tensorlake 0.4.40 → 0.4.42

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
@@ -23,10 +33,13 @@ __export(index_exports, {
   APIClient: () => APIClient,
   CloudClient: () => CloudClient,
   ContainerState: () => ContainerState,
+  Image: () => Image,
+  ImageBuildOperationType: () => ImageBuildOperationType,
   OutputMode: () => OutputMode,
   PoolInUseError: () => PoolInUseError,
   PoolNotFoundError: () => PoolNotFoundError,
   ProcessStatus: () => ProcessStatus,
+  Pty: () => Pty,
   RemoteAPIError: () => RemoteAPIError,
   RequestExecutionError: () => RequestExecutionError,
   RequestFailedError: () => RequestFailedError,
@@ -39,7 +52,9 @@ __export(index_exports, {
   SandboxNotFoundError: () => SandboxNotFoundError,
   SandboxStatus: () => SandboxStatus,
   SnapshotStatus: () => SnapshotStatus,
-  StdinMode: () => StdinMode
+  StdinMode: () => StdinMode,
+  createSandboxImage: () => createSandboxImage,
+  dockerfileContent: () => dockerfileContent
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -141,7 +156,8 @@ var HttpClient = class {
   timeoutMs;
   abortController = null;
   constructor(options) {
-    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    const url = options.baseUrl;
+    this.baseUrl = url.endsWith("/") ? url.slice(0, -1) : url;
     this.maxRetries = options.maxRetries ?? MAX_RETRIES;
     this.retryBackoffMs = options.retryBackoffMs ?? RETRY_BACKOFF_MS;
     this.timeoutMs = options.timeoutMs ?? DEFAULT_HTTP_TIMEOUT_MS;
@@ -164,8 +180,8 @@ var HttpClient = class {
     this.abortController = null;
   }
   /** Make a JSON request, returning the parsed response body. */
-  async requestJson(method, path, options) {
-    const response = await this.requestResponse(method, path, {
+  async requestJson(method, path2, options) {
+    const response = await this.requestResponse(method, path2, {
       json: options?.body,
       headers: options?.headers,
       signal: options?.signal
@@ -175,14 +191,14 @@ var HttpClient = class {
     return JSON.parse(text);
   }
   /** Make a request returning raw bytes. */
-  async requestBytes(method, path, options) {
+  async requestBytes(method, path2, options) {
     const headers = { ...options?.headers ?? {} };
     if (options?.contentType) {
       headers["Content-Type"] = options.contentType;
     }
     const response = await this.requestResponse(
       method,
-      path,
+      path2,
       {
         body: options?.body,
         headers,
@@ -193,10 +209,10 @@ var HttpClient = class {
     return new Uint8Array(buffer);
   }
   /** Make a request and return the raw Response (for SSE streaming). */
-  async requestStream(method, path, options) {
+  async requestStream(method, path2, options) {
     const response = await this.requestResponse(
       method,
-      path,
+      path2,
       {
         headers: { Accept: "text/event-stream" },
         signal: options?.signal
@@ -208,7 +224,7 @@ var HttpClient = class {
     return response.body;
   }
   /** Make a request and return the raw Response. */
-  async requestResponse(method, path, options) {
+  async requestResponse(method, path2, options) {
     const headers = {
       ...this.headers,
       ...options?.headers ?? {}
@@ -220,15 +236,15 @@ var HttpClient = class {
     const body = hasJsonBody ? JSON.stringify(options?.json) : normalizeRequestBody(options?.body);
     return this.doFetch(
       method,
-      path,
+      path2,
       body,
       headers,
       options?.signal,
