@tensorlakeai/tensorlake 0.5.152 → 0.5.154

package/dist/{remote-CC48cvYP.d.cts → remote-B3vn4tt1.d.cts}

@@ -1,4 +1,4 @@
-import { C as CloudClientOptions, A as ApplicationManifest, F as FileSystem, a as ApplicationSummary, R as RequestInput, b as RequestOutput, I as Image } from './sandbox-image-CAK_K7ND.cjs';
+import { C as CloudClientOptions, A as ApplicationManifest, F as FileSystem, a as ApplicationSummary, R as RequestInput, b as RequestOutput, I as Image } from './sandbox-image-BMiFlzAs.cjs';
 
 declare class APIClient {
     private readonly cloudClient;

package/dist/{remote-BbSrvgUn.d.ts → remote-DqBUuciu.d.ts}

@@ -1,4 +1,4 @@
-import { C as CloudClientOptions, A as ApplicationManifest, F as FileSystem, a as ApplicationSummary, R as RequestInput, b as RequestOutput, I as Image } from './sandbox-image-CAK_K7ND.js';
+import { C as CloudClientOptions, A as ApplicationManifest, F as FileSystem, a as ApplicationSummary, R as RequestInput, b as RequestOutput, I as Image } from './sandbox-image-BMiFlzAs.js';
 
 declare class APIClient {
     private readonly cloudClient;

package/dist/{sandbox-image-CAK_K7ND.d.cts → sandbox-image-BMiFlzAs.d.cts}

@@ -136,7 +136,14 @@ interface ApplicationBuildResponse {
     finishedAt?: Date;
     imageBuilds: ApplicationBuildImageResult[];
 }
-/** A registered sandbox image (template) as returned by the platform API. */
+/**
+ * A registered sandbox image in the platform template shape. Both image
+ * families answer it: legacy templates verbatim from the platform API, and
+ * CAS images (`snapshotFormatVersion === "content_addressed_streaming_v1"`)
+ * derived by the core from the Image Service's trimmed record (id, name,
+ * snapshot id, visibility, sizes, timestamps); no content digest or build
+ * provenance rides on either.
+ */
 interface SandboxTemplate {
     id?: string;
     name?: string;
@@ -148,6 +155,10 @@ interface SandboxTemplate {
     rootfsDiskBytes?: number;
     rootfsNodeKind?: string;
     public?: boolean;
+    dockerfile?: string;
+    createdByUserId?: string;
+    createdAt?: string;
+    updatedAt?: string;
 }
 /** A registered file system as returned by the platform API. */
 interface FileSystem {
@@ -245,6 +256,25 @@ interface CreateSandboxImageOptions {
      * memory and disk space on builder sandbox).
      */
     dockerCompat?: boolean;
+    /**
+     * Build a CAS (content-addressed streaming) image through the Image
+     * Service instead of a legacy template. Off by default.
+     */
+    cas?: boolean;
+    /**
+     * Dockerfile build args (`--build-arg KEY=VALUE`), forwarded to BuildKit
+     * and expanded in `FROM` references. CAS builds only; a legacy build with
+     * build args is rejected.
+     */
+    buildArgs?: Record<string, string>;
+    /**
+     * CAS builds only (`cas: true`): aborting requests *remote cancellation*
+     * of the Image Service build through a bounded handshake, and the call
+     * rejects with `ImageBuildInterruptedError` carrying the outcome. It is
+     * rejected for legacy builds, which have no build operation to cancel.
+     * Abandoning the promise alone never cancels anything.
+     */
+    signal?: AbortSignal;
     /**
      * Print build progress to stderr. Ignored when an explicit `emit` is
      * passed via `deps`. Defaults to false — `createSandboxImage` is silent
@@ -275,6 +305,16 @@ interface ImportSandboxImageOptions {
      * memory and disk space on builder sandbox).
      */
     dockerCompat?: boolean;
+    /**
+     * Import as a CAS (content-addressed streaming) image through the Image
+     * Service instead of a legacy template. Off by default.
+     */
+    cas?: boolean;
+    /**
+     * CAS imports only (`cas: true`): aborting requests remote cancellation of
+     * the Image Service import; see `CreateSandboxImageOptions.signal`.
