setsuna-microvm 0.5.0

package/dist/cli.js

@@ -0,0 +1,3753 @@
+#!/usr/bin/env node
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// ../setsuna/src/tui/customer/prompt.ts
+var TUI_CANCEL;
+var init_prompt = __esm({
+  "../setsuna/src/tui/customer/prompt.ts"() {
+    "use strict";
+    TUI_CANCEL = /* @__PURE__ */ Symbol("setsuna:tui-cancel");
+  }
+});
+
+// ../setsuna/src/tui/customer/clack.ts
+var clack_exports = {};
+__export(clack_exports, {
+  loadClackPromptUi: () => loadClackPromptUi
+});
+async function loadClackPromptUi(presentation = {}) {
+  const clack = await import("@clack/prompts");
+  const guide = (options) => ({
+    withGuide: options?.withGuide ?? presentation.withGuide
+  });
+  return {
+    ...adaptMessages(clack, guide),
+    ...adaptPrompts(clack, guide),
+    box(message, title, io, options = {}) {
+      clack.box(message, title, { ...options, ...guide(options), output: io.output });
+    },
+    spinner: (io, options = {}) => adaptSpinner(clack, io, options, guide(options)),
+    progress: (options, io) => adaptProgress(clack, io, options, guide(options)),
+    taskLog: (options, io) => adaptTaskLog(clack, io, options)
+  };
+}
+function adaptMessages(clack, guide) {
+  const { cancel, intro, log, note, outro } = clack;
+  return {
+    intro(title, subtitle, io, presentation) {
+      intro(title, { output: io.output, ...guide(presentation) });
+      log.message(subtitle, { output: io.output, ...guide(presentation) });
+    },
+    note(message, title, io, presentation) {
+      note(message, title, { output: io.output, ...guide(presentation) });
+    },
+    outro(message, io, presentation) {
+      outro(message, { output: io.output, ...guide(presentation) });
+    },
+    cancel(message, io, presentation) {
+      cancel(message, { output: io.output, ...guide(presentation) });
+    },
+    info(message, io, presentation) {
+      log.info(message, { output: io.output, ...guide(presentation) });
+    },
+    success(message, io, presentation) {
+      log.success(message, { output: io.output, ...guide(presentation) });
+    },
+    warn(message, io, presentation) {
+      log.warn(message, { output: io.output, ...guide(presentation) });
+    },
+    error(message, io, presentation) {
+      log.error(message, { output: io.errorOutput, ...guide(presentation) });
+    },
+    phase(message, io, presentation) {
+      log.step(message, { output: io.output, ...guide(presentation) });
+    }
+  };
+}
+function adaptPrompts(clack, guide) {
+  const { confirm, isCancel, select, text } = clack;
+  return {
+    async select(options, io) {
+      const result = await select({
+        ...options,
+        options: [...options.options],
+        ...guide(options),
+        input: io.input,
+        output: io.output
+      });
+      return isCancel(result) ? TUI_CANCEL : result;
+    },
+    async text(options, io) {
+      const result = await text({
+        ...options,
+        validate: options.validate === void 0 ? void 0 : (value) => options.validate?.(value ?? ""),
+        ...guide(options),
+        input: io.input,
+        output: io.output
+      });
+      return isCancel(result) ? TUI_CANCEL : result;
+    },
+    async confirm(options, io) {
+      const result = await confirm({
+        ...options,
+        ...guide(options),
+        input: io.input,
+        output: io.output
+      });
+      return isCancel(result) ? TUI_CANCEL : result;
+    }
+  };
+}
+function adaptSpinner(clack, io, options, guide) {
+  const completion = trackInterruption(clack, io, options.onCancel, guide);
+  const spinner = clack.spinner({
+    output: io.output,
+    indicator: options.indicator,
+    onCancel: completion.interrupt,
+    ...guide
+  });
+  return {
+    start: (message) => spinner.start(message),
+    message: (message) => spinner.message(message),
+    stop: (message) => completion.stop(message, spinner.stop),
+    error: (message) => completion.error(message, spinner.error)
+  };
+}
+function adaptProgress(clack, io, options, guide) {
+  const completion = trackInterruption(clack, io, options.onCancel, guide);
+  const bar = clack.progress({
+    max: options.max,
+    size: options.size,
+    style: options.style,
+    indicator: options.indicator,
+    output: io.output,
+    onCancel: completion.interrupt,
+    ...guide
+  });
+  return {
+    start: (message) => bar.start(message),
+    advance: (step, message) => bar.advance(step, message),
+    message: (message) => bar.message(message),
+    stop: (message) => completion.stop(message, bar.stop),
+    cancel: (message) => completion.cancel(message, bar.cancel),
+    error: (message) => completion.error(message, bar.error),
+    clear: () => completion.clear(bar.clear),
+    // Clack 1.7.0 copies the spinner flag once while creating the bar, so it never turns true;
+    // the interruption tracked for the fallback logging is the same state.
+    get isCancelled() {
+      return completion.interrupted;
+    }
+  };
+}
+function adaptTaskLog(clack, io, options) {
+  return clack.taskLog({
+    title: options.title,
+    limit: options.limit,
+    retainLog: options.retainLog,
+    output: io.output
+  });
+}
+function trackInterruption(clack, io, onCancel, guide) {
+  let interrupted = false;
+  const fallback = (write, output) => (message, finish) => {
+    if (interrupted) write(message ?? "", { output, ...guide });
+    else finish(message);
+  };
+  return {
+    get interrupted() {
+      return interrupted;
+    },
+    interrupt() {
+      interrupted = true;
+      onCancel?.();
+    },
+    stop: fallback(clack.log.success, io.output),
+    cancel: fallback(
+      (message, options) => clack.log.message(message, { ...options, symbol: clack.S_STEP_CANCEL }),
+      io.output
+    ),
+    error: fallback(clack.log.error, io.errorOutput),
+    clear(clear) {
+      if (!interrupted) clear();
+    }
+  };
+}
+var init_clack = __esm({
+  "../setsuna/src/tui/customer/clack.ts"() {
+    "use strict";
+    init_prompt();
+  }
+});
+
+// ../setsuna/src/cli-preview.ts
+import { realpathSync } from "fs";
+import { pathToFileURL } from "url";
+
+// ../setsuna/src/auth-flow.ts
+import { setTimeout as delay } from "timers/promises";
+
+// ../setsuna/src/auth-metadata.ts
+import { randomUUID } from "crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "fs/promises";
+import path from "path";
+
+// ../setsuna/src/auth-token.ts
+import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
+var SETSUNA_AUTH0_ISSUER = "https://login.setsuna.semswitch.com/";
+var SETSUNA_AUTH0_AUDIENCE = "https://api.setsuna.semswitch.com";
+var SETSUNA_AUTH0_CLIENT_ID = "SFMnPOMePRs61ixPkzvkHSRZxzCinw2C";
+var SETSUNA_AUTH0_ORG_CLAIM = "https://setsuna.semswitch.com/org_id";
+var Auth0AccessTokenValidator = class {
+  #fetch;
+  #providedKeyResolver;
+  #now;
+  #remoteKeyResolver;
+  constructor(options = {}) {
+    this.#fetch = options.fetch ?? globalThis.fetch;
+    this.#providedKeyResolver = options.keyResolver;
+    this.#now = options.now ?? (() => /* @__PURE__ */ new Date());
+  }
+  async validate(token) {
+    if (token.trim() === "" || /\s/u.test(token)) throw new Error("Invalid Auth0 access token.");
+    const currentDate = this.#now();
+    const keyResolver = this.#providedKeyResolver ?? await this.#getRemoteKeyResolver();
+    const { payload } = await jwtVerify(token, keyResolver, {
+      algorithms: ["RS256"],
+      issuer: SETSUNA_AUTH0_ISSUER,
+      audience: SETSUNA_AUTH0_AUDIENCE,
+      currentDate
+    });
+    const subject = requiredText(payload.sub);
+    const orgId = requiredText(payload[SETSUNA_AUTH0_ORG_CLAIM]);
+    const permissions = requiredPermissions(payload.permissions);
+    const issuedAt = requiredTimestamp(payload.iat);
+    const expiresAt = requiredTimestamp(payload.exp);
+    if (expiresAt <= issuedAt || issuedAt > Math.floor(currentDate.getTime() / 1e3) + 60) {
+      throw new Error("Invalid Auth0 access token timestamps.");
+    }
+    return { subject, orgId, permissions, issuedAt, expiresAt };
+  }
+  #getRemoteKeyResolver() {
+    if (this.#remoteKeyResolver === void 0) {
+      const pending = this.#loadRemoteKeyResolver();
+      this.#remoteKeyResolver = pending;
+      void pending.catch(() => {
+        if (this.#remoteKeyResolver === pending) this.#remoteKeyResolver = void 0;
+      });
+    }
+    return this.#remoteKeyResolver;
+  }
+  async #loadRemoteKeyResolver() {
+    const response = await this.#fetch(
+      new URL(".well-known/openid-configuration", SETSUNA_AUTH0_ISSUER),
+      { headers: { accept: "application/json" } }
+    );
+    if (!response.ok) throw new Error("Auth0 OIDC discovery failed.");
+    const document = await response.json();
+    if (document.issuer !== SETSUNA_AUTH0_ISSUER || typeof document.jwks_uri !== "string" || document.jwks_uri.trim() === "") {
+      throw new Error("Auth0 OIDC discovery response is invalid.");
+    }
+    const jwksUrl = new URL(document.jwks_uri);
+    if (jwksUrl.protocol !== "https:" || jwksUrl.origin !== new URL(SETSUNA_AUTH0_ISSUER).origin) {
+      throw new Error("Auth0 OIDC JWKS URL is invalid.");
+    }
+    return createRemoteJWKSet(jwksUrl, { [customFetch]: this.#fetch });
+  }
+};
+function requiredText(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error("Auth0 access token is missing an identity claim.");
+  }
+  return value;
+}
+function requiredTimestamp(value) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error("Auth0 access token is missing a timestamp.");
+  }
+  return value;
+}
+function requiredPermissions(value) {
+  if (!Array.isArray(value) || value.length === 0 || value.some((permission) => typeof permission !== "string" || permission.trim() === "")) {
+    throw new Error("Auth0 access token is missing permissions.");
+  }
+  return value;
+}
+
+// ../setsuna/src/auth-metadata.ts
+var FileAuthMetadataStore = class {
+  constructor(path3) {
+    this.path = path3;
+  }
+  path;
+  async load() {
+    let contents;
+    try {
+      contents = await readFile(this.path, "utf8");
+    } catch (error) {
+      if (isFileError(error, "ENOENT")) return null;
+      throw new Error("Setsuna credentials could not be read.", { cause: error });
+    }
+    let credentials2;
+    try {
+      credentials2 = storedCredentials(JSON.parse(contents));
+    } catch {
+      throw new Error("Setsuna credentials are invalid.");
+    }
+    assertConfiguredCredentials(credentials2);
+    return credentials2;
+  }
+  async save(credentials2) {
+    const metadata = metadataFields(credentials2);
+    const directory = path.dirname(this.path);
+    await mkdir(directory, { recursive: true, mode: 448 });
+    await restrictPermissions(directory, 448);
+    const temporaryPath = path.join(
+      directory,
+      `.${path.basename(this.path)}.${process.pid}.${randomUUID()}.tmp`
+    );
+    try {
+      await writeFile(temporaryPath, `${JSON.stringify(metadata)}
+`, {
+        encoding: "utf8",
+        flag: "wx",
+        mode: 384
+      });
+      await restrictPermissions(temporaryPath, 384);
+      await rename(temporaryPath, this.path);
+      await restrictPermissions(this.path, 384);
+    } catch (error) {
+      throw new Error("Setsuna credentials could not be saved.", { cause: error });
+    } finally {
+      await rm(temporaryPath, { force: true });
+    }
+  }
+  async remove() {
+    try {
+      await rm(this.path, { force: true });
+    } catch (error) {
+      throw new Error("Setsuna credentials could not be removed.", { cause: error });
+    }
+  }
+  async saveLogin(metadata, persistRefreshToken) {
+    const temporaryPath = path.join(
+      path.dirname(this.path),
+      `.${path.basename(this.path)}.${process.pid}.${randomUUID()}.tmp`
+    );
+    try {
+      await stageLoginMetadata(temporaryPath, metadata);
+      await this.remove();
+      await persistRefreshToken();
+      try {
+        await rename(temporaryPath, this.path);
+      } catch (error) {
+        throw new Error("Setsuna credentials could not be saved.", { cause: error });
+      }
+    } catch (error) {
+      await rm(temporaryPath, { force: true }).catch(() => {
+      });
+      throw error;
+    }
+  }
+};
+async function stageLoginMetadata(temporaryPath, credentials2) {
+  const metadata = metadataFields(credentials2);
+  const directory = path.dirname(temporaryPath);
+  try {
+    await mkdir(directory, { recursive: true, mode: 448 });
+    await restrictPermissions(directory, 448);
+    await writeFile(temporaryPath, `${JSON.stringify(metadata)}
+`, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 384
+    });
+    await restrictPermissions(temporaryPath, 384);
+  } catch (error) {
+    throw new Error("Setsuna credentials could not be saved.", { cause: error });
+  }
+}
+function metadataFields(record) {
+  return {
+    schemaVersion: 2,
+    issuer: requiredText2(record.issuer),
+    audience: requiredText2(record.audience),
+    clientId: requiredText2(record.clientId),
+    accessToken: requiredText2(record.accessToken),
+    accessTokenExpiresAt: requiredPositiveInteger(record.accessTokenExpiresAt)
+  };
+}
+function storedCredentials(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error();
+  const record = value;
+  const allowedKeys = /* @__PURE__ */ new Set([
+    "schemaVersion",
+    "issuer",
+    "audience",
+    "clientId",
+    "accessToken",
+    "accessTokenExpiresAt"
+  ]);
+  if (record.schemaVersion === 1) allowedKeys.add("refreshToken");
+  if (Object.keys(record).some((key) => !allowedKeys.has(key)) || record.schemaVersion !== 1 && record.schemaVersion !== 2)
+    throw new Error();
+  const metadata = metadataFields(record);
+  return record.schemaVersion === 1 ? { ...metadata, schemaVersion: 1, refreshToken: requiredText2(record.refreshToken) } : metadata;
+}
+function assertConfiguredCredentials(value) {
+  if (value.issuer !== SETSUNA_AUTH0_ISSUER || value.audience !== SETSUNA_AUTH0_AUDIENCE || value.clientId !== SETSUNA_AUTH0_CLIENT_ID) {
+    throw new Error("Stored Setsuna credentials belong to another authentication configuration.");
+  }
+}
+async function restrictPermissions(target, mode) {
+  try {
+    await chmod(target, mode);
+  } catch (error) {
+    if (process.platform !== "win32") throw error;
+  }
+}
+function isFileError(error, code) {
+  return error instanceof Error && "code" in error && error.code === code;
+}
+function requiredText2(value) {
+  if (typeof value !== "string" || value.trim() === "") throw new Error("invalid credential text");
+  return value;
+}
+function requiredPositiveInteger(value) {
+  if (!Number.isSafeInteger(value) || value <= 0)
+    throw new Error("invalid credential expiration");
+  return value;
+}
+
+// ../setsuna/src/auth-oauth.ts
+var DEVICE_CODE_ENDPOINT = new URL("oauth/device/code", SETSUNA_AUTH0_ISSUER).toString();
+var TOKEN_ENDPOINT = new URL("oauth/token", SETSUNA_AUTH0_ISSUER).toString();
+var REVOCATION_ENDPOINT = new URL("oauth/revoke", SETSUNA_AUTH0_ISSUER).toString();
+var DEFAULT_POLL_INTERVAL_SECONDS = 5;
+var REFRESH_FAILURE_MESSAGES = {
+  permanent: "Your Setsuna session has expired. Run `setsuna auth login` again.",
+  transient: "Setsuna authentication is temporarily unavailable. Try again.",
+  malformed: "Auth0 returned an invalid refresh response. Try again."
