@tensorlakeai/tensorlake 0.5.154 → 0.5.156

package/dist/index.d.cts

@@ -1,6 +1,6 @@
-import { C as CloudClientOptions, A as ApplicationManifest, B as BinaryPayload, S as SandboxTemplate, a as ApplicationSummary, R as RequestInput, c as RequestMetadata, b as RequestOutput, d as SecretsList, e as Secret, N as NewSecret, U as UpsertSecretResponse, f as StartImageBuildRequest, g as BuildInfo, h as CreateApplicationBuildRequest, i as ApplicationBuildContext, j as ApplicationBuildResponse, k as BuildLogEntry, I as Image, l as CreateSandboxImageDeps, F as FileSystem } from './sandbox-image-BMiFlzAs.cjs';
-export { m as ApplicationBuildImageResult, n as CreateApplicationBuildImageRequest, o as CreateSandboxImageOptions, p as ImageBuildOperation, q as ImageBuildOperationType, q as ImageBuildOperationTypeValue, r as ImageOptions, s as ImportSandboxImageOptions, t as RequestErrorInfo, u as SandboxImageSource, v as SecretsPagination, w as createSandboxImage, x as deleteSandboxImage, y as dockerfileContent, z as findSandboxImageByName, D as importSandboxImage, E as listSandboxImages } from './sandbox-image-BMiFlzAs.cjs';
-export { v as APIClient, A as ApplicationCapability, a as ApplicationOptions, F as File, b as FunctionOptions, c as Future, H as Headers, d as HeadersInit, e as HttpBody, P as Parameter, g as RegisteredFunction, h as RemoteOptions, j as RequestContext, S as Schema, l as SimpleApplicationOptions, m as SimpleFunctionOptions, T as TailCall, r as registerApplication, o as registerFunction, p as remoteOptions, q as retries, s as runLocal, t as runRemote, u as schema } from './remote-B3vn4tt1.cjs';
+import { C as CloudClientOptions, A as ApplicationManifest, B as BinaryPayload, S as SandboxTemplate, a as ApplicationSummary, R as RequestInput, c as RequestMetadata, b as RequestOutput, d as SecretsList, e as Secret, N as NewSecret, U as UpsertSecretResponse, f as StartImageBuildRequest, g as BuildInfo, h as CreateApplicationBuildRequest, i as ApplicationBuildContext, j as ApplicationBuildResponse, k as BuildLogEntry, I as Image, l as CreateSandboxImageDeps, F as FileSystem } from './sandbox-image-C2GTVnx3.cjs';
+export { m as ApplicationBuildImageResult, n as CreateApplicationBuildImageRequest, o as CreateSandboxImageOptions, p as ImageBuildOperation, q as ImageBuildOperationType, q as ImageBuildOperationTypeValue, r as ImageOptions, s as ImportSandboxImageOptions, t as RequestErrorInfo, u as SandboxImageSource, v as SecretsPagination, w as createSandboxImage, x as deleteSandboxImage, y as dockerfileContent, z as findSandboxImageByName, D as importSandboxImage, E as listSandboxImages } from './sandbox-image-C2GTVnx3.cjs';
+export { v as APIClient, A as ApplicationCapability, a as ApplicationOptions, F as File, b as FunctionOptions, c as Future, H as Headers, d as HeadersInit, e as HttpBody, P as Parameter, g as RegisteredFunction, h as RemoteOptions, j as RequestContext, S as Schema, l as SimpleApplicationOptions, m as SimpleFunctionOptions, T as TailCall, r as registerApplication, o as registerFunction, p as remoteOptions, q as retries, s as runLocal, t as runRemote, u as schema } from './remote-CEs4GFGP.cjs';
 
 /** An SDK result paired with its server-side W3C trace ID. */
 type Traced<T> = T & {
@@ -1693,19 +1693,21 @@ declare class CloudClient {
     upsertApplication(manifest: ApplicationManifest, codeZip: BinaryPayload, upgradeRunningRequests?: boolean): Promise<void>;
     deleteApplication(applicationName: string): Promise<void>;
     /**
-     * Delete a registered sandbox image by name or id through the merged
-     * catalog, with this client's credentials: an `image_` id or a name the
-     * Image Service knows deletes a CAS image, a `sandbox_template_` id or a
-     * name registered only in the platform registry deletes a legacy image.
+     * Delete a registered CAS or legacy sandbox image by name or id through the
+     * merged catalog, with this client's credentials: an `image_` id or a name
+     * the CAS image registry knows deletes a CAS image, a `sandbox_template_` id
+     * or a name registered only in the legacy image registry deletes a legacy
+     * image.
+     * A name is deleted from both the CAS and the legacy image registries.
      * Rejects when neither catalog knows the reference. The same semantics
      * and accepted differences as the module-level `deleteSandboxImage`.
