@veris-ai/daytona 0.1.0

package/dist/index.js

@@ -0,0 +1,855 @@
+// src/index.ts
+export * from "@daytona/sdk";
+
+// src/daytona.ts
+import { Daytona as BaseDaytona } from "@daytona/sdk";
+
+// src/errors.ts
+var VerisError = class extends Error {
+  phase;
+  /** The Veris twin's sandbox id, when one exists yet. */
+  verisSandboxId;
+  /** Verbatim control-plane response body, when the failure came from an API call. */
+  responseBody;
+  constructor(message, opts = {}) {
+    super(message, opts.cause !== void 0 ? { cause: opts.cause } : void 0);
+    this.name = new.target.name;
+    this.phase = opts.phase;
+    this.verisSandboxId = opts.verisSandboxId;
+    this.responseBody = opts.responseBody;
+  }
+};
+var MissingCredentialsError = class extends VerisError {
+};
+var VerisGatewayUnreachableError = class extends VerisError {
+};
+var VerisGatewayNotOfferedError = class extends VerisError {
+  /** Server-announced minimum SDK version, when the refusal carried one. */
+  minSdk;
+  constructor(message, opts = {}) {
+    super(message, opts);
+    this.minSdk = opts.minSdk;
+  }
+};
+var ReceiptIntegrityError = class extends VerisError {
+};
+var VerisUntouchedError = class extends VerisError {
+  service;
+  constructor(message, service, opts = {}) {
+    super(message, opts);
+    this.service = service;
+  }
+};
+var TwinExpiredError = class extends VerisError {
+};
+var SnapshotUnsupportedError = class extends VerisError {
+};
+var UnsupportedOperationError = class extends VerisError {
+};
+
+// src/control-plane.ts
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var ControlPlane = class {
+  apiBase;
+  headers;
+  constructor(opts) {
+    this.apiBase = opts.apiBase.replace(/\/$/, "");
+    this.headers = {
+      "X-API-Key": opts.apiKey,
+      "X-Veris-SDK": opts.sdkVersion,
+      "Content-Type": "application/json"
+    };
+  }
+  async request(method, path, body) {
+    let res;
+    try {
+      res = await fetch(`${this.apiBase}${path}`, {
+        method,
+        headers: this.headers,
+        body: body === void 0 ? void 0 : JSON.stringify(body)
+      });
+    } catch (cause) {
+      throw new VerisError(`Veris control plane unreachable (${method} ${path})`, { cause });
+    }
+    return res;
+  }
+  async json(res, context, phase) {
+    const text = await res.text();
+    let parsed;
+    try {
+      parsed = text ? JSON.parse(text) : void 0;
+    } catch {
+      parsed = text;
+    }
+    if (!res.ok) {
+      throw new VerisError(`${context}: ${res.status}`, { phase, responseBody: parsed });
+    }
+    if (parsed === void 0) {
+      throw new VerisError(`${context}: empty response body`, { phase, responseBody: text });
+    }
+    return parsed;
+  }
+  async createTwin(environmentId, opts = {}) {
+    const res = await this.request("POST", `/v1/environments/${environmentId}/sandboxes`, {
+      ttl_minutes: opts.ttlMinutes,
+      metadata: opts.metadata
+    });
+    return this.json(res, `create sandbox in environment ${environmentId}`, "twin-provision");
+  }
+  async getTwin(sandboxId) {
+    const res = await this.request("GET", `/v1/sandboxes/${sandboxId}`);
+    if (res.status === 404) return null;
+    return this.json(res, `get sandbox ${sandboxId}`);
+  }
+  /** Poll until the twin reports ready. "failed" is terminal per the API docs. */
+  async waitReady(sandboxId, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    for (; ; ) {
+      const twin = await this.getTwin(sandboxId);
+      if (!twin) throw new TwinExpiredError(`Veris sandbox ${sandboxId} disappeared while provisioning`, { verisSandboxId: sandboxId });
+      if (twin.status === "ready") return twin;
+      if (twin.status === "failed") {
+        throw new VerisError(
+          `Veris sandbox ${sandboxId} failed to provision: ${twin.failure_reason ?? "no failure_reason"}`,
+          { phase: "twin-provision", verisSandboxId: sandboxId }
+        );
+      }
+      if (Date.now() > deadline) {
+        throw new VerisError(
+          `Veris sandbox ${sandboxId} not ready after ${timeoutMs}ms (status: ${twin.status})`,
+          { phase: "twin-provision", verisSandboxId: sandboxId }
+        );
+      }
+      await sleep(1500);
+    }
+  }
+  async services(sandboxId) {
+    const res = await this.request("GET", `/v1/sandboxes/${sandboxId}/services`);
+    if (res.status === 404) {
+      throw new TwinExpiredError(`Veris sandbox ${sandboxId} not found \u2014 expired or deleted`, { verisSandboxId: sandboxId });
+    }
+    return this.json(res, `services of sandbox ${sandboxId}`, "receipt");
+  }
+  async deleteTwin(environmentId, sandboxId) {
+    const res = await this.request("DELETE", `/v1/environments/${environmentId}/sandboxes/${sandboxId}`);
+    if (res.status === 404) return false;
+    if (!res.ok) await this.json(res, `delete sandbox ${sandboxId}`);
+    return true;
+  }
+  /**
+   * Mint (or re-mint) the gateway egress credential for a twin. Returns null
+   * when the control plane does not offer gateway mode at all (404 — route
+   * absent), so `mode: 'auto'` can fall back; throws VerisGatewayNotOfferedError
+   * on an explicit version refusal (409 sdk_too_old).
