@veris-ai/daytona 0.2.0 → 0.3.0

package/dist/index.cjs

@@ -21,11 +21,16 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  BUNDLED_CA_FILES: () => BUNDLED_CA_FILES,
+  BUNDLED_CA_PATCH_SCRIPT: () => BUNDLED_CA_PATCH_SCRIPT,
   CA_CERT_PATH: () => CA_CERT_PATH,
   ControlPlane: () => ControlPlane,
-  DEFAULT_REGISTRY_HOSTS: () => DEFAULT_REGISTRY_HOSTS,
+  DAYTONA_API_URL: () => DAYTONA_API_URL,
+  DEFAULT_API_BASE: () => DEFAULT_API_BASE,
+  DELETE_SANDBOXES: () => DELETE_SANDBOXES,
   Daytona: () => Daytona,
   MissingCredentialsError: () => MissingCredentialsError,
+  NODE_TRUST_FLAG: () => NODE_TRUST_FLAG,
   ReceiptIntegrityError: () => ReceiptIntegrityError,
   SDK_VERSION: () => SDK_VERSION,
   SYSTEM_BUNDLE: () => SYSTEM_BUNDLE,
@@ -39,14 +44,33 @@ __export(index_exports, {
   VerisGatewayUnreachableError: () => VerisGatewayUnreachableError,
   VerisUntouchedError: () => VerisUntouchedError,
   assertHttpControlPlane: () => assertHttpControlPlane,
+  buildNetwork: () => buildNetwork,
+  canDeleteSandboxes: () => canDeleteSandboxes,
+  cannotTeardownWarning: () => cannotTeardownWarning,
   dataPlaneHosts: () => dataPlaneHosts,
+  daytonaApiUrl: () => daytonaApiUrl,
   default: () => daytona_default,
+  directTwinHosts: () => directTwinHosts,
+  fetchDaytonaKey: () => fetchDaytonaKey,
   fetchManual: () => fetchManual,
+  gatewayIps: () => gatewayIps,
   gatewayProxyUrl: () => gatewayProxyUrl,
+  isPermissionDenied: () => isPermissionDenied,
   isVerisSandbox: () => isVerisSandbox,
+  missingKeyMessage: () => missingKeyMessage,
+  nodeOptionsWithTrust: () => nodeOptionsWithTrust,
+  patchBundledCas: () => patchBundledCas,
+  profilePath: () => profilePath,
+  requireVerisCredentials: () => requireVerisCredentials,
+  resolveVerisCredentials: () => resolveVerisCredentials,
+  sandboxBrakes: () => sandboxBrakes,
+  teardownRefusedMessage: () => teardownRefusedMessage,
+  trustPrelude: () => trustPrelude,
   twinHosts: () => twinHosts,
   vendorHosts: () => vendorHosts,
-  vendoredTrustEnv: () => vendoredTrustEnv
+  vendoredTrustEnv: () => vendoredTrustEnv,
+  verisOwnsTwin: () => verisOwnsTwin,
+  verisTwinId: () => verisTwinId
 });
 module.exports = __toCommonJS(index_exports);
 __reExport(index_exports, require("@daytona/sdk"), module.exports);
@@ -224,14 +248,19 @@ var ControlPlane = class {
     }
     if (!res.ok) await this.json(res, `update sandbox ${sandboxId}`);
   }
-  /** Extend a twin's TTL so it stays in lockstep with an extended Daytona sandbox. */
-  async extendTtl(environmentId, sandboxId, ttlMinutes) {
-    const res = await this.request("PATCH", `/v1/environments/${environmentId}/sandboxes/${sandboxId}`, { ttl_minutes: ttlMinutes });
-    if (res.status === 404) {
-      throw new TwinExpiredError(`Veris sandbox ${sandboxId} not found \u2014 cannot extend TTL`, { verisSandboxId: sandboxId });
-    }
-    if (!res.ok && res.status !== 405) await this.json(res, `extend TTL of ${sandboxId}`);
-  }
+  // There was an extendTtl() here, and it did nothing.
+  //
+  // It PATCHed { ttl_minutes } at the sandbox resource, and the server's
+  // UpdateSandboxRequest declares only client_base_url. Pydantic ignores
+  // unknown fields, so the route answered 200 having changed no TTL at all —
+  // a call that reports success while doing nothing, which is worse than no
+  // call, because the caller then believes the twin will outlive the run.
+  // Nothing here called it; it was API surface promising a thing that could
+  // not happen.
+  //
+  // Bring it back when a route exists to carry it. Until then a twin's TTL is
+  // decided once, by ttl_minutes at create — where this SDK already keeps it
+  // in step with the Daytona sandbox's own ttlMinutes.