      */
     deleteSandboxImage(imageName: string): Promise<void>;
     /**
-     * Look up a registered sandbox image by name or id through the merged
-     * catalog, with this client's credentials. Returns the image in the
-     * sandbox-template shape, or `null` when neither the Image Service nor the
-     * platform registry knows the reference. An explicit organization/project
+     * Look up a registered CAS or legacy sandbox image by name or id through
+     * the merged catalog, with this client's credentials. Returns the image in
+     * the sandbox-template shape, or `null` when neither the CAS nor the legacy
+     * image registry knows the reference. An explicit organization/project
      * scope (the client's, or the call's override) addresses that project's
      * routes directly, as before; without one the key's own scope applies.
      */
@@ -2041,18 +2043,18 @@ declare class RepositoryClient {
 }
 
 /**
- * Image Service build operations for CAS sandbox images.
+ * Build operations for CAS sandbox images.
  *
- * A CAS (content-addressed streaming) image is built or imported by an Image
- * Service *build operation*. This module exposes that operation directly:
+ * A CAS (content-addressed streaming) image is built or imported by a *build
+ * operation*. This module exposes that operation directly:
  * {@link startImageBuild} / {@link startImageImport} admit a build (and upload
  * and seal its context) and return an {@link ImageBuildHandle} without
  * waiting; {@link getImageBuild} looks a build up by id; the handle's
  * `refresh`, `wait` and `cancel` read, wait for and cancel it.
  *
- * **CAS only.** Everything here addresses the Image Service. Legacy images
- * (`createSandboxImage` without `cas`, `sandbox_template_` ids, `.tlsnap`
- * snapshots) have no build operation: a `sandbox_template_` or `image_`
+ * **CAS images only.** Everything here addresses a CAS image build. Legacy
+ * images (`createSandboxImage` with `cas: false`, `sandbox_template_` ids,
+ * `.tlsnap` snapshots) have no build operation: a `sandbox_template_` or `image_`
  * reference passed as a build id is refused locally, before any request, and
  * the legacy functions in `sandbox-image.ts` keep their own requests,
  * results, errors and interruption behavior.
@@ -2143,7 +2145,7 @@ interface ImageBuildErrorDetails {
     waitedSecs?: number | null;
     status?: number | null;
 }
-/** An Image Service build operation failed. `code` is stable. */
+/** A CAS image build operation failed. `code` is stable. */
 declare class ImageBuildError extends Error {
     readonly code: ImageBuildErrorCode;
     readonly buildId?: string;
@@ -2199,14 +2201,14 @@ declare class ImageBuildInterruptedError extends ImageBuildError {
     constructor(details: ImageBuildErrorDetails);
 }
 /**
- * The published image of a succeeded build, in the sandbox-template shape
- * the merged catalog answers (derived by the core from the Image Service's
- * trimmed record): one image representation for `findSandboxImageByName`,
- * `listSandboxImages` and build results.
+ * The published CAS image of a succeeded build, in the sandbox-template
+ * shape the merged catalog answers (derived by the core from the CAS image
+ * registry's trimmed record): one image representation for
+ * `findSandboxImageByName`, `listSandboxImages` and build results.
  */
 type ImageBuildResult = SandboxTemplate;
 /**
- * One build or import as the Image Service reports it (the twelve-field
+ * One CAS image build or import as the service reports it (the twelve-field
  * `BuildInfo`; the service exposes no cleanup state, phase deadline,
  * content digest or upload capability on a build).
