ppio-sandbox 2.1.0 → 2.1.1-a4

package/dist/{chunk-GFQFOIS4.mjs → chunk-6PRE7JOS.mjs}

@@ -60,7 +60,7 @@ import createClient from "openapi-fetch";
 import platform2 from "platform";
 
 // package.json
-var version = "2.1.0";
+var version = "2.1.1-a4";
 
 // src/core/utils.ts
 import platform from "platform";
@@ -102,12 +102,6 @@ async function sha256(data) {
 function timeoutToSeconds(timeout) {
   return Math.ceil(timeout / 1e3);
 }
-function dynamicRequire(module) {
-  if (runtime === "browser") {
-    throw new Error("Browser runtime is not supported for require");
-  }
-  return __require(module);
-}
 async function dynamicImport(module) {
   if (runtime === "browser") {
     throw new Error("Browser runtime is not supported for dynamic import");
@@ -1458,7 +1452,7 @@ var Filesystem2 = class {
     this.defaultWatchRecursive = false;
     this.rpc = createClient5(Filesystem, transport);
   }
-  async read(path2, opts) {
+  async read(path3, opts) {
     var _a3;
     const format = (_a3 = opts == null ? void 0 : opts.format) != null ? _a3 : "text";
     let user = opts == null ? void 0 : opts.user;
@@ -1472,7 +1466,7 @@ var Filesystem2 = class {
     const res = await this.envdApi.api.GET("/files", {
       params: {
         query: {
-          path: path2,
+          path: path3,
           username: user
         }
       },
@@ -1505,7 +1499,7 @@ var Filesystem2 = class {
         "Cannot specify both path and array of files. You have to specify either path and data for a single file or an array for multiple files."
       );
     }
-    const { path: path2, writeOpts, writeFiles } = typeof pathOrFiles === "string" ? {
+    const { path: path3, writeOpts, writeFiles } = typeof pathOrFiles === "string" ? {
       path: pathOrFiles,
       writeOpts: opts,
       writeFiles: [
@@ -1535,7 +1529,7 @@ var Filesystem2 = class {
       }
       const uploadResults = await Promise.all(
         writeFiles.map(async (file) => {
-          const filePath = path2 != null ? path2 : file.path;
+          const filePath = path3 != null ? path3 : file.path;
           const body = await toUploadBody(file.data, useGzip);
           const res = await this.envdApi.api.POST("/files", {
             params: {
@@ -1573,13 +1567,13 @@ var Filesystem2 = class {
         formData.append(
           "file",
           await toBlob(file.data),
-          (_a3 = file.path) != null ? _a3 : path2
+          (_a3 = file.path) != null ? _a3 : path3
         );
       }
       const res = await this.envdApi.api.POST("/files", {
         params: {
           query: {
-            path: path2,
+            path: path3,
             username: user
           }
         },
@@ -1597,7 +1591,7 @@ var Filesystem2 = class {
       }
       results.push(...files);
     }
-    return results.length === 1 && path2 ? results[0] : results;
+    return results.length === 1 && path3 ? results[0] : results;
   }
   /**
    * Write multiple files.
@@ -1625,7 +1619,7 @@ var Filesystem2 = class {
    *
    * @returns list of entries in the sandbox filesystem directory.
    */
-  async list(path2, opts) {
+  async list(path3, opts) {
     var _a3;
     if (typeof (opts == null ? void 0 : opts.depth) === "number" && opts.depth < 1) {
       throw new InvalidArgumentError("depth should be at least one");
@@ -1633,7 +1627,7 @@ var Filesystem2 = class {
     try {
       const res = await this.rpc.listDir(
         {
-          path: path2,
+          path: path3,
           depth: (_a3 = opts == null ? void 0 : opts.depth) != null ? _a3 : 1
         },
         {
@@ -1672,10 +1666,10 @@ var Filesystem2 = class {
    *
    * @returns `true` if the directory was created, `false` if it already exists.
    */
-  async makeDir(path2, opts) {
+  async makeDir(path3, opts) {
     try {
       await this.rpc.makeDir(
-        { path: path2 },
+        { path: path3 },
         {
           headers: authenticationHeader(this.envdApi.version, opts == null ? void 0 : opts.user),
           signal: this.connectionConfig.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
@@ -1738,10 +1732,10 @@ var Filesystem2 = class {
    * @param path path to a file or directory.
    * @param opts connection options.
    */
-  async remove(path2, opts) {
+  async remove(path3, opts) {
     try {
       await this.rpc.remove(
-        { path: path2 },
+        { path: path3 },
         {
           headers: authenticationHeader(this.envdApi.version, opts == null ? void 0 : opts.user),
           signal: this.connectionConfig.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
@@ -1759,10 +1753,10 @@ var Filesystem2 = class {
    *
    * @returns `true` if the file or directory exists, `false` otherwise
    */
-  async exists(path2, opts) {
+  async exists(path3, opts) {
     try {
       await this.rpc.stat(
-        { path: path2 },
+        { path: path3 },
         {
           headers: authenticationHeader(this.envdApi.version, opts == null ? void 0 : opts.user),
           signal: this.connectionConfig.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
@@ -1786,10 +1780,10 @@ var Filesystem2 = class {
    *
    * @returns information about the file or directory like name, type, and path.