+   */
+  async mintEgressCredential(environmentId, sandboxId) {
+    const res = await this.request("POST", `/v1/environments/${environmentId}/sandboxes/${sandboxId}/egress-credential`);
+    if (res.status === 404) return null;
+    if (res.status === 409) {
+      const body = await res.json().catch(() => ({}));
+      throw new VerisGatewayNotOfferedError(
+        `this SDK version is below the control plane's minimum for gateway mode${body.min_sdk ? ` (min_sdk ${body.min_sdk})` : ""} \u2014 upgrade @veris-ai/daytona`,
+        { phase: "credential-mint", verisSandboxId: sandboxId, minSdk: body.min_sdk, responseBody: body }
+      );
+    }
+    return this.json(res, `mint egress credential for ${sandboxId}`, "credential-mint");
+  }
+  /** PATCH the twin resource. Omitted fields are untouched by the server. */
+  async updateSandbox(environmentId, sandboxId, patch) {
+    const res = await this.request("PATCH", `/v1/environments/${environmentId}/sandboxes/${sandboxId}`, patch);
+    if (res.status === 404) {
+      throw new TwinExpiredError(`Veris sandbox ${sandboxId} not found`, { verisSandboxId: sandboxId });
+    }
+    if (!res.ok) await this.json(res, `update sandbox ${sandboxId}`);
+  }
+  /** Extend a twin's TTL so it stays in lockstep with an extended Daytona sandbox. */
+  async extendTtl(environmentId, sandboxId, ttlMinutes) {
+    const res = await this.request("PATCH", `/v1/environments/${environmentId}/sandboxes/${sandboxId}`, { ttl_minutes: ttlMinutes });
+    if (res.status === 404) {
+      throw new TwinExpiredError(`Veris sandbox ${sandboxId} not found \u2014 cannot extend TTL`, { verisSandboxId: sandboxId });
+    }
+    if (!res.ok && res.status !== 405) await this.json(res, `extend TTL of ${sandboxId}`);
+  }
+  /** Create-time preflight: is the gateway infrastructure up, per the control plane? */
+  async gatewayHealth() {
+    const res = await this.request("GET", "/v1/gateway/health");
+    if (res.status === 404) return;
+    if (!res.ok) {
+      throw new VerisGatewayUnreachableError(
+        `Veris gateway reported unhealthy (${res.status})`,
+        { phase: "gateway-preflight" }
+      );
+    }
+  }
+};
+
+// src/receipt.ts
+function parseRequestsBody(body) {
+  const rows = Array.isArray(body?.requests) ? body.requests : [];
+  const entries = rows.map((r) => {
+    const row = r;
+    return {
+      method: String(row.method ?? ""),
+      path: String(row.path ?? ""),
+      status: typeof row.status === "number" ? row.status : null
+    };
+  });
+  return { count: entries.length, entries };
+}
+async function fetchReceiptEntry(svc) {
+  const url = `${svc.control_url}/veris/requests`;
+  const res = await fetch(url);
+  const text = await res.text();
+  if (!res.ok) {
+    throw new VerisError(`could not read receipt for service '${svc.name}' (${res.status})`, {
+      phase: "receipt",
+      responseBody: text.slice(0, 500)
+    });
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    throw new VerisError(`service '${svc.name}' returned a non-JSON receipt body`, {
+      phase: "receipt",
+      responseBody: text.slice(0, 500)
+    });
+  }
+  const { count, entries } = parseRequestsBody(raw);
+  return { requests: count, controlUrl: svc.control_url, entries, raw };
+}
+
+// src/network.ts