  */

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-import { C as CloudClientOptions, A as ApplicationManifest, B as BinaryPayload, S as SandboxTemplate, a as ApplicationSummary, R as RequestInput, c as RequestMetadata, b as RequestOutput, d as SecretsList, e as Secret, N as NewSecret, U as UpsertSecretResponse, f as StartImageBuildRequest, g as BuildInfo, h as CreateApplicationBuildRequest, i as ApplicationBuildContext, j as ApplicationBuildResponse, k as BuildLogEntry, I as Image, l as CreateSandboxImageDeps, F as FileSystem } from './sandbox-image-BMiFlzAs.js';
-export { m as ApplicationBuildImageResult, n as CreateApplicationBuildImageRequest, o as CreateSandboxImageOptions, p as ImageBuildOperation, q as ImageBuildOperationType, q as ImageBuildOperationTypeValue, r as ImageOptions, s as ImportSandboxImageOptions, t as RequestErrorInfo, u as SandboxImageSource, v as SecretsPagination, w as createSandboxImage, x as deleteSandboxImage, y as dockerfileContent, z as findSandboxImageByName, D as importSandboxImage, E as listSandboxImages } from './sandbox-image-BMiFlzAs.js';
-export { v as APIClient, A as ApplicationCapability, a as ApplicationOptions, F as File, b as FunctionOptions, c as Future, H as Headers, d as HeadersInit, e as HttpBody, P as Parameter, g as RegisteredFunction, h as RemoteOptions, j as RequestContext, S as Schema, l as SimpleApplicationOptions, m as SimpleFunctionOptions, T as TailCall, r as registerApplication, o as registerFunction, p as remoteOptions, q as retries, s as runLocal, t as runRemote, u as schema } from './remote-DqBUuciu.js';
+import { C as CloudClientOptions, A as ApplicationManifest, B as BinaryPayload, S as SandboxTemplate, a as ApplicationSummary, R as RequestInput, c as RequestMetadata, b as RequestOutput, d as SecretsList, e as Secret, N as NewSecret, U as UpsertSecretResponse, f as StartImageBuildRequest, g as BuildInfo, h as CreateApplicationBuildRequest, i as ApplicationBuildContext, j as ApplicationBuildResponse, k as BuildLogEntry, I as Image, l as CreateSandboxImageDeps, F as FileSystem } from './sandbox-image-C2GTVnx3.js';
+export { m as ApplicationBuildImageResult, n as CreateApplicationBuildImageRequest, o as CreateSandboxImageOptions, p as ImageBuildOperation, q as ImageBuildOperationType, q as ImageBuildOperationTypeValue, r as ImageOptions, s as ImportSandboxImageOptions, t as RequestErrorInfo, u as SandboxImageSource, v as SecretsPagination, w as createSandboxImage, x as deleteSandboxImage, y as dockerfileContent, z as findSandboxImageByName, D as importSandboxImage, E as listSandboxImages } from './sandbox-image-C2GTVnx3.js';
+export { v as APIClient, A as ApplicationCapability, a as ApplicationOptions, F as File, b as FunctionOptions, c as Future, H as Headers, d as HeadersInit, e as HttpBody, P as Parameter, g as RegisteredFunction, h as RemoteOptions, j as RequestContext, S as Schema, l as SimpleApplicationOptions, m as SimpleFunctionOptions, T as TailCall, r as registerApplication, o as registerFunction, p as remoteOptions, q as retries, s as runLocal, t as runRemote, u as schema } from './remote-DYBXCTNC.js';
 
 /** An SDK result paired with its server-side W3C trace ID. */
 type Traced<T> = T & {
@@ -1693,19 +1693,21 @@ declare class CloudClient {
     upsertApplication(manifest: ApplicationManifest, codeZip: BinaryPayload, upgradeRunningRequests?: boolean): Promise<void>;
     deleteApplication(applicationName: string): Promise<void>;
     /**
-     * Delete a registered sandbox image by name or id through the merged
-     * catalog, with this client's credentials: an `image_` id or a name the
-     * Image Service knows deletes a CAS image, a `sandbox_template_` id or a
-     * name registered only in the platform registry deletes a legacy image.
+     * Delete a registered CAS or legacy sandbox image by name or id through the
+     * merged catalog, with this client's credentials: an `image_` id or a name
+     * the CAS image registry knows deletes a CAS image, a `sandbox_template_` id
+     * or a name registered only in the legacy image registry deletes a legacy
+     * image.
+     * A name is deleted from both the CAS and the legacy image registries.
      * Rejects when neither catalog knows the reference. The same semantics
      * and accepted differences as the module-level `deleteSandboxImage`.
      */
     deleteSandboxImage(imageName: string): Promise<void>;
     /**
-     * Look up a registered sandbox image by name or id through the merged
-     * catalog, with this client's credentials. Returns the image in the
-     * sandbox-template shape, or `null` when neither the Image Service nor the
-     * platform registry knows the reference. An explicit organization/project
+     * Look up a registered CAS or legacy sandbox image by name or id through
+     * the merged catalog, with this client's credentials. Returns the image in
+     * the sandbox-template shape, or `null` when neither the CAS nor the legacy
+     * image registry knows the reference. An explicit organization/project
      * scope (the client's, or the call's override) addresses that project's
      * routes directly, as before; without one the key's own scope applies.
      */
@@ -2041,18 +2043,18 @@ declare class RepositoryClient {
 }
 
 /**
- * Image Service build operations for CAS sandbox images.
+ * Build operations for CAS sandbox images.
  *
- * A CAS (content-addressed streaming) image is built or imported by an Image
- * Service *build operation*. This module exposes that operation directly:
+ * A CAS (content-addressed streaming) image is built or imported by a *build
+ * operation*. This module exposes that operation directly:
  * {@link startImageBuild} / {@link startImageImport} admit a build (and upload
  * and seal its context) and return an {@link ImageBuildHandle} without
  * waiting; {@link getImageBuild} looks a build up by id; the handle's
  * `refresh`, `wait` and `cancel` read, wait for and cancel it.