       options?.allowHttpErrors ?? false
     );
   }
-  async doFetch(method, path, body, headers, signal, allowHttpErrors = false) {
-    const url = `${this.baseUrl}${path}`;
+  async doFetch(method, path2, body, headers, signal, allowHttpErrors = false) {
+    const url = `${this.baseUrl}${path2}`;
     let lastError;
     for (let attempt = 0; attempt <= this.maxRetries; attempt++) {
       if (attempt > 0) {
@@ -261,7 +277,7 @@ var HttpClient = class {
           return response;
         }
         const errorBody = await response.text().catch(() => "");
-        throwMappedError(response.status, errorBody, path);
+        throwMappedError(response.status, errorBody, path2);
       } catch (err) {
         clearTimeout(timeoutId);
         if (err instanceof RemoteAPIError || err instanceof SandboxNotFoundError || err instanceof PoolNotFoundError || err instanceof PoolInUseError) {
@@ -292,7 +308,7 @@ function normalizeRequestBody(body) {
   }
   return body;
 }
-function throwMappedError(status, body, path) {
+function throwMappedError(status, body, path2) {
   let message = body;
   try {
     const parsed = JSON.parse(body);
@@ -301,19 +317,19 @@ function throwMappedError(status, body, path) {
   } catch {
   }
   if (status === 404) {
-    if (path.includes("sandbox-pools") || path.includes("pools")) {
-      const match = path.match(/sandbox-pools\/([^/]+)/);
+    if (path2.includes("sandbox-pools") || path2.includes("pools")) {
+      const match = path2.match(/sandbox-pools\/([^/]+)/);
       if (match) throw new PoolNotFoundError(match[1]);
     }
-    if (path.includes("sandboxes")) {
-      const match = path.match(/sandboxes\/([^/]+)/);
+    if (path2.includes("sandboxes")) {
+      const match = path2.match(/sandboxes\/([^/]+)/);
       if (match) throw new SandboxNotFoundError(match[1]);
     }
     throw new RemoteAPIError(404, message);
   }
   if (status === 409) {
-    if (path.includes("sandbox-pools") || path.includes("pools")) {
-      const match = path.match(/sandbox-pools\/([^/]+)/);
+    if (path2.includes("sandbox-pools") || path2.includes("pools")) {
+      const match = path2.match(/sandbox-pools\/([^/]+)/);
       if (match) throw new PoolInUseError(match[1], message);
     }
   }
@@ -341,6 +357,7 @@ var SandboxStatus = /* @__PURE__ */ ((SandboxStatus2) => {
   SandboxStatus2["PENDING"] = "pending";
   SandboxStatus2["RUNNING"] = "running";
   SandboxStatus2["SNAPSHOTTING"] = "snapshotting";
+  SandboxStatus2["SUSPENDING"] = "suspending";
   SandboxStatus2["SUSPENDED"] = "suspended";
   SandboxStatus2["TERMINATED"] = "terminated";
   return SandboxStatus2;
@@ -468,6 +485,9 @@ async function* parseSSEStream(stream, signal) {
 }
 
 // src/url.ts
+function trimTrailingSlashes(url) {
+  return url.endsWith("/") ? url.slice(0, -1) : url;
+}
 function isLocalhost(apiUrl) {
   try {
     const parsed = new URL(apiUrl);
@@ -497,7 +517,7 @@ function resolveProxyTarget(proxyUrl, sandboxId) {
     const host = parsed.hostname;
     if (host === "localhost" || host === "127.0.0.1") {
       return {
-        baseUrl: proxyUrl.replace(/\/+$/, ""),
+        baseUrl: trimTrailingSlashes(proxyUrl),
         hostHeader: `${sandboxId}.local`
       };
     }
@@ -508,23 +528,210 @@ function resolveProxyTarget(proxyUrl, sandboxId) {
     };
   } catch {
     return {
-      baseUrl: `${proxyUrl.replace(/\/+$/, "")}/${sandboxId}`,
+      baseUrl: `${trimTrailingSlashes(proxyUrl)}/${sandboxId}`,
       hostHeader: void 0
     };
   }
 }