+     */
+    signal?: AbortSignal;
     /**
      * Print build progress to stderr. Ignored when an explicit `emit` is
      * passed via `deps`. Defaults to false.
@@ -309,19 +349,74 @@ interface NativeBindingOptions extends NativeBindingCommonOptions {
     dockerfilePath: string;
     dockerfileText?: string | undefined | null;
     contextDir?: string | undefined | null;
+    cas?: boolean | undefined | null;
+    buildArgs?: Record<string, string> | undefined | null;
 }
 interface NativeBindingImportOptions extends NativeBindingCommonOptions {
     imageReference: string;
+    cas?: boolean | undefined | null;
+}
+/** Credentials and scope for the merged image catalog. */
+interface NativeBindingCatalogOptions {
+    apiUrl: string;
+    bearerToken: string;
+    organizationId?: string | undefined | null;
+    projectId?: string | undefined | null;
+    useScopeHeaders?: boolean | undefined | null;
+    userAgent?: string | undefined | null;
 }
 interface NativeBindingEvent {
     eventType: string;
     stream?: string | undefined | null;
     message: string;
+    /** CAS build events (`build_accepted`, `build_progress`, `build_terminal`, `interrupted`). */
+    buildId?: string | undefined | null;
+    clientRequestId?: string | undefined | null;
+    status?: string | undefined | null;
+    phase?: string | undefined | null;
+    attempt?: number | undefined | null;
+    outcome?: string | undefined | null;
+    confirmed?: boolean | undefined | null;
+}
+/** Credentials and scope for build lookups, waits and cancellations. */
+interface NativeBindingBuildClientOptions {
+    apiUrl: string;
+    bearerToken: string;
+    organizationId?: string | undefined | null;
+    projectId?: string | undefined | null;
+    namespace?: string | undefined | null;
+    useScopeHeaders?: boolean | undefined | null;
+    userAgent?: string | undefined | null;
 }
 interface NativeBinding {
     loadDockerConfigJson(): string;
-    buildSandboxImage(options: NativeBindingOptions, emit?: ((event: NativeBindingEvent) => void) | null | undefined): Promise<string>;
-    importSandboxImage(options: NativeBindingImportOptions, emit?: ((event: NativeBindingEvent) => void) | null | undefined): Promise<string>;
+    /** `interruptId` is honored for CAS builds only; legacy builds ignore it. */
+    buildSandboxImage(options: NativeBindingOptions, emit?: ((event: NativeBindingEvent) => void) | null | undefined, interruptId?: number | undefined | null): Promise<string>;
+    importSandboxImage(options: NativeBindingImportOptions, emit?: ((event: NativeBindingEvent) => void) | null | undefined, interruptId?: number | undefined | null): Promise<string>;
+    createImageBuildInterrupt(): number;
+    triggerImageBuildInterrupt(id: number): void;
+    releaseImageBuildInterrupt(id: number): void;
+    /** JSON `{build, client_request_id}` after admission (and context seal). */
+    startImageBuild(options: Omit<NativeBindingOptions, "builderDiskMb" | "dockerCompat">, emit?: ((event: NativeBindingEvent) => void) | null | undefined, interruptId?: number | undefined | null): Promise<string>;
+    startImageImport(options: Omit<NativeBindingImportOptions, "builderDiskMb" | "dockerCompat">, emit?: ((event: NativeBindingEvent) => void) | null | undefined, interruptId?: number | undefined | null): Promise<string>;
+    /** BuildInfo JSON. */
+    getImageBuild(options: NativeBindingBuildClientOptions, buildId: string): Promise<string>;
+    /** The build's immutable result JSON. */
+    waitImageBuild(options: NativeBindingBuildClientOptions, buildId: string, wait: {
+        timeoutMs?: number | undefined | null;
+        followLogs?: boolean | undefined | null;
+    }, emit?: ((event: NativeBindingEvent) => void) | null | undefined, interruptId?: number | undefined | null): Promise<string>;
+    /** JSON `{outcome, build}`. */
+    cancelImageBuild(options: NativeBindingBuildClientOptions, selector: {
+        buildId?: string | undefined | null;
+        clientRequestId?: string | undefined | null;
+    }): Promise<string>;
+    /** JSON array of every image of both families, newest first. */
+    listSandboxImages(options: NativeBindingCatalogOptions): Promise<string>;
+    /** JSON record of one image by name or id, or null when unknown. */
+    findSandboxImage(options: NativeBindingCatalogOptions, reference: string): Promise<string | null>;
+    /** Delete one image by name or id; unknown in both catalogs rejects. */
+    deleteSandboxImage(options: NativeBindingCatalogOptions, reference: string): Promise<void>;
 }
 /** Test seam: replace the native binding with a stub. */
 declare function __setNativeBindingForTest(binding: NativeBinding | undefined): void;
@@ -335,6 +430,21 @@ interface BuildContext {
     debug: boolean;
 }
 declare function buildContextFromEnv(): BuildContext;
+/**
+ * @internal Shared with `image-builds.ts`, which implements the Image
+ * Service build operations on top of the same native binding and
+ * environment context.
