@veris-ai/daytona 0.2.1 → 0.3.0

package/dist/cli.js

@@ -0,0 +1,2099 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { execFileSync } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+import { DaytonaNotFoundError } from "@daytona/sdk";
+
+// src/daytona.ts
+import { Daytona as BaseDaytona } from "@daytona/sdk";
+
+// src/errors.ts
+function withCause(message, cause) {
+  const detail = cause instanceof Error ? cause.message : typeof cause === "string" ? cause : "";
+  if (!detail || message.includes(detail)) return message;
+  const trimmed = detail.length > 200 ? `${detail.slice(0, 200)}\u2026` : detail;
+  return `${message}: ${trimmed}`;
+}
+var VerisError = class extends Error {
+  phase;
+  /** The Veris twin's sandbox id, when one exists yet. */
+  verisSandboxId;
+  /** Verbatim control-plane response body, when the failure came from an API call. */
+  responseBody;
+  constructor(message, opts = {}) {
+    super(withCause(message, opts.cause), opts.cause !== void 0 ? { cause: opts.cause } : void 0);
+    this.name = new.target.name;
+    this.phase = opts.phase;
+    this.verisSandboxId = opts.verisSandboxId;
+    this.responseBody = opts.responseBody;
+  }
+};
+var MissingCredentialsError = class extends VerisError {
+};
+var VerisGatewayUnreachableError = class extends VerisError {
+};
+var VerisGatewayNotOfferedError = class extends VerisError {
+  /** Server-announced minimum SDK version, when the refusal carried one. */
+  minSdk;
+  constructor(message, opts = {}) {
+    super(message, opts);
+    this.minSdk = opts.minSdk;
+  }
+};
+var ReceiptIntegrityError = class extends VerisError {
+};
+var VerisUntouchedError = class extends VerisError {
+  service;
+  constructor(message, service, opts = {}) {
+    super(message, opts);
+    this.service = service;
+  }
+};
+var TwinExpiredError = class extends VerisError {
+};
+var SnapshotUnsupportedError = class extends VerisError {
+};
+
+// src/control-plane.ts
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var ControlPlane = class {
+  apiBase;
+  headers;
+  constructor(opts) {
+    this.apiBase = opts.apiBase.replace(/\/$/, "");
+    this.headers = {
+      "X-API-Key": opts.apiKey,
+      "X-Veris-SDK": opts.sdkVersion,
+      "Content-Type": "application/json"
+    };
+  }
+  async request(method, path, body) {
+    let res;
+    try {
+      res = await fetch(`${this.apiBase}${path}`, {
+        method,
+        headers: this.headers,
+        body: body === void 0 ? void 0 : JSON.stringify(body)
+      });
+    } catch (cause) {
+      throw new VerisError(`Veris control plane unreachable (${method} ${path})`, { cause });
+    }
+    return res;
+  }
+  async json(res, context, phase) {
+    const text = await res.text();
+    let parsed;
+    try {
+      parsed = text ? JSON.parse(text) : void 0;
+    } catch {
+      parsed = text;
+    }
+    if (!res.ok) {
+      throw new VerisError(`${context}: ${res.status}`, { phase, responseBody: parsed });
+    }
+    if (parsed === void 0) {
+      throw new VerisError(`${context}: empty response body`, { phase, responseBody: text });
+    }
+    return parsed;
+  }
+  async createTwin(environmentId, opts = {}) {
+    const res = await this.request("POST", `/v1/environments/${environmentId}/sandboxes`, {
+      ttl_minutes: opts.ttlMinutes,
+      metadata: opts.metadata
+    });
+    if (res.status === 404) {
+      throw new VerisError(
+        `environment '${environmentId}' does not exist on ${this.apiBase}. Environments belong to one control plane: check that VERIS_ENVIRONMENT_ID and VERIS_API_BASE name the same one (an id from the other environment gives exactly this 404).`,
+        { phase: "twin-provision", responseBody: await res.text() }
+      );
+    }
+    return this.json(res, `create sandbox in environment ${environmentId}`, "twin-provision");
+  }
+  async getTwin(sandboxId) {
+    const res = await this.request("GET", `/v1/sandboxes/${sandboxId}`);
+    if (res.status === 404) return null;
+    return this.json(res, `get sandbox ${sandboxId}`);
+  }
+  /** Poll until the twin reports ready. "failed" is terminal per the API docs. */
+  async waitReady(sandboxId, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    for (; ; ) {
+      const twin = await this.getTwin(sandboxId);
+      if (!twin) throw new TwinExpiredError(`Veris sandbox ${sandboxId} disappeared while provisioning`, { verisSandboxId: sandboxId });
+      if (twin.status === "ready") return twin;
+      if (twin.status === "failed") {
+        throw new VerisError(
+          `Veris sandbox ${sandboxId} failed to provision: ${twin.failure_reason ?? "no failure_reason"}`,
+          { phase: "twin-provision", verisSandboxId: sandboxId }
+        );
+      }
+      if (Date.now() > deadline) {
+        throw new VerisError(
+          `Veris sandbox ${sandboxId} not ready after ${timeoutMs}ms (status: ${twin.status})`,
+          { phase: "twin-provision", verisSandboxId: sandboxId }
+        );
+      }
+      await sleep(1500);
+    }
+  }
+  async services(sandboxId) {
+    const res = await this.request("GET", `/v1/sandboxes/${sandboxId}/services`);
+    if (res.status === 404) {
+      throw new TwinExpiredError(`Veris sandbox ${sandboxId} not found \u2014 expired or deleted`, { verisSandboxId: sandboxId });
+    }
+    return this.json(res, `services of sandbox ${sandboxId}`, "receipt");
+  }
+  async deleteTwin(environmentId, sandboxId) {
+    const res = await this.request("DELETE", `/v1/environments/${environmentId}/sandboxes/${sandboxId}`);
+    if (res.status === 404) return false;
+    if (!res.ok) await this.json(res, `delete sandbox ${sandboxId}`);
+    return true;
+  }
+  /**
+   * Mint (or re-mint) the gateway egress credential for a twin. Returns null
+   * when the control plane does not offer gateway mode at all (404 — route
+   * absent), so `mode: 'auto'` can fall back; throws VerisGatewayNotOfferedError
+   * on an explicit version refusal (409 sdk_too_old).
+   */
+  async mintEgressCredential(environmentId, sandboxId) {
+    const res = await this.request("POST", `/v1/environments/${environmentId}/sandboxes/${sandboxId}/egress-credential`);
+    if (res.status === 404) return null;
+    if (res.status === 409) {
+      const body = await res.json().catch(() => ({}));
+      throw new VerisGatewayNotOfferedError(
+        `this SDK version is below the control plane's minimum for gateway mode${body.min_sdk ? ` (min_sdk ${body.min_sdk})` : ""} \u2014 upgrade @veris-ai/daytona`,
+        { phase: "credential-mint", verisSandboxId: sandboxId, minSdk: body.min_sdk, responseBody: body }
+      );
+    }
+    return this.json(res, `mint egress credential for ${sandboxId}`, "credential-mint");
+  }
+  /** PATCH the twin resource. Omitted fields are untouched by the server. */
+  async updateSandbox(environmentId, sandboxId, patch) {
+    const res = await this.request("PATCH", `/v1/environments/${environmentId}/sandboxes/${sandboxId}`, patch);
+    if (res.status === 404) {
+      throw new TwinExpiredError(`Veris sandbox ${sandboxId} not found`, { verisSandboxId: sandboxId });
+    }
+    if (!res.ok) await this.json(res, `update sandbox ${sandboxId}`);
+  }
+  // There was an extendTtl() here, and it did nothing.
+  //
+  // It PATCHed { ttl_minutes } at the sandbox resource, and the server's
+  // UpdateSandboxRequest declares only client_base_url. Pydantic ignores
+  // unknown fields, so the route answered 200 having changed no TTL at all —
+  // a call that reports success while doing nothing, which is worse than no
+  // call, because the caller then believes the twin will outlive the run.
+  // Nothing here called it; it was API surface promising a thing that could
+  // not happen.
+  //
+  // Bring it back when a route exists to carry it. Until then a twin's TTL is
+  // decided once, by ttl_minutes at create — where this SDK already keeps it
+  // in step with the Daytona sandbox's own ttlMinutes.
+  /** Create-time preflight: is the gateway infrastructure up, per the control plane? */
+  async gatewayHealth() {
+    const res = await this.request("GET", "/v1/gateway/health");
+    if (res.status === 404) return;
+    if (!res.ok) {
+      throw new VerisGatewayUnreachableError(
+        `Veris gateway reported unhealthy (${res.status})`,
+        { phase: "gateway-preflight" }
+      );
+    }
+  }
+};
+
+// src/run-receipt.ts
+import { randomUUID } from "crypto";
+
+// src/receipt.ts
+var PAGE_LIMIT = 1e3;
+var MAX_PAGES = 20;
+function rowsOf(body) {
+  if (!body || !Array.isArray(body.requests)) {
+    throw new VerisError("invalid request log: expected requests array", { phase: "receipt" });
+  }
+  const rows = body.requests;
+  for (const r of rows) {
+    if (!r || !Number.isSafeInteger(r.id) || r.id <= 0 || typeof r.method !== "string" || typeof r.path !== "string" || typeof r.tier !== "string" || !(r.status === null || typeof r.status === "number")) {
+      throw new VerisError("invalid request log row: stable id, method, path, tier and status required", { phase: "receipt" });
+    }
+  }
+  return rows;
+}
+function parseRequestsBody(body) {
+  const rows = rowsOf(body);
+  const entries = rows.filter(
+    (r) => ["handler", "fault", "fallback", "fallback-llm", "fallback-replay"].includes(r.tier) && !/^\/veris(?:\/|$)/.test(r.path)
+  ).map(({ id, method, path, status, tier }) => ({ id, method, path, status, tier }));
+  return { count: entries.length, entries, total: rows.length };
+}
+async function readPage(svc, query) {
+  const res = await fetch(`${svc.control_url.replace(/\/$/, "")}/veris/requests?${query}`, {
+    signal: AbortSignal.timeout(3e4),
+    redirect: "error"
+  });
+  const text = await res.text();
+  if (!res.ok) throw new VerisError(`could not read receipt for service '${svc.name}' (${res.status})`, { phase: "receipt" });
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    throw new VerisError(`service '${svc.name}' returned a non-JSON receipt body`, { phase: "receipt" });
+  }
+  return rowsOf(body);
+}
+async function fetchWatermark(svc) {
+  const rows = await readPage(svc, new URLSearchParams({ limit: "1", order: "desc" }));
+  if (rows.length > 1) throw new VerisError("request log ignored watermark limit", { phase: "receipt" });
+  return rows[0]?.id ?? 0;
+}
+async function fetchReceiptEntry(svc, sinceId = 0) {
+  if (!Number.isSafeInteger(sinceId) || sinceId < 0) throw new VerisError("invalid receipt watermark", { phase: "receipt" });
+  const end = await fetchWatermark(svc);
+  if (end < sinceId) throw new VerisError("receipt baseline invalid: log moved backwards; take a new baseline", { phase: "receipt" });
+  const entries = [];
+  const raw = [];
+  let mark = sinceId;
+  let incompleteReason;
+  for (let page = 0; mark < end; page++) {
+    if (page >= MAX_PAGES) {
+      incompleteReason = "page-limit";
+      break;
+    }
+    let rows;
+    try {
+      rows = await readPage(svc, new URLSearchParams({ limit: String(PAGE_LIMIT), order: "asc", since_id: String(mark) }));
+    } catch (error) {
+      if (!raw.length) throw error;
+      incompleteReason = "read-failed";
+      break;
+    }
+    let previous = mark;
+    if (!rows.length || rows.some((r) => {
+      const bad = r.id <= previous;
+      previous = r.id;
+      return bad;
+    })) {
+      incompleteReason = "pagination-not-progressing";
+      break;
+    }
+    const window = rows.filter((r) => r.id <= end);
+    raw.push(...window);
+    entries.push(...parseRequestsBody({ requests: window }).entries);
+    mark = rows[rows.length - 1].id;
+  }
+  entries.sort((a, b) => b.id - a.id);
+  return {
+    requests: entries.length,
+    controlUrl: svc.control_url,
+    entries,
+    sinceId,
+    untilId: end,
+    capped: Boolean(incompleteReason),
+    ...incompleteReason ? { incompleteReason } : {},
+    raw: { requests: raw }
+  };
+}
+