+};
+var AuthRefreshError = class extends Error {
+  constructor(kind) {
+    super(REFRESH_FAILURE_MESSAGES[kind]);
+    this.kind = kind;
+    this.name = "AuthRefreshError";
+  }
+  kind;
+};
+async function requestDeviceAuthorization(fetch_) {
+  const response = await postForm(
+    DEVICE_CODE_ENDPOINT,
+    {
+      client_id: SETSUNA_AUTH0_CLIENT_ID,
+      audience: SETSUNA_AUTH0_AUDIENCE,
+      scope: "openid offline_access"
+    },
+    fetch_
+  );
+  if (!response.ok) throw new Error("Auth0 device authorization request failed.");
+  const value = await responseRecord(response, "Auth0 returned an invalid device authorization.");
+  const verificationUri = requiredHttpsUrl(value.verification_uri);
+  const verificationUriComplete = optionalHttpsUrl(value.verification_uri_complete);
+  return {
+    deviceCode: requiredText3(value.device_code),
+    userCode: requiredText3(value.user_code),
+    verificationUrl: verificationUriComplete ?? verificationUri,
+    expiresInSeconds: requiredPositiveInteger2(value.expires_in),
+    intervalSeconds: value.interval === void 0 ? DEFAULT_POLL_INTERVAL_SECONDS : requiredPositiveInteger2(value.interval)
+  };
+}
+async function pollDeviceToken(deviceCode, fetch_, signal) {
+  const response = await postForm(
+    TOKEN_ENDPOINT,
+    {
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+      device_code: deviceCode,
+      client_id: SETSUNA_AUTH0_CLIENT_ID
+    },
+    fetch_,
+    signal
+  );
+  const value = await responseRecord(response, "Auth0 returned an invalid token response.");
+  if (response.ok) return { kind: "token", token: tokenResponse(value, true) };
+  if (value.error === "authorization_pending") return { kind: "pending" };
+  if (value.error === "slow_down") return { kind: "slow-down" };
+  if (value.error === "access_denied") return { kind: "denied" };
+  if (value.error === "expired_token") return { kind: "expired" };
+  throw new Error("Auth0 device authorization failed.");
+}
+async function refreshAccessToken(refreshToken, fetch_) {
+  let response;
+  try {
+    response = await postForm(
+      TOKEN_ENDPOINT,
+      {
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: SETSUNA_AUTH0_CLIENT_ID
+      },
+      fetch_
+    );
+  } catch {
+    throw new AuthRefreshError("transient");
+  }
+  if (response.status === 408 || response.status === 429 || response.status >= 500) {
+    throw new AuthRefreshError("transient");
+  }
+  const value = await refreshResponseRecord(response);
+  if (!response.ok) {
+    if (response.status >= 400 && value.error === "invalid_grant") {
+      throw new AuthRefreshError("permanent");
+    }
+    throw new AuthRefreshError(
+      typeof value.error === "string" && value.error !== "" ? "transient" : "malformed"
+    );
+  }
+  try {
+    const replacement = tokenResponse(value, false);
+    return {
+      accessToken: replacement.accessToken,
+      refreshToken: replacement.refreshToken || refreshToken
+    };
+  } catch {
+    throw new AuthRefreshError("malformed");
+  }
+}
+async function refreshResponseRecord(response) {
+  let value;
+  try {
+    value = await response.json();
+  } catch (error) {
+    throw new AuthRefreshError(error instanceof SyntaxError ? "malformed" : "transient");
+  }
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new AuthRefreshError("malformed");
+  }
+  return value;
+}
+async function revokeRefreshToken(refreshToken, fetch_, signal) {
+  if (signal.aborted) return "unconfirmed";
+  let onAbort = () => {
+  };
+  const aborted = new Promise((resolve) => {
+    onAbort = () => resolve("unconfirmed");
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+  try {
+    return await Promise.race([sendRevocation(refreshToken, fetch_, signal), aborted]);
+  } finally {
+    signal.removeEventListener("abort", onAbort);
+  }
+}
+async function sendRevocation(token, fetch_, signal) {
+  try {
+    const response = await fetch_(REVOCATION_ENDPOINT, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ token, client_id: SETSUNA_AUTH0_CLIENT_ID }).toString(),
+      signal,
+      redirect: "error"
+    });
+    void response.body?.cancel().catch(() => {
+    });
+    return response.status === 200 && !signal.aborted ? "confirmed" : "unconfirmed";
+  } catch {
+    return "unconfirmed";
+  }
+}
+function tokenResponse(value, requireRefreshToken) {
+  if (typeof value.token_type !== "string" || value.token_type.toLowerCase() !== "bearer") {
+    throw new Error("Auth0 did not return a Bearer access token.");
+  }
+  const refreshToken = value.refresh_token === void 0 && !requireRefreshToken ? "" : requiredText3(value.refresh_token);
+  return { accessToken: requiredText3(value.access_token), refreshToken };
+}
+async function postForm(url, fields, fetch_, signal) {
+  try {
+    return await fetch_(url, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/x-www-form-urlencoded"
+      },
+      body: new URLSearchParams(fields).toString(),
+      signal
+    });
+  } catch (error) {
+    throw new Error("Auth0 request failed.", { cause: error });
+  }
+}
+async function responseRecord(response, message) {
+  try {
+    const value = await response.json();
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+      return value;
+    }
+  } catch {
+  }
+  throw new Error(message);
+}
+function requiredText3(value) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error("Auth0 response is missing a required value.");
+  }
+  return value;
+}
+function requiredPositiveInteger2(value) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error("Auth0 response contains an invalid duration.");
+  }
+  return value;
+}
+function requiredHttpsUrl(value) {
+  const text = requiredText3(value);
+  const url = new URL(text);
+  if (url.protocol !== "https:") throw new Error("Auth0 returned an invalid verification URL.");
+  return url.toString();
+}
+function optionalHttpsUrl(value) {
+  return value === void 0 ? null : requiredHttpsUrl(value);
+}
+
+// ../setsuna/src/auth-store.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { link, mkdir as mkdir2, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { homedir } from "os";
+import path2 from "path";
+
+// ../setsuna/src/auth-keyring.ts
+var AUTH_KEYRING_SERVICE = "com.semswitch.setsuna";
+var AUTH_KEYRING_ACCOUNT = "refresh-token";
+var SECURE_STORAGE_UNAVAILABLE = "Secure credential storage is unavailable on this system.";
+var NativeRefreshTokenStore = class {
+  async load() {
+    try {
+      const { keyring } = await import("@zowe/secrets-for-zowe-sdk");
+      return await keyring.getPassword(AUTH_KEYRING_SERVICE, AUTH_KEYRING_ACCOUNT);
+    } catch {
+      throw new Error(SECURE_STORAGE_UNAVAILABLE);
+    }
+  }
+  async save(refreshToken) {
+    try {
+      const { keyring } = await import("@zowe/secrets-for-zowe-sdk");
+      await keyring.setPassword(AUTH_KEYRING_SERVICE, AUTH_KEYRING_ACCOUNT, refreshToken, 2);
+    } catch {
+      throw new Error(SECURE_STORAGE_UNAVAILABLE);
+    }
+  }
+  async remove() {
+    try {
+      const { keyring } = await import("@zowe/secrets-for-zowe-sdk");
+      await keyring.deletePassword(AUTH_KEYRING_SERVICE, AUTH_KEYRING_ACCOUNT);
+    } catch {
+      throw new Error(SECURE_STORAGE_UNAVAILABLE);
+    }
+  }
+};
+
+// ../setsuna/src/auth-store.ts
+var LOCK_ACQUISITION_TIMEOUT_MS = 1e4;
+var LOCK_RETRY_MS = 50;
+var NativeAuthCredentialStore = class {
+  path;
+  #metadata;
+  #refreshTokens;
+  constructor(userHome = homedir(), refreshTokens = new NativeRefreshTokenStore()) {
+    this.path = authCredentialPath(userHome);
+    this.#metadata = new FileAuthMetadataStore(this.path);
+    this.#refreshTokens = refreshTokens;
+  }
+  async load() {
+    const stored = await this.#metadata.load();
+    if (stored === null) return null;
+    if (stored.schemaVersion === 1) {
+      return this.withRefreshLock(async () => {
+        const current = await this.#metadata.load();
+        if (current === null) return null;
+        if (current.schemaVersion === 1) {
+          const migrated = { ...current, schemaVersion: 2 };
+          await this.save(migrated);
+          return migrated;
+        }
+        return this.#withRefreshToken(current);
+      });
+    }
+    return this.#withRefreshToken(stored);
+  }
+  async #withRefreshToken(metadata) {
+    const refreshToken = await this.#refreshTokens.load();
+    const current = await this.#metadata.load();
+    if (current?.accessToken !== metadata.accessToken) return this.load();
+    if (refreshToken === null || refreshToken.trim() === "") {
+      throw new Error("Run `setsuna auth login` first.");
+    }
+    return { ...metadata, refreshToken };
+  }
+  /** Logout holds the refresh lock already and must not migrate credentials just to delete them. */
+  async loadRefreshTokenForLogout() {
+    const stored = await this.#metadata.load();
+    if (stored === null) return null;
+    const token = stored.schemaVersion === 1 ? stored.refreshToken : await this.#refreshTokens.load();
+    return token === null || token.trim() === "" ? null : token;
+  }
+  async save(credentials2) {
+    assertConfiguredCredentials(credentials2);
+    await this.#saveRefreshToken(credentials2.refreshToken);
+    await this.#metadata.save(credentials2);
+  }
+  /** The caller holds the refresh lock, just as for rotation and migration. */
+  async saveLogin(credentials2) {
+    assertConfiguredCredentials(credentials2);
+    await this.#metadata.saveLogin(
+      credentials2,
+      () => this.#saveRefreshToken(credentials2.refreshToken)
+    );
+  }
+  async #saveRefreshToken(refreshToken) {
+    await this.#refreshTokens.save(refreshToken);
+    if (await this.#refreshTokens.load() !== refreshToken) {
+      throw new Error(SECURE_STORAGE_UNAVAILABLE);
+    }
+  }
+  async remove() {
+    await this.#refreshTokens.remove();
+    await this.#metadata.remove();
+  }
+  /** Called under the refresh lock when the installed refresh credential is no longer safe. */
+  async invalidate() {
+    try {
+      await this.#refreshTokens.remove();
+    } finally {
+      await this.#metadata.remove();
+    }
+  }
+  async withRefreshLock(operation) {
+    const release = await acquireRefreshLock(this.path);
+    try {
+      return await operation();
+    } finally {
+      await release();
+    }
+  }
+};
+function authCredentialPath(userHome = homedir()) {
+  return path2.join(userHome, ".setsuna", "auth.json");
+}
+async function acquireRefreshLock(credentialPath) {
+  const lockPath = `${credentialPath}.lock`;
+  const directory = path2.dirname(lockPath);
+  await mkdir2(directory, { recursive: true, mode: 448 });
+  await restrictPermissions(directory, 448);
+  const owner = { pid: process.pid, createdAt: Date.now(), nonce: randomUUID2() };
+  const deadline = Date.now() + LOCK_ACQUISITION_TIMEOUT_MS;
+  while (true) {
+    if (await tryClaimLock(lockPath, owner)) {
+      return async () => releaseRefreshLock(lockPath, owner.nonce);
+    }
+    const existing = await readLockOwner(lockPath);
+    if (existing !== null && !processIsAlive(existing.pid)) {
+      await removeLockOwnedBy(lockPath, existing.nonce);
+      continue;
+    }
+    if (Date.now() >= deadline) {
+      throw new Error("Setsuna authentication is busy; try again.");
+    }
+    await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+  }
+}
+async function tryClaimLock(lockPath, owner) {
+  const candidatePath = `${lockPath}.${owner.nonce}.tmp`;
+  try {
+    await writeFile2(candidatePath, `${JSON.stringify(owner)}
+`, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 384
+    });
+    await restrictPermissions(candidatePath, 384);
+    try {
+      await link(candidatePath, lockPath);
+      await restrictPermissions(lockPath, 384);
+      return true;
+    } catch (error) {
+      if (isFileError(error, "EEXIST")) return false;
+      throw error;
+    }
+  } finally {
+    await rm2(candidatePath, { force: true });
+  }
+}
+async function readLockOwner(lockPath) {
+  try {
+    const value = JSON.parse(await readFile2(lockPath, "utf8"));
+    if (Number.isSafeInteger(value.pid) && value.pid > 0 && Number.isSafeInteger(value.createdAt) && value.createdAt > 0 && typeof value.nonce === "string" && value.nonce !== "") {
+      return value;
+    }
+  } catch (error) {
+    if (isFileError(error, "ENOENT")) return null;
+  }
+  return null;
+}
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return !isFileError(error, "ESRCH");
+  }
+}
+async function removeLockOwnedBy(lockPath, nonce) {
+  const owner = await readLockOwner(lockPath);
+  if (owner?.nonce === nonce) await rm2(lockPath, { force: true });
+}
+async function releaseRefreshLock(lockPath, nonce) {
+  try {
+    await removeLockOwnedBy(lockPath, nonce);
+  } catch (error) {
+    throw new Error("Setsuna authentication lock could not be released.", { cause: error });
+  }
+}
+
+// ../setsuna/src/auth-flow.ts
+var SLOW_DOWN_INCREMENT_SECONDS = 5;
+var ACCESS_TOKEN_SAFETY_MARGIN_SECONDS = 60;
+var LOGOUT_REVOCATION_TIMEOUT_MS = 5e3;
+function defaultAuthRuntimeDependencies() {
+  const fetch_ = globalThis.fetch;
+  return {
+    fetch: fetch_,
+    store: new NativeAuthCredentialStore(),
+    validator: new Auth0AccessTokenValidator({ fetch: fetch_ }),
+    now: Date.now,
+    sleep: (milliseconds, signal) => delay(milliseconds, void 0, { signal }),
+    abortAfter: (milliseconds) => AbortSignal.timeout(milliseconds)
+  };
+}
+async function loginWithDeviceFlow(dependencies, prompt, signal) {
+  const authorization = await requestDeviceAuthorization(dependencies.fetch);
+  prompt({
+    verificationUrl: authorization.verificationUrl,
+    userCode: authorization.userCode
+  });
+  const deadline = dependencies.now() + authorization.expiresInSeconds * 1e3;
+  let intervalSeconds = authorization.intervalSeconds;
+  while (true) {
+    if (dependencies.now() + intervalSeconds * 1e3 >= deadline) {
+      throw new Error("Auth0 device authorization expired.");
+    }
+    await sleepUnlessCanceled(dependencies, intervalSeconds * 1e3, signal);
+    const result = await pollBeforeDeadline(
+      authorization.deviceCode,
+      deadline,
+      dependencies,
+      signal
+    );
+    if (result.kind === "pending") continue;
+    if (result.kind === "slow-down") {
+      intervalSeconds += SLOW_DOWN_INCREMENT_SECONDS;
+      continue;
+    }
+    if (result.kind === "denied") throw new Error("Auth0 device authorization was denied.");
+    if (result.kind === "expired") throw new Error("Auth0 device authorization expired.");
+    if (signal?.aborted) throw canceledDeviceAuthorization();
+    const validated = await dependencies.validator.validate(result.token.accessToken);
+    if (signal?.aborted) throw canceledDeviceAuthorization();
+    await dependencies.store.withRefreshLock(
+      () => dependencies.store.saveLogin(credentials(result.token, validated))
+    );
+    return { authenticated: true, expiresAt: validated.expiresAt };
+  }
+}
+async function inspectAuthStatus(dependencies) {
+  const stored = await dependencies.store.load();
+  if (stored === null) return { authenticated: false, expiresAt: null };
+  assertConfiguredCredentials(stored);
+  if (stored.accessTokenExpiresAt <= Math.floor(dependencies.now() / 1e3)) {
+    return { authenticated: false, expiresAt: stored.accessTokenExpiresAt };
+  }
+  try {
+    const validated = await dependencies.validator.validate(stored.accessToken);
+    if (validated.expiresAt !== stored.accessTokenExpiresAt) {
+      throw new Error("Stored access-token expiration does not match the token.");
+    }
+  } catch {
+    return { authenticated: false, expiresAt: stored.accessTokenExpiresAt };
+  }
+  return { authenticated: true, expiresAt: stored.accessTokenExpiresAt };
+}
+async function getValidAuthAccessToken(dependencies) {
+  const stored = await dependencies.store.load();
+  if (stored === null) throw new Error("Run `setsuna auth login` first.");
+  assertConfiguredCredentials(stored);
+  const refreshAt = Math.floor(dependencies.now() / 1e3) + ACCESS_TOKEN_SAFETY_MARGIN_SECONDS;
+  if (stored.accessTokenExpiresAt > refreshAt) {
+    const validated = await dependencies.validator.validate(stored.accessToken);
+    if (validated.expiresAt !== stored.accessTokenExpiresAt) {
+      throw new Error("Stored access-token expiration does not match the token.");
+    }
+    return stored.accessToken;
+  }
+  return dependencies.store.withRefreshLock(async () => {
+    const authoritative = await dependencies.store.load();
+    if (authoritative === null) throw new Error("Run `setsuna auth login` first.");
+    assertConfiguredCredentials(authoritative);
+    const lockedRefreshAt = Math.floor(dependencies.now() / 1e3) + ACCESS_TOKEN_SAFETY_MARGIN_SECONDS;
+    if (authoritative.accessTokenExpiresAt > lockedRefreshAt) {
+      const validated = await dependencies.validator.validate(authoritative.accessToken);
+      if (validated.expiresAt !== authoritative.accessTokenExpiresAt) {
+        throw new Error("Stored access-token expiration does not match the token.");
+      }
+      return authoritative.accessToken;
+    }
+    return refreshStoredSession(authoritative.refreshToken, dependencies);
+  });
+}
+async function logoutAuth(dependencies) {
+  return dependencies.store.withRefreshLock(async () => {
+    let remoteRevocation = "unconfirmed";
+    try {
+      const token = await dependencies.store.loadRefreshTokenForLogout();
+      remoteRevocation = token === null ? "not-needed" : await revokeRefreshToken(
+        token,
+        dependencies.fetch,
+        dependencies.abortAfter(LOGOUT_REVOCATION_TIMEOUT_MS)
+      );
+    } catch {
+    } finally {
+      await invalidateSession(dependencies.store);
+    }
+    return { authenticated: false, remoteRevocation };
+  });
+}
+async function refreshStoredSession(refreshToken, dependencies) {
+  let replacement;
+  try {
+    replacement = await refreshAccessToken(refreshToken, dependencies.fetch);
+  } catch (error) {
+    if (error instanceof AuthRefreshError && error.kind === "permanent") {
+      await invalidateSession(dependencies.store);
+    }
+    throw error;
+  }
+  try {
+    const validated = await dependencies.validator.validate(replacement.accessToken);
+    await dependencies.store.save(credentials(replacement, validated));
+    return replacement.accessToken;
+  } catch {
+    if (replacement.refreshToken !== refreshToken) {
+      await invalidateSession(dependencies.store);
+      throw new Error("Your Setsuna session could not be renewed. Run `setsuna auth login` again.");
+    }
+    throw new Error("Setsuna authentication could not be refreshed. Try again.");
+  }
+}
+async function invalidateSession(store) {
+  try {
+    await store.invalidate();
+  } catch {
+    throw new Error(
+      "Setsuna could not clear the session. Run `setsuna auth logout`, then `setsuna auth login`."
