ppio-sandbox 2.0.0-a2 → 2.0.2-a1

package/dist/code-interpreter.js

@@ -100,13 +100,16 @@ __export(code_interpreter_exports, {
   Sandbox: () => Sandbox2,
   SandboxError: () => SandboxError,
   SandboxNotFoundError: () => SandboxNotFoundError,
+  Secret: () => Secret,
+  SecretError: () => SecretError,
   Template: () => Template,
+  TemplateApi: () => TemplateApi,
   TemplateBase: () => TemplateBase,
   TemplateError: () => TemplateError,
+  TemplatePaginator: () => TemplatePaginator,
   TimeoutError: () => TimeoutError,
   Volume: () => Volume,
   VolumeError: () => VolumeError,
-  VolumeFileType: () => VolumeFileType,
   default: () => code_interpreter_default,
   defaultBuildLogger: () => defaultBuildLogger,
   getSignature: () => getSignature,
@@ -125,7 +128,7 @@ var import_openapi_fetch = __toESM(require("openapi-fetch"));
 var import_platform2 = __toESM(require("platform"));
 
 // package.json
-var version = "2.0.0-a2";
+var version = "2.0.2-a1";
 
 // src/core/utils.ts
 var import_platform = __toESM(require("platform"));
@@ -333,6 +336,12 @@ var VolumeError = class extends Error {
     this.name = "VolumeError";
   }
 };
+var SecretError = class extends SandboxError {
+  constructor(message, stackTrace) {
+    super(message, stackTrace);
+    this.name = "SecretError";
+  }
+};
 
 // src/core/logs.ts
 function formatLog(log) {
@@ -376,10 +385,10 @@ function createRpcLogger(logger) {
 }
 function createApiLogger(logger) {
   return {
-    async onRequest({ request }) {
+    async onRequest({ request: request2 }) {
       var _a3;
-      (_a3 = logger.info) == null ? void 0 : _a3.call(logger, `Request ${request.method} ${request.url}`);
-      return request;
+      (_a3 = logger.info) == null ? void 0 : _a3.call(logger, `Request ${request2.method} ${request2.url}`);
+      return request2;
     },
     async onResponse({ response }) {
       var _a3, _b;
@@ -455,12 +464,27 @@ var REQUEST_TIMEOUT_MS = 6e4;
 var DEFAULT_SANDBOX_TIMEOUT_MS = 3e5;
 var KEEPALIVE_PING_INTERVAL_SEC = 50;
 var KEEPALIVE_PING_HEADER = "Keepalive-Ping-Interval";
+var LEGACY_DOMAINS = ["sandbox.ppio.cn", "cn-beijing-1.sandbox.ppio.com"];
+function isLegacyDomain(domain) {
+  return domain ? LEGACY_DOMAINS.includes(domain) : true;
+}
+function raiseIfLegacy(config, feature, ErrorType = Error) {
+  if (config.isLegacyDomain) {
+    throw new ErrorType(`${feature} is not supported on legacy domains`);
+  }
+}
+function validateDomain(domain) {
+  if (!domain) {
+    throw new Error("Domain cannot be empty");
+  }
+}
 var _ConnectionConfig = class _ConnectionConfig {
   constructor(opts) {
     var _a3;
     this.apiKey = (opts == null ? void 0 : opts.apiKey) || _ConnectionConfig.apiKey;
     this.debug = (opts == null ? void 0 : opts.debug) || _ConnectionConfig.debug;
     this.domain = (opts == null ? void 0 : opts.domain) || _ConnectionConfig.domain;
+    this.isLegacyDomain = isLegacyDomain(this.domain);
     this.accessToken = (opts == null ? void 0 : opts.accessToken) || _ConnectionConfig.accessToken;
     this.requestTimeoutMs = (_a3 = opts == null ? void 0 : opts.requestTimeoutMs) != null ? _a3 : REQUEST_TIMEOUT_MS;
     this.logger = opts == null ? void 0 : opts.logger;
@@ -861,6 +885,9 @@ var Filesystem2 = class {
       return new Uint8Array(res.data);
     }
     if (res.response.headers.get("content-length") === "0") {
+      if (format === "blob") {
+        return new Blob([]);
+      }
       return "";
     }
     return res.data;
@@ -2373,64 +2400,7 @@ var Git = class {
   }
 };
 
-// src/core/volume/client.ts
-var import_openapi_fetch3 = __toESM(require("openapi-fetch"));
-var FILE_TIMEOUT_MS = 36e5;
-var VolumeConnectionConfig = class _VolumeConnectionConfig {
-  constructor(volume, opts) {
-    var _a3, _b;
-    this.domain = (opts == null ? void 0 : opts.domain) || volume.domain || _VolumeConnectionConfig.domain;
-    this.debug = (_b = (_a3 = opts == null ? void 0 : opts.debug) != null ? _a3 : volume.debug) != null ? _b : _VolumeConnectionConfig.debug;
-    this.apiUrl = (opts == null ? void 0 : opts.apiUrl) || _VolumeConnectionConfig.volumeApiUrl || (this.debug ? "http://localhost:8080" : `https://api.${this.domain}`);
-    this.token = (opts == null ? void 0 : opts.token) || volume.token;
-    this.headers = opts == null ? void 0 : opts.headers;
-    this.logger = opts == null ? void 0 : opts.logger;
-    this.requestTimeoutMs = opts == null ? void 0 : opts.requestTimeoutMs;
-  }
-  static get domain() {
-    return getEnvVar("PPIO_DOMAIN") || "sandbox.ppio.cn";
-  }
-  static get debug() {
-    return (getEnvVar("PPIO_DEBUG") || "false").toLowerCase() === "true";
-  }
-  static get volumeApiUrl() {
-    return getEnvVar("PPIO_SANDBOX_VOLUME_API_URL");
-  }
-  getSignal(requestTimeoutMs) {
-    const timeout = requestTimeoutMs != null ? requestTimeoutMs : this.requestTimeoutMs;
-    return timeout ? AbortSignal.timeout(timeout) : void 0;
-  }
-};
-var VolumeApiClient = class {
-  constructor(config) {
-    this.api = (0, import_openapi_fetch3.default)({
-      baseUrl: config.apiUrl,
-      headers: __spreadValues(__spreadValues(__spreadValues({}, defaultHeaders), config.token && { Authorization: `Bearer ${config.token}` }), config.headers)
-    });
-    if (config.logger) {
-      this.api.use(createApiLogger(config.logger));
-    }
-  }
-};
-
-// src/core/volume/types.ts
-var VolumeFileType = /* @__PURE__ */ ((VolumeFileType2) => {
-  VolumeFileType2["UNKNOWN"] = "unknown";
-  VolumeFileType2["FILE"] = "file";
-  VolumeFileType2["DIRECTORY"] = "directory";
-  VolumeFileType2["SYMLINK"] = "symlink";
-  return VolumeFileType2;
-})(VolumeFileType || {});
-
 // src/core/volume/index.ts
-function convertVolumeEntryStat(entry) {
-  return __spreadProps(__spreadValues({}, entry), {
-    type: entry.type,
-    atime: new Date(entry.atime),
-    mtime: new Date(entry.mtime),
-    ctime: new Date(entry.ctime)
-  });
-}
 var Volume = class _Volume {
   /**
    * Create a local Volume instance with no API call.
@@ -2442,6 +2412,9 @@ var Volume = class _Volume {
    * @param debug whether to use debug mode.
    */
   constructor(volumeId, name, token, domain, debug) {
+    if (domain) {
+      validateDomain(domain);
+    }
     this.volumeId = volumeId;
     this.name = name;
     this.token = token;
@@ -2453,15 +2426,20 @@ var Volume = class _Volume {
    *
    * @param name name of the volume.
    * @param opts connection options.
+   * @param [opts.quotaSizeGiB] capacity quota in GiB.
+   * @param [opts.quotaInodes] inode quota.
    *
    * @returns new Volume instance.
    */
   static async create(name, opts) {
     const config = new ConnectionConfig(opts);
+    raiseIfLegacy(config, "Volume.create", VolumeError);
     const client = new ApiClient(config);
     const res = await client.api.POST("/volumes", {
       body: {
-        name
+        name,
+        quotaSizeGiB: opts == null ? void 0 : opts.quotaSizeGiB,
+        quotaInodes: opts == null ? void 0 : opts.quotaInodes
       },
       signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
     });
@@ -2490,6 +2468,7 @@ var Volume = class _Volume {
    */
   static async connect(volumeId, opts) {
     const config = new ConnectionConfig(opts);
+    raiseIfLegacy(config, "Volume.connect", VolumeError);
     const { name, token } = await _Volume.getInfo(volumeId, opts);
     return new _Volume(volumeId, name, token, config.domain, config.debug);
   }
@@ -2502,7 +2481,9 @@ var Volume = class _Volume {
    * @returns volume information.