+var isHttpUrl = (u) => /^https?:/.test(u);
+function vendorHosts(services) {
+  const hosts = /* @__PURE__ */ new Set();
+  for (const svc of services) {
+    for (const r of svc.routes ?? []) hosts.add(r.host);
+  }
+  return [...hosts].sort();
+}
+function twinHosts(services) {
+  const hosts = /* @__PURE__ */ new Set();
+  for (const svc of services) {
+    for (const u of [svc.control_url, svc.url]) {
+      if (!u || !isHttpUrl(u)) continue;
+      try {
+        hosts.add(new URL(u).hostname);
+      } catch {
+      }
+    }
+  }
+  return [...hosts].sort();
+}
+function dataPlaneHosts(services) {
+  const hosts = /* @__PURE__ */ new Set();
+  for (const svc of services) {
+    if (!svc.url || isHttpUrl(svc.url)) continue;
+    for (const h of hostsFromDsn(svc.url)) hosts.add(h);
+  }
+  return [...hosts].sort();
+}
+function hostsFromDsn(dsn) {
+  const out = [];
+  try {
+    const u = new URL(dsn);
+    if (u.hostname) out.push(u.hostname.replace(/^\[|\]$/g, ""));
+  } catch {
+  }
+  const authority = dsn.replace(/^[^:]+:\/\//, "").split(/[/?]/)[0] ?? "";
+  const afterAt = authority.includes("@") ? authority.slice(authority.lastIndexOf("@") + 1) : authority;
+  for (const part of afterAt.split(",")) {
+    const m = part.match(/^\[?([A-Za-z0-9_.:-]+?)\]?(?::\d+)?$/);
+    if (m?.[1] && !/^\d+$/.test(m[1])) out.push(m[1].replace(/^\[|\]$/g, ""));
+  }
+  return out;
+}
+function dataPlaneEnv(services) {
+  const envs = {};
+  for (const svc of services) {
+    if (!svc.env_hint || !svc.url || isHttpUrl(svc.url)) continue;
+    if (!isSafeEnvName(svc.env_hint)) continue;
+    envs[svc.env_hint] = svc.url;
+  }
+  return envs;
+}
+var PROCESS_CONTROLLING = /* @__PURE__ */ new Set([
+  "PATH",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "NODE_OPTIONS",
+  "BASH_ENV",
+  "ENV",
+  "PYTHONPATH",
+  "PYTHONSTARTUP",
+  "SHELL",
+  "IFS",
+  "HOME",
+  "PROMPT_COMMAND"
+]);
+function isSafeEnvName(name) {
+  return /^[A-Z][A-Z0-9_]{0,63}$/.test(name) && !PROCESS_CONTROLLING.has(name);
+}
+var DEFAULT_REGISTRY_HOSTS = [
+  // JS
+  "registry.npmjs.org",
+  "registry.yarnpkg.com",
+  // Python
+  "pypi.org",
+  "files.pythonhosted.org",
+  // Go
+  "proxy.golang.org",
+  "sum.golang.org",
+  // Rust
+  "crates.io",
+  "static.crates.io",
+  "index.crates.io",
+  // Debian/Ubuntu
+  "deb.debian.org",
+  "security.debian.org",
+  "archive.ubuntu.com",
+  "security.ubuntu.com",
+  // Source + container hosts the above routinely redirect to
+  "github.com",
+  "codeload.github.com",
+  "objects.githubusercontent.com",
+  "raw.githubusercontent.com",
+  "ghcr.io"
+];
+function buildNetwork(args) {
+  const { services, mode, gatewayHosts, allowOut = [], allowRegistries = true } = args;
+  if (mode === "open") return {};
+  const domains = [
+    ...vendorHosts(services),
+    ...gatewayHosts,
+    ...dataPlaneHosts(services),
+    ...allowRegistries ? DEFAULT_REGISTRY_HOSTS : [],
+    ...allowOut
+  ].filter((h) => Boolean(h));
+  return {
+    // NOT networkBlockAll: that blocks everything including the gateway, and the
+    // allowlist is what Daytona documents as "unbypassable network-layer
+    // enforcement". Blocking all and then allowing is not a shape the API
+    // offers; a non-empty domainAllowList IS the deny-by-default.