+    );
+  }
+}
+async function sleepUnlessCanceled(dependencies, milliseconds, signal) {
+  try {
+    await (signal === void 0 ? dependencies.sleep(milliseconds) : dependencies.sleep(milliseconds, signal));
+  } catch (error) {
+    if (signal?.aborted) throw canceledDeviceAuthorization();
+    throw error;
+  }
+  if (signal?.aborted) throw canceledDeviceAuthorization();
+}
+async function pollBeforeDeadline(deviceCode, deadline, dependencies, cancelSignal) {
+  const remainingMilliseconds = deadline - dependencies.now();
+  if (remainingMilliseconds <= 0) throw new Error("Auth0 device authorization expired.");
+  const deadlineSignal = dependencies.abortAfter(remainingMilliseconds);
+  const signal = cancelSignal === void 0 ? deadlineSignal : AbortSignal.any([deadlineSignal, cancelSignal]);
+  let result;
+  try {
+    result = await pollDeviceToken(deviceCode, dependencies.fetch, signal);
+  } catch (error) {
+    if (cancelSignal?.aborted) throw canceledDeviceAuthorization();
+    if (deadlineSignal.aborted) throw new Error("Auth0 device authorization expired.");
+    throw error;
+  }
+  if (cancelSignal?.aborted) throw canceledDeviceAuthorization();
+  return result;
+}
+function canceledDeviceAuthorization() {
+  return new Error("Auth0 device authorization was canceled.");
+}
+function credentials(token, validated) {
+  return {
+    schemaVersion: 2,
+    issuer: SETSUNA_AUTH0_ISSUER,
+    audience: SETSUNA_AUTH0_AUDIENCE,
+    clientId: SETSUNA_AUTH0_CLIENT_ID,
+    accessToken: token.accessToken,
+    accessTokenExpiresAt: validated.expiresAt,
+    refreshToken: token.refreshToken
+  };
+}
+
+// ../setsuna/src/cli-auth.ts
+async function runAuthCommand(arguments_, parsed, io, providedDependencies) {
+  assertAuthOptions(parsed);
+  if (arguments_.length !== 1) {
+    throw new TypeError("setsuna auth requires exactly one of: login, status, logout.");
+  }
+  const dependencies = providedDependencies ?? defaultAuthRuntimeDependencies();
+  const json = parsed.values.json;
+  switch (arguments_[0]) {
+    case "login": {
+      const result = await loginWithDeviceFlow(dependencies, ({ verificationUrl, userCode }) => {
+        if (json) {
+          io.errorOutput.write(`${JSON.stringify({ verificationUrl, userCode })}
+`);
+        } else {
+          io.output.write(`Verification URL: ${verificationUrl}
+User code: ${userCode}
+`);
+        }
+      });
+      writeState(io, json, result.authenticated, result.expiresAt);
+      return;
+    }
+    case "status": {
+      const status = await inspectAuthStatus(dependencies);
+      writeState(io, json, status.authenticated, status.expiresAt);
+      return;
+    }
+    case "logout": {
+      const result = await logoutAuth(dependencies);
+      if (json) io.output.write(`${JSON.stringify(result)}
+`);
+      else {
+        io.output.write("Logged out.\n");
+        if (result.remoteRevocation === "unconfirmed") {
+          io.errorOutput.write(
+            "Warning: Local session cleared; remote revocation could not be confirmed.\n"
+          );
+        }
+      }
+      return;
+    }
+    default:
+      throw new TypeError(`Unknown auth command: ${arguments_[0]}`);
+  }
+}
+function writeState(io, json, authenticated, expiresAt) {
+  const expiration = expiresAt === null ? null : new Date(expiresAt * 1e3).toISOString();
+  if (json) {
+    io.output.write(`${JSON.stringify({ authenticated, expiresAt: expiration })}
+`);
+    return;
+  }
+  if (authenticated) {
+    io.output.write(`Authenticated. Access token expires at ${expiration}.
+`);
+  } else if (expiration !== null) {
+    io.output.write(`Not authenticated. Access token expired at ${expiration}.
+`);
+  } else {
+    io.output.write("Not authenticated.\n");
+  }
+}
+function assertAuthOptions(parsed) {
+  const unsupported = Object.entries(parsed.values).find(
+    ([name, value]) => name !== "json" && optionIsPresent(value)
+  );
+  if (unsupported !== void 0) {
+    throw new TypeError(`--${unsupported[0]} is not supported by setsuna auth.`);
+  }
+}
+function optionIsPresent(value) {
+  if (Array.isArray(value)) return value.length > 0;
+  if (typeof value === "boolean") return value;
+  return value !== void 0;
+}
+
+// ../setsuna/src/cli-parsing.ts
+import { readFile as readFile3 } from "fs/promises";
+import { parseArgs } from "util";
+function parsePreviewCliArgs(args) {
+  return parseArgs({
+    args: [...args],
+    allowPositionals: true,
+    strict: true,
+    options: {
+      "timeout-ms": { type: "string" },
+      "request-timeout-ms": { type: "string" },
+      "configuration-id": { type: "string" },
+      attach: { type: "string" },
+      json: { type: "boolean", default: false },
+      help: { type: "boolean", short: "h", default: false },
+      version: { type: "boolean", short: "v", default: false }
+    }
+  });
+}
+async function packageVersion() {
+  const metadata = JSON.parse(
+    await readFile3(new URL("../package.json", import.meta.url), "utf8")
+  );
+  if (typeof metadata !== "object" || metadata === null || !("version" in metadata) || typeof metadata.version !== "string" || metadata.version === "") {
+    throw new Error("Installed package metadata does not contain a version.");
+  }
+  return metadata.version;
+}
+function optionalInteger(value, name) {
+  if (value === void 0) return void 0;
+  if (!/^[1-9][0-9]*$/u.test(value)) throw new TypeError(`${name} must be a positive integer.`);
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed)) throw new TypeError(`${name} is too large.`);
+  return parsed;
+}
+function shellQuote(value) {
+  if (/^[A-Za-z0-9_@%+=:,./-]+$/u.test(value)) return value;
+  return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+
+// ../setsuna/src/errors.ts
+var SetsunaError = class extends Error {
+  code;
+  status;
+  constructor(message, options) {
+    super(message, options.cause === void 0 ? void 0 : { cause: options.cause });
+    this.name = "SetsunaError";
+    this.code = options.code;
+    this.status = options.status;
+  }
+};
+
+// ../setsuna/src/broker-response.ts
+async function parseResponseJson(response) {
+  try {
+    return await response.json();
+  } catch (error) {
+    throw new SetsunaError("The Setsuna service returned an invalid JSON response.", {
+      code: "INVALID_RESPONSE",
+      status: response.status,
+      cause: error
+    });
+  }
+}
+function brokerResponseError(response, value) {
+  const body = isRecord(value) ? value : void 0;
+  const code = typeof body?.error?.code === "string" ? body.error.code : "SERVICE_ERROR";
+  const message = typeof body?.error?.message === "string" ? body.error.message : `The Setsuna service request failed with HTTP ${response.status}.`;
+  return new SetsunaError(message, { code, status: response.status });
+}
+function parseHealth(value) {
+  if (!isRecord(value) || value.ok !== true || typeof value.activeSandbox !== "boolean" || value.startupPhase !== "idle" && value.startupPhase !== "launching" && value.startupPhase !== "ready") {
+    throw invalidResponse("health");
+  }
+  return {
+    ok: true,
+    activeSandbox: value.activeSandbox,
+    startupPhase: value.startupPhase
+  };
+}
+function parseMicrovmConfigurationCatalog(value) {
+  if (!isRecord(value) || !hasOnlyKeys(value, [
+    "schemaVersion",
+    "maxConcurrentMicrovms",
+    "defaultConfigurationId",
+    "configurations"
+  ]) || value.schemaVersion !== 1 || !positiveResponseInteger(value.maxConcurrentMicrovms) || typeof value.defaultConfigurationId !== "string" || value.defaultConfigurationId === "" || !Array.isArray(value.configurations) || value.configurations.length === 0) {
+    throw invalidResponse("microVM configuration catalog");
+  }
+  const configurations = value.configurations.map(parseMicrovmConfiguration);
+  const ids = new Set(configurations.map(({ id }) => id));
+  if (ids.size !== configurations.length || !ids.has(value.defaultConfigurationId)) {
+    throw invalidResponse("microVM configuration catalog");
+  }
+  return {
+    schemaVersion: 1,
+    maxConcurrentMicrovms: value.maxConcurrentMicrovms,
+    defaultConfigurationId: value.defaultConfigurationId,
+    configurations
+  };
+}
+function parseMicrovmConfiguration(value) {
+  if (!isRecord(value) || !hasOnlyKeys(value, ["id", "vcpuCount", "memoryMiB"]) || !nonEmptyResponseString(value.id) || !positiveResponseInteger(value.vcpuCount) || !positiveResponseInteger(value.memoryMiB)) {
+    throw invalidResponse("microVM configuration");
+  }
+  return {
+    id: value.id,
+    vcpuCount: value.vcpuCount,
+    memoryMiB: value.memoryMiB
+  };
+}
+function nonEmptyResponseString(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function positiveResponseInteger(value) {
+  return Number.isSafeInteger(value) && value > 0;
+}
+function hasOnlyKeys(value, allowed) {
+  const keys = new Set(allowed);
+  return Object.keys(value).every((key) => keys.has(key));
+}
+function parseLease(value, expectedConfigurationId) {
+  const sandboxId = parseLeaseSandboxId(value);
+  if (!isRecord(value) || typeof value.expiresAt !== "string") {
+    throw invalidResponse("sandbox lease");
+  }
+  const microvmConfiguration = parseMicrovmConfiguration(value.microvmConfiguration);
+  if (expectedConfigurationId !== void 0 && microvmConfiguration.id !== expectedConfigurationId) {
+    throw invalidResponse("sandbox lease");
+  }
+  return { sandboxId, expiresAt: value.expiresAt, microvmConfiguration };
+}
+function parseLeaseSandboxId(value) {
+  if (!isRecord(value) || !nonEmptyResponseString(value.sandboxId))
+    throw invalidResponse("sandbox lease");
+  return value.sandboxId;
+}
+function parseSandboxStatus(value) {
+  if (!isRecord(value) || typeof value.sandboxId !== "string" || typeof value.expiresAt !== "string" || value.status !== "active") {
+    throw invalidResponse("sandbox status");
+  }
+  return { sandboxId: value.sandboxId, expiresAt: value.expiresAt, status: "active" };
+}
+function parseSandboxList(value) {
+  if (!Array.isArray(value)) throw invalidResponse("sandbox list");
+  return value.map(parseSandboxStatus);
+}
+function parseExecutionResult(value) {
+  if (!isRecord(value) || value.exitCode !== null && typeof value.exitCode !== "number" || typeof value.stdout !== "string" || typeof value.stderr !== "string" || typeof value.outputTruncated !== "boolean" || typeof value.omittedOutputBytes !== "number" || value.signal !== null && typeof value.signal !== "string" || typeof value.timedOut !== "boolean" || typeof value.durationMs !== "number") {
+    throw invalidResponse("execution result");
+  }
+  return {
+    exitCode: value.exitCode,
+    stdout: value.stdout,
+    stderr: value.stderr,
+    outputTruncated: value.outputTruncated,
+    omittedOutputBytes: value.omittedOutputBytes,
+    signal: value.signal,
+    timedOut: value.timedOut,
+    durationMs: value.durationMs
+  };
+}
+function invalidResponse(subject) {
+  return new SetsunaError(`The Setsuna service returned an invalid ${subject}.`, {
+    code: "INVALID_RESPONSE"
+  });
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// ../setsuna/src/client-options.ts
+var PREVIEW_SERVICE_URL = "https://api.setsuna.semswitch.com/azure-f8amds-v7/";
+function normalizeServiceUrl(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch (error) {
+    throw new SetsunaError("serviceUrl must be a valid loopback HTTP URL.", {
+      code: "INVALID_SERVICE_URL",
+      cause: error
+    });
+  }
+  if (url.protocol !== "http:" || !isLoopbackHostname(url.hostname) || url.username !== "" || url.password !== "") {
+    throw new SetsunaError("serviceUrl must be an unauthenticated loopback HTTP URL.", {
+      code: "INVALID_SERVICE_URL"
+    });
+  }
+  url.pathname = url.pathname.endsWith("/") ? url.pathname : `${url.pathname}/`;
+  url.search = "";
+  url.hash = "";
+  return url;
+}
+function positiveMilliseconds(value, name) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new TypeError(`${name} must be a positive integer.`);
+  }
+  return value;
+}
+function nonEmptyString(value, name) {
+  if (value.trim() === "") throw new TypeError(`${name} must not be empty.`);
+  return value;
+}
+function normalizeCreateOptions(options) {
+  if (typeof options !== "object" || options === null || Array.isArray(options)) {
+    throw new TypeError("create options must be an object.");
+  }
+  const unsupported = Object.keys(options).find(
+    (key) => key !== "microvmConfigurationId" && key !== "network"
+  );
+  if (unsupported !== void 0) throw new TypeError(`Unsupported create option: ${unsupported}.`);
+  const microvmConfigurationId = options.microvmConfigurationId === void 0 ? void 0 : nonEmptyString(options.microvmConfigurationId, "microvmConfigurationId");
+  const network = options.network === void 0 ? void 0 : validateRoutedNetwork(options.network);
+  return {
+    ...microvmConfigurationId === void 0 ? {} : { microvmConfigurationId },
+    ...network === void 0 ? {} : { network }
+  };
+}
+function validateRoutedNetwork(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new TypeError("network must be an object.");
+  }
+  const record = value;
+  const supported = /* @__PURE__ */ new Set([
+    "mode",
+    "hostIp",
+    "guestIp",
+    "prefixLength",
+    "uplinkInterface",
+    "dnsResolvers",
+    "mtu"
+  ]);
+  const unsupported = Object.keys(record).find((key) => !supported.has(key));
+  if (unsupported !== void 0) throw new TypeError(`Unsupported network option: ${unsupported}.`);
+  if (record.mode !== "routed") throw new TypeError("network.mode must be routed.");
+  if (record.prefixLength !== 30) throw new TypeError("network.prefixLength must be 30.");
+  const hostIp = ipv4(record.hostIp, "network.hostIp");
+  const guestIp = ipv4(record.guestIp, "network.guestIp");
+  const uplinkInterface = interfaceName(record.uplinkInterface);
+  const dnsResolvers = dns(record.dnsResolvers);
+  const mtu = optionalMtu(record.mtu);
+  return {
+    mode: "routed",
+    hostIp,
+    guestIp,
+    prefixLength: 30,
+    uplinkInterface,
+    ...dnsResolvers === void 0 ? {} : { dnsResolvers },
+    ...mtu === void 0 ? {} : { mtu }
+  };
+}
+function ipv4(value, name) {
+  if (typeof value !== "string") throw new TypeError(`${name} must be an IPv4 address.`);
+  const parts = value.split(".");
+  if (parts.length !== 4 || parts.some((part) => !/^(?:0|[1-9][0-9]{0,2})$/u.test(part) || Number(part) > 255)) {
+    throw new TypeError(`${name} must be an IPv4 address.`);
+  }
+  return value;
+}
+function interfaceName(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_.:-]{1,64}$/u.test(value)) {
+    throw new TypeError("network.uplinkInterface is invalid.");
+  }
+  return value;
+}
+function dns(value) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new TypeError("network.dnsResolvers must be an array.");
+  return value.map((entry) => ipv4(entry, "network.dnsResolvers"));
+}
+function optionalMtu(value) {
+  if (value === void 0) return void 0;
+  if (!Number.isInteger(value) || value < 576 || value > 9e3) {
+    throw new TypeError("network.mtu must be an integer between 576 and 9000.");
+  }
+  return value;
+}
+function isLoopbackHostname(hostname) {
+  return hostname === "127.0.0.1" || hostname === "localhost" || hostname === "[::1]";
+}
+
+// ../setsuna/src/client-request.ts
+async function requestJson(serviceUrl, defaultTimeoutMs, getAccessToken, path3, options) {
+  const requestTimeoutMs = options.requestTimeoutMs === void 0 ? defaultTimeoutMs : positiveMilliseconds(options.requestTimeoutMs, "requestTimeoutMs");
+  const timeoutSignal = AbortSignal.timeout(requestTimeoutMs);
+  const signal = options.signal === void 0 ? timeoutSignal : AbortSignal.any([options.signal, timeoutSignal]);
+  const accessToken = await requestAccessToken(
+    getAccessToken,
+    requestTimeoutMs,
+    timeoutSignal,
+    signal,
+    options.signal
+  );
+  const response = await fetchService(
+    new URL(path3, serviceUrl),
+    options,
+    requestTimeoutMs,
+    timeoutSignal,
+    signal,
+    accessToken
+  );
+  const responseBody = response.status === 204 ? void 0 : await parseResponseJson(response);
+  if (!response.ok) throw brokerResponseError(response, responseBody);
+  return responseBody;
+}
+async function requestAccessToken(getAccessToken, requestTimeoutMs, timeoutSignal, signal, callerSignal) {
+  if (getAccessToken === void 0) return void 0;
+  let token;
+  try {
+    if (signal.aborted) throw signal.reason;
+    token = await settleBeforeAbort(getAccessToken(), signal);
+  } catch (error) {
+    throwCancellationFailure(error, requestTimeoutMs, timeoutSignal, callerSignal);
+    throw error;
+  }
+  if (typeof token !== "string" || token.trim() === "") {
+    throw new TypeError("remote.getAccessToken must return a non-empty token.");
+  }
+  return token;
+}
+function settleBeforeAbort(pending, signal) {
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      signal.removeEventListener("abort", onAbort);
+      reject(signal.reason);
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    pending.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      }
+    );
+    if (signal.aborted) onAbort();
+  });
+}
+async function fetchService(url, options, requestTimeoutMs, timeoutSignal, signal, accessToken) {
+  try {
+    return await fetch(url, {
+      method: options.method,
+      headers: requestHeaders(options.body, accessToken),
+      body: options.body === void 0 ? void 0 : JSON.stringify(options.body),
+      signal
+    });
+  } catch (error) {
+    throwCancellationFailure(error, requestTimeoutMs, timeoutSignal, options.signal);
+    throw new SetsunaError("The local Setsuna service could not be reached.", {
+      code: "SERVICE_UNREACHABLE",
+      cause: error
+    });
+  }
+}
+function throwCancellationFailure(error, requestTimeoutMs, timeoutSignal, callerSignal) {
+  if (timeoutSignal.aborted && !callerSignal?.aborted) {
+    throw new SetsunaError(`The Setsuna service request exceeded ${requestTimeoutMs} ms.`, {
+      code: "REQUEST_TIMEOUT",
+      cause: error
+    });
+  }
+  if (callerSignal?.aborted) {
+    throw new SetsunaError("The Setsuna service request was aborted.", {
+      code: "REQUEST_ABORTED",
+      cause: error
+    });
+  }
+}
+function requestHeaders(body, accessToken) {
+  if (body === void 0 && accessToken === void 0) return void 0;
+  return {
+    ...body === void 0 ? {} : { "content-type": "application/json" },
+    ...accessToken === void 0 ? {} : { authorization: `Bearer ${accessToken}` }
+  };
+}
+
+// ../setsuna/src/process-request.ts
