sandbox 2.0.4 → 2.1.0

package/dist/{app-Be0xsoIH.mjs → app-DtmaeGtx.mjs}

@@ -622,8 +622,8 @@ var require_effects = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/c
 	* with a command line, and again, to mock `stdout` and `stderr` it if we want to test it.
 	*/
 	var Exit = class {
-		constructor(config) {
-			this.config = config;
+		constructor(config$1) {
+			this.config = config$1;
 		}
 		run() {
 			this.output()(this.config.message);
@@ -867,65 +867,65 @@ var require_flag = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cmd-
 		displayName: "true/false",
 		defaultValue: () => false
 	};
-	function fullFlag(config) {
+	function fullFlag(config$1) {
 		var _a;
-		const decoder = (0, type_1$2.extendType)(exports.boolean, config.type);
+		const decoder = (0, type_1$2.extendType)(exports.boolean, config$1.type);
 		return {
-			description: (_a = config.description) !== null && _a !== void 0 ? _a : config.type.description,
+			description: (_a = config$1.description) !== null && _a !== void 0 ? _a : config$1.type.description,
 			helpTopics() {
 				var _a$1, _b;
-				let usage = `--${config.long}`;
-				if (config.short) usage += `, -${config.short}`;
+				let usage = `--${config$1.long}`;
+				if (config$1.short) usage += `, -${config$1.short}`;
 				const defaults = [];
-				if (config.env) {
-					const env$2 = process.env[config.env] === void 0 ? "" : `=${chalk_1$6.default.italic(process.env[config.env])}`;
-					defaults.push(`env: ${config.env}${env$2}`);
+				if (config$1.env) {
+					const env$2 = process.env[config$1.env] === void 0 ? "" : `=${chalk_1$6.default.italic(process.env[config$1.env])}`;
+					defaults.push(`env: ${config$1.env}${env$2}`);
 				}
-				if (config.defaultValue) try {
-					const defaultValue = config.defaultValue();
-					if (config.defaultValueIsSerializable) defaults.push(`default: ${chalk_1$6.default.italic(defaultValue)}`);
+				if (config$1.defaultValue) try {
+					const defaultValue = config$1.defaultValue();
+					if (config$1.defaultValueIsSerializable) defaults.push(`default: ${chalk_1$6.default.italic(defaultValue)}`);
 					else defaults.push("optional");
 				} catch (e) {}
-				else if (config.type.defaultValue) try {
-					const defaultValue = config.type.defaultValue();
-					if (config.type.defaultValueIsSerializable) defaults.push(`default: ${chalk_1$6.default.italic(defaultValue)}`);
+				else if (config$1.type.defaultValue) try {
+					const defaultValue = config$1.type.defaultValue();
+					if (config$1.type.defaultValueIsSerializable) defaults.push(`default: ${chalk_1$6.default.italic(defaultValue)}`);
 					else defaults.push("optional");
 				} catch (e) {}
-				else if (config.onMissing || config.type.onMissing) defaults.push("optional");
+				else if (config$1.onMissing || config$1.type.onMissing) defaults.push("optional");
 				return [{
 					category: "flags",
 					usage,
 					defaults,
-					description: (_b = (_a$1 = config.description) !== null && _a$1 !== void 0 ? _a$1 : config.type.description) !== null && _b !== void 0 ? _b : "self explanatory"
+					description: (_b = (_a$1 = config$1.description) !== null && _a$1 !== void 0 ? _a$1 : config$1.type.description) !== null && _b !== void 0 ? _b : "self explanatory"
 				}];
 			},
 			register(opts) {
-				opts.forceFlagLongNames.add(config.long);
-				if (config.short) opts.forceFlagShortNames.add(config.short);
+				opts.forceFlagLongNames.add(config$1.long);
+				if (config$1.short) opts.forceFlagShortNames.add(config$1.short);
 			},
 			async parse({ nodes, visitedNodes }) {
 				var _a$1, _b;
 				const options = (0, findOption_1$3.findOption)(nodes, {
-					longNames: [config.long],
-					shortNames: config.short ? [config.short] : []
+					longNames: [config$1.long],
+					shortNames: config$1.short ? [config$1.short] : []
 				}).filter((x) => !visitedNodes.has(x));
 				options.forEach((opt) => visitedNodes.add(opt));
 				if (options.length > 1) return Result$10.err({ errors: [{
 					nodes: options,
 					message: `Expected 1 occurence, got ${options.length}`
 				}] });
-				const valueFromEnv = config.env ? process.env[config.env] : void 0;
-				const onMissingFn = config.onMissing || config.type.onMissing;
+				const valueFromEnv = config$1.env ? process.env[config$1.env] : void 0;
+				const onMissingFn = config$1.onMissing || config$1.type.onMissing;
 				let rawValue;
 				let envPrefix = "";
 				if (options.length === 0 && valueFromEnv !== void 0) {
 					rawValue = valueFromEnv;
-					envPrefix = `env[${chalk_1$6.default.italic(config.env)}]: `;
-				} else if (options.length === 0 && config.defaultValue) try {
-					const defaultValue = config.defaultValue();
+					envPrefix = `env[${chalk_1$6.default.italic(config$1.env)}]: `;
+				} else if (options.length === 0 && config$1.defaultValue) try {
+					const defaultValue = config$1.defaultValue();
 					return Result$10.ok(defaultValue);
 				} catch (e) {
-					const message = `Default value not found for '--${config.long}': ${e.message}`;
+					const message = `Default value not found for '--${config$1.long}': ${e.message}`;
 					return Result$10.err({ errors: [{
 						message,
 						nodes: []
@@ -935,17 +935,17 @@ var require_flag = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cmd-
 					const missingValue = await onMissingFn();
 					return Result$10.ok(missingValue);
 				} catch (e) {
-					const message = `Failed to get missing value for '--${config.long}': ${e.message}`;
+					const message = `Failed to get missing value for '--${config$1.long}': ${e.message}`;
 					return Result$10.err({ errors: [{
 						message,
 						nodes: []
 					}] });
 				}
-				else if (options.length === 0 && config.type.defaultValue) try {
-					const defaultValue = config.type.defaultValue();
+				else if (options.length === 0 && config$1.type.defaultValue) try {
+					const defaultValue = config$1.type.defaultValue();
 					return Result$10.ok(defaultValue);
 				} catch (e) {
-					const message = `Default value not found for '--${config.long}': ${e.message}`;
+					const message = `Default value not found for '--${config$1.long}': ${e.message}`;
 					return Result$10.err({ errors: [{
 						message,
 						nodes: []
@@ -954,7 +954,7 @@ var require_flag = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cmd-
 				else if (options.length === 1) rawValue = (_b = (_a$1 = options[0].value) === null || _a$1 === void 0 ? void 0 : _a$1.node.raw) !== null && _b !== void 0 ? _b : "true";
 				else return Result$10.err({ errors: [{
 					nodes: [],
-					message: `No value provided for --${config.long}`
+					message: `No value provided for --${config$1.long}`
 				}] });
 				const decoded = await Result$10.safeAsync(decoder.from(rawValue));
 				if (Result$10.isErr(decoded)) return Result$10.err({ errors: [{
@@ -965,10 +965,10 @@ var require_flag = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cmd-
 			}
 		};
 	}
-	function flag(config) {
+	function flag(config$1) {
 		return fullFlag({
 			type: types_1$4.boolean,
-			...config
+			...config$1
 		});
 	}
 }) });
@@ -1146,24 +1146,24 @@ var require_positional = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnp
 	const chalk_1$5 = __importDefault$8((init_source(), __toCommonJS$3(source_exports)));
 	const Result$8 = __importStar$8(require_Result());
 	const types_1$2 = require_types();
-	function fullPositional(config) {
+	function fullPositional(config$1) {
 		var _a, _b, _c;
-		const displayName = (_b = (_a = config.displayName) !== null && _a !== void 0 ? _a : config.type.displayName) !== null && _b !== void 0 ? _b : "arg";
+		const displayName = (_b = (_a = config$1.displayName) !== null && _a !== void 0 ? _a : config$1.type.displayName) !== null && _b !== void 0 ? _b : "arg";
 		return {
-			description: (_c = config.description) !== null && _c !== void 0 ? _c : config.type.description,
+			description: (_c = config$1.description) !== null && _c !== void 0 ? _c : config$1.type.description,
 			helpTopics() {
 				var _a$1, _b$1, _c$1, _d;
 				const defaults = [];
-				const defaultValueFn = (_a$1 = config.defaultValue) !== null && _a$1 !== void 0 ? _a$1 : config.type.defaultValue;
+				const defaultValueFn = (_a$1 = config$1.defaultValue) !== null && _a$1 !== void 0 ? _a$1 : config$1.type.defaultValue;
 				if (defaultValueFn) try {
 					const defaultValue = defaultValueFn();