    */
   static async getInfo(volumeId, opts) {
+    var _a3, _b, _c, _d;
     const config = new ConnectionConfig(opts);
+    raiseIfLegacy(config, "Volume.getInfo", VolumeError);
     const client = new ApiClient(config);
     const res = await client.api.GET("/volumes/{volumeID}", {
       params: {
@@ -2519,10 +2500,15 @@ var Volume = class _Volume {
     if (err) {
       throw err;
     }
+    const data = res.data;
     return {
-      volumeId: res.data.volumeID,
-      name: res.data.name,
-      token: res.data.token
+      volumeId: data.volumeID,
+      name: data.name,
+      token: data.token,
+      quotaSizeGiB: (_a3 = data.quotaSizeGiB) != null ? _a3 : 0,
+      quotaInodes: (_b = data.quotaInodes) != null ? _b : 0,
+      usedSizeBytes: (_c = data.usedSizeBytes) != null ? _c : 0,
+      usedInodes: (_d = data.usedInodes) != null ? _d : 0
     };
   }
   /**
@@ -2535,6 +2521,7 @@ var Volume = class _Volume {
   static async list(opts) {
     var _a3;
     const config = new ConnectionConfig(opts);
+    raiseIfLegacy(config, "Volume.list", VolumeError);
     const client = new ApiClient(config);
     const res = await client.api.GET("/volumes", {
       signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
@@ -2543,10 +2530,61 @@ var Volume = class _Volume {
     if (err) {
       throw err;
     }
-    return ((_a3 = res.data) != null ? _a3 : []).map((vol) => ({
-      volumeId: vol.volumeID,
-      name: vol.name
-    }));
+    return ((_a3 = res.data) != null ? _a3 : []).map((vol) => {
+      var _a4, _b, _c, _d;
+      return {
+        volumeId: vol.volumeID,
+        name: vol.name,
+        quotaSizeGiB: (_a4 = vol.quotaSizeGiB) != null ? _a4 : 0,
+        quotaInodes: (_b = vol.quotaInodes) != null ? _b : 0,
+        usedSizeBytes: (_c = vol.usedSizeBytes) != null ? _c : 0,
+        usedInodes: (_d = vol.usedInodes) != null ? _d : 0
+      };
+    });
+  }
+  /**
+   * Update volume quota.
+   *
+   * @param volumeId volume ID.
+   * @param params quota parameters.
+   * @param opts connection options.
+   *
+   * @returns updated volume information.
+   */
+  static async updateQuota(volumeId, params, opts) {
+    var _a3, _b, _c, _d;
+    const config = new ConnectionConfig(opts);
+    raiseIfLegacy(config, "Volume.updateQuota", VolumeError);
+    const res = await fetch(
+      `${config.apiUrl}/volumes/${encodeURIComponent(volumeId)}`,
+      {
+        method: "PATCH",
+        headers: __spreadValues(__spreadValues(__spreadProps(__spreadValues({}, config.headers), {
+          "Content-Type": "application/json"
+        }), config.apiKey ? { "X-API-KEY": config.apiKey } : {}), config.accessToken ? { Authorization: `Bearer ${config.accessToken}` } : {}),
+        body: JSON.stringify({
+          quotaSizeGiB: params.quotaSizeGiB,
+          quotaInodes: params.quotaInodes
+        }),
+        signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+      }
+    );
+    if (res.status === 404) {
+      throw new NotFoundError(`Volume ${volumeId} not found`);
+    }
+    if (!res.ok) {
+      throw new VolumeError(`${res.status}: ${res.statusText}`);
+    }
+    const data = await res.json();
+    return {
+      volumeId: data.volumeID,
+      name: data.name,
+      token: data.token,
+      quotaSizeGiB: (_a3 = data.quotaSizeGiB) != null ? _a3 : 0,
+      quotaInodes: (_b = data.quotaInodes) != null ? _b : 0,
+      usedSizeBytes: (_c = data.usedSizeBytes) != null ? _c : 0,
+      usedInodes: (_d = data.usedInodes) != null ? _d : 0
+    };
   }
   /**
    * Destroy a volume.
@@ -2556,6 +2594,7 @@ var Volume = class _Volume {
    */
   static async destroy(volumeId, opts) {
     const config = new ConnectionConfig(opts);
+    raiseIfLegacy(config, "Volume.destroy", VolumeError);
     const client = new ApiClient(config);
     const res = await client.api.DELETE("/volumes/{volumeID}", {
       params: {
@@ -2574,296 +2613,196 @@ var Volume = class _Volume {
     }
     return true;
   }
-  /**
-   * List directory contents.
-   *
-   * @param path path to the directory.
-   * @param opts connection options.
-   * @param [opts.depth] number of layers deep to recurse into the directory (default: 1).
-   *
-   * @returns list of entries in the directory.
-   */
-  async list(path2, opts) {
-    const config = new VolumeConnectionConfig(this, opts);
-    const client = new VolumeApiClient(config);
-    const res = await client.api.GET("/volumecontent/{volumeID}/dir", {
-      params: {
-        path: {
-          volumeID: this.volumeId
-        },
-        query: {
-          path: path2,
-          depth: opts == null ? void 0 : opts.depth
-        }
-      },
-      signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
-    });
-    if (res.response.status === 404) {
-      throw new NotFoundError(`Path ${path2} not found`);
-    }
-    const err = handleApiError(res, VolumeError);
-    if (err) {
-      throw err;
-    }
-    const entries = Array.isArray(res.data) ? res.data : [];
-    return entries.map(convertVolumeEntryStat);
+};
+
+// src/core/secret/index.ts
+var SECRET_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+var ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var HOST_PATTERN = /^(\*\.)?[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
+function validateSecretEnvs(secretEnvs, envs) {
+  if (!secretEnvs) {
+    return {};
   }
-  /**
-   * Create a directory.
-   *
-   * @param path path to the directory to create.
-   * @param options directory creation options.
-   * @param opts connection options.
-   */
-  async makeDir(path2, opts) {
-    const config = new VolumeConnectionConfig(this, opts);
-    const client = new VolumeApiClient(config);
-    const res = await client.api.POST("/volumecontent/{volumeID}/dir", {
-      params: {
-        path: {
-          volumeID: this.volumeId
-        },
-        query: {
-          path: path2,
-          uid: opts == null ? void 0 : opts.uid,
-          gid: opts == null ? void 0 : opts.gid,
-          mode: opts == null ? void 0 : opts.mode,
-          force: opts == null ? void 0 : opts.force
-        }
-      },
-      signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
-    });
-    if (res.response.status === 404) {
-      throw new NotFoundError(`Path ${path2} not found`);
-    }
-    const err = handleApiError(res, VolumeError);
-    if (err) {
-      throw err;
+  if (typeof secretEnvs !== "object" || Array.isArray(secretEnvs)) {
+    throw new InvalidArgumentError("secretEnvs must be a mapping");
+  }
+  const envNames = new Set(Object.keys(envs != null ? envs : {}));
+  const validated = {};
+  for (const [envName, secretName] of Object.entries(secretEnvs)) {
+    if (!ENV_NAME_PATTERN.test(envName)) {
+      throw new InvalidArgumentError(
+        `secretEnvs key ${JSON.stringify(envName)} must be a valid sandbox environment variable name`
+      );
     }
-    if (!res.data) {
-      throw new Error("Response data is missing");
+    if (envNames.has(envName)) {
+      throw new InvalidArgumentError(
+        `envs and secretEnvs both define ${JSON.stringify(envName)}`
+      );
     }
-    return convertVolumeEntryStat(
-      res.data
+    validateSecretName(secretName);
+    validated[envName] = secretName;
+  }
+  return validated;
+}
+var _Secret = class _Secret {
+  static async create(params, opts) {
+    validateSecretName(params.name);
+    if (!params.value) {
+      throw new InvalidArgumentError("value is required");
+    }
+    const body = {
+      name: params.name,
+      value: params.value,
+      hosts: normalizeSecretHosts(params.hosts)
+    };
+    if (params.description !== void 0) {
+      body.description = params.description;
+    }
+    return bindingFromJson(
+      await request(
+        "POST",
+        _Secret.base,
+        "Secret.create",
+        opts,
+        body
+      )
     );
   }
-  /**
-   * Get information about a file or directory.
-   *
-   * @param path path to the file or directory.
-   * @param opts connection options.
-   *
-   * @returns information about the entry.
-   */
-  async getInfo(path2, opts) {
-    const config = new VolumeConnectionConfig(this, opts);
-    const client = new VolumeApiClient(config);
-    const res = await client.api.GET("/volumecontent/{volumeID}/path", {
-      params: {
-        path: {
-          volumeID: this.volumeId
-        },
-        query: {
-          path: path2
-        }
-      },
-      signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
-    });
-    if (res.response.status === 404) {
-      throw new NotFoundError(`Path ${path2} not found`);
-    }
-    const err = handleApiError(res, VolumeError);
-    if (err) {
-      throw err;
-    }
-    if (!res.data) {
-      throw new Error("Response data is missing");
-    }
-    return convertVolumeEntryStat(
-      res.data
+  static async list(opts) {
+    var _a3;
+    const data = await request(
+      "GET",
+      _Secret.base,
+      "Secret.list",
+      opts
+    );
+    return ((_a3 = data.secrets) != null ? _a3 : []).map(bindingFromJson);
+  }
+  static async get(name, opts) {
+    validateSecretName(name);
+    return bindingFromJson(
+      await request(
+        "GET",
+        `${_Secret.base}/${encodeURIComponent(name)}`,
+        "Secret.get",
+        opts
+      )
     );
   }
-  /**
-   * Check whether a file or directory exists.
-   *
-   * Uses {@link getInfo} under the hood. Returns `true` if the path exists,
-   * `false` if it does not (404). Other errors are rethrown.
-   *
-   * @param path path to the file or directory.
-   * @param opts connection options.
-   *
-   * @returns `true` if the path exists, `false` otherwise.
-   */
-  async exists(path2, opts) {
-    try {
-      await this.getInfo(path2, opts);
-      return true;
-    } catch (err) {
-      if (err instanceof NotFoundError) {
-        return false;
-      }
-      throw err;
+  static async update(params, opts) {
+    validateSecretName(params.name);
+    if (!params.value) {
+      throw new InvalidArgumentError("value is required");
     }
+    const body = {
+      value: params.value,
+      hosts: normalizeSecretHosts(params.hosts)
+    };
+    if (params.description !== void 0) {
+      body.description = params.description;
+    }
+    return bindingFromJson(
+      await request(
+        "PUT",
+        `${_Secret.base}/${encodeURIComponent(params.name)}`,
+        "Secret.update",
+        opts,
+        body
+      )
+    );
   }
-  /**
-   * Update file or directory metadata.
