@tensorlakeai/tensorlake 0.5.153 → 0.5.156

package/dist/index.cjs

@@ -49,7 +49,7 @@ var init_defaults = __esm({
   "src/defaults.ts"() {
     "use strict";
     init_cjs_shims();
-    SDK_VERSION = "0.5.153";
+    SDK_VERSION = "0.5.156";
     API_URL = process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai";
     API_KEY = process.env.TENSORLAKE_API_KEY ?? void 0;
     NAMESPACE = process.env.INDEXIFY_NAMESPACE ?? "default";
@@ -60,6 +60,20 @@ var init_defaults = __esm({
   }
 });
 
+// src/enum.ts
+function enumValue(values, value) {
+  return typeof value === "string" && Object.values(values).includes(value) ? value : values.UNKNOWN;
+}
+function withRaw(value, raw) {
+  return Object.defineProperty(value, "raw", { value: raw, enumerable: false, configurable: true });
+}
+var init_enum = __esm({
+  "src/enum.ts"() {
+    "use strict";
+    init_cjs_shims();
+  }
+});
+
 // src/errors.ts
 function formatErrorDetails(errorDetails) {
   if (errorDetails == null) return void 0;
@@ -498,7 +512,7 @@ var init_native_worker_client = __esm({
       }
     };
     runtimeKey = /* @__PURE__ */ Symbol.for(
-      `tensorlake.native.worker.${false ? "source" : "0.5.153"}.v1`
+      `tensorlake.native.worker.${false ? "source" : "0.5.156"}.v1`
     );
     runtimes = globalThis;
   }
@@ -600,6 +614,7 @@ var init_models = __esm({
       SnapshotStatus2["FAILED"] = "failed";
       SnapshotStatus2["DELETING"] = "deleting";
       SnapshotStatus2["REPLICATING"] = "replicating";
+      SnapshotStatus2["UNKNOWN"] = "unknown";
       return SnapshotStatus2;
     })(SnapshotStatus || {});
     ProcessStatus = /* @__PURE__ */ ((ProcessStatus2) => {
@@ -4496,6 +4511,18 @@ __export(client_exports, {
   DEFAULT_WAIT_POLL_INTERVAL_SEC: () => DEFAULT_WAIT_POLL_INTERVAL_SEC,
   SandboxClient: () => SandboxClient
 });
+function parseSnapshot(raw) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new SandboxError("Invalid snapshot response: expected an object");
+  }
+  if (raw.status == null) {
+    throw new SandboxError("Invalid snapshot response: missing status");
+  }
+  return withRaw({
+    ...fromSnakeKeys(raw, "snapshotId"),
+    status: enumValue(SnapshotStatus, raw.status)
+  }, raw);
+}
 function requireReadOnlySnapshotPin(fileSystemId, mountPath, readOnly, snapshotId) {
   if (snapshotId != null && readOnly !== true) {
     throw new SandboxError(
@@ -4617,6 +4644,7 @@ var init_client = __esm({
     "use strict";
     init_cjs_shims();
     init_defaults();
+    init_enum();
     init_errors();
     init_native_worker_client();
     init_native_sandbox();
@@ -5264,18 +5292,18 @@ var init_client = __esm({
        * block automatically.
        */
       async snapshot(sandboxId, options) {
-        return this.plainJson(
+        const { json } = await callNative(
           () => this.native.createSnapshot(sandboxId, options?.snapshotType ?? null),
-          "snapshotId",
           { sandboxId, notFoundKind: "sandbox" }
         );
+        return parseSnapshot(JSON.parse(json));
       }
       /** Get current status and metadata for a snapshot by ID. */
       async getSnapshot(snapshotId) {
-        return this.tracedJson(
-          () => this.native.getSnapshot(snapshotId),
-          "snapshotId"
+        const { traceId, json } = await callNative(
+          () => this.native.getSnapshot(snapshotId)
         );
+        return Object.assign(parseSnapshot(JSON.parse(json)), { traceId });
       }
       /** List all snapshots in the namespace. */
       async listSnapshots() {
@@ -5283,9 +5311,14 @@ var init_client = __esm({
           () => this.native.listSnapshots()
         );
         const parsed = JSON.parse(json);
-        const snapshots = (parsed.snapshots ?? []).map(
-          (s) => fromSnakeKeys(s, "snapshotId")
-        );
+        if (parsed !== null && (typeof parsed !== "object" || Array.isArray(parsed))) {
+          throw new SandboxError("Invalid snapshot list response: expected an object");
+        }
+        const records = parsed?.snapshots ?? [];
+        if (!Array.isArray(records)) {
+          throw new SandboxError("Invalid snapshot list response: snapshots must be an array");
+        }
+        const snapshots = records.map((s) => parseSnapshot(s));
         return Object.assign(snapshots, { traceId });
       }
       /** Delete a snapshot by ID. */
@@ -5686,10 +5719,11 @@ var init_image = __esm({
         });
       }
       /**
-       * Build this image as a sandbox template and register it.
+       * Build this image and register it as a CAS sandbox image (the default) or,
+       * with `cas: false`, a legacy sandbox image.
        *
        * Materializes the image in a build sandbox, snapshots the filesystem,
-       * and registers the snapshot as a named sandbox template.
+       * and registers the snapshot under the image's name.
