCELLED,
   TERMINATION_REASON_NO_CAPACITY,
   TcpTunnel,
+  cancelImageBuild,
   createFileSystem,
   createSandboxImage,
   deleteFileSystem,
   deleteSandboxImage,
   dockerfileContent,
   findSandboxImageByName,
+  getImageBuild,
   importSandboxImage,
   isSandboxPending,
   listFileSystems,
@@ -10001,6 +10473,9 @@ export {
   runLocal,
   runRemote,
   sandboxUrlFromIngressEndpoint,
-  schema
+  schema,
+  startImageBuild,
+  startImageImport,
+  waitImageBuild
 };
 //# sourceMappingURL=index.js.map