-   *
-   * @param path path to the file or directory.
-   * @param metadata metadata to update (uid, gid, mode).
-   * @param opts connection options.
-   *
-   * @returns updated entry information.
-   */
-  async updateMetadata(path2, metadata, opts) {
-    const config = new VolumeConnectionConfig(this, opts);
-    const client = new VolumeApiClient(config);
-    const res = await client.api.PATCH("/volumecontent/{volumeID}/path", {
-      params: {
-        path: {
-          volumeID: this.volumeId
-        },
-        query: {
-          path: path2
-        }
-      },
-      body: {
-        uid: metadata.uid,
-        gid: metadata.gid,
-        mode: metadata.mode
-      },
-      signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
-    });
-    if (res.response.status === 404) {
-      throw new NotFoundError(`Path ${path2} not found`);
-    }
-    const err = handleApiError(res, VolumeError);
-    if (err) {
-      throw err;
-    }
-    if (!res.data) {
-      throw new Error("Response data is missing");
-    }
-    return convertVolumeEntryStat(
-      res.data
+  static async delete(name, opts) {
+    var _a3;
+    validateSecretName(name);
+    const data = await request(
+      "DELETE",
+      `${_Secret.base}/${encodeURIComponent(name)}`,
+      "Secret.delete",
+      opts
     );
+    return String((_a3 = data.deleted) != null ? _a3 : "");
   }
-  async readFile(path2, opts) {
-    var _a3, _b;
-    const format = (_a3 = opts == null ? void 0 : opts.format) != null ? _a3 : "text";
-    const config = new VolumeConnectionConfig(this, opts);
-    const client = new VolumeApiClient(config);
-    const res = await client.api.GET("/volumecontent/{volumeID}/file", {
-      params: {
-        path: {
-          volumeID: this.volumeId
-        },
-        query: {
-          path: path2
-        }
-      },
-      parseAs: format === "bytes" ? "arrayBuffer" : format,
-      signal: config.getSignal((_b = opts == null ? void 0 : opts.requestTimeoutMs) != null ? _b : FILE_TIMEOUT_MS)
-    });
-    if (res.response.status === 404) {
-      throw new NotFoundError(`Path ${path2} not found`);
+};
+_Secret.base = "/secrets";
+var Secret = _Secret;
+function validateSecretName(name) {
+  if (typeof name !== "string" || !SECRET_NAME_PATTERN.test(name)) {
+    throw new InvalidArgumentError(
+      `secret name ${JSON.stringify(name)} must be 1-128 characters and contain only letters, numbers, dots, underscores, and hyphens`
+    );
+  }
+}
+function normalizeSecretHosts(hosts) {
+  if (!hosts.length) {
+    throw new InvalidArgumentError("hosts is required");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const normalizedHosts = [];
+  for (const rawHost of hosts) {
+    if (typeof rawHost !== "string") {
+      throw new InvalidArgumentError("host must be a string");
     }
-    const err = handleApiError(res, VolumeError);
-    if (err) {
-      throw err;
+    const host = rawHost.trim().toLowerCase();
+    if (!host) {
+      throw new InvalidArgumentError("host cannot be empty");
     }
-    if (format === "bytes") {
-      return new Uint8Array(res.data);
-    }
-    if (format === "text") {
-      if (res.response.headers.get("content-length") === "0") {
-        return "";
-      }
-      return typeof res.data === "string" ? res.data : "";
+    if (host.includes("://") || /[/?#@:]/.test(host)) {
+      throw new InvalidArgumentError(
+        `host ${JSON.stringify(host)} must be a hostname only`
+      );
     }
-    return res.data;
-  }
-  /**
-   * Write content to a file.
-   *
-   * Writing to a file that doesn't exist creates the file.
-   *
-   * Writing to a file that already exists overwrites the file.
-   *
-   * @param path path to the file.
-   * @param data data to write to the file. Data can be a string, `ArrayBuffer`, `Blob`, or `ReadableStream`.
-   * @param options file creation options.
-   * @param opts connection options.
-   *
-   * @returns information about the written file
-   */
-  async writeFile(path2, data, opts) {
-    var _a3;
-    const config = new VolumeConnectionConfig(this, opts);
-    const client = new VolumeApiClient(config);
-    const blob = await toBlob(data);
-    const res = await client.api.PUT("/volumecontent/{volumeID}/file", {
-      params: {
-        path: {
-          volumeID: this.volumeId
-        },
-        query: {
-          path: path2,
-          uid: opts == null ? void 0 : opts.uid,
-          gid: opts == null ? void 0 : opts.gid,
-          mode: opts == null ? void 0 : opts.mode,
-          force: opts == null ? void 0 : opts.force
-        }
-      },
-      bodySerializer: () => blob,
-      body: {},
-      headers: {
-        "Content-Type": "application/octet-stream"
-      },
-      signal: config.getSignal((_a3 = opts == null ? void 0 : opts.requestTimeoutMs) != null ? _a3 : FILE_TIMEOUT_MS)
-    });
-    if (res.response.status === 404) {
-      throw new NotFoundError(`Path ${path2} not found`);
+    const wildcard = host.startsWith("*.");
+    const lookupHost = wildcard ? host.slice(2) : host;
+    if (!lookupHost || lookupHost.includes("*")) {
+      throw new InvalidArgumentError(`invalid host ${JSON.stringify(host)}`);
     }
-    const err = handleApiError(res, VolumeError);
-    if (err) {
-      throw err;
+    const normalized = wildcard ? `*.${lookupHost}` : lookupHost;
+    if (!HOST_PATTERN.test(normalized)) {
+      throw new InvalidArgumentError(
+        `host ${JSON.stringify(host)} must be a hostname or wildcard hostname`
+      );
     }
-    if (!res.data) {
-      throw new Error("Response data is missing");
+    if (seen.has(normalized)) {
+      continue;
     }
-    return convertVolumeEntryStat(
-      res.data
-    );
+    seen.add(normalized);
+    normalizedHosts.push(normalized);
   }
-  /**
-   * Remove a file or directory.
-   *
-   * @param path path to the file or directory to remove.
-   * @param opts connection options.
-   */
-  async remove(path2, opts) {
-    const config = new VolumeConnectionConfig(this, opts);
-    const client = new VolumeApiClient(config);
-    const res = await client.api.DELETE("/volumecontent/{volumeID}/path", {
-      params: {
-        path: {
-          volumeID: this.volumeId
-        },
-        query: {
-          path: path2
-        }
-      },
-      signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
-    });
-    if (res.response.status === 404) {
-      throw new NotFoundError(`Path ${path2} not found`);
-    }
-    const err = handleApiError(res, VolumeError);
-    if (err) {
-      throw err;
-    }
+  return normalizedHosts;
+}
+async function request(method, path2, feature, opts, body) {
+  const config = new ConnectionConfig(opts);
+  raiseIfLegacy(config, feature, SecretError);
+  const headers = __spreadValues(__spreadValues(__spreadValues(__spreadValues({}, config.headers), body ? { "Content-Type": "application/json" } : {}), config.apiKey ? { "X-API-KEY": config.apiKey } : {}), config.accessToken ? { Authorization: `Bearer ${config.accessToken}` } : {});
+  const response = await fetch(`${config.apiUrl}${path2}`, {
+    method,
+    headers,
+    body: body ? JSON.stringify(body) : void 0,
+    signal: config.getSignal()
+  });
+  const data = await parseJson(response);
+  if (!response.ok) {
+    const message = typeof (data == null ? void 0 : data.message) === "string" ? data.message : response.statusText;
+    throw new SecretError(`${response.status}: ${message}`);
   }
-};
+  return data;
+}
+async function parseJson(response) {
+  const text = await response.text();
+  return text ? JSON.parse(text) : {};
+}
+function bindingFromJson(data) {
+  var _a3, _b;
+  return {
+    name: data.name,
+    hosts: (_a3 = data.hosts) != null ? _a3 : [],
+    placeholder: data.placeholder,
+    description: (_b = data.description) != null ? _b : null,
+    hasSecret: data.hasSecret,
+    status: data.status,
+    updatedAt: data.updatedAt
+  };
+}
 
 // src/core/sandbox/index.ts
 var import_connect_web = require("@connectrpc/connect-web");
@@ -3334,6 +3273,33 @@ var Commands = class {
 
 // src/core/sandbox/sandboxApi.ts
 var import_compare_versions4 = require("compare-versions");
+async function createRawApiError(response) {
+  var _a3;
+  let message = response.statusText;
+  try {
+    const body = await response.json();
+    message = (_a3 = body == null ? void 0 : body.message) != null ? _a3 : JSON.stringify(body);
+  } catch (e) {
+    try {
+      message = await response.text();
+    } catch (e2) {
+    }
+  }
+  if (response.status === 401) {
+    return new AuthenticationError(
+      `Unauthorized, please check your credentials. - ${message}`
+    );
+  }
+  if (response.status === 429) {
+    return new RateLimitError(
+      `Rate limit exceeded, please try again later - ${message}`
+    );
+  }
+  return new SandboxError(`${response.status}: ${message}`);
+}
+function getRawApiHeaders(config, headers) {
+  return __spreadValues(__spreadValues(__spreadValues(__spreadValues(__spreadValues({}, defaultHeaders), config.apiKey ? { "X-API-KEY": config.apiKey } : {}), config.accessToken ? { Authorization: `Bearer ${config.accessToken}` } : {}), config.headers), headers != null ? headers : {});
+}
 function getLifecycle(opts) {
   if (opts == null ? void 0 : opts.lifecycle) {
     return opts.lifecycle;
@@ -3404,15 +3370,40 @@ var SandboxApi = class {
    * @returns  List of sandbox metrics containing CPU, memory and disk usage information.