        */
       async build(options = {}) {
         const { createSandboxImage: createSandboxImage2 } = await Promise.resolve().then(() => (init_sandbox_image(), sandbox_image_exports));
@@ -5850,6 +5884,9 @@ var init_native_binding = __esm({
 });
 
 // src/image-builds.ts
+function isConfirmedCancellation(outcome) {
+  return outcome === "cancelled" /* CANCELLED */ || outcome === "already_cancelled" /* ALREADY_CANCELLED */ || outcome === "already_failed" /* ALREADY_FAILED */;
+}
 function camelize(key) {
   return key.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
 }
@@ -5867,62 +5904,87 @@ function toImageBuildError(error) {
     if (key === "category") continue;
     details[camelize(key)] = value;
   }
+  details.code = enumValue(ImageBuildErrorCode, details.code || "internal" /* INTERNAL */);
+  if ("activeKind" in details) details.activeKind = details.activeKind ? enumValue(ImageBuildKind, details.activeKind) : null;
+  if ("activeStatus" in details) details.activeStatus = details.activeStatus ? enumValue(ImageBuildStatus, details.activeStatus) : null;
+  if ("outcome" in details) details.outcome = details.outcome ? enumValue(ImageBuildCancellationOutcome, details.outcome) : null;
+  if ("info" in details) details.info = buildInfoOrNull(details.info);
   const typed = details;
-  switch (typed.code) {
-    case "not_found":
-      return new ImageBuildNotFoundError(typed);
-    case "image_build_in_progress":
-      return new ImageBuildInProgressError(typed);
-    case "failed":
-      return new ImageBuildFailedError(typed);
-    case "cancelled":
-      return new ImageBuildCancelledError(typed);
-    case "timeout":
-      return new ImageBuildTimeoutError(typed);
-    case "interrupted":
-      return new ImageBuildInterruptedError(typed);
-    default:
-      return new ImageBuildError(typed);
-  }
+  const errors = {
+    not_found: ImageBuildNotFoundError,
+    image_build_in_progress: ImageBuildInProgressError,
+    failed: ImageBuildFailedError,
+    cancelled: ImageBuildCancelledError,
+    timeout: ImageBuildTimeoutError,
+    interrupted: ImageBuildInterruptedError
+  };
+  const ErrorClass = errors[typed.code] ?? ImageBuildError;
+  return withRaw(new ErrorClass(typed), payload);
 }
 function camelizeRecord(value) {
   const out = {};
   for (const [key, inner] of Object.entries(value)) out[camelize(key)] = inner;
   return out;
 }
-function parseBuildInfo(raw) {
+function buildInfoOrNull(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  try {
+    return parseBuildInfo(value);
+  } catch (error) {
+    if (error instanceof ImageBuildError) return null;
+    throw error;
+  }
+}
+function decodeResponse(value) {
+  try {
+    const raw = typeof value === "string" ? JSON.parse(value) : value;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new TypeError("expected a response object");
+    return raw;
+  } catch (error) {
+    throw withRaw(new ImageBuildError({ code: "service" /* SERVICE */, message: `Invalid image-build response: ${String(error)}` }), { response: value });
+  }
+}
+function parseBuildInfo(value) {
+  const raw = decodeResponse(value);
+  if (raw.status == null) {
+    throw withRaw(new ImageBuildError({ code: "service" /* SERVICE */, message: "Invalid image-build response: missing status" }), { response: value });
+  }
+  const attempt = raw.attempt_no ?? 0;
+  const attemptNo = Number(attempt);
+  if (typeof attempt !== "number" && typeof attempt !== "string" || typeof attempt === "string" && attempt.trim() === "" || !Number.isSafeInteger(attemptNo)) {
+    throw withRaw(new ImageBuildError({ code: "service" /* SERVICE */, message: "Invalid image-build attempt_no" }), { response: value });
+  }
   const camel = camelizeRecord(raw);
   const result = raw.result && typeof raw.result === "object" ? camelizeRecord(raw.result) : null;
-  return {
+  return withRaw({
     buildId: String(raw.build_id ?? ""),
     clientRequestId: camel.clientRequestId ?? null,
-    kind: String(raw.kind ?? ""),
+    kind: raw.kind ? enumValue(ImageBuildKind, raw.kind) : null,
     name: raw.name ?? null,
-    status: String(raw.status ?? ""),
-    phase: raw.phase ?? null,
-    attemptNo: Number(raw.attempt_no ?? 0),
+    status: enumValue(ImageBuildStatus, raw.status),
+    phase: raw.phase ? enumValue(ImageBuildPhase, raw.phase) : null,
+    attemptNo,
     builderSandboxId: camel.builderSandboxId ?? null,
     error: raw.error ?? null,
     result,
     operationDeadlineMs: camel.operationDeadlineMs ?? null,
     createdAtMs: camel.createdAtMs ?? null,
-    updatedAtMs: camel.updatedAtMs ?? null,
-    raw
-  };
+    updatedAtMs: camel.updatedAtMs ?? null
+  }, raw);
 }
 function parseResult(json) {
-  return camelizeRecord(JSON.parse(json));
+  return camelizeRecord(decodeResponse(json));
 }
 function credentialsFromEnv() {
   const context = __imageBuildInternals.buildContextFromEnv();
   if (!context.apiKey) {
     if (context.personalAccessToken) {
       throw new ImageBuildError({
-        code: "auth",
+        code: "auth" /* AUTH */,
         message: "Sandbox image SDKs require TENSORLAKE_API_KEY. Personal access tokens are CLI-only."