+ */
+declare const __imageBuildInternals: {
+    loadNativeBinding: () => NativeBinding;
+    buildContextFromEnv: () => BuildContext;
+    stderrEmit: (event: Record<string, unknown>) => void;
+    noopEmit: (event: Record<string, unknown>) => void;
+    eventToEmitDict: (event: NativeBindingEvent) => Record<string, unknown>;
+    imageRequiresContext: (image: Image) => boolean;
+    defaultRegisteredName: (dockerfilePath: string) => string;
+    defaultRegisteredNameFromImage: (reference: string) => string;
+};
 declare function createSandboxImage(source: SandboxImageSource, options?: CreateSandboxImageOptions, deps?: CreateSandboxImageDeps): Promise<Record<string, unknown>>;
 /**
  * Import a registry image directly into a sandbox image — no Docker.
@@ -348,24 +458,69 @@ declare function createSandboxImage(source: SandboxImageSource, options?: Create
  * registry.
  */
 declare function importSandboxImage(imageReference: string, options?: ImportSandboxImageOptions, deps?: CreateSandboxImageDeps): Promise<Record<string, unknown>>;
-declare function deleteSandboxImage(imageName: string): Promise<void>;
+/** Credentials the merged-catalog operations run with. */
+interface SandboxImageCatalogCredentials {
+    apiUrl?: string;
+    apiKey?: string;
+    organizationId?: string;
+    projectId?: string;
+}
 /**
- * Look up a registered sandbox image by its registered name.
+ * Delete a registered sandbox image by name or id. Both families are
+ * covered: an `image_` id or a name registered in the Image Service deletes
+ * a CAS image, a `sandbox_template_` id or a name registered only in the
+ * platform registry deletes a legacy image. Rejects when neither catalog
+ * knows the reference.
+ *
+ * Deleting removes a *published* image. An unfinished CAS build is cancelled
+ * with `cancelImageBuild({ buildId })` (or `tl sbx image build cancel
+ * BUILD_ID`), never by deleting its name: a name whose only state is an
+ * unfinished first build has no image, so the Image Service answers 404 and
+ * the lookup falls through to the platform registry as usual. A 202
+ * (deletion in progress) counts as success; a 409 `image_build_in_progress`,
+ * a 5xx or a transport failure rejects as is and never falls through.
  *
- * Returns the registered sandbox template, or `null` if no image with that
- * name exists. Uses the same environment-based Tensorlake auth as
- * `createSandboxImage`. Ingress derives project scope from the API key.
+ * Accepted merged-catalog differences from the released SDKs, for legacy
+ * images: this deletes the platform-api template itself (the released SDKs
+ * only removed the engine registration and left the template listed), and
+ * an unknown name rejects instead of succeeding silently.
  */
-declare function findSandboxImageByName(imageName: string): Promise<SandboxTemplate | null>;
+declare function deleteSandboxImage(imageName: string): Promise<void>;
+/** @internal `APIClient.deleteSandboxImage` with the client's credentials. */
+declare function deleteSandboxImageWithCredentials(credentials: SandboxImageCatalogCredentials, imageName: string): Promise<void>;
 /**
- * List all registered sandbox images for the current project.
+ * Look up a registered sandbox image by its registered name or id.