    */
   static async getMetrics(sandboxId, opts) {
-    var _a3, _b;
+    var _a3, _b, _c, _d;
     const config = new ConnectionConfig(opts);
     const client = new ApiClient(config);
+    if (config.isLegacyDomain) {
+      const res2 = await client.api.GET("/sandboxes/{sandboxID}/metrics", {
+        params: {
+          path: {
+            sandboxID: sandboxId
+          }
+        },
+        signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+      });
+      const err2 = handleApiError(res2);
+      if (err2) {
+        throw err2;
+      }
+      return (_b = ((_a3 = res2.data) != null ? _a3 : []).map((metric) => ({
+        timestamp: new Date(metric.timestamp),
+        cpuUsedPct: metric.cpuUsedPct,
+        cpuCount: metric.cpuCount,
+        memUsed: metric.memUsedMiB * 1024 * 1024,
+        memTotal: metric.memTotalMiB * 1024 * 1024,
+        diskUsed: -1,
+        diskTotal: -1
+      }))) != null ? _b : [];
+    }
     const start = (opts == null ? void 0 : opts.start) ? Math.round(opts.start.getTime() / 1e3) : void 0;
     const end = (opts == null ? void 0 : opts.end) ? Math.round(opts.end.getTime() / 1e3) : void 0;
     const res = await client.api.GET("/sandboxes/{sandboxID}/metrics", {
       params: {
         path: {
-          sandboxID: sandboxId,
+          sandboxID: sandboxId
+        },
+        query: {
           start,
           end
         }
@@ -3423,7 +3414,7 @@ var SandboxApi = class {
     if (err) {
       throw err;
     }
-    return (_b = (_a3 = res.data) == null ? void 0 : _a3.map((metric) => ({
+    return (_d = (_c = res.data) == null ? void 0 : _c.map((metric) => ({
       timestamp: new Date(metric.timestamp),
       cpuUsedPct: metric.cpuUsedPct,
       cpuCount: metric.cpuCount,
@@ -3431,7 +3422,7 @@ var SandboxApi = class {
       memTotal: metric.memTotal,
       diskUsed: metric.diskUsed,
       diskTotal: metric.diskTotal
-    }))) != null ? _b : [];
+    }))) != null ? _d : [];
   }
   /**
    * Set the timeout of the specified sandbox.
@@ -3448,28 +3439,249 @@ var SandboxApi = class {
   static async setTimeout(sandboxId, timeoutMs, opts) {
     var _a3;
     const config = new ConnectionConfig(opts);
-    const client = new ApiClient(config);
-    const res = await client.api.POST("/sandboxes/{sandboxID}/timeout", {
-      params: {
-        path: {
-          sandboxID: sandboxId
-        }
-      },
-      body: {
-        timeout: timeoutToSeconds(timeoutMs)
-      },
-      signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
-    });
-    if (((_a3 = res.error) == null ? void 0 : _a3.code) === 404) {
+    const client = new ApiClient(config);
+    const res = await client.api.POST("/sandboxes/{sandboxID}/timeout", {
+      params: {
+        path: {
+          sandboxID: sandboxId
+        }
+      },
+      body: {
+        timeout: timeoutToSeconds(timeoutMs)
+      },
+      signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+    });
+    if (((_a3 = res.error) == null ? void 0 : _a3.code) === 404) {
+      throw new SandboxNotFoundError(`Sandbox ${sandboxId} not found`);
+    }
+    const err = handleApiError(res);
+    if (err) {
+      throw err;
+    }
+  }
+  /**
+   * @deprecated Only legacy domains support this method. Use {@link SandboxApi.createSnapshot} for modern domains.
+   */
+  static async commit(sandboxId, opts) {
+    var _a3, _b, _c, _d, _e, _f, _g, _h, _i, _j;
+    const config = new ConnectionConfig(opts);
+    if (!config.isLegacyDomain) {
+      throw new SandboxError("Sandbox.commit is only supported for legacy domains");
+    }
+    const response = await fetch(
+      `${config.apiUrl}/sandboxes/${encodeURIComponent(sandboxId)}/commit`,
+      {
+        method: "POST",
+        headers: getRawApiHeaders(config, {
+          "Content-Type": "application/json"
+        }),
+        body: JSON.stringify((opts == null ? void 0 : opts.alias) ? { alias: opts.alias } : {}),
+        signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+      }
+    );
+    if (response.status === 404) {
+      throw new SandboxNotFoundError(`Sandbox ${sandboxId} not found`);
+    }
+    if (!response.ok) {
+      throw await createRawApiError(response);
+    }
+    const data = await response.json();
+    return {
+      alias: (_d = (_c = (_a3 = data.aliases) == null ? void 0 : _a3[0]) != null ? _c : (_b = data.names) == null ? void 0 : _b[0]) != null ? _d : "",
+      name: (_h = (_g = (_e = data.names) == null ? void 0 : _e[0]) != null ? _g : (_f = data.aliases) == null ? void 0 : _f[0]) != null ? _h : "",
+      tags: [],
+      templateId: data.templateID,
+      buildId: data.buildID,
+      aliases: (_i = data.aliases) != null ? _i : [],
+      names: (_j = data.names) != null ? _j : [],
+      templateType: "snapshot_template"
+    };
+  }
+  static async hotplugMemory(sandboxId, requestedSizeMib, opts) {
+    const config = new ConnectionConfig(opts);
+    raiseIfLegacy(config, "Sandbox.hotplugMemory", SandboxError);
+    const response = await fetch(
+      `${config.apiUrl}/sandboxes/${encodeURIComponent(sandboxId)}/hotplug-memory`,
+      {
+        method: "POST",
+        headers: getRawApiHeaders(config, {
+          "Content-Type": "application/json"
+        }),
+        body: JSON.stringify({
+          requested_size_mib: requestedSizeMib
+        }),
+        signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+      }
+    );
+    if (response.status === 404) {
+      throw new SandboxNotFoundError(`Sandbox ${sandboxId} not found`);
+    }
+    if (!response.ok) {
+      throw await createRawApiError(response);
+    }
+  }
+  static async reset(sandboxId, opts) {
+    var _a3;
+    const config = new ConnectionConfig(opts);
+    const response = await fetch(
+      `${config.apiUrl}/sandboxes/${encodeURIComponent(sandboxId)}/reset`,
+      {
+        method: "POST",
+        headers: getRawApiHeaders(config, {
+          "Content-Type": "application/json"
+        }),
+        body: JSON.stringify(__spreadValues({
+          resume: (_a3 = opts == null ? void 0 : opts.resume) != null ? _a3 : true
+        }, (opts == null ? void 0 : opts.timeoutMs) !== void 0 ? { timeout: timeoutToSeconds(opts.timeoutMs) } : {})),
+        signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+      }
+    );
+    if (response.status === 404) {
+      throw new SandboxNotFoundError(`Sandbox ${sandboxId} not found`);
+    }
+    if (response.status === 409) {
+      return false;
+    }
+    if (!response.ok) {
+      throw await createRawApiError(response);
+    }
+    return true;
+  }
+  static async mountVolume(sandboxId, name, path2, opts) {
+    var _a3, _b;
+    const config = new ConnectionConfig(opts);
+    raiseIfLegacy(config, "Sandbox.mountVolume", SandboxError);
+    const response = await fetch(
+      `${config.apiUrl}/sandboxes/${encodeURIComponent(sandboxId)}/volume-mounts`,
+      {
+        method: "POST",
+        headers: getRawApiHeaders(config, {
+          "Content-Type": "application/json"
+        }),
+        body: JSON.stringify({ name, path: path2 }),
+        signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+      }
+    );
+    if (response.status === 404) {
+      throw new SandboxNotFoundError(`Sandbox ${sandboxId} not found`);
+    }
+    if (!response.ok) {
+      throw await createRawApiError(response);
+    }
+    const data = await response.json();
+    return {
+      sandboxId: data.sandboxID,
+      templateId: data.templateID,
+      name: data.name,
+      metadata: (_a3 = data.metadata) != null ? _a3 : {},
+      startedAt: new Date(data.startedAt),
+      endAt: new Date(data.endAt),
+      state: data.state,
+      cpuCount: data.cpuCount,
+      memoryMB: data.memoryMB,
+      envdVersion: data.envdVersion,
+      volumeMounts: (_b = data.volumeMounts) != null ? _b : []
+    };
+  }
+  static async unmountVolume(sandboxId, path2, opts) {
+    var _a3, _b;
+    const config = new ConnectionConfig(opts);
+    raiseIfLegacy(config, "Sandbox.unmountVolume", SandboxError);
+    const url = new URL(
+      `${config.apiUrl}/sandboxes/${encodeURIComponent(sandboxId)}/volume-mounts`
+    );
+    url.searchParams.set("path", path2);
+    if (opts == null ? void 0 : opts.force) {
+      url.searchParams.set("force", "true");
+    }
+    const response = await fetch(url, {
+      method: "DELETE",
+      headers: getRawApiHeaders(config),
+      signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+    });
+    if (response.status === 404) {
+      throw new SandboxNotFoundError(`Sandbox ${sandboxId} not found`);
+    }
+    if (!response.ok) {
+      throw await createRawApiError(response);
+    }
+    const data = await response.json();
+    return {
+      sandboxId: data.sandboxID,
+      templateId: data.templateID,
+      name: data.name,
+      metadata: (_a3 = data.metadata) != null ? _a3 : {},
+      startedAt: new Date(data.startedAt),
+      endAt: new Date(data.endAt),
+      state: data.state,
+      cpuCount: data.cpuCount,
+      memoryMB: data.memoryMB,
+      envdVersion: data.envdVersion,
+      volumeMounts: (_b = data.volumeMounts) != null ? _b : []
+    };
+  }
+  static async setNetwork(sandboxId, opts) {