   /** Create-time preflight: is the gateway infrastructure up, per the control plane? */
   async gatewayHealth() {
     const res = await this.request("GET", "/v1/gateway/health");
@@ -245,40 +274,162 @@ var ControlPlane = class {
   }
 };
 
+// src/run-receipt.ts
+var import_node_crypto = require("crypto");
+
 // src/receipt.ts
+var PAGE_LIMIT = 1e3;
+var MAX_PAGES = 20;
+function rowsOf(body) {
+  if (!body || !Array.isArray(body.requests)) {
+    throw new VerisError("invalid request log: expected requests array", { phase: "receipt" });
+  }
+  const rows = body.requests;
+  for (const r of rows) {
+    if (!r || !Number.isSafeInteger(r.id) || r.id <= 0 || typeof r.method !== "string" || typeof r.path !== "string" || typeof r.tier !== "string" || !(r.status === null || typeof r.status === "number")) {
+      throw new VerisError("invalid request log row: stable id, method, path, tier and status required", { phase: "receipt" });
+    }
+  }
+  return rows;
+}
 function parseRequestsBody(body) {
-  const rows = Array.isArray(body?.requests) ? body.requests : [];
-  const entries = rows.map((r) => {
-    const row = r;
-    return {
-      method: String(row.method ?? ""),
-      path: String(row.path ?? ""),
-      status: typeof row.status === "number" ? row.status : null
-    };
-  });
-  return { count: entries.length, entries };
+  const rows = rowsOf(body);
+  const entries = rows.filter(
+    (r) => ["handler", "fault", "fallback", "fallback-llm", "fallback-replay"].includes(r.tier) && !/^\/veris(?:\/|$)/.test(r.path)
+  ).map(({ id, method, path, status, tier }) => ({ id, method, path, status, tier }));
+  return { count: entries.length, entries, total: rows.length };
 }
-async function fetchReceiptEntry(svc) {
-  const url = `${svc.control_url}/veris/requests`;
-  const res = await fetch(url);
+async function readPage(svc, query) {
+  const res = await fetch(`${svc.control_url.replace(/\/$/, "")}/veris/requests?${query}`, {
+    signal: AbortSignal.timeout(3e4),
+    redirect: "error"
+  });
   const text = await res.text();
-  if (!res.ok) {
-    throw new VerisError(`could not read receipt for service '${svc.name}' (${res.status})`, {
-      phase: "receipt",
-      responseBody: text.slice(0, 500)
-    });
+  if (!res.ok) throw new VerisError(`could not read receipt for service '${svc.name}' (${res.status})`, { phase: "receipt" });
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    throw new VerisError(`service '${svc.name}' returned a non-JSON receipt body`, { phase: "receipt" });
   }
-  let raw;
+  return rowsOf(body);
+}
+async function fetchWatermark(svc) {
+  const rows = await readPage(svc, new URLSearchParams({ limit: "1", order: "desc" }));
+  if (rows.length > 1) throw new VerisError("request log ignored watermark limit", { phase: "receipt" });
+  return rows[0]?.id ?? 0;
+}
+async function fetchReceiptEntry(svc, sinceId = 0) {
+  if (!Number.isSafeInteger(sinceId) || sinceId < 0) throw new VerisError("invalid receipt watermark", { phase: "receipt" });
+  const end = await fetchWatermark(svc);
+  if (end < sinceId) throw new VerisError("receipt baseline invalid: log moved backwards; take a new baseline", { phase: "receipt" });
+  const entries = [];
+  const raw = [];
+  let mark = sinceId;
+  let incompleteReason;
+  for (let page = 0; mark < end; page++) {
+    if (page >= MAX_PAGES) {
+      incompleteReason = "page-limit";
+      break;
+    }
+    let rows;
+    try {
+      rows = await readPage(svc, new URLSearchParams({ limit: String(PAGE_LIMIT), order: "asc", since_id: String(mark) }));
+    } catch (error) {
+      if (!raw.length) throw error;
+      incompleteReason = "read-failed";
+      break;
+    }
+    let previous = mark;
+    if (!rows.length || rows.some((r) => {
+      const bad = r.id <= previous;
+      previous = r.id;
+      return bad;
+    })) {
+      incompleteReason = "pagination-not-progressing";
+      break;
+    }
+    const window = rows.filter((r) => r.id <= end);
+    raw.push(...window);
+    entries.push(...parseRequestsBody({ requests: window }).entries);
+    mark = rows[rows.length - 1].id;
+  }
+  entries.sort((a, b) => b.id - a.id);
+  return {
+    requests: entries.length,
+    controlUrl: svc.control_url,
+    entries,
+    sinceId,
+    untilId: end,
+    capped: Boolean(incompleteReason),
+    ...incompleteReason ? { incompleteReason } : {},
+    raw: { requests: raw }
+  };
+}
+
+// src/run-receipt.ts
+var HEADER = "x-veris-receipt-baseline";
+function markerOf(row) {
   try {
-    raw = JSON.parse(text);
+    const headers = typeof row.request_headers === "string" ? JSON.parse(row.request_headers) : row.request_headers;
+    return headers?.[HEADER];
   } catch {
-    throw new VerisError(`service '${svc.name}' returned a non-JSON receipt body`, {
-      phase: "receipt",
-      responseBody: text.slice(0, 500)
+    return void 0;
+  }
+}
+async function captureBaseline(twinId, sandboxId, services) {
+  const marks = await Promise.all(services.map(async (svc) => {
+    const marker = (0, import_node_crypto.randomUUID)();
+    const res = await fetch(`${svc.control_url.replace(/\/$/, "")}/veris/schema`, {
+      headers: { [HEADER]: marker },
+      signal: AbortSignal.timeout(3e4),
+      redirect: "error"
     });
+    await res.text();
+    if (!res.ok) throw new VerisError(`could not establish baseline for '${svc.name}' (${res.status})`, { phase: "receipt" });
+    for (let attempt = 0; attempt < 5; attempt++) {
+      const rows = await readPage(svc, new URLSearchParams({ limit: "1000", order: "desc" }));
+      const anchor = rows.find((r) => markerOf(r) === marker && r.tier === "control" && r.path === "/veris/schema");
+      if (anchor) return [svc.name, { controlUrl: svc.control_url, id: anchor.id, marker }];
+      await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+    throw new VerisError(`baseline unavailable for '${svc.name}': trace must retain control request headers`, { phase: "receipt" });
+  }));
+  return { version: 1, twinId, sandboxId, services: Object.fromEntries(marks) };