+    domainAllowList: [...new Set(domains)].sort().join(",")
+  };
+}
+
+// src/trust.ts
+var CA_CERT_PATH = "/usr/local/share/ca-certificates/veris-ca.crt";
+var SYSTEM_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+var VERIS_CA_FILE = "/tmp/veris-ca.crt";
+var VERIS_BUNDLE = "/tmp/veris-ca-bundle.crt";
+function vendoredTrustEnv() {
+  return {
+    SSL_CERT_FILE: VERIS_BUNDLE,
+    REQUESTS_CA_BUNDLE: VERIS_BUNDLE,
+    CURL_CA_BUNDLE: VERIS_BUNDLE,
+    GIT_SSL_CAINFO: VERIS_BUNDLE,
+    AWS_CA_BUNDLE: VERIS_BUNDLE,
+    CARGO_HTTP_CAINFO: VERIS_BUNDLE,
+    DENO_CERT: VERIS_BUNDLE,
+    PIP_CERT: VERIS_BUNDLE,
+    npm_config_cafile: VERIS_BUNDLE,
+    GRPC_DEFAULT_SSL_ROOTS_FILE_PATH: VERIS_BUNDLE,
+    BUNDLE_SSL_CA_CERT: VERIS_BUNDLE,
+    COMPOSER_CAFILE: VERIS_BUNDLE,
+    HEX_CACERTS_PATH: VERIS_BUNDLE,
+    JULIA_SSL_CA_ROOTS_PATH: VERIS_BUNDLE,
+    NIX_SSL_CERT_FILE: VERIS_BUNDLE,
+    PERL_LWP_SSL_CA_FILE: VERIS_BUNDLE,
+    CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE: VERIS_BUNDLE,
+    NODE_EXTRA_CA_CERTS: VERIS_CA_FILE
+  };
+}
+var CA_INSTALL_CMD = [
+  "update-ca-certificates",
+  `(keytool -importcert -noprompt -cacerts -storepass changeit -alias veris -file ${CA_CERT_PATH} 2>/dev/null || true)`,
+  `(command -v certutil >/dev/null 2>&1 && for db in $(find /home /root -maxdepth 4 -name "cert9.db" 2>/dev/null | xargs -r -n1 dirname); do certutil -A -n veris -t "C,," -i ${CA_CERT_PATH} -d "sql:$db" 2>/dev/null || true; done || true)`
+].join(" && ");
+function sanitizeTrustEnv(served) {
+  const vendored = vendoredTrustEnv();
+  const out = { ...vendored };
+  for (const [k, val] of Object.entries(served ?? {})) {
+    if (!(k in vendored)) continue;
+    if (typeof val !== "string") continue;
+    if (!/^\/[\w./+~-]+$/.test(val)) continue;
+    out[k] = val;
+  }
+  return out;
+}
+
+// src/gateway.ts
+var HOSTNAME_RE = /^[A-Za-z0-9.-]+$/;
+var HOSTPORT_RE = /^[A-Za-z0-9.-]+:\d{1,5}$/;
+function shellQuote(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+var sh = (sandbox, cmd, timeoutSec = 60) => sandbox.process.executeCommand(`sh -lc ${shellQuote(cmd)}`, void 0, void 0, timeoutSec);
+function gatewayProxyUrl(credential) {
+  if (credential.http_proxy_url) return assertProxyUrl(credential.http_proxy_url);
+  if (!credential.connect_address || !HOSTPORT_RE.test(credential.connect_address)) {
+    throw new VerisError(
+      `the control plane returned a malformed gateway address: ${JSON.stringify(credential.connect_address)} (expected host:port)`,
+      { phase: "credential-mint" }
+    );
+  }
+  return `http://${encodeURIComponent(credential.username)}:x@${credential.connect_address}`;
+}
+function assertProxyUrl(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw new VerisError(
+      `the control plane returned an unparseable gateway proxy URL: ${JSON.stringify(raw)}`,
+      { phase: "credential-mint" }
+    );
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") {
+    throw new VerisError(
+      `the gateway proxy URL uses scheme "${u.protocol.replace(":", "")}", and Daytona accepts only http or https outbound proxies`,
+      { phase: "credential-mint" }
+    );
+  }
+  if (!u.hostname || !u.port) {
+    throw new VerisError(
+      `the gateway proxy URL is missing a host or port: ${JSON.stringify(raw)}`,
+      { phase: "credential-mint" }
+    );
+  }
+  return raw;
+}
+async function installCa(sandbox, caPem) {
+  await sandbox.fs.uploadFile(Buffer.from(caPem, "utf8"), VERIS_CA_FILE);
+  const script = [
+    `chmod 0644 ${VERIS_CA_FILE}`,
+    // Public roots first so they keep working; ours appended. `cat` of a
+    // missing file is tolerated — an image with no roots at all still gets a
+    // bundle containing the one CA that matters here.