-					if ((_b$1 = config.defaultValueIsSerializable) !== null && _b$1 !== void 0 ? _b$1 : config.type.defaultValueIsSerializable) defaults.push(`default: ${chalk_1$5.default.italic(defaultValue)}`);
+					if ((_b$1 = config$1.defaultValueIsSerializable) !== null && _b$1 !== void 0 ? _b$1 : config$1.type.defaultValueIsSerializable) defaults.push(`default: ${chalk_1$5.default.italic(defaultValue)}`);
 					else defaults.push("optional");
 				} catch (e) {}
 				return [{
 					category: "arguments",
 					usage: defaults.length > 0 ? `[${displayName}]` : `<${displayName}>`,
-					description: (_d = (_c$1 = config.description) !== null && _c$1 !== void 0 ? _c$1 : config.type.description) !== null && _d !== void 0 ? _d : "self explanatory",
+					description: (_d = (_c$1 = config$1.description) !== null && _c$1 !== void 0 ? _c$1 : config$1.type.description) !== null && _d !== void 0 ? _d : "self explanatory",
 					defaults
 				}];
 			},
@@ -1171,7 +1171,7 @@ var require_positional = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnp
 			async parse({ nodes, visitedNodes }) {
 				var _a$1;
 				const positionals = nodes.filter((node) => node.type === "positionalArgument" && !visitedNodes.has(node));
-				const defaultValueFn = (_a$1 = config.defaultValue) !== null && _a$1 !== void 0 ? _a$1 : config.type.defaultValue;
+				const defaultValueFn = (_a$1 = config$1.defaultValue) !== null && _a$1 !== void 0 ? _a$1 : config$1.type.defaultValue;
 				const positional$1 = positionals[0];
 				if (!positional$1) {
 					if (defaultValueFn) return Result$8.ok(defaultValueFn());
@@ -1181,7 +1181,7 @@ var require_positional = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnp
 					}] });
 				}
 				visitedNodes.add(positional$1);
-				const decoded = await Result$8.safeAsync(config.type.from(positional$1.raw));
+				const decoded = await Result$8.safeAsync(config$1.type.from(positional$1.raw));
 				if (Result$8.isErr(decoded)) return Result$8.err({ errors: [{
 					nodes: [positional$1],
 					message: decoded.error.message
@@ -1190,10 +1190,10 @@ var require_positional = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnp
 			}
 		};
 	}
-	function positional(config) {
+	function positional(config$1) {
 		return fullPositional({
 			type: types_1$2.string,
-			...config
+			...config$1
 		});
 	}
 }) });
@@ -1255,13 +1255,13 @@ var require_subcommands = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pn
 	/**
 	* Combine multiple `command`s into one
 	*/
-	function subcommands$2(config) {
-		const circuitbreaker = (0, circuitbreaker_1$1.createCircuitBreaker)(!!config.version);
+	function subcommands$2(config$1) {
+		const circuitbreaker = (0, circuitbreaker_1$1.createCircuitBreaker)(!!config$1.version);
 		const subcommand = (0, positional_1$1.positional)({
 			displayName: "subcommand",
-			description: `one of ${Object.keys(config.cmds).join(", ")}`,
+			description: `one of ${Object.keys(config$1.cmds).join(", ")}`,
 			type: { async from(str) {
-				const commands = Object.entries(config.cmds).map(([name, cmd$1]) => {
+				const commands = Object.entries(config$1.cmds).map(([name, cmd$1]) => {
 					var _a;
 					return {
 						cmdName: name,
@@ -1281,7 +1281,7 @@ var require_subcommands = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pn
 		});
 		function normalizeContext(context) {
 			var _a;
-			if (((_a = context.hotPath) === null || _a === void 0 ? void 0 : _a.length) === 0) context.hotPath.push(config.name);
+			if (((_a = context.hotPath) === null || _a === void 0 ? void 0 : _a.length) === 0) context.hotPath.push(config$1.name);
 			if (!context.nodes.some((n) => !context.visitedNodes.has(n))) context.nodes.push({
 				type: "longOption",
 				index: 0,
@@ -1290,14 +1290,14 @@ var require_subcommands = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pn
 			});
 		}
 		return {
-			version: config.version,
-			description: config.description,
-			name: config.name,
+			version: config$1.version,
+			description: config$1.description,
+			name: config$1.name,
 			handler: (value) => {
-				return config.cmds[value.command].handler(value.args);
+				return config$1.cmds[value.command].handler(value.args);
 			},
 			register(opts) {
-				for (const cmd of Object.values(config.cmds)) cmd.register(opts);
+				for (const cmd of Object.values(config$1.cmds)) cmd.register(opts);
 				circuitbreaker.register(opts);
 			},
 			printHelp(context) {
@@ -1305,12 +1305,12 @@ var require_subcommands = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pn
 				const lines = [];
 				const argsSoFar = (_b = (_a = context.hotPath) === null || _a === void 0 ? void 0 : _a.join(" ")) !== null && _b !== void 0 ? _b : "cli";
 				lines.push(chalk_1$4.default.bold(argsSoFar + chalk_1$4.default.italic(" <subcommand>")));
-				if (config.description) lines.push(chalk_1$4.default.dim("> ") + config.description);
+				if (config$1.description) lines.push(chalk_1$4.default.dim("> ") + config$1.description);
 				lines.push("");
 				lines.push(`where ${chalk_1$4.default.italic("<subcommand>")} can be one of:`);
 				lines.push("");
-				for (const key of Object.keys(config.cmds)) {
-					const cmd = config.cmds[key];
+				for (const key of Object.keys(config$1.cmds)) {
+					const cmd = config$1.cmds[key];
 					let description = (_c = cmd.description) !== null && _c !== void 0 ? _c : "";
 					description = description && ` - ${description} `;
 					if ((_d = cmd.aliases) === null || _d === void 0 ? void 0 : _d.length) {
@@ -1335,7 +1335,7 @@ var require_subcommands = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pn
 					partialValue: {}
 				});
 				(_a = context.hotPath) === null || _a === void 0 || _a.push(parsed.value);
-				const parsedCommand = await config.cmds[parsed.value].parse(context);
+				const parsedCommand = await config$1.cmds[parsed.value].parse(context);
 				if (Result$7.isErr(parsedCommand)) return Result$7.err({
 					errors: parsedCommand.error.errors,
 					partialValue: {
@@ -1361,7 +1361,7 @@ var require_subcommands = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pn
 					});
 				}
 				(_a = context.hotPath) === null || _a === void 0 || _a.push(parsedSubcommand.value);
-				const commandRun = await config.cmds[parsedSubcommand.value].run(context);
+				const commandRun = await config$1.cmds[parsedSubcommand.value].run(context);
 				if (Result$7.isOk(commandRun)) return Result$7.ok({
 					command: parsedSubcommand.value,
 					value: commandRun.value
@@ -1545,17 +1545,17 @@ var require_command = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/c
 	* A combination of multiple flags, options and arguments
 	* with a common name and a handler that expects them as input.
 	*/
-	function command(config) {
-		const argEntries = (0, utils_1$2.entries)(config.args);
-		const circuitbreaker = (0, circuitbreaker_1.createCircuitBreaker)(!!config.version);
+	function command(config$1) {
+		const argEntries = (0, utils_1$2.entries)(config$1.args);
+		const circuitbreaker = (0, circuitbreaker_1.createCircuitBreaker)(!!config$1.version);
 		return {
-			name: config.name,
-			aliases: config.aliases,
-			handler: config.handler,
-			description: config.description,
-			version: config.version,
+			name: config$1.name,
+			aliases: config$1.aliases,
+			handler: config$1.handler,
+			description: config$1.description,
+			version: config$1.version,
 			helpTopics() {
-				return (0, utils_1$2.flatMap)(Object.values(config.args).concat([circuitbreaker]), (x) => {
+				return (0, utils_1$2.flatMap)(Object.values(config$1.args).concat([circuitbreaker]), (x) => {
 					var _a, _b;
 					return (_b = (_a = x.helpTopics) === null || _a === void 0 ? void 0 : _a.call(x)) !== null && _b !== void 0 ? _b : [];
 				});
@@ -1564,11 +1564,11 @@ var require_command = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/c
 				var _a, _b;
 				const lines = [];
 				let name = (_b = (_a = context.hotPath) === null || _a === void 0 ? void 0 : _a.join(" ")) !== null && _b !== void 0 ? _b : "";
-				if (!name) name = config.name;
+				if (!name) name = config$1.name;
 				name = chalk_1$3.default.bold(name);
-				if (config.version) name += ` ${chalk_1$3.default.dim(config.version)}`;
+				if (config$1.version) name += ` ${chalk_1$3.default.dim(config$1.version)}`;
 				lines.push(name);
-				if (config.description) lines.push(chalk_1$3.default.dim("> ") + config.description);
+				if (config$1.description) lines.push(chalk_1$3.default.dim("> ") + config$1.description);