+// src/run-receipt.ts
+var HEADER = "x-veris-receipt-baseline";
+function markerOf(row) {
+  try {
+    const headers = typeof row.request_headers === "string" ? JSON.parse(row.request_headers) : row.request_headers;
+    return headers?.[HEADER];
+  } catch {
+    return void 0;
+  }
+}
+async function captureBaseline(twinId, sandboxId, services) {
+  const marks = await Promise.all(services.map(async (svc) => {
+    const marker = randomUUID();
+    const res = await fetch(`${svc.control_url.replace(/\/$/, "")}/veris/schema`, {
+      headers: { [HEADER]: marker },
+      signal: AbortSignal.timeout(3e4),
+      redirect: "error"
+    });
+    await res.text();
+    if (!res.ok) throw new VerisError(`could not establish baseline for '${svc.name}' (${res.status})`, { phase: "receipt" });
+    for (let attempt = 0; attempt < 5; attempt++) {
+      const rows = await readPage(svc, new URLSearchParams({ limit: "1000", order: "desc" }));
+      const anchor = rows.find((r) => markerOf(r) === marker && r.tier === "control" && r.path === "/veris/schema");
+      if (anchor) return [svc.name, { controlUrl: svc.control_url, id: anchor.id, marker }];
+      await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+    throw new VerisError(`baseline unavailable for '${svc.name}': trace must retain control request headers`, { phase: "receipt" });
+  }));
+  return { version: 1, twinId, sandboxId, services: Object.fromEntries(marks) };
+}
+async function validateBaseline(baseline, twinId, sandboxId, services) {
+  const invalid = () => new VerisError("receipt baseline invalid: session, services or history changed; take a new baseline before execution", { phase: "receipt" });
+  if (baseline.version !== 1 || baseline.twinId !== twinId || baseline.sandboxId !== sandboxId || Object.keys(baseline.services).sort().join("\0") !== services.map((s) => s.name).sort().join("\0")) throw invalid();
+  await Promise.all(services.map(async (svc) => {
+    const mark = baseline.services[svc.name];
+    if (!mark || mark.controlUrl !== svc.control_url || !Number.isSafeInteger(mark.id) || mark.id <= 0) throw invalid();
+    const rows = await readPage(svc, new URLSearchParams({ limit: "1", order: "asc", since_id: String(mark.id - 1) }));
+    if (rows.length !== 1 || rows[0].id !== mark.id || markerOf(rows[0]) !== mark.marker) throw invalid();
+  }));
+}
+
+// src/service-control.ts
+async function serviceControl(svc, resource, options = {}) {
+  const method = options.method ?? "GET";
+  if (!["manual", "schema", "operations", "data", "requests"].includes(resource) || !["GET", "POST", "PATCH"].includes(method) || method !== "GET" && resource !== "data" || method === "GET" && options.body !== void 0 || !/^https?:\/\//.test(svc.control_url)) {
+    throw new VerisError("unsupported service control operation");
+  }
+  const url = new URL(`${svc.control_url.replace(/\/$/, "")}/veris/${resource}`);
+  for (const [key, value] of Object.entries(options.query ?? {})) url.searchParams.set(key, value);
+  const res = await fetch(url, {
+    method,
+    redirect: "error",
+    signal: AbortSignal.timeout(3e4),
+    headers: { "Content-Type": "application/json" },
+    body: options.body === void 0 ? void 0 : JSON.stringify(options.body)
+  });
+  const text = await res.text();
+  if (!res.ok) throw new VerisError(`service '${svc.name}' ${method} /veris/${resource} failed (${res.status})`);
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new VerisError(`service '${svc.name}' returned invalid control JSON`);
+  }
+}
+
+// src/network.ts
+var isHttpUrl = (u) => /^https?:/.test(u);
+function dataPlaneEnv(services) {
+  const envs = {};
+  for (const svc of services) {
+    if (!svc.env_hint || !svc.url || isHttpUrl(svc.url)) continue;
+    if (!isSafeEnvName(svc.env_hint)) continue;
+    envs[svc.env_hint] = svc.url;
+  }
+  return envs;
+}
+var PROCESS_CONTROLLING = /* @__PURE__ */ new Set([
+  "PATH",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "NODE_OPTIONS",
+  "BASH_ENV",
+  "ENV",
+  "PYTHONPATH",
+  "PYTHONSTARTUP",
+  "SHELL",
+  "IFS",
+  "HOME",
+  "PROMPT_COMMAND"
+]);
+function isSafeEnvName(name) {
+  return /^[A-Z][A-Z0-9_]{0,63}$/.test(name) && !PROCESS_CONTROLLING.has(name);
+}
+var IPV4_RE = /^(25[0-5]|2[0-4]\d|1?\d?\d)(\.(25[0-5]|2[0-4]\d|1?\d?\d)){3}$/;
+function buildNetwork(args) {
+  const { mode, gatewayIps: gatewayIps2 } = args;
+  if (mode === "open") return { params: {} };
+  const ips = [...new Set(gatewayIps2)];
+  if (!ips.length) {
+    throw new VerisError(
+      "the control plane did not name the gateway's IP addresses (egress credential `gateway_ips`) and the gateway hostname could not be resolved, so the sandbox cannot be pinned to it. Upgrade the control plane, or run with veris.egress: 'open' (Daytona still blocks anything that bypasses the proxy).",
+      { phase: "credential-mint" }
+    );
+  }
+  const bad = ips.filter((ip) => !IPV4_RE.test(ip));
+  if (bad.length) {
+    throw new VerisError(
+      `the control plane returned gateway addresses that are not IPv4: ${JSON.stringify(bad)} (Daytona's networkAllowList takes IPv4 CIDRs only)`,
+      { phase: "credential-mint" }
+    );
+  }
+  return { params: { networkAllowList: ips.map((ip) => `${ip}/32`).join(",") } };
+}
+
+// src/gateway.ts
+import { promises as dns } from "dns";
+
+// src/trust.ts
+var CA_CERT_PATH = "/usr/local/share/ca-certificates/veris-ca.crt";
+var SYSTEM_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+var VERIS_CA_FILE = "/tmp/veris-ca.crt";
+var VERIS_BUNDLE = "/tmp/veris-ca-bundle.crt";
+function vendoredTrustEnv() {
+  return {
+    SSL_CERT_FILE: VERIS_BUNDLE,
+    REQUESTS_CA_BUNDLE: VERIS_BUNDLE,
+    CURL_CA_BUNDLE: VERIS_BUNDLE,
+    GIT_SSL_CAINFO: VERIS_BUNDLE,
+    AWS_CA_BUNDLE: VERIS_BUNDLE,
+    CARGO_HTTP_CAINFO: VERIS_BUNDLE,
+    DENO_CERT: VERIS_BUNDLE,
+    PIP_CERT: VERIS_BUNDLE,
+    npm_config_cafile: VERIS_BUNDLE,
+    GRPC_DEFAULT_SSL_ROOTS_FILE_PATH: VERIS_BUNDLE,
+    BUNDLE_SSL_CA_CERT: VERIS_BUNDLE,
+    COMPOSER_CAFILE: VERIS_BUNDLE,
+    HEX_CACERTS_PATH: VERIS_BUNDLE,
+    JULIA_SSL_CA_ROOTS_PATH: VERIS_BUNDLE,
+    NIX_SSL_CERT_FILE: VERIS_BUNDLE,
+    PERL_LWP_SSL_CA_FILE: VERIS_BUNDLE,
+    CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE: VERIS_BUNDLE,
+    NODE_EXTRA_CA_CERTS: VERIS_BUNDLE
+  };
+}
+function trustPrelude(env = vendoredTrustEnv()) {
+  return Object.entries(env).map(([k, v]) => `export ${k}='${v.replace(/'/g, `'\\''`)}';`).join(" ");
+}
+var BUNDLED_CA_FILES = [
+  { sdk: "pip (vendored certifi)", suffix: "pip/_vendor/certifi/cacert.pem" },
+  { sdk: "certifi", suffix: "certifi/cacert.pem" },
+  { sdk: "botocore", suffix: "botocore/cacert.pem" },
+  // Matches both stripe-python's site-packages layout and the stripe-ruby gem.
+  { sdk: "stripe", suffix: "stripe/data/ca-certificates.crt" },
+  { sdk: "httplib2", suffix: "httplib2/cacerts.txt" }
+];
+var BUNDLED_CA_PATCH_SCRIPT = "/tmp/veris-patch-bundled-cas.sh";
+var BUNDLED_CA_PATCHED_MARKER = "the Veris CA was appended to ";
+function bundledCaPatchScript() {
+  const find = BUNDLED_CA_FILES.map((f) => `find / -xdev \\( -path /proc -o -path /sys -o -path /dev \\) -prune -o -path '*/${f.suffix}' -type f -print 2>/dev/null`).join("; ");
+  return [
+    `marker=$(sed -n 2p ${VERIS_CA_FILE} 2>/dev/null)`,
+    // No CA on disk means nothing to append, and appending nothing to every
+    // bundle in the image would be the worst available no-op.
+    `[ -n "$marker" ] || { echo "no ${VERIS_CA_FILE} to append" >&2; exit 1; }`,
+    // The whole loop is one brace group at the end of the pipe so `n` survives
+    // to the summary: a pipeline's last stage is a subshell, and a counter
+    // incremented inside a bare `while` would be gone by the time we report it.
+    `{ ${find}; } | sort -u | { n=0`,
+    `while IFS= read -r f; do`,
+    `  [ -w "$f" ] || continue`,
+    `  grep -qF "$marker" "$f" && continue`,
+    `  { printf '\\n'; cat ${VERIS_CA_FILE}; } >> "$f" || continue`,
+    `  n=$((n+1))`,
+    `  echo "${BUNDLED_CA_PATCHED_MARKER}$f"`,
+    `done`,
+    // Silence is the common case and it reads as "did that even run?", so say
+    // so. patchBundledCas() keeps only the lines above, so this costs it
+    // nothing.
+    `if [ "$n" -gt 0 ]; then echo "$n bundled CA file(s) patched"`,
+    `else echo "no bundled CA file needed patching \u2014 no SDK that ships its own is installed here, or they already trust the Veris CA"; fi`,
+    `}`
+  ].join("\n");
+}
+var NODE_TRUST_FLAG = "--use-openssl-ca";
+function nodeOptionsWithTrust(existing) {
+  const base = (existing ?? "").trim();
+  if (base.split(/\s+/).includes(NODE_TRUST_FLAG)) return base;
+  return base ? `${base} ${NODE_TRUST_FLAG}` : NODE_TRUST_FLAG;
+}
+var CA_INSTALL_CMD = [
+  "update-ca-certificates",
+  `(keytool -importcert -noprompt -cacerts -storepass changeit -alias veris -file ${CA_CERT_PATH} 2>/dev/null || true)`,
+  `(command -v certutil >/dev/null 2>&1 && for db in $(find /home /root -maxdepth 4 -name "cert9.db" 2>/dev/null | xargs -r -n1 dirname); do certutil -A -n veris -t "C,," -i ${CA_CERT_PATH} -d "sql:$db" 2>/dev/null || true; done || true)`
+].join(" && ");
+function sanitizeTrustEnv(served) {
+  const vendored = vendoredTrustEnv();
+  const out2 = { ...vendored };
+  for (const [k, val] of Object.entries(served ?? {})) {
+    if (!(k in vendored)) continue;
+    if (typeof val !== "string") continue;
+    if (!/^\/[\w./+~-]+$/.test(val)) continue;
+    out2[k] = val;
+  }
+  return out2;
+}
+
+// src/gateway.ts
+var HOSTNAME_RE = /^[A-Za-z0-9.-]+$/;
+var HOSTPORT_RE = /^[A-Za-z0-9.-]+:\d{1,5}$/;
+function shellQuote(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+var sh = (sandbox, cmd, timeoutSec = 60) => sandbox.process.executeCommand(`sh -lc ${shellQuote(cmd)}`, void 0, void 0, timeoutSec);
+function gatewayProxyUrl(credential) {
+  if (credential.http_proxy_url) return assertProxyUrl(credential.http_proxy_url);
+  if (!credential.connect_address || !HOSTPORT_RE.test(credential.connect_address)) {
+    throw new VerisError(
+      `the control plane returned a malformed gateway address: ${JSON.stringify(credential.connect_address)} (expected host:port)`,
+      { phase: "credential-mint" }
+    );
+  }
+  return `http://${encodeURIComponent(credential.username)}:x@${credential.connect_address}`;
+}
+async function gatewayIps(credential, proxyUrl) {
+  if (credential.gateway_ips?.length) return credential.gateway_ips;
+  const host = new URL(proxyUrl).hostname;
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(host)) return [host];
+  try {
+    return await dns.resolve4(host);
+  } catch {
+    return [];
+  }
+}
+function assertProxyUrl(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    throw new VerisError(
+      `the control plane returned an unparseable gateway proxy URL: ${JSON.stringify(raw)}`,
+      { phase: "credential-mint" }
+    );
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:") {
+    throw new VerisError(
+      `the gateway proxy URL uses scheme "${u.protocol.replace(":", "")}", and Daytona accepts only http or https outbound proxies`,
+      { phase: "credential-mint" }
+    );
+  }
+  if (!u.hostname || !u.port) {
+    throw new VerisError(
+      `the gateway proxy URL is missing a host or port: ${JSON.stringify(raw)}`,
+      { phase: "credential-mint" }
+    );
+  }
+  return raw;
+}
+async function installCa(sandbox, caPem) {
+  await sandbox.fs.uploadFile(Buffer.from(caPem, "utf8"), VERIS_CA_FILE);
+  await sandbox.fs.uploadFile(Buffer.from(bundledCaPatchScript(), "utf8"), BUNDLED_CA_PATCH_SCRIPT);
+  const script = [
+    `chmod 0644 ${VERIS_CA_FILE}`,
+    // Public roots first so they keep working; ours appended. `cat` of a
+    // missing file is tolerated — an image with no roots at all still gets a
+    // bundle containing the one CA that matters here.