+    `{ cat ${SYSTEM_BUNDLE} 2>/dev/null; cat ${VERIS_CA_FILE}; } > ${VERIS_BUNDLE}`,
+    `chmod 0644 ${VERIS_BUNDLE}`,
+    // Best-effort, for the stacks that read a store rather than a variable:
+    // the system bundle, the JVM truststore, and NSS databases. All of it needs
+    // root and tooling that may not be there, so none of it is load-bearing —
+    // but a Java client honours no CA env var at all, so where we CAN do it,
+    // we should.
+    `SUDO=; [ "$(id -u)" = 0 ] || SUDO="sudo -n"`,
+    `($SUDO install -m 0644 -D ${VERIS_CA_FILE} ${CA_CERT_PATH} 2>/dev/null && $SUDO sh -c ${shellQuote(CA_INSTALL_CMD)} 2>/dev/null) || true`,
+    // The bundle is the load-bearing one: fail loudly if it is not there.
+    `[ -s ${VERIS_BUNDLE} ] && echo __VERIS_CA_OK__`
+  ].join("; ");
+  const r = await sh(sandbox, script, 120).catch((e) => ({ exitCode: 1, result: String(e) }));
+  if (!(r.result ?? "").includes("__VERIS_CA_OK__")) {
+    throw new SnapshotUnsupportedError(
+      `could not assemble a CA bundle at ${VERIS_BUNDLE}, so the gateway's certificates cannot be trusted (${(r.result ?? "").trim().slice(0, 200)})`,
+      { phase: "ca-install" }
+    );
+  }
+}
+async function probeCanary(sandbox, canaryHost, expectedTwinId) {
+  if (!HOSTNAME_RE.test(canaryHost)) {
+    throw new ReceiptIntegrityError(
+      `refusing to probe a malformed canary host from the control plane: ${JSON.stringify(canaryHost)}`,
+      { phase: "canary", verisSandboxId: expectedTwinId }
+    );
+  }
+  const r = await sh(
+    sandbox,
+    `curl -sS --cacert ${VERIS_BUNDLE} --max-time 20 https://${canaryHost}/ || echo __VERIS_CANARY_FAIL__`,
+    45
+  ).catch((e) => ({ exitCode: 1, result: String(e) }));
+  let body = {};
+  try {
+    body = JSON.parse(r.result ?? "");
+  } catch {
+  }
+  if (body.veris_sandbox_id !== expectedTwinId) {
+    throw new ReceiptIntegrityError(
+      `canary probe failed: egress from this Daytona sandbox is not tunnelled through the Veris gateway (expected twin ${expectedTwinId}, canary answered: ${(r.result || "nothing").trim().slice(0, 200)})`,
+      { phase: "canary", verisSandboxId: expectedTwinId }
+    );
+  }
+}
+
+// src/veris-api.ts
+var VerisApiImpl = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  get sandboxId() {
+    return this.ctx.twinId;
+  }
+  get mode() {
+    return "gateway";
+  }
+  services() {
+    return this.ctx.controlPlane.services(this.ctx.twinId);
+  }
+  async receipt(service) {
+    await probeCanary(this.ctx.sandbox, this.ctx.canaryHost, this.ctx.twinId);
+    const services = await this.services();
+    if (service !== void 0) {
+      const svc = services.find((s) => s.name === service);
+      if (!svc) {
+        throw new VerisError(
+          `unknown service '${service}' \u2014 the twin has no service by that name (available: ${services.map((s) => s.name).join(", ") || "none"})`,
+          { verisSandboxId: this.ctx.twinId }
+        );
+      }
+      return fetchReceiptEntry(svc);
+    }
+    const entries = await Promise.all(
+      services.filter((s) => isHttpUrl(s.control_url)).map(async (svc) => [svc.name, await fetchReceiptEntry(svc)])
+    );
+    return {
+      services: Object.fromEntries(entries),
+      mode: "gateway",
+      integrity: "verified",
+      leaks: this.leaks()
+    };
+  }
+  /**
+   * What this receipt cannot see. The gateway relays TCP, so QUIC/HTTP3 and ECH
+   * ride around it — named rather than rounded off.