 				const usageBreakdown = (0, utils_1$2.groupBy)(this.helpTopics(), (x) => x.category);
 				for (const [category, helpTopics] of (0, utils_1$2.entries)(usageBreakdown)) {
 					lines.push("");
@@ -1593,7 +1593,7 @@ var require_command = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/c
 			},
 			async parse(context) {
 				var _a;
-				if (((_a = context.hotPath) === null || _a === void 0 ? void 0 : _a.length) === 0) context.hotPath.push(config.name);
+				if (((_a = context.hotPath) === null || _a === void 0 ? void 0 : _a.length) === 0) context.hotPath.push(config$1.name);
 				const resultObject = {};
 				const errors = [];
 				for (const [argName, arg] of argEntries) {
@@ -1684,47 +1684,47 @@ var require_option = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cm
 	const Result$5 = __importStar$5(require_Result());
 	const findOption_1$2 = require_findOption();
 	const types_1$1 = require_types();
-	function fullOption(config) {
+	function fullOption(config$1) {
 		var _a;
 		return {
-			description: (_a = config.description) !== null && _a !== void 0 ? _a : config.type.description,
+			description: (_a = config$1.description) !== null && _a !== void 0 ? _a : config$1.type.description,
 			helpTopics() {
 				var _a$1, _b, _c;
-				const displayName = (_a$1 = config.type.displayName) !== null && _a$1 !== void 0 ? _a$1 : "value";
-				let usage = `--${config.long}`;
-				if (config.short) usage += `, -${config.short}`;
+				const displayName = (_a$1 = config$1.type.displayName) !== null && _a$1 !== void 0 ? _a$1 : "value";
+				let usage = `--${config$1.long}`;
+				if (config$1.short) usage += `, -${config$1.short}`;
 				usage += ` <${displayName}>`;
 				const defaults = [];
-				if (config.env) {
-					const env$2 = process.env[config.env] === void 0 ? "" : `=${chalk_1$2.default.italic(process.env[config.env])}`;
-					defaults.push(`env: ${config.env}${env$2}`);
+				if (config$1.env) {
+					const env$2 = process.env[config$1.env] === void 0 ? "" : `=${chalk_1$2.default.italic(process.env[config$1.env])}`;
+					defaults.push(`env: ${config$1.env}${env$2}`);
 				}
-				if (config.defaultValue) try {
-					const defaultValue = config.defaultValue();
-					if (config.defaultValueIsSerializable) defaults.push(`default: ${chalk_1$2.default.italic(defaultValue)}`);
+				if (config$1.defaultValue) try {
+					const defaultValue = config$1.defaultValue();
+					if (config$1.defaultValueIsSerializable) defaults.push(`default: ${chalk_1$2.default.italic(defaultValue)}`);
 					else defaults.push("optional");
 				} catch (e) {}
-				else if (config.type.defaultValue) try {
-					const defaultValue = config.type.defaultValue();
-					if (config.type.defaultValueIsSerializable) defaults.push(`default: ${chalk_1$2.default.italic(defaultValue)}`);
+				else if (config$1.type.defaultValue) try {
+					const defaultValue = config$1.type.defaultValue();
+					if (config$1.type.defaultValueIsSerializable) defaults.push(`default: ${chalk_1$2.default.italic(defaultValue)}`);
 					else defaults.push("optional");
 				} catch (e) {}
-				else if (config.onMissing || config.type.onMissing) defaults.push("optional");
+				else if (config$1.onMissing || config$1.type.onMissing) defaults.push("optional");
 				return [{
 					category: "options",
 					usage,
 					defaults,
-					description: (_c = (_b = config.description) !== null && _b !== void 0 ? _b : config.type.description) !== null && _c !== void 0 ? _c : "self explanatory"
+					description: (_c = (_b = config$1.description) !== null && _b !== void 0 ? _b : config$1.type.description) !== null && _c !== void 0 ? _c : "self explanatory"
 				}];
 			},
 			register(opts) {
-				opts.forceOptionLongNames.add(config.long);
-				if (config.short) opts.forceOptionShortNames.add(config.short);
+				opts.forceOptionLongNames.add(config$1.long);
+				if (config$1.short) opts.forceOptionShortNames.add(config$1.short);
 			},
 			async parse({ nodes, visitedNodes }) {
 				const options = (0, findOption_1$2.findOption)(nodes, {
-					longNames: [config.long],
-					shortNames: config.short ? [config.short] : []
+					longNames: [config$1.long],
+					shortNames: config$1.short ? [config$1.short] : []
 				}).filter((x) => !visitedNodes.has(x));
 				options.forEach((opt) => visitedNodes.add(opt));
 				if (options.length > 1) {
@@ -1734,21 +1734,21 @@ var require_option = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cm
 					};
 					return Result$5.err({ errors: [error] });
 				}
-				const valueFromEnv = config.env ? process.env[config.env] : void 0;
-				const defaultValueFn = config.defaultValue || config.type.defaultValue;
-				const onMissingFn = config.onMissing || config.type.onMissing;
+				const valueFromEnv = config$1.env ? process.env[config$1.env] : void 0;
+				const defaultValueFn = config$1.defaultValue || config$1.type.defaultValue;
+				const onMissingFn = config$1.onMissing || config$1.type.onMissing;
 				const option$1 = options[0];
 				let rawValue;
 				let envPrefix = "";
 				if (option$1 === null || option$1 === void 0 ? void 0 : option$1.value) rawValue = option$1.value.node.raw;
 				else if (valueFromEnv !== void 0) {
 					rawValue = valueFromEnv;
-					envPrefix = `env[${chalk_1$2.default.italic(config.env)}]: `;
+					envPrefix = `env[${chalk_1$2.default.italic(config$1.env)}]: `;
 				} else if (defaultValueFn) try {
 					const defaultValue = defaultValueFn();
 					return Result$5.ok(defaultValue);
 				} catch (e) {
-					const message = `Default value not found for '--${config.long}': ${e.message}`;
+					const message = `Default value not found for '--${config$1.long}': ${e.message}`;
 					return Result$5.err({ errors: [{
 						nodes: [],
 						message
@@ -1758,20 +1758,20 @@ var require_option = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cm
 					const missingValue = await onMissingFn();
 					return Result$5.ok(missingValue);
 				} catch (e) {
-					const message = `Failed to get missing value for '--${config.long}': ${e.message}`;
+					const message = `Failed to get missing value for '--${config$1.long}': ${e.message}`;
 					return Result$5.err({ errors: [{
 						nodes: [],
 						message
 					}] });
 				}
 				else {
-					const raw = (option$1 === null || option$1 === void 0 ? void 0 : option$1.type) === "shortOption" ? `-${option$1 === null || option$1 === void 0 ? void 0 : option$1.key}` : `--${config.long}`;
+					const raw = (option$1 === null || option$1 === void 0 ? void 0 : option$1.type) === "shortOption" ? `-${option$1 === null || option$1 === void 0 ? void 0 : option$1.key}` : `--${config$1.long}`;
 					return Result$5.err({ errors: [{
 						nodes: options,
 						message: `No value provided for ${raw}`
 					}] });
 				}
-				const decoded = await Result$5.safeAsync(config.type.from(rawValue));
+				const decoded = await Result$5.safeAsync(config$1.type.from(rawValue));
 				if (Result$5.isErr(decoded)) return Result$5.err({ errors: [{
 					nodes: options,
 					message: envPrefix + decoded.error.message
@@ -1780,10 +1780,10 @@ var require_option = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cm
 			}
 		};
 	}
-	function option(config) {
+	function option(config$1) {
 		return fullOption({
 			type: types_1$1.string,
-			...config
+			...config$1
 		});
 	}
 }) });
@@ -2255,15 +2255,15 @@ var require_restPositionals = /* @__PURE__ */ __commonJS$1({ "../../node_modules
 	* Works best when it is the last item on the `command` construct, to be
 	* used like the `...rest` operator in JS and TypeScript.
 	*/
-	function fullRestPositionals(config) {
+	function fullRestPositionals(config$1) {
 		return {
 			helpTopics() {
 				var _a, _b, _c, _d;
 				return [{
-					usage: `[...${(_b = (_a = config.displayName) !== null && _a !== void 0 ? _a : config.type.displayName) !== null && _b !== void 0 ? _b : "arg"}]`,
+					usage: `[...${(_b = (_a = config$1.displayName) !== null && _a !== void 0 ? _a : config$1.type.displayName) !== null && _b !== void 0 ? _b : "arg"}]`,
 					category: "arguments",
 					defaults: [],
-					description: (_d = (_c = config.description) !== null && _c !== void 0 ? _c : config.type.description) !== null && _d !== void 0 ? _d : ""
+					description: (_d = (_c = config$1.description) !== null && _c !== void 0 ? _c : config$1.type.description) !== null && _d !== void 0 ? _d : ""
 				}];
 			},
 			register(_opts) {},
@@ -2273,7 +2273,7 @@ var require_restPositionals = /* @__PURE__ */ __commonJS$1({ "../../node_modules