+    `{ cat ${SYSTEM_BUNDLE} 2>/dev/null; cat ${VERIS_CA_FILE}; } > ${VERIS_BUNDLE}`,
+    `chmod 0644 ${VERIS_BUNDLE}`,
+    // Best-effort, for the stacks that read a store rather than a variable:
+    // the system bundle, the JVM truststore, and NSS databases. All of it needs
+    // root and tooling that may not be there, so none of it is load-bearing —
+    // but a Java client honours no CA env var at all, so where we CAN do it,
+    // we should.
+    `SUDO=; [ "$(id -u)" = 0 ] || SUDO="sudo -n"`,
+    `($SUDO install -m 0644 -D ${VERIS_CA_FILE} ${CA_CERT_PATH} 2>/dev/null && $SUDO sh -c ${shellQuote(CA_INSTALL_CMD)} 2>/dev/null) || true`,
+    // The bundle is the load-bearing one: fail loudly if it is not there.
+    `[ -s ${VERIS_BUNDLE} ] && echo __VERIS_CA_OK__`
+  ].join("; ");
+  const r = await sh(sandbox, script, 120).catch((e) => ({ exitCode: 1, result: String(e) }));
+  if (!(r.result ?? "").includes("__VERIS_CA_OK__")) {
+    throw new SnapshotUnsupportedError(
+      `could not assemble a CA bundle at ${VERIS_BUNDLE}, so the gateway's certificates cannot be trusted (${(r.result ?? "").trim().slice(0, 200)})`,
+      { phase: "ca-install" }
+    );
+  }
+}
+async function patchBundledCas(sandbox) {
+  const r = await sh(sandbox, `sh ${BUNDLED_CA_PATCH_SCRIPT}`, 180).catch((e) => ({ exitCode: 1, result: String(e) }));
+  return (r.result ?? "").split("\n").filter((line) => line.startsWith(BUNDLED_CA_PATCHED_MARKER)).map((line) => line.slice(BUNDLED_CA_PATCHED_MARKER.length).trim()).filter(Boolean);
+}
+async function probeCanary(sandbox, canaryHost, expectedTwinId) {
+  if (!HOSTNAME_RE.test(canaryHost)) {
+    throw new ReceiptIntegrityError(
+      `refusing to probe a malformed canary host from the control plane: ${JSON.stringify(canaryHost)}`,
+      { phase: "canary", verisSandboxId: expectedTwinId }
+    );
+  }
+  const r = await sh(
+    sandbox,
+    `curl -sS --cacert ${VERIS_BUNDLE} --max-time 20 https://${canaryHost}/ || echo __VERIS_CANARY_FAIL__`,
+    45
+  ).catch((e) => ({ exitCode: 1, result: String(e) }));
+  let body = {};
+  try {
+    body = JSON.parse(r.result ?? "");
+  } catch {
+  }
+  if (body.veris_sandbox_id !== expectedTwinId) {
+    throw new ReceiptIntegrityError(
+      `canary probe failed: egress from this Daytona sandbox is not tunnelled through the Veris gateway (expected twin ${expectedTwinId}, canary answered: ${(r.result || "nothing").trim().slice(0, 200)})`,
+      { phase: "canary", verisSandboxId: expectedTwinId }
+    );
+  }
+}
+
+// src/state.ts
+function assertHttpControlPlane(svc) {
+  if (!svc.control_url || !isHttpUrl(svc.control_url)) {
+    throw new VerisError(
+      `service '${svc.name}' has no HTTP control plane, so there is nothing to read`,
+      { phase: "twin-state" }
+    );
+  }
+}
+async function fetchManual(svc) {
+  assertHttpControlPlane(svc);
+  const res = await fetch(`${svc.control_url}/veris/manual`);
+  const text = await res.text();
+  if (!res.ok) {
+    throw new VerisError(`could not read the manual for service '${svc.name}' (${res.status})`, {
+      phase: "twin-state",
+      responseBody: text.slice(0, 500)
+    });
+  }
+  return text;
+}
+
+// src/veris-api.ts
+var VerisApiImpl = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  ctx;
+  get ownsTwin() {
+    return this.ctx.ownsTwin;
+  }
+  get sandboxId() {
+    return this.ctx.twinId;
+  }
+  get environmentId() {
+    return this.ctx.environmentId;
+  }
+  get mode() {
+    return "gateway";
+  }
+  services() {
+    return this.ctx.controlPlane.services(this.ctx.twinId);
+  }
+  /** Resolve a service by name. A typo and a service that exists but saw
+   *  nothing are different failures, so this throws rather than returning
+   *  undefined and letting the caller report an empty result. */
+  async resolveService(service) {
+    const services = await this.services();
+    const svc = services.find((s) => s.name === service);
+    if (!svc) {
+      throw new VerisError(
+        `unknown service '${service}' \u2014 the twin has no service by that name (available: ${services.map((s) => s.name).join(", ") || "none"})`,
+        { verisSandboxId: this.ctx.twinId }
+      );
+    }
+    return svc;
+  }
+  async manual(service) {
+    return fetchManual(await this.resolveService(service));
+  }
+  async receipt(service) {
+    await probeCanary(this.ctx.sandbox, this.ctx.canaryHost, this.ctx.twinId);
+    if (service !== void 0) {
+      const svc = await this.resolveService(service);
+      return fetchReceiptEntry(svc, this.watermark(svc.name));
+    }
+    const services = await this.services();
+    const entries = await Promise.all(
+      services.filter((s) => isHttpUrl(s.control_url)).map(async (svc) => [svc.name, await fetchReceiptEntry(svc, this.watermark(svc.name))])
+    );
+    return {
+      services: Object.fromEntries(entries),
+      mode: "gateway",
+      integrity: "verified",
+      leaks: this.leaks()
+    };
+  }
+  /**
+   * What this receipt cannot see. The gateway relays TCP, so QUIC/HTTP3 and ECH
+   * ride around it — named rather than rounded off.
+   */
+  leaks() {
+    return ["udp-quic-possible", "ech-possible"];
+  }
+  /** Where this service's log was when the run began. 0 reads all of it. */
+  watermark(service) {
+    return this.ctx.watermarks?.[service] ?? 0;
+  }
+  async verifyIntegrity() {
+    await probeCanary(this.ctx.sandbox, this.ctx.canaryHost, this.ctx.twinId);
+  }
+  async receiptBaseline() {
+    await this.verifyIntegrity();
+    return captureBaseline(
+      this.ctx.twinId,
+      this.ctx.sandbox.id,
+      (await this.services()).filter((s) => isHttpUrl(s.control_url))
+    );
+  }
+  async receiptSince(baseline, service) {
+    await this.verifyIntegrity();
+    const services = (await this.services()).filter((s) => isHttpUrl(s.control_url));
+    if (service !== void 0 && !services.some((s) => s.name === service)) {
+      throw new VerisError(`unknown HTTP service '${service}'`, { phase: "receipt" });
+    }
+    await validateBaseline(baseline, this.ctx.twinId, this.ctx.sandbox.id, services);
+    const selected = service === void 0 ? services : services.filter((s) => s.name === service);
+    const entries = await Promise.all(selected.map(async (svc) => [svc.name, await fetchReceiptEntry(svc, baseline.services[svc.name].id)]));
+    await validateBaseline(baseline, this.ctx.twinId, this.ctx.sandbox.id, await this.services().then((s) => s.filter((v) => isHttpUrl(v.control_url))));
+    return { services: Object.fromEntries(entries), mode: "gateway", integrity: "verified", leaks: this.leaks() };
+  }
+  async control(service, resource, options) {
+    const svc = (await this.services()).find((s) => s.name === service);
+    if (!svc) throw new VerisError(`unknown service '${service}'`);
+    return serviceControl(svc, resource, options);
+  }
+  async assertTouched(service, match) {
+    const entry = await this.receipt(service);
+    const need = match?.minRequests ?? 1;
+    const matched = match ? entry.entries.filter((r) => (match.method === void 0 || r.method.toUpperCase() === match.method.toUpperCase()) && (match.path === void 0 || r.path.includes(match.path))) : entry.entries;
+    if (matched.length < need && entry.capped) {
+      throw new VerisError(`receipt for '${service}' is incomplete; insufficient evidence`, { phase: "receipt" });
+    }
+    if (matched.length < need) {
+      const what = match ? `matching ${match.method ?? "ANY"} ${match.path ?? "*"} (${matched.length}/${need})` : "any intercepted requests";
+      throw new VerisUntouchedError(
+        `service '${service}' saw no ${what} \u2014 the code under test never reached it (a green run that skipped its dependency looks identical to a working one)`,
+        service,
+        { verisSandboxId: this.ctx.twinId }
+      );
+    }
+  }
+  async getDataPlaneEnv() {
+    return dataPlaneEnv(await this.services());
+  }
+  /** The CA trust vars injected at create, for callers building their own env. */
+  getTrustEnv() {
+    return vendoredTrustEnv();
+  }
+  /**
+   * The same variables as a shell prelude, for a caller that has no env map to
+   * fill — anything running a command through a session or a shell it did not
+   * build the environment for. Daytona resets SSL_CERT_FILE,
+   * REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE and NODE_EXTRA_CA_CERTS to its own CA
+   * file inside the sandbox, and that file cannot verify the gateway's leaf, so
+   * a command that inherits them fails on certificate validation:
+   * `uv sync` dies with "invalid peer certificate: UnknownIssuer".
+   *
+   *   sbx.process.executeCommand(`${sbx.veris.trustPrelude()} uv sync`)
+   */
+  trustPrelude() {
+    return trustPrelude(this.getTrustEnv());
+  }
+  /**
+   * Append the Veris CA to the CA bundles the code under test's own SDKs ship.
+   *
+   * The variables above reach every client that reads one. stripe-python does
+   * not: it passes `verify=stripe.ca_bundle_path`, so the first Stripe call
+   * fails with "Could not verify Stripe's SSL certificate" in a sandbox where
+   * curl, Node and `requests` all succeed. This patches the file itself, which
+   * is the Daytona-shaped version of the veris CLI's --patch-bundled-cas.
+   *
+   * Call it AFTER installing dependencies — the bundles arrive with them, so
+   * there is nothing to patch at create time. Safe to call again; it returns
+   * only the files it actually changed.