  *
- * **CAS only.** Everything here addresses the Image Service. Legacy images
- * (`createSandboxImage` without `cas`, `sandbox_template_` ids, `.tlsnap`
- * snapshots) have no build operation: a `sandbox_template_` or `image_`
+ * **CAS images only.** Everything here addresses a CAS image build. Legacy
+ * images (`createSandboxImage` with `cas: false`, `sandbox_template_` ids,
+ * `.tlsnap` snapshots) have no build operation: a `sandbox_template_` or `image_`
  * reference passed as a build id is refused locally, before any request, and
  * the legacy functions in `sandbox-image.ts` keep their own requests,
  * results, errors and interruption behavior.
@@ -2143,7 +2145,7 @@ interface ImageBuildErrorDetails {
     waitedSecs?: number | null;
     status?: number | null;
 }
-/** An Image Service build operation failed. `code` is stable. */
+/** A CAS image build operation failed. `code` is stable. */
 declare class ImageBuildError extends Error {
     readonly code: ImageBuildErrorCode;
     readonly buildId?: string;
@@ -2199,14 +2201,14 @@ declare class ImageBuildInterruptedError extends ImageBuildError {
     constructor(details: ImageBuildErrorDetails);
 }
 /**
- * The published image of a succeeded build, in the sandbox-template shape
- * the merged catalog answers (derived by the core from the Image Service's
- * trimmed record): one image representation for `findSandboxImageByName`,
- * `listSandboxImages` and build results.
+ * The published CAS image of a succeeded build, in the sandbox-template
+ * shape the merged catalog answers (derived by the core from the CAS image
+ * registry's trimmed record): one image representation for
+ * `findSandboxImageByName`, `listSandboxImages` and build results.
  */
 type ImageBuildResult = SandboxTemplate;
 /**
- * One build or import as the Image Service reports it (the twelve-field
+ * One CAS image build or import as the service reports it (the twelve-field
  * `BuildInfo`; the service exposes no cleanup state, phase deadline,
  * content digest or upload capability on a build).
  */

package/dist/index.js

@@ -46,7 +46,7 @@ var init_defaults = __esm({
   "src/defaults.ts"() {
     "use strict";
     init_esm_shims();
-    SDK_VERSION = "0.5.154";
+    SDK_VERSION = "0.5.156";
     API_URL = process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai";
     API_KEY = process.env.TENSORLAKE_API_KEY ?? void 0;
     NAMESPACE = process.env.INDEXIFY_NAMESPACE ?? "default";
@@ -509,7 +509,7 @@ var init_native_worker_client = __esm({
       }
     };
     runtimeKey = /* @__PURE__ */ Symbol.for(
-      `tensorlake.native.worker.${false ? "source" : "0.5.154"}.v1`
+      `tensorlake.native.worker.${false ? "source" : "0.5.156"}.v1`
     );
     runtimes = globalThis;
   }
@@ -5716,10 +5716,11 @@ var init_image = __esm({
         });
       }
       /**
-       * Build this image as a sandbox template and register it.
+       * Build this image and register it as a CAS sandbox image (the default) or,
+       * with `cas: false`, a legacy sandbox image.
        *
        * Materializes the image in a build sandbox, snapshots the filesystem,
-       * and registers the snapshot as a named sandbox template.
+       * and registers the snapshot under the image's name.
        */
       async build(options = {}) {
         const { createSandboxImage: createSandboxImage2 } = await Promise.resolve().then(() => (init_sandbox_image(), sandbox_image_exports));
@@ -6002,14 +6003,14 @@ function rejectLegacyReference(buildId) {
   if (buildId.startsWith("sandbox_template_")) {
     throw new ImageBuildError({
       code: "usage" /* USAGE */,
-      message: `'${buildId}' is a legacy sandbox template id; legacy images have no build operation to get, wait for or cancel`,
+      message: `'${buildId}' is a legacy image id; legacy images have no build operation to get, wait for or cancel`,
       buildId
     });
   }
   if (buildId.startsWith("image_")) {
     throw new ImageBuildError({
       code: "usage" /* USAGE */,
-      message: `'${buildId}' is an image id, not a build id; look the image up with findSandboxImageByName or use the build id admission returned`,
+      message: `'${buildId}' is a CAS image id, not a build id; look the CAS image up with findSandboxImageByName or use the build id admission returned`,
       buildId
     });
   }
@@ -6088,19 +6089,27 @@ async function startImageBuild(source, options = {}, deps = {}) {