 				const errors = [];
 				for (const positional$1 of positionals) {
 					visitedNodes.add(positional$1);
-					const decoded = await Result$4.safeAsync(config.type.from(positional$1.raw));
+					const decoded = await Result$4.safeAsync(config$1.type.from(positional$1.raw));
 					if (Result$4.isOk(decoded)) results.push(decoded.value);
 					else errors.push({
 						nodes: [positional$1],
@@ -2285,10 +2285,10 @@ var require_restPositionals = /* @__PURE__ */ __commonJS$1({ "../../node_modules
 			}
 		};
 	}
-	function restPositionals(config) {
+	function restPositionals(config$1) {
 		return fullRestPositionals({
 			type: types_1.string,
-			...config
+			...config$1
 		});
 	}
 }) });
@@ -2346,28 +2346,28 @@ var require_multiflag = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm
 	* Like `option`, but can accept multiple options, and expects a decoder from a list of strings.
 	* An error will highlight all option occurences.
 	*/
-	function multiflag(config) {
+	function multiflag(config$1) {
 		return {
 			helpTopics() {
 				var _a;
-				let usage = `--${config.long}`;
-				if (config.short) usage += `, -${config.short}`;
+				let usage = `--${config$1.long}`;
+				if (config$1.short) usage += `, -${config$1.short}`;
 				return [{
 					category: "flags",
 					usage,
 					defaults: [],
-					description: (_a = config.description) !== null && _a !== void 0 ? _a : "self explanatory"
+					description: (_a = config$1.description) !== null && _a !== void 0 ? _a : "self explanatory"
 				}];
 			},
 			register(opts) {
-				opts.forceFlagLongNames.add(config.long);
-				if (config.short) opts.forceFlagShortNames.add(config.short);
+				opts.forceFlagLongNames.add(config$1.long);
+				if (config$1.short) opts.forceFlagShortNames.add(config$1.short);
 			},
 			async parse({ nodes, visitedNodes }) {
 				var _a, _b;
 				const options = (0, findOption_1$1.findOption)(nodes, {
-					longNames: [config.long],
-					shortNames: config.short ? [config.short] : []
+					longNames: [config$1.long],
+					shortNames: config$1.short ? [config$1.short] : []
 				}).filter((x) => !visitedNodes.has(x));
 				for (const option$1 of options) visitedNodes.add(option$1);
 				const optionValues = [];
@@ -2381,7 +2381,7 @@ var require_multiflag = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm
 					else optionValues.push(decoded.value);
 				}
 				if (errors.length > 0) return Result$3.err({ errors });
-				const multiDecoded = await Result$3.safeAsync(config.type.from(optionValues));
+				const multiDecoded = await Result$3.safeAsync(config$1.type.from(optionValues));
 				if (Result$3.isErr(multiDecoded)) return Result$3.err({ errors: [{
 					nodes: options,
 					message: multiDecoded.error.message
@@ -2448,49 +2448,49 @@ var require_multioption = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pn
 	* Like `option`, but can accept multiple options, and expects a decoder from a list of strings.
 	* An error will highlight all option occurences.
 	*/
-	function multioption(config) {
+	function multioption(config$1) {
 		return {
 			helpTopics() {
 				var _a, _b;
-				const displayName = (_a = config.type.displayName) !== null && _a !== void 0 ? _a : "value";
-				let usage = `--${config.long} <${displayName}>`;
-				if (config.short) usage += `, -${config.short}=<${displayName}>`;
+				const displayName = (_a = config$1.type.displayName) !== null && _a !== void 0 ? _a : "value";
+				let usage = `--${config$1.long} <${displayName}>`;
+				if (config$1.short) usage += `, -${config$1.short}=<${displayName}>`;
 				const defaults = [];
-				if (config.defaultValue) try {
-					const defaultValue = config.defaultValue();
-					if (config.defaultValueIsSerializable) defaults.push(`default: ${chalk_1.default.italic(defaultValue)}`);
+				if (config$1.defaultValue) try {
+					const defaultValue = config$1.defaultValue();
+					if (config$1.defaultValueIsSerializable) defaults.push(`default: ${chalk_1.default.italic(defaultValue)}`);
 					else defaults.push("[...optional]");
 				} catch (e) {}
-				else if (config.type.defaultValue) try {
-					const defaultValue = config.type.defaultValue();
-					if (config.type.defaultValueIsSerializable) defaults.push(`default: ${chalk_1.default.italic(defaultValue)}`);
+				else if (config$1.type.defaultValue) try {
+					const defaultValue = config$1.type.defaultValue();
+					if (config$1.type.defaultValueIsSerializable) defaults.push(`default: ${chalk_1.default.italic(defaultValue)}`);
 					else defaults.push("[...optional]");
 				} catch (e) {}
-				else if (config.onMissing || config.type.onMissing) defaults.push("[...optional]");
+				else if (config$1.onMissing || config$1.type.onMissing) defaults.push("[...optional]");
 				return [{
 					category: "options",
 					usage,
 					defaults,
-					description: (_b = config.description) !== null && _b !== void 0 ? _b : "self explanatory"
+					description: (_b = config$1.description) !== null && _b !== void 0 ? _b : "self explanatory"
 				}];
 			},
 			register(opts) {
-				opts.forceOptionLongNames.add(config.long);
-				if (config.short) opts.forceOptionShortNames.add(config.short);
+				opts.forceOptionLongNames.add(config$1.long);
+				if (config$1.short) opts.forceOptionShortNames.add(config$1.short);
 			},
 			async parse({ nodes, visitedNodes }) {
 				var _a;
 				const options = (0, findOption_1.findOption)(nodes, {
-					longNames: [config.long],
-					shortNames: config.short ? [config.short] : []
+					longNames: [config$1.long],
+					shortNames: config$1.short ? [config$1.short] : []
 				}).filter((x) => !visitedNodes.has(x));
-				const defaultValueFn = config.defaultValue || config.type.defaultValue;
-				const onMissingFn = config.onMissing || config.type.onMissing;
+				const defaultValueFn = config$1.defaultValue || config$1.type.defaultValue;
+				const onMissingFn = config$1.onMissing || config$1.type.onMissing;
 				if (options.length === 0 && defaultValueFn) try {
 					const defaultValue = defaultValueFn();
 					return Result$2.ok(defaultValue);
 				} catch (e) {
-					const message = `Failed to resolve default value for '--${config.long}': ${e.message}`;
+					const message = `Failed to resolve default value for '--${config$1.long}': ${e.message}`;
 					return Result$2.err({ errors: [{
 						nodes: [],
 						message
@@ -2500,7 +2500,7 @@ var require_multioption = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pn
 					const missingValue = await onMissingFn();
 					return Result$2.ok(missingValue);
 				} catch (e) {
-					const message = `Failed to get missing value for '--${config.long}': ${e.message}`;
+					const message = `Failed to get missing value for '--${config$1.long}': ${e.message}`;
 					return Result$2.err({ errors: [{
 						nodes: [],
 						message
@@ -2523,7 +2523,7 @@ var require_multioption = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pn
 					message: "Expected to get a value, found a flag"
 				});
 				if (errors.length > 0) return Result$2.err({ errors });
-				const multiDecoded = await Result$2.safeAsync(config.type.from(optionValues));
+				const multiDecoded = await Result$2.safeAsync(config$1.type.from(optionValues));
 				if (Result$2.isErr(multiDecoded)) return Result$2.err({ errors: [{
 					nodes: options,
 					message: multiDecoded.error.message
@@ -2671,15 +2671,15 @@ var require_rest = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cmd-
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.rest = rest;
 	const Result = __importStar(require_Result());
-	function rest(config) {
+	function rest(config$1) {
 		return {
 			helpTopics() {
 				var _a, _b;
 				return [{
-					usage: `[...${(_a = config === null || config === void 0 ? void 0 : config.displayName) !== null && _a !== void 0 ? _a : "arg"}]`,
+					usage: `[...${(_a = config$1 === null || config$1 === void 0 ? void 0 : config$1.displayName) !== null && _a !== void 0 ? _a : "arg"}]`,
 					category: "arguments",
 					defaults: [],
-					description: (_b = config === null || config === void 0 ? void 0 : config.description) !== null && _b !== void 0 ? _b : "catches the rest of the values"
+					description: (_b = config$1 === null || config$1 === void 0 ? void 0 : config$1.description) !== null && _b !== void 0 ? _b : "catches the rest of the values"
 				}];
 			},
 			register() {},
@@ -2874,11 +2874,11 @@ var require_cjs = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cmd-t
 