+   */
+  patchBundledCas() {
+    return patchBundledCas(this.ctx.sandbox);
+  }
+  async deliverTo(target, opts = {}) {
+    const url = typeof target === "number" ? (await this.ctx.sandbox.getPreviewLink(target)).url : target;
+    await this.ctx.controlPlane.updateSandbox(
+      this.ctx.environmentId,
+      this.ctx.twinId,
+      { client_base_url: url }
+    );
+    if (url !== null && opts.probe !== false) await this.probeDelivery(url);
+    return url;
+  }
+  /** Ask each service to re-probe the registered destination; throw if none can reach it. */
+  async probeDelivery(url) {
+    const services = (await this.services()).filter((s) => isHttpUrl(s.control_url));
+    if (!services.length) return;
+    const probes = await Promise.all(services.map(async (svc) => {
+      try {
+        const res = await fetch(`${svc.control_url}/veris/client/probe`, { method: "POST" });
+        return res.ok ? await res.json() : null;
+      } catch {
+        return null;
+      }
+    }));
+    if (!probes.some((p) => p?.answered)) {
+      throw new VerisError(
+        `no service could reach ${url} \u2014 is your app listening on that port inside the Daytona sandbox?`,
+        { phase: "receipt", verisSandboxId: this.ctx.twinId, responseBody: probes }
+      );
+    }
+  }
+};
+
+// src/profile.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { parse } from "yaml";
+var DEFAULT_API_BASE = "https://svc.api.veris.ai";
+function profilePath(home = homedir()) {
+  return join(home, ".veris", "twin.yaml");
+}
+function readOrUndefined(path) {
+  try {
+    return readFileSync(path, "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return void 0;
+    throw e;
+  }
+}
+function parseProfileFile(text, path) {
+  if (text === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = parse(text);
+  } catch (cause) {
+    throw new VerisError(`${path} is not valid YAML`, { phase: "credentials", cause });
+  }
+  if (parsed === null || parsed === void 0) return {};
+  if (typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new VerisError(`${path} is not a profile file (expected a mapping)`, { phase: "credentials" });
+  }
+  return parsed;
+}
+function selectProfileName(env, file) {
+  return env.VERIS_PROFILE || file?.active_profile || "default";
+}
+function resolveVerisCredentials(opts = {}) {
+  const env = opts.env ?? process.env;
+  const path = opts.path ?? profilePath();
+  const file = parseProfileFile((opts.readFile ?? readOrUndefined)(path), path);
+  const name = selectProfileName(env, file);
+  const profile = file?.profiles?.[name] ?? void 0;
+  const found = profile !== void 0 && profile !== null;
+  const apiKey = opts.apiKey || env.VERIS_API_KEY || (found ? profile.api_key : void 0) || void 0;
+  const keySource = opts.apiKey ? "option" : env.VERIS_API_KEY ? "env" : apiKey ? "profile" : "none";
+  const profileBase = found ? profile.api_base : void 0;
+  const apiBase = (opts.apiBase || env.VERIS_API_BASE || profileBase || DEFAULT_API_BASE).replace(/\/$/, "");
+  const baseSource = opts.apiBase ? "option" : env.VERIS_API_BASE ? "env" : profileBase ? "profile" : "default";
+  return { apiKey, apiBase, keySource, baseSource, profile: { name, path, found } };
+}
+function missingKeyWhere(c) {
+  const where = c.profile.found ? `profile '${c.profile.name}' in ${c.profile.path} has no api_key` : `${c.profile.path} has no profile '${c.profile.name}'`;
+  return `VERIS_API_KEY is not set, and ${where}`;
+}
+var KEY_SOURCES_HINT = "Run `veris login` (the veris CLI saves the key there; `--profile <name>` for another plane, and VERIS_PROFILE picks it here), or set VERIS_API_KEY in the environment. Get a key at https://studio.veris.ai";
+function missingKeyMessage(c) {
+  return `no Veris API key: ${missingKeyWhere(c)}. ${KEY_SOURCES_HINT}`;
+}
+function requireVerisCredentials(opts = {}) {
+  const c = resolveVerisCredentials(opts);
+  if (!c.apiKey) throw new MissingCredentialsError(missingKeyMessage(c), { phase: "credentials" });
+  return c;
+}
+
+// src/version.ts
+var SDK_VERSION = true ? "0.3.0" : "0.0.0-dev";
+
+// src/daytona.ts
+var LABEL = {
+  twinId: "veris_twin_id",
+  envId: "veris_env_id",
+  apiBase: "veris_api_base",
+  mode: "veris_mode",
+  egress: "veris_egress",
+  ownsTwin: "veris_owns_twin",
+  canaryHost: "veris_canary_host",
+  /** Unique to ONE create() call, and the only way back to a sandbox whose
+   *  create threw before it could hand the object over — see reapFailedCreate.
+   *  The twin id will not do: an attached twin is shared by every sandbox on
+   *  it, and deleting the wrong one of those would be worse than the leak. */
+  createId: "veris_create_id"
+};
+var VERIS_LABEL_KEYS = Object.values(LABEL);
+function isVerisSandbox(sbx) {
+  return typeof sbx.verisSandboxId === "string";
+}
+function verisTwinId(sandbox) {
+  return sandbox.labels?.[LABEL.twinId];
+}
+function verisOwnsTwin(sandbox) {
+  const labels = sandbox.labels ?? {};
+  return labels[LABEL.twinId] !== void 0 && labels[LABEL.ownsTwin] !== "false";
+}
+var Daytona = class extends BaseDaytona {
+  verisDefaults;
+  constructor(config) {
+    super(config);
+    this.verisDefaults = config?.veris ?? {};
+  }
+  async create(params, options) {
+    const v = { ...this.verisDefaults, ...params?.veris ?? {} };
+    const rest = stripVeris(params);
+    if (v.disabled) return this.baseCreate(rest, options);
+    const coords = resolveCoordinates(v);
+    const controlPlane = new ControlPlane({
+      apiKey: coords.apiKey,
+      apiBase: coords.apiBase,
+      sdkVersion: SDK_VERSION
+    });
+    const egress = v.egress ?? "strict";
+    const ttlMinutes = v.ttlMinutes ?? 60;
+    const ownsTwin = !v.attachSandboxId;
+    const createId = crypto.randomUUID();
+    const twin = await this.provisionTwin(controlPlane, v, coords, ttlMinutes);
+    const cleanupTwin = async () => {
+      if (ownsTwin) await controlPlane.deleteTwin(twin.environment_id, twin.id).catch(() => {
+      });
+    };
+    let sandbox;
+    let credential;
+    let watermarks = {};
+    let daytonaAsked = false;
+    try {
+      credential = await controlPlane.mintEgressCredential(twin.environment_id, twin.id);
+      if (!credential) {
+        throw new VerisGatewayNotOfferedError(
+          "this Veris control plane does not offer egress credentials, so there is no gateway for the sandbox to route through",
+          { phase: "credential-mint", verisSandboxId: twin.id }
+        );
+      }
+      if (!credential.connect_address && !credential.http_proxy_url) {
+        throw new VerisGatewayNotOfferedError(
+          'the Veris gateway offers SOCKS5 but no HTTP CONNECT endpoint, and Daytona accepts only http/https outbound proxies ("Unsupported outbound proxy scheme"). Upgrade the control plane to one that returns connect_address.',
+          { phase: "credential-mint", verisSandboxId: twin.id }
+        );
+      }
+      const services = twin.services?.length ? twin.services : await controlPlane.services(twin.id);
+      const proxyUrl = gatewayProxyUrl(credential);
+      const network = buildNetwork({ mode: egress, gatewayIps: await gatewayIps(credential, proxyUrl) });
+      watermarks = await readWatermarks(services);
+      const verisManaged = {
+        ...v.installCa !== false ? sanitizeTrustEnv(void 0) : {},
+        // Node reads none of the variables above once Daytona has overwritten
+        // them; the flag makes it read OpenSSL's store, which the CA install
+        // fills. Appended, not replaced: a caller's own NODE_OPTIONS keep working.
+        ...v.installCa !== false ? { NODE_OPTIONS: nodeOptionsWithTrust(rest.envVars?.NODE_OPTIONS) } : {},
+        // Node ignores HTTPS_PROXY unless told to, and Daytona blocks anything
+        // that dials out directly — so without this every plain `https.get`
+        // and `fetch` in Node 24+ dies with ECONNRESET instead of reaching
+        // the gateway. Older Node needs a proxy agent; the variable is inert there.
+        NODE_USE_ENV_PROXY: "1",
+        ...v.dataPlaneEnv !== false ? dataPlaneEnv(services) : {},
+        VERIS_SANDBOX_ID: twin.id
+      };
+      const createParams = {
+        ...rest,
+        envVars: { ...rest.envVars ?? {}, ...verisManaged },
+        labels: {
+          ...reserveLabels(rest.labels),
+          [LABEL.twinId]: twin.id,
+          [LABEL.envId]: twin.environment_id,
+          [LABEL.apiBase]: coords.apiBase,
+          [LABEL.egress]: egress,
+          [LABEL.ownsTwin]: String(ownsTwin),
+          [LABEL.mode]: "gateway",
+          [LABEL.canaryHost]: credential.canary_host,
+          [LABEL.createId]: createId
+        },
+        ...network.params,
+        // 3. Where Daytona forwards everything. Chained, not advisory: an
+        //    unreachable gateway makes traffic 502 rather than quietly going
+        //    direct.
+        outboundProxyUrl: proxyUrl,
+        ttlMinutes: rest.ttlMinutes ?? ttlMinutes
+      };
+      daytonaAsked = true;
+      sandbox = await this.baseCreate(createParams, options);
+    } catch (cause) {
+      const failed = daytonaAsked ? await reapFailedCreate((labels) => super.list({ labels }), createId) : void 0;
+      await cleanupTwin();
+      if (cause instanceof VerisError) throw cause;
+      throw new VerisError(sandboxCreateMessage(cause, failed, rest), {
+        phase: "sandbox-create",
+        verisSandboxId: twin.id,
+        cause
+      });
+    }
+    try {
+      await installCa(sandbox, credential.ca_pem);
+      await probeCanary(sandbox, credential.canary_host, twin.id);
+    } catch (err) {
+      await sandbox.delete().catch(() => {
+      });
+      await cleanupTwin();
+      throw err;
+    }
+    return this.attach(sandbox, {
+      controlPlane,
+      environmentId: twin.environment_id,
+      twinId: twin.id,
+      egress,
+      ownsTwin,
+      canaryHost: credential.canary_host,
+      watermarks
+    });
+  }
+  /**
+   * Rehydrate the Veris surface on an existing sandbox.
+   *
+   * Not an optimisation — a necessity. The OpenCode plugin reconnects to a
+   * sandbox with get() on every resumed session and deletes through get() too,
+   * so a get() that returned a bare Sandbox would mean no receipts after any
+   * restart and a leaked twin on every delete.
+   */
+  async get(sandboxIdOrName) {
+    const sandbox = await super.get(sandboxIdOrName);
+    return this.rehydrate(sandbox);
+  }
+  /** Same rehydration for the sandboxes a list() streams. */
+  list(query) {
+    const inner = super.list(query);
+    const rehydrate = (s) => this.rehydrate(s);
+    return (async function* () {
+      for await (const sandbox of inner) yield rehydrate(sandbox);
+    })();
+  }
+  /**
+   * Attach the Veris surface to a sandbox whose labels say it has a twin.
+   * A sandbox without our labels is passed through untouched — callers can use
+   * this client for ordinary Daytona work.
+   */
+  rehydrate(sandbox) {
+    const labels = sandbox.labels ?? {};
+    const twinId = labels[LABEL.twinId];
+    if (!twinId) return sandbox;
+    const creds = resolveVerisCredentials({ apiKey: this.verisDefaults.apiKey, apiBase: this.verisDefaults.apiBase });
+    const apiKey = creds.apiKey;
+    if (!apiKey) return sandbox;
+    const trustedBase = creds.baseSource === "default" ? void 0 : creds.apiBase;
+    const labelBase = labels[LABEL.apiBase];
+    if (trustedBase && labelBase && labelBase !== trustedBase) {
+      throw new VerisError(
+        `sandbox ${sandbox.id} labels name a different Veris control plane (${labelBase}) than your configuration (${trustedBase}) \u2014 refusing to send the API key to an unverified host`,
+        { phase: "attach" }
+      );
+    }
+    const apiBase = trustedBase ?? labelBase ?? "https://svc.api.veris.ai";
+    return this.attach(sandbox, {
+      controlPlane: new ControlPlane({ apiKey, apiBase, sdkVersion: SDK_VERSION }),
+      environmentId: labels[LABEL.envId] ?? "",
+      twinId,
+      // Re-minted below when a receipt is actually asked for; the label only
+      // has to survive the reconnect.