+    const config = new ConnectionConfig(opts);
+    raiseIfLegacy(config, "Sandbox.setNetwork", SandboxError);
+    const response = await fetch(
+      `${config.apiUrl}/sandboxes/${encodeURIComponent(sandboxId)}/network`,
+      {
+        method: "PUT",
+        headers: getRawApiHeaders(config, {
+          "Content-Type": "application/json"
+        }),
+        body: JSON.stringify(__spreadValues(__spreadValues({}, (opts == null ? void 0 : opts.allowOut) ? { allowOut: opts.allowOut } : {}), (opts == null ? void 0 : opts.denyOut) ? { denyOut: opts.denyOut } : {})),
+        signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+      }
+    );
+    if (response.status === 404) {
+      throw new SandboxNotFoundError(`Sandbox ${sandboxId} not found`);
+    }
+    if (!response.ok) {
+      throw await createRawApiError(response);
+    }
+  }
+  static async cloneSandboxes(sandboxId, opts) {
+    var _a3, _b, _c, _d;
+    const config = new ConnectionConfig(opts);
+    const response = await fetch(
+      `${config.apiUrl}/sandboxes/${encodeURIComponent(sandboxId)}/clone`,
+      {
+        method: "POST",
+        headers: getRawApiHeaders(config, {
+          "Content-Type": "application/json"
+        }),
+        body: JSON.stringify(__spreadValues(__spreadValues({
+          count: (_a3 = opts == null ? void 0 : opts.count) != null ? _a3 : 1,
+          strict: (_b = opts == null ? void 0 : opts.strict) != null ? _b : false
+        }, (opts == null ? void 0 : opts.nodeId) ? { nodeID: opts.nodeId } : {}), (opts == null ? void 0 : opts.timeoutMs) !== void 0 ? { timeout: timeoutToSeconds(opts.timeoutMs) } : {})),
+        signal: config.getSignal((_c = opts == null ? void 0 : opts.requestTimeoutMs) != null ? _c : 3e5)
+      }
+    );
+    if (response.status === 404) {
       throw new SandboxNotFoundError(`Sandbox ${sandboxId} not found`);
     }
-    const err = handleApiError(res);
-    if (err) {
-      throw err;
+    if (!response.ok) {
+      throw await createRawApiError(response);
     }
+    const data = await response.json();
+    return {
+      sandboxes: ((_d = data.sandboxes) != null ? _d : []).map((sandbox) => {
+        var _a4, _b2;
+        const baseSandboxId = (_a4 = sandbox.sandboxID) != null ? _a4 : "";
+        const sandboxId2 = sandbox.clientID ? `${baseSandboxId}-${sandbox.clientID}` : baseSandboxId;
+        return {
+          sandboxId: sandboxId2,
+          envdVersion: (_b2 = sandbox.envdVersion) != null ? _b2 : "0.0.0",
+          envdAccessToken: sandbox.envdAccessToken,
+          trafficAccessToken: sandbox.trafficAccessToken
+        };
+      }),
+      snapshotTemplateId: data.snapshotTemplateId
+    };
   }
   static async getFullInfo(sandboxId, opts) {
-    var _a3, _b, _c, _d;
+    var _a3, _b, _c, _d, _e, _f;
     const config = new ConnectionConfig(opts);
     const client = new ApiClient(config);
     const res = await client.api.GET("/sandboxes/{sandboxID}", {
@@ -3490,12 +3702,29 @@ var SandboxApi = class {
     if (!res.data) {
       throw new Error("Sandbox not found");
     }
+    if (config.isLegacyDomain) {
+      const data = res.data;
+      return __spreadProps(__spreadValues({
+        sandboxId: data.clientID != null ? `${data.sandboxID}-${data.clientID}` : data.sandboxID,
+        templateId: data.templateID
+      }, data.alias && { name: data.alias }), {
+        metadata: (_b = data.metadata) != null ? _b : {},
+        envdVersion: (_c = data.envdVersion) != null ? _c : "0.0.0",
+        envdAccessToken: data.envdAccessToken,
+        startedAt: new Date(data.startedAt),
+        endAt: new Date(data.endAt),
+        state: data.state,
+        cpuCount: data.cpuCount,
+        memoryMB: data.memoryMB,
+        sandboxDomain: data.domain || void 0
+      });
+    }
     return __spreadProps(__spreadValues({
       sandboxId: res.data.sandboxID,
       templateId: res.data.templateID
     }, res.data.alias && { name: res.data.alias }), {
-      metadata: (_b = res.data.metadata) != null ? _b : {},
-      allowInternetAccess: (_c = res.data.allowInternetAccess) != null ? _c : void 0,
+      metadata: (_d = res.data.metadata) != null ? _d : {},
+      allowInternetAccess: (_e = res.data.allowInternetAccess) != null ? _e : void 0,
       envdVersion: res.data.envdVersion,
       envdAccessToken: res.data.envdAccessToken,
       startedAt: new Date(res.data.startedAt),
@@ -3514,7 +3743,7 @@ var SandboxApi = class {
         autoResume: res.data.lifecycle.autoResume
       } : void 0,
       sandboxDomain: res.data.domain || void 0,
-      volumeMounts: (_d = res.data.volumeMounts) != null ? _d : []
+      volumeMounts: (_f = res.data.volumeMounts) != null ? _f : []
     });
   }
   /**
@@ -3526,8 +3755,31 @@ var SandboxApi = class {
    * @returns `true` if the sandbox got paused, `false` if the sandbox was already paused.
    */
   static async pause(sandboxId, opts) {
-    var _a3, _b;
+    var _a3, _b, _c;
     const config = new ConnectionConfig(opts);
+    if (config.isLegacyDomain) {
+      const response = await fetch(
+        `${config.apiUrl}/sandboxes/${encodeURIComponent(sandboxId)}/pause`,
+        {
+          method: "POST",
+          headers: getRawApiHeaders(config, {
+            "Content-Type": "application/json"
+          }),
+          body: JSON.stringify({ sync: (_a3 = opts == null ? void 0 : opts.sync) != null ? _a3 : false }),
+          signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+        }
+      );
+      if (response.status === 404) {
+        throw new SandboxNotFoundError(`Sandbox ${sandboxId} not found`);
+      }
+      if (response.status === 409) {
+        return false;
+      }
+      if (!response.ok) {
+        throw await createRawApiError(response);
+      }
+      return true;
+    }
     const client = new ApiClient(config);
     const res = await client.api.POST("/sandboxes/{sandboxID}/pause", {
       params: {
@@ -3537,10 +3789,10 @@ var SandboxApi = class {
       },
       signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
     });
-    if (((_a3 = res.error) == null ? void 0 : _a3.code) === 404) {
+    if (((_b = res.error) == null ? void 0 : _b.code) === 404) {
       throw new SandboxNotFoundError(`Sandbox ${sandboxId} not found`);
     }
-    if (((_b = res.error) == null ? void 0 : _b.code) === 409) {
+    if (((_c = res.error) == null ? void 0 : _c.code) === 409) {
       return false;
     }
     const err = handleApiError(res);
@@ -3570,6 +3822,7 @@ var SandboxApi = class {
   static async createSnapshot(sandboxId, opts) {
     var _a3;
     const config = new ConnectionConfig(opts);
+    raiseIfLegacy(config, "Sandbox.createSnapshot", SandboxError);
     const client = new ApiClient(config);
     const res = await client.api.POST("/sandboxes/{sandboxID}/snapshots", {
       params: {
@@ -3631,22 +3884,69 @@ var SandboxApi = class {
     return true;
   }
   static async createSandbox(template, timeoutMs, opts) {
-    var _a3, _b, _c;
+    var _a3, _b, _c, _d, _e, _f;
     const config = new ConnectionConfig(opts);
-    const client = new ApiClient(config);
     const lifecycle = getLifecycle(opts);
     const autoPause = lifecycle.onTimeout === "pause";
     const autoResumeEnabled = lifecycle.onTimeout === "pause" ? (_a3 = lifecycle.autoResume) != null ? _a3 : false : void 0;
-    const body = __spreadValues(__spreadValues({
+    if (config.isLegacyDomain) {
+      if (opts == null ? void 0 : opts.mcp) {
+        raiseIfLegacy(config, "Sandbox.create mcp", SandboxError);
+      }
+      if (opts == null ? void 0 : opts.network) {
+        raiseIfLegacy(config, "Sandbox.create network", SandboxError);
+      }
+      if (opts == null ? void 0 : opts.volumeMounts) {
+        raiseIfLegacy(config, "Sandbox.create volumeMounts", SandboxError);
+      }
+      if (opts == null ? void 0 : opts.secretEnvs) {
+        raiseIfLegacy(config, "Sandbox.create secretEnvs", SandboxError);
+      }
+      const body2 = __spreadValues({
+        templateID: template,
+        timeout: timeoutToSeconds(timeoutMs),
+        metadata: (_b = opts == null ? void 0 : opts.metadata) != null ? _b : {},
+        envVars: (_c = opts == null ? void 0 : opts.envs) != null ? _c : {},
+        secure: (_d = opts == null ? void 0 : opts.secure) != null ? _d : false,
+        autoPause: autoPause != null ? autoPause : false
+      }, (opts == null ? void 0 : opts.nodeId) ? { nodeID: opts.nodeId } : {});
+      const response = await fetch(`${config.apiUrl}/sandboxes`, {
+        method: "POST",
+        headers: getRawApiHeaders(config, {
+          "Content-Type": "application/json"
+        }),
+        body: JSON.stringify(body2),
+        signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+      });
+      if (!response.ok) {
+        throw await createRawApiError(response);
+      }
+      const data = await response.json();
+      if ((0, import_compare_versions4.compareVersions)(data.envdVersion, "0.1.0") < 0) {
+        await this.kill(data.sandboxID, opts);
+        throw new TemplateError(
+          "You need to update the template to use the new SDK. You can do this by running `ppio-sandbox template build` in the directory with the template."