    */
-  async getInfo(path2, opts) {
+  async getInfo(path3, opts) {
     try {
       const res = await this.rpc.stat(
-        { path: path2 },
+        { path: path3 },
         {
           headers: authenticationHeader(this.envdApi.version, opts == null ? void 0 : opts.user),
           signal: this.connectionConfig.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
@@ -1825,7 +1819,7 @@ var Filesystem2 = class {
    *
    * @returns `WatchHandle` object for stopping watching directory.
    */
-  async watchDir(path2, onEvent, opts) {
+  async watchDir(path3, onEvent, opts) {
     var _a3, _b, _c;
     if ((opts == null ? void 0 : opts.recursive) && this.envdApi.version && compareVersions3(this.envdApi.version, ENVD_VERSION_RECURSIVE_WATCH) < 0) {
       throw new TemplateError(
@@ -1839,7 +1833,7 @@ var Filesystem2 = class {
     }, requestTimeoutMs) : void 0;
     const events = this.rpc.watchDir(
       {
-        path: path2,
+        path: path3,
         recursive: (_b = opts == null ? void 0 : opts.recursive) != null ? _b : this.defaultWatchRecursive
       },
       {
@@ -2060,11 +2054,11 @@ function parseGitStatus(output) {
     }
     const indexStatus = line[0];
     const workingTreeStatus = line[1];
-    const path2 = line.slice(3);
+    const path3 = line.slice(3);
     let renamedFrom;
-    let name = path2;
-    if (path2.includes(" -> ")) {
-      const parts = path2.split(" -> ");
+    let name = path3;
+    if (path3.includes(" -> ")) {
+      const parts = path3.split(" -> ");
       renamedFrom = parts[0];
       name = parts.slice(1).join(" -> ");
     }
@@ -2173,16 +2167,16 @@ function buildUpstreamErrorMessage(action) {
   }
   return "Git pull failed because no upstream branch is configured. Pass remote and branch explicitly, or set upstream once (push with { setUpstream: true } or run: git branch --set-upstream-to=origin/<branch> <branch>).";
 }
-function getRepoPathForScope(scope, path2) {
+function getRepoPathForScope(scope, path3) {
   if (scope !== "local") {
     return void 0;
   }
-  if (!path2) {
+  if (!path3) {
     throw new InvalidArgumentError(
       'A repository path is required when using scope "local".'
     );
   }
-  return path2;
+  return path3;
 }
 
 // src/core/sandbox/git/index.ts
@@ -2206,7 +2200,7 @@ var Git = class {
       password,
       branch,
       depth,
-      path: path2,
+      path: path3,
       dangerouslyStoreCredentials
     } = _a3, rest = __objRest(_a3, [
       "username",
@@ -2225,7 +2219,7 @@ var Git = class {
       const urlWithCreds = authUsername && authPassword ? withCredentials(url, authUsername, authPassword) : url;
       const sanitizedUrl = stripCredentials(urlWithCreds);
       const stripInlineCreds = !dangerouslyStoreCredentials && sanitizedUrl !== urlWithCreds;
-      const repoPath = stripInlineCreds ? path2 != null ? path2 : deriveRepoDirFromUrl(url) : path2;
+      const repoPath = stripInlineCreds ? path3 != null ? path3 : deriveRepoDirFromUrl(url) : path3;
       if (stripInlineCreds && !repoPath) {
         throw new InvalidArgumentError(
           "A destination path is required when using credentials without storing them."
@@ -2263,7 +2257,7 @@ var Git = class {
    * @param opts Init options.
    * @returns Command result from the command runner.
    */
-  async init(path2, opts) {
+  async init(path3, opts) {
     const _a3 = opts != null ? opts : {}, { bare, initialBranch } = _a3, rest = __objRest(_a3, ["bare", "initialBranch"]);
     const args = ["init"];
     if (initialBranch) {
@@ -2272,7 +2266,7 @@ var Git = class {
     if (bare) {
       args.push("--bare");
     }
-    args.push(path2);
+    args.push(path3);
     return this.runGit(args, void 0, rest);
   }
   /**
@@ -2284,7 +2278,7 @@ var Git = class {
    * @param opts Remote add options.
    * @returns Command result from the command runner.
    */
-  async remoteAdd(path2, name, url, opts) {
+  async remoteAdd(path3, name, url, opts) {
     if (!name || !url) {
       throw new InvalidArgumentError(
         "Both remote name and URL are required to add a git remote."