+}
+async function validateBaseline(baseline, twinId, sandboxId, services) {
+  const invalid = () => new VerisError("receipt baseline invalid: session, services or history changed; take a new baseline before execution", { phase: "receipt" });
+  if (baseline.version !== 1 || baseline.twinId !== twinId || baseline.sandboxId !== sandboxId || Object.keys(baseline.services).sort().join("\0") !== services.map((s) => s.name).sort().join("\0")) throw invalid();
+  await Promise.all(services.map(async (svc) => {
+    const mark = baseline.services[svc.name];
+    if (!mark || mark.controlUrl !== svc.control_url || !Number.isSafeInteger(mark.id) || mark.id <= 0) throw invalid();
+    const rows = await readPage(svc, new URLSearchParams({ limit: "1", order: "asc", since_id: String(mark.id - 1) }));
+    if (rows.length !== 1 || rows[0].id !== mark.id || markerOf(rows[0]) !== mark.marker) throw invalid();
+  }));
+}
+
+// src/service-control.ts
+async function serviceControl(svc, resource, options = {}) {
+  const method = options.method ?? "GET";
+  if (!["manual", "schema", "operations", "data", "requests"].includes(resource) || !["GET", "POST", "PATCH"].includes(method) || method !== "GET" && resource !== "data" || method === "GET" && options.body !== void 0 || !/^https?:\/\//.test(svc.control_url)) {
+    throw new VerisError("unsupported service control operation");
+  }
+  const url = new URL(`${svc.control_url.replace(/\/$/, "")}/veris/${resource}`);
+  for (const [key, value] of Object.entries(options.query ?? {})) url.searchParams.set(key, value);
+  const res = await fetch(url, {
+    method,
+    redirect: "error",
+    signal: AbortSignal.timeout(3e4),
+    headers: { "Content-Type": "application/json" },
+    body: options.body === void 0 ? void 0 : JSON.stringify(options.body)
+  });
+  const text = await res.text();
+  if (!res.ok) throw new VerisError(`service '${svc.name}' ${method} /veris/${resource} failed (${res.status})`);
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new VerisError(`service '${svc.name}' returned invalid control JSON`);
   }
-  const { count, entries } = parseRequestsBody(raw);
-  return { requests: count, controlUrl: svc.control_url, entries, raw };
 }
 
 // src/network.ts
@@ -303,6 +454,9 @@ function twinHosts(services) {
   }
   return [...hosts].sort();
 }
+function directTwinHosts(services) {
+  return twinHosts(services.filter((s) => isHttpUrl(s.url) && !(s.routes ?? []).length));
+}
 function dataPlaneHosts(services) {
   const hosts = /* @__PURE__ */ new Set();
   for (const svc of services) {
@@ -352,51 +506,30 @@ var PROCESS_CONTROLLING = /* @__PURE__ */ new Set([
 function isSafeEnvName(name) {
   return /^[A-Z][A-Z0-9_]{0,63}$/.test(name) && !PROCESS_CONTROLLING.has(name);
 }
-var DEFAULT_REGISTRY_HOSTS = [
-  // JS
-  "registry.npmjs.org",
-  "registry.yarnpkg.com",
-  // Python
-  "pypi.org",
-  "files.pythonhosted.org",
-  // Go
-  "proxy.golang.org",
-  "sum.golang.org",
-  // Rust
-  "crates.io",
-  "static.crates.io",
-  "index.crates.io",
-  // Debian/Ubuntu
-  "deb.debian.org",
-  "security.debian.org",
-  "archive.ubuntu.com",
-  "security.ubuntu.com",
-  // Source + container hosts the above routinely redirect to
-  "github.com",
-  "codeload.github.com",
-  "objects.githubusercontent.com",
-  "raw.githubusercontent.com",
-  "ghcr.io"
-];
+var IPV4_RE = /^(25[0-5]|2[0-4]\d|1?\d?\d)(\.(25[0-5]|2[0-4]\d|1?\d?\d)){3}$/;
 function buildNetwork(args) {
-  const { services, mode, gatewayHosts, allowOut = [], allowRegistries = true } = args;
-  if (mode === "open") return {};
-  const domains = [
-    ...vendorHosts(services),
-    ...gatewayHosts,
-    ...dataPlaneHosts(services),
-    ...allowRegistries ? DEFAULT_REGISTRY_HOSTS : [],
-    ...allowOut
-  ].filter((h) => Boolean(h));
-  return {
-    // NOT networkBlockAll: that blocks everything including the gateway, and the
-    // allowlist is what Daytona documents as "unbypassable network-layer
-    // enforcement". Blocking all and then allowing is not a shape the API
-    // offers; a non-empty domainAllowList IS the deny-by-default.
-    domainAllowList: [...new Set(domains)].sort().join(",")
-  };
+  const { mode, gatewayIps: gatewayIps2 } = args;
+  if (mode === "open") return { params: {} };
+  const ips = [...new Set(gatewayIps2)];
+  if (!ips.length) {
+    throw new VerisError(
+      "the control plane did not name the gateway's IP addresses (egress credential `gateway_ips`) and the gateway hostname could not be resolved, so the sandbox cannot be pinned to it. Upgrade the control plane, or run with veris.egress: 'open' (Daytona still blocks anything that bypasses the proxy).",
+      { phase: "credential-mint" }
+    );
+  }
+  const bad = ips.filter((ip) => !IPV4_RE.test(ip));
+  if (bad.length) {
+    throw new VerisError(
+      `the control plane returned gateway addresses that are not IPv4: ${JSON.stringify(bad)} (Daytona's networkAllowList takes IPv4 CIDRs only)`,
+      { phase: "credential-mint" }
+    );
+  }
+  return { params: { networkAllowList: ips.map((ip) => `${ip}/32`).join(",") } };
 }
 
+// src/gateway.ts
+var import_node_dns = require("dns");
+
 // src/trust.ts
 var CA_CERT_PATH = "/usr/local/share/ca-certificates/veris-ca.crt";
 var SYSTEM_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
@@ -421,9 +554,54 @@ function vendoredTrustEnv() {
     NIX_SSL_CERT_FILE: VERIS_BUNDLE,
     PERL_LWP_SSL_CA_FILE: VERIS_BUNDLE,
     CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE: VERIS_BUNDLE,
-    NODE_EXTRA_CA_CERTS: VERIS_CA_FILE
+    NODE_EXTRA_CA_CERTS: VERIS_BUNDLE
   };
 }
+function trustPrelude(env = vendoredTrustEnv()) {
+  return Object.entries(env).map(([k, v]) => `export ${k}='${v.replace(/'/g, `'\\''`)}';`).join(" ");
+}
+var BUNDLED_CA_FILES = [
+  { sdk: "pip (vendored certifi)", suffix: "pip/_vendor/certifi/cacert.pem" },
+  { sdk: "certifi", suffix: "certifi/cacert.pem" },
+  { sdk: "botocore", suffix: "botocore/cacert.pem" },
+  // Matches both stripe-python's site-packages layout and the stripe-ruby gem.