+        );
+      }
+      return {
+        sandboxId: data.clientID ? `${data.sandboxID}-${data.clientID}` : data.sandboxID,
+        sandboxDomain: data.domain || void 0,
+        envdVersion: data.envdVersion,
+        envdAccessToken: data.envdAccessToken,
+        trafficAccessToken: void 0
+      };
+    }
+    const client = new ApiClient(config);
+    const body = __spreadValues(__spreadValues(__spreadValues({
       templateID: template,
       metadata: opts == null ? void 0 : opts.metadata,
       mcp: opts == null ? void 0 : opts.mcp,
       envVars: opts == null ? void 0 : opts.envs,
       timeout: timeoutToSeconds(timeoutMs),
-      secure: (_b = opts == null ? void 0 : opts.secure) != null ? _b : true,
-      allow_internet_access: (_c = opts == null ? void 0 : opts.allowInternetAccess) != null ? _c : true,
+      secure: (_e = opts == null ? void 0 : opts.secure) != null ? _e : true,
+      allow_internet_access: (_f = opts == null ? void 0 : opts.allowInternetAccess) != null ? _f : true,
       network: opts == null ? void 0 : opts.network
-    }, autoPause !== void 0 ? { autoPause } : {}), autoResumeEnabled !== void 0 ? { autoResume: { enabled: autoResumeEnabled } } : {});
+    }, (opts == null ? void 0 : opts.nodeId) ? { nodeID: opts.nodeId } : {}), autoPause !== void 0 ? { autoPause } : {}), autoResumeEnabled !== void 0 ? { autoResume: { enabled: autoResumeEnabled } } : {});
     if (opts == null ? void 0 : opts.volumeMounts) {
       body.volumeMounts = Object.entries(opts.volumeMounts).map(
         ([mountPath, vol]) => ({
@@ -3655,6 +3955,14 @@ var SandboxApi = class {
         })
       );
     }
+    const validatedSecretEnvs = validateSecretEnvs(
+      opts == null ? void 0 : opts.secretEnvs,
+      opts == null ? void 0 : opts.envs
+    );
+    if (Object.keys(validatedSecretEnvs).length > 0) {
+      ;
+      body.secrets = validatedSecretEnvs;
+    }
     const res = await client.api.POST("/sandboxes", {
       body,
       signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
@@ -3681,6 +3989,33 @@ var SandboxApi = class {
     var _a3, _b;
     const timeoutMs = (_a3 = opts == null ? void 0 : opts.timeoutMs) != null ? _a3 : DEFAULT_SANDBOX_TIMEOUT_MS;
     const config = new ConnectionConfig(opts);
+    if (config.isLegacyDomain) {
+      const response = await fetch(
+        `${config.apiUrl}/sandboxes/${encodeURIComponent(sandboxId)}/connect`,
+        {
+          method: "POST",
+          headers: getRawApiHeaders(config, {
+            "Content-Type": "application/json"
+          }),
+          body: JSON.stringify({ timeout: timeoutToSeconds(timeoutMs) }),
+          signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+        }
+      );
+      if (response.status === 404) {
+        throw new SandboxNotFoundError(`Paused sandbox ${sandboxId} not found`);
+      }
+      if (!response.ok) {
+        throw await createRawApiError(response);
+      }
+      const data = await response.json();
+      return {
+        sandboxId: data.clientID ? `${data.sandboxID}-${data.clientID}` : data.sandboxID,
+        sandboxDomain: data.domain || void 0,
+        envdVersion: data.envdVersion || "0.0.0",
+        envdAccessToken: data.envdAccessToken,
+        trafficAccessToken: void 0
+      };
+    }
     const client = new ApiClient(config);
     const res = await client.api.POST("/sandboxes/{sandboxID}/connect", {
       params: {
@@ -3708,6 +4043,69 @@ var SandboxApi = class {
       trafficAccessToken: res.data.trafficAccessToken || void 0
     };
   }
+  static async getQuota(opts) {
+    var _a3, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t;
+    const config = new ConnectionConfig(opts);
+    const url = new URL(`${config.apiUrl}/sandboxes/quota`);
+    const response = await fetch(url, {
+      method: "GET",
+      headers: __spreadValues(__spreadValues(__spreadValues({}, config.headers), config.apiKey ? { "X-API-KEY": config.apiKey } : {}), config.accessToken ? { Authorization: `Bearer ${config.accessToken}` } : {}),
+      signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+    });
+    if (!response.ok) {
+      throw await createRawApiError(response);
+    }
+    const data = await response.json();
+    return {
+      limit: {
+        concurrentInstances: (_b = (_a3 = data.limit) == null ? void 0 : _a3.concurrentInstances) != null ? _b : 0,
+        concurrentVcpu: (_d = (_c = data.limit) == null ? void 0 : _c.concurrentVcpu) != null ? _d : 0,
+        concurrentRamMb: (_f = (_e = data.limit) == null ? void 0 : _e.concurrentRamMb) != null ? _f : 0,
+        maxLengthHours: (_h = (_g = data.limit) == null ? void 0 : _g.maxLengthHours) != null ? _h : 0,
+        diskMb: (_j = (_i = data.limit) == null ? void 0 : _i.diskMb) != null ? _j : 0,
+        maxVcpu: (_l = (_k = data.limit) == null ? void 0 : _k.maxVcpu) != null ? _l : 0,
+        maxRamMb: (_n = (_m = data.limit) == null ? void 0 : _m.maxRamMb) != null ? _n : 0
+      },
+      usage: {
+        concurrentInstances: (_p = (_o = data.usage) == null ? void 0 : _o.concurrentInstances) != null ? _p : 0,
+        concurrentVcpu: (_r = (_q = data.usage) == null ? void 0 : _q.concurrentVcpu) != null ? _r : 0,
+        concurrentRamMb: (_t = (_s = data.usage) == null ? void 0 : _s.concurrentRamMb) != null ? _t : 0
+      }
+    };
+  }
+  static async getEvents(opts) {
+    var _a3, _b, _c;
+    const config = new ConnectionConfig(opts);
+    const url = new URL(`${config.apiUrl}/sandboxes/events`);
+    if ((opts == null ? void 0 : opts.startTime) !== void 0)
+      url.searchParams.set("startTime", String(opts.startTime));
+    if ((opts == null ? void 0 : opts.endTime) !== void 0)
+      url.searchParams.set("endTime", String(opts.endTime));
+    if (opts == null ? void 0 : opts.sandboxID) url.searchParams.set("sandboxID", opts.sandboxID);
+    if (opts == null ? void 0 : opts.templateID) url.searchParams.set("templateID", opts.templateID);
+    if (opts == null ? void 0 : opts.events) url.searchParams.set("events", opts.events);
+    if (opts == null ? void 0 : opts.state) url.searchParams.set("state", opts.state);
+    if ((opts == null ? void 0 : opts.orderAsc) !== void 0)
+      url.searchParams.set("orderAsc", String(opts.orderAsc));
+    if ((opts == null ? void 0 : opts.offset) !== void 0)
+      url.searchParams.set("offset", String(opts.offset));
+    if ((opts == null ? void 0 : opts.limit) !== void 0)
+      url.searchParams.set("limit", String(opts.limit));
+    const response = await fetch(url, {
+      method: "GET",
+      headers: __spreadValues(__spreadValues(__spreadValues({}, config.headers), config.apiKey ? { "X-API-KEY": config.apiKey } : {}), config.accessToken ? { Authorization: `Bearer ${config.accessToken}` } : {}),
+      signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
+    });
+    if (!response.ok) {
+      throw await createRawApiError(response);
+    }
+    const data = await response.json();
+    return {
+      items: (_a3 = data.items) != null ? _a3 : [],
+      total: (_b = data.total) != null ? _b : 0,
+      hasMore: (_c = data.hasMore) != null ? _c : false
+    };
+  }
 };
 var BasePaginator = class {
   constructor(config, limit, nextToken) {
@@ -3740,7 +4138,7 @@ var SandboxPaginator = class extends BasePaginator {
     this.query = opts == null ? void 0 : opts.query;
   }
   async nextItems() {
-    var _a3, _b, _c;
+    var _a3, _b, _c, _d, _e;
     if (!this.hasNext) {
       throw new Error("No more items to fetch");
     }
@@ -3754,11 +4152,55 @@ var SandboxPaginator = class extends BasePaginator {
       );
       metadata = new URLSearchParams(encodedPairs).toString();
     }
+    if (this.config.isLegacyDomain) {
+      const params = new URLSearchParams();
+      if (metadata) {
+        params.set("metadata", metadata);
+      }
+      if ((_c = (_b = this.query) == null ? void 0 : _b.state) == null ? void 0 : _c.length) {
+        params.set("state", this.query.state.join(","));
+      }
+      if (this.limit) {
+        params.set("limit", String(this.limit));
+      }
+      if (this.nextToken) {
+        params.set("nextToken", this.nextToken);
+      }
+      const query = params.toString();
+      const response = await fetch(
+        `${this.config.apiUrl}/v2/sandboxes${query ? `?${query}` : ""}`,
+        {
+          headers: getRawApiHeaders(this.config),
+          signal: this.config.getSignal()
+        }
+      );
+      if (!response.ok) {