 //#endregion
 //#region src/args/runtime.ts
-var import_cjs$20 = /* @__PURE__ */ __toESM(require_cjs());
-const runtime = import_cjs$20.option({
+var import_cjs$22 = /* @__PURE__ */ __toESM(require_cjs());
+const runtime = import_cjs$22.option({
 	long: "runtime",
 	type: {
-		...import_cjs$20.oneOf([
+		...import_cjs$22.oneOf([
 			"node22",
 			"node24",
 			"python3.13"
@@ -3010,9 +3010,9 @@ var require_ms = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/ms@2.1
 
 //#endregion
 //#region src/types/duration.ts
-var import_cjs$19 = require_cjs();
+var import_cjs$21 = require_cjs();
 init_source();
-const Duration = (0, import_cjs$19.extendType)(import_cjs$19.string, {
+const Duration = (0, import_cjs$21.extendType)(import_cjs$21.string, {
 	displayName: "num UNIT",
 	description: "A duration, e.g. 5m, 10s, 1h",
 	async from(string$1) {
@@ -3028,8 +3028,8 @@ const Duration = (0, import_cjs$19.extendType)(import_cjs$19.string, {
 
 //#endregion
 //#region src/args/timeout.ts
-var import_cjs$18 = /* @__PURE__ */ __toESM(require_cjs());
-const timeout = import_cjs$18.option({
+var import_cjs$20 = /* @__PURE__ */ __toESM(require_cjs());
+const timeout = import_cjs$20.option({
 	long: "timeout",
 	type: Duration,
 	description: "The maximum duration a sandbox can run for. Example: 5m, 1h",
@@ -6802,10 +6802,10 @@ function _usingCtx() {
 
 //#endregion
 //#region src/commands/login.ts
-var import_cjs$17 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$19 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
 const debug$5 = createDebugger("sandbox:login");
-const login = import_cjs$17.command({
+const login = import_cjs$19.command({
 	name: "login",
 	description: "Log in to the Sandbox CLI",
 	args: {},
@@ -7010,15 +7010,15 @@ var require_dist = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/@ver
 
 //#endregion
 //#region src/args/auth.ts
-var import_cjs$16 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$18 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
 var import_dist = require_dist();
 const debug$4 = createDebugger("sandbox:args:auth");
-const token = import_cjs$16.option({
+const token = import_cjs$18.option({
 	long: "token",
 	description: "A Vercel authentication token. If not provided, will use the token stored in your system from `VERCEL_AUTH_TOKEN` or will start a log in process.",
 	type: {
-		...import_cjs$16.string,
+		...import_cjs$18.string,
 		displayName: "pat_or_oidc",
 		defaultValueIsSerializable: false,
 		onMissing: async () => {
@@ -7184,29 +7184,29 @@ async function inferFromToken(token$1, requestedTeam) {
 