  *
- * Returns the registered sandbox templates (each with `id`, `name`,
- * `snapshotId`, `public`, etc.). Uses the same environment-based Tensorlake
+ * Returns the image in the sandbox-template shape (CAS images carry
+ * `snapshotFormatVersion === "content_addressed_streaming_v1"`; the shape is
+ * derived from the Image Service's trimmed record, so no content digest or
+ * build provenance rides on it), or `null` if neither the Image Service nor
+ * the platform registry knows the reference. Uses the same environment-based Tensorlake
  * auth as `createSandboxImage`. Ingress derives project scope from the API key.
+ *
+ * An `image_` id names the *current* image under its name; a rebuild
+ * replaces it. A build's own immutable result is read with `getImageBuild`.
+ *
+ * Accepted merged-catalog difference from the released SDKs, for legacy
+ * images: a name that fits the Image Service grammar is looked up there first
+ * and only a clean 404 falls through to the platform registry, so Image
+ * Service unavailability (or a deploy 5xx) rejects the lookup of a legacy name
+ * where the released SDKs touched only platform-api. A `sandbox_template_` id
+ * never consults the Image Service.
+ */
+declare function findSandboxImageByName(imageName: string): Promise<SandboxTemplate | null>;
+/** @internal `CloudClient.findSandboxImageByName` with the client's credentials. */
+declare function findSandboxImageByNameWithCredentials(credentials: SandboxImageCatalogCredentials, imageName: string): Promise<SandboxTemplate | null>;
+/**
+ * List all registered sandbox images for the current project: every CAS and
+ * legacy image in the sandbox-template shape, newest first. Uses the same
+ * environment-based Tensorlake auth as `createSandboxImage`. Ingress derives
+ * project scope from the API key.
  */
 declare function listSandboxImages(): Promise<SandboxTemplate[]>;
+/** @internal `CloudClient.listSandboxImages` with the client's credentials. */
+declare function listSandboxImagesWithCredentials(credentials: SandboxImageCatalogCredentials): Promise<SandboxTemplate[]>;
 declare function runCreateSandboxImageCli(argv?: string[]): Promise<void>;
 declare function runImportSandboxImageCli(argv?: string[]): Promise<void>;
 
-export { type ApplicationManifest as A, type BinaryPayload as B, type CloudClientOptions as C, listSandboxImages as D, type BuildContext as E, type FileSystem as F, type CreateSandboxImageDeps as G, buildContextFromEnv as H, Image as I, runCreateSandboxImageCli as J, runImportSandboxImageCli as K, type NewSecret as N, type RequestInput as R, type SandboxTemplate as S, type UpsertSecretResponse as U, __setNativeBindingForTest as _, type ApplicationSummary as a, type RequestOutput as b, type RequestMetadata as c, type SecretsList as d, type Secret as e, type StartImageBuildRequest as f, type BuildInfo as g, type CreateApplicationBuildRequest as h, type ApplicationBuildContext as i, type ApplicationBuildResponse as j, type BuildLogEntry as k, type ApplicationBuildImageResult as l, type CreateApplicationBuildImageRequest as m, type CreateSandboxImageOptions as n, type ImageBuildOperation as o, ImageBuildOperationType as p, type ImageOptions as q, type ImportSandboxImageOptions as r, type RequestErrorInfo as s, type SandboxImageSource as t, type SecretsPagination as u, createSandboxImage as v, deleteSandboxImage as w, dockerfileContent as x, findSandboxImageByName as y, importSandboxImage as z };