+function processPath(sandboxId) {
+  return `v1/sandboxes/${encodeURIComponent(nonEmpty(sandboxId, "sandboxId"))}/processes`;
+}
+function processResourcePath(sandboxId, processId) {
+  return `${processPath(sandboxId)}/${encodeURIComponent(nonEmpty(processId, "processId"))}`;
+}
+function appendPositiveInteger(parameters, name, value) {
+  const validated = optionalPositiveInteger(value, name);
+  if (validated !== void 0) parameters.set(name, String(validated));
+}
+function optionalPositiveInteger(value, name) {
+  if (value === void 0) return void 0;
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new TypeError(`${name} must be a positive integer.`);
+  }
+  return value;
+}
+function validateProcessSpec(spec) {
+  if (typeof spec !== "object" || spec === null || Array.isArray(spec)) {
+    throw new TypeError("spec must be an object.");
+  }
+  const unsupported = Object.keys(spec).find(
+    (key) => key !== "argv" && key !== "cwd" && key !== "env" && key !== "spoolMaxBytes" && key !== "terminal"
+  );
+  if (unsupported !== void 0)
+    throw new TypeError(`Unsupported process spec field: ${unsupported}.`);
+  if (!Array.isArray(spec.argv) || spec.argv.length === 0 || spec.argv.some((value) => typeof value !== "string" || value.length === 0)) {
+    throw new TypeError("argv must be a non-empty array of non-empty strings.");
+  }
+  if (spec.cwd !== void 0 && typeof spec.cwd !== "string") {
+    throw new TypeError("cwd must be a string.");
+  }
+  if (spec.env !== void 0 && (typeof spec.env !== "object" || spec.env === null || Array.isArray(spec.env) || Object.values(spec.env).some((value) => typeof value !== "string"))) {
+    throw new TypeError("env values must be strings.");
+  }
+  optionalPositiveInteger(spec.spoolMaxBytes, "spoolMaxBytes");
+  validateTerminal(spec.terminal);
+}
+function processResizeBody(size) {
+  terminalDimension(size.cols, "cols");
+  terminalDimension(size.rows, "rows");
+  return { cols: size.cols, rows: size.rows };
+}
+function processStdinBody(data) {
+  if (typeof data === "string") return { data };
+  if (data instanceof Uint8Array) return { dataBase64: Buffer.from(data).toString("base64") };
+  throw new TypeError("data must be a string or Uint8Array.");
+}
+function validateTerminal(terminal) {
+  if (terminal === void 0) return;
+  if (typeof terminal !== "object" || terminal === null || Array.isArray(terminal)) {
+    throw new TypeError("terminal must be an object.");
+  }
+  const unsupported = Object.keys(terminal).find(
+    (key) => key !== "cols" && key !== "rows" && key !== "term"
+  );
+  if (unsupported !== void 0) throw new TypeError(`Unsupported terminal field: ${unsupported}.`);
+  terminalDimension(terminal.cols, "terminal.cols");
+  terminalDimension(terminal.rows, "terminal.rows");
+  if (terminal.term !== void 0 && (typeof terminal.term !== "string" || terminal.term.length === 0 || terminal.term.length > 128 || terminal.term.includes("\0"))) {
+    throw new TypeError("terminal.term must be 1-128 characters without NUL bytes.");
+  }
+}
+function terminalDimension(value, name) {
+  const dimension = optionalPositiveInteger(value, name);
+  if (dimension === void 0 || dimension > 65535) {
+    throw new TypeError(`${name} must be an integer from 1 through 65535.`);
+  }
+  return dimension;
+}
+function nonEmpty(value, name) {
+  if (value.trim() === "") throw new TypeError(`${name} must not be empty.`);
+  return value;
+}
+
+// ../setsuna/src/process-response.ts
+function parseProcessHandle(value) {
+  const record = processRecord(value, "process handle");
+  if (!nonEmptyString2(record.processId) || !positiveInteger(record.pid) || !validDate(record.startedAt)) {
+    throw invalidResponse2("process handle");
+  }
+  return { processId: record.processId, pid: record.pid, startedAt: record.startedAt };
+}
+function parseProcessInfo(value) {
+  const handle = parseProcessHandle(value);
+  const record = value;
+  if (record.state !== "running" && record.state !== "exited" || !nonnegativeInteger(record.spooledBytes) || !optionalDate(record.exitedAt) || !optionalNullableInteger(record.exitCode) || !optionalNullableString(record.signal)) {
+    throw invalidResponse2("process information");
+  }
+  return {
+    ...handle,
+    state: record.state,
+    ...record.exitedAt === void 0 ? {} : { exitedAt: record.exitedAt },
+    ...record.exitCode === void 0 ? {} : { exitCode: record.exitCode },
+    ...record.signal === void 0 ? {} : { signal: record.signal },
+    spooledBytes: record.spooledBytes,
+    ...record.terminal === void 0 ? {} : { terminal: parseTerminal(record.terminal) }
+  };
+}
+function parseProcessList(value) {
+  if (!Array.isArray(value)) throw invalidResponse2("process list");
+  return value.map(parseProcessInfo);
+}
+function attachProcessStream(serviceUrl, path3, options, getAccessToken) {
+  return {
+    async *[Symbol.asyncIterator]() {
+      const response = await fetchProcessStream(
+        new URL(path3, serviceUrl),
+        options.signal,
+        getAccessToken
+      );
+      if (response.body === null) throw invalidResponse2("process stream");
+      yield* decodeFrames(response.body, options.signal);
+    }
+  };
+}
+function processFrameToJson(frame) {
+  if (frame.kind === "replay") {
+    return {
+      kind: frame.kind,
+      stream: frame.stream,
+      encoding: "base64",
+      data: frame.data.toString("base64")
+    };
+  }
+  if (frame.kind === "stdout" || frame.kind === "stderr" || frame.kind === "terminal") {
+    return { kind: frame.kind, encoding: "base64", data: frame.data.toString("base64") };
+  }
+  return frame;
+}
+async function fetchProcessStream(url, signal, getAccessToken) {
+  const accessToken = await processAccessToken(getAccessToken, signal);
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "GET",
+      signal,
+      ...accessToken === void 0 ? {} : { headers: { authorization: `Bearer ${accessToken}` } }
+    });
+  } catch (error) {
+    throw requestError(error, signal);
+  }
+  if (!response.ok) throw brokerResponseError(response, await parseResponseJson(response));
+  const contentType = response.headers.get("content-type")?.split(";", 1)[0]?.trim();
+  if (contentType !== "application/x-ndjson") throw invalidResponse2("process stream");
+  return response;
+}
+async function processAccessToken(getAccessToken, signal) {
+  if (getAccessToken === void 0) return void 0;
+  let token;
+  try {
+    if (signal?.aborted) throw signal.reason;
+    const pending = getAccessToken();
+    token = signal === void 0 ? await pending : await settleBeforeAbort2(pending, signal);
+  } catch (error) {
+    if (signal?.aborted) throw requestError(error, signal);
+    throw error;
+  }
+  if (typeof token !== "string" || token.trim() === "") {
+    throw new TypeError("remote.getAccessToken must return a non-empty token.");
+  }
+  return token;
+}
+function settleBeforeAbort2(pending, signal) {
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      signal.removeEventListener("abort", onAbort);
+      reject(signal.reason);
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    pending.then(
+      (value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(value);
+      },
+      (error) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      }
+    );
+    if (signal.aborted) onAbort();
+  });
+}
+async function* decodeFrames(body, signal) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  let pending = "";
+  let completed = false;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      pending += decoder.decode(value, { stream: !done });
+      const lines = pending.split("\n");
+      pending = lines.pop() ?? "";
+      for (const line of lines) {
+        if (line !== "") yield parseWireFrame(line);
+      }
+      if (done) {
+        completed = true;
+        break;
+      }
+    }
+    if (pending !== "") yield parseWireFrame(pending);
+  } catch (error) {
+    if (error instanceof SetsunaError) throw error;
+    throw requestError(error, signal);
+  } finally {
+    if (!completed) await reader.cancel().catch(() => void 0);
+    reader.releaseLock();
+  }
+}
+function parseWireFrame(line) {
+  let value;
+  try {
+    value = JSON.parse(line);
+  } catch (error) {
+    throw new SetsunaError("The Setsuna service returned an invalid process stream frame.", {
+      code: "INVALID_RESPONSE",
+      cause: error
+    });
+  }
+  const record = processRecord(value, "process stream frame");
+  if (record.kind === "heartbeat") return { kind: "heartbeat" };
+  if (record.kind === "exit" && nullableInteger(record.exitCode) && nullableString(record.signal)) {
+    return { kind: "exit", exitCode: record.exitCode, signal: record.signal };
+  }
+  if (record.kind !== "replay" && record.kind !== "stdout" && record.kind !== "stderr" && record.kind !== "terminal") {
+    throw invalidResponse2("process stream frame");
+  }
+  if (record.encoding !== "base64" || typeof record.data !== "string") {
+    throw invalidResponse2("process stream frame");
+  }
+  const data = decodeBase64(record.data);
+  if (record.kind === "replay") {
+    if (record.stream !== "stdout" && record.stream !== "stderr" && record.stream !== "terminal")
+      throw invalidResponse2("process stream frame");
+    return { kind: "replay", stream: record.stream, data };
+  }
+  return { kind: record.kind, data };
+}
+function parseTerminal(value) {
+  const terminal = processRecord(value, "terminal process information");
+  if (!positiveInteger(terminal.cols) || terminal.cols > 65535 || !positiveInteger(terminal.rows) || terminal.rows > 65535 || !nonEmptyString2(terminal.term) || terminal.term.length > 128 || terminal.term.includes("\0")) {
+    throw invalidResponse2("terminal process information");
+  }
+  return { cols: terminal.cols, rows: terminal.rows, term: terminal.term };
+}
+function decodeBase64(value) {
+  const data = Buffer.from(value, "base64");
+  if (data.toString("base64") !== value) throw invalidResponse2("process stream frame");
+  return data;
+}
+function requestError(error, signal) {
+  if (signal?.aborted) {
+    return new SetsunaError("The process attachment was detached.", {
+      code: "REQUEST_ABORTED",
+      cause: error
+    });
+  }
+  return new SetsunaError("The process attachment stream was interrupted.", {
+    code: "SERVICE_UNREACHABLE",
+    cause: error
+  });
+}
+function processRecord(value, subject) {
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    throw invalidResponse2(subject);
+  return value;
+}
+function nonEmptyString2(value) {
+  return typeof value === "string" && value !== "";
+}
+function positiveInteger(value) {
+  return Number.isSafeInteger(value) && value > 0;
+}
+function nonnegativeInteger(value) {
+  return Number.isSafeInteger(value) && value >= 0;
+}
+function validDate(value) {
+  return typeof value === "string" && !Number.isNaN(Date.parse(value));
+}
+function optionalDate(value) {
+  return value === void 0 || validDate(value);
+}
+function nullableInteger(value) {
+  return value === null || Number.isSafeInteger(value);
+}
+function optionalNullableInteger(value) {
+  return value === void 0 || nullableInteger(value);
+}
+function nullableString(value) {
+  return value === null || typeof value === "string";
+}
+function optionalNullableString(value) {
+  return value === void 0 || nullableString(value);
+}
+function invalidResponse2(subject) {
+  return new SetsunaError(`The Setsuna service returned an invalid ${subject}.`, {
+    code: "INVALID_RESPONSE"
+  });
+}
+
+// ../setsuna/src/run-support.ts
+function reportRunPhase(callback, phase) {
+  try {
+    callback?.(phase);
+  } catch {
+  }
+}
+
+// ../setsuna/src/client.ts
+var DEFAULT_REQUEST_TIMEOUT_MS = 6e4;
+var DEFAULT_CLEANUP_TIMEOUT_MS = 1e4;
+var SetsunaClient = class {
+  #serviceUrl;
+  #requestTimeoutMs;
+  #getAccessToken;
+  constructor(options = {}) {
+    if (options.serviceUrl !== void 0 && options.remote !== void 0) {
+      throw new TypeError("serviceUrl and remote are mutually exclusive.");
+    }
+    if (options.remote === void 0) {
+      this.#serviceUrl = normalizeServiceUrl(options.serviceUrl ?? "http://127.0.0.1:8787");
+      this.#getAccessToken = void 0;
+    } else {
+      if (typeof options.remote.getAccessToken !== "function") {
+        throw new TypeError("remote.getAccessToken must be a function.");
+      }
+      this.#serviceUrl = new URL(PREVIEW_SERVICE_URL);
+      this.#getAccessToken = options.remote.getAccessToken;
+    }
+    this.#requestTimeoutMs = positiveMilliseconds(
+      options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS,
+      "requestTimeoutMs"
+    );
+  }
+  async health() {
+    return parseHealth(await this.#request("health", { method: "GET" }));
+  }
+  async microvmConfigurations() {
+    return parseMicrovmConfigurationCatalog(
+      await this.#request("v1/microvm-configurations", { method: "GET" })
+    );
+  }
+  async create(options = {}) {
+    const createOptions = normalizeCreateOptions(options);
+    const response = await this.#request("v1/sandboxes", {
+      method: "POST",
+      body: { ...createOptions }
+    });
+    const sandboxId = parseLeaseSandboxId(response);
+    try {
+      return parseLease(response, createOptions.microvmConfigurationId);
+    } catch (error) {
+      try {
+        await this.#destroy(sandboxId, DEFAULT_CLEANUP_TIMEOUT_MS);
+      } catch (cleanupFailure) {
+        throw new AggregateError(
+          [error, cleanupFailure],
+          "Sandbox lease validation and destruction both failed."
+        );
+      }
+      throw error;
+    }
+  }
+  async list() {
+    return parseSandboxList(await this.#request("v1/sandboxes", { method: "GET" }));
+  }
+  async status(sandboxId) {
+    const validatedSandboxId = nonEmptyString(sandboxId, "sandboxId");
+    return parseSandboxStatus(
+      await this.#request(`v1/sandboxes/${encodeURIComponent(validatedSandboxId)}`, {
+        method: "GET"
+      })
+    );
+  }
+  async renew(sandboxId) {
+    const validatedSandboxId = nonEmptyString(sandboxId, "sandboxId");
+    return parseSandboxStatus(
+      await this.#request(`v1/sandboxes/${encodeURIComponent(validatedSandboxId)}/renew`, {
+        method: "POST"
+      })
+    );
+  }
+  async execute(sandboxId, command, options = {}) {
+    const validatedSandboxId = nonEmptyString(sandboxId, "sandboxId");
+    const validatedCommand = nonEmptyString(command, "command");
+    const timeoutMs = options.timeoutMs === void 0 ? void 0 : positiveMilliseconds(options.timeoutMs, "timeoutMs");
+    return parseExecutionResult(
+      await this.#request(`v1/sandboxes/${encodeURIComponent(validatedSandboxId)}/execute`, {
+        method: "POST",
+        body: {
+          command: validatedCommand,
+          ...timeoutMs === void 0 ? {} : { timeoutMs }
+        },
+        signal: options.signal,
+        requestTimeoutMs: options.requestTimeoutMs
+      })
+    );
+  }
+  async destroy(sandboxId) {
+    await this.#destroy(sandboxId, this.#requestTimeoutMs);
+  }
+  async spawnProcess(sandboxId, spec) {
+    const path3 = processPath(sandboxId);
+    validateProcessSpec(spec);
+    return parseProcessHandle(await this.#request(path3, { method: "POST", body: { ...spec } }));
+  }
+  async listProcesses(sandboxId) {
+    return parseProcessList(await this.#request(processPath(sandboxId), { method: "GET" }));
+  }
+  attachProcess(sandboxId, processId, options = {}) {
+    const parameters = new URLSearchParams();
+    appendPositiveInteger(parameters, "maxStreamBytes", options.maxStreamBytes);
+    appendPositiveInteger(parameters, "idleTimeoutMs", options.idleTimeoutMs);
+    const query = parameters.size === 0 ? "" : `?${parameters.toString()}`;
+    return attachProcessStream(
+      this.#serviceUrl,
+      `${processPath(sandboxId)}/${encodeURIComponent(nonEmptyString(processId, "processId"))}/attach${query}`,
+      options,
+      this.#getAccessToken
+    );
+  }
+  async writeProcessStdin(sandboxId, processId, data) {
+    await this.#request(`${processResourcePath(sandboxId, processId)}/stdin`, {
+      method: "POST",
+      body: processStdinBody(data)
+    });
+  }
+  async resizeProcess(sandboxId, processId, size) {
+    await this.#request(`${processResourcePath(sandboxId, processId)}/resize`, {
+      method: "POST",
+      body: processResizeBody(size)
+    });
+  }
+  async terminateProcess(sandboxId, processId, options = {}) {
+    const graceMs = optionalPositiveInteger(options.graceMs, "graceMs");
+    const requestTimeoutMs = optionalPositiveInteger(options.requestTimeoutMs, "requestTimeoutMs");
+    return parseProcessInfo(
+      await this.#request(`${processResourcePath(sandboxId, processId)}/terminate`, {
+        method: "POST",
+        body: {
+          ...graceMs === void 0 ? {} : { graceMs },
+          ...requestTimeoutMs === void 0 ? {} : { requestTimeoutMs }
+        },
+        requestTimeoutMs
+      })
+    );
+  }
+  async #destroy(sandboxId, requestTimeoutMs) {
+    const validatedSandboxId = nonEmptyString(sandboxId, "sandboxId");
+    await this.#request(`v1/sandboxes/${encodeURIComponent(validatedSandboxId)}`, {
+      method: "DELETE",
+      requestTimeoutMs
+    });
+  }
+  async run(command, options = {}) {
+    let sandboxId;
+    const cleanupTimeoutMs = positiveMilliseconds(
+      options.cleanupTimeoutMs ?? DEFAULT_CLEANUP_TIMEOUT_MS,
+      "cleanupTimeoutMs"
+    );
+    let executionOutcome;
+    try {
+      reportRunPhase(options.onPhase, "starting-microvm");
+      const lease = await this.create({
+        ...options.microvmConfigurationId === void 0 ? {} : { microvmConfigurationId: options.microvmConfigurationId },
+        ...options.network === void 0 ? {} : { network: options.network }
+      });
+      sandboxId = lease.sandboxId;
+      reportRunPhase(options.onPhase, "microvm-ready");
+      reportRunPhase(options.onPhase, "running-command");
+      executionOutcome = { ok: true, result: await this.execute(sandboxId, command, options) };
+    } catch (error) {
+      executionOutcome = { ok: false, error };
+    }
+    if (sandboxId !== void 0) {
+      try {
+        reportRunPhase(options.onPhase, "destroying-microvm");
+        await this.#destroy(sandboxId, cleanupTimeoutMs);
+        reportRunPhase(options.onPhase, "microvm-destroyed");
+      } catch (cleanupFailure) {
+        if (!executionOutcome.ok) {
+          throw new AggregateError(
+            [executionOutcome.error, cleanupFailure],
+            "Sandbox execution and destruction both failed."