-function lifecyclePath(path, isLocal, namespace) {
+function lifecyclePath(path2, isLocal, namespace) {
   if (isLocal) {
-    return `/v1/namespaces/${namespace}/${path}`;
+    return `/v1/namespaces/${namespace}/${path2}`;
   }
-  return `/${path}`;
+  return `/${path2}`;
 }
 
 // src/sandbox.ts
+var import_ws = __toESM(require("ws"), 1);
+var PTY_OP_DATA = 0;
+var PTY_OP_RESIZE = 1;
+var PTY_OP_READY = 2;
+var PTY_OP_EXIT = 3;
+var Pty = class {
+  sessionId;
+  token;
+  wsUrl;
+  wsHeaders;
+  killSession;
+  socket = null;
+  connectPromise = null;
+  intentionalDisconnect = false;
+  exitCode = null;
+  waitSettled = false;
+  dataHandlers = /* @__PURE__ */ new Set();
+  exitHandlers = /* @__PURE__ */ new Set();
+  waitPromise;
+  resolveWait;
+  rejectWait;
+  constructor(options) {
+    this.sessionId = options.sessionId;
+    this.token = options.token;
+    this.wsUrl = options.wsUrl;
+    this.wsHeaders = options.wsHeaders;
+    this.killSession = options.killSession;
+    this.waitPromise = new Promise((resolve, reject) => {
+      this.resolveWait = resolve;
+      this.rejectWait = reject;
+    });
+  }
+  onData(handler) {
+    this.dataHandlers.add(handler);
+    return () => this.dataHandlers.delete(handler);
+  }
+  onExit(handler) {
+    this.exitHandlers.add(handler);
+    if (this.exitCode != null) {
+      queueMicrotask(() => handler(this.exitCode));
+    }
+    return () => this.exitHandlers.delete(handler);
+  }
+  async connect() {
+    if (this.socket?.readyState === import_ws.default.OPEN) {
+      return this;
+    }
+    if (this.connectPromise) {
+      return this.connectPromise;
+    }
+    this.intentionalDisconnect = false;
+    this.connectPromise = new Promise((resolve, reject) => {
+      let opened = false;
+      const socket = new import_ws.default(this.wsUrl, {
+        headers: this.wsHeaders
+      });
+      this.socket = socket;
+      socket.on("open", async () => {
+        try {
+          await sendPtyFrame(socket, Buffer.from([PTY_OP_READY]));
+          opened = true;
+          resolve(this);
+        } catch (error) {
+          reject(error);
+        }
+      });
+      socket.on("message", (message) => {
+        const bytes = normalizePtyMessage(message);
+        const opcode = bytes[0];
+        if (opcode === PTY_OP_DATA) {
+          const payload = bytes.subarray(1);
+          for (const handler of this.dataHandlers) {
+            handler(payload);
+          }
+          return;
+        }
+        if (opcode === PTY_OP_EXIT && bytes.length >= 5) {
+          this.finishWait(bytes.readInt32BE(1));
+        }
+      });
+      socket.on("close", (code, reason) => {
+        const closeReason = Buffer.isBuffer(reason) ? reason.toString("utf8") : String(reason);
+        if (this.socket === socket) {
+          this.socket = null;
+        }
+        this.connectPromise = null;
+        if (this.exitCode != null) {
+          this.finishWait(this.exitCode);
+          return;
+        }
+        if (closeReason.startsWith("exit:")) {
+          const parsed = Number.parseInt(closeReason.slice(5), 10);
+          this.finishWait(Number.isNaN(parsed) ? -1 : parsed);
+          return;
+        }
+        if (this.intentionalDisconnect) {
+          this.intentionalDisconnect = false;
+          return;
+        }
+        if (!opened) {
+          reject(new SandboxError(
+            `PTY websocket closed before READY completed: ${code} ${closeReason || "no reason"}`
+          ));