+        throw await createRawApiError(response);
+      }
+      this.updatePagination(response);
+      const data = await response.json();
+      return (data != null ? data : []).map((sandbox) => {
+        var _a4, _b2;
+        return __spreadProps(__spreadValues({
+          sandboxId: sandbox.clientID != null ? `${sandbox.sandboxID}-${sandbox.clientID}` : sandbox.sandboxID,
+          templateId: sandbox.templateID
+        }, sandbox.alias && { name: sandbox.alias }), {
+          metadata: (_a4 = sandbox.metadata) != null ? _a4 : {},
+          startedAt: new Date(sandbox.startedAt),
+          endAt: new Date(sandbox.endAt),
+          state: sandbox.state,
+          cpuCount: sandbox.cpuCount,
+          memoryMB: sandbox.memoryMB,
+          envdVersion: sandbox.envdVersion,
+          volumeMounts: (_b2 = sandbox.volumeMounts) != null ? _b2 : []
+        });
+      });
+    }
     const res = await this.client.api.GET("/v2/sandboxes", {
       params: {
         query: {
           metadata,
-          state: (_b = this.query) == null ? void 0 : _b.state,
+          state: (_d = this.query) == null ? void 0 : _d.state,
           limit: this.limit,
           nextToken: this.nextToken
         }
@@ -3771,11 +4213,11 @@ var SandboxPaginator = class extends BasePaginator {
       throw err;
     }
     this.updatePagination(res.response);
-    return ((_c = res.data) != null ? _c : []).map(
+    return ((_e = res.data) != null ? _e : []).map(
       (sandbox) => {
         var _a4, _b2;
         return __spreadProps(__spreadValues({
-          sandboxId: sandbox.sandboxID,
+          sandboxId: this.config.isLegacyDomain && sandbox.clientID != null ? `${sandbox.sandboxID}-${sandbox.clientID}` : sandbox.sandboxID,
           templateId: sandbox.templateID
         }, sandbox.alias && { name: sandbox.alias }), {
           metadata: (_a4 = sandbox.metadata) != null ? _a4 : {},
@@ -3794,6 +4236,7 @@ var SandboxPaginator = class extends BasePaginator {
 var SnapshotPaginator = class extends BasePaginator {
   constructor(opts) {
     super(new ConnectionConfig(opts), opts == null ? void 0 : opts.limit, opts == null ? void 0 : opts.nextToken);
+    raiseIfLegacy(this.config, "Sandbox.listSnapshots", SandboxError);
     this.sandboxId = opts == null ? void 0 : opts.sandboxId;
   }
   async nextItems() {
@@ -3933,7 +4376,7 @@ var Sandbox = class extends SandboxApi {
       sandboxOpts
     );
     const sandbox = new this(__spreadValues(__spreadValues({}, sandboxInfo), config));
-    if (sandboxOpts == null ? void 0 : sandboxOpts.mcp) {
+    if ((sandboxOpts == null ? void 0 : sandboxOpts.mcp) && !config.isLegacyDomain) {
       sandbox.mcpToken = crypto.randomUUID();
       const res = await sandbox.commands.run(
         `mcp-gateway --config ${shellQuote(JSON.stringify(sandboxOpts.mcp))}`,
@@ -3950,6 +4393,101 @@ var Sandbox = class extends SandboxApi {
     }
     return sandbox;
   }
+  /**
+   * Clone a sandbox to create one or more identical sandboxes.
+   *
+   * @param sandboxId source sandbox ID.
+   * @param opts clone options.
+   *
+   * @returns cloned sandbox instances plus snapshot template ID.
+   */
+  static async clone(sandboxId, opts) {
+    const cloneResult = await SandboxApi.cloneSandboxes(sandboxId, opts);
+    const config = new ConnectionConfig(opts);
+    const sandboxes = cloneResult.sandboxes.map(
+      (sandbox) => new this(__spreadValues({
+        sandboxId: sandbox.sandboxId,
+        envdVersion: sandbox.envdVersion,
+        envdAccessToken: sandbox.envdAccessToken,
+        trafficAccessToken: sandbox.trafficAccessToken
+      }, config))
+    );
+    return {
+      sandboxes,
+      count: sandboxes.length,
+      snapshotTemplateId: cloneResult.snapshotTemplateId
+    };
+  }
+  /**
+   * Dynamically adjust the hotplugged memory on a running sandbox.
+   *
+   * The value represents the new *total* plugged size in MiB, not a delta.
+   * Use `0` to unplug all hotplugged memory.
+   */
+  static async hotplugMemory(sandboxId, requestedSizeMib, opts) {
+    return await SandboxApi.hotplugMemory(
+      sandboxId,
+      requestedSizeMib,
+      opts
+    );
+  }
+  /**
+   * Mount a volume to a sandbox.
+   *
+   * @param sandboxId sandbox ID.
+   * @param name volume name.
+   * @param path mount path inside the sandbox.
+   * @param opts connection options.
+   *
+   * @returns updated sandbox information.
+   */
+  static async mountVolume(sandboxId, name, path2, opts) {
+    return await SandboxApi.mountVolume(sandboxId, name, path2, opts);
+  }
+  /**
+   * Unmount a volume from a sandbox.
+   *
+   * @param sandboxId sandbox ID.
+   * @param path mount path to unmount.
+   * @param opts connection options.
+   * @param [opts.force] force unmount.
+   *
+   * @returns updated sandbox information.
+   */
+  static async unmountVolume(sandboxId, path2, opts) {
+    return await SandboxApi.unmountVolume(sandboxId, path2, opts);
+  }
+  /**
+   * Commit a sandbox to create a snapshot template.
+   *
+   * @deprecated Use snapshot APIs instead. This method is only supported for modern domains.
+   *
+   * @param sandboxId source sandbox ID.
+   * @param opts commit options.
+   *
+   * @returns created snapshot template.
+   */
+  static async commit(sandboxId, opts) {
+    return await SandboxApi.commit(sandboxId, opts);
+  }
+  /**
+   * Reset sandbox memory and optionally resume the sandbox.
+   *
+   * @param sandboxId sandbox ID.
+   * @param opts reset options.
+   *
+   * @returns `true` if reset succeeded, `false` if the sandbox is in a conflicting state.
+   */
+  static async reset(sandboxId, opts) {
+    return await SandboxApi.reset(sandboxId, opts);
+  }
+  /**
+   * Update network egress rules for a running sandbox.
+   * Omitting both `allowOut` and `denyOut` clears all egress rules.
+   */
+  static async setNetwork(sandboxId, opts) {
+    await SandboxApi.setNetwork(sandboxId, opts);
+  }
   static async betaCreate(templateOrOpts, opts) {
     var _a3, _b, _c;
     const { template, sandboxOpts } = typeof templateOrOpts === "string" ? {
@@ -3972,7 +4510,7 @@ var Sandbox = class extends SandboxApi {
       sandboxOpts
     );
     const sandbox = new this(__spreadValues(__spreadValues({}, sandboxInfo), config));
-    if (sandboxOpts == null ? void 0 : sandboxOpts.mcp) {
+    if ((sandboxOpts == null ? void 0 : sandboxOpts.mcp) && !config.isLegacyDomain) {
       sandbox.mcpToken = crypto.randomUUID();
       const res = await sandbox.commands.run(
         `mcp-gateway --config ${shellQuote(JSON.stringify(sandboxOpts.mcp))}`,
@@ -4114,6 +4652,68 @@ var Sandbox = class extends SandboxApi {
       this.resolveApiOpts(opts)
     );
   }
+  /**
+   * Reset sandbox memory and optionally resume the sandbox.
+   *
+   * @param opts reset options.
+   *
+   * @returns `true` if reset succeeded, `false` if the sandbox is in a conflicting state.
+   */
+  async reset(opts) {
+    return await SandboxApi.reset(this.sandboxId, this.resolveApiOpts(opts));
+  }
+  /**
+   * Update network egress rules for this running sandbox.
+   * Omitting both `allowOut` and `denyOut` clears all egress rules.
+   */
+  async setNetwork(opts) {
+    await SandboxApi.setNetwork(this.sandboxId, this.resolveApiOpts(opts));
+  }
+  /**
+   * Commit this sandbox to create a snapshot template.
+   *
+   * @deprecated Use snapshot APIs instead. This method is only supported for modern domains.
+   *
+   * @param opts commit options.
+   *
+   * @returns created snapshot template.
+   */
+  async commit(opts) {
+    return await SandboxApi.commit(this.sandboxId, this.resolveApiOpts(opts));
+  }
+  /**
+   * Mount a volume to this sandbox.
+   *
+   * @param name volume name.
+   * @param path mount path inside the sandbox.
+   * @param opts connection options.
+   *
+   * @returns updated sandbox information.
+   */
+  async mountVolume(name, path2, opts) {
+    return await SandboxApi.mountVolume(
+      this.sandboxId,
+      name,
+      path2,
+      this.resolveApiOpts(opts)
+    );
+  }
+  /**
+   * Unmount a volume from this sandbox.
+   *
+   * @param path mount path to unmount.
+   * @param opts connection options.
+   * @param [opts.force] force unmount.
+   *
+   * @returns updated sandbox information.
+   */
+  async unmountVolume(path2, opts) {
+    return await SandboxApi.unmountVolume(
+      this.sandboxId,
+      path2,
+      this.resolveApiOpts(opts)
+    );
+  }
   /**
    * Kill the sandbox.