+  { sdk: "stripe", suffix: "stripe/data/ca-certificates.crt" },
+  { sdk: "httplib2", suffix: "httplib2/cacerts.txt" }
+];
+var BUNDLED_CA_PATCH_SCRIPT = "/tmp/veris-patch-bundled-cas.sh";
+var BUNDLED_CA_PATCHED_MARKER = "the Veris CA was appended to ";
+function bundledCaPatchScript() {
+  const find = BUNDLED_CA_FILES.map((f) => `find / -xdev \\( -path /proc -o -path /sys -o -path /dev \\) -prune -o -path '*/${f.suffix}' -type f -print 2>/dev/null`).join("; ");
+  return [
+    `marker=$(sed -n 2p ${VERIS_CA_FILE} 2>/dev/null)`,
+    // No CA on disk means nothing to append, and appending nothing to every
+    // bundle in the image would be the worst available no-op.
+    `[ -n "$marker" ] || { echo "no ${VERIS_CA_FILE} to append" >&2; exit 1; }`,
+    // The whole loop is one brace group at the end of the pipe so `n` survives
+    // to the summary: a pipeline's last stage is a subshell, and a counter
+    // incremented inside a bare `while` would be gone by the time we report it.
+    `{ ${find}; } | sort -u | { n=0`,
+    `while IFS= read -r f; do`,
+    `  [ -w "$f" ] || continue`,
+    `  grep -qF "$marker" "$f" && continue`,
+    `  { printf '\\n'; cat ${VERIS_CA_FILE}; } >> "$f" || continue`,
+    `  n=$((n+1))`,
+    `  echo "${BUNDLED_CA_PATCHED_MARKER}$f"`,
+    `done`,
+    // Silence is the common case and it reads as "did that even run?", so say
+    // so. patchBundledCas() keeps only the lines above, so this costs it
+    // nothing.
+    `if [ "$n" -gt 0 ]; then echo "$n bundled CA file(s) patched"`,
+    `else echo "no bundled CA file needed patching \u2014 no SDK that ships its own is installed here, or they already trust the Veris CA"; fi`,
+    `}`
+  ].join("\n");
+}
+var NODE_TRUST_FLAG = "--use-openssl-ca";
+function nodeOptionsWithTrust(existing) {
+  const base = (existing ?? "").trim();
+  if (base.split(/\s+/).includes(NODE_TRUST_FLAG)) return base;
+  return base ? `${base} ${NODE_TRUST_FLAG}` : NODE_TRUST_FLAG;
+}
 var CA_INSTALL_CMD = [
   "update-ca-certificates",
   `(keytool -importcert -noprompt -cacerts -storepass changeit -alias veris -file ${CA_CERT_PATH} 2>/dev/null || true)`,
@@ -458,6 +636,16 @@ function gatewayProxyUrl(credential) {
   }
   return `http://${encodeURIComponent(credential.username)}:x@${credential.connect_address}`;
 }
+async function gatewayIps(credential, proxyUrl) {
+  if (credential.gateway_ips?.length) return credential.gateway_ips;
+  const host = new URL(proxyUrl).hostname;
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(host)) return [host];
+  try {
+    return await import_node_dns.promises.resolve4(host);
+  } catch {
+    return [];
+  }
+}
 function assertProxyUrl(raw) {
   let u;
   try {
@@ -484,6 +672,7 @@ function assertProxyUrl(raw) {
 }
 async function installCa(sandbox, caPem) {
   await sandbox.fs.uploadFile(Buffer.from(caPem, "utf8"), VERIS_CA_FILE);
+  await sandbox.fs.uploadFile(Buffer.from(bundledCaPatchScript(), "utf8"), BUNDLED_CA_PATCH_SCRIPT);
   const script = [
     `chmod 0644 ${VERIS_CA_FILE}`,
     // Public roots first so they keep working; ours appended. `cat` of a
@@ -509,6 +698,10 @@ async function installCa(sandbox, caPem) {
     );
   }
 }
+async function patchBundledCas(sandbox) {
+  const r = await sh(sandbox, `sh ${BUNDLED_CA_PATCH_SCRIPT}`, 180).catch((e) => ({ exitCode: 1, result: String(e) }));
+  return (r.result ?? "").split("\n").filter((line) => line.startsWith(BUNDLED_CA_PATCHED_MARKER)).map((line) => line.slice(BUNDLED_CA_PATCHED_MARKER.length).trim()).filter(Boolean);
+}
 async function probeCanary(sandbox, canaryHost, expectedTwinId) {
   if (!HOSTNAME_RE.test(canaryHost)) {
     throw new ReceiptIntegrityError(
@@ -562,9 +755,15 @@ var VerisApiImpl = class {
     this.ctx = ctx;
   }
   ctx;
+  get ownsTwin() {
+    return this.ctx.ownsTwin;
+  }
   get sandboxId() {
     return this.ctx.twinId;
   }
+  get environmentId() {
+    return this.ctx.environmentId;
+  }
   get mode() {
     return "gateway";
   }
@@ -590,10 +789,13 @@ var VerisApiImpl = class {
   }
   async receipt(service) {
     await probeCanary(this.ctx.sandbox, this.ctx.canaryHost, this.ctx.twinId);
-    if (service !== void 0) return fetchReceiptEntry(await this.resolveService(service));
+    if (service !== void 0) {
+      const svc = await this.resolveService(service);
+      return fetchReceiptEntry(svc, this.watermark(svc.name));
+    }
     const services = await this.services();