+      canaryHost: labels[LABEL.canaryHost] ?? "",
+      egress: labels[LABEL.egress] ?? "strict",
+      ownsTwin: labels[LABEL.ownsTwin] !== "false"
+    });
+  }
+  async provisionTwin(controlPlane, v, coords, ttlMinutes) {
+    if (v.attachSandboxId) {
+      const existing = await controlPlane.getTwin(v.attachSandboxId);
+      if (!existing) {
+        throw new VerisError(`attach target ${v.attachSandboxId} not found`, {
+          phase: "twin-provision",
+          verisSandboxId: v.attachSandboxId
+        });
+      }
+      return existing.status === "ready" ? existing : controlPlane.waitReady(v.attachSandboxId, 24e4);
+    }
+    if (!coords.environmentId) {
+      throw new MissingCredentialsError(
+        "no Veris environment: set VERIS_ENVIRONMENT_ID, or pass veris.environmentId",
+        { phase: "credentials" }
+      );
+    }
+    const created = await controlPlane.createTwin(coords.environmentId, { ttlMinutes });
+    try {
+      return await controlPlane.waitReady(created.id, 24e4);
+    } catch (e) {
+      await controlPlane.deleteTwin(coords.environmentId, created.id).catch(() => {
+      });
+      throw e;
+    }
+  }
+  /**
+   * Hang the Veris surface off the instance, and wrap delete() so teardown is
+   * automatic.
+   *
+   * Wrapping rather than asking callers to remember is the point: the OpenCode
+   * plugin's existing `sandbox.delete()` then removes the twin too, with no
+   * change to the plugin at all. A twin outlives its sandbox otherwise, until
+   * its TTL reaps it — invisible until the bill arrives.
+   */
+  attach(sandbox, ctx) {
+    if (isVerisSandbox(sandbox)) return sandbox;
+    const veris = new VerisApiImpl({ ...ctx, sandbox });
+    const originalDelete = sandbox.delete.bind(sandbox);
+    Object.defineProperties(sandbox, {
+      veris: { value: veris, enumerable: true, configurable: true },
+      verisSandboxId: { value: ctx.twinId, enumerable: true, configurable: true },
+      delete: {
+        configurable: true,
+        value: async (timeout, wait) => {
+          if (ctx.ownsTwin) {
+            await ctx.controlPlane.deleteTwin(ctx.environmentId, ctx.twinId).catch(() => {
+            });
+          }
+          return originalDelete(timeout, wait);
+        }
+      }
+    });
+    return sandbox;
+  }
+  /** super.create through the overload the params actually match. */
+  baseCreate(params, options) {
+    return super.create.call(this, params, options);
+  }
+};
+function resolveCoordinates(v) {
+  const creds = requireVerisCredentials({ apiKey: v.apiKey, apiBase: v.apiBase });
+  return {
+    apiKey: creds.apiKey,
+    environmentId: v.environmentId ?? process.env.VERIS_ENVIRONMENT_ID,
+    apiBase: creds.apiBase
+  };
+}
+async function reapFailedCreate(list, createId) {
+  try {
+    for await (const sandbox of list({ [LABEL.createId]: createId })) {
+      if (sandbox.labels?.[LABEL.createId] !== createId) continue;
+      if (!sandbox.errorReason) await sandbox.refreshData().catch(() => {
+      });
+      const found = { id: sandbox.id, state: sandbox.state, errorReason: sandbox.errorReason };
+      return { ...found, deleted: await sandbox.delete().then(() => true, () => false) };
+    }
+  } catch {
+  }
+  return void 0;
+}
+function sandboxCreateMessage(cause, failed, params = {}) {
+  const base = "Daytona sandbox create failed";
+  if (!failed) return base;
+  const reason = failed.errorReason?.trim().replace(/[.\s]+$/, "");
+  const parts = [reason ? `${base}: ${reason}.` : `${base}.`];
+  const image = typeof params.image === "string" ? params.image : void 0;
+  if (image && failed.state === "build_failed") {
+    parts.push(
+      `Daytona builds "${image}" on its own servers and pulls it from a registry, so an image that exists only in your local Docker daemon is not one it can see.`
+    );
+  }
+  parts.push(failed.deleted ? `The half-built sandbox ${failed.id} was deleted.` : `The half-built sandbox ${failed.id} could not be deleted \u2014 remove it with \`veris-daytona teardown ${failed.id}\`.`);
+  const raw = cause instanceof Error ? cause.message : "";
+  if (raw) parts.push(`(Daytona SDK: ${raw})`);
+  return parts.join(" ");
+}
+async function readWatermarks(services) {
+  const marks = await Promise.all(
+    services.filter((s) => isHttpUrl(s.control_url)).map(async (svc) => [svc.name, await fetchWatermark(svc).catch(() => 0)])
+  );
+  return Object.fromEntries(marks);
+}
+function stripVeris(params) {
+  const { veris: _veris, ...rest } = params ?? {};
+  return rest;
+}
+function reserveLabels(labels) {
+  const out2 = {};
+  for (const [k, val] of Object.entries(labels ?? {})) {
+    if (!VERIS_LABEL_KEYS.includes(k)) out2[k] = val;
+  }
+  return out2;
+}
+
+// src/run.ts
+var DEFAULT_TIMEOUT_SECONDS = 1800;
+var USAGE = `usage: veris-daytona run [options] -- <command>
+
+Runs <command> in a Daytona sandbox whose vendor API calls are answered by a
+Veris twin, then prints what the twin received.
+
+  --repo <url>              git URL to clone into the sandbox (default: upload the current directory)
+  --ref <branch>            branch to clone
+  --environment <id>        Veris environment (default: $VERIS_ENVIRONMENT_ID)
+  --sandbox <twin-id>       attach to an existing twin instead of creating one
+  --image <name>            Daytona image to run in (default: Daytona's default snapshot)
+  --snapshot <name>         Daytona snapshot to run in
+  --setup <cmd>             shell command run first, e.g. 'npm ci' or 'pip install -e .'
+  --require-service <name>  the receipt must show this service (repeatable; default: any)
+  --env KEY=VALUE           exported to the setup and main commands (repeatable)
+  --timeout <seconds>       how long <command> may run (default: ${DEFAULT_TIMEOUT_SECONDS})
+  --keep                    leave the sandbox and twin running afterwards
+
+needs: DAYTONA_API_KEY (with delete:sandboxes, or the sandbox outlives the run),
+a Veris key \u2014 VERIS_API_KEY, or the profile \`veris login\` saved in
+~/.veris/twin.yaml (VERIS_PROFILE picks one) \u2014 and VERIS_ENVIRONMENT_ID (or
+--environment). GITHUB_TOKEN or GH_TOKEN is used for a private --repo.
+
+exit code: the command's; 1 if the twin received nothing (a pass without a receipt is not a pass).`;
+var UsageError = class extends Error {
+};
+function parseRunArgs(argv) {
+  const opts = {
+    requireService: [],
+    env: {},
+    keep: false,
+    timeoutSeconds: DEFAULT_TIMEOUT_SECONDS,
+    command: ""
+  };
+  const sep = argv.indexOf("--");
+  const flags = sep === -1 ? [...argv] : argv.slice(0, sep);
+  const command = sep === -1 ? [] : argv.slice(sep + 1);
+  const takeValue = (i, flag) => {
+    const v = flags[i + 1];
+    if (v === void 0 || v.startsWith("--")) throw new UsageError(`${flag} needs a value`);
+    return v;
+  };
+  for (let i = 0; i < flags.length; i++) {
+    const flag = flags[i];
+    switch (flag) {
+      case "--repo":
+        opts.repo = takeValue(i++, flag);
+        break;
+      case "--ref":
+        opts.ref = takeValue(i++, flag);
+        break;
+      case "--environment":
+        opts.environment = takeValue(i++, flag);
+        break;
+      case "--sandbox":
+        opts.sandbox = takeValue(i++, flag);
+        break;
+      case "--image":
+        opts.image = takeValue(i++, flag);
+        break;
+      case "--snapshot":
+        opts.snapshot = takeValue(i++, flag);
+        break;
+      case "--setup":
+        opts.setup = takeValue(i++, flag);
+        break;
+      case "--require-service":
+        opts.requireService.push(takeValue(i++, flag));
+        break;
+      case "--env": {
+        const pair = takeValue(i++, flag);
+        const eq = pair.indexOf("=");
+        if (eq <= 0) throw new UsageError(`--env wants KEY=VALUE, got '${pair}'`);
+        opts.env[pair.slice(0, eq)] = pair.slice(eq + 1);
+        break;
+      }
+      case "--timeout": {
+        const n = Number(takeValue(i++, flag));
+        if (!Number.isFinite(n) || n <= 0) throw new UsageError("--timeout wants a positive number of seconds");
+        opts.timeoutSeconds = n;
+        break;
+      }
+      case "--keep":
+        opts.keep = true;
+        break;
+      case "-h":
+      case "--help":
+        throw new UsageError(USAGE);
+      default:
+        throw new UsageError(`unknown option '${flag}'
+
+${USAGE}`);
+    }
+  }
+  if (opts.image && opts.snapshot) throw new UsageError("--image and --snapshot are exclusive");
+  if (command.length === 0) throw new UsageError(`no command given: put it after '--'
+
+${USAGE}`);
+  opts.command = shellJoin(command);
+  return opts;
+}
+function shellJoin(words) {
+  return words.map((w) => /^[A-Za-z0-9_./:=@%+,-]+$/.test(w) ? w : `'${w.replace(/'/g, `'\\''`)}'`).join(" ");
+}
+function verdict(commandExitCode, receipt, requireService) {
+  const problems = [];
+  const seen = (name) => (receipt.services[name]?.requests ?? 0) > 0;
+  const total = Object.values(receipt.services).reduce((n, e) => n + (e?.requests ?? 0), 0);
+  if (requireService.length > 0) {
+    for (const name of requireService) {
+      if (!(name in receipt.services)) problems.push(`the twin has no service named '${name}'`);
+      else if (!seen(name)) problems.push(`'${name}' received ZERO requests \u2014 the code under test never called it`);
+    }
+  } else if (total === 0) {
+    problems.push("the twin received ZERO requests \u2014 the code under test never called any vendor");
+  }
+  if (commandExitCode !== 0) return { exitCode: commandExitCode, problems };
+  return { exitCode: problems.length ? 1 : 0, problems };
+}
+function formatReceipt(receipt, twinId) {
+  const lines = [`Veris receipt \u2014 twin ${twinId}`, `  interception: ${receipt.mode}   integrity: ${receipt.integrity}`];
+  if (receipt.leaks.length) lines.push(`  blind spots: ${receipt.leaks.join(", ")}`);
+  const entries = Object.entries(receipt.services);
+  const total = entries.reduce((n, [, e]) => n + (e?.requests ?? 0), 0);
+  const floor = (capped) => capped ? "\u2265" : "";
+  lines.push("", `${floor(entries.some(([, e]) => e?.capped))}${total} request(s) reached the twin:`);
+  for (const [name, entry] of entries) {
+    lines.push(`  ${name}: ${floor(entry?.capped)}${entry?.requests ?? 0} request(s)`);
+    for (const r of (entry?.entries ?? []).slice(0, 20)) {
+      lines.push(`    ${r.method} ${r.path} -> ${r.status ?? "no response"}`);
+    }
+    if ((entry?.entries.length ?? 0) > 20) lines.push(`    \u2026 ${entry.entries.length - 20} more`);
+  }
+  return lines.join("\n");
+}
+var WORK_SUBDIR = "veris-run";
+var UPLOAD_EXCLUDES = [
+  ".git",
+  "node_modules",
+  ".venv",
+  "venv",
+  "__pycache__",
+  ".pytest_cache",
+  ".mypy_cache",
+  ".ruff_cache",
+  "dist",
+  "build",
+  "target",
+  ".next",
+  ".turbo",
+  "coverage",
+  ".DS_Store"
+];
+var TIMED_OUT_EXIT = 124;
+function commandLine(cwd, env, command, timeoutSeconds) {
+  const exports = Object.entries(env).map(([k, v]) => `export ${k}=${shellQuote2(v)};`).join(" ");
+  const q = shellQuote2(command);
+  return `cd ${shellQuote2(cwd)} && ${exports} if command -v timeout >/dev/null 2>&1; then timeout -k 10 ${Math.ceil(timeoutSeconds)} sh -c ${q}; else sh -c ${q}; fi`;
+}
+function shellQuote2(s) {
+  return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+function commandEnv(trust, user) {
+  return { ...trust, ...user };
+}
+
+// src/push.ts
+function wrapped(words, width = 74) {
+  const lines = [];
+  for (const w of words) {
+    const last = lines.at(-1);
+    if (last !== void 0 && `${last}, ${w}`.length <= width) lines[lines.length - 1] = `${last}, ${w}`;
+    else lines.push(w);
+  }
+  return lines.map((l) => `  ${l}`).join("\n");
+}
+var PUSH_USAGE = `usage: veris-daytona push <daytona-sandbox-id> [options]
+
+Puts code into a sandbox that already exists \u2014 the id \`veris-daytona provision\`
+printed as daytonaSandboxId, not the Veris twin's. By default it tars the
+current directory and unpacks it in the sandbox; --repo clones instead.