@@ -2297,13 +2291,13 @@ var Git = class {
     }
     addArgs.push(name, url);
     if (!overwrite) {
-      return this.runGit(addArgs, path2, rest);
+      return this.runGit(addArgs, path3, rest);
     }
-    const addCmd = buildGitCommand(addArgs, path2);
-    const setUrlCmd = buildGitCommand(["remote", "set-url", name, url], path2);
+    const addCmd = buildGitCommand(addArgs, path3);
+    const setUrlCmd = buildGitCommand(["remote", "set-url", name, url], path3);
     let cmd = `${addCmd} || ${setUrlCmd}`;
     if (fetch2) {
-      const fetchCmd = buildGitCommand(["fetch", name], path2);
+      const fetchCmd = buildGitCommand(["fetch", name], path3);
       cmd = `(${cmd}) && ${fetchCmd}`;
     }
     return this.runShell(cmd, rest);
@@ -2318,11 +2312,11 @@ var Git = class {
    * @param opts Command execution options.
    * @returns Remote URL if present.
    */
-  async remoteGet(path2, name, opts) {
+  async remoteGet(path3, name, opts) {
     if (!name) {
       throw new InvalidArgumentError("Remote name is required.");
     }
-    const cmd = `${buildGitCommand(["remote", "get-url", name], path2)} || true`;
+    const cmd = `${buildGitCommand(["remote", "get-url", name], path3)} || true`;
     const result = await this.runShell(cmd, opts);
     const trimmed = result.stdout.trim();
     return trimmed.length > 0 ? trimmed : void 0;
@@ -2334,10 +2328,10 @@ var Git = class {
    * @param opts Command execution options.
    * @returns Parsed git status.
    */
-  async status(path2, opts) {
+  async status(path3, opts) {
     const result = await this.runGit(
       ["status", "--porcelain=1", "-b"],
-      path2,
+      path3,
       opts
     );
     return parseGitStatus(result.stdout);
@@ -2349,10 +2343,10 @@ var Git = class {
    * @param opts Command execution options.
    * @returns Parsed branch list.
    */
-  async branches(path2, opts) {
+  async branches(path3, opts) {
     const result = await this.runGit(
       ["branch", "--format=%(refname:short)	%(HEAD)"],
-      path2,
+      path3,
       opts
     );
     return parseGitBranches(result.stdout);
@@ -2365,8 +2359,8 @@ var Git = class {
    * @param opts Command execution options.
    * @returns Command result from the command runner.
    */
-  async createBranch(path2, branch, opts) {
-    return this.runGit(["checkout", "-b", branch], path2, opts);
+  async createBranch(path3, branch, opts) {
+    return this.runGit(["checkout", "-b", branch], path3, opts);
   }
   /**
    * Check out an existing branch.
@@ -2376,8 +2370,8 @@ var Git = class {
    * @param opts Command execution options.
    * @returns Command result from the command runner.
    */
-  async checkoutBranch(path2, branch, opts) {
-    return this.runGit(["checkout", branch], path2, opts);
+  async checkoutBranch(path3, branch, opts) {
+    return this.runGit(["checkout", branch], path3, opts);
   }
   /**
    * Delete a branch.
@@ -2387,10 +2381,10 @@ var Git = class {
    * @param opts Delete options.
    * @returns Command result from the command runner.
    */
-  async deleteBranch(path2, branch, opts) {
+  async deleteBranch(path3, branch, opts) {
     const _a3 = opts != null ? opts : {}, { force } = _a3, rest = __objRest(_a3, ["force"]);
     const args = ["branch", force ? "-D" : "-d", branch];
-    return this.runGit(args, path2, rest);
+    return this.runGit(args, path3, rest);
   }
   /**
    * Stage files for commit.
@@ -2399,7 +2393,7 @@ var Git = class {
    * @param opts Add options.
    * @returns Command result from the command runner.
    */
-  async add(path2, opts) {
+  async add(path3, opts) {
     const _a3 = opts != null ? opts : {}, { files, all = true } = _a3, rest = __objRest(_a3, ["files", "all"]);
     const args = ["add"];
     if (!files || files.length === 0) {
@@ -2407,7 +2401,7 @@ var Git = class {
     } else {
       args.push("--", ...files);
     }
-    return this.runGit(args, path2, rest);
+    return this.runGit(args, path3, rest);
   }
   /**
    * Create a commit in the repository.
@@ -2417,7 +2411,7 @@ var Git = class {
    * @param opts Commit options.
    * @returns Command result from the command runner.
    */
-  async commit(path2, message, opts) {
+  async commit(path3, message, opts) {
     const _a3 = opts != null ? opts : {}, { authorName, authorEmail, allowEmpty } = _a3, rest = __objRest(_a3, ["authorName", "authorEmail", "allowEmpty"]);
     const args = ["commit", "-m", message];
     if (allowEmpty) {
@@ -2430,7 +2424,7 @@ var Git = class {
     if (authorEmail) {
       authorArgs.push("-c", `user.email=${authorEmail}`);
     }
-    return this.runGit([...authorArgs, ...args], path2, rest);
+    return this.runGit([...authorArgs, ...args], path3, rest);
   }
   /**
    * Reset the current HEAD to a specified state.