     const entries = await Promise.all(
-      services.filter((s) => isHttpUrl(s.control_url)).map(async (svc) => [svc.name, await fetchReceiptEntry(svc)])
+      services.filter((s) => isHttpUrl(s.control_url)).map(async (svc) => [svc.name, await fetchReceiptEntry(svc, this.watermark(svc.name))])
     );
     return {
       services: Object.fromEntries(entries),
@@ -609,10 +811,45 @@ var VerisApiImpl = class {
   leaks() {
     return ["udp-quic-possible", "ech-possible"];
   }
+  /** Where this service's log was when the run began. 0 reads all of it. */
+  watermark(service) {
+    return this.ctx.watermarks?.[service] ?? 0;
+  }
+  async verifyIntegrity() {
+    await probeCanary(this.ctx.sandbox, this.ctx.canaryHost, this.ctx.twinId);
+  }
+  async receiptBaseline() {
+    await this.verifyIntegrity();
+    return captureBaseline(
+      this.ctx.twinId,
+      this.ctx.sandbox.id,
+      (await this.services()).filter((s) => isHttpUrl(s.control_url))
+    );
+  }
+  async receiptSince(baseline, service) {
+    await this.verifyIntegrity();
+    const services = (await this.services()).filter((s) => isHttpUrl(s.control_url));
+    if (service !== void 0 && !services.some((s) => s.name === service)) {
+      throw new VerisError(`unknown HTTP service '${service}'`, { phase: "receipt" });
+    }
+    await validateBaseline(baseline, this.ctx.twinId, this.ctx.sandbox.id, services);
+    const selected = service === void 0 ? services : services.filter((s) => s.name === service);
+    const entries = await Promise.all(selected.map(async (svc) => [svc.name, await fetchReceiptEntry(svc, baseline.services[svc.name].id)]));
+    await validateBaseline(baseline, this.ctx.twinId, this.ctx.sandbox.id, await this.services().then((s) => s.filter((v) => isHttpUrl(v.control_url))));
+    return { services: Object.fromEntries(entries), mode: "gateway", integrity: "verified", leaks: this.leaks() };
+  }
+  async control(service, resource, options) {
+    const svc = (await this.services()).find((s) => s.name === service);
+    if (!svc) throw new VerisError(`unknown service '${service}'`);
+    return serviceControl(svc, resource, options);
+  }
   async assertTouched(service, match) {
     const entry = await this.receipt(service);
     const need = match?.minRequests ?? 1;
     const matched = match ? entry.entries.filter((r) => (match.method === void 0 || r.method.toUpperCase() === match.method.toUpperCase()) && (match.path === void 0 || r.path.includes(match.path))) : entry.entries;
+    if (matched.length < need && entry.capped) {
+      throw new VerisError(`receipt for '${service}' is incomplete; insufficient evidence`, { phase: "receipt" });
+    }
     if (matched.length < need) {
       const what = match ? `matching ${match.method ?? "ANY"} ${match.path ?? "*"} (${matched.length}/${need})` : "any intercepted requests";
       throw new VerisUntouchedError(
@@ -629,6 +866,36 @@ var VerisApiImpl = class {
   getTrustEnv() {
     return vendoredTrustEnv();
   }
+  /**
+   * The same variables as a shell prelude, for a caller that has no env map to
+   * fill — anything running a command through a session or a shell it did not
+   * build the environment for. Daytona resets SSL_CERT_FILE,
+   * REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE and NODE_EXTRA_CA_CERTS to its own CA
+   * file inside the sandbox, and that file cannot verify the gateway's leaf, so
+   * a command that inherits them fails on certificate validation:
+   * `uv sync` dies with "invalid peer certificate: UnknownIssuer".
+   *
+   *   sbx.process.executeCommand(`${sbx.veris.trustPrelude()} uv sync`)
+   */
+  trustPrelude() {
+    return trustPrelude(this.getTrustEnv());
+  }
+  /**
+   * Append the Veris CA to the CA bundles the code under test's own SDKs ship.
+   *
+   * The variables above reach every client that reads one. stripe-python does
+   * not: it passes `verify=stripe.ca_bundle_path`, so the first Stripe call
+   * fails with "Could not verify Stripe's SSL certificate" in a sandbox where
+   * curl, Node and `requests` all succeed. This patches the file itself, which
+   * is the Daytona-shaped version of the veris CLI's --patch-bundled-cas.
+   *
+   * Call it AFTER installing dependencies — the bundles arrive with them, so
+   * there is nothing to patch at create time. Safe to call again; it returns
+   * only the files it actually changed.