+
+  --repo <url>              git URL to clone into the sandbox (default: upload the current directory)
+  --ref <branch>            branch to clone
+
+It lands in <sandbox home>/${WORK_SUBDIR} \u2014 the same path \`provision\` printed as
+workDir, so the two chain without carrying it between them. The upload leaves
+out what is rebuilt inside or is not source:
+
+${wrapped(UPLOAD_EXCLUDES)}
+
+Files of the same name are overwritten; anything else already in the directory
+is left alone.
+
+This verb exists because the Daytona CLI has no upload, copy or sync command,
+its \`ssh\` takes no remote command, and \`--context\` is a build context on
+\`create\` only.
+
+needs: DAYTONA_API_KEY. GITHUB_TOKEN or GH_TOKEN is used for a private --repo.
+A clone runs inside the sandbox and reaches the git host through the Veris
+gateway, which passes public hosts through.
+
+exit code: 0 when the code is in the sandbox; 1 when there is no such sandbox.`;
+function parsePushArgs(argv) {
+  const opts = { sandboxId: "" };
+  const ids = [];
+  const takeValue = (i, flag) => {
+    const v = argv[i + 1];
+    if (v === void 0 || v.startsWith("--")) throw new UsageError(`${flag} needs a value`);
+    return v;
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    switch (arg) {
+      case "--repo":
+        opts.repo = takeValue(i++, arg);
+        break;
+      case "--ref":
+        opts.ref = takeValue(i++, arg);
+        break;
+      case "-h":
+      case "--help":
+        throw new UsageError(PUSH_USAGE);
+      default:
+        if (arg.startsWith("-")) throw new UsageError(`unknown option '${arg}'
+
+${PUSH_USAGE}`);
+        ids.push(arg);
+    }
+  }
+  if (ids.length === 0) throw new UsageError(`no sandbox id given
+
+${PUSH_USAGE}`);
+  if (ids.length > 1) throw new UsageError(`push takes one sandbox id, got ${ids.length}: ${ids.join(" ")}`);
+  if (opts.ref && !opts.repo) throw new UsageError("--ref only means something with --repo; an upload has no branch");
+  opts.sandboxId = ids[0];
+  return opts;
+}
+
+// src/exec.ts
+var EXEC_USAGE = `usage: veris-daytona exec <daytona-sandbox-id> [options] -- <command>
+
+Runs <command> in a sandbox that already exists \u2014 the id \`veris-daytona
+provision\` printed as daytonaSandboxId \u2014 with the Veris trust environment
+applied, and streams the output as it happens.
+
+  --cwd <dir>               directory to run in (default: <sandbox home>/${WORK_SUBDIR}, provision's workDir)
+  --env KEY=VALUE           exported on top of the trust environment (repeatable)
+  --timeout <seconds>       how long <command> may run (default: ${DEFAULT_TIMEOUT_SECONDS})
+
+The trust environment is applied for you, and that is the point of the verb:
+Daytona overwrites SSL_CERT_FILE, REQUESTS_CA_BUNDLE, CURL_CA_BUNDLE and
+NODE_EXTRA_CA_CERTS inside the sandbox with its own CA file, which cannot verify
+the twin gateway's certificates, and \`daytona exec\` has no way to set a variable
+at all. Every command here is run with the Veris values exported in front of it.
+--env is applied after them and wins.
+
+Output streams rather than arriving at the end, so a long install or suite shows
+its progress. No receipt is read and no verdict is passed \u2014 take a watermark
+before and read \`veris sandbox trace --since\` after.
+
+needs: DAYTONA_API_KEY.
+
+exit code: the command's own. 124 when it ran out of --timeout; 1 when there is
+no such sandbox; 2 on a usage error.`;
+function parseExecArgs(argv) {
+  const opts = { sandboxId: "", env: {}, timeoutSeconds: DEFAULT_TIMEOUT_SECONDS, command: "" };
+  const sep = argv.indexOf("--");
+  const flags = sep === -1 ? [...argv] : argv.slice(0, sep);
+  const command = sep === -1 ? [] : argv.slice(sep + 1);
+  const ids = [];
+  const takeValue = (i, flag) => {
+    const v = flags[i + 1];
+    if (v === void 0 || v.startsWith("--")) throw new UsageError(`${flag} needs a value`);
+    return v;
+  };
+  for (let i = 0; i < flags.length; i++) {
+    const arg = flags[i];
+    switch (arg) {
+      case "--cwd":
+        opts.cwd = takeValue(i++, arg);
+        break;
+      case "--env": {
+        const pair = takeValue(i++, arg);
+        const eq = pair.indexOf("=");
+        if (eq <= 0) throw new UsageError(`--env wants KEY=VALUE, got '${pair}'`);
+        opts.env[pair.slice(0, eq)] = pair.slice(eq + 1);
+        break;
+      }
+      case "--timeout": {
+        const n = Number(takeValue(i++, arg));
+        if (!Number.isFinite(n) || n <= 0) throw new UsageError("--timeout wants a positive number of seconds");
+        opts.timeoutSeconds = n;
+        break;
+      }
+      case "-h":
+      case "--help":
+        throw new UsageError(EXEC_USAGE);
+      default:
+        if (arg.startsWith("-")) throw new UsageError(`unknown option '${arg}'
+
+${EXEC_USAGE}`);
+        ids.push(arg);
+    }
+  }
+  if (ids.length === 0) throw new UsageError(`no sandbox id given
+
+${EXEC_USAGE}`);
+  if (ids.length > 1) throw new UsageError(`exec takes one sandbox id, got ${ids.length}: ${ids.join(" ")}`);
+  if (command.length === 0) throw new UsageError(`no command given: put it after '--'
+
+${EXEC_USAGE}`);
+  opts.sandboxId = ids[0];
+  opts.command = shellJoin(command);
+  return opts;
+}
+
+// src/provision.ts
+var AUTO_STOP_MINUTES = 30;
+var AUTO_DELETE_MINUTES = 60;
+var PROVISION_TTL_MINUTES = 240;
+var PROVISION_USAGE = `usage: veris-daytona provision --sandbox <twin-id> [options]
+
+Creates a Daytona sandbox whose vendor API calls are answered by an existing
+Veris twin, and stops there: nothing is uploaded, nothing is run, nothing is
+deleted. One JSON object is printed on stdout; progress goes to stderr.
+
+  --sandbox <twin-id>       the Veris twin to attach to (required)
+  --image <name>            Daytona image to run in (default: Daytona's default snapshot)
+  --snapshot <name>         Daytona snapshot to run in
+  --env KEY=VALUE           set as a sandbox environment variable (repeatable)
+
+needs: DAYTONA_API_KEY, and a Veris key: VERIS_API_KEY, or the profile
+\`veris login\` saved in ~/.veris/twin.yaml (VERIS_PROFILE picks one; the
+environment variable wins when both exist). No VERIS_ENVIRONMENT_ID \u2014 the
+environment comes from the twin. A Daytona key without delete:sandboxes still
+provisions, with a warning that teardown will be refused.
+
+the JSON on stdout:
+  daytonaSandboxId        the Daytona sandbox id; \`veris-daytona teardown\` takes it
+  verisSandboxId          the Veris twin's id \u2014 NOT the Daytona one
+  verisEnvironmentId      the environment the twin belongs to
+  ownsTwin                false: the twin is yours, and teardown leaves it alone
+  workDir                 an empty directory to put code in and run commands from
+  caBundlePath            the CA bundle inside the sandbox (public roots + the Veris CA)
+  trustEnv                the CA variables, as a map \u2014 export them on EVERY command
+  trustPrelude            the same variables as one line of shell \`export\`s
+  patchBundledCasCommand  run it inside the sandbox after installing dependencies
+  pushCommand             how to get code in \u2014 the Daytona CLI cannot upload
+  execCommand             how to run one command in there, trustEnv already applied
+  services                the twin's service names
+  expiresAt               when Daytona destroys the sandbox whatever state it is in
+  autoStopMinutes         idle minutes before Daytona stops it
+  autoDeleteMinutes       minutes after stopping before Daytona deletes it
+
+Getting code in: the Daytona CLI has no upload, copy or sync command, its \`ssh\`
+takes no remote command, and \`--context\` is a build context on \`create\` only \u2014
+so \`veris-daytona push <daytonaSandboxId>\` is the route. It tars the current
+directory into workDir. \`veris-daytona exec <daytonaSandboxId> -- <command>\`
+then runs a command in there with trustEnv already exported and its output
+streaming, neither of which \`daytona exec\` can do.
+
+Data-plane variables (DATABASE_URL and the like) are already set inside the
+sandbox, so a command run in there inherits them.
+
+The sandbox stops after ${AUTO_STOP_MINUTES} idle minutes, is deleted ${AUTO_DELETE_MINUTES} minutes after
+it stops, and is destroyed at ${PROVISION_TTL_MINUTES} minutes old whatever state it is in \u2014 nothing
+here deletes it for you. The twin's own TTL is whatever created it.
+
+exit code: 0 when the sandbox is up and the canary answered; 2 otherwise.`;
+var RUN_ONLY = {
+  "--repo": "provision puts no code in the sandbox \u2014 clone or upload it yourself",
+  "--ref": "provision puts no code in the sandbox \u2014 clone or upload it yourself",
+  "--setup": "provision runs no commands \u2014 install dependencies yourself in the sandbox it hands back",
+  "--require-service": "provision reads no receipt, so it judges nothing \u2014 that belongs to the `veris` CLI",
+  "--timeout": "provision runs no command, so there is nothing to time out",
+  "--keep": "provision always keeps the sandbox; delete it with `veris-daytona teardown`",
+  "--environment": "the environment comes from the twin named by --sandbox"
+};
+function parseProvisionArgs(argv) {
+  const opts = { sandbox: "", env: {} };
+  const takeValue = (i, flag) => {
+    const v = argv[i + 1];
+    if (v === void 0 || v.startsWith("--")) throw new UsageError(`${flag} needs a value`);
+    return v;
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const flag = argv[i];
+    if (flag === "--") {
+      throw new UsageError(
+        `provision runs no command, so there is nothing to put after '--'. Use \`veris-daytona run\` for that, or run your command in the sandbox provision hands back.`
+      );
+    }
+    if (flag in RUN_ONLY) throw new UsageError(`${flag} is a \`run\` flag: ${RUN_ONLY[flag]}`);
+    switch (flag) {
+      case "--sandbox":
+        opts.sandbox = takeValue(i++, flag);
+        break;
+      case "--image":
+        opts.image = takeValue(i++, flag);
+        break;
+      case "--snapshot":
+        opts.snapshot = takeValue(i++, flag);
+        break;
+      case "--env": {
+        const pair = takeValue(i++, flag);
+        const eq = pair.indexOf("=");
+        if (eq <= 0) throw new UsageError(`--env wants KEY=VALUE, got '${pair}'`);
+        opts.env[pair.slice(0, eq)] = pair.slice(eq + 1);
+        break;
+      }
+      case "-h":
+      case "--help":
+        throw new UsageError(PROVISION_USAGE);
+      default:
+        throw new UsageError(`unknown option '${flag}'
+
+${PROVISION_USAGE}`);
+    }
+  }
+  if (opts.image && opts.snapshot) throw new UsageError("--image and --snapshot are exclusive");
+  if (!opts.sandbox) {
+    throw new UsageError(
+      `--sandbox is required: provision attaches to a twin that already exists (\`veris up\` prints its id)
+
+${PROVISION_USAGE}`
+    );
+  }
+  return opts;
+}
+function provisionResult(facts) {
+  return {
+    daytonaSandboxId: facts.daytonaSandboxId,
+    verisSandboxId: facts.verisSandboxId,
+    verisEnvironmentId: facts.verisEnvironmentId,
+    // provision requires --sandbox, so the twin is always the caller's.