     let text = dockerfileContent(source);
     if (!text.endsWith("\n")) text += "\n";
     dockerfileText = text;
-    name = options.registeredName ?? source.name;
+    name = __imageBuildInternals.registeredImageName(
+      options.registeredName ?? source.name,
+      void 0,
+      true
+    );
   } else if (typeof source === "string") {
     const resolved = path3.resolve(source);
     if (!existsSync2(resolved)) throw new Error(`Dockerfile not found: ${source}`);
     dockerfilePath = resolved;
-    name = options.registeredName ?? __imageBuildInternals.defaultRegisteredName(resolved);
+    name = __imageBuildInternals.registeredImageName(
+      options.registeredName,
+      __imageBuildInternals.defaultRegisteredName(resolved),
+      true
+    );
   } else {
     throw new TypeError(`source must be an Image or a Dockerfile path, got ${typeof source}`);
   }
   try {
     const credentials = credentialsFromEnv();
     const binding = __imageBuildInternals.loadNativeBinding();
-    emitter.emit({ type: "status", message: `Building image '${name}'...` });
+    emitter.emit({ type: "status", message: `Building CAS image '${name}'...` });
     const json = await __runWithInterrupt(
       options.signal,
       (interruptId) => binding.startImageBuild(
@@ -6136,11 +6145,16 @@ async function startImageImport(imageReference, options = {}, deps = {}) {
     throw new Error("image reference to import must not be empty");
   }
   const reference = imageReference.trim();
-  const name = options.registeredName ?? __imageBuildInternals.defaultRegisteredNameFromImage(reference);
+  const name = __imageBuildInternals.registeredImageName(
+    options.registeredName,
+    __imageBuildInternals.defaultRegisteredNameFromImage(reference),
+    true,
+    __imageBuildInternals.defaultImportedImageName
+  );
   const emitter = makeEmitter({ emit: deps.emit ?? options.emit, verbose: options.verbose });
   const credentials = credentialsFromEnv();
   const binding = __imageBuildInternals.loadNativeBinding();
-  emitter.emit({ type: "status", message: `Importing image '${reference}' as '${name}'...` });
+  emitter.emit({ type: "status", message: `Importing '${reference}' as CAS image '${name}'...` });
   const json = await __runWithInterrupt(
     options.signal,
     (interruptId) => binding.startImageImport(
@@ -6477,16 +6491,58 @@ function defaultRegisteredName(dockerfilePath) {
   const parsed = path4.parse(dockerfilePath);
   if (parsed.name.toLowerCase() === "dockerfile") {
     const parentName = path4.basename(path4.dirname(dockerfilePath)).trim();
-    return parentName || "sandbox-image";
+    return parentName || DEFAULT_SANDBOX_IMAGE_NAME;
   }
-  return parsed.name || "sandbox-image";
+  return parsed.name || DEFAULT_SANDBOX_IMAGE_NAME;
+}
+function registeredImageName(explicit, generated, cas, fallback = DEFAULT_SANDBOX_IMAGE_NAME) {
+  if (explicit || generated === void 0) {
+    const name = explicit ?? "";
+    return cas ? canonicalCasImageName(name) : name;
+  }
+  return cas ? casImageNameFrom(generated, fallback) : generated;
+}
+function canonicalCasImageName(name) {
+  return name.replace(/[A-Z]/g, (c) => c.toLowerCase());
+}
+function casImageNameFrom(raw, fallback) {
+  const lowered = canonicalCasImageName(raw);
+  if (isAddressableCasImageName(lowered)) {
+    return lowered;
+  }
+  let name = "";
+  for (const original of lowered) {
+    const ch = /^[a-z0-9._-]$/.test(original) ? original : "-";
+    const previous = name[name.length - 1];
+    if (CAS_NAME_SEPARATORS.includes(ch) && previous !== void 0 && CAS_NAME_SEPARATORS.includes(previous)) {
+      continue;
+    }
+    name += ch;
+  }
+  name = name.replace(/^[._-]+|[._-]+$/g, "").slice(0, MAX_CAS_IMAGE_NAME_LENGTH).replace(/[._-]+$/, "");
+  return isAddressableCasImageName(name) ? name : fallback;
+}
+function isAddressableCasImageName(name) {
+  if (name.length === 0 || name.length > MAX_CAS_IMAGE_NAME_LENGTH || RESERVED_IMAGE_NAME_PREFIXES.some((prefix) => name.startsWith(prefix)) || /^[0-9a-f]{64}$/.test(name)) {
+    return false;
+  }
+  const colon = name.indexOf(":");
+  const repository = colon === -1 ? name : name.slice(0, colon);
+  if (!repository.split("/").every((component) => /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/.test(component))) {
+    return false;
+  }
+  if (colon === -1) {
+    return true;