       });
     }
-    throw new ImageBuildError({ code: "auth", message: "Missing TENSORLAKE_API_KEY credentials." });
+    throw new ImageBuildError({ code: "auth" /* AUTH */, message: "Missing TENSORLAKE_API_KEY credentials." });
   }
   return { apiUrl: context.apiUrl, bearerToken: context.apiKey, namespace: context.namespace };
 }
@@ -5936,19 +5998,19 @@ function clientOptions(credentials) {
 }
 function rejectLegacyReference(buildId) {
   if (typeof buildId !== "string" || buildId.trim().length === 0) {
-    throw new ImageBuildError({ code: "usage", message: "buildId must be a non-empty string" });
+    throw new ImageBuildError({ code: "usage" /* USAGE */, message: "buildId must be a non-empty string" });
   }
   if (buildId.startsWith("sandbox_template_")) {
     throw new ImageBuildError({
-      code: "usage",
-      message: `'${buildId}' is a legacy sandbox template id; legacy images have no build operation to get, wait for or cancel`,
+      code: "usage" /* USAGE */,
+      message: `'${buildId}' is a legacy image id; legacy images have no build operation to get, wait for or cancel`,
       buildId
     });
   }
   if (buildId.startsWith("image_")) {
     throw new ImageBuildError({
-      code: "usage",
-      message: `'${buildId}' is an image id, not a build id; look the image up with findSandboxImageByName or use the build id admission returned`,
+      code: "usage" /* USAGE */,
+      message: `'${buildId}' is a CAS image id, not a build id; look the CAS image up with findSandboxImageByName or use the build id admission returned`,
       buildId
     });
   }
@@ -5994,8 +6056,15 @@ function makeEmitter(options) {
   };
 }
 function decodeStarted(json, credentials) {
-  const payload = JSON.parse(json);
-  return new ImageBuildHandle(parseBuildInfo(payload.build ?? {}), credentials, payload.client_request_id);
+  const payload = decodeResponse(json);
+  const build = payload.build;
+  if (!build || typeof build !== "object" || Array.isArray(build) || typeof build.build_id !== "string" || !build.build_id.trim()) {
+    throw withRaw(new ImageBuildError({
+      code: "service" /* SERVICE */,
+      message: "Invalid image-build admission: expected a build with a non-empty build_id"
+    }), { response: payload });
+  }
+  return new ImageBuildHandle(parseBuildInfo(build), credentials, payload.client_request_id);
 }
 async function startImageBuild(source, options = {}, deps = {}) {
   const emitter = makeEmitter({ emit: deps.emit ?? options.emit, verbose: options.verbose });
@@ -6020,19 +6089,27 @@ async function startImageBuild(source, options = {}, deps = {}) {
     let text = dockerfileContent(source);
     if (!text.endsWith("\n")) text += "\n";
     dockerfileText = text;
-    name = options.registeredName ?? source.name;
+    name = __imageBuildInternals.registeredImageName(
+      options.registeredName ?? source.name,
+      void 0,
+      true
+    );
   } else if (typeof source === "string") {
     const resolved = import_node_path2.default.resolve(source);
     if (!(0, import_node_fs.existsSync)(resolved)) throw new Error(`Dockerfile not found: ${source}`);
     dockerfilePath = resolved;
-    name = options.registeredName ?? __imageBuildInternals.defaultRegisteredName(resolved);
+    name = __imageBuildInternals.registeredImageName(
+      options.registeredName,
+      __imageBuildInternals.defaultRegisteredName(resolved),
+      true
+    );
   } else {
     throw new TypeError(`source must be an Image or a Dockerfile path, got ${typeof source}`);
   }
   try {
     const credentials = credentialsFromEnv();
     const binding = __imageBuildInternals.loadNativeBinding();
-    emitter.emit({ type: "status", message: `Building image '${name}'...` });
+    emitter.emit({ type: "status", message: `Building CAS image '${name}'...` });
     const json = await __runWithInterrupt(
       options.signal,
       (interruptId) => binding.startImageBuild(
@@ -6068,11 +6145,16 @@ async function startImageImport(imageReference, options = {}, deps = {}) {
     throw new Error("image reference to import must not be empty");
   }
   const reference = imageReference.trim();
-  const name = options.registeredName ?? __imageBuildInternals.defaultRegisteredNameFromImage(reference);
+  const name = __imageBuildInternals.registeredImageName(
+    options.registeredName,
+    __imageBuildInternals.defaultRegisteredNameFromImage(reference),
+    true,
+    __imageBuildInternals.defaultImportedImageName
+  );
   const emitter = makeEmitter({ emit: deps.emit ?? options.emit, verbose: options.verbose });
   const credentials = credentialsFromEnv();
   const binding = __imageBuildInternals.loadNativeBinding();
-  emitter.emit({ type: "status", message: `Importing image '${reference}' as '${name}'...` });
+  emitter.emit({ type: "status", message: `Importing '${reference}' as CAS image '${name}'...` });