@@ -2439,7 +2433,7 @@ var Git = class {
    * @param opts Reset options.
    * @returns Command result from the command runner.
    */
-  async reset(path2, opts) {
+  async reset(path3, opts) {
     const _a3 = opts != null ? opts : {}, { mode, target, paths: paths2 } = _a3, rest = __objRest(_a3, ["mode", "target", "paths"]);
     const allowedModes = [
       "soft",
@@ -2463,7 +2457,7 @@ var Git = class {
     if (paths2 && paths2.length > 0) {
       args.push("--", ...paths2);
     }
-    return this.runGit(args, path2, rest);
+    return this.runGit(args, path3, rest);
   }
   /**
    * Restore working tree files or unstage changes.
@@ -2472,7 +2466,7 @@ var Git = class {
    * @param opts Restore options.
    * @returns Command result from the command runner.
    */
-  async restore(path2, opts) {
+  async restore(path3, opts) {
     const _a3 = opts, { paths: paths2, staged, worktree, source } = _a3, rest = __objRest(_a3, ["paths", "staged", "worktree", "source"]);
     if (!paths2 || paths2.length === 0) {
       throw new InvalidArgumentError("At least one path is required.");
@@ -2502,7 +2496,7 @@ var Git = class {
       args.push("--source", source);
     }
     args.push("--", ...paths2);
-    return this.runGit(args, path2, rest);
+    return this.runGit(args, path3, rest);
   }
   /**
    * Push commits to a remote.
@@ -2511,7 +2505,7 @@ var Git = class {
    * @param opts Push options.
    * @returns Command result from the command runner.
    */
-  async push(path2, opts) {
+  async push(path3, opts) {
     const _a3 = opts != null ? opts : {}, {
       remote,
       branch,
@@ -2531,16 +2525,16 @@ var Git = class {
       );
     }
     if (username && password) {
-      const remoteName = await this.resolveRemoteName(path2, remote, rest);
+      const remoteName = await this.resolveRemoteName(path3, remote, rest);
       return this.withRemoteCredentials(
-        path2,
+        path3,
         remoteName,
         username,
         password,
         rest,
         () => this.runGit(
           buildPushArgs(remoteName, { remote, branch, setUpstream }),
-          path2,
+          path3,
           rest
         )
       );
@@ -2548,7 +2542,7 @@ var Git = class {
     try {
       return await this.runGit(
         buildPushArgs(void 0, { remote, branch, setUpstream }),
-        path2,
+        path3,
         rest
       );
     } catch (err) {
@@ -2570,7 +2564,7 @@ var Git = class {
    * @param opts Pull options.
    * @returns Command result from the command runner.
    */
-  async pull(path2, opts) {
+  async pull(path3, opts) {
     const _a3 = opts != null ? opts : {}, { remote, branch, username, password } = _a3, rest = __objRest(_a3, ["remote", "branch", "username", "password"]);
     if (password && !username) {
       throw new InvalidArgumentError(
@@ -2578,7 +2572,7 @@ var Git = class {
       );
     }
     if (!remote && !branch) {
-      const hasUpstream = await this.hasUpstream(path2, rest);
+      const hasUpstream = await this.hasUpstream(path3, rest);
       if (!hasUpstream) {
         throw new GitUpstreamError(buildUpstreamErrorMessage("pull"));
       }
@@ -2595,18 +2589,18 @@ var Git = class {
       return args;
     };
     if (username && password) {
-      const remoteName = await this.resolveRemoteName(path2, remote, rest);
+      const remoteName = await this.resolveRemoteName(path3, remote, rest);
       return this.withRemoteCredentials(
-        path2,
+        path3,
         remoteName,
         username,
         password,
         rest,
-        () => this.runGit(buildArgs(remoteName), path2, rest)
+        () => this.runGit(buildArgs(remoteName), path3, rest)
       );
     }
     try {
-      return await this.runGit(buildArgs(), path2, rest);
+      return await this.runGit(buildArgs(), path3, rest);
     } catch (err) {
       if (isAuthFailure(err)) {
         throw new GitAuthError(
@@ -2743,8 +2737,8 @@ var Git = class {
       envs: mergedEnvs
     }));
   }
-  async getRemoteUrl(path2, remote, opts) {
-    const result = await this.runGit(["remote", "get-url", remote], path2, opts);
+  async getRemoteUrl(path3, remote, opts) {
+    const result = await this.runGit(["remote", "get-url", remote], path3, opts);
     const url = result.stdout.trim();
     if (!url) {
       throw new InvalidArgumentError(
@@ -2753,11 +2747,11 @@ var Git = class {
     }
     return url;
   }
-  async resolveRemoteName(path2, remote, opts) {
+  async resolveRemoteName(path3, remote, opts) {
     if (remote) {
       return remote;
     }
-    const result = await this.runGit(["remote"], path2, opts);
+    const result = await this.runGit(["remote"], path3, opts);
     const remotes = result.stdout.split("\n").map((line) => line.trim()).filter(Boolean);
     if (remotes.length === 1) {
       return remotes[0];
@@ -2766,10 +2760,10 @@ var Git = class {
       "Remote is required when using username/password and the repository has multiple remotes."