+export { type ApplicationManifest as A, type BinaryPayload as B, type CloudClientOptions as C, importSandboxImage as D, listSandboxImages as E, type FileSystem as F, type BuildContext as G, type SandboxImageCatalogCredentials as H, Image as I, __setNativeBindingForTest as J, buildContextFromEnv as K, deleteSandboxImageWithCredentials as L, findSandboxImageByNameWithCredentials as M, type NewSecret as N, listSandboxImagesWithCredentials as O, runCreateSandboxImageCli as P, runImportSandboxImageCli as Q, type RequestInput as R, type SandboxTemplate as S, type UpsertSecretResponse as U, __imageBuildInternals as _, type ApplicationSummary as a, type RequestOutput as b, type RequestMetadata as c, type SecretsList as d, type Secret as e, type StartImageBuildRequest as f, type BuildInfo as g, type CreateApplicationBuildRequest as h, type ApplicationBuildContext as i, type ApplicationBuildResponse as j, type BuildLogEntry as k, type CreateSandboxImageDeps as l, type ApplicationBuildImageResult as m, type CreateApplicationBuildImageRequest as n, type CreateSandboxImageOptions as o, type ImageBuildOperation as p, ImageBuildOperationType as q, type ImageOptions as r, type ImportSandboxImageOptions as s, type RequestErrorInfo as t, type SandboxImageSource as u, type SecretsPagination as v, createSandboxImage as w, deleteSandboxImage as x, dockerfileContent as y, findSandboxImageByName as z };

package/dist/{sandbox-image-CAK_K7ND.d.ts → sandbox-image-BMiFlzAs.d.ts}

@@ -136,7 +136,14 @@ interface ApplicationBuildResponse {
     finishedAt?: Date;
     imageBuilds: ApplicationBuildImageResult[];
 }
-/** A registered sandbox image (template) as returned by the platform API. */
+/**
+ * A registered sandbox image in the platform template shape. Both image
+ * families answer it: legacy templates verbatim from the platform API, and
+ * CAS images (`snapshotFormatVersion === "content_addressed_streaming_v1"`)
+ * derived by the core from the Image Service's trimmed record (id, name,
+ * snapshot id, visibility, sizes, timestamps); no content digest or build
+ * provenance rides on either.
+ */
 interface SandboxTemplate {
     id?: string;
     name?: string;
@@ -148,6 +155,10 @@ interface SandboxTemplate {
     rootfsDiskBytes?: number;
     rootfsNodeKind?: string;
     public?: boolean;
+    dockerfile?: string;
+    createdByUserId?: string;
+    createdAt?: string;
+    updatedAt?: string;
 }
 /** A registered file system as returned by the platform API. */
 interface FileSystem {
@@ -245,6 +256,25 @@ interface CreateSandboxImageOptions {
      * memory and disk space on builder sandbox).
      */
     dockerCompat?: boolean;
+    /**
+     * Build a CAS (content-addressed streaming) image through the Image
+     * Service instead of a legacy template. Off by default.
+     */
+    cas?: boolean;
+    /**
+     * Dockerfile build args (`--build-arg KEY=VALUE`), forwarded to BuildKit
+     * and expanded in `FROM` references. CAS builds only; a legacy build with
+     * build args is rejected.
+     */
+    buildArgs?: Record<string, string>;
+    /**
+     * CAS builds only (`cas: true`): aborting requests *remote cancellation*
+     * of the Image Service build through a bounded handshake, and the call
+     * rejects with `ImageBuildInterruptedError` carrying the outcome. It is
+     * rejected for legacy builds, which have no build operation to cancel.
+     * Abandoning the promise alone never cancels anything.
+     */
+    signal?: AbortSignal;
     /**
      * Print build progress to stderr. Ignored when an explicit `emit` is
      * passed via `deps`. Defaults to false — `createSandboxImage` is silent
@@ -275,6 +305,16 @@ interface ImportSandboxImageOptions {
      * memory and disk space on builder sandbox).
      */
     dockerCompat?: boolean;
+    /**
+     * Import as a CAS (content-addressed streaming) image through the Image
+     * Service instead of a legacy template. Off by default.
+     */
+    cas?: boolean;
+    /**
+     * CAS imports only (`cas: true`): aborting requests remote cancellation of
+     * the Image Service import; see `CreateSandboxImageOptions.signal`.
+     */
+    signal?: AbortSignal;
     /**
      * Print build progress to stderr. Ignored when an explicit `emit` is
      * passed via `deps`. Defaults to false.