 //#endregion
 //#region src/args/scope.ts
-var import_cjs$15 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$17 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
-const project = import_cjs$15.option({
+const project = import_cjs$17.option({
 	long: "project",
 	type: {
-		...import_cjs$15.optional(import_cjs$15.string),
+		...import_cjs$17.optional(import_cjs$17.string),
 		displayName: "my-project"
 	},
 	description: "The project name or ID to associate with the command. Can be inferred from VERCEL_OIDC_TOKEN."
 });
 /** Parser for the `--team` option. */
-const teamParser = import_cjs$15.option({
+const teamParser = import_cjs$17.option({
 	long: "team",
 	type: {
-		...import_cjs$15.optional(import_cjs$15.string),
+		...import_cjs$17.optional(import_cjs$17.string),
 		displayName: "my-team"
 	}
 });
 /** Parser for the `--scope` option. */
-const scopeParser = import_cjs$15.option({
+const scopeParser = import_cjs$17.option({
 	long: "scope",
 	type: {
-		...import_cjs$15.optional(import_cjs$15.string),
+		...import_cjs$17.optional(import_cjs$17.string),
 		displayName: "my-team"
 	},
 	description: "The scope/team to associate with the command. Can be inferred from VERCEL_OIDC_TOKEN. [alias: --team]"
@@ -7292,7 +7292,7 @@ const scope = {
 
 //#endregion
 //#region package.json
-var version = "2.0.4";
+var version = "2.1.0";
 
 //#endregion
 //#region src/error.ts
@@ -7381,9 +7381,9 @@ async function writeResponseToTemp({ response, text }) {
 
 //#endregion
 //#region src/args/snapshot-id.ts
-var import_cjs$14 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$16 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
-const snapshotId = import_cjs$14.extendType(import_cjs$14.string, {
+const snapshotId = import_cjs$16.extendType(import_cjs$16.string, {
 	displayName: "snapshot_id",
 	description: "The ID of the snapshot",
 	async from(s$1) {
@@ -7392,20 +7392,99 @@ const snapshotId = import_cjs$14.extendType(import_cjs$14.string, {
 	}
 });
 
+//#endregion
+//#region src/args/network-policy.ts
+var import_cjs$15 = /* @__PURE__ */ __toESM(require_cjs());
+init_source();
+const networkPolicyMode = import_cjs$15.extendType(import_cjs$15.string, {
+	displayName: "MODE",
+	async from(value) {
+		const validModes = [
+			"internet-access",
+			"no-access",
+			"restricted"
+		];
+		if (!validModes.includes(value)) throw new Error([`Invalid network policy mode: ${value}.`, `${source_default.bold("hint:")} Valid modes are: ${validModes.join(", ")}`].join("\n"));
+		return value;
+	}
+});
+const networkPolicy = import_cjs$15.option({
+	long: "network-policy",
+	description: `Network policy mode: "internet-access", "no-access", or "restricted"
+    
+internet-access: sandbox can access any website/domain
+no-access: sandbox has no network access
+restricted: sandbox can only access websites and domains explicitly allowed`,
+	type: import_cjs$15.optional(networkPolicyMode)
+});
+const allowedDomains = import_cjs$15.multioption({
+	long: "allowed-domain",
+	description: `Domain to allow traffic to (requires --network-policy=restricted)
+
+Supports "*" for wildcards for a segment (e.g. '*.vercel.com', 'www.*.com')
+If used as the first segment, will match any subdomain.`,
+	type: import_cjs$15.array(import_cjs$15.string)
+});
+const allowedCIDRs = import_cjs$15.multioption({
+	long: "allowed-cidr",
+	description: `CIDR to allow traffic to (requires --network-policy=restricted)
+
+Takes precedence over 'allowed-domain'.
+`,
+	type: import_cjs$15.array(import_cjs$15.string)
+});
+const deniedCIDRs = import_cjs$15.multioption({
+	long: "denied-cidr",
+	description: `CIDR to deny traffic to (requires --network-policy=restricted)
+    
+Takes precedence over allowed domains/CIDRs.`,
+	type: import_cjs$15.array(import_cjs$15.string)
+});
+const networkPolicyArgs = {
+	networkPolicy,
+	allowedDomains,
+	allowedCIDRs,
+	deniedCIDRs
+};
+
+//#endregion
+//#region src/util/network-policy.ts
+init_source();
+/**
+* Builds a NetworkPolicy from CLI arguments (optional mode for create).
+*/
+function buildNetworkPolicy(args$4) {
+	const { networkPolicy: networkPolicy$1, allowedDomains: allowedDomains$1, allowedCIDRs: allowedCIDRs$1, deniedCIDRs: deniedCIDRs$1 } = args$4;
+	if (!networkPolicy$1 || networkPolicy$1 !== "restricted") {
+		if (allowedDomains$1.length > 0 || allowedCIDRs$1.length > 0 || deniedCIDRs$1.length > 0) throw new Error(["Network policy options require --network-policy to be set to restricted.", `${source_default.bold("hint:")} Use --network-policy=restricted to allow/deny specific domains or CIDRs.`].join("\n"));
+	}
+	switch (networkPolicy$1) {
+		case void 0:
+		case "internet-access": return { type: "internet-access" };
+		case "no-access": return { type: "no-access" };
+		case "restricted": return {
+			type: "restricted",
+			allowedDomains: allowedDomains$1.length > 0 ? allowedDomains$1 : void 0,
+			allowedCIDRs: allowedCIDRs$1.length > 0 ? allowedCIDRs$1 : void 0,
+			deniedCIDRs: deniedCIDRs$1.length > 0 ? deniedCIDRs$1 : void 0
+		};
+	}
+}
+
 //#endregion
 //#region src/commands/create.ts
-var import_cjs$13 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$14 = /* @__PURE__ */ __toESM(require_cjs());
 var import_ms$1 = /* @__PURE__ */ __toESM(require_ms());
 init_source();
 const args$3 = {
 	scope,
 	runtime,
 	timeout,
-	ports: import_cjs$13.multioption({
+	ports: import_cjs$14.multioption({
 		long: "publish-port",
 		short: "p",
 		description: "Publish sandbox port(s) to DOMAIN.vercel.run",
-		type: import_cjs$13.array(import_cjs$13.extendType(import_cjs$13.number, {
+		type: import_cjs$14.array(import_cjs$14.extendType(import_cjs$14.number, {
 			displayName: "PORT",
 			async from(number) {
 				if (number < 1024 || number > 65535) throw new Error([
@@ -7417,22 +7496,29 @@ const args$3 = {
 			}
 		}))
 	}),
-	silent: import_cjs$13.flag({
+	silent: import_cjs$14.flag({
 		long: "silent",
 		description: "Don't write sandbox ID to stdout"
 	}),
-	snapshot: import_cjs$13.option({
+	snapshot: import_cjs$14.option({
 		long: "snapshot",
 		short: "s",
 		description: "Start the sandbox from a snapshot ID",
-		type: import_cjs$13.optional(snapshotId)
-	})
+		type: import_cjs$14.optional(snapshotId)
+	}),
+	...networkPolicyArgs
 };
-const create = import_cjs$13.command({
+const create = import_cjs$14.command({
 	name: "create",
 	description: "Create a sandbox in the specified account and project.",
 	args: args$3,
-	async handler({ ports, scope: scope$1, runtime: runtime$1, timeout: timeout$1, silent, snapshot: snapshot$1 }) {
+	async handler({ ports, scope: scope$1, runtime: runtime$1, timeout: timeout$1, silent, snapshot: snapshot$1, networkPolicy: networkPolicyMode$1, allowedDomains: allowedDomains$1, allowedCIDRs: allowedCIDRs$1, deniedCIDRs: deniedCIDRs$1 }) {
+		const networkPolicy$1 = buildNetworkPolicy({
+			networkPolicy: networkPolicyMode$1,
+			allowedDomains: allowedDomains$1,
+			allowedCIDRs: allowedCIDRs$1,
+			deniedCIDRs: deniedCIDRs$1
+		});
 		const spinner = silent ? void 0 : ora("Creating sandbox...").start();
 		const sandbox = snapshot$1 ? await sandboxClient.create({
 			source: {
@@ -7444,6 +7530,7 @@ const create = import_cjs$13.command({
 			token: scope$1.token,
 			ports,
 			timeout: (0, import_ms$1.default)(timeout$1),
+			networkPolicy: networkPolicy$1,
 			__interactive: true
 		}) : await sandboxClient.create({
 			teamId: scope$1.team,
@@ -7452,6 +7539,7 @@ const create = import_cjs$13.command({
 			ports,
 			runtime: runtime$1,
 			timeout: (0, import_ms$1.default)(timeout$1),
+			networkPolicy: networkPolicy$1,
 			__interactive: true
 		});
 		spinner?.stop();
@@ -7485,9 +7573,9 @@ const create = import_cjs$13.command({
 