+   */
+  patchBundledCas() {
+    return patchBundledCas(this.ctx.sandbox);
+  }
   async deliverTo(target, opts = {}) {
     const url = typeof target === "number" ? (await this.ctx.sandbox.getPreviewLink(target)).url : target;
     await this.ctx.controlPlane.updateSandbox(
@@ -660,8 +927,70 @@ var VerisApiImpl = class {
   }
 };
 
+// src/profile.ts
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+var import_yaml = require("yaml");
+var DEFAULT_API_BASE = "https://svc.api.veris.ai";
+function profilePath(home = (0, import_node_os.homedir)()) {
+  return (0, import_node_path.join)(home, ".veris", "twin.yaml");
+}
+function readOrUndefined(path) {
+  try {
+    return (0, import_node_fs.readFileSync)(path, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return void 0;
+    throw e;
+  }
+}
+function parseProfileFile(text, path) {
+  if (text === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = (0, import_yaml.parse)(text);
+  } catch (cause) {
+    throw new VerisError(`${path} is not valid YAML`, { phase: "credentials", cause });
+  }
+  if (parsed === null || parsed === void 0) return {};
+  if (typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new VerisError(`${path} is not a profile file (expected a mapping)`, { phase: "credentials" });
+  }
+  return parsed;
+}
+function selectProfileName(env, file) {
+  return env.VERIS_PROFILE || file?.active_profile || "default";
+}
+function resolveVerisCredentials(opts = {}) {
+  const env = opts.env ?? process.env;
+  const path = opts.path ?? profilePath();
+  const file = parseProfileFile((opts.readFile ?? readOrUndefined)(path), path);
+  const name = selectProfileName(env, file);
+  const profile = file?.profiles?.[name] ?? void 0;
+  const found = profile !== void 0 && profile !== null;
+  const apiKey = opts.apiKey || env.VERIS_API_KEY || (found ? profile.api_key : void 0) || void 0;
+  const keySource = opts.apiKey ? "option" : env.VERIS_API_KEY ? "env" : apiKey ? "profile" : "none";
+  const profileBase = found ? profile.api_base : void 0;
+  const apiBase = (opts.apiBase || env.VERIS_API_BASE || profileBase || DEFAULT_API_BASE).replace(/\/$/, "");
+  const baseSource = opts.apiBase ? "option" : env.VERIS_API_BASE ? "env" : profileBase ? "profile" : "default";
+  return { apiKey, apiBase, keySource, baseSource, profile: { name, path, found } };
+}
+function missingKeyWhere(c) {
+  const where = c.profile.found ? `profile '${c.profile.name}' in ${c.profile.path} has no api_key` : `${c.profile.path} has no profile '${c.profile.name}'`;
+  return `VERIS_API_KEY is not set, and ${where}`;
+}
+var KEY_SOURCES_HINT = "Run `veris login` (the veris CLI saves the key there; `--profile <name>` for another plane, and VERIS_PROFILE picks it here), or set VERIS_API_KEY in the environment. Get a key at https://studio.veris.ai";
+function missingKeyMessage(c) {
+  return `no Veris API key: ${missingKeyWhere(c)}. ${KEY_SOURCES_HINT}`;
+}
+function requireVerisCredentials(opts = {}) {
+  const c = resolveVerisCredentials(opts);
+  if (!c.apiKey) throw new MissingCredentialsError(missingKeyMessage(c), { phase: "credentials" });
+  return c;
+}
+
 // src/version.ts
-var SDK_VERSION = true ? "0.2.0" : "0.0.0-dev";
+var SDK_VERSION = true ? "0.3.0" : "0.0.0-dev";
 
 // src/daytona.ts
 var LABEL = {
@@ -671,12 +1000,24 @@ var LABEL = {
   mode: "veris_mode",
   egress: "veris_egress",
   ownsTwin: "veris_owns_twin",
-  canaryHost: "veris_canary_host"
+  canaryHost: "veris_canary_host",
+  /** Unique to ONE create() call, and the only way back to a sandbox whose
+   *  create threw before it could hand the object over — see reapFailedCreate.
+   *  The twin id will not do: an attached twin is shared by every sandbox on
+   *  it, and deleting the wrong one of those would be worse than the leak. */
+  createId: "veris_create_id"
 };
 var VERIS_LABEL_KEYS = Object.values(LABEL);
 function isVerisSandbox(sbx) {
   return typeof sbx.verisSandboxId === "string";
 }
+function verisTwinId(sandbox) {
+  return sandbox.labels?.[LABEL.twinId];
+}
+function verisOwnsTwin(sandbox) {
+  const labels = sandbox.labels ?? {};
+  return labels[LABEL.twinId] !== void 0 && labels[LABEL.ownsTwin] !== "false";
+}
 var Daytona = class extends import_sdk.Daytona {
   verisDefaults;
   constructor(config) {
@@ -696,6 +1037,7 @@ var Daytona = class extends import_sdk.Daytona {
     const egress = v.egress ?? "strict";
     const ttlMinutes = v.ttlMinutes ?? 60;
     const ownsTwin = !v.attachSandboxId;
+    const createId = crypto.randomUUID();
     const twin = await this.provisionTwin(controlPlane, v, coords, ttlMinutes);
     const cleanupTwin = async () => {
       if (ownsTwin) await controlPlane.deleteTwin(twin.environment_id, twin.id).catch(() => {
@@ -703,6 +1045,8 @@ var Daytona = class extends import_sdk.Daytona {
     };
     let sandbox;
     let credential;
+    let watermarks = {};
+    let daytonaAsked = false;
     try {
       credential = await controlPlane.mintEgressCredential(twin.environment_id, twin.id);
       if (!credential) {
@@ -719,17 +1063,19 @@ var Daytona = class extends import_sdk.Daytona {
       }
       const services = twin.services?.length ? twin.services : await controlPlane.services(twin.id);
       const proxyUrl = gatewayProxyUrl(credential);
-      const network = buildNetwork({
-        services,
-        mode: egress,
-        // The gateway has to be reachable or nothing is: taken from the URL we
-        // are actually going to use, so the two can never disagree.
-        gatewayHosts: [new URL(proxyUrl).hostname, credential.canary_host].filter(Boolean),
-        allowOut: v.allowOut,
-        allowRegistries: v.allowRegistries
-      });
+      const network = buildNetwork({ mode: egress, gatewayIps: await gatewayIps(credential, proxyUrl) });
+      watermarks = await readWatermarks(services);
       const verisManaged = {
         ...v.installCa !== false ? sanitizeTrustEnv(void 0) : {},
+        // Node reads none of the variables above once Daytona has overwritten
+        // them; the flag makes it read OpenSSL's store, which the CA install
+        // fills. Appended, not replaced: a caller's own NODE_OPTIONS keep working.
+        ...v.installCa !== false ? { NODE_OPTIONS: nodeOptionsWithTrust(rest.envVars?.NODE_OPTIONS) } : {},
+        // Node ignores HTTPS_PROXY unless told to, and Daytona blocks anything
+        // that dials out directly — so without this every plain `https.get`
+        // and `fetch` in Node 24+ dies with ECONNRESET instead of reaching
+        // the gateway. Older Node needs a proxy agent; the variable is inert there.