+   */
+  leaks() {
+    return ["udp-quic-possible", "ech-possible"];
+  }
+  async assertTouched(service, match) {
+    const entry = await this.receipt(service);
+    const need = match?.minRequests ?? 1;
+    const matched = match ? entry.entries.filter((r) => (match.method === void 0 || r.method.toUpperCase() === match.method.toUpperCase()) && (match.path === void 0 || r.path.includes(match.path))) : entry.entries;
+    if (matched.length < need) {
+      const what = match ? `matching ${match.method ?? "ANY"} ${match.path ?? "*"} (${matched.length}/${need})` : "any intercepted requests";
+      throw new VerisUntouchedError(
+        `service '${service}' saw no ${what} \u2014 the code under test never reached it (a green run that skipped its dependency looks identical to a working one)`,
+        service,
+        { verisSandboxId: this.ctx.twinId }
+      );
+    }
+  }
+  async getDataPlaneEnv() {
+    return dataPlaneEnv(await this.services());
+  }
+  /** The CA trust vars injected at create, for callers building their own env. */
+  getTrustEnv() {
+    return vendoredTrustEnv();
+  }
+  async deliverTo(target, opts = {}) {
+    const url = typeof target === "number" ? (await this.ctx.sandbox.getPreviewLink(target)).url : target;
+    await this.ctx.controlPlane.updateSandbox(
+      this.ctx.environmentId,
+      this.ctx.twinId,
+      { client_base_url: url }
+    );
+    if (url !== null && opts.probe !== false) await this.probeDelivery(url);
+    return url;
+  }
+  /** Ask each service to re-probe the registered destination; throw if none can reach it. */
+  async probeDelivery(url) {
+    const services = (await this.services()).filter((s) => isHttpUrl(s.control_url));
+    if (!services.length) return;
+    const probes = await Promise.all(services.map(async (svc) => {
+      try {
+        const res = await fetch(`${svc.control_url}/veris/client/probe`, { method: "POST" });
+        return res.ok ? await res.json() : null;
+      } catch {
+        return null;
+      }
+    }));
+    if (!probes.some((p) => p?.answered)) {
+      throw new VerisError(
+        `no service could reach ${url} \u2014 is your app listening on that port inside the Daytona sandbox?`,
+        { phase: "receipt", verisSandboxId: this.ctx.twinId, responseBody: probes }
+      );
+    }
+  }
+};
+
+// src/version.ts
+var SDK_VERSION = true ? "0.1.0" : "0.0.0-dev";
+
+// src/daytona.ts
+var LABEL = {
+  twinId: "veris_twin_id",
+  envId: "veris_env_id",
+  apiBase: "veris_api_base",
+  mode: "veris_mode",
+  egress: "veris_egress",
+  ownsTwin: "veris_owns_twin",
+  canaryHost: "veris_canary_host"
+};
+var VERIS_LABEL_KEYS = Object.values(LABEL);
+function isVerisSandbox(sbx) {
+  return typeof sbx.verisSandboxId === "string";
+}
+var Daytona = class extends BaseDaytona {
+  verisDefaults;
+  constructor(config) {
+    super(config);
+    this.verisDefaults = config?.veris ?? {};
+  }
+  async create(params, options) {
+    const v = { ...this.verisDefaults, ...params?.veris ?? {} };
+    const rest = stripVeris(params);
+    if (v.disabled) return this.baseCreate(rest, options);
+    const coords = resolveCoordinates(v);
+    const controlPlane = new ControlPlane({
+      apiKey: coords.apiKey,
+      apiBase: coords.apiBase,
+      sdkVersion: SDK_VERSION
+    });
+    const egress = v.egress ?? "strict";
+    const ttlMinutes = v.ttlMinutes ?? 60;
+    const ownsTwin = !v.attachSandboxId;
+    const twin = await this.provisionTwin(controlPlane, v, coords, ttlMinutes);
+    const cleanupTwin = async () => {
+      if (ownsTwin) await controlPlane.deleteTwin(twin.environment_id, twin.id).catch(() => {
+      });
+    };
+    let sandbox;
+    let credential;
+    try {
+      credential = await controlPlane.mintEgressCredential(twin.environment_id, twin.id);
+      if (!credential) {
+        throw new VerisGatewayNotOfferedError(
+          "this Veris control plane does not offer egress credentials, so there is no gateway for the sandbox to route through",
+          { phase: "credential-mint", verisSandboxId: twin.id }
+        );
+      }
+      if (!credential.connect_address && !credential.http_proxy_url) {
+        throw new VerisGatewayNotOfferedError(
+          'the Veris gateway offers SOCKS5 but no HTTP CONNECT endpoint, and Daytona accepts only http/https outbound proxies ("Unsupported outbound proxy scheme"). Upgrade the control plane to one that returns connect_address.',
+          { phase: "credential-mint", verisSandboxId: twin.id }
+        );
+      }
+      const services = twin.services?.length ? twin.services : await controlPlane.services(twin.id);
+      const proxyUrl = gatewayProxyUrl(credential);
+      const network = buildNetwork({
+        services,
+        mode: egress,
+        // The gateway has to be reachable or nothing is: taken from the URL we
+        // are actually going to use, so the two can never disagree.