    *
@@ -4125,6 +4725,22 @@ var Sandbox = class extends SandboxApi {
     }
     await SandboxApi.kill(this.sandboxId, this.resolveApiOpts(opts));
   }
+  /**
+   * Dynamically adjust the hotplugged memory on a running sandbox.
+   *
+   * The value represents the new *total* plugged size in MiB, not a delta.
+   * Use `0` to unplug all hotplugged memory.
+   *
+   * @param requestedSizeMib new total plugged memory size in MiB.
+   * @param opts connection options.
+   */
+  async hotplugMemory(requestedSizeMib, opts) {
+    await SandboxApi.hotplugMemory(
+      this.sandboxId,
+      requestedSizeMib,
+      this.resolveApiOpts(opts)
+    );
+  }
   /**
    * Pause a sandbox by its ID.
    *
@@ -4145,7 +4761,10 @@ var Sandbox = class extends SandboxApi {
    * @deprecated Use {@link Sandbox.pause} instead.
    */
   async betaPause(opts) {
-    return await SandboxApi.betaPause(this.sandboxId, this.resolveApiOpts(opts));
+    return await SandboxApi.betaPause(
+      this.sandboxId,
+      this.resolveApiOpts(opts)
+    );
   }
   /**
    * Create a snapshot of the sandbox's current state.
@@ -4197,6 +4816,7 @@ var Sandbox = class extends SandboxApi {
    * @returns MCP URL for the sandbox.
    */
   getMcpUrl() {
+    raiseIfLegacy(this.connectionConfig, "Sandbox.getMcpUrl", SandboxError);
     return `https://${this.getHost(this.mcpPort)}/mcp`;
   }
   /**
@@ -4205,6 +4825,7 @@ var Sandbox = class extends SandboxApi {
    * @returns MCP token for the sandbox, or undefined if MCP is not enabled.
    */
   async getMcpToken() {
+    raiseIfLegacy(this.connectionConfig, "Sandbox.getMcpToken", SandboxError);
     if (!this.mcpToken) {
       this.mcpToken = await this.files.read("/etc/mcp-gateway/.token", {
         user: "root"
@@ -5158,6 +5779,123 @@ function handleCmdEntrypointInstruction(instruction, templateBuilder) {
 }
 
 // src/core/template/index.ts
+var TemplateApi = class {
+  static async listTemplates(options) {
+    var _a3, _b, _c, _d, _e, _f, _g, _h;
+    const templateType = (_a3 = options == null ? void 0 : options.templateType) != null ? _a3 : "template_build";
+    const page = (_b = options == null ? void 0 : options.page) != null ? _b : 1;
+    const limit = (_c = options == null ? void 0 : options.limit) != null ? _c : 20;
+    if (!["template_build", "snapshot_template"].includes(templateType)) {
+      throw new Error(
+        'templateType must be either "template_build" or "snapshot_template"'
+      );
+    }
+    if (page < 1) {
+      throw new Error("page must be >= 1");
+    }
+    if (limit < 1 || limit > 100) {
+      throw new Error("limit must be between 1 and 100");
+    }
+    const config = new ConnectionConfig(options);
+    const url = new URL(`${config.apiUrl}/v2/templates`);
+    url.searchParams.set("template_type", templateType);
+    url.searchParams.set("page", String(page));
+    url.searchParams.set("limit", String(limit));
+    const response = await fetch(url, {
+      method: "GET",
+      headers: __spreadValues(__spreadValues(__spreadValues({}, config.headers), config.apiKey ? { "X-API-KEY": config.apiKey } : {}), config.accessToken ? { Authorization: `Bearer ${config.accessToken}` } : {}),
+      signal: config.getSignal(options == null ? void 0 : options.requestTimeoutMs)
+    });
+    if (!response.ok) {
+      throw new Error(`${response.status}: ${await response.text()}`);
+    }
+    const data = await response.json();
+    if (!data) {
+      throw new Error("Template list response data is missing");
+    }
+    return {
+      templates: ((_d = data.templates) != null ? _d : []).map(
+        (template) => ({
+          templateId: template.templateID,
+          aliases: template.aliases,
+          buildCount: template.buildCount,
+          buildId: template.buildID,
+          cpuCount: template.cpuCount,
+          createdAt: new Date(template.createdAt),
+          createdBy: template.createdBy,
+          diskSizeMB: template.diskSizeMB,
+          envdVersion: template.envdVersion,
+          lastSpawnedAt: template.lastSpawnedAt ? new Date(template.lastSpawnedAt) : null,
+          memoryMB: template.memoryMB,
+          metadata: template.metadata,
+          public: template.public,
+          spawnCount: template.spawnCount,
+          templateType: template.templateType,
+          originSandboxID: template.originSandboxID,
+          updatedAt: new Date(template.updatedAt)
+        })
+      ),
+      page: (_e = data.page) != null ? _e : page,
+      limit: (_f = data.limit) != null ? _f : limit,
+      total: (_g = data.total) != null ? _g : 0,
+      totalPages: (_h = data.totalPages) != null ? _h : 0
+    };
+  }
+  static async deleteTemplate(templateId, options) {
+    var _a3;
+    if (!templateId) {
+      throw new Error("templateId cannot be empty");
+    }
+    const config = new ConnectionConfig(options);
+    const client = new ApiClient(config);
+    const res = await client.api.DELETE("/templates/{templateID}", {
+      params: {
+        path: {
+          templateID: templateId
+        }
+      },
+      signal: config.getSignal(options == null ? void 0 : options.requestTimeoutMs)
+    });
+    if (((_a3 = res.error) == null ? void 0 : _a3.code) === 404 || res.response.status === 404) {
+      return false;
+    }
+    const err = handleApiError(res, BuildError);
+    if (err) {
+      throw err;
+    }
+    return true;
+  }
+};
+var TemplatePaginator = class {
+  constructor(options) {
+    this.hasNextPage = true;
+    var _a3;
+    this.options = options;
+    this.nextPageNumber = (_a3 = options == null ? void 0 : options.page) != null ? _a3 : 1;
+  }
+  get hasNext() {
+    return this.hasNextPage;
+  }
+  get currentPage() {
+    return this.nextPageNumber;
+  }
+  async nextPage() {
+    if (!this.hasNextPage) {
+      throw new Error("No more pages to fetch");
+    }
+    const response = await TemplateApi.listTemplates(__spreadProps(__spreadValues({}, this.options), {
+      page: this.nextPageNumber
+    }));
+    this.hasNextPage = response.page < response.totalPages;
+    this.nextPageNumber = response.page + 1;
+    return response;
+  }
+  reset() {
+    var _a3, _b;
+    this.nextPageNumber = (_b = (_a3 = this.options) == null ? void 0 : _a3.page) != null ? _b : 1;
+    this.hasNextPage = true;
+  }
+};
 var _a2;
 var TemplateBase = class _TemplateBase {
   constructor(options) {
@@ -5167,6 +5905,7 @@ var TemplateBase = class _TemplateBase {
     this.registryConfig = void 0;
     this.startCmd = void 0;
     this.readyCmd = void 0;
+    this.patchCmd = void 0;
     // Force the whole template to be rebuilt
     this.force = false;
     // Force the next layer to be rebuilt
@@ -5182,6 +5921,9 @@ var TemplateBase = class _TemplateBase {
     this.fileContextPath = (_a3 = options == null ? void 0 : options.fileContextPath) != null ? _a3 : this.fileContextPath;
     this.fileIgnorePatterns = (_b = options == null ? void 0 : options.fileIgnorePatterns) != null ? _b : this.fileIgnorePatterns;
   }
+  static list(options) {
+    return new TemplatePaginator(options);
+  }
   /**
    * Convert a template to JSON representation.
    *
@@ -5260,6 +6002,15 @@ var TemplateBase = class _TemplateBase {
       logsOffset: options == null ? void 0 : options.logsOffset
     });
   }
+  static async listTemplates(options) {
+    return TemplateApi.listTemplates(options);
+  }
+  static async delete(templateId, options) {
+    await TemplateApi.deleteTemplate(templateId, options);
+  }
+  static async deleteTemplate(templateId, options) {
+    return TemplateApi.deleteTemplate(templateId, options);
+  }
   /**
    * Check if a template with the given name exists.
    *
@@ -5728,6 +6479,11 @@ var TemplateBase = class _TemplateBase {
     this.collectStackTrace();
     return this;
   }
+  setPatchCmd(cmd) {
+    this.patchCmd = cmd;
+    this.collectStackTrace();
+    return this;
+  }
   setEnvs(envs) {
     if (Object.keys(envs).length === 0) {
       return this;
@@ -6053,6 +6809,7 @@ var TemplateBase = class _TemplateBase {
     const templateData = {
       startCmd: this.startCmd,
       readyCmd: this.readyCmd,
+      preBootScript: this.patchCmd,
       steps,
       force: this.force
     };
@@ -6079,6 +6836,8 @@ Template.aliasExists = TemplateBase.aliasExists;
 Template.assignTags = TemplateBase.assignTags;
 Template.removeTags = TemplateBase.removeTags;
 Template.getTags = TemplateBase.getTags;
+Template.list = TemplateBase.list;
+Template.delete = TemplateBase.delete;
 Template.toJSON = TemplateBase.toJSON;
 Template.toDockerfile = TemplateBase.toDockerfile;
 
@@ -6561,13 +7320,16 @@ var code_interpreter_default = Sandbox2;
   Sandbox,
   SandboxError,
   SandboxNotFoundError,
+  Secret,
+  SecretError,
   Template,
+  TemplateApi,
   TemplateBase,
   TemplateError,
+  TemplatePaginator,
   TimeoutError,
   Volume,
   VolumeError,
-  VolumeFileType,
   defaultBuildLogger,
   getSignature,
   waitForFile,