+          return;
+        }
+        if (closeReason === "session terminated") {
+          this.failWait(new SandboxError("PTY session terminated"));
+          return;
+        }
+        this.failWait(
+          new SandboxError(
+            `PTY websocket closed unexpectedly: ${code} ${closeReason || "no reason"}`
+          )
+        );
+      });
+      socket.on("error", (error) => {
+        if (!opened) {
+          reject(error);
+        }
+      });
+    });
+    return this.connectPromise;
+  }
+  async sendInput(input) {
+    const socket = this.requireOpenSocket();
+    await sendPtyFrame(socket, encodePtyInput(input));
+  }
+  async resize(cols, rows) {
+    const socket = this.requireOpenSocket();
+    await sendPtyFrame(socket, encodePtyResize(cols, rows));
+  }
+  disconnect(code = 1e3, reason = "client disconnect") {
+    if (!this.socket) return;
+    this.intentionalDisconnect = true;
+    this.socket.close(code, reason);
+  }
+  wait() {
+    return this.waitPromise;
+  }
+  async kill() {
+    await this.killSession();
+  }
+  requireOpenSocket() {
+    if (!this.socket || this.socket.readyState !== import_ws.default.OPEN) {
+      throw new SandboxError("PTY is not connected");
+    }
+    return this.socket;
+  }
+  finishWait(exitCode) {
+    if (this.waitSettled) return;
+    this.waitSettled = true;
+    this.exitCode = exitCode;
+    for (const handler of this.exitHandlers) {
+      handler(exitCode);
+    }
+    this.resolveWait(exitCode);
+  }
+  failWait(error) {
+    if (this.waitSettled) return;
+    this.waitSettled = true;
+    this.rejectWait(error);
+  }
+};
+function normalizePtyMessage(message) {
+  if (Buffer.isBuffer(message)) return message;
+  if (Array.isArray(message)) {
+    return Buffer.concat(message.map((part) => Buffer.from(part)));
+  }
+  return Buffer.from(message);
+}
+function encodePtyInput(input) {
+  const payload = typeof input === "string" ? Buffer.from(input, "utf8") : Buffer.from(input);
+  return Buffer.concat([Buffer.from([PTY_OP_DATA]), payload]);
+}
+function encodePtyResize(cols, rows) {
+  const frame = Buffer.alloc(5);
+  frame[0] = PTY_OP_RESIZE;
+  frame.writeUInt16BE(cols, 1);
+  frame.writeUInt16BE(rows, 3);
+  return frame;
+}
+function sendPtyFrame(socket, frame) {
+  return new Promise((resolve, reject) => {
+    socket.send(frame, (error) => error ? reject(error) : resolve());
+  });
+}
 var Sandbox = class {
   sandboxId;
   http;
   baseUrl;
+  wsHeaders;
   ownsSandbox = false;
   lifecycleClient = null;
   constructor(options) {
@@ -532,6 +739,19 @@ var Sandbox = class {
     const proxyUrl = options.proxyUrl ?? SANDBOX_PROXY_URL;
     const { baseUrl, hostHeader } = resolveProxyTarget(proxyUrl, options.sandboxId);
     this.baseUrl = baseUrl;
+    this.wsHeaders = {};
+    if (options.apiKey) {
+      this.wsHeaders.Authorization = `Bearer ${options.apiKey}`;
+    }
+    if (options.organizationId) {
+      this.wsHeaders["X-Forwarded-Organization-Id"] = options.organizationId;
+    }
+    if (options.projectId) {
+      this.wsHeaders["X-Forwarded-Project-Id"] = options.projectId;
+    }
+    if (hostHeader) {
+      this.wsHeaders.Host = hostHeader;
+    }
     this.http = new HttpClient({
       baseUrl,
       apiKey: options.apiKey,
@@ -710,29 +930,29 @@ var Sandbox = class {
     }
   }
   // --- File operations ---
-  async readFile(path) {
+  async readFile(path2) {
     return this.http.requestBytes(
       "GET",
-      `/api/v1/files?path=${encodeURIComponent(path)}`