 //#endregion
 //#region src/args/sandbox-id.ts
-var import_cjs$12 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$13 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
-const sandboxId = import_cjs$12.extendType(import_cjs$12.string, {
+const sandboxId = import_cjs$13.extendType(import_cjs$13.string, {
 	displayName: "sandbox_id",
 	description: "The ID of the sandbox to execute the command in",
 	async from(s$1) {
@@ -11479,9 +11567,9 @@ function getStderrStream() {
 
 //#endregion
 //#region src/args/key-value-pair.ts
-var import_cjs$11 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$12 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
-const KeyValuePair = import_cjs$11.extendType(import_cjs$11.string, {
+const KeyValuePair = import_cjs$12.extendType(import_cjs$12.string, {
 	displayName: "key=value",
 	async from(input) {
 		if (!input.includes("=")) return {
@@ -11495,7 +11583,7 @@ const KeyValuePair = import_cjs$11.extendType(import_cjs$11.string, {
 		};
 	}
 });
-const ObjectFromKeyValue = import_cjs$11.extendType(import_cjs$11.array(KeyValuePair), { async from(input) {
+const ObjectFromKeyValue = import_cjs$12.extendType(import_cjs$12.array(KeyValuePair), { async from(input) {
 	const obj = Object.create(null);
 	const missingVars = [];
 	for (const { key, value } of input) if (value === void 0) missingVars.push(key);
@@ -11509,34 +11597,34 @@ const ObjectFromKeyValue = import_cjs$11.extendType(import_cjs$11.array(KeyValue
 
 //#endregion
 //#region src/commands/exec.ts
-var import_cjs$10 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$11 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
 const args$2 = {
 	scope,
-	sandbox: import_cjs$10.positional({ type: sandboxId }),
-	asSudo: import_cjs$10.flag({
+	sandbox: import_cjs$11.positional({ type: sandboxId }),
+	asSudo: import_cjs$11.flag({
 		long: "sudo",
 		description: "Give extended privileges to the command."
 	}),
-	command: import_cjs$10.positional({
+	command: import_cjs$11.positional({
 		displayName: "command",
 		description: "The executable to invoke"
 	}),
-	args: import_cjs$10.rest({
+	args: import_cjs$11.rest({
 		displayName: "args",
 		description: "arguments to pass to the command"
 	}),
-	cwd: import_cjs$10.option({
+	cwd: import_cjs$11.option({
 		long: "workdir",
 		short: "w",
 		description: "The working directory to run the command in",
-		type: import_cjs$10.optional(import_cjs$10.string)
+		type: import_cjs$11.optional(import_cjs$11.string)
 	}),
-	interactive: import_cjs$10.flag({
+	interactive: import_cjs$11.flag({
 		long: "interactive",
 		short: "i",
 		description: "Run the command in a secure interactive shell",
-		type: import_cjs$10.extendType(import_cjs$10.boolean, {
+		type: import_cjs$11.extendType(import_cjs$11.boolean, {
 			defaultValue() {
 				return false;
 			},
@@ -11546,23 +11634,23 @@ const args$2 = {
 			}
 		})
 	}),
-	skipExtendingTimeout: import_cjs$10.flag({
+	skipExtendingTimeout: import_cjs$11.flag({
 		long: "no-extend-timeout",
 		description: "Do not extend the sandbox timeout while running an interactive command. Only affects interactive executions."
 	}),
-	envVars: import_cjs$10.multioption({
+	envVars: import_cjs$11.multioption({
 		long: "env",
 		short: "e",
 		type: ObjectFromKeyValue,
 		description: "Environment variables to set for the command"
 	}),
-	tty: import_cjs$10.flag({
+	tty: import_cjs$11.flag({
 		long: "tty",
 		short: "t",
 		description: "Allocate a tty for an interactive command. This is a no-op."
 	})
 };
-const exec = import_cjs$10.command({
+const exec = import_cjs$11.command({
 	name: "exec",
 	description: "Execute a command in an existing sandbox",
 	args: args$2,
@@ -11617,16 +11705,16 @@ function omit(obj, ...keys) {
 
 //#endregion
 //#region src/commands/run.ts
-var import_cjs$9 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$10 = /* @__PURE__ */ __toESM(require_cjs());
 const args$1 = {
 	...args$3,
 	...omit(args$2, "sandbox"),
-	removeAfterUse: import_cjs$9.flag({
+	removeAfterUse: import_cjs$10.flag({
 		long: "rm",
 		description: "Automatically remove the sandbox when the command exits."
 	})
 };
-const run = import_cjs$9.command({
+const run = import_cjs$10.command({
 	name: "run",
 	description: "Create and run a command in a sandbox",
 	args: args$1,
@@ -11642,7 +11730,7 @@ const run = import_cjs$9.command({
 		}
 	}
 });
-const sh = import_cjs$9.command({
+const sh = import_cjs$10.command({
 	name: "sh",
 	description: "Create a sandbox and run an interactive shell.",
 	aliases: ["shell"],
@@ -11659,15 +11747,15 @@ const sh = import_cjs$9.command({
 
 //#endregion
 //#region src/commands/list.ts
-var import_cjs$8 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$9 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
-const list = import_cjs$8.command({
+const list = import_cjs$9.command({
 	name: "list",
 	aliases: ["ls"],
 	description: "List all sandboxes for the specified account and project.",
 	args: {
 		scope,
-		all: import_cjs$8.flag({
+		all: import_cjs$9.flag({
 			long: "all",
 			short: "a",
 			description: "Show all sandboxes (default shows just running)"
@@ -11725,8 +11813,8 @@ const SandboxStatusColor = new Map([
 
 //#endregion
 //#region src/commands/ssh.ts
-var import_cjs$7 = /* @__PURE__ */ __toESM(require_cjs());
-const ssh = import_cjs$7.command({
+var import_cjs$8 = /* @__PURE__ */ __toESM(require_cjs());
+const ssh = import_cjs$8.command({
 	name: "ssh",
 	description: "Start an interactive shell in an existing sandbox",
 	args: omit(args$2, "command", "args", "interactive", "tty"),
@@ -14026,18 +14114,18 @@ var Listr = class {
 
 //#endregion
 //#region src/commands/stop.ts
-var import_cjs$6 = /* @__PURE__ */ __toESM(require_cjs());
-const stop = import_cjs$6.command({
+var import_cjs$7 = /* @__PURE__ */ __toESM(require_cjs());
+const stop = import_cjs$7.command({
 	name: "stop",
 	aliases: ["rm", "remove"],
 	description: "Stop one or more running sandboxes",
 	args: {
 		scope,
-		sandboxId: import_cjs$6.positional({
+		sandboxId: import_cjs$7.positional({
 			type: sandboxId,
 			description: "a sandbox ID to stop"
 		}),
-		sandboxIds: import_cjs$6.restPositionals({
+		sandboxIds: import_cjs$7.restPositionals({
 			type: sandboxId,
 			description: "more sandboxes to stop"
 		})
@@ -14110,10 +14198,10 @@ var require_fs = /* @__PURE__ */ __commonJS$1({ "../../node_modules/.pnpm/cmd-ts
 