     );
   }
-  async withRemoteCredentials(path2, remote, username, password, opts, operation) {
-    const originalUrl = await this.getRemoteUrl(path2, remote, opts);
+  async withRemoteCredentials(path3, remote, username, password, opts, operation) {
+    const originalUrl = await this.getRemoteUrl(path3, remote, opts);
     const credentialUrl = withCredentials(originalUrl, username, password);
-    await this.runGit(["remote", "set-url", remote, credentialUrl], path2, opts);
+    await this.runGit(["remote", "set-url", remote, credentialUrl], path3, opts);
     let result;
     let operationError;
     try {
@@ -2779,7 +2773,7 @@ var Git = class {
     }
     let restoreError;
     try {
-      await this.runGit(["remote", "set-url", remote, originalUrl], path2, opts);
+      await this.runGit(["remote", "set-url", remote, originalUrl], path3, opts);
     } catch (err) {
       restoreError = err;
     }
@@ -2791,11 +2785,11 @@ var Git = class {
     }
     return result;
   }
-  async hasUpstream(path2, opts) {
+  async hasUpstream(path3, opts) {
     try {
       const result = await this.runGit(
         ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"],
-        path2,
+        path3,
         opts
       );
       return result.stdout.trim().length > 0;
@@ -2963,11 +2957,11 @@ function normalizeSecretHosts(hosts) {
   }
   return normalizedHosts;
 }
-async function request(method, path2, feature, opts, body) {
+async function request(method, path3, feature, opts, body) {
   const config = new ConnectionConfig(opts);
   raiseIfLegacy(config, feature, SecretError);
   const headers = __spreadValues(__spreadValues(__spreadValues(__spreadValues({}, config.headers), body ? { "Content-Type": "application/json" } : {}), config.apiKey ? { "X-API-KEY": config.apiKey } : {}), config.accessToken ? { Authorization: `Bearer ${config.accessToken}` } : {});
-  const response = await fetch(`${config.apiUrl}${path2}`, {
+  const response = await fetch(`${config.apiUrl}${path3}`, {
     method,
     headers,
     body: body ? JSON.stringify(body) : void 0,
@@ -3282,7 +3276,7 @@ var SandboxApi = class {
     }
     return true;
   }
-  static async mountVolume(sandboxId, name, path2, opts) {
+  static async mountVolume(sandboxId, name, path3, opts) {
     var _a3, _b;
     const config = new ConnectionConfig(opts);
     raiseIfLegacy(config, "Sandbox.mountVolume", SandboxError);
@@ -3293,7 +3287,7 @@ var SandboxApi = class {
         headers: getRawApiHeaders(config, {
           "Content-Type": "application/json"
         }),
-        body: JSON.stringify({ name, path: path2 }),
+        body: JSON.stringify({ name, path: path3 }),
         signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
       }
     );
@@ -3318,14 +3312,14 @@ var SandboxApi = class {
       volumeMounts: (_b = data.volumeMounts) != null ? _b : []
     };
   }
-  static async unmountVolume(sandboxId, path2, opts) {
+  static async unmountVolume(sandboxId, path3, opts) {
     var _a3, _b;
     const config = new ConnectionConfig(opts);
     raiseIfLegacy(config, "Sandbox.unmountVolume", SandboxError);
     const url = new URL(
       `${config.apiUrl}/sandboxes/${encodeURIComponent(sandboxId)}/volume-mounts`
     );
-    url.searchParams.set("path", path2);
+    url.searchParams.set("path", path3);
     if (opts == null ? void 0 : opts.force) {
       url.searchParams.set("force", "true");
     }
@@ -3619,7 +3613,7 @@ var SandboxApi = class {
     return true;
   }
   static async createSandbox(template, timeoutMs, opts) {
-    var _a3, _b, _c, _d, _e, _f;
+    var _a3, _b, _c, _d, _e, _f, _g;
     const config = new ConnectionConfig(opts);
     const lifecycle = getLifecycle(opts);
     const autoPause = lifecycle.onTimeout === "pause";
@@ -3628,8 +3622,13 @@ var SandboxApi = class {
       if (opts == null ? void 0 : opts.mcp) {
         raiseIfLegacy(config, "Sandbox.create mcp", SandboxError);
       }
-      if (opts == null ? void 0 : opts.network) {
-        raiseIfLegacy(config, "Sandbox.create network", SandboxError);
+      const unsupportedNetworkOptions = Object.keys((_b = opts == null ? void 0 : opts.network) != null ? _b : {}).filter(
+        (key) => key !== "allowPublicTraffic"
+      );
+      if (unsupportedNetworkOptions.length > 0) {
+        throw new SandboxError(
+          `Sandbox.create network only supports allowPublicTraffic on legacy domains; unsupported options: ${unsupportedNetworkOptions.join(", ")}`
+        );
       }
       if (opts == null ? void 0 : opts.volumeMounts) {