+  }
+  const tag = name.slice(colon + 1);
+  return tag.length > 0 && tag.length <= 128 && /^[a-z0-9._-]+$/.test(tag) && !tag.startsWith(".") && !tag.startsWith("-");
 }
 function defaultRegisteredNameFromImage(imageReference) {
   const withoutDigest = imageReference.split("@", 1)[0] ?? imageReference;
   const lastSegment = withoutDigest.split("/").pop() ?? withoutDigest;
   const colonIndex = lastSegment.lastIndexOf(":");
   const name = colonIndex > 0 && colonIndex < lastSegment.length - 1 ? lastSegment.slice(0, colonIndex) : lastSegment;
-  return name || "imported-image";
+  return name || DEFAULT_IMPORTED_IMAGE_NAME;
 }
 function noopEmit(_event) {
 }
@@ -6589,7 +6645,11 @@ async function createSandboxImage(source, options = {}, deps = {}) {
     if (!text.endsWith("\n")) text += "\n";
     dockerfileText = text;
     nativeContextDir = resolvedContext;
-    effectiveName = options.registeredName ?? source.name;
+    effectiveName = registeredImageName(
+      options.registeredName ?? source.name,
+      void 0,
+      options.cas ?? true
+    );
   } else if (typeof source === "string") {
     const resolvedPath = path4.resolve(source);
     if (!existsSync3(resolvedPath)) {
@@ -6598,7 +6658,11 @@ async function createSandboxImage(source, options = {}, deps = {}) {
     dockerfilePath = resolvedPath;
     dockerfileText = void 0;
     nativeContextDir = void 0;
-    effectiveName = options.registeredName ?? defaultRegisteredName(resolvedPath);
+    effectiveName = registeredImageName(
+      options.registeredName,
+      defaultRegisteredName(resolvedPath),
+      options.cas ?? true
+    );
   } else {
     throw new TypeError(
       `source must be an Image or a Dockerfile path, got ${typeof source}`
@@ -6622,12 +6686,16 @@ async function createSandboxImage(source, options = {}, deps = {}) {
         deps._allowPat ? "Missing TENSORLAKE_API_KEY or TENSORLAKE_PAT credentials." : "Missing TENSORLAKE_API_KEY credentials."
       );
     }
-    if (options.signal !== void 0 && !options.cas) {
+    const cas = options.cas ?? true;
+    if (options.signal !== void 0 && !cas) {
       throw new Error(
-        "signal is only supported for CAS image builds (cas: true); a legacy build has no Image Service build operation to cancel"
+        "signal is not supported for legacy image builds (cas: false): a legacy image build has no build operation to cancel"
       );
     }
-    emit({ type: "status", message: `Building image '${effectiveName}'...` });
+    emit({
+      type: "status",
+      message: `Building ${cas ? "CAS" : "legacy"} image '${effectiveName}'...`
+    });
     const binding = loadNativeBinding();
     let emitError;
     const nativeOptions = {
@@ -6649,7 +6717,7 @@ async function createSandboxImage(source, options = {}, deps = {}) {
       dockerConfigJson: options.dockerConfigJson,
       dockerfileText,
       contextDir: nativeContextDir,
-      cas: options.cas ?? false,
+      cas,
       buildArgs: options.buildArgs
     };
     const forward = (event) => {
@@ -6659,7 +6727,7 @@ async function createSandboxImage(source, options = {}, deps = {}) {
         emitError ??= error;
       }
     };
-    const resultJson = options.cas ? await __runWithInterrupt(
+    const resultJson = cas ? await __runWithInterrupt(
       options.signal,
       (interruptId) => binding.buildSandboxImage(nativeOptions, forward, interruptId)
     ) : await binding.buildSandboxImage(nativeOptions, forward);
@@ -6690,7 +6758,12 @@ async function importSandboxImage(imageReference, options = {}, deps = {}) {
   }
   const reference = imageReference.trim();
   const context = buildContextFromEnv();
-  const effectiveName = options.registeredName ?? defaultRegisteredNameFromImage(reference);
+  const effectiveName = registeredImageName(
+    options.registeredName,
+    defaultRegisteredNameFromImage(reference),
+    options.cas ?? true,
+    DEFAULT_IMPORTED_IMAGE_NAME
+  );
   if (effectiveName === DEFAULT_IMAGE_NAME2) {
     console.warn(
       `Importing sandbox image with the default name "${DEFAULT_IMAGE_NAME2}". Pass \`registeredName\` to avoid collisions with other default-named images in this project.`
@@ -6708,14 +6781,15 @@ async function importSandboxImage(imageReference, options = {}, deps = {}) {
       deps._allowPat ? "Missing TENSORLAKE_API_KEY or TENSORLAKE_PAT credentials." : "Missing TENSORLAKE_API_KEY credentials."