+          );
+        }
+        throw cleanupFailure;
+      }
+    }
+    if (!executionOutcome.ok) {
+      throw executionOutcome.error;
+    }
+    return executionOutcome.result;
+  }
+  async #request(path3, options) {
+    return requestJson(
+      this.#serviceUrl,
+      this.#requestTimeoutMs,
+      this.#getAccessToken,
+      path3,
+      options
+    );
+  }
+};
+
+// ../setsuna/src/cli-execution.ts
+import { spawn } from "child_process";
+async function runHealth(client, output, json) {
+  const health = await client.health();
+  if (json) output.write(`${JSON.stringify(health)}
+`);
+  else output.write(`Setsuna service is healthy (${health.startupPhase}).
+`);
+}
+async function runWithSignalCleanup(client, command, options, io, signalRuntime) {
+  const controller = new AbortController();
+  let interruptedExitCode;
+  const handleSignal = (signal) => {
+    const exitCode = signal === "SIGINT" ? 130 : 143;
+    if (interruptedExitCode === void 0) {
+      interruptedExitCode = exitCode;
+      io.errorOutput.write("Interrupt received; destroying sandbox...\n");
+      controller.abort();
+      return;
+    }
+    signalRuntime.forceExit(exitCode);
+  };
+  const handleSigint = () => handleSignal("SIGINT");
+  const handleSigterm = () => handleSignal("SIGTERM");
+  signalRuntime.on("SIGINT", handleSigint);
+  signalRuntime.on("SIGTERM", handleSigterm);
+  try {
+    const result = await client.run(command, { ...options, signal: controller.signal });
+    if (interruptedExitCode !== void 0) {
+      process.exitCode = interruptedExitCode;
+      return void 0;
+    }
+    return result;
+  } catch (error) {
+    if (interruptedExitCode === void 0) throw error;
+    process.exitCode = interruptedExitCode;
+    if (!(error instanceof SetsunaError && error.code === "REQUEST_ABORTED")) {
+      io.errorOutput.write(`${formatCliError(error)}
+`);
+    }
+    return void 0;
+  } finally {
+    signalRuntime.off("SIGINT", handleSigint);
+    signalRuntime.off("SIGTERM", handleSigterm);
+  }
+}
+function writeExecutionResult(result, json, output = process.stdout, errorOutput = process.stderr, updateProcessExitCode = true) {
+  if (json) {
+    output.write(`${JSON.stringify(result)}
+`);
+  } else {
+    output.write(result.stdout);
+    errorOutput.write(result.stderr);
+  }
+  if (updateProcessExitCode) {
+    if (result.timedOut) process.exitCode = 124;
+    else if (result.exitCode !== null) process.exitCode = result.exitCode;
+    else if (result.signal !== null) process.exitCode = 1;
+  }
+}
+function guestExitStatus(result) {
+  if (result.timedOut) return "124 (timed out)";
+  if (result.exitCode !== null) return String(result.exitCode);
+  if (result.signal !== null) return `signal ${result.signal}`;
+  return "unknown";
+}
+function formatCliError(error) {
+  if (error instanceof AggregateError) {
+    const details = error.errors.map(
+      (nested) => formatCliError(nested).replace(/^setsuna: /u, "  ")
+    );
+    return [`setsuna: ${error.message}`, ...details].join("\n");
+  }
+  if (error instanceof SetsunaError) return `setsuna: ${error.code}: ${error.message}`;
+  if (error instanceof Error) return `setsuna: ${error.message}`;
+  return "setsuna: An unknown error occurred.";
+}
+
+// ../setsuna/src/cli-shell.ts
+import { once } from "events";
+
+// ../setsuna/src/cli-shell-terminal.ts
+function createLocalShellTerminal(io) {
+  const input = io.input;
+  const output = io.output;
+  return {
+    isInteractive: () => input.isTTY === true && output.isTTY === true && typeof input.setRawMode === "function",
+    size: () => terminalSize(output),
+    term: () => process.env.TERM,
+    enterRawMode: () => enterRawMode(input),
+    onResize(listener) {
+      process.on("SIGWINCH", listener);
+    },
+    offResize(listener) {
+      process.off("SIGWINCH", listener);
+    },
+    setExitCode(exitCode) {
+      process.exitCode = exitCode;
+    }
+  };
+}
+function terminalSize(output) {
+  if (!terminalDimension2(output.columns) || !terminalDimension2(output.rows)) {
+    throw new TypeError("setsuna shell could not determine the local terminal size.");
+  }
+  return { cols: output.columns, rows: output.rows };
+}
+function terminalDimension2(value) {
+  return Number.isInteger(value) && value > 0 && value <= 65535;
+}
+function enterRawMode(input) {
+  if (typeof input.setRawMode !== "function") {
+    throw new TypeError("setsuna shell requires raw-mode support on local stdin.");
+  }
+  const wasRaw = input.isRaw === true;
+  const wasPaused = input.isPaused();
+  input.setRawMode(true);
+  input.resume();
+  let restored = false;
+  return () => {
+    if (restored) return;
+    restored = true;
+    input.setRawMode?.(wasRaw);
+    if (wasPaused) input.pause();
+  };
+}
+
+// ../setsuna/src/lease-keeper.ts
+var MAX_TIMER_DELAY_MS = 2147483647;
+var SYSTEM_RUNTIME = {
+  now: Date.now,
+  setTimeout: (callback, delayMs) => setTimeout(callback, delayMs),
+  clearTimeout: (handle) => clearTimeout(handle)
+};
+var ActiveLeaseKeeper = class {
+  #client;
+  #sandboxId;
+  #runtime;
+  #expiresAtMs;
+  #failureHandler;
+  #running = false;
+  #timer;
+  constructor(client, sandboxId, runtime = SYSTEM_RUNTIME) {
+    this.#client = client;
+    this.#sandboxId = sandboxId;
+    this.#runtime = runtime;
+  }
+  async renewNow() {
+    if (this.#running) throw new TypeError("Cannot prime a running lease keeper.");
+    this.#expiresAtMs = await this.#renewExpiry();
+  }
+  start(onFailure) {
+    if (this.#running) throw new TypeError("The lease keeper is already running.");
+    if (this.#expiresAtMs === void 0) {
+      throw new TypeError("The lease keeper must renew the sandbox before it starts.");
+    }
+    this.#running = true;
+    this.#failureHandler = onFailure;
+    try {
+      this.#schedule(this.#expiresAtMs);
+    } catch (error) {
+      this.#running = false;
+      this.#failureHandler = void 0;
+      throw error;
+    }
+  }
+  stop() {
+    this.#running = false;
+    this.#failureHandler = void 0;
+    if (this.#timer !== void 0) this.#runtime.clearTimeout(this.#timer);
+    this.#timer = void 0;
+  }
+  async #renewExpiry() {
+    const { expiresAt } = await this.#client.renew(this.#sandboxId);
+    const expiresAtMs = Date.parse(expiresAt);
+    if (!Number.isFinite(expiresAtMs) || expiresAtMs <= this.#runtime.now()) {
+      throw new TypeError("Sandbox renewal returned an invalid or expired expiresAt value.");
+    }
+    return expiresAtMs;
+  }
+  #schedule(expiresAtMs) {
+    const remainingMs = expiresAtMs - this.#runtime.now();
+    if (!Number.isFinite(remainingMs) || remainingMs <= 0) {
+      throw new TypeError(
+        "The renewed sandbox lease expired before its next renewal was scheduled."
+      );
+    }
+    const delayMs = Math.min(MAX_TIMER_DELAY_MS, Math.max(1, Math.floor(remainingMs / 2)));
+    this.#timer = this.#runtime.setTimeout(() => {
+      this.#timer = void 0;
+      void this.#renewAndSchedule().catch((error) => this.#fail(error));
+    }, delayMs);
+  }
+  async #renewAndSchedule() {
+    const expiresAtMs = await this.#renewExpiry();
+    if (!this.#running) return;
+    this.#expiresAtMs = expiresAtMs;
+    this.#schedule(expiresAtMs);
+  }
+  #fail(error) {
+    if (!this.#running) return;
+    this.#running = false;
+    const handler = this.#failureHandler;
+    this.#failureHandler = void 0;
+    try {
+      handler?.(error);
+    } catch {
+    }
+  }
+};
+
+// ../setsuna/src/cli-shell.ts
+var DETACH_BYTE = 29;
+var DEFAULT_TERM = "xterm-256color";
+async function runShellCliCommand(commandName, commandArguments, attachProcessId, json, client, io, terminal) {
+  if (commandName !== "shell") {
+    if (attachProcessId !== void 0) {
+      throw new TypeError("--attach is supported only by setsuna shell.");
+    }
+    return false;
+  }
+  if (json) throw new TypeError("setsuna shell does not support --json.");
+  await runShellCommand(
+    commandArguments,
+    attachProcessId,
+    client,
+    io,
+    terminal ?? createLocalShellTerminal(io)
+  );
+  return true;
+}
+async function runShellCommand(commandArguments, attachProcessId, client, io, terminal, leaseRuntime) {
+  if (commandArguments.length !== 1 || commandArguments[0] === "") {
+    throw new TypeError("setsuna shell requires exactly one sandbox ID.");
+  }
+  if (!terminal.isInteractive()) {
+    throw new TypeError("setsuna shell requires an interactive local TTY on stdin and stdout.");
+  }
+  if (attachProcessId === "") throw new TypeError("--attach requires a process ID.");
+  const sandboxId = commandArguments[0];
+  const leaseKeeper = new ActiveLeaseKeeper(client, sandboxId, leaseRuntime);
+  await leaseKeeper.renewNow();
+  try {
+    const size = terminal.size();
+    const processId = await resolveProcess(
+      client,
+      sandboxId,
+      attachProcessId,
+      size,
+      terminal.term()
+    );
+    await attachTerminal(client, sandboxId, processId, io, terminal, leaseKeeper);
+  } finally {
+    leaseKeeper.stop();
+  }
+}
+async function resolveProcess(client, sandboxId, attachProcessId, size, localTerm) {
+  if (attachProcessId === void 0) {
+    const handle = await client.spawnProcess(sandboxId, {
+      argv: ["/bin/bash"],
+      cwd: "/workspace",
+      terminal: { ...size, term: validTerm(localTerm) ? localTerm : DEFAULT_TERM }
+    });
+    return handle.processId;
+  }
+  const process2 = (await client.listProcesses(sandboxId)).find(
+    (entry) => entry.processId === attachProcessId
+  );
+  if (process2 === void 0) {
+    throw new TypeError(`Process '${attachProcessId}' was not found in sandbox '${sandboxId}'.`);
+  }
+  if (process2.terminal === void 0) {
+    throw new TypeError(`Process '${attachProcessId}' is not terminal-backed.`);
+  }
+  if (process2.state === "running") await client.resizeProcess(sandboxId, attachProcessId, size);
+  return attachProcessId;
+}
+async function attachTerminal(client, sandboxId, processId, io, terminal, leaseKeeper) {
+  const controller = new AbortController();
+  const session = createAttachedSession(
+    client,
+    sandboxId,
+    processId,
+    io,
+    terminal,
+    controller,
+    () => leaseKeeper.stop()
+  );
+  let exitFrame;
+  let attachError;
+  try {
+    leaseKeeper.start(session.fail);
+    for await (const frame of client.attachProcess(sandboxId, processId, {
+      maxStreamBytes: Number.MAX_SAFE_INTEGER,
+      signal: controller.signal
+    })) {
+      if (frame.kind === "exit") exitFrame = frame;
+      else await writeTerminalFrame(frame, io);
+    }
+  } catch (error) {
+    attachError = error;
+  } finally {
+    session.cleanup();
+  }
+  await session.settle();
+  if (session.failure !== void 0) throw session.failure;
+  if (session.detached) {
+    if (attachError !== void 0 && !isDetachAbort(attachError)) throw attachError;
+    return;
+  }
+  if (attachError !== void 0) throw attachError;
+  if (exitFrame === void 0) {
+    throw new SetsunaError("The terminal attachment ended without a process exit frame.", {
+      code: "SERVICE_UNREACHABLE"
+    });
+  }
+  if (exitFrame.exitCode !== null) terminal.setExitCode(exitFrame.exitCode);
+}
+function createAttachedSession(client, sandboxId, processId, io, terminal, controller, stopLeaseKeeper) {
+  let detached = false;
+  let failure;
+  let cleaned = false;
+  let inputQueue = Promise.resolve();
+  let resizeQueue = Promise.resolve();
+  const restoreRawMode = terminal.enterRawMode();
+  const cleanup = () => {
+    if (cleaned) return;
+    cleaned = true;
+    io.input.off("data", onInput);
+    terminal.offResize(onResize);
+    stopLeaseKeeper();
+    restoreRawMode();
+  };
+  const fail = (error) => {
+    if (failure === void 0) failure = error;
+    cleanup();
+    controller.abort();
+  };
+  const onInput = (chunk) => {
+    if (!(chunk instanceof Uint8Array)) {
+      fail(new TypeError("setsuna shell received non-binary data from local stdin."));
+      return;
+    }
+    const data = Buffer.from(chunk);
+    const detachAt = data.indexOf(DETACH_BYTE);
+    const forwarded = detachAt < 0 ? data : data.subarray(0, detachAt);
+    if (forwarded.byteLength > 0) {
+      inputQueue = inputQueue.then(() => client.writeProcessStdin(sandboxId, processId, forwarded));
+      void inputQueue.catch(fail);
+    }
+    if (detachAt >= 0 && !detached) {
+      detached = true;
+      cleanup();
+      controller.abort();
+      writeDetachMessage(io, sandboxId, processId);
+    }
+  };
+  const onResize = () => {
+    resizeQueue = queueResize(resizeQueue, client, sandboxId, processId, terminal, fail);
+  };
+  try {
+    io.input.on("data", onInput);
+    terminal.onResize(onResize);
+  } catch (error) {
+    cleanup();
+    throw error;
+  }
+  return {
+    cleanup,
+    fail,
+    get detached() {
+      return detached;
+    },
+    get failure() {
+      return failure;
+    },
+    async settle() {
+      await Promise.allSettled([inputQueue, resizeQueue]);
+    }
+  };
+}
+function queueResize(queue, client, sandboxId, processId, terminal, fail) {
+  try {
+    const size = terminal.size();
+    const next = queue.then(() => client.resizeProcess(sandboxId, processId, size));
+    void next.catch(fail);
+    return next;
+  } catch (error) {
+    fail(error);
+    return queue;
+  }
+}
+function writeDetachMessage(io, sandboxId, processId) {
+  io.errorOutput.write(
+    `Detached from sandbox ${sandboxId}, process ${processId}; both remain active.