+      `/api/v1/files?path=${encodeURIComponent(path2)}`
     );
   }
-  async writeFile(path, content) {
+  async writeFile(path2, content) {
     await this.http.requestBytes(
       "PUT",
-      `/api/v1/files?path=${encodeURIComponent(path)}`,
+      `/api/v1/files?path=${encodeURIComponent(path2)}`,
       { body: content, contentType: "application/octet-stream" }
     );
   }
-  async deleteFile(path) {
+  async deleteFile(path2) {
     await this.http.requestJson(
       "DELETE",
-      `/api/v1/files?path=${encodeURIComponent(path)}`
+      `/api/v1/files?path=${encodeURIComponent(path2)}`
     );
   }
-  async listDirectory(path) {
+  async listDirectory(path2) {
     const raw = await this.http.requestJson(
       "GET",
-      `/api/v1/files/list?path=${encodeURIComponent(path)}`
+      `/api/v1/files/list?path=${encodeURIComponent(path2)}`
     );
     return fromSnakeKeys(raw);
   }
@@ -753,6 +973,43 @@ var Sandbox = class {
     );
     return fromSnakeKeys(raw);
   }
+  async createPty(options) {
+    const { onData, onExit, ...createOptions } = options;
+    const session = await this.createPtySession(createOptions);
+    try {
+      return await this.connectPty(session.sessionId, session.token, { onData, onExit });
+    } catch (error) {
+      try {
+        await this.http.requestResponse("DELETE", `/api/v1/pty/${session.sessionId}`);
+      } catch {
+      }
+      throw error;
+    }
+  }
+  async connectPty(sessionId, token, options) {
+    const wsUrl = new URL(this.ptyWsUrl(sessionId, token));
+    const authToken = wsUrl.searchParams.get("token") ?? token;
+    const pty = new Pty({
+      sessionId,
+      token: authToken,
+      wsUrl: wsUrl.toString(),
+      wsHeaders: {
+        ...this.wsHeaders,
+        "X-PTY-Token": authToken
+      },
+      killSession: async () => {
+        await this.http.requestResponse("DELETE", `/api/v1/pty/${sessionId}`);
+      }
+    });
+    if (options?.onData) {
+      pty.onData(options.onData);
+    }
+    if (options?.onExit) {
+      pty.onExit(options.onExit);
+    }
+    await pty.connect();
+    return pty;
+  }
   ptyWsUrl(sessionId, token) {
     let wsBase;
     if (this.baseUrl.startsWith("https://")) {
@@ -880,6 +1137,15 @@ var SandboxClient = class _SandboxClient {
   async update(sandboxId, options) {
     const body = {};
     if (options.name != null) body.name = options.name;
+    if (options.allowUnauthenticatedAccess != null) {
+      body.allow_unauthenticated_access = options.allowUnauthenticatedAccess;
+    }
+    if (options.exposedPorts != null) {
+      body.exposed_ports = normalizeUserPorts(options.exposedPorts);
+    }
+    if (Object.keys(body).length === 0) {
+      throw new SandboxError("At least one sandbox update field must be provided.");
+    }
     const raw = await this.http.requestJson(
       "PATCH",
       this.path(`sandboxes/${sandboxId}`),
@@ -887,12 +1153,54 @@ var SandboxClient = class _SandboxClient {
     );
     return fromSnakeKeys(raw, "sandboxId");
   }
+  async getPortAccess(sandboxId) {
+    const info = await this.get(sandboxId);
+    return {
+      allowUnauthenticatedAccess: info.allowUnauthenticatedAccess ?? false,
+      exposedPorts: dedupeAndSortPorts(info.exposedPorts ?? []),
+      sandboxUrl: info.sandboxUrl
+    };
+  }
+  async exposePorts(sandboxId, ports, options) {
+    const requestedPorts = normalizeUserPorts(ports);
+    const current = await this.getPortAccess(sandboxId);