         raiseIfLegacy(config, "Sandbox.create volumeMounts", SandboxError);
@@ -3637,14 +3636,14 @@ var SandboxApi = class {
       if (opts == null ? void 0 : opts.secretEnvs) {
         raiseIfLegacy(config, "Sandbox.create secretEnvs", SandboxError);
       }
-      const body2 = __spreadValues({
+      const body2 = __spreadValues(__spreadValues({
         templateID: template,
         timeout: timeoutToSeconds(timeoutMs),
-        metadata: (_b = opts == null ? void 0 : opts.metadata) != null ? _b : {},
-        envVars: (_c = opts == null ? void 0 : opts.envs) != null ? _c : {},
-        secure: (_d = opts == null ? void 0 : opts.secure) != null ? _d : false,
+        metadata: (_c = opts == null ? void 0 : opts.metadata) != null ? _c : {},
+        envVars: (_d = opts == null ? void 0 : opts.envs) != null ? _d : {},
+        secure: (_e = opts == null ? void 0 : opts.secure) != null ? _e : false,
         autoPause: autoPause != null ? autoPause : false
-      }, (opts == null ? void 0 : opts.nodeId) ? { nodeID: opts.nodeId } : {});
+      }, (opts == null ? void 0 : opts.network) ? { network: opts.network } : {}), (opts == null ? void 0 : opts.nodeId) ? { nodeID: opts.nodeId } : {});
       const response = await fetch(`${config.apiUrl}/sandboxes`, {
         method: "POST",
         headers: getRawApiHeaders(config, {
@@ -3668,7 +3667,7 @@ var SandboxApi = class {
         sandboxDomain: data.domain || void 0,
         envdVersion: data.envdVersion,
         envdAccessToken: data.envdAccessToken,
-        trafficAccessToken: void 0
+        trafficAccessToken: data.trafficAccessToken || void 0
       };
     }
     const client = new ApiClient(config);
@@ -3678,8 +3677,8 @@ var SandboxApi = class {
       mcp: opts == null ? void 0 : opts.mcp,
       envVars: opts == null ? void 0 : opts.envs,
       timeout: timeoutToSeconds(timeoutMs),
-      secure: (_e = opts == null ? void 0 : opts.secure) != null ? _e : true,
-      allow_internet_access: (_f = opts == null ? void 0 : opts.allowInternetAccess) != null ? _f : true,
+      secure: (_f = opts == null ? void 0 : opts.secure) != null ? _f : true,
+      allow_internet_access: (_g = opts == null ? void 0 : opts.allowInternetAccess) != null ? _g : true,
       network: opts == null ? void 0 : opts.network
     }, (opts == null ? void 0 : opts.nodeId) ? { nodeID: opts.nodeId } : {}), autoPause !== void 0 ? { autoPause } : {}), autoResumeEnabled !== void 0 ? { autoResume: { enabled: autoResumeEnabled } } : {});
     if (opts == null ? void 0 : opts.volumeMounts) {
@@ -3732,7 +3731,9 @@ var SandboxApi = class {
           headers: getRawApiHeaders(config, {
             "Content-Type": "application/json"
           }),
-          body: JSON.stringify({ timeout: timeoutToSeconds(timeoutMs) }),
+          body: JSON.stringify(__spreadValues(__spreadValues(__spreadValues({
+            timeout: timeoutToSeconds(timeoutMs)
+          }, (opts == null ? void 0 : opts.secure) !== void 0 ? { secure: opts.secure } : {}), (opts == null ? void 0 : opts.allowPublicTraffic) !== void 0 ? { allowPublicTraffic: opts.allowPublicTraffic } : {}), (opts == null ? void 0 : opts.network) ? { network: opts.network } : {})),
           signal: config.getSignal(opts == null ? void 0 : opts.requestTimeoutMs)
         }
       );
@@ -3748,7 +3749,7 @@ var SandboxApi = class {
         sandboxDomain: data.domain || void 0,
         envdVersion: data.envdVersion || "0.0.0",
         envdAccessToken: data.envdAccessToken,
-        trafficAccessToken: void 0
+        trafficAccessToken: data.trafficAccessToken || void 0
       };
     }
     const client = new ApiClient(config);
@@ -4005,7 +4006,7 @@ var SnapshotPaginator = class extends BasePaginator {
 
 // src/core/sandbox/signature.ts
 async function getSignature({
-  path: path2,
+  path: path3,
   operation,
   user,
   expirationInSeconds,
@@ -4022,9 +4023,9 @@ async function getSignature({
     user = "";
   }
   if (signatureExpiration === null) {
-    signatureRaw = `${path2}:${operation}:${user}:${envdAccessToken}`;
+    signatureRaw = `${path3}:${operation}:${user}:${envdAccessToken}`;
   } else {
-    signatureRaw = `${path2}:${operation}:${user}:${envdAccessToken}:${signatureExpiration.toString()}`;
+    signatureRaw = `${path3}:${operation}:${user}:${envdAccessToken}:${signatureExpiration.toString()}`;
   }
   const hashBase64 = await sha256(signatureRaw);
   const signature = "v1_" + hashBase64.replace(/=+$/, "");
@@ -4208,8 +4209,8 @@ var Sandbox = class extends SandboxApi {
    *
    * @returns updated sandbox information.