   const json = await __runWithInterrupt(
     options.signal,
     (interruptId) => binding.startImageImport(
@@ -6107,7 +6189,7 @@ async function getImageBuild(buildId) {
   } catch (error) {
     throw toImageBuildError(error);
   }
-  return new ImageBuildHandle(parseBuildInfo(JSON.parse(json)), credentials);
+  return new ImageBuildHandle(parseBuildInfo(json), credentials);
 }
 async function waitImageBuild(buildId, options = {}) {
   rejectLegacyReference(buildId);
@@ -6138,36 +6220,84 @@ async function cancelImageBuildWith(credentials, selector) {
   } catch (error) {
     throw toImageBuildError(error);
   }
-  const payload = JSON.parse(json);
-  const outcome = String(payload.outcome ?? "");
-  return {
-    outcome,
-    build: payload.build ? parseBuildInfo(payload.build) : null,
-    confirmed: ["cancelled", "already_cancelled", "already_failed"].includes(outcome)
-  };
+  const payload = decodeResponse(json);
+  const outcome = enumValue(ImageBuildCancellationOutcome, payload.outcome);
+  return withRaw({ outcome, build: buildInfoOrNull(payload.build), confirmed: isConfirmedCancellation(outcome) }, payload);
 }
 async function cancelImageBuild(selector) {
   const hasBuild = selector.buildId != null;
   const hasRequest = selector.clientRequestId != null;
   if (hasBuild === hasRequest) {
     throw new ImageBuildError({
-      code: "usage",
+      code: "usage" /* USAGE */,
       message: "pass exactly one of buildId or clientRequestId"
     });
   }
   if (selector.buildId != null) rejectLegacyReference(selector.buildId);
   return cancelImageBuildWith(credentialsFromEnv(), selector);
 }
-var import_node_path2, import_node_os, import_node_fs, ImageBuildError, ImageBuildNotFoundError, ImageBuildInProgressError, ImageBuildFailedError, ImageBuildCancelledError, ImageBuildTimeoutError, ImageBuildInterruptedError, ImageBuildHandle;
+var import_node_path2, import_node_os, import_node_fs, ImageBuildStatus, ImageBuildPhase, ImageBuildKind, ImageBuildCancellationOutcome, ImageBuildErrorCode, ImageBuildError, ImageBuildNotFoundError, ImageBuildInProgressError, ImageBuildFailedError, ImageBuildCancelledError, ImageBuildTimeoutError, ImageBuildInterruptedError, ImageBuildHandle;
 var init_image_builds = __esm({
   "src/image-builds.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_path2 = __toESM(require("path"), 1);
+    init_enum();
     import_node_os = __toESM(require("os"), 1);
     import_node_fs = require("fs");
     init_image();
     init_sandbox_image();
+    ImageBuildStatus = /* @__PURE__ */ ((ImageBuildStatus2) => {
+      ImageBuildStatus2["PENDING"] = "pending";
+      ImageBuildStatus2["RUNNING"] = "running";
+      ImageBuildStatus2["SUCCEEDED"] = "succeeded";
+      ImageBuildStatus2["FAILED"] = "failed";
+      ImageBuildStatus2["CANCELLED"] = "cancelled";
+      ImageBuildStatus2["UNKNOWN"] = "unknown";
+      return ImageBuildStatus2;
+    })(ImageBuildStatus || {});
+    ImageBuildPhase = /* @__PURE__ */ ((ImageBuildPhase2) => {
+      ImageBuildPhase2["AWAITING_CONTEXT"] = "awaiting_context";
+      ImageBuildPhase2["STARTING_BUILDER"] = "starting_builder";
+      ImageBuildPhase2["EXECUTING"] = "executing";
+      ImageBuildPhase2["SNAPSHOTTING"] = "snapshotting";
+      ImageBuildPhase2["PUBLISHING"] = "publishing";
+      ImageBuildPhase2["FINISHED"] = "finished";
+      ImageBuildPhase2["UNKNOWN"] = "unknown";
+      return ImageBuildPhase2;
+    })(ImageBuildPhase || {});
+    ImageBuildKind = /* @__PURE__ */ ((ImageBuildKind2) => {
+      ImageBuildKind2["DOCKERFILE"] = "dockerfile";
+      ImageBuildKind2["IMPORT"] = "import";
+      ImageBuildKind2["DIRECT"] = "direct";
+      ImageBuildKind2["UNKNOWN"] = "unknown";
+      return ImageBuildKind2;
+    })(ImageBuildKind || {});
+    ImageBuildCancellationOutcome = /* @__PURE__ */ ((ImageBuildCancellationOutcome2) => {
+      ImageBuildCancellationOutcome2["CANCELLED"] = "cancelled";
+      ImageBuildCancellationOutcome2["ALREADY_CANCELLED"] = "already_cancelled";
+      ImageBuildCancellationOutcome2["ALREADY_COMPLETED"] = "already_completed";
+      ImageBuildCancellationOutcome2["ALREADY_FAILED"] = "already_failed";
+      ImageBuildCancellationOutcome2["NOT_ADMITTED"] = "not_admitted";
+      ImageBuildCancellationOutcome2["UNCONFIRMED"] = "unconfirmed";
+      ImageBuildCancellationOutcome2["UNKNOWN"] = "unknown";
+      return ImageBuildCancellationOutcome2;
+    })(ImageBuildCancellationOutcome || {});
+    ImageBuildErrorCode = /* @__PURE__ */ ((ImageBuildErrorCode2) => {
+      ImageBuildErrorCode2["USAGE"] = "usage";
+      ImageBuildErrorCode2["AUTH"] = "auth";
+      ImageBuildErrorCode2["NOT_FOUND"] = "not_found";
+      ImageBuildErrorCode2["IMAGE_BUILD_IN_PROGRESS"] = "image_build_in_progress";
+      ImageBuildErrorCode2["CLIENT_REQUEST_ID_MISMATCH"] = "client_request_id_mismatch";