@@ -309,19 +349,74 @@ interface NativeBindingOptions extends NativeBindingCommonOptions {
     dockerfilePath: string;
     dockerfileText?: string | undefined | null;
     contextDir?: string | undefined | null;
+    cas?: boolean | undefined | null;
+    buildArgs?: Record<string, string> | undefined | null;
 }
 interface NativeBindingImportOptions extends NativeBindingCommonOptions {
     imageReference: string;
+    cas?: boolean | undefined | null;
+}
+/** Credentials and scope for the merged image catalog. */
+interface NativeBindingCatalogOptions {
+    apiUrl: string;
+    bearerToken: string;
+    organizationId?: string | undefined | null;
+    projectId?: string | undefined | null;
+    useScopeHeaders?: boolean | undefined | null;
+    userAgent?: string | undefined | null;
 }
 interface NativeBindingEvent {
     eventType: string;
     stream?: string | undefined | null;
     message: string;
+    /** CAS build events (`build_accepted`, `build_progress`, `build_terminal`, `interrupted`). */
+    buildId?: string | undefined | null;
+    clientRequestId?: string | undefined | null;
+    status?: string | undefined | null;
+    phase?: string | undefined | null;
+    attempt?: number | undefined | null;
+    outcome?: string | undefined | null;
+    confirmed?: boolean | undefined | null;
+}
+/** Credentials and scope for build lookups, waits and cancellations. */
+interface NativeBindingBuildClientOptions {
+    apiUrl: string;
+    bearerToken: string;
+    organizationId?: string | undefined | null;
+    projectId?: string | undefined | null;
+    namespace?: string | undefined | null;
+    useScopeHeaders?: boolean | undefined | null;
+    userAgent?: string | undefined | null;
 }
 interface NativeBinding {
     loadDockerConfigJson(): string;
-    buildSandboxImage(options: NativeBindingOptions, emit?: ((event: NativeBindingEvent) => void) | null | undefined): Promise<string>;
-    importSandboxImage(options: NativeBindingImportOptions, emit?: ((event: NativeBindingEvent) => void) | null | undefined): Promise<string>;
+    /** `interruptId` is honored for CAS builds only; legacy builds ignore it. */
+    buildSandboxImage(options: NativeBindingOptions, emit?: ((event: NativeBindingEvent) => void) | null | undefined, interruptId?: number | undefined | null): Promise<string>;
+    importSandboxImage(options: NativeBindingImportOptions, emit?: ((event: NativeBindingEvent) => void) | null | undefined, interruptId?: number | undefined | null): Promise<string>;
+    createImageBuildInterrupt(): number;
+    triggerImageBuildInterrupt(id: number): void;
+    releaseImageBuildInterrupt(id: number): void;
+    /** JSON `{build, client_request_id}` after admission (and context seal). */
+    startImageBuild(options: Omit<NativeBindingOptions, "builderDiskMb" | "dockerCompat">, emit?: ((event: NativeBindingEvent) => void) | null | undefined, interruptId?: number | undefined | null): Promise<string>;
+    startImageImport(options: Omit<NativeBindingImportOptions, "builderDiskMb" | "dockerCompat">, emit?: ((event: NativeBindingEvent) => void) | null | undefined, interruptId?: number | undefined | null): Promise<string>;
+    /** BuildInfo JSON. */
+    getImageBuild(options: NativeBindingBuildClientOptions, buildId: string): Promise<string>;
+    /** The build's immutable result JSON. */
+    waitImageBuild(options: NativeBindingBuildClientOptions, buildId: string, wait: {
+        timeoutMs?: number | undefined | null;
+        followLogs?: boolean | undefined | null;
+    }, emit?: ((event: NativeBindingEvent) => void) | null | undefined, interruptId?: number | undefined | null): Promise<string>;
+    /** JSON `{outcome, build}`. */
+    cancelImageBuild(options: NativeBindingBuildClientOptions, selector: {
+        buildId?: string | undefined | null;
+        clientRequestId?: string | undefined | null;
+    }): Promise<string>;
+    /** JSON array of every image of both families, newest first. */
+    listSandboxImages(options: NativeBindingCatalogOptions): Promise<string>;
+    /** JSON record of one image by name or id, or null when unknown. */
+    findSandboxImage(options: NativeBindingCatalogOptions, reference: string): Promise<string | null>;
+    /** Delete one image by name or id; unknown in both catalogs rejects. */
+    deleteSandboxImage(options: NativeBindingCatalogOptions, reference: string): Promise<void>;
 }
 /** Test seam: replace the native binding with a stub. */
 declare function __setNativeBindingForTest(binding: NativeBinding | undefined): void;
@@ -335,6 +430,21 @@ interface BuildContext {
     debug: boolean;
 }
 declare function buildContextFromEnv(): BuildContext;
+/**
+ * @internal Shared with `image-builds.ts`, which implements the Image
+ * Service build operations on top of the same native binding and
+ * environment context.