    */
-  static async mountVolume(sandboxId, name, path2, opts) {
-    return await SandboxApi.mountVolume(sandboxId, name, path2, opts);
+  static async mountVolume(sandboxId, name, path3, opts) {
+    return await SandboxApi.mountVolume(sandboxId, name, path3, opts);
   }
   /**
    * Unmount a volume from a sandbox.
@@ -4221,8 +4222,8 @@ var Sandbox = class extends SandboxApi {
    *
    * @returns updated sandbox information.
    */
-  static async unmountVolume(sandboxId, path2, opts) {
-    return await SandboxApi.unmountVolume(sandboxId, path2, opts);
+  static async unmountVolume(sandboxId, path3, opts) {
+    return await SandboxApi.unmountVolume(sandboxId, path3, opts);
   }
   /**
    * Commit a sandbox to create a snapshot template.
@@ -4457,11 +4458,11 @@ var Sandbox = class extends SandboxApi {
    *
    * @returns updated sandbox information.
    */
-  async mountVolume(name, path2, opts) {
+  async mountVolume(name, path3, opts) {
     return await SandboxApi.mountVolume(
       this.sandboxId,
       name,
-      path2,
+      path3,
       this.resolveApiOpts(opts)
     );
   }
@@ -4474,10 +4475,10 @@ var Sandbox = class extends SandboxApi {
    *
    * @returns updated sandbox information.
    */
-  async unmountVolume(path2, opts) {
+  async unmountVolume(path3, opts) {
     return await SandboxApi.unmountVolume(
       this.sandboxId,
-      path2,
+      path3,
       this.resolveApiOpts(opts)
     );
   }
@@ -4611,7 +4612,7 @@ var Sandbox = class extends SandboxApi {
    *
    * @returns URL for uploading file.
    */
-  async uploadUrl(path2, opts) {
+  async uploadUrl(path3, opts) {
     opts = opts != null ? opts : {};
     const useSignature = !!this.envdAccessToken;
     if (!useSignature && opts.useSignatureExpiration != void 0) {
@@ -4623,7 +4624,7 @@ var Sandbox = class extends SandboxApi {
     if (username == void 0 && compareVersions5(this.envdApi.version, ENVD_DEFAULT_USER) < 0) {
       username = defaultUsername;
     }
-    const filePath = path2 != null ? path2 : "";
+    const filePath = path3 != null ? path3 : "";
     const fileUrl = this.fileUrl(filePath, username);
     if (useSignature) {
       const url = new URL(fileUrl);
@@ -4651,7 +4652,7 @@ var Sandbox = class extends SandboxApi {
    *
    * @returns URL for downloading file.
    */
-  async downloadUrl(path2, opts) {
+  async downloadUrl(path3, opts) {
     opts = opts != null ? opts : {};
     const useSignature = !!this.envdAccessToken;
     if (!useSignature && opts.useSignatureExpiration != void 0) {
@@ -4663,11 +4664,11 @@ var Sandbox = class extends SandboxApi {
     if (username == void 0 && compareVersions5(this.envdApi.version, ENVD_DEFAULT_USER) < 0) {
       username = defaultUsername;
     }
-    const fileUrl = this.fileUrl(path2, username);
+    const fileUrl = this.fileUrl(path3, username);
     if (useSignature) {
       const url = new URL(fileUrl);
       const sig = await getSignature({
-        path: path2,
+        path: path3,
         operation: "read",
         user: username,
         expirationInSeconds: opts.useSignatureExpiration,
@@ -4721,13 +4722,13 @@ var Sandbox = class extends SandboxApi {
   resolveApiOpts(opts) {
     return __spreadValues(__spreadValues({}, this.connectionConfig), opts != null ? opts : {});
   }
-  fileUrl(path2, username) {
+  fileUrl(path3, username) {
     const url = new URL("/files", this.envdApiUrl);
     if (username) {
       url.searchParams.set("username", username);
     }
-    if (path2) {
-      url.searchParams.set("path", path2);
+    if (path3) {
+      url.searchParams.set("path", path3);
     }
     return url.toString();
   }
@@ -4858,6 +4859,7 @@ function defaultBuildLogger(options) {
 import crypto2 from "crypto";
 import fs from "fs";
 import path from "path";
+import { fileURLToPath } from "url";
 
 // src/core/template/consts.ts
 var FINALIZE_STEP_NAME = "finalize";
@@ -4908,8 +4910,8 @@ function readDockerignore(contextPath) {
   const content = fs.readFileSync(dockerignorePath, "utf-8");