 //#endregion
 //#region src/commands/cp.ts
-var import_cjs$5 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$6 = /* @__PURE__ */ __toESM(require_cjs());
 var import_fs = /* @__PURE__ */ __toESM(require_fs());
 init_source();
-const localOrRemote = import_cjs$5.extendType(import_cjs$5.string, { async from(input) {
+const localOrRemote = import_cjs$6.extendType(import_cjs$6.string, { async from(input) {
 	const parts = input.split(":");
 	if (parts.length === 2) {
 		const [id, path$1] = parts;
@@ -14133,18 +14221,18 @@ const localOrRemote = import_cjs$5.extendType(import_cjs$5.string, { async from(
 		file: await import_fs.File.from(input)
 	};
 } });
-const cp = import_cjs$5.command({
+const cp = import_cjs$6.command({
 	name: "copy",
 	description: "Copy files between your local filesystem and a remote sandbox",
 	aliases: ["cp"],
 	args: {
 		scope,
-		source: import_cjs$5.positional({
+		source: import_cjs$6.positional({
 			displayName: `SANDBOX_ID:PATH`,
 			description: `The source file to copy from local file system, or or a sandbox_id:path from a remote sandbox`,
 			type: localOrRemote
 		}),
-		dest: import_cjs$5.positional({
+		dest: import_cjs$6.positional({
 			displayName: `SANDBOX_ID:PATH`,
 			description: `The destination file to copy to local file system, or or a sandbox_id:path to a remote sandbox`,
 			type: localOrRemote
@@ -14186,10 +14274,10 @@ const cp = import_cjs$5.command({
 
 //#endregion
 //#region src/commands/logout.ts
-var import_cjs$4 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$5 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
 const debug = createDebugger("sandbox:logout");
-const logout = import_cjs$4.command({
+const logout = import_cjs$5.command({
 	name: "logout",
 	description: "Log out of the Sandbox CLI",
 	args: {},
@@ -14208,21 +14296,21 @@ const logout = import_cjs$4.command({
 
 //#endregion
 //#region src/commands/snapshot.ts
-var import_cjs$3 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$4 = /* @__PURE__ */ __toESM(require_cjs());
 init_source();
 const args = {
 	scope,
-	stop: import_cjs$3.flag({
+	stop: import_cjs$4.flag({
 		long: "stop",
 		description: "Confirm that the sandbox will be stopped when snapshotting"
 	}),
-	silent: import_cjs$3.flag({
+	silent: import_cjs$4.flag({
 		long: "silent",
 		description: "Don't write snapshot ID to stdout"
 	}),
-	sandbox: import_cjs$3.positional({ type: sandboxId })
+	sandbox: import_cjs$4.positional({ type: sandboxId })
 };
-const snapshot = import_cjs$3.command({
+const snapshot = import_cjs$4.command({
 	name: "snapshot",
 	description: "Take a snapshot of the filesystem of a sandbox",
 	args,
@@ -14256,10 +14344,10 @@ const snapshot = import_cjs$3.command({
 
 //#endregion
 //#region src/commands/snapshots.ts
-var import_cjs$1 = /* @__PURE__ */ __toESM(require_cjs());
-var import_cjs$2 = require_cjs();
+var import_cjs$2 = /* @__PURE__ */ __toESM(require_cjs());
+var import_cjs$3 = require_cjs();
 init_source();
-const list$1 = import_cjs$1.command({
+const list$1 = import_cjs$2.command({
 	name: "list",
 	aliases: ["ls"],
 	description: "List snapshots for the specified account and project.",
@@ -14298,17 +14386,17 @@ const list$1 = import_cjs$1.command({
 		}));
 	}
 });
-const remove = import_cjs$1.command({
+const remove = import_cjs$2.command({
 	name: "delete",
 	aliases: ["rm", "remove"],
 	description: "Delete one or more snapshots.",
 	args: {
 		scope,
-		snapshotId: import_cjs$1.positional({
+		snapshotId: import_cjs$2.positional({
 			type: snapshotId,
 			description: "snapshot ID to delete"
 		}),
-		snapshotIds: import_cjs$1.restPositionals({
+		snapshotIds: import_cjs$2.restPositionals({
 			type: snapshotId,
 			description: "More snapshots IDs to delete"
 		})
@@ -14331,7 +14419,7 @@ const remove = import_cjs$1.command({
 		}), { concurrent: true }).run();
 	}
 });
-const snapshots = (0, import_cjs$2.subcommands)({
+const snapshots = (0, import_cjs$3.subcommands)({
 	name: "snapshots",
 	description: "Manage sandbox snapshots",
 	cmds: {
@@ -14345,6 +14433,62 @@ const SnapshotStatusColor = new Map([
 	["failed", source_default.red]
 ]);
 
+//#endregion
+//#region src/commands/config.ts
+var import_cjs$1 = /* @__PURE__ */ __toESM(require_cjs());
+init_source();
+const networkPolicyCommand = import_cjs$1.command({
+	name: "network-policy",
+	description: `Update the network policy of a sandbox
+  
+This is a full update, fully overriding the pre-existing configuration.`,
+	args: {
+		scope,
+		sandbox: import_cjs$1.positional({ type: sandboxId }),
+		...networkPolicyArgs
+	},
+	async handler({ scope: { token: token$1, team: team$1, project: project$1 }, sandbox: sandboxId$1, networkPolicy: networkPolicyMode$1, allowedDomains: allowedDomains$1, allowedCIDRs: allowedCIDRs$1, deniedCIDRs: deniedCIDRs$1 }) {
+		if (networkPolicyMode$1 === void 0) throw new Error(`Network policy mode must be set.`);
+		const networkPolicy$1 = buildNetworkPolicy({
+			networkPolicy: networkPolicyMode$1,
+			allowedDomains: allowedDomains$1,
+			allowedCIDRs: allowedCIDRs$1,
+			deniedCIDRs: deniedCIDRs$1
+		});
+		const sandbox = typeof sandboxId$1 !== "string" ? sandboxId$1 : await sandboxClient.get({
+			sandboxId: sandboxId$1,
+			projectId: project$1,
+			teamId: team$1,
+			token: token$1
+		});
+		if (!["pending", "running"].includes(sandbox.status)) {
+			console.error([
+				`Sandbox ${sandbox.sandboxId} is not available (status: ${sandbox.status}).`,
+				`${source_default.bold("hint:")} Only 'pending' or 'running' sandboxes can execute commands.`,
+				"├▶ Use `sandbox list` to check sandbox status.",
+				"╰▶ Use `sandbox create` to create a new sandbox."
+			].join("\n"));
+			process.exitCode = 1;
+			return;
+		}
+		const spinner = ora("Updating network policy...").start();
+		try {
+			await sandbox.updateNetworkPolicy(networkPolicy$1);
+			spinner.stop();
+			process.stderr.write("✅ Network policy updated for sandbox " + source_default.cyan(sandbox.sandboxId) + "\n");
+			process.stderr.write(source_default.dim("   ╰ ") + "mode: " + source_default.cyan(networkPolicy$1.type) + "\n");
+		} catch (error) {
+			spinner.stop();
+			throw error;
+		}
+	}
+});
+const config = import_cjs$1.subcommands({
+	name: "config",
+	description: "Update a sandbox configuration",
+	cmds: { "network-policy": networkPolicyCommand }
+});
+
 //#endregion
 //#region src/app.ts
 var import_cjs = require_cjs();
@@ -14355,6 +14499,7 @@ const app = (opts) => (0, import_cjs.subcommands)({
 	cmds: {
 		list,
 		create,
+		config,
 		copy: cp,
 		exec,
 		ssh,
@@ -14372,4 +14517,4 @@ const app = (opts) => (0, import_cjs.subcommands)({
 
 //#endregion
 export { StyledError as n, require_cjs as r, app as t };
-//# sourceMappingURL=app-Be0xsoIH.mjs.map
+//# sourceMappingURL=app-DtmaeGtx.mjs.map