+ */
+declare const __imageBuildInternals: {
+    loadNativeBinding: () => NativeBinding;
+    buildContextFromEnv: () => BuildContext;
+    stderrEmit: (event: Record<string, unknown>) => void;
+    noopEmit: (event: Record<string, unknown>) => void;
+    eventToEmitDict: (event: NativeBindingEvent) => Record<string, unknown>;
+    imageRequiresContext: (image: Image) => boolean;
+    defaultRegisteredName: (dockerfilePath: string) => string;
+    defaultRegisteredNameFromImage: (reference: string) => string;
+};
 declare function createSandboxImage(source: SandboxImageSource, options?: CreateSandboxImageOptions, deps?: CreateSandboxImageDeps): Promise<Record<string, unknown>>;
 /**
  * Import a registry image directly into a sandbox image — no Docker.
@@ -348,24 +458,69 @@ declare function createSandboxImage(source: SandboxImageSource, options?: Create
  * registry.
  */
 declare function importSandboxImage(imageReference: string, options?: ImportSandboxImageOptions, deps?: CreateSandboxImageDeps): Promise<Record<string, unknown>>;
-declare function deleteSandboxImage(imageName: string): Promise<void>;
+/** Credentials the merged-catalog operations run with. */
+interface SandboxImageCatalogCredentials {
+    apiUrl?: string;
+    apiKey?: string;
+    organizationId?: string;
+    projectId?: string;
+}
 /**
- * Look up a registered sandbox image by its registered name.
+ * Delete a registered sandbox image by name or id. Both families are
+ * covered: an `image_` id or a name registered in the Image Service deletes
+ * a CAS image, a `sandbox_template_` id or a name registered only in the
+ * platform registry deletes a legacy image. Rejects when neither catalog
+ * knows the reference.
+ *
+ * Deleting removes a *published* image. An unfinished CAS build is cancelled
+ * with `cancelImageBuild({ buildId })` (or `tl sbx image build cancel
+ * BUILD_ID`), never by deleting its name: a name whose only state is an
+ * unfinished first build has no image, so the Image Service answers 404 and
+ * the lookup falls through to the platform registry as usual. A 202
+ * (deletion in progress) counts as success; a 409 `image_build_in_progress`,
+ * a 5xx or a transport failure rejects as is and never falls through.
  *
- * Returns the registered sandbox template, or `null` if no image with that
- * name exists. Uses the same environment-based Tensorlake auth as
- * `createSandboxImage`. Ingress derives project scope from the API key.
+ * Accepted merged-catalog differences from the released SDKs, for legacy
+ * images: this deletes the platform-api template itself (the released SDKs
+ * only removed the engine registration and left the template listed), and
+ * an unknown name rejects instead of succeeding silently.
  */
-declare function findSandboxImageByName(imageName: string): Promise<SandboxTemplate | null>;
+declare function deleteSandboxImage(imageName: string): Promise<void>;
+/** @internal `APIClient.deleteSandboxImage` with the client's credentials. */
+declare function deleteSandboxImageWithCredentials(credentials: SandboxImageCatalogCredentials, imageName: string): Promise<void>;
 /**
- * List all registered sandbox images for the current project.
+ * Look up a registered sandbox image by its registered name or id.
  *
- * Returns the registered sandbox templates (each with `id`, `name`,
- * `snapshotId`, `public`, etc.). Uses the same environment-based Tensorlake
+ * Returns the image in the sandbox-template shape (CAS images carry
+ * `snapshotFormatVersion === "content_addressed_streaming_v1"`; the shape is
+ * derived from the Image Service's trimmed record, so no content digest or
+ * build provenance rides on it), or `null` if neither the Image Service nor
+ * the platform registry knows the reference. Uses the same environment-based Tensorlake
  * auth as `createSandboxImage`. Ingress derives project scope from the API key.
+ *
+ * An `image_` id names the *current* image under its name; a rebuild
+ * replaces it. A build's own immutable result is read with `getImageBuild`.