   return content.split("\n").map((line) => line.trim()).filter((line) => line && !line.startsWith("#"));
 }
-function normalizePath(path2) {
-  return path2.replace(/\\/g, "/");
+function normalizePath(path3) {
+  return path3.replace(/\\/g, "/");
 }
 async function getAllFilesInPath(src, contextPath, ignorePatterns, includeDirectories = true) {
   const { glob } = await dynamicImport("glob");
@@ -5021,7 +5023,6 @@ function getCallerDirectory(depth) {
     return void 0;
   }
   if (fileName.startsWith("file:")) {
-    const { fileURLToPath } = dynamicRequire("node:url");
     fileName = fileURLToPath(fileName);
   }
   return path.dirname(fileName);
@@ -6477,8 +6478,8 @@ var TemplateBase = class _TemplateBase {
     });
     return this;
   }
-  remove(path2, options) {
-    const paths2 = Array.isArray(path2) ? path2 : [path2];
+  remove(path3, options) {
+    const paths2 = Array.isArray(path3) ? path3 : [path3];
     const args = ["rm"];
     if (options == null ? void 0 : options.recursive) {
       args.push("-r");
@@ -6500,8 +6501,8 @@ var TemplateBase = class _TemplateBase {
       () => this.runCmd(args.join(" "), { user: options == null ? void 0 : options.user })
     );
   }
-  makeDir(path2, options) {
-    const paths2 = Array.isArray(path2) ? path2 : [path2];
+  makeDir(path3, options) {
+    const paths2 = Array.isArray(path3) ? path3 : [path3];
     const args = ["mkdir", "-p"];
     if (options == null ? void 0 : options.mode) {
       args.push(`-m ${padOctal(options.mode)}`);
@@ -6636,7 +6637,7 @@ var TemplateBase = class _TemplateBase {
       })
     );
   }
-  gitClone(url, path2, options) {
+  gitClone(url, path3, options) {
     const args = ["git", "clone", url];
     if (options == null ? void 0 : options.branch) {
       args.push(`--branch ${options.branch}`);
@@ -6645,8 +6646,8 @@ var TemplateBase = class _TemplateBase {
     if (options == null ? void 0 : options.depth) {
       args.push(`--depth ${options.depth}`);
     }
-    if (path2) {
-      args.push(path2.toString());
+    if (path3) {
+      args.push(path3.toString());
     }
     return this.runInNewStackTraceContext(
       () => this.runCmd(args.join(" "), { user: options == null ? void 0 : options.user })
@@ -7361,6 +7362,8 @@ var Volume = class _Volume {
 };
 
 // src/core/client.ts
+import path2 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 function mergeConnectionOpts(base, next) {
   var _a3, _b;
   const baseHeaders = (_a3 = base.headers) != null ? _a3 : {};
@@ -7565,7 +7568,18 @@ var TemplateNamespace = class {
     this.toDockerfile = Template.toDockerfile;
   }
   new(options) {
-    return Template(options);
+    var _a3;
+    let callerContext = ".";
+    for (const site of callsites(2)) {
+      const fileName = site.getFileName();
+      if (fileName && (!fileName.includes("/src/core/") || fileName.includes("/src/core/tests/")) && !fileName.includes("/node_modules/ppio-sandbox/")) {
+        callerContext = path2.dirname(fileName.startsWith("file:") ? fileURLToPath2(fileName) : fileName);
+        break;
+      }
+    }
+    return Template(__spreadProps(__spreadValues({}, options), {
+      fileContextPath: (_a3 = options == null ? void 0 : options.fileContextPath) != null ? _a3 : callerContext
+    }));
   }
   list(opts) {
     return Template.list(mergeConnectionOpts(this.opts, opts));
@@ -7694,12 +7708,12 @@ var PPIO = class {
     this.secret = new SecretNamespace(opts);
     this.codeInterpreter = new RuntimeSandboxNamespace(
       opts,
-      () => import("./sandbox-FGY2BWMG.mjs")
+      () => import("./sandbox-OAPKYDCZ.mjs")
     );
     this.code_interpreter = this.codeInterpreter;
     this.desktop = new RuntimeSandboxNamespace(
       opts,
-      () => import("./sandbox-7DONHEV2.mjs")
+      () => import("./sandbox-IFBOTC7A.mjs")
     );
   }
   async create(templateOrOpts, opts) {
@@ -7777,4 +7791,4 @@ export {
   ALL_TRAFFIC,
   core_default
 };
-//# sourceMappingURL=chunk-GFQFOIS4.mjs.map
+//# sourceMappingURL=chunk-6PRE7JOS.mjs.map