+        gatewayHosts: [new URL(proxyUrl).hostname, credential.canary_host].filter(Boolean),
+        allowOut: v.allowOut,
+        allowRegistries: v.allowRegistries
+      });
+      const verisManaged = {
+        ...v.installCa !== false ? sanitizeTrustEnv(void 0) : {},
+        ...v.dataPlaneEnv !== false ? dataPlaneEnv(services) : {},
+        VERIS_SANDBOX_ID: twin.id
+      };
+      const createParams = {
+        ...rest,
+        envVars: { ...rest.envVars ?? {}, ...verisManaged },
+        labels: {
+          ...reserveLabels(rest.labels),
+          [LABEL.twinId]: twin.id,
+          [LABEL.envId]: twin.environment_id,
+          [LABEL.apiBase]: coords.apiBase,
+          [LABEL.egress]: egress,
+          [LABEL.ownsTwin]: String(ownsTwin),
+          [LABEL.mode]: "gateway",
+          [LABEL.canaryHost]: credential.canary_host
+        },
+        ...network,
+        // 3. Where Daytona forwards everything the allowlist permits. Chained,
+        //    not advisory: an unreachable gateway makes allowed traffic 502
+        //    rather than quietly going direct.
+        outboundProxyUrl: proxyUrl,
+        ttlMinutes: rest.ttlMinutes ?? ttlMinutes
+      };
+      sandbox = await this.baseCreate(createParams, options);
+    } catch (cause) {
+      await cleanupTwin();
+      if (cause instanceof VerisError) throw cause;
+      throw new VerisError("Daytona sandbox create failed", {
+        phase: "sandbox-create",
+        verisSandboxId: twin.id,
+        cause
+      });
+    }
+    try {
+      await installCa(sandbox, credential.ca_pem);
+      await probeCanary(sandbox, credential.canary_host, twin.id);
+    } catch (err) {
+      await sandbox.delete().catch(() => {
+      });
+      await cleanupTwin();
+      throw err;
+    }
+    return this.attach(sandbox, {
+      controlPlane,
+      environmentId: twin.environment_id,
+      twinId: twin.id,
+      egress,
+      ownsTwin,
+      canaryHost: credential.canary_host
+    });
+  }
+  /**
+   * Rehydrate the Veris surface on an existing sandbox.
+   *
+   * Not an optimisation — a necessity. The OpenCode plugin reconnects to a
+   * sandbox with get() on every resumed session and deletes through get() too,
+   * so a get() that returned a bare Sandbox would mean no receipts after any
+   * restart and a leaked twin on every delete.
+   */
+  async get(sandboxIdOrName) {
+    const sandbox = await super.get(sandboxIdOrName);
+    return this.rehydrate(sandbox);
+  }
+  /** Same rehydration for the sandboxes a list() streams. */
+  list(query) {
+    const inner = super.list(query);
+    const rehydrate = (s) => this.rehydrate(s);
+    return (async function* () {
+      for await (const sandbox of inner) yield rehydrate(sandbox);
+    })();
+  }
+  /**
+   * Attach the Veris surface to a sandbox whose labels say it has a twin.
+   * A sandbox without our labels is passed through untouched — callers can use
+   * this client for ordinary Daytona work.
+   */
+  rehydrate(sandbox) {
+    const labels = sandbox.labels ?? {};
+    const twinId = labels[LABEL.twinId];
+    if (!twinId) return sandbox;
+    const apiKey = this.verisDefaults.apiKey ?? process.env.VERIS_API_KEY;
+    if (!apiKey) return sandbox;
+    const trustedBase = this.verisDefaults.apiBase ?? process.env.VERIS_API_BASE;
+    const labelBase = labels[LABEL.apiBase];
+    if (trustedBase && labelBase && labelBase !== trustedBase) {
+      throw new VerisError(
+        `sandbox ${sandbox.id} labels name a different Veris control plane (${labelBase}) than your configuration (${trustedBase}) \u2014 refusing to send the API key to an unverified host`,
+        { phase: "attach" }
+      );
+    }
+    const apiBase = trustedBase ?? labelBase ?? "https://svc.api.veris.ai";
+    return this.attach(sandbox, {
+      controlPlane: new ControlPlane({ apiKey, apiBase, sdkVersion: SDK_VERSION }),
+      environmentId: labels[LABEL.envId] ?? "",
+      twinId,
+      // Re-minted below when a receipt is actually asked for; the label only
+      // has to survive the reconnect.