+      ImageBuildErrorCode2["FAILED"] = "failed";
+      ImageBuildErrorCode2["CANCELLED"] = "cancelled";
+      ImageBuildErrorCode2["TIMEOUT"] = "timeout";
+      ImageBuildErrorCode2["INTERRUPTED"] = "interrupted";
+      ImageBuildErrorCode2["SERVICE"] = "service";
+      ImageBuildErrorCode2["INTERNAL"] = "internal";
+      ImageBuildErrorCode2["UNKNOWN"] = "unknown";
+      return ImageBuildErrorCode2;
+    })(ImageBuildErrorCode || {});
     ImageBuildError = class extends Error {
       code;
       buildId;
@@ -6177,7 +6307,11 @@ var init_image_builds = __esm({
         super(details.message);
         this.name = "ImageBuildError";
         this.code = details.code;
-        this.details = details;
+        this.details = { ...details };
+        withRaw(this, {});
+        if ("confirmed" in details) {
+          this.details.confirmed = details.confirmed === true && isConfirmedCancellation(details.outcome);
+        }
         if (details.buildId) this.buildId = details.buildId;
         if (details.clientRequestId) this.clientRequestId = details.clientRequestId;
       }
@@ -6209,7 +6343,7 @@ var init_image_builds = __esm({
         super(details);
         this.name = "ImageBuildFailedError";
         this.error = details.error ?? "no error recorded";
-        if (details.info) this.info = parseBuildInfo(details.info);
+        if (details.info) this.info = details.info;
       }
     };
     ImageBuildCancelledError = class extends ImageBuildError {
@@ -6217,7 +6351,7 @@ var init_image_builds = __esm({
       constructor(details) {
         super(details);
         this.name = "ImageBuildCancelledError";
-        if (details.info) this.info = parseBuildInfo(details.info);
+        if (details.info) this.info = details.info;
       }
     };
     ImageBuildTimeoutError = class extends ImageBuildError {
@@ -6233,8 +6367,8 @@ var init_image_builds = __esm({
       constructor(details) {
         super(details);
         this.name = "ImageBuildInterruptedError";
-        this.outcome = details.outcome ?? "unconfirmed";
-        this.confirmed = details.confirmed === true;
+        this.outcome = details.outcome ?? "unconfirmed" /* UNCONFIRMED */;
+        this.confirmed = this.details.confirmed === true;
         if (details.result) this.result = details.result;
       }
     };
@@ -6267,7 +6401,7 @@ var init_image_builds = __esm({
         } catch (error) {
           throw toImageBuildError(error);
         }
-        this.#info = parseBuildInfo(JSON.parse(json));
+        this.#info = parseBuildInfo(json);
         return this.#info;
       }
       /**
@@ -6288,8 +6422,12 @@ var init_image_builds = __esm({
           )
         );
         emitter.rethrow();
-        const result = parseResult(json);
-        this.#info = { ...this.#info, status: "succeeded", result };
+        const raw = decodeResponse(json);
+        const result = camelizeRecord(raw);
+        this.#info = withRaw(
+          { ...this.#info, status: "succeeded" /* SUCCEEDED */, result },
+          { ...this.#info.raw, status: "succeeded", result: raw }
+        );
         return result;
       }
       /** Cancel this build by its id (the sufficient selector). */
@@ -6352,16 +6490,58 @@ function defaultRegisteredName(dockerfilePath) {
   const parsed = import_node_path3.default.parse(dockerfilePath);
   if (parsed.name.toLowerCase() === "dockerfile") {
     const parentName = import_node_path3.default.basename(import_node_path3.default.dirname(dockerfilePath)).trim();
-    return parentName || "sandbox-image";
+    return parentName || DEFAULT_SANDBOX_IMAGE_NAME;
+  }
+  return parsed.name || DEFAULT_SANDBOX_IMAGE_NAME;
+}
+function registeredImageName(explicit, generated, cas, fallback = DEFAULT_SANDBOX_IMAGE_NAME) {
+  if (explicit || generated === void 0) {
+    const name = explicit ?? "";
+    return cas ? canonicalCasImageName(name) : name;
   }
-  return parsed.name || "sandbox-image";
+  return cas ? casImageNameFrom(generated, fallback) : generated;
+}
+function canonicalCasImageName(name) {
+  return name.replace(/[A-Z]/g, (c) => c.toLowerCase());
+}
+function casImageNameFrom(raw, fallback) {
+  const lowered = canonicalCasImageName(raw);
+  if (isAddressableCasImageName(lowered)) {
+    return lowered;
+  }
+  let name = "";
+  for (const original of lowered) {
+    const ch = /^[a-z0-9._-]$/.test(original) ? original : "-";
+    const previous = name[name.length - 1];
+    if (CAS_NAME_SEPARATORS.includes(ch) && previous !== void 0 && CAS_NAME_SEPARATORS.includes(previous)) {
+      continue;
+    }
+    name += ch;
+  }
+  name = name.replace(/^[._-]+|[._-]+$/g, "").slice(0, MAX_CAS_IMAGE_NAME_LENGTH).replace(/[._-]+$/, "");
+  return isAddressableCasImageName(name) ? name : fallback;
+}
+function isAddressableCasImageName(name) {