+        NODE_USE_ENV_PROXY: "1",
         ...v.dataPlaneEnv !== false ? dataPlaneEnv(services) : {},
         VERIS_SANDBOX_ID: twin.id
       };
@@ -744,20 +1090,23 @@ var Daytona = class extends import_sdk.Daytona {
           [LABEL.egress]: egress,
           [LABEL.ownsTwin]: String(ownsTwin),
           [LABEL.mode]: "gateway",
-          [LABEL.canaryHost]: credential.canary_host
+          [LABEL.canaryHost]: credential.canary_host,
+          [LABEL.createId]: createId
         },
-        ...network,
-        // 3. Where Daytona forwards everything the allowlist permits. Chained,
-        //    not advisory: an unreachable gateway makes allowed traffic 502
-        //    rather than quietly going direct.
+        ...network.params,
+        // 3. Where Daytona forwards everything. Chained, not advisory: an
+        //    unreachable gateway makes traffic 502 rather than quietly going
+        //    direct.
         outboundProxyUrl: proxyUrl,
         ttlMinutes: rest.ttlMinutes ?? ttlMinutes
       };
+      daytonaAsked = true;
       sandbox = await this.baseCreate(createParams, options);
     } catch (cause) {
+      const failed = daytonaAsked ? await reapFailedCreate((labels) => super.list({ labels }), createId) : void 0;
       await cleanupTwin();
       if (cause instanceof VerisError) throw cause;
-      throw new VerisError("Daytona sandbox create failed", {
+      throw new VerisError(sandboxCreateMessage(cause, failed, rest), {
         phase: "sandbox-create",
         verisSandboxId: twin.id,
         cause
@@ -778,7 +1127,8 @@ var Daytona = class extends import_sdk.Daytona {
       twinId: twin.id,
       egress,
       ownsTwin,
-      canaryHost: credential.canary_host
+      canaryHost: credential.canary_host,
+      watermarks
     });
   }
   /**
@@ -810,9 +1160,10 @@ var Daytona = class extends import_sdk.Daytona {
     const labels = sandbox.labels ?? {};
     const twinId = labels[LABEL.twinId];
     if (!twinId) return sandbox;
-    const apiKey = this.verisDefaults.apiKey ?? process.env.VERIS_API_KEY;
+    const creds = resolveVerisCredentials({ apiKey: this.verisDefaults.apiKey, apiBase: this.verisDefaults.apiBase });
+    const apiKey = creds.apiKey;
     if (!apiKey) return sandbox;
-    const trustedBase = this.verisDefaults.apiBase ?? process.env.VERIS_API_BASE;
+    const trustedBase = creds.baseSource === "default" ? void 0 : creds.apiBase;
     const labelBase = labels[LABEL.apiBase];
     if (trustedBase && labelBase && labelBase !== trustedBase) {
       throw new VerisError(
@@ -894,19 +1245,48 @@ var Daytona = class extends import_sdk.Daytona {
 };
 var daytona_default = Daytona;
 function resolveCoordinates(v) {
-  const apiKey = v.apiKey ?? process.env.VERIS_API_KEY;
-  if (!apiKey) {
-    throw new MissingCredentialsError(
-      "no Veris API key: set VERIS_API_KEY in your environment, or pass veris.apiKey. Get one at https://studio.veris.ai",
-      { phase: "credentials" }
-    );
-  }
+  const creds = requireVerisCredentials({ apiKey: v.apiKey, apiBase: v.apiBase });
   return {
-    apiKey,
+    apiKey: creds.apiKey,
     environmentId: v.environmentId ?? process.env.VERIS_ENVIRONMENT_ID,
-    apiBase: (v.apiBase ?? process.env.VERIS_API_BASE ?? "https://svc.api.veris.ai").replace(/\/$/, "")
+    apiBase: creds.apiBase
   };
 }
+async function reapFailedCreate(list, createId) {
+  try {
+    for await (const sandbox of list({ [LABEL.createId]: createId })) {
+      if (sandbox.labels?.[LABEL.createId] !== createId) continue;
+      if (!sandbox.errorReason) await sandbox.refreshData().catch(() => {
+      });
+      const found = { id: sandbox.id, state: sandbox.state, errorReason: sandbox.errorReason };
+      return { ...found, deleted: await sandbox.delete().then(() => true, () => false) };
+    }
+  } catch {
+  }
+  return void 0;
+}
+function sandboxCreateMessage(cause, failed, params = {}) {
+  const base = "Daytona sandbox create failed";
+  if (!failed) return base;
+  const reason = failed.errorReason?.trim().replace(/[.\s]+$/, "");
+  const parts = [reason ? `${base}: ${reason}.` : `${base}.`];
+  const image = typeof params.image === "string" ? params.image : void 0;
+  if (image && failed.state === "build_failed") {
+    parts.push(
+      `Daytona builds "${image}" on its own servers and pulls it from a registry, so an image that exists only in your local Docker daemon is not one it can see.`
+    );
+  }
+  parts.push(failed.deleted ? `The half-built sandbox ${failed.id} was deleted.` : `The half-built sandbox ${failed.id} could not be deleted \u2014 remove it with \`veris-daytona teardown ${failed.id}\`.`);
+  const raw = cause instanceof Error ? cause.message : "";
+  if (raw) parts.push(`(Daytona SDK: ${raw})`);
+  return parts.join(" ");
+}
+async function readWatermarks(services) {
+  const marks = await Promise.all(
+    services.filter((s) => isHttpUrl(s.control_url)).map(async (svc) => [svc.name, await fetchWatermark(svc).catch(() => 0)])
+  );
+  return Object.fromEntries(marks);
+}
 function stripVeris(params) {
   const { veris: _veris, ...rest } = params ?? {};
   return rest;