+      canaryHost: labels[LABEL.canaryHost] ?? "",
+      egress: labels[LABEL.egress] ?? "strict",
+      ownsTwin: labels[LABEL.ownsTwin] !== "false"
+    });
+  }
+  async provisionTwin(controlPlane, v, coords, ttlMinutes) {
+    if (v.attachSandboxId) {
+      const existing = await controlPlane.getTwin(v.attachSandboxId);
+      if (!existing) {
+        throw new VerisError(`attach target ${v.attachSandboxId} not found`, {
+          phase: "twin-provision",
+          verisSandboxId: v.attachSandboxId
+        });
+      }
+      return existing.status === "ready" ? existing : controlPlane.waitReady(v.attachSandboxId, 24e4);
+    }
+    if (!coords.environmentId) {
+      throw new MissingCredentialsError(
+        "no Veris environment: set VERIS_ENVIRONMENT_ID, or pass veris.environmentId",
+        { phase: "credentials" }
+      );
+    }
+    const created = await controlPlane.createTwin(coords.environmentId, { ttlMinutes });
+    try {
+      return await controlPlane.waitReady(created.id, 24e4);
+    } catch (e) {
+      await controlPlane.deleteTwin(coords.environmentId, created.id).catch(() => {
+      });
+      throw e;
+    }
+  }
+  /**
+   * Hang the Veris surface off the instance, and wrap delete() so teardown is
+   * automatic.
+   *
+   * Wrapping rather than asking callers to remember is the point: the OpenCode
+   * plugin's existing `sandbox.delete()` then removes the twin too, with no
+   * change to the plugin at all. A twin outlives its sandbox otherwise, until
+   * its TTL reaps it — invisible until the bill arrives.
+   */
+  attach(sandbox, ctx) {
+    if (isVerisSandbox(sandbox)) return sandbox;
+    const veris = new VerisApiImpl({ ...ctx, sandbox });
+    const originalDelete = sandbox.delete.bind(sandbox);
+    Object.defineProperties(sandbox, {
+      veris: { value: veris, enumerable: true, configurable: true },
+      verisSandboxId: { value: ctx.twinId, enumerable: true, configurable: true },
+      delete: {
+        configurable: true,
+        value: async (timeout, wait) => {
+          if (ctx.ownsTwin) {
+            await ctx.controlPlane.deleteTwin(ctx.environmentId, ctx.twinId).catch(() => {
+            });
+          }
+          return originalDelete(timeout, wait);
+        }
+      }
+    });
+    return sandbox;
+  }
+  /** super.create through the overload the params actually match. */
+  baseCreate(params, options) {
+    return super.create.call(this, params, options);
+  }
+};
+var daytona_default = Daytona;
+function resolveCoordinates(v) {
+  const apiKey = v.apiKey ?? process.env.VERIS_API_KEY;
+  if (!apiKey) {
+    throw new MissingCredentialsError(
+      "no Veris API key: set VERIS_API_KEY in your environment, or pass veris.apiKey. Get one at https://studio.veris.ai",
+      { phase: "credentials" }
+    );
+  }
+  return {
+    apiKey,
+    environmentId: v.environmentId ?? process.env.VERIS_ENVIRONMENT_ID,
+    apiBase: (v.apiBase ?? process.env.VERIS_API_BASE ?? "https://svc.api.veris.ai").replace(/\/$/, "")
+  };
+}
+function stripVeris(params) {
+  const { veris: _veris, ...rest } = params ?? {};
+  return rest;
+}
+function reserveLabels(labels) {
+  const out = {};
+  for (const [k, val] of Object.entries(labels ?? {})) {
+    if (!VERIS_LABEL_KEYS.includes(k)) out[k] = val;
+  }
+  return out;
+}
+export {
+  CA_CERT_PATH,
+  ControlPlane,
+  DEFAULT_REGISTRY_HOSTS,
+  Daytona,
+  MissingCredentialsError,
+  ReceiptIntegrityError,
+  SDK_VERSION,
+  SYSTEM_BUNDLE,
+  SnapshotUnsupportedError,
+  TwinExpiredError,
+  UnsupportedOperationError,
+  VERIS_BUNDLE,
+  VERIS_CA_FILE,
+  VerisError,
+  VerisGatewayNotOfferedError,
+  VerisGatewayUnreachableError,
+  VerisUntouchedError,
+  dataPlaneHosts,
+  daytona_default as default,
+  gatewayProxyUrl,
+  isVerisSandbox,
+  twinHosts,
+  vendorHosts,
+  vendoredTrustEnv
+};
+//# sourceMappingURL=index.js.map