+  if (name.length === 0 || name.length > MAX_CAS_IMAGE_NAME_LENGTH || RESERVED_IMAGE_NAME_PREFIXES.some((prefix) => name.startsWith(prefix)) || /^[0-9a-f]{64}$/.test(name)) {
+    return false;
+  }
+  const colon = name.indexOf(":");
+  const repository = colon === -1 ? name : name.slice(0, colon);
+  if (!repository.split("/").every((component) => /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/.test(component))) {
+    return false;
+  }
+  if (colon === -1) {
+    return true;
+  }
+  const tag = name.slice(colon + 1);
+  return tag.length > 0 && tag.length <= 128 && /^[a-z0-9._-]+$/.test(tag) && !tag.startsWith(".") && !tag.startsWith("-");
 }
 function defaultRegisteredNameFromImage(imageReference) {
   const withoutDigest = imageReference.split("@", 1)[0] ?? imageReference;
   const lastSegment = withoutDigest.split("/").pop() ?? withoutDigest;
   const colonIndex = lastSegment.lastIndexOf(":");
   const name = colonIndex > 0 && colonIndex < lastSegment.length - 1 ? lastSegment.slice(0, colonIndex) : lastSegment;
-  return name || "imported-image";
+  return name || DEFAULT_IMPORTED_IMAGE_NAME;
 }
 function noopEmit(_event) {
 }
@@ -6464,7 +6644,11 @@ async function createSandboxImage(source, options = {}, deps = {}) {
     if (!text.endsWith("\n")) text += "\n";
     dockerfileText = text;
     nativeContextDir = resolvedContext;
-    effectiveName = options.registeredName ?? source.name;
+    effectiveName = registeredImageName(
+      options.registeredName ?? source.name,
+      void 0,
+      options.cas ?? true
+    );
   } else if (typeof source === "string") {
     const resolvedPath = import_node_path3.default.resolve(source);
     if (!(0, import_node_fs2.existsSync)(resolvedPath)) {
@@ -6473,7 +6657,11 @@ async function createSandboxImage(source, options = {}, deps = {}) {
     dockerfilePath = resolvedPath;
     dockerfileText = void 0;
     nativeContextDir = void 0;
-    effectiveName = options.registeredName ?? defaultRegisteredName(resolvedPath);
+    effectiveName = registeredImageName(
+      options.registeredName,
+      defaultRegisteredName(resolvedPath),
+      options.cas ?? true
+    );
   } else {
     throw new TypeError(
       `source must be an Image or a Dockerfile path, got ${typeof source}`
@@ -6497,12 +6685,16 @@ async function createSandboxImage(source, options = {}, deps = {}) {
         deps._allowPat ? "Missing TENSORLAKE_API_KEY or TENSORLAKE_PAT credentials." : "Missing TENSORLAKE_API_KEY credentials."
       );
     }
-    if (options.signal !== void 0 && !options.cas) {
+    const cas = options.cas ?? true;
+    if (options.signal !== void 0 && !cas) {
       throw new Error(
-        "signal is only supported for CAS image builds (cas: true); a legacy build has no Image Service build operation to cancel"
+        "signal is not supported for legacy image builds (cas: false): a legacy image build has no build operation to cancel"
       );
     }
-    emit({ type: "status", message: `Building image '${effectiveName}'...` });
+    emit({
+      type: "status",
+      message: `Building ${cas ? "CAS" : "legacy"} image '${effectiveName}'...`
+    });
     const binding = loadNativeBinding();
     let emitError;
     const nativeOptions = {
@@ -6524,7 +6716,7 @@ async function createSandboxImage(source, options = {}, deps = {}) {
       dockerConfigJson: options.dockerConfigJson,
       dockerfileText,
       contextDir: nativeContextDir,
-      cas: options.cas ?? false,
+      cas,
       buildArgs: options.buildArgs
     };
     const forward = (event) => {
@@ -6534,7 +6726,7 @@ async function createSandboxImage(source, options = {}, deps = {}) {
         emitError ??= error;
       }
     };
-    const resultJson = options.cas ? await __runWithInterrupt(
+    const resultJson = cas ? await __runWithInterrupt(
       options.signal,
       (interruptId) => binding.buildSandboxImage(nativeOptions, forward, interruptId)
     ) : await binding.buildSandboxImage(nativeOptions, forward);
@@ -6565,7 +6757,12 @@ async function importSandboxImage(imageReference, options = {}, deps = {}) {
   }
   const reference = imageReference.trim();
   const context = buildContextFromEnv();
-  const effectiveName = options.registeredName ?? defaultRegisteredNameFromImage(reference);
+  const effectiveName = registeredImageName(
+    options.registeredName,
+    defaultRegisteredNameFromImage(reference),
+    options.cas ?? true,
+    DEFAULT_IMPORTED_IMAGE_NAME
+  );
   if (effectiveName === DEFAULT_IMAGE_NAME2) {
     console.warn(
       `Importing sandbox image with the default name "${DEFAULT_IMAGE_NAME2}". Pass \`registeredName\` to avoid collisions with other default-named images in this project.`
@@ -6583,14 +6780,15 @@ async function importSandboxImage(imageReference, options = {}, deps = {}) {
       deps._allowPat ? "Missing TENSORLAKE_API_KEY or TENSORLAKE_PAT credentials." : "Missing TENSORLAKE_API_KEY credentials."