     );
   }
-  if (options.signal !== void 0 && !options.cas) {
+  const cas = options.cas ?? true;
+  if (options.signal !== void 0 && !cas) {
     throw new Error(
-      "signal is only supported for CAS image imports (cas: true); a legacy import has no Image Service build operation to cancel"
+      "signal is not supported for legacy image imports (cas: false): a legacy image import has no build operation to cancel"
     );
   }
   emit({
     type: "status",
-    message: `Importing image '${reference}' as '${effectiveName}'...`
+    message: `Importing '${reference}' as ${cas ? "CAS" : "legacy"} image '${effectiveName}'...`
   });
   const binding = loadNativeBinding();
   let emitError;
@@ -6736,7 +6810,7 @@ async function importSandboxImage(imageReference, options = {}, deps = {}) {
     userAgent: void 0,
     dockerCompat: options.dockerCompat ?? false,
     dockerConfigJson: options.dockerConfigJson,
-    cas: options.cas ?? false
+    cas
   };
   const forward = (event) => {
     try {
@@ -6745,7 +6819,7 @@ async function importSandboxImage(imageReference, options = {}, deps = {}) {
       emitError ??= error;
     }
   };
-  const resultJson = options.cas ? await __runWithInterrupt(
+  const resultJson = cas ? await __runWithInterrupt(
     options.signal,
     (interruptId) => binding.importSandboxImage(nativeOptions, forward, interruptId)
   ) : await binding.importSandboxImage(nativeOptions, forward);
@@ -6802,15 +6876,29 @@ async function deleteSandboxImage(imageName) {
   if (typeof imageName !== "string" || imageName.length === 0) {
     throw new TypeError("imageName must be a non-empty string");
   }
-  await loadNativeBinding().deleteSandboxImage(catalogOptionsFromEnv(), imageName);
+  warnIncompleteLegacyCleanup(
+    await loadNativeBinding().deleteSandboxImage(catalogOptionsFromEnv(), imageName)
+  );
 }
 async function deleteSandboxImageWithCredentials(credentials, imageName) {
   if (typeof imageName !== "string" || imageName.length === 0) {
     throw new TypeError("imageName must be a non-empty string");
   }
-  await loadNativeBinding().deleteSandboxImage(
-    catalogOptionsFromCredentials(credentials),
-    imageName
+  warnIncompleteLegacyCleanup(
+    await loadNativeBinding().deleteSandboxImage(
+      catalogOptionsFromCredentials(credentials),
+      imageName
+    )
+  );
+}
+function warnIncompleteLegacyCleanup(failure) {
+  if (failure == null) {
+    return;
+  }
+  const legacyImageId = failure.legacyImageId ?? void 0;
+  const label = legacyImageId ? ` (${legacyImageId})` : "";
+  console.warn(
+    `Deleted CAS image '${failure.legacyImageName}', but could not delete the legacy image of the same name${label}, which can no longer start sandboxes: ${failure.error}. Delete it with deleteSandboxImage("${legacyImageId ?? failure.legacyImageName}").`
   );
 }
 async function findSandboxImageByName(imageName) {
@@ -6854,13 +6942,14 @@ async function runCreateSandboxImageCli(argv = process.argv.slice(2)) {
       disk_mb: { type: "string" },
       builder_disk_mb: { type: "string" },
       docker_compat: { type: "boolean", default: false },
-      public: { type: "boolean", default: false }
+      public: { type: "boolean", default: false },
+      "no-cas": { type: "boolean", default: false }
     }
   });
   const dockerfilePath = parsed.positionals[0];
   if (!dockerfilePath) {
     throw new Error(
-      "Usage: tensorlake-create-sandbox-image <dockerfile_path> [--name NAME] [--cpus N] [--memory MiB] [--disk_mb MiB] [--builder_disk_mb MiB] [--docker_compat] [--public]"
+      "Usage: tensorlake-create-sandbox-image <dockerfile_path> [--name NAME] [--cpus N] [--memory MiB] [--disk_mb MiB] [--builder_disk_mb MiB] [--docker_compat] [--public] [--no-cas]"
     );
   }
   const cpus = parsed.values.cpus != null ? Number(parsed.values.cpus) : void 0;
@@ -6892,7 +6981,8 @@ async function runCreateSandboxImageCli(argv = process.argv.slice(2)) {
       diskMb,
       builderDiskMb,
       dockerCompat: parsed.values.docker_compat,
-      isPublic: parsed.values.public
+      isPublic: parsed.values.public,
+      cas: !parsed.values["no-cas"]
     },
     { emit: ndjsonStdoutEmit, _allowPat: true }
   );
@@ -6908,13 +6998,14 @@ async function runImportSandboxImageCli(argv = process.argv.slice(2)) {
       disk_mb: { type: "string" },
       builder_disk_mb: { type: "string" },
       docker_compat: { type: "boolean", default: false },
-      public: { type: "boolean", default: false }
+      public: { type: "boolean", default: false },
+      "no-cas": { type: "boolean", default: false }
     }
   });