+    const desiredPorts = dedupeAndSortPorts([
+      ...current.exposedPorts,
+      ...requestedPorts
+    ]);
+    return this.update(sandboxId, {
+      allowUnauthenticatedAccess: options?.allowUnauthenticatedAccess ?? current.allowUnauthenticatedAccess,
+      exposedPorts: desiredPorts
+    });
+  }
+  async unexposePorts(sandboxId, ports) {
+    const requestedPorts = normalizeUserPorts(ports);
+    const current = await this.getPortAccess(sandboxId);
+    const toRemove = new Set(requestedPorts);
+    const desiredPorts = current.exposedPorts.filter((port) => !toRemove.has(port));
+    return this.update(sandboxId, {
+      allowUnauthenticatedAccess: desiredPorts.length ? current.allowUnauthenticatedAccess : false,
+      exposedPorts: desiredPorts
+    });
+  }
   async delete(sandboxId) {
     await this.http.requestJson(
       "DELETE",
       this.path(`sandboxes/${sandboxId}`)
     );
   }
+  async suspend(sandboxId) {
+    await this.http.requestResponse(
+      "POST",
+      this.path(`sandboxes/${sandboxId}/suspend`)
+    );
+  }
+  async resume(sandboxId) {
+    await this.http.requestResponse(
+      "POST",
+      this.path(`sandboxes/${sandboxId}/resume`)
+    );
+  }
   async claim(poolId) {
     const raw = await this.http.requestJson(
       "POST",
@@ -1015,10 +1323,10 @@ var SandboxClient = class _SandboxClient {
     );
   }
   // --- Connect ---
-  connect(sandboxId, proxyUrl) {
+  connect(identifier, proxyUrl) {
     const resolvedProxy = proxyUrl ?? resolveProxyUrl(this.apiUrl);
     return new Sandbox({
-      sandboxId,
+      sandboxId: identifier,
       proxyUrl: resolvedProxy,
       apiKey: this.apiKey,
       organizationId: this.organizationId,
@@ -1060,6 +1368,22 @@ var SandboxClient = class _SandboxClient {
 function sleep3(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+var RESERVED_SANDBOX_MANAGEMENT_PORT = 9501;
+function normalizeUserPorts(ports) {
+  return dedupeAndSortPorts(ports.map(validateUserPort));
+}
+function validateUserPort(port) {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new SandboxError(`invalid port '${port}'`);
+  }
+  if (port === RESERVED_SANDBOX_MANAGEMENT_PORT) {
+    throw new SandboxError("port 9501 is reserved for sandbox management");
+  }
+  return port;
+}
+function dedupeAndSortPorts(ports) {
+  return [...new Set(ports)].sort((a, b) => a - b);
+}
 
 // src/cloud-client.ts
 var CloudClient = class _CloudClient {
@@ -1126,19 +1450,19 @@ var CloudClient = class _CloudClient {
     return fromSnakeKeys(raw);
   }
   async runRequest(applicationName, inputs = []) {
-    const path = this.namespacePath(
+    const path2 = this.namespacePath(
       `applications/${encodeURIComponent(applicationName)}`
     );
-    const response = inputs.length === 0 ? await this.http.requestResponse("POST", path, {
+    const response = inputs.length === 0 ? await this.http.requestResponse("POST", path2, {
       body: new Uint8Array(),
       headers: { Accept: "application/json" }
-    }) : inputs.length === 1 && inputs[0].name === "0" ? await this.http.requestResponse("POST", path, {
+    }) : inputs.length === 1 && inputs[0].name === "0" ? await this.http.requestResponse("POST", path2, {
       body: toRequestBody(inputs[0].data),
       headers: {
         Accept: "application/json",
         "Content-Type": inputs[0].contentType
       }
-    }) : await this.runMultipartRequest(path, inputs);
+    }) : await this.runMultipartRequest(path2, inputs);
     const body = await parseJsonResponse(response);