     );
   }
-  if (options.signal !== void 0 && !options.cas) {
+  const cas = options.cas ?? true;
+  if (options.signal !== void 0 && !cas) {
     throw new Error(
-      "signal is only supported for CAS image imports (cas: true); a legacy import has no Image Service build operation to cancel"
+      "signal is not supported for legacy image imports (cas: false): a legacy image import has no build operation to cancel"
     );
   }
   emit({
     type: "status",
-    message: `Importing image '${reference}' as '${effectiveName}'...`
+    message: `Importing '${reference}' as ${cas ? "CAS" : "legacy"} image '${effectiveName}'...`
   });
   const binding = loadNativeBinding();
   let emitError;
@@ -6611,7 +6809,7 @@ async function importSandboxImage(imageReference, options = {}, deps = {}) {
     userAgent: void 0,
     dockerCompat: options.dockerCompat ?? false,
     dockerConfigJson: options.dockerConfigJson,
-    cas: options.cas ?? false
+    cas
   };
   const forward = (event) => {
     try {
@@ -6620,7 +6818,7 @@ async function importSandboxImage(imageReference, options = {}, deps = {}) {
       emitError ??= error;
     }
   };
-  const resultJson = options.cas ? await __runWithInterrupt(
+  const resultJson = cas ? await __runWithInterrupt(
     options.signal,
     (interruptId) => binding.importSandboxImage(nativeOptions, forward, interruptId)
   ) : await binding.importSandboxImage(nativeOptions, forward);
@@ -6677,15 +6875,29 @@ async function deleteSandboxImage(imageName) {
   if (typeof imageName !== "string" || imageName.length === 0) {
     throw new TypeError("imageName must be a non-empty string");
   }
-  await loadNativeBinding().deleteSandboxImage(catalogOptionsFromEnv(), imageName);
+  warnIncompleteLegacyCleanup(
+    await loadNativeBinding().deleteSandboxImage(catalogOptionsFromEnv(), imageName)
+  );
 }
 async function deleteSandboxImageWithCredentials(credentials, imageName) {
   if (typeof imageName !== "string" || imageName.length === 0) {
     throw new TypeError("imageName must be a non-empty string");
   }
-  await loadNativeBinding().deleteSandboxImage(
-    catalogOptionsFromCredentials(credentials),
-    imageName
+  warnIncompleteLegacyCleanup(
+    await loadNativeBinding().deleteSandboxImage(
+      catalogOptionsFromCredentials(credentials),
+      imageName
+    )
+  );
+}
+function warnIncompleteLegacyCleanup(failure) {
+  if (failure == null) {
+    return;
+  }
+  const legacyImageId = failure.legacyImageId ?? void 0;
+  const label = legacyImageId ? ` (${legacyImageId})` : "";
+  console.warn(
+    `Deleted CAS image '${failure.legacyImageName}', but could not delete the legacy image of the same name${label}, which can no longer start sandboxes: ${failure.error}. Delete it with deleteSandboxImage("${legacyImageId ?? failure.legacyImageName}").`
   );
 }
 async function findSandboxImageByName(imageName) {
@@ -6729,13 +6941,14 @@ async function runCreateSandboxImageCli(argv = process.argv.slice(2)) {
       disk_mb: { type: "string" },
       builder_disk_mb: { type: "string" },
       docker_compat: { type: "boolean", default: false },
-      public: { type: "boolean", default: false }
+      public: { type: "boolean", default: false },
+      "no-cas": { type: "boolean", default: false }
     }
   });
   const dockerfilePath = parsed.positionals[0];
   if (!dockerfilePath) {
     throw new Error(
-      "Usage: tensorlake-create-sandbox-image <dockerfile_path> [--name NAME] [--cpus N] [--memory MiB] [--disk_mb MiB] [--builder_disk_mb MiB] [--docker_compat] [--public]"
+      "Usage: tensorlake-create-sandbox-image <dockerfile_path> [--name NAME] [--cpus N] [--memory MiB] [--disk_mb MiB] [--builder_disk_mb MiB] [--docker_compat] [--public] [--no-cas]"
     );
   }
   const cpus = parsed.values.cpus != null ? Number(parsed.values.cpus) : void 0;
@@ -6767,7 +6980,8 @@ async function runCreateSandboxImageCli(argv = process.argv.slice(2)) {
       diskMb,
       builderDiskMb,
       dockerCompat: parsed.values.docker_compat,
-      isPublic: parsed.values.public
+      isPublic: parsed.values.public,
+      cas: !parsed.values["no-cas"]
     },
     { emit: ndjsonStdoutEmit, _allowPat: true }
   );
@@ -6783,13 +6997,14 @@ async function runImportSandboxImageCli(argv = process.argv.slice(2)) {
       disk_mb: { type: "string" },
       builder_disk_mb: { type: "string" },
       docker_compat: { type: "boolean", default: false },
-      public: { type: "boolean", default: false }
+      public: { type: "boolean", default: false },
+      "no-cas": { type: "boolean", default: false }
     }
   });
   const imageReference = parsed.positionals[0];
   if (!imageReference) {
     throw new Error(
-      "Usage: tensorlake-import-sandbox-image <image_reference> [--name NAME] [--cpus N] [--memory MiB] [--disk_mb MiB] [--builder_disk_mb MiB] [--docker_compat] [--public]"
+      "Usage: tensorlake-import-sandbox-image <image_reference> [--name NAME] [--cpus N] [--memory MiB] [--disk_mb MiB] [--builder_disk_mb MiB] [--docker_compat] [--public] [--no-cas]"
     );
   }
   const cpus = parsed.values.cpus != null ? Number(parsed.values.cpus) : void 0;
@@ -6821,12 +7036,13 @@ async function runImportSandboxImageCli(argv = process.argv.slice(2)) {
       diskMb,
       builderDiskMb,
       dockerCompat: parsed.values.docker_compat,
-      isPublic: parsed.values.public