   const imageReference = parsed.positionals[0];
   if (!imageReference) {
     throw new Error(
-      "Usage: tensorlake-import-sandbox-image <image_reference> [--name NAME] [--cpus N] [--memory MiB] [--disk_mb MiB] [--builder_disk_mb MiB] [--docker_compat] [--public]"
+      "Usage: tensorlake-import-sandbox-image <image_reference> [--name NAME] [--cpus N] [--memory MiB] [--disk_mb MiB] [--builder_disk_mb MiB] [--docker_compat] [--public] [--no-cas]"
     );
   }
   const cpus = parsed.values.cpus != null ? Number(parsed.values.cpus) : void 0;
@@ -6946,12 +7037,13 @@ async function runImportSandboxImageCli(argv = process.argv.slice(2)) {
       diskMb,
       builderDiskMb,
       dockerCompat: parsed.values.docker_compat,
-      isPublic: parsed.values.public
+      isPublic: parsed.values.public,
+      cas: !parsed.values["no-cas"]
     },
     { emit: ndjsonStdoutEmit, _allowPat: true }
   );
 }
-var cachedNativeBinding, cachedNativeBindingError, DEFAULT_IMAGE_NAME2, __imageBuildInternals;
+var cachedNativeBinding, cachedNativeBindingError, DEFAULT_IMAGE_NAME2, DEFAULT_SANDBOX_IMAGE_NAME, DEFAULT_IMPORTED_IMAGE_NAME, CAS_NAME_SEPARATORS, RESERVED_IMAGE_NAME_PREFIXES, MAX_CAS_IMAGE_NAME_LENGTH, __imageBuildInternals;
 var init_sandbox_image = __esm({
   "src/sandbox-image.ts"() {
     "use strict";
@@ -6960,6 +7052,11 @@ var init_sandbox_image = __esm({
     init_native_binding();
     init_image_builds();
     DEFAULT_IMAGE_NAME2 = "default";
+    DEFAULT_SANDBOX_IMAGE_NAME = "sandbox-image";
+    DEFAULT_IMPORTED_IMAGE_NAME = "imported-image";
+    CAS_NAME_SEPARATORS = "._-";
+    RESERVED_IMAGE_NAME_PREFIXES = ["sandbox_template_", "image_", "cas-v1:"];
+    MAX_CAS_IMAGE_NAME_LENGTH = 255;
     __imageBuildInternals = {
       loadNativeBinding: () => loadNativeBinding(),
       buildContextFromEnv: () => buildContextFromEnv(),
@@ -6968,7 +7065,12 @@ var init_sandbox_image = __esm({
       eventToEmitDict: (event) => eventToEmitDict(event),
       imageRequiresContext: (image) => imageRequiresContext(image),
       defaultRegisteredName: (dockerfilePath) => defaultRegisteredName(dockerfilePath),
-      defaultRegisteredNameFromImage: (reference) => defaultRegisteredNameFromImage(reference)
+      defaultRegisteredNameFromImage: (reference) => defaultRegisteredNameFromImage(reference),
+      registeredImageName: (explicit, generated, cas, fallback) => registeredImageName(explicit, generated, cas, fallback),
+      casImageNameFrom: (raw, fallback) => casImageNameFrom(raw, fallback),
+      canonicalCasImageName: (name) => canonicalCasImageName(name),
+      isAddressableCasImageName: (name) => isAddressableCasImageName(name),
+      defaultImportedImageName: DEFAULT_IMPORTED_IMAGE_NAME
     };
   }
 });
@@ -7135,10 +7237,12 @@ var CloudClient = class _CloudClient {
     );
   }
   /**
-   * Delete a registered sandbox image by name or id through the merged
-   * catalog, with this client's credentials: an `image_` id or a name the
-   * Image Service knows deletes a CAS image, a `sandbox_template_` id or a
-   * name registered only in the platform registry deletes a legacy image.
+   * Delete a registered CAS or legacy sandbox image by name or id through the
+   * merged catalog, with this client's credentials: an `image_` id or a name
+   * the CAS image registry knows deletes a CAS image, a `sandbox_template_` id
+   * or a name registered only in the legacy image registry deletes a legacy
+   * image.
+   * A name is deleted from both the CAS and the legacy image registries.
    * Rejects when neither catalog knows the reference. The same semantics
    * and accepted differences as the module-level `deleteSandboxImage`.
    */
@@ -7146,10 +7250,10 @@ var CloudClient = class _CloudClient {
     await deleteSandboxImageWithCredentials(this.catalogCredentials(), imageName);
   }
   /**
-   * Look up a registered sandbox image by name or id through the merged
-   * catalog, with this client's credentials. Returns the image in the
-   * sandbox-template shape, or `null` when neither the Image Service nor the
-   * platform registry knows the reference. An explicit organization/project
+   * Look up a registered CAS or legacy sandbox image by name or id through
+   * the merged catalog, with this client's credentials. Returns the image in
+   * the sandbox-template shape, or `null` when neither the CAS nor the legacy
+   * image registry knows the reference. An explicit organization/project
    * scope (the client's, or the call's override) addresses that project's
    * routes directly, as before; without one the key's own scope applies.
    */