+Reattach with: setsuna shell ${sandboxId} --attach ${processId}
+`
+  );
+}
+async function writeTerminalFrame(frame, io) {
+  if (frame.kind === "heartbeat") return;
+  const data = frame.kind === "terminal" || frame.kind === "replay" && frame.stream === "terminal" ? frame.data : void 0;
+  if (data === void 0) {
+    throw new SetsunaError("A terminal attachment received a non-terminal process stream.", {
+      code: "INVALID_RESPONSE"
+    });
+  }
+  if (!io.output.write(data)) await once(io.output, "drain");
+}
+function validTerm(value) {
+  return value !== void 0 && /^[A-Za-z0-9][A-Za-z0-9+._-]{0,127}$/u.test(value);
+}
+function isDetachAbort(error) {
+  return error instanceof SetsunaError && error.code === "REQUEST_ABORTED";
+}
+
+// ../setsuna/src/cli-interactive-persistent-actions.ts
+function createPersistentInteractiveActions(client, io, shellTerminal) {
+  return {
+    async startMicrovm(microvmConfigurationId) {
+      const lease = await client.create({ microvmConfigurationId });
+      return {
+        sandboxId: lease.sandboxId,
+        expiresAt: lease.expiresAt,
+        vcpuCount: lease.microvmConfiguration.vcpuCount,
+        memoryMiB: lease.microvmConfiguration.memoryMiB
+      };
+    },
+    activeMicrovms: () => client.list(),
+    openTerminal: (sandboxId, processId) => runShellCommand(
+      [sandboxId],
+      processId,
+      client,
+      io,
+      shellTerminal ?? createLocalShellTerminal(io)
+    ),
+    async terminalProcesses(sandboxId) {
+      return (await client.listProcesses(sandboxId)).filter((process2) => process2.state === "running" && process2.terminal !== void 0).map(({ processId, pid }) => ({ processId, pid }));
+    },
+    async runPersistentCommand(sandboxId, command, timeoutMs) {
+      await client.renew(sandboxId);
+      const result = await client.execute(sandboxId, command, {
+        ...timeoutMs === void 0 ? {} : { timeoutMs }
+      });
+      return interactiveRunResult(result);
+    },
+    renewMicrovm: (sandboxId) => client.renew(sandboxId),
+    destroyMicrovm: (sandboxId) => client.destroy(sandboxId)
+  };
+}
+function interactiveRunResult(result) {
+  return {
+    exitStatus: guestExitStatus(result),
+    durationMs: result.durationMs,
+    timedOut: result.timedOut,
+    outputTruncated: result.outputTruncated,
+    omittedOutputBytes: result.omittedOutputBytes,
+    stdout: result.stdout,
+    stderr: result.stderr
+  };
+}
+
+// ../setsuna/src/cli-interactive-sandbox-actions.ts
+function createSandboxInteractiveActions(client, io, signalRuntime, shellTerminal) {
+  return {
+    async runCommand(command, options) {
+      const result = await runWithSignalCleanup(client, command, options, io, signalRuntime);
+      return result === void 0 ? null : interactiveRunResult(result);
+    },
+    async microvmConfigurations() {
+      const catalog = await client.microvmConfigurations();
+      return {
+        maxConcurrentMicrovms: catalog.maxConcurrentMicrovms,
+        configurations: catalog.configurations.map((configuration) => ({
+          id: configuration.id,
+          isDefault: configuration.id === catalog.defaultConfigurationId,
+          vcpuCount: configuration.vcpuCount,
+          memoryMiB: configuration.memoryMiB
+        }))
+      };
+    },
+    ...createPersistentInteractiveActions(client, io, shellTerminal)
+  };
+}
+
+// ../setsuna/src/cli-io.ts
+var DEFAULT_IO = {
+  input: process.stdin,
+  output: process.stdout,
+  errorOutput: process.stderr
+};
+var DEFAULT_SIGNAL_RUNTIME = {
+  on(signal, listener) {
+    process.on(signal, listener);
+  },
+  off(signal, listener) {
+    process.off(signal, listener);
+  },
+  forceExit(exitCode) {
+    process.exit(exitCode);
+  }
+};
+
+// ../setsuna/src/tui/customer/format.ts
+var STANDALONE_BOX = { withGuide: false, width: "auto" };
+function formatRunPhase(phase) {
+  switch (phase) {
+    case "starting-microvm":
+      return "Starting microVM";
+    case "microvm-ready":
+      return "microVM ready";
+    case "running-command":
+      return "Running command";
+    case "destroying-microvm":
+      return "Cleaning up";
+    case "microvm-destroyed":
+      return "microVM destroyed";
+  }
+}
+function formatRunResult(result) {
+  const facts = [`Exit status ${result.exitStatus}`, `${result.durationMs} ms`];
+  if (result.outputTruncated) {
+    facts.push(`Output truncated (${result.omittedOutputBytes} bytes omitted)`);
+  }
+  return facts.join(" \xB7 ");
+}
+function formatTimeoutHint(timeoutMs) {
+  return timeoutMs === void 0 ? "No timeout" : `Timeout ${formatSeconds(timeoutMs)} seconds`;
+}
+function formatSeconds(timeoutMs) {
+  return String(timeoutMs / 1e3);
+}
+function formatGib(memoryMiB) {
+  return Number.isInteger(memoryMiB / 1024) ? String(memoryMiB / 1024) : (memoryMiB / 1024).toFixed(2);
+}
+function formatMicrovmShape(vcpuCount, memoryMiB) {
+  return `${vcpuCount} vCPU \xB7 ${formatMemory(memoryMiB)}`;
+}
+function formatMicrovmConfigurationHint(configuration) {
+  return configuration.isDefault ? "Default" : void 0;
+}
+function formatMicrovmConfigurationIdentifier(configuration) {
+  return configuration.isDefault ? `${configuration.id} (default)` : configuration.id;
+}
+function formatMemory(memoryMiB) {
+  return memoryMiB < 1024 ? `${memoryMiB} MiB` : `${formatGib(memoryMiB)} GiB`;
+}
+function formatExpiry(expiresAt, now) {
+  const remaining = remainingTime(expiresAt, now);
+  return remaining === void 0 ? "Expired" : `Expires in ${remaining}`;
+}
+function formatMicrovmState(microvm, now) {
+  const lines = [`ID          ${microvm.sandboxId}`];
+  if (microvm.vcpuCount !== void 0 && microvm.memoryMiB !== void 0) {
+    lines.push(`Compute     ${formatMicrovmShape(microvm.vcpuCount, microvm.memoryMiB)}`);
+  }
+  const remaining = remainingTime(microvm.expiresAt, now);
+  lines.push(remaining === void 0 ? "Expired" : `Expires in  ${remaining}`);
+  return lines.join("\n");
+}
+function remainingTime(expiresAt, now) {
+  const seconds = Math.floor((Date.parse(expiresAt) - now) / 1e3);
+  if (Number.isNaN(seconds) || seconds <= 0) return void 0;
+  const minutes = Math.floor(seconds / 60);
+  const rest = seconds % 60;
+  return minutes === 0 ? `${rest}s` : `${minutes}m ${String(rest).padStart(2, "0")}s`;
+}
+function requiredText4(message) {
+  return (value) => value.trim() === "" ? message : void 0;
+}
+function optionalPositiveNumber(message) {
+  return (value) => {
+    if (value.trim() === "") return void 0;
+    const number = Number(value);
+    return Number.isFinite(number) && number > 0 ? void 0 : message;
+  };
+}
+function formatTuiError(error) {
+  const message = error instanceof AggregateError ? [error.message, ...error.errors.map(formatTuiErrorCause)].join("\n") : error instanceof Error ? error.message : String(error);
+  return formatTuiText(message);
+}
+function formatTuiErrorCause(error) {
+  if (!(error instanceof Error)) return String(error);
+  const code = "code" in error && typeof error.code === "string" ? `${error.code}: ` : "";
+  return `${code}${error.message}`;
+}
+function formatTuiText(message) {
+  return message.replace(/broker/giu, "Setsuna service").replace(/guest/giu, "microVM");
+}
+function formatSignInStatus(status) {
+  return status.authenticated ? "Signed in" : "Not signed in";
+}
+function formatAccountStatus(status) {
+  const lines = [`Status     ${formatSignInStatus(status)}`];
+  if (status.expiresAt !== null) {
+    const end = new Date(status.expiresAt * 1e3).toISOString();
+    lines.push(`Session    ${status.authenticated ? "Active until" : "Expired"} ${end}`);
+  }
+  return lines.join("\n");
+}
+function formatDeviceAuthorization(authorization) {
+  return [`Open    ${authorization.verificationUrl}`, `Code    ${authorization.userCode}`].join(
+    "\n"
+  );
+}
+
+// ../setsuna/src/tui/customer/configuration-menu.ts
+init_prompt();
+async function promptForMicrovmConfiguration(io, promptUi, configurations, selection = {}) {
+  const extraOptions = selection.extraOptions ?? [];
+  const defaultIndex = Math.max(
+    0,
+    configurations.findIndex(({ isDefault }) => isDefault)
+  );
+  const selected = await promptUi.select(
+    {
+      message: "MicroVM configuration",
+      options: [
+        ...configurations.map(
+          (configuration, index) => configurationOption(configuration, index, selection.withIdentifiers === true)
+        ),
+        ...extraOptions,
+        { value: "back", label: "Back" }
+      ],
+      initialValue: configurations.length === 0 ? extraOptions[0]?.value ?? "back" : `configuration:${defaultIndex}`
+    },
+    io
+  );
+  if (selected === TUI_CANCEL || selected === "back") return null;
+  const extra = extraOptions.find(({ value }) => value === selected);
+  if (extra !== void 0) return extra.value;
+  return configurations[Number(selected.slice("configuration:".length))] ?? null;
+}
+function configurationOption(configuration, index, withIdentifiers) {
+  const hint = withIdentifiers ? formatMicrovmConfigurationIdentifier(configuration) : formatMicrovmConfigurationHint(configuration);
+  return {
+    value: `configuration:${index}`,
+    label: formatMicrovmShape(configuration.vcpuCount, configuration.memoryMiB),
+    ...hint === void 0 ? {} : { hint }
+  };
+}
+
+// ../setsuna/src/tui/customer/account-menu.ts
+init_prompt();
+
+// ../setsuna/src/tui/customer/session.ts
+function shellPrompt(session) {
+  return session.signal === void 0 ? {} : { signal: AbortSignal.any([session.signal]) };
+}
+
+// ../setsuna/src/tui/customer/account-menu.ts
+async function ensureSignedIn(io, auth, promptUi, session = {}) {
+  let status = await checkSignIn(io, auth, promptUi);
+  while (status?.authenticated !== true) {
+    const choice = await promptUi.select(
+      {
+        message: "Sign in to continue",
+        options: [
+          { value: "sign-in", label: "Sign in", hint: "Approve this device in your browser" },
+          { value: "exit", label: "Exit" }
+        ],
+        initialValue: "sign-in",
+        ...shellPrompt(session)
+      },
+      io
+    );
+    if (choice === TUI_CANCEL) {
+      promptUi.cancel("Exited.", io);
+      return false;
+    }
+    if (choice === "exit") {
+      promptUi.outro("Ready when you are.", io);
+      return false;
+    }
+    status = await signIn(io, auth, promptUi);
+  }
+  return true;
+}
+async function checkSignIn(io, auth, promptUi) {
+  const spinner = promptUi.spinner(io);
+  spinner.start("Checking sign-in");
+  try {
+    const status = await auth.status();
+    spinner.stop(formatSignInStatus(status));
+    return status;
+  } catch (error) {
+    spinner.error(formatTuiError(error));
+    return void 0;
+  }
+}
+async function signIn(io, auth, promptUi) {
+  const controller = new AbortController();
+  const spinner = promptUi.spinner(io, {
+    indicator: "timer",
+    onCancel: () => controller.abort()
+  });
+  let waiting = false;
+  try {
+    const status = await auth.login((authorization) => {
+      promptUi.box(formatDeviceAuthorization(authorization), "Sign in", io, STANDALONE_BOX);
+      spinner.start("Waiting for approval");
+      waiting = true;
+    }, controller.signal);
+    spinner.stop("Signed in");
+    return status;
+  } catch (error) {
+    if (controller.signal.aborted) return void 0;
+    if (waiting) spinner.error(formatTuiError(error));
+    else promptUi.error(formatTuiError(error), io);
+    return void 0;
+  }
+}
+async function accountMenu(io, auth, promptUi, session = {}) {
+  promptUi.box(formatAccountStatus(await auth.status()), "Account", io, STANDALONE_BOX);
+  const choice = await promptUi.select(
+    {
+      message: "Account",
+      options: [
+        { value: "logout", label: "Log out", hint: "Remove the saved sign-in from this device" },
+        { value: "back", label: "Back" }
+      ],
+      initialValue: "back",
+      ...shellPrompt(session)
+    },
+    io
+  );
+  if (choice === TUI_CANCEL || choice === "back") return "back";
+  const result = await auth.logout();
+  promptUi.success("Logged out.", io);
+  if (result.remoteRevocation === "unconfirmed") {
+    promptUi.warn("Local session cleared; remote revocation could not be confirmed.", io);
+  }
+  return "signed-out";
+}
+
+// ../setsuna/src/tui/customer/persistent-menu.ts
+init_prompt();
+
+// ../setsuna/src/tui/customer/run-menu.ts
+init_prompt();
+async function runCommandMenu(io, actions, promptUi) {
+  let configurations;
+  try {
+    configurations = (await actions.microvmConfigurations()).configurations;
+  } catch (error) {
+    promptUi.error(formatTuiError(error), io);
+    return true;
+  }
+  const configuration = await promptForMicrovmConfiguration(io, promptUi, configurations);
+  if (configuration === null) return true;
+  let previousCommand;
+  while (true) {
+    const command = await promptUi.text(
+      {
+        message: "Command to run",
+        placeholder: "uname -a",
+        ...previousCommand === void 0 ? {} : { initialValue: previousCommand },
+        validate: requiredText4("Enter a command.")
+      },
+      io
+    );
+    if (command === TUI_CANCEL) return true;
+    const outcome = await runSingleCommandSession(io, actions, promptUi, command, configuration.id);
+    if (outcome === "back-to-main") return true;
+    if (outcome === "exit-tui") return false;
+    previousCommand = command;
+  }
+}
+async function runSingleCommandSession(io, actions, promptUi, command, microvmConfigurationId) {
+  let timeoutMs;
+  while (true) {
+    const choice = await promptUi.select(
+      {
+        message: "Run command",
+        options: [
+          { value: "execute", label: "Run", hint: formatTimeoutHint(timeoutMs) },
+          { value: "timeout", label: "Set timeout" },
+          { value: "back", label: "Back" }
+        ],
+        initialValue: "execute"
+      },
+      io
+    );
+    if (choice === TUI_CANCEL || choice === "back") return "back-to-main";
+    if (choice === "timeout") {
+      const nextTimeoutMs = await promptCommandTimeout(io, promptUi, timeoutMs);
+      if (nextTimeoutMs !== TUI_CANCEL) timeoutMs = nextTimeoutMs;
+      continue;
+    }
+    const outcome = await executeCommandAndReport(
+      io,
+      actions,
+      promptUi,
+      command,
+      microvmConfigurationId,
+      timeoutMs
+    );
+    if (outcome === "no-active-session") return "exit-tui";
+    return promptRunAgain(io, promptUi);
+  }
+}
+async function promptRunAgain(io, promptUi) {
+  const next = await promptUi.select(
+    {
+      message: "What next?",
+      options: [
+        { value: "again", label: "Run another" },
+        { value: "back", label: "Back" },
+        { value: "exit", label: "Exit" }
+      ],
+      initialValue: "again"
+    },
+    io
+  );
+  if (next === TUI_CANCEL || next === "back") return "back-to-main";
+  if (next === "exit") {
+    promptUi.outro("Ready when you are.", io);
+    return "exit-tui";
+  }
+  return "prompt-new-command";
+}
+async function promptCommandTimeout(io, promptUi, timeoutMs) {
+  const timeout = await promptUi.text(
+    {
+      message: "Timeout in seconds",
+      placeholder: "No timeout",
+      // The current timeout is there to edit; clearing it means no timeout, as the placeholder says.
+      ...timeoutMs === void 0 ? {} : { initialValue: formatSeconds(timeoutMs) },
+      validate: optionalPositiveNumber(
+        "Enter a positive number of seconds, or leave blank for no timeout."