+      isPublic: parsed.values.public,
+      cas: !parsed.values["no-cas"]
     },
     { emit: ndjsonStdoutEmit, _allowPat: true }
   );
 }
-var import_node_path3, import_node_os2, import_node_fs2, import_node_util, cachedNativeBinding, cachedNativeBindingError, DEFAULT_IMAGE_NAME2, __imageBuildInternals;
+var import_node_path3, import_node_os2, import_node_fs2, import_node_util, cachedNativeBinding, cachedNativeBindingError, DEFAULT_IMAGE_NAME2, DEFAULT_SANDBOX_IMAGE_NAME, DEFAULT_IMPORTED_IMAGE_NAME, CAS_NAME_SEPARATORS, RESERVED_IMAGE_NAME_PREFIXES, MAX_CAS_IMAGE_NAME_LENGTH, __imageBuildInternals;
 var init_sandbox_image = __esm({
   "src/sandbox-image.ts"() {
     "use strict";
@@ -6839,6 +7055,11 @@ var init_sandbox_image = __esm({
     init_native_binding();
     init_image_builds();
     DEFAULT_IMAGE_NAME2 = "default";
+    DEFAULT_SANDBOX_IMAGE_NAME = "sandbox-image";
+    DEFAULT_IMPORTED_IMAGE_NAME = "imported-image";
+    CAS_NAME_SEPARATORS = "._-";
+    RESERVED_IMAGE_NAME_PREFIXES = ["sandbox_template_", "image_", "cas-v1:"];
+    MAX_CAS_IMAGE_NAME_LENGTH = 255;
     __imageBuildInternals = {
       loadNativeBinding: () => loadNativeBinding(),
       buildContextFromEnv: () => buildContextFromEnv(),
@@ -6847,7 +7068,12 @@ var init_sandbox_image = __esm({
       eventToEmitDict: (event) => eventToEmitDict(event),
       imageRequiresContext: (image) => imageRequiresContext(image),
       defaultRegisteredName: (dockerfilePath) => defaultRegisteredName(dockerfilePath),
-      defaultRegisteredNameFromImage: (reference) => defaultRegisteredNameFromImage(reference)
+      defaultRegisteredNameFromImage: (reference) => defaultRegisteredNameFromImage(reference),
+      registeredImageName: (explicit, generated, cas, fallback) => registeredImageName(explicit, generated, cas, fallback),
+      casImageNameFrom: (raw, fallback) => casImageNameFrom(raw, fallback),
+      canonicalCasImageName: (name) => canonicalCasImageName(name),
+      isAddressableCasImageName: (name) => isAddressableCasImageName(name),
+      defaultImportedImageName: DEFAULT_IMPORTED_IMAGE_NAME
     };
   }
 });
@@ -6873,14 +7099,19 @@ __export(index_exports, {
   Headers: () => Headers,
   HttpBody: () => HttpBody,
   Image: () => Image,
+  ImageBuildCancellationOutcome: () => ImageBuildCancellationOutcome,
   ImageBuildCancelledError: () => ImageBuildCancelledError,
   ImageBuildError: () => ImageBuildError,
+  ImageBuildErrorCode: () => ImageBuildErrorCode,
   ImageBuildFailedError: () => ImageBuildFailedError,
   ImageBuildHandle: () => ImageBuildHandle,
   ImageBuildInProgressError: () => ImageBuildInProgressError,
   ImageBuildInterruptedError: () => ImageBuildInterruptedError,
+  ImageBuildKind: () => ImageBuildKind,
   ImageBuildNotFoundError: () => ImageBuildNotFoundError,
   ImageBuildOperationType: () => ImageBuildOperationType,
+  ImageBuildPhase: () => ImageBuildPhase,
+  ImageBuildStatus: () => ImageBuildStatus,
   ImageBuildTimeoutError: () => ImageBuildTimeoutError,
   MountError: () => MountError,
   OutputMode: () => OutputMode,
@@ -7100,10 +7331,12 @@ var CloudClient = class _CloudClient {
     );
   }
   /**
-   * Delete a registered sandbox image by name or id through the merged
-   * catalog, with this client's credentials: an `image_` id or a name the
-   * Image Service knows deletes a CAS image, a `sandbox_template_` id or a
-   * name registered only in the platform registry deletes a legacy image.
+   * Delete a registered CAS or legacy sandbox image by name or id through the
+   * merged catalog, with this client's credentials: an `image_` id or a name
+   * the CAS image registry knows deletes a CAS image, a `sandbox_template_` id
+   * or a name registered only in the legacy image registry deletes a legacy
+   * image.
+   * A name is deleted from both the CAS and the legacy image registries.
    * Rejects when neither catalog knows the reference. The same semantics
    * and accepted differences as the module-level `deleteSandboxImage`.
    */
@@ -7111,10 +7344,10 @@ var CloudClient = class _CloudClient {
     await deleteSandboxImageWithCredentials(this.catalogCredentials(), imageName);
   }
   /**
-   * Look up a registered sandbox image by name or id through the merged
-   * catalog, with this client's credentials. Returns the image in the
-   * sandbox-template shape, or `null` when neither the Image Service nor the
-   * platform registry knows the reference. An explicit organization/project
+   * Look up a registered CAS or legacy sandbox image by name or id through
+   * the merged catalog, with this client's credentials. Returns the image in
+   * the sandbox-template shape, or `null` when neither the CAS nor the legacy
+   * image registry knows the reference. An explicit organization/project
    * scope (the client's, or the call's override) addresses that project's
    * routes directly, as before; without one the key's own scope applies.
    */
@@ -10503,14 +10736,19 @@ init_models();
   Headers,
   HttpBody,
   Image,
+  ImageBuildCancellationOutcome,
   ImageBuildCancelledError,
   ImageBuildError,
+  ImageBuildErrorCode,
   ImageBuildFailedError,
   ImageBuildHandle,
   ImageBuildInProgressError,
   ImageBuildInterruptedError,
+  ImageBuildKind,
   ImageBuildNotFoundError,
   ImageBuildOperationType,
+  ImageBuildPhase,
+  ImageBuildStatus,
   ImageBuildTimeoutError,
   MountError,
   OutputMode,