+    ownsTwin: false,
+    workDir: facts.workDir,
+    caBundlePath: VERIS_BUNDLE,
+    trustEnv: facts.trustEnv,
+    trustPrelude: trustPrelude(facts.trustEnv),
+    // The script is already in the sandbox — installCa uploads it at create,
+    // precisely so that whoever installs the dependencies can patch the bundles
+    // afterwards without holding this SDK. Naming the command here is the whole
+    // of "how a caller patches bundled CAs": one line of shell, no third verb.
+    patchBundledCasCommand: `sh ${BUNDLED_CA_PATCH_SCRIPT}`,
+    // Named with the id already in them, because the gap this closes is a
+    // caller who reads the JSON, finds workDir, and has nothing that can put a
+    // file there — the trial wrote a Node script against @daytona/sdk to do it.
+    pushCommand: `veris-daytona push ${facts.daytonaSandboxId}`,
+    execCommand: `veris-daytona exec ${facts.daytonaSandboxId} -- <command>`,
+    services: facts.services,
+    expiresAt: facts.expiresAt,
+    autoStopMinutes: AUTO_STOP_MINUTES,
+    autoDeleteMinutes: AUTO_DELETE_MINUTES
+  };
+}
+function provisionJson(result) {
+  return JSON.stringify(result, null, 2);
+}
+
+// src/daytona-key.ts
+var DAYTONA_API_URL = "https://app.daytona.io/api";
+var DELETE_SANDBOXES = "delete:sandboxes";
+function daytonaApiUrl(env = process.env) {
+  return (env.DAYTONA_API_URL || env.DAYTONA_SERVER_URL || DAYTONA_API_URL).replace(/\/$/, "");
+}
+async function fetchDaytonaKey(apiKey, apiUrl = daytonaApiUrl()) {
+  try {
+    const res = await fetch(`${apiUrl}/api-keys/current`, {
+      headers: { Authorization: `Bearer ${apiKey}` }
+    });
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    if (!Array.isArray(body.permissions)) return void 0;
+    return {
+      name: typeof body.name === "string" ? body.name : "",
+      permissions: body.permissions.filter((p) => typeof p === "string")
+    };
+  } catch {
+    return void 0;
+  }
+}
+function canDeleteSandboxes(key) {
+  return key === void 0 ? void 0 : key.permissions.includes(DELETE_SANDBOXES);
+}
+function describeKey(key) {
+  const name = key.name ? `"${key.name}" ` : "";
+  return `${name}(permissions: ${key.permissions.join(", ") || "none"})`;
+}
+var DELETE_PERMISSION_FIX = 'create a key with the "delete sandboxes" permission at https://app.daytona.io/dashboard/keys';
+function cannotTeardownWarning(key, autoStopMinutes, autoDeleteMinutes) {
+  return `DAYTONA_API_KEY ${describeKey(key)} lacks \`${DELETE_SANDBOXES}\`, so \`veris-daytona teardown\` will be refused for the sandbox about to be created, and \`run\` cannot delete its own. The box still stops after ${autoStopMinutes} idle minutes and is deleted ${autoDeleteMinutes} minutes after it stops. For a teardown that works, ${DELETE_PERMISSION_FIX} and use it instead.`;
+}
+
+// src/teardown.ts
+var TEARDOWN_USAGE = `usage: veris-daytona teardown <daytona-sandbox-id>
+
+Deletes the Daytona sandbox. The id is the one \`veris-daytona provision\`
+printed as daytonaSandboxId \u2014 not the Veris twin's id.
+
+The twin follows the rule it was created under: one this package created is
+deleted with the sandbox, one it attached to (\`provision\`, or \`run --sandbox\`)
+is yours and is left running. Which of the two happened is printed.
+
+needs: DAYTONA_API_KEY with the ${DELETE_SANDBOXES} permission \u2014 a key made with
+"write sandboxes" alone is refused, and the refusal says when Daytona will stop
+and delete the box on its own. To reach a twin that must be deleted, a Veris
+key too: VERIS_API_KEY, or the profile \`veris login\` saved.
+
+exit code: 0 when the sandbox is deleted; 1 when there is no such sandbox, or
+the key may not delete one.`;
+function isPermissionDenied(e) {
+  return typeof e === "object" && e !== null && e.statusCode === 403;
+}
+function sandboxBrakes(r) {
+  const stop = r.autoStopMinutes && r.autoStopMinutes > 0 ? `stops after ${r.autoStopMinutes} idle minutes` : "never stops on its own";
+  const del = r.autoDeleteMinutes === void 0 || r.autoDeleteMinutes < 0 ? "is never auto-deleted" : r.autoDeleteMinutes === 0 ? "is deleted as soon as it stops" : `is deleted ${r.autoDeleteMinutes} minutes after it stops`;
+  const destroy = r.expiresAt ? `, and is destroyed at ${r.expiresAt} whatever state it is in` : "";
+  return `${stop} and ${del}${destroy}`;
+}
+function teardownRefusedMessage(r) {
+  const key = r.key ? `this DAYTONA_API_KEY ${describeKey(r.key)} lacks the \`${DELETE_SANDBOXES}\` permission` : `Daytona answered 403 (Access denied), which is what a DAYTONA_API_KEY without the \`${DELETE_SANDBOXES}\` permission gets \u2014 the key's own record could not be read to confirm it`;
+  const twin = r.twinId === void 0 ? "" : r.ownsTwin ? ` Its twin ${r.twinId} was deleted before Daytona refused, so nothing is left on the Veris side.` : ` Twin ${r.twinId} is yours and was not touched.`;
+  return `Daytona refused to delete sandbox ${r.sandboxId}: ${key}. The sandbox is still there: it ${sandboxBrakes(r)}.${twin} To delete it sooner, ${DELETE_PERMISSION_FIX}, then run \`veris-daytona teardown ${r.sandboxId}\` with it \u2014 or delete the sandbox in the Daytona dashboard.`;
+}
+function parseTeardownArgs(argv) {
+  const ids = [];
+  for (const arg of argv) {
+    if (arg === "-h" || arg === "--help") throw new UsageError(TEARDOWN_USAGE);
+    if (arg.startsWith("-")) throw new UsageError(`unknown option '${arg}'
+
+${TEARDOWN_USAGE}`);
+    ids.push(arg);
+  }
+  if (ids.length === 0) throw new UsageError(`no sandbox id given
+
+${TEARDOWN_USAGE}`);
+  if (ids.length > 1) {
+    throw new UsageError(`teardown takes one sandbox id, got ${ids.length}: ${ids.join(" ")}`);
+  }
+  return { sandboxId: ids[0] };
+}
+
+// src/cli.ts
+var out = (msg) => process.stdout.write(msg + "\n");
+var say = (msg) => process.stderr.write(`\x1B[1m\xBB ${msg}\x1B[0m
+`);
+var note = (msg) => process.stderr.write(`  \x1B[2m${msg}\x1B[0m
+`);
+var ROOT_USAGE = `usage: veris-daytona <command> [options]
+
+  run         run a command in a wired sandbox, print the receipt, delete everything
+  provision   create a wired sandbox on an existing twin, print its JSON, and stop
+  push        put code into a sandbox that already exists
+  exec        run one command in a sandbox, with the Veris trust environment applied
+  teardown    delete a sandbox that provision (or run --keep) left behind
+
+veris-daytona <command> --help describes each one.`;
+var HELP_TEXTS = [ROOT_USAGE, USAGE, PROVISION_USAGE, PUSH_USAGE, EXEC_USAGE, TEARDOWN_USAGE];
+async function main(argv) {
+  const [verb, ...rest] = argv;
+  if (verb === "--version" || verb === "-v") {
+    out(SDK_VERSION);
+    return 0;
+  }
+  switch (verb) {
+    case "run": {
+      const opts = parseOrExit(() => parseRunArgs(rest));
+      return typeof opts === "number" ? opts : run(opts);
+    }
+    case "provision": {
+      const opts = parseOrExit(() => parseProvisionArgs(rest));
+      return typeof opts === "number" ? opts : provision(opts);
+    }
+    case "push": {
+      const opts = parseOrExit(() => parsePushArgs(rest));
+      return typeof opts === "number" ? opts : push(opts);
+    }
+    case "exec": {
+      const opts = parseOrExit(() => parseExecArgs(rest));
+      return typeof opts === "number" ? opts : exec(opts);
+    }
+    case "teardown": {
+      const opts = parseOrExit(() => parseTeardownArgs(rest));
+      return typeof opts === "number" ? opts : teardown(opts);
+    }
+    default:
+      process.stderr.write(ROOT_USAGE + "\n");
+      return verb === void 0 || verb === "--help" || verb === "-h" ? 0 : 2;
+  }
+}
+function parseOrExit(parse2) {
+  try {
+    return parse2();
+  } catch (e) {
+    if (!(e instanceof UsageError)) throw e;
+    process.stderr.write(e.message + "\n");
+    return HELP_TEXTS.includes(e.message) ? 0 : 2;
+  }
+}
+async function run(opts) {
+  const daytonaKey = requireDaytonaKey();
+  if (!daytonaKey) return 2;
+  await warnIfCannotDelete(daytonaKey);
+  const ttlMinutes = Math.ceil(opts.timeoutSeconds / 60) + 30;
+  say(opts.sandbox ? `Creating the Daytona sandbox on twin ${opts.sandbox}` : "Creating the Daytona sandbox and its Veris twin");
+  const daytona = new Daytona({ apiKey: daytonaKey });
+  const created = await daytona.create({
+    ...opts.image ? { image: opts.image } : {},
+    ...opts.snapshot ? { snapshot: opts.snapshot } : {},
+    // A run deletes its own sandbox, so these two only ever matter when it
+    // could not: --keep, a crash, a machine that went away mid-run. Daytona's
+    // own auto-stop default is 15 minutes and auto-delete is off entirely, so
+    // saying them out loud is the difference between a stranded box costing an
+    // hour and costing until someone notices.
+    autoStopInterval: AUTO_STOP_MINUTES,
+    autoDeleteInterval: AUTO_DELETE_MINUTES,
+    veris: {
+      environmentId: opts.environment,
+      attachSandboxId: opts.sandbox,
+      ttlMinutes
+    }
+  }, { timeout: 300 });
+  if (!isVerisSandbox(created)) throw new VerisError("create() returned a sandbox with no Veris surface");
+  const sandbox = created;
+  note(`Daytona sandbox ${sandbox.id}`);
+  note(`Veris twin      ${sandbox.verisSandboxId}`);
+  let code = 2;
+  try {
+    const root = await sandboxRoot(sandbox);
+    const work = `${root}/${WORK_SUBDIR}`;
+    await putCode(sandbox, root, work, opts.repo, opts.ref);
+    const env = commandEnv(sandbox.veris.getTrustEnv(), opts.env);
+    if (opts.setup) {
+      say(`Setup: ${opts.setup}`);
+      const setup = await stream(sandbox, opts.setup, work, env, opts.timeoutSeconds);
+      if (setup !== 0) {
+        process.stderr.write(`
+setup exited ${setup}; not running the command
+`);
+        return setup;
+      }
+    }
+    const patched = await sandbox.veris.patchBundledCas();
+    for (const file of patched) note(`${BUNDLED_CA_PATCHED_MARKER}${file}`);
+    if (patched.length) note(`${patched.length} bundled CA file(s) patched`);
+    say(`Running: ${opts.command}`);
+    const commandExit = await stream(sandbox, opts.command, work, env, opts.timeoutSeconds);
+    note(`exit ${commandExit}`);
+    say("Reading the receipt");
+    const receipt = await sandbox.veris.receipt();
+    out("");
+    out(formatReceipt(receipt, sandbox.verisSandboxId));
+    const v = verdict(commandExit, receipt, opts.requireService);
+    for (const p of v.problems) process.stderr.write(`
+\x1B[31m\u2717\x1B[0m ${p}`);
+    if (v.problems.length) process.stderr.write("\n  Do not report this run as working.\n");
+    code = v.exitCode;
+    return code;
+  } finally {
+    const owns = verisOwnsTwin(sandbox);
+    if (opts.keep) {
+      say(owns ? "Keeping the sandbox and twin (--keep)" : "Keeping the sandbox (--keep); the twin was already yours");
+      note(`VERIS_SANDBOX_ID=${sandbox.verisSandboxId}`);
+      note(`daytona sandbox: ${sandbox.id}`);
+      note(owns ? `delete both with: veris-daytona teardown ${sandbox.id}` : `delete the sandbox with: veris-daytona teardown ${sandbox.id}   # your twin is left alone`);
+    } else {
+      say(owns ? "Deleting the sandbox and twin" : `Deleting the sandbox; twin ${sandbox.verisSandboxId} is yours and is left running`);
+      try {
+        await sandbox.delete();
+      } catch (e) {
+        const why = isPermissionDenied(e) ? await refusedMessage(daytonaKey, sandbox, owns) : String(e);
+        process.stderr.write(`  cleanup failed: ${why}
+`);
+      }
+    }
+  }
+}
+async function provision(opts) {
+  const daytonaKey = requireDaytonaKey();
+  if (!daytonaKey) return 2;
+  await warnIfCannotDelete(daytonaKey);
+  const createdAt = Date.now();
+  say(`Creating the Daytona sandbox on twin ${opts.sandbox}`);
+  const created = await new Daytona({ apiKey: daytonaKey }).create({
+    ...opts.image ? { image: opts.image } : {},
+    ...opts.snapshot ? { snapshot: opts.snapshot } : {},
+    // The only place a caller's --env can land: there is no command here to
+    // export it in front of, so it is set on the sandbox and every command run
+    // in there inherits it. Veris-managed variables still win — see create().