+      )
+    },
+    io
+  );
+  if (timeout === TUI_CANCEL) return TUI_CANCEL;
+  return timeout.trim() === "" ? void 0 : Math.round(Number(timeout) * 1e3);
+}
+function presentRunResult(io, promptUi, result) {
+  io.output.write(result.stdout);
+  io.errorOutput.write(result.stderr);
+  const summary = formatRunResult(result);
+  if (result.timedOut || result.outputTruncated) promptUi.warn(summary, io);
+  else promptUi.info(summary, io);
+}
+async function executeCommandAndReport(io, actions, promptUi, command, microvmConfigurationId, timeoutMs) {
+  const log = promptUi.taskLog({ title: "Run command" }, io);
+  let result;
+  try {
+    result = await actions.runCommand(command, {
+      microvmConfigurationId,
+      ...timeoutMs === void 0 ? {} : { timeoutMs },
+      onPhase: (phase) => log.message(formatRunPhase(phase))
+    });
+  } catch (error) {
+    log.error(formatTuiError(error));
+    return "completed";
+  }
+  if (result === null) {
+    log.error("Interrupted");
+    return "no-active-session";
+  }
+  log.success("Complete");
+  presentRunResult(io, promptUi, result);
+  return "completed";
+}
+
+// ../setsuna/src/tui/customer/persistent-menu.ts
+async function startMicrovmMenu(io, actions, promptUi) {
+  const configurations = (await actions.microvmConfigurations()).configurations;
+  const configuration = await promptForMicrovmConfiguration(io, promptUi, configurations);
+  if (configuration === null) return;
+  const sandbox = await startSandbox(io, actions, promptUi, configuration.id);
+  if (sandbox === void 0) return;
+  promptUi.box(formatMicrovmState(sandbox, Date.now()), "microVM ready", io, STANDALONE_BOX);
+  await manageSandbox(io, actions, promptUi, sandbox);
+}
+async function startSandbox(io, actions, promptUi, microvmConfigurationId) {
+  let interrupted = false;
+  const spinner = promptUi.spinner(io, {
+    indicator: "timer",
+    onCancel: () => {
+      interrupted = true;
+    }
+  });
+  spinner.start("Starting microVM");
+  let sandbox;
+  try {
+    sandbox = await actions.startMicrovm(microvmConfigurationId);
+  } catch (error) {
+    spinner.error(formatTuiError(error));
+    return void 0;
+  }
+  spinner.stop("microVM ready");
+  if (!interrupted) return sandbox;
+  promptUi.warn(
+    `Interrupted after microVM ${sandbox.sandboxId} was created; it stays active under Active microVMs.`,
+    io
+  );
+  return void 0;
+}
+async function activeMicrovmsMenu(io, actions, promptUi) {
+  while (true) {
+    const sandboxes = await actions.activeMicrovms();
+    if (sandboxes.length === 0) {
+      promptUi.info("No active microVMs.", io);
+      return;
+    }
+    const sandbox = await selectSandbox(io, promptUi, sandboxes);
+    if (sandbox === void 0) return;
+    await manageSandbox(io, actions, promptUi, sandbox);
+  }
+}
+async function selectSandbox(io, promptUi, sandboxes) {
+  const now = Date.now();
+  const selected = await promptUi.select(
+    {
+      message: "Active microVMs",
+      options: [
+        ...sandboxes.map((sandbox, index) => ({
+          value: `sandbox:${index}`,
+          label: sandbox.sandboxId,
+          hint: formatExpiry(sandbox.expiresAt, now)
+        })),
+        { value: "back", label: "Back" }
+      ]
+    },
+    io
+  );
+  if (selected === TUI_CANCEL || selected === "back") return void 0;
+  return sandboxes[Number(selected.slice("sandbox:".length))];
+}
+async function manageSandbox(io, actions, promptUi, initial) {
+  let microvm = initial;
+  while (true) {
+    const expiry = formatExpiry(microvm.expiresAt, Date.now());
+    const choice = await promptUi.select(
+      {
+        message: `Manage microVM ${microvm.sandboxId} \xB7 ${expiry}`,
+        options: [
+          { value: "open-terminal", label: "Open terminal" },
+          { value: "reattach-terminal", label: "Reattach terminal" },
+          { value: "run-command", label: "Run command" },
+          { value: "renew", label: "Renew" },
+          { value: "destroy", label: "Destroy microVM" },
+          { value: "back", label: "Back" }
+        ],
+        initialValue: "open-terminal"
+      },
+      io
+    );
+    if (choice === TUI_CANCEL || choice === "back") return;
+    try {
+      const next = await dispatchSandboxChoice(choice, microvm, io, actions, promptUi);
+      if (next === void 0) return;
+      microvm = next;
+    } catch (error) {
+      promptUi.error(formatTuiError(error), io);
+    }
+  }
+}
+async function dispatchSandboxChoice(choice, microvm, io, actions, promptUi) {
+  if (choice === "open-terminal") {
+    await actions.openTerminal(microvm.sandboxId);
+    return refreshExpiry(actions, microvm);
+  }
+  if (choice === "reattach-terminal") {
+    const attached = await reattachTerminal(io, actions, promptUi, microvm.sandboxId);
+    return attached ? refreshExpiry(actions, microvm) : microvm;
+  }
+  if (choice === "run-command") {
+    const ran = await runPersistentCommand(io, actions, promptUi, microvm.sandboxId);
+    return ran ? refreshExpiry(actions, microvm) : microvm;
+  }
+  if (choice === "renew") return renewSandbox(io, actions, promptUi, microvm);
+  return await destroySandbox(io, actions, promptUi, microvm.sandboxId) ? void 0 : microvm;
+}
+async function renewSandbox(io, actions, promptUi, microvm) {
+  const status = await actions.renewMicrovm(microvm.sandboxId);
+  promptUi.success(`Renewed \xB7 ${formatExpiry(status.expiresAt, Date.now())}`, io);
+  return { ...microvm, expiresAt: status.expiresAt };
+}
+async function refreshExpiry(actions, microvm) {
+  try {
+    const current = (await actions.activeMicrovms()).find(
+      ({ sandboxId }) => sandboxId === microvm.sandboxId
+    );
+    return current === void 0 ? microvm : { ...microvm, expiresAt: current.expiresAt };
+  } catch {
+    return microvm;
+  }
+}
+async function reattachTerminal(io, actions, promptUi, sandboxId) {
+  const processes = await actions.terminalProcesses(sandboxId);
+  if (processes.length === 0) {
+    promptUi.info("No terminal sessions to reattach.", io);
+    return false;
+  }
+  const selected = await promptUi.select(
+    {
+      message: "Reattach terminal",
+      options: [
+        ...processes.map((process3, index) => ({
+          value: `terminal:${index}`,
+          label: process3.processId
+        })),
+        { value: "back", label: "Back" }
+      ]
+    },
+    io
+  );
+  if (selected === TUI_CANCEL || selected === "back") return false;
+  const process2 = processes[Number(selected.slice("terminal:".length))];
+  if (process2 === void 0) return false;
+  await actions.openTerminal(sandboxId, process2.processId);
+  return true;
+}
+async function runPersistentCommand(io, actions, promptUi, sandboxId) {
+  const command = await promptUi.text(
+    {
+      message: "Command to run",
+      placeholder: "uname -a",
+      validate: requiredText4("Enter a command.")
+    },
+    io
+  );
+  if (command === TUI_CANCEL) return false;
+  let timeoutMs;
+  while (true) {
+    const choice = await promptUi.select(
+      {
+        message: "Run command",
+        options: [
+          { value: "execute", label: "Run", hint: formatTimeoutHint(timeoutMs) },
+          { value: "timeout", label: "Set timeout" },
+          { value: "back", label: "Back" }
+        ],
+        initialValue: "execute"
+      },
+      io
+    );
+    if (choice === TUI_CANCEL || choice === "back") return false;
+    if (choice === "timeout") {
+      const timeout = await promptCommandTimeout(io, promptUi, timeoutMs);
+      if (timeout !== TUI_CANCEL) timeoutMs = timeout;
+    } else {
+      const result = await actions.runPersistentCommand(sandboxId, command, timeoutMs);
+      presentRunResult(io, promptUi, result);
+      return true;
+    }
+  }
+}
+async function destroySandbox(io, actions, promptUi, sandboxId) {
+  const confirmed = await promptUi.confirm(
+    { message: `Destroy microVM ${sandboxId}?`, initialValue: false },
+    io
+  );
+  if (confirmed === TUI_CANCEL || !confirmed) return false;
+  await actions.destroyMicrovm(sandboxId);
+  promptUi.success(`Destroyed microVM ${sandboxId}.`, io);
+  return true;
+}
+
+// ../setsuna/src/tui/customer/index.ts
+init_prompt();
+var TUI_TITLE = "Setsuna \u5239\u90A3";
+var PREVIEW_TUI_SUBTITLE = "Research Preview";
+var UNAVAILABLE_MESSAGE = "Setsuna is temporarily unavailable. Try again shortly.";
+async function runCustomerTui(io, actions, promptUi, session = {}) {
+  promptUi.intro(TUI_TITLE, PREVIEW_TUI_SUBTITLE, io);
+  while (await ensureSignedIn(io, actions.auth, promptUi, session)) {
+    await checkAvailability(io, actions.service, promptUi);
+    if (await mainMenu(io, actions, promptUi, session) === "exit") return;
+  }
+}
+async function checkAvailability(io, service, promptUi) {
+  const spinner = promptUi.spinner(io);
+  spinner.start("Connecting");
+  if (await service.available()) spinner.stop("Connected");
+  else spinner.error(UNAVAILABLE_MESSAGE);
+}
+async function mainMenu(io, actions, promptUi, session) {
+  while (true) {
+    const choice = await promptUi.select(
+      {
+        message: "What would you like to do?",
+        options: [
+          { value: "start", label: "Start a microVM", hint: "Create a persistent microVM" },
+          { value: "active", label: "Active microVMs", hint: "Manage persistent microVMs" },
+          { value: "run", label: "Run a command", hint: "Launch a fresh microVM" },
+          { value: "account", label: "Account", hint: "Sign-in status and log out" },
+          { value: "exit", label: "Exit" }
+        ],
+        initialValue: "start",
+        ...shellPrompt(session)
+      },
+      io
+    );
+    if (choice === TUI_CANCEL) {
+      promptUi.cancel("Exited.", io);
+      return "exit";
+    }
+    if (choice === "exit") {
+      promptUi.outro("Ready when you are.", io);
+      return "exit";
+    }
+    try {
+      const outcome = await dispatchMainChoice(choice, io, actions, promptUi, session);
+      if (outcome !== "continue") return outcome;
+    } catch (error) {
+      promptUi.error(formatTuiError(error), io);
+    }
+  }
+}
+async function dispatchMainChoice(choice, io, actions, promptUi, session) {
+  if (choice === "start") {
+    await startMicrovmMenu(io, actions.sandbox, promptUi);
+    return "continue";
+  }
+  if (choice === "active") {
+    await activeMicrovmsMenu(io, actions.sandbox, promptUi);
+    return "continue";
+  }
+  if (choice === "run") {
+    return await runCommandMenu(io, actions.sandbox, promptUi) ? "continue" : "exit";
+  }
+  return await accountMenu(io, actions.auth, promptUi, session) === "signed-out" ? "signed-out" : "continue";
+}
+
+// ../setsuna/src/cli-network-options.ts
+var NETWORK_OPTION_NAMES = [
+  "network-mode",
+  "host-ip",
+  "guest-ip",
+  "prefix-length",
+  "uplink-interface",
+  "dns-resolvers",
+  "mtu"
+];
+function routedNetworkFromCli(parsed) {
+  if (!NETWORK_OPTION_NAMES.some((name) => parsed.values[name] !== void 0)) return void 0;
+  if (parsed.values["network-mode"] !== "routed") {
+    throw new TypeError("--network-mode must be routed.");
+  }
+  const hostIp = required(parsed.values["host-ip"], "--host-ip");
+  const guestIp = required(parsed.values["guest-ip"], "--guest-ip");
+  const prefixLength = integer(parsed.values["prefix-length"], "--prefix-length");
+  if (prefixLength !== 30) throw new TypeError("--prefix-length must be 30.");
+  const uplinkInterface = required(parsed.values["uplink-interface"], "--uplink-interface");
+  const dnsResolvers = parsed.values["dns-resolvers"]?.split(",");
+  const mtu = optionalInteger2(parsed.values.mtu, "--mtu");
+  return {
+    mode: "routed",
+    hostIp,
+    guestIp,
+    prefixLength: 30,
+    uplinkInterface,
+    ...dnsResolvers === void 0 ? {} : { dnsResolvers },
+    ...mtu === void 0 ? {} : { mtu }
+  };
+}
+function required(value, name) {
+  if (value === void 0 || value === "") throw new TypeError(`${name} is required.`);
+  return value;
+}
+function integer(value, name) {
+  if (value === void 0 || !/^[0-9]+$/u.test(value)) {
+    throw new TypeError(`${name} must be an integer.`);
+  }
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed)) throw new TypeError(`${name} is too large.`);
+  return parsed;
+}
+function optionalInteger2(value, name) {
+  return value === void 0 ? void 0 : integer(value, name);
+}
+
+// ../setsuna/src/cli-commands.ts
+async function runRunCommand(commandName, commandArguments, parsed, client, requestTimeoutMs, io, options) {
+  if (commandName !== "run") throw new TypeError(`Unknown command: ${commandName ?? ""}`);
+  if (commandArguments.length === 0)
+    throw new TypeError("setsuna run requires a command after --.");
+  const network = routedNetworkFromCli(parsed);
+  const result = await runWithSignalCleanup(
+    client,
+    commandArguments.map(shellQuote).join(" "),
+    {
+      timeoutMs: optionalInteger(parsed.values["timeout-ms"], "--timeout-ms"),
+      requestTimeoutMs,
+      ...parsed.values["configuration-id"] === void 0 ? {} : { microvmConfigurationId: parsed.values["configuration-id"] },
+      ...network === void 0 ? {} : { network }
+    },
+    io,
+    options.signalRuntime ?? DEFAULT_SIGNAL_RUNTIME
+  );
+  if (result !== void 0)
+    writeExecutionResult(result, parsed.values.json, io.output, io.errorOutput, true);
+}
+
+// ../setsuna/src/cli-configurations.ts
+async function runConfigurationsCommand(client, json, output) {
+  const catalog = await client.microvmConfigurations();
+  if (json) {
+    output.write(`${JSON.stringify(catalog)}
+`);
+    return;
+  }
+  output.write(`Installed microVM configurations (default: ${catalog.defaultConfigurationId}):
+`);
+  for (const configuration of catalog.configurations) {
+    const defaultLabel = configuration.id === catalog.defaultConfigurationId ? " (default)" : "";
+    output.write(
+      `${configuration.id}${defaultLabel}  ${configuration.vcpuCount} vCPU  ${configuration.memoryMiB} MiB
+`
+    );
+  }
+}
+
+// ../setsuna/src/cli-process-commands.ts
+var PROCESS_COMMANDS = /* @__PURE__ */ new Set(["spawn", "list", "attach", "stdin", "terminate"]);
+async function runProcessCommand(commandArguments, parsed, client, io, signalRuntime = DEFAULT_SIGNAL_RUNTIME) {
+  const [command, ...arguments_] = commandArguments;
+  if (command === void 0 || !PROCESS_COMMANDS.has(command)) {
+    throw new TypeError("setsuna process requires spawn, list, attach, stdin, or terminate.");
+  }
+  if (command === "spawn") return spawnProcess(arguments_, parsed, client, io.output);
+  if (command === "list") return listProcesses(arguments_, parsed, client, io.output);
+  if (command === "attach") return attachProcess(arguments_, parsed, client, io, signalRuntime);
+  if (command === "stdin") return writeStdin(arguments_, parsed, client, io.output);
+  return terminateProcess(arguments_, parsed, client, io.output);
+}
+async function spawnProcess(arguments_, parsed, client, output) {
+  const [sandboxId, ...argv] = arguments_;
+  if (sandboxId === void 0 || argv.length === 0) {
+    throw new TypeError("setsuna process spawn requires a sandbox ID and argv after --.");
+  }
+  const handle = await client.spawnProcess(sandboxId, { argv });
+  writeHandle(handle, parsed.values.json, output);
+}
+async function listProcesses(arguments_, parsed, client, output) {
+  const [sandboxId] = exactly(arguments_, 1, "setsuna process list requires one sandbox ID.");
+  const processes = await client.listProcesses(sandboxId);
+  if (parsed.values.json) output.write(`${JSON.stringify(processes)}
+`);
+  else if (processes.length === 0) output.write("No processes in this sandbox.\n");
+  else for (const process2 of processes) writeProcess(process2, output);
+}
+async function attachProcess(arguments_, parsed, client, io, signalRuntime) {
+  const [sandboxId, processId] = exactly(
+    arguments_,
+    2,
+    "setsuna process attach requires a sandbox ID and process ID."
+  );
+  const controller = new AbortController();
+  let detached = false;
+  const handleSignal = (signal) => {
+    if (!detached) {
+      detached = true;
+      io.errorOutput.write("Detached; process and sandbox remain active.\n");
+      controller.abort();
+    } else signalRuntime.forceExit(signal === "SIGINT" ? 130 : 143);
+  };
+  const sigint = () => handleSignal("SIGINT");
+  const sigterm = () => handleSignal("SIGTERM");
+  signalRuntime.on("SIGINT", sigint);
+  signalRuntime.on("SIGTERM", sigterm);
+  try {
+    for await (const frame of client.attachProcess(sandboxId, processId, {
+      signal: controller.signal
+    })) {
+      writeFrame(frame, parsed.values.json, io);
+    }
+  } catch (error) {
+    if (!detached || !(error instanceof SetsunaError && error.code === "REQUEST_ABORTED")) {
+      if (!detached) throw error;
+      io.errorOutput.write(`${formatCliError(error)}
+`);
+    }
+  } finally {
+    signalRuntime.off("SIGINT", sigint);
+    signalRuntime.off("SIGTERM", sigterm);
+  }
+}
+async function writeStdin(arguments_, parsed, client, output) {
+  const [sandboxId, processId, data] = exactly(
+    arguments_,
+    3,
+    "setsuna process stdin requires a sandbox ID, process ID, and data."
+  );
+  await client.writeProcessStdin(sandboxId, processId, data);
+  if (parsed.values.json)
+    output.write(`${JSON.stringify({ sandboxId, processId, written: true })}
+`);
+  else output.write(`Wrote stdin to process ${processId}.
+`);
+}
+async function terminateProcess(arguments_, parsed, client, output) {
+  const [sandboxId, processId] = exactly(
+    arguments_,
+    2,
+    "setsuna process terminate requires a sandbox ID and process ID."
+  );
+  const process2 = await client.terminateProcess(sandboxId, processId);
+  if (parsed.values.json) output.write(`${JSON.stringify(process2)}
+`);
+  else output.write(`Terminated process ${process2.processId}; state is ${process2.state}.
+`);
+}
+function writeHandle(handle, json, output) {
+  if (json) output.write(`${JSON.stringify(handle)}
+`);
+  else output.write(`Spawned process ${handle.processId} (PID ${handle.pid}).