@@ -918,13 +1298,84 @@ function reserveLabels(labels) {
   }
   return out;
 }
+
+// src/daytona-key.ts
+var DAYTONA_API_URL = "https://app.daytona.io/api";
+var DELETE_SANDBOXES = "delete:sandboxes";
+function daytonaApiUrl(env = process.env) {
+  return (env.DAYTONA_API_URL || env.DAYTONA_SERVER_URL || DAYTONA_API_URL).replace(/\/$/, "");
+}
+async function fetchDaytonaKey(apiKey, apiUrl = daytonaApiUrl()) {
+  try {
+    const res = await fetch(`${apiUrl}/api-keys/current`, {
+      headers: { Authorization: `Bearer ${apiKey}` }
+    });
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    if (!Array.isArray(body.permissions)) return void 0;
+    return {
+      name: typeof body.name === "string" ? body.name : "",
+      permissions: body.permissions.filter((p) => typeof p === "string")
+    };
+  } catch {
+    return void 0;
+  }
+}
+function canDeleteSandboxes(key) {
+  return key === void 0 ? void 0 : key.permissions.includes(DELETE_SANDBOXES);
+}
+function describeKey(key) {
+  const name = key.name ? `"${key.name}" ` : "";
+  return `${name}(permissions: ${key.permissions.join(", ") || "none"})`;
+}
+var DELETE_PERMISSION_FIX = 'create a key with the "delete sandboxes" permission at https://app.daytona.io/dashboard/keys';
+function cannotTeardownWarning(key, autoStopMinutes, autoDeleteMinutes) {
+  return `DAYTONA_API_KEY ${describeKey(key)} lacks \`${DELETE_SANDBOXES}\`, so \`veris-daytona teardown\` will be refused for the sandbox about to be created, and \`run\` cannot delete its own. The box still stops after ${autoStopMinutes} idle minutes and is deleted ${autoDeleteMinutes} minutes after it stops. For a teardown that works, ${DELETE_PERMISSION_FIX} and use it instead.`;
+}
+
+// src/teardown.ts
+var TEARDOWN_USAGE = `usage: veris-daytona teardown <daytona-sandbox-id>
+
+Deletes the Daytona sandbox. The id is the one \`veris-daytona provision\`
+printed as daytonaSandboxId \u2014 not the Veris twin's id.
+
+The twin follows the rule it was created under: one this package created is
+deleted with the sandbox, one it attached to (\`provision\`, or \`run --sandbox\`)
+is yours and is left running. Which of the two happened is printed.
+
+needs: DAYTONA_API_KEY with the ${DELETE_SANDBOXES} permission \u2014 a key made with
+"write sandboxes" alone is refused, and the refusal says when Daytona will stop
+and delete the box on its own. To reach a twin that must be deleted, a Veris
+key too: VERIS_API_KEY, or the profile \`veris login\` saved.
+
+exit code: 0 when the sandbox is deleted; 1 when there is no such sandbox, or
+the key may not delete one.`;
+function isPermissionDenied(e) {
+  return typeof e === "object" && e !== null && e.statusCode === 403;
+}
+function sandboxBrakes(r) {
+  const stop = r.autoStopMinutes && r.autoStopMinutes > 0 ? `stops after ${r.autoStopMinutes} idle minutes` : "never stops on its own";
+  const del = r.autoDeleteMinutes === void 0 || r.autoDeleteMinutes < 0 ? "is never auto-deleted" : r.autoDeleteMinutes === 0 ? "is deleted as soon as it stops" : `is deleted ${r.autoDeleteMinutes} minutes after it stops`;
+  const destroy = r.expiresAt ? `, and is destroyed at ${r.expiresAt} whatever state it is in` : "";
+  return `${stop} and ${del}${destroy}`;
+}
+function teardownRefusedMessage(r) {
+  const key = r.key ? `this DAYTONA_API_KEY ${describeKey(r.key)} lacks the \`${DELETE_SANDBOXES}\` permission` : `Daytona answered 403 (Access denied), which is what a DAYTONA_API_KEY without the \`${DELETE_SANDBOXES}\` permission gets \u2014 the key's own record could not be read to confirm it`;
+  const twin = r.twinId === void 0 ? "" : r.ownsTwin ? ` Its twin ${r.twinId} was deleted before Daytona refused, so nothing is left on the Veris side.` : ` Twin ${r.twinId} is yours and was not touched.`;
+  return `Daytona refused to delete sandbox ${r.sandboxId}: ${key}. The sandbox is still there: it ${sandboxBrakes(r)}.${twin} To delete it sooner, ${DELETE_PERMISSION_FIX}, then run \`veris-daytona teardown ${r.sandboxId}\` with it \u2014 or delete the sandbox in the Daytona dashboard.`;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  BUNDLED_CA_FILES,
+  BUNDLED_CA_PATCH_SCRIPT,
   CA_CERT_PATH,
   ControlPlane,
-  DEFAULT_REGISTRY_HOSTS,
+  DAYTONA_API_URL,
+  DEFAULT_API_BASE,
+  DELETE_SANDBOXES,
   Daytona,
   MissingCredentialsError,
+  NODE_TRUST_FLAG,
   ReceiptIntegrityError,
   SDK_VERSION,
   SYSTEM_BUNDLE,
@@ -938,13 +1389,32 @@ function reserveLabels(labels) {
   VerisGatewayUnreachableError,
   VerisUntouchedError,
   assertHttpControlPlane,
+  buildNetwork,
+  canDeleteSandboxes,
+  cannotTeardownWarning,
   dataPlaneHosts,
+  daytonaApiUrl,
+  directTwinHosts,
+  fetchDaytonaKey,
   fetchManual,
+  gatewayIps,
   gatewayProxyUrl,
+  isPermissionDenied,
   isVerisSandbox,
+  missingKeyMessage,
+  nodeOptionsWithTrust,
+  patchBundledCas,
+  profilePath,
+  requireVerisCredentials,
+  resolveVerisCredentials,
+  sandboxBrakes,
+  teardownRefusedMessage,
+  trustPrelude,
   twinHosts,
   vendorHosts,
   vendoredTrustEnv,
+  verisOwnsTwin,
+  verisTwinId,
   ...require("@daytona/sdk")
 });
 //# sourceMappingURL=index.cjs.map