+    ...Object.keys(opts.env).length ? { envVars: opts.env } : {},
+    // Load-bearing here in a way they are not in `run`: nothing deletes this
+    // box afterwards, so these are what stop an abandoned one from billing.
+    autoStopInterval: AUTO_STOP_MINUTES,
+    autoDeleteInterval: AUTO_DELETE_MINUTES,
+    veris: {
+      attachSandboxId: opts.sandbox,
+      // The Daytona box's wall-clock backstop. It does not move the twin's own
+      // TTL: an attached twin is never created here, so its life was already
+      // decided by whoever made it.
+      ttlMinutes: PROVISION_TTL_MINUTES
+    }
+  }, { timeout: 300 });
+  if (!isVerisSandbox(created)) throw new VerisError("create() returned a sandbox with no Veris surface");
+  const sandbox = created;
+  note(`Daytona sandbox ${sandbox.id}`);
+  note(`Veris twin      ${sandbox.verisSandboxId}`);
+  const work = `${await sandboxRoot(sandbox)}/${WORK_SUBDIR}`;
+  const mkdir = await sandbox.process.executeCommand(`mkdir -p ${shellQuote2(work)}`, void 0, void 0, 60);
+  if (mkdir.exitCode !== 0) throw new VerisError(`could not create ${work} in the sandbox: ${mkdir.result}`);
+  const services = await sandbox.veris.services();
+  say("Ready. The sandbox is up, trusted, and running nothing");
+  note(`put code in:   veris-daytona push ${sandbox.id}`);
+  note(`run something: veris-daytona exec ${sandbox.id} -- <command>`);
+  note(`delete it:     veris-daytona teardown ${sandbox.id}`);
+  out(provisionJson(provisionResult({
+    daytonaSandboxId: sandbox.id,
+    verisSandboxId: sandbox.verisSandboxId,
+    verisEnvironmentId: sandbox.veris.environmentId,
+    workDir: work,
+    trustEnv: sandbox.veris.getTrustEnv(),
+    services: services.map((s) => s.name),
+    // Daytona's own answer where it gives one: it is the authority on when the
+    // box dies, and the local sum can only estimate the moment it began.
+    expiresAt: sandbox.autoDestroyAt ?? new Date(createdAt + PROVISION_TTL_MINUTES * 6e4).toISOString()
+  })));
+  return 0;
+}
+async function push(opts) {
+  const daytonaKey = requireDaytonaKey();
+  if (!daytonaKey) return 2;
+  const sandbox = await getSandbox(daytonaKey, opts.sandboxId);
+  if (typeof sandbox === "number") return sandbox;
+  const root = await sandboxRoot(sandbox);
+  await putCode(sandbox, root, `${root}/${WORK_SUBDIR}`, opts.repo, opts.ref);
+  return 0;
+}
+async function exec(opts) {
+  const daytonaKey = requireDaytonaKey();
+  if (!daytonaKey) return 2;
+  const sandbox = await getSandbox(daytonaKey, opts.sandboxId);
+  if (typeof sandbox === "number") return sandbox;
+  const wired = verisTwinId(sandbox) !== void 0;
+  if (!wired) note(`${sandbox.id} has no Veris twin, so there is no trust environment to apply`);
+  const trust = !wired ? {} : isVerisSandbox(sandbox) ? sandbox.veris.getTrustEnv() : vendoredTrustEnv();
+  const cwd = opts.cwd ?? `${await sandboxRoot(sandbox)}/${WORK_SUBDIR}`;
+  say(`Running in ${cwd}: ${opts.command}`);
+  const code = await stream(sandbox, opts.command, cwd, commandEnv(trust, opts.env), opts.timeoutSeconds);
+  note(`exit ${code}`);
+  return code;
+}
+async function teardown(opts) {
+  const daytonaKey = requireDaytonaKey();
+  if (!daytonaKey) return 2;
+  const sandbox = await getSandbox(daytonaKey, opts.sandboxId, " No Veris twin was touched.");
+  if (typeof sandbox === "number") return sandbox;
+  const twinId = verisTwinId(sandbox);
+  const owns = verisOwnsTwin(sandbox);
+  if (owns && !isVerisSandbox(sandbox)) {
+    process.stderr.write(
+      `sandbox ${sandbox.id} owns Veris twin ${twinId}, and no Veris API key was found (${missingKeyWhere(resolveVerisCredentials())}), so the twin cannot be deleted. Run \`veris login\` or set VERIS_API_KEY and run this again, or the twin outlives the sandbox until its TTL. Nothing was deleted.
+`
+    );
+    return 2;
+  }
+  say(owns ? `Deleting the sandbox and twin ${twinId}` : twinId ? `Deleting the sandbox; twin ${twinId} is yours and is left running` : "Deleting the sandbox (it has no Veris twin)");
+  try {
+    await sandbox.delete();
+  } catch (e) {
+    if (!isPermissionDenied(e)) throw e;
+    process.stderr.write(`${await refusedMessage(daytonaKey, sandbox, owns)}
+`);
+    return 1;
+  }
+  note(`deleted ${sandbox.id}`);
+  return 0;
+}
+function requireDaytonaKey() {
+  const key = process.env.DAYTONA_API_KEY;
+  if (!key) process.stderr.write("DAYTONA_API_KEY is not set. Get one at https://app.daytona.io/dashboard/keys\n");
+  return key;
+}
+async function warnIfCannotDelete(daytonaKey) {
+  const key = await fetchDaytonaKey(daytonaKey);
+  if (key && canDeleteSandboxes(key) === false) {
+    process.stderr.write(`\x1B[33m!\x1B[0m ${cannotTeardownWarning(key, AUTO_STOP_MINUTES, AUTO_DELETE_MINUTES)}
+`);
+  }
+}
+async function refusedMessage(daytonaKey, sandbox, ownsTwin) {
+  return teardownRefusedMessage({
+    sandboxId: sandbox.id,
+    twinId: verisTwinId(sandbox),
+    ownsTwin,
+    autoStopMinutes: sandbox.autoStopInterval,
+    autoDeleteMinutes: sandbox.autoDeleteInterval,
+    expiresAt: sandbox.autoDestroyAt,
+    key: await fetchDaytonaKey(daytonaKey)
+  });
+}
+async function getSandbox(apiKey, id, tail = "") {
+  try {
+    return await new Daytona({ apiKey }).get(id);
+  } catch (e) {
+    if (!(e instanceof DaytonaNotFoundError)) throw e;
+    process.stderr.write(
+      `no Daytona sandbox '${id}' \u2014 already deleted, or it belongs to another organization than this DAYTONA_API_KEY.${tail}
+`
+    );
+    return 1;
+  }
+}
+async function putCode(sandbox, root, work, repo, ref) {
+  if (repo) {
+    say(`Cloning ${repo}${ref ? ` (${ref})` : ""}`);
+    const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN;
+    const auth = token && /github\.com/.test(repo) ? ["x-access-token", token] : [void 0, void 0];
+    await sandbox.git.clone(repo, work, ref, void 0, auth[0], auth[1], void 0, 1);
+    note(`cloned into ${work}`);
+    return;
+  }
+  say(`Uploading ${process.cwd()}`);
+  const archive = packCwd();
+  note(`${(archive.length / 1024 / 1024).toFixed(1)} MB after excluding ${UPLOAD_EXCLUDES.join(", ")}`);
+  const tgz = `${root}/${WORK_SUBDIR}.tgz`;
+  await sandbox.fs.uploadFile(archive, tgz, 300);
+  const unpack = await sandbox.process.executeCommand(
+    `mkdir -p ${shellQuote2(work)} && tar xzf ${shellQuote2(tgz)} -C ${shellQuote2(work)} && rm ${shellQuote2(tgz)}`,
+    void 0,
+    void 0,
+    120
+  );
+  if (unpack.exitCode !== 0) throw new VerisError(`unpacking the upload failed: ${unpack.result}`);
+  note(`unpacked into ${work}`);
+}
+async function sandboxRoot(sandbox) {
+  const root = await sandbox.getWorkDir() ?? await sandbox.getUserRootDir() ?? "/home/daytona";
+  return root.replace(/\/$/, "");
+}
+function packCwd() {
+  const args = ["czf", "-", ...UPLOAD_EXCLUDES.map((x) => `--exclude=${x}`), "-C", process.cwd(), "."];
+  return execFileSync("tar", args, {
+    maxBuffer: 1024 * 1024 * 1024,
+    // macOS bsdtar writes an AppleDouble `._name` beside every file it packs.
+    // Measured in the sandbox: a two-file upload arrived as `smoke.py`,
+    // `trust_check.py`, `._smoke.py`, `._trust_check.py` and a bare `._.` —
+    // resource forks for a Linux box that will never read one. The variable is
+    // ignored everywhere else, so it costs nothing on Linux.
+    env: { ...process.env, COPYFILE_DISABLE: "1" }
+  });
+}
+async function stream(sandbox, command, cwd, env, timeoutSeconds) {
+  const session = `veris-run-${randomUUID2().slice(0, 8)}`;
+  await sandbox.process.createSession(session);
+  let timer;
+  try {
+    const started = await sandbox.process.executeSessionCommand(
+      session,
+      { command: commandLine(cwd, env, command, timeoutSeconds), runAsync: true },
+      60
+    );
+    const cmdId = started.cmdId;
+    if (!cmdId) throw new VerisError("Daytona did not return a command id for the session command");
+    const backstopMs = (timeoutSeconds + 30) * 1e3;
+    const backstop = new Promise((resolve) => {
+      timer = setTimeout(() => resolve("timeout"), backstopMs);
+    });
+    const logs = sandbox.process.getSessionCommandLogs(
+      session,
+      cmdId,
+      (chunk) => process.stdout.write(chunk),
+      (chunk) => process.stderr.write(chunk)
+    ).then(() => "done");
+    if (await Promise.race([logs, backstop]) === "timeout") {
+      process.stderr.write(`
+command still running after ${timeoutSeconds}s; stopping it
+`);
+      return TIMED_OUT_EXIT;
+    }
+    const deadline = Date.now() + 3e4;
+    for (; ; ) {
+      const cmd = await sandbox.process.getSessionCommand(session, cmdId);
+      if (typeof cmd.exitCode === "number") {
+        if (cmd.exitCode === TIMED_OUT_EXIT) process.stderr.write(`
+command timed out after ${timeoutSeconds}s
+`);
+        return cmd.exitCode;
+      }
+      if (Date.now() > deadline) throw new VerisError("command finished but Daytona never reported its exit code");
+      await new Promise((r) => setTimeout(r, 500));
+    }
+  } finally {
+    if (timer) clearTimeout(timer);
+    await sandbox.process.deleteSession(session).catch(() => {
+    });
+  }
+}
+main(process.argv.slice(2)).then(
+  (code) => process.exit(code),
+  (err) => {
+    const e = err;
+    process.stderr.write(`
+\x1B[31mFAILED\x1B[0m ${e?.message ?? err}
+`);
+    if (e?.phase) process.stderr.write(`  phase: ${e.phase}
+`);
+    if (e?.responseBody) process.stderr.write(`  body:  ${JSON.stringify(e.responseBody).slice(0, 400)}
+`);
+    process.exit(2);
+  }
+);
+export {
+  main
+};
+//# sourceMappingURL=cli.js.map