+ *
+ * Accepted merged-catalog difference from the released SDKs, for legacy
+ * images: a name that fits the Image Service grammar is looked up there first
+ * and only a clean 404 falls through to the platform registry, so Image
+ * Service unavailability (or a deploy 5xx) rejects the lookup of a legacy name
+ * where the released SDKs touched only platform-api. A `sandbox_template_` id
+ * never consults the Image Service.
+ */
+declare function findSandboxImageByName(imageName: string): Promise<SandboxTemplate | null>;
+/** @internal `CloudClient.findSandboxImageByName` with the client's credentials. */
+declare function findSandboxImageByNameWithCredentials(credentials: SandboxImageCatalogCredentials, imageName: string): Promise<SandboxTemplate | null>;
+/**
+ * List all registered sandbox images for the current project: every CAS and
+ * legacy image in the sandbox-template shape, newest first. Uses the same
+ * environment-based Tensorlake auth as `createSandboxImage`. Ingress derives
+ * project scope from the API key.
  */
 declare function listSandboxImages(): Promise<SandboxTemplate[]>;
+/** @internal `CloudClient.listSandboxImages` with the client's credentials. */
+declare function listSandboxImagesWithCredentials(credentials: SandboxImageCatalogCredentials): Promise<SandboxTemplate[]>;
 declare function runCreateSandboxImageCli(argv?: string[]): Promise<void>;
 declare function runImportSandboxImageCli(argv?: string[]): Promise<void>;
 
-export { type ApplicationManifest as A, type BinaryPayload as B, type CloudClientOptions as C, listSandboxImages as D, type BuildContext as E, type FileSystem as F, type CreateSandboxImageDeps as G, buildContextFromEnv as H, Image as I, runCreateSandboxImageCli as J, runImportSandboxImageCli as K, type NewSecret as N, type RequestInput as R, type SandboxTemplate as S, type UpsertSecretResponse as U, __setNativeBindingForTest as _, type ApplicationSummary as a, type RequestOutput as b, type RequestMetadata as c, type SecretsList as d, type Secret as e, type StartImageBuildRequest as f, type BuildInfo as g, type CreateApplicationBuildRequest as h, type ApplicationBuildContext as i, type ApplicationBuildResponse as j, type BuildLogEntry as k, type ApplicationBuildImageResult as l, type CreateApplicationBuildImageRequest as m, type CreateSandboxImageOptions as n, type ImageBuildOperation as o, ImageBuildOperationType as p, type ImageOptions as q, type ImportSandboxImageOptions as r, type RequestErrorInfo as s, type SandboxImageSource as t, type SecretsPagination as u, createSandboxImage as v, deleteSandboxImage as w, dockerfileContent as x, findSandboxImageByName as y, importSandboxImage as z };
+export { type ApplicationManifest as A, type BinaryPayload as B, type CloudClientOptions as C, importSandboxImage as D, listSandboxImages as E, type FileSystem as F, type BuildContext as G, type SandboxImageCatalogCredentials as H, Image as I, __setNativeBindingForTest as J, buildContextFromEnv as K, deleteSandboxImageWithCredentials as L, findSandboxImageByNameWithCredentials as M, type NewSecret as N, listSandboxImagesWithCredentials as O, runCreateSandboxImageCli as P, runImportSandboxImageCli as Q, type RequestInput as R, type SandboxTemplate as S, type UpsertSecretResponse as U, __imageBuildInternals as _, type ApplicationSummary as a, type RequestOutput as b, type RequestMetadata as c, type SecretsList as d, type Secret as e, type StartImageBuildRequest as f, type BuildInfo as g, type CreateApplicationBuildRequest as h, type ApplicationBuildContext as i, type ApplicationBuildResponse as j, type BuildLogEntry as k, type CreateSandboxImageDeps as l, type ApplicationBuildImageResult as m, type CreateApplicationBuildImageRequest as n, type CreateSandboxImageOptions as o, type ImageBuildOperation as p, ImageBuildOperationType as q, type ImageOptions as r, type ImportSandboxImageOptions as s, type RequestErrorInfo as t, type SandboxImageSource as u, type SecretsPagination as v, createSandboxImage as w, deleteSandboxImage as x, dockerfileContent as y, findSandboxImageByName as z };