+`);
+}
+function writeProcess(process2, output) {
+  output.write(`${process2.processId}  PID ${process2.pid}  ${process2.state}
+`);
+}
+function writeFrame(frame, json, io) {
+  if (json) {
+    io.output.write(`${JSON.stringify(processFrameToJson(frame))}
+`);
+  } else if (frame.kind === "replay") {
+    (frame.stream === "stderr" ? io.errorOutput : io.output).write(frame.data);
+  } else if (frame.kind === "stdout") io.output.write(frame.data);
+  else if (frame.kind === "stderr") io.errorOutput.write(frame.data);
+  else if (frame.kind === "terminal") io.output.write(frame.data);
+}
+function exactly(arguments_, count, message) {
+  if (arguments_.length !== count) throw new TypeError(message);
+  return arguments_;
+}
+
+// ../setsuna/src/cli-sandbox-commands.ts
+var SANDBOX_COMMANDS = /* @__PURE__ */ new Set(["create", "list", "status", "renew", "exec", "destroy"]);
+async function runSandboxCommand(commandName, commandArguments, parsed, client, requestTimeoutMs, io, options) {
+  if (commandName === void 0 || !SANDBOX_COMMANDS.has(commandName)) return false;
+  if (commandName === "create") {
+    requireArgumentCount(commandName, commandArguments, 0);
+    const network = routedNetworkFromCli(parsed);
+    writeLease(
+      await client.create({
+        ...parsed.values["configuration-id"] === void 0 ? {} : { microvmConfigurationId: parsed.values["configuration-id"] },
+        ...network === void 0 ? {} : { network }
+      }),
+      parsed.values.json,
+      io.output,
+      "Created"
+    );
+  } else if (commandName === "list") {
+    requireArgumentCount(commandName, commandArguments, 0);
+    writeList(await client.list(), parsed.values.json, io.output);
+  } else if (commandName === "status") {
+    const sandboxId = requireSandboxId(commandName, commandArguments);
+    writeStatus(await client.status(sandboxId), parsed.values.json, io.output, "Sandbox");
+  } else if (commandName === "renew") {
+    const sandboxId = requireSandboxId(commandName, commandArguments);
+    writeStatus(await client.renew(sandboxId), parsed.values.json, io.output, "Renewed sandbox");
+  } else if (commandName === "destroy") {
+    const sandboxId = requireSandboxId(commandName, commandArguments);
+    await client.destroy(sandboxId);
+    writeDestroyed(sandboxId, parsed.values.json, io.output);
+  } else {
+    await runExec(commandArguments, parsed, client, requestTimeoutMs, io, options);
+  }
+  return true;
+}
+async function runExec(commandArguments, parsed, client, requestTimeoutMs, io, options) {
+  const [sandboxId, ...guestArguments] = commandArguments;
+  if (sandboxId === void 0 || guestArguments.length === 0) {
+    throw new TypeError("setsuna exec requires a sandbox ID and command after --.");
+  }
+  const result = await executeWithSignals(
+    client,
+    sandboxId,
+    guestArguments.map(shellQuote).join(" "),
+    {
+      timeoutMs: optionalInteger(parsed.values["timeout-ms"], "--timeout-ms"),
+      requestTimeoutMs
+    },
+    io,
+    options.signalRuntime ?? DEFAULT_SIGNAL_RUNTIME
+  );
+  if (result !== void 0) {
+    writeExecutionResult(result, parsed.values.json, io.output, io.errorOutput, true);
+  }
+}
+async function executeWithSignals(client, sandboxId, command, options, io, signalRuntime) {
+  const controller = new AbortController();
+  let interruptedExitCode;
+  const handleSignal = (signal) => {
+    const exitCode = signal === "SIGINT" ? 130 : 143;
+    if (interruptedExitCode === void 0) {
+      interruptedExitCode = exitCode;
+      io.errorOutput.write("Interrupt received; sandbox remains active.\n");
+      controller.abort();
+    } else {
+      signalRuntime.forceExit(exitCode);
+    }
+  };
+  const handleSigint = () => handleSignal("SIGINT");
+  const handleSigterm = () => handleSignal("SIGTERM");
+  signalRuntime.on("SIGINT", handleSigint);
+  signalRuntime.on("SIGTERM", handleSigterm);
+  try {
+    const result = await client.execute(sandboxId, command, {
+      ...options,
+      signal: controller.signal
+    });
+    if (interruptedExitCode === void 0) return result;
+  } catch (error) {
+    if (interruptedExitCode === void 0) throw error;
+    if (!(error instanceof SetsunaError && error.code === "REQUEST_ABORTED")) {
+      io.errorOutput.write(`${formatCliError(error)}
+`);
+    }
+  } finally {
+    signalRuntime.off("SIGINT", handleSigint);
+    signalRuntime.off("SIGTERM", handleSigterm);
+  }
+  process.exitCode = interruptedExitCode;
+  return void 0;
+}
+function requireSandboxId(commandName, arguments_) {
+  requireArgumentCount(commandName, arguments_, 1);
+  const sandboxId = arguments_[0];
+  if (sandboxId === void 0) throw new TypeError(`setsuna ${commandName} requires a sandbox ID.`);
+  return sandboxId;
+}
+function requireArgumentCount(commandName, arguments_, expected) {
+  if (arguments_.length === expected) return;
+  if (expected === 0) throw new TypeError(`setsuna ${commandName} does not accept arguments.`);
+  throw new TypeError(`setsuna ${commandName} requires exactly one sandbox ID.`);
+}
+function writeLease(lease, json, output, verb) {
+  if (json) output.write(`${JSON.stringify(lease)}
+`);
+  else {
+    output.write(
+      `${verb} sandbox ${lease.sandboxId} with configuration ${lease.microvmConfiguration.id}; lease expires at ${lease.expiresAt}.
+`
+    );
+  }
+}
+function writeStatus(status, json, output, subject) {
+  if (json) output.write(`${JSON.stringify(status)}
+`);
+  else output.write(`${subject} ${status.sandboxId} is active until ${status.expiresAt}.
+`);
+}
+function writeList(statuses, json, output) {
+  if (json) {
+    output.write(`${JSON.stringify(statuses)}
+`);
+  } else if (statuses.length === 0) {
+    output.write("No active sandboxes.\n");
+  } else {
+    for (const status of statuses) {
+      output.write(`${status.sandboxId}  active until ${status.expiresAt}
+`);
+    }
+  }
+}
+function writeDestroyed(sandboxId, json, output) {
+  if (json) output.write(`${JSON.stringify({ sandboxId, destroyed: true })}
+`);
+  else output.write(`Destroyed sandbox ${sandboxId}.
+`);
+}
+
+// ../setsuna/src/cli-client.ts
+async function runClientCli(commandName, commandArguments, parsed, authenticated, io, options) {
+  const requestTimeoutMs = optionalInteger(
+    parsed.values["request-timeout-ms"],
+    "--request-timeout-ms"
+  );
+  const remote = authenticated ? remoteClientOptions(options.authDependencies) : void 0;
+  const client = new SetsunaClient({
+    serviceUrl: options.serviceUrl,
+    remote,
+    requestTimeoutMs
+  });
+  await runClientCommand(
+    commandName,
+    commandArguments,
+    parsed,
+    client,
+    requestTimeoutMs,
+    io,
+    options
+  );
+}
+function remoteClientOptions(providedDependencies) {
+  const authDependencies = providedDependencies ?? defaultAuthRuntimeDependencies();
+  return {
+    getAccessToken: () => getValidAuthAccessToken(authDependencies)
+  };
+}
+async function runClientCommand(commandName, commandArguments, parsed, client, requestTimeoutMs, io, options) {
+  if (commandName === "health") {
+    await runHealth(client, io.output, parsed.values.json);
+    return;
+  }
+  if (commandName === "configurations") {
+    if (commandArguments.length !== 0) {
+      throw new TypeError("setsuna configurations does not accept arguments.");
+    }
+    await runConfigurationsCommand(client, parsed.values.json, io.output);
+    return;
+  }
+  if (await runShellCliCommand(
+    commandName,
+    commandArguments,
+    parsed.values.attach,
+    parsed.values.json,
+    client,
+    io,
+    options.shellTerminal
+  ))
+    return;
+  if (commandName === "process") {
+    await runProcessCommand(
+      commandArguments,
+      parsed,
+      client,
+      io,
+      options.signalRuntime ?? DEFAULT_SIGNAL_RUNTIME
+    );
+    return;
+  }
+  if (await runSandboxCommand(
+    commandName,
+    commandArguments,
+    parsed,
+    client,
+    requestTimeoutMs,
+    io,
+    options
+  )) {
+    return;
+  }
+  await runRunCommand(commandName, commandArguments, parsed, client, requestTimeoutMs, io, options);
+}
+
+// ../setsuna/src/tui/customer/failure.ts
+var CUSTOMER_FAILURE = {
+  session: "Your Setsuna session has expired. Sign in again.",
+  forbidden: "This action is not available for your account.",
+  missing: "This microVM is no longer active.",
+  conflict: "This action is no longer available for this microVM.",
+  capacity: "Preview capacity is temporarily busy. Try again shortly.",
+  unreachable: "Setsuna could not be reached. Try again shortly.",
+  unexpected: "Setsuna returned an unexpected response. Try again shortly.",
+  unknown: "Something went wrong while completing that action."
+};
+var SIGN_IN_FAILURE = {
+  check: "The saved sign-in could not be checked.",
+  signIn: "Sign-in could not be completed. Try again.",
+  signOut: "Log out could not be completed. Try again."
+};
+var FAILURE_BY_CODE = /* @__PURE__ */ new Map([
+  ["UNAUTHORIZED", CUSTOMER_FAILURE.session],
+  ["SANDBOX_NOT_FOUND", CUSTOMER_FAILURE.missing],
+  ["SANDBOX_EXPIRED", CUSTOMER_FAILURE.missing],
+  // The request matched no route: the contract is off, the microVM has not gone anywhere.
+  ["ROUTE_NOT_FOUND", CUSTOMER_FAILURE.unexpected],
+  // A 409 that means every slot is taken, not a conflict with this microVM.
+  ["SANDBOX_BUSY", CUSTOMER_FAILURE.capacity],
+  ["SERVICE_UNREACHABLE", CUSTOMER_FAILURE.unreachable],
+  ["REQUEST_TIMEOUT", CUSTOMER_FAILURE.unreachable],
+  ["INVALID_RESPONSE", CUSTOMER_FAILURE.unexpected]
+]);
+var FAILURE_BY_STATUS = /* @__PURE__ */ new Map([
+  [401, CUSTOMER_FAILURE.session],
+  [403, CUSTOMER_FAILURE.forbidden],
+  [409, CUSTOMER_FAILURE.conflict],
+  [429, CUSTOMER_FAILURE.capacity]
+]);
+function describeCustomerFailure(error) {
+  const { code, status } = failureEvidence(error);
+  if (status !== void 0 && status >= 502 && status <= 504) return CUSTOMER_FAILURE.unreachable;
+  return (code === void 0 ? void 0 : FAILURE_BY_CODE.get(code)) ?? (status === void 0 ? void 0 : FAILURE_BY_STATUS.get(status)) ?? CUSTOMER_FAILURE.unknown;
+}
+function primaryFailure(error) {
+  return error instanceof AggregateError ? primaryFailure(error.errors[0]) : error;
+}
+function failureEvidence(error) {
+  const primary = primaryFailure(error);
+  if (!(primary instanceof Error)) return {};
+  return {
+    code: "code" in primary && typeof primary.code === "string" ? primary.code : void 0,
+    status: "status" in primary && typeof primary.status === "number" ? primary.status : void 0
+  };
+}
+
+// ../setsuna/src/cli-preview-interactive.ts
+async function runPreviewInteractive(io, options) {
+  const authDependencies = options.authDependencies ?? defaultAuthRuntimeDependencies();
+  const client = new SetsunaClient({
+    remote: { getAccessToken: () => previewAccessToken(authDependencies) }
+  });
+  const promptUi = options.promptUi ?? await loadPromptUi();
+  await runCustomerTui(
+    io,
+    {
+      auth: createPreviewAuthActions(authDependencies),
+      service: createPreviewServiceActions(client),
+      sandbox: customerSafeSandboxActions(
+        options.interactiveActions ?? createSandboxInteractiveActions(
+          client,
+          io,
+          options.signalRuntime ?? DEFAULT_SIGNAL_RUNTIME,
+          options.shellTerminal
+        )
+      )
+    },
+    promptUi
+  );
+}
+async function loadPromptUi() {
+  const { loadClackPromptUi: loadClackPromptUi2 } = await Promise.resolve().then(() => (init_clack(), clack_exports));
+  return loadClackPromptUi2({ withGuide: true });
+}
+async function previewAccessToken(dependencies) {
+  try {
+    return await getValidAuthAccessToken(dependencies);
+  } catch (error) {
+    if (isSecureStorageNotice(error) || isExpiredSession(error)) throw error;
+    throw new Error("The saved sign-in could not authorize the request.", { cause: error });
+  }
+}
+function createPreviewAuthActions(dependencies) {
+  return {
+    status: () => customerSafeAuth(previewAuthStatus(dependencies), SIGN_IN_FAILURE.check),
+    login: (onAuthorization, signal) => customerSafeAuth(
+      loginWithDeviceFlow(dependencies, onAuthorization, signal),
+      SIGN_IN_FAILURE.signIn
+    ),
+    logout: () => customerSafeAuth(logoutAuth(dependencies), SIGN_IN_FAILURE.signOut)
+  };
+}
+async function previewAuthStatus(dependencies) {
+  const saved = await inspectAuthStatus(dependencies);
+  if (saved.authenticated) return saved;
+  try {
+    await getValidAuthAccessToken(dependencies);
+  } catch {
+    return saved;
+  }
+  return inspectAuthStatus(dependencies);
+}
+async function customerSafeAuth(pending, copy) {
+  try {
+    return await pending;
+  } catch (error) {
+    if (isSecureStorageNotice(error)) throw error;
+    throw new Error(copy, { cause: error });
+  }
+}
+function isSecureStorageNotice(error) {
+  return error instanceof Error && error.message === SECURE_STORAGE_UNAVAILABLE;
+}
+function isExpiredSession(error) {
+  return error instanceof AuthRefreshError && error.kind === "permanent";
+}
+function createPreviewServiceActions(client) {
+  return {
+    async available() {
+      try {
+        await client.health();
+        return true;
+      } catch {
+        return false;
+      }
+    }
+  };
+}
+function customerSafeSandboxActions(actions) {
+  return {
+    runCommand: customerSafe(actions.runCommand),
+    microvmConfigurations: customerSafe(actions.microvmConfigurations),
+    startMicrovm: customerSafe(actions.startMicrovm),
+    activeMicrovms: customerSafe(actions.activeMicrovms),
+    openTerminal: customerSafe(actions.openTerminal),
+    terminalProcesses: customerSafe(actions.terminalProcesses),
+    runPersistentCommand: customerSafe(actions.runPersistentCommand),
+    renewMicrovm: customerSafe(actions.renewMicrovm),
+    destroyMicrovm: customerSafe(actions.destroyMicrovm)
+  };
+}
+function customerSafe(action) {
+  return async (...arguments_) => {
+    try {
+      return await action(...arguments_);
+    } catch (error) {
+      throw new Error(customerCopy(error), { cause: error });
+    }
+  };
+}
+function customerCopy(error) {
+  const primary = primaryFailure(error);
+  if (isSecureStorageNotice(primary)) return SECURE_STORAGE_UNAVAILABLE;
+  if (isExpiredSession(primary)) return CUSTOMER_FAILURE.session;
+  return describeCustomerFailure(error);
+}
+
+// ../setsuna/src/cli-preview.ts
+var PREVIEW_HELP = `Usage:
+  setsuna --help
+  setsuna --version
+  setsuna auth login
+  setsuna auth status [--json]
+  setsuna auth logout [--json]
+  setsuna health [--json]
+  setsuna configurations [--json]
+  setsuna create [--configuration-id ID] [--request-timeout-ms MS] [--json]
+  setsuna list [--request-timeout-ms MS] [--json]
+  setsuna status SANDBOX_ID [--request-timeout-ms MS] [--json]
+  setsuna renew SANDBOX_ID [--request-timeout-ms MS] [--json]
+  setsuna exec SANDBOX_ID [--timeout-ms MS] [--request-timeout-ms MS] [--json] -- COMMAND [ARG...]
+  setsuna destroy SANDBOX_ID [--request-timeout-ms MS] [--json]
+  setsuna shell SANDBOX_ID [--attach PROCESS_ID] [--request-timeout-ms MS]
+  setsuna process spawn SANDBOX_ID [--json] -- ARGV [ARG...]
+  setsuna process list SANDBOX_ID [--json]
+  setsuna process attach SANDBOX_ID PROCESS_ID [--json]
+  setsuna process stdin SANDBOX_ID PROCESS_ID DATA [--json]
+  setsuna process terminate SANDBOX_ID PROCESS_ID [--json]
+  setsuna run [--configuration-id ID] [--timeout-ms MS] [--request-timeout-ms MS] [--json] -- COMMAND [ARG...]
+
+Commands:
+  auth    Log in with Auth0 Device Flow, inspect local credentials, or log out.
+  health  Print the Setsuna service health response.
+  configurations List available microVM configurations.
+  create  Create a persistent sandbox with a selected or default configuration.
+  list    List active persistent sandboxes.
+  status  Inspect an active persistent sandbox lease.
+  renew   Extend an active persistent sandbox lease.
+  exec    Execute a command without destroying the persistent sandbox.
+  destroy Explicitly destroy a persistent sandbox.
+  shell   Open an interactive shell in a persistent sandbox, or reattach to one.
+  process Spawn, list, attach, write stdin, or terminate a guest process.
+  run     Create a sandbox, execute a command, and always destroy the sandbox.
+
+`;
+async function runPreviewCli(args, options = {}) {
+  const io = options.io ?? DEFAULT_IO;
+  const parsed = parsePreviewCliArgs(args);
+  const [commandName, ...commandArguments] = parsed.positionals;
+  if (parsed.values.version) {
+    io.output.write(`${await packageVersion()}
+`);
+    return;
+  }
+  if (parsed.values.help) {
+    io.output.write(PREVIEW_HELP);
+    return;
+  }
+  if (parsed.positionals.length === 0) {
+    if (args.length === 0 && io.input.isTTY === true && io.output.isTTY === true) {
+      return runPreviewInteractive(io, options);
+    }
+    io.output.write(PREVIEW_HELP);
+    return;
+  }
+  if (commandName === "auth") {
+    return runAuthCommand(commandArguments, parsed, io, options.authDependencies);
+  }
+  await runClientCli(commandName, commandArguments, parsed, true, io, options);
+}
+function isDirectExecution() {
+  const entrypoint = process.argv[1];
+  if (entrypoint === void 0) return false;
+  try {
+    return import.meta.url === pathToFileURL(realpathSync(entrypoint)).href;
+  } catch {
+    return import.meta.url === pathToFileURL(entrypoint).href;
+  }
+}
+if (isDirectExecution()) {
+  runPreviewCli(process.argv.slice(2)).catch((error) => {
+    process.stderr.write(`${formatCliError(error)}
+`);
+    process.exitCode = 1;
+  });
+}
+export {
+  PREVIEW_HELP,
+  runPreviewCli
+};