     const requestId = body?.request_id;
     if (!requestId) {
@@ -1239,7 +1563,7 @@ var CloudClient = class _CloudClient {
     );
     const response = await this.http.requestResponse(
       "PUT",
-      `${trimTrailingSlashes(buildServicePath)}/builds`,
+      `${trimTrailingSlashes2(buildServicePath)}/builds`,
       { body: form }
     );
     const raw = await parseJsonResponse(response);
@@ -1249,7 +1573,7 @@ var CloudClient = class _CloudClient {
     const form = createApplicationBuildForm(request, imageContexts);
     const response = await this.http.requestResponse(
       "POST",
-      trimTrailingSlashes(buildServicePath),
+      trimTrailingSlashes2(buildServicePath),
       { body: form }
     );
     const raw = await parseJsonResponse(response);
@@ -1258,41 +1582,41 @@ var CloudClient = class _CloudClient {
   async applicationBuildInfo(buildServicePath, applicationBuildId) {
     const raw = await this.http.requestJson(
       "GET",
-      `${trimTrailingSlashes(buildServicePath)}/${encodeURIComponent(applicationBuildId)}`
+      `${trimTrailingSlashes2(buildServicePath)}/${encodeURIComponent(applicationBuildId)}`
     );
     return fromSnakeKeys(raw);
   }
   async cancelApplicationBuild(buildServicePath, applicationBuildId) {
     const raw = await this.http.requestJson(
       "POST",
-      `${trimTrailingSlashes(buildServicePath)}/${encodeURIComponent(applicationBuildId)}/cancel`
+      `${trimTrailingSlashes2(buildServicePath)}/${encodeURIComponent(applicationBuildId)}/cancel`
     );
     return fromSnakeKeys(raw);
   }
   async buildInfo(buildServicePath, buildId) {
     const raw = await this.http.requestJson(
       "GET",
-      `${trimTrailingSlashes(buildServicePath)}/builds/${encodeURIComponent(buildId)}`
+      `${trimTrailingSlashes2(buildServicePath)}/builds/${encodeURIComponent(buildId)}`
     );
     return fromSnakeKeys(raw);
   }
   async cancelBuild(buildServicePath, buildId) {
     await this.http.requestResponse(
       "POST",
-      `${trimTrailingSlashes(buildServicePath)}/builds/${encodeURIComponent(buildId)}/cancel`
+      `${trimTrailingSlashes2(buildServicePath)}/builds/${encodeURIComponent(buildId)}/cancel`
     );
   }
   async *streamBuildLogs(buildServicePath, buildId, signal) {
     const stream = await this.http.requestStream(
       "GET",
-      `${trimTrailingSlashes(buildServicePath)}/builds/${encodeURIComponent(buildId)}/logs`,
+      `${trimTrailingSlashes2(buildServicePath)}/builds/${encodeURIComponent(buildId)}/logs`,
       { signal }
     );
     for await (const event of parseSSEStream(stream, signal)) {
       yield fromSnakeKeys(event);
     }
   }
-  async runMultipartRequest(path, inputs) {
+  async runMultipartRequest(path2, inputs) {
     const form = new FormData();
     for (const input of inputs) {
       form.append(
@@ -1301,7 +1625,7 @@ var CloudClient = class _CloudClient {
         input.name
       );
     }
-    return this.http.requestResponse("POST", path, {
+    return this.http.requestResponse("POST", path2, {
       body: form,
       headers: { Accept: "application/json" }
     });
@@ -1361,8 +1685,8 @@ function createApplicationBuildForm(request, imageContexts) {
   }
   return form;
 }
-function trimTrailingSlashes(value) {
-  return value.replace(/\/+$/, "");
+function trimTrailingSlashes2(value) {
+  return value.endsWith("/") ? value.slice(0, -1) : value;
 }
 function toBlobPart(data) {
   if (typeof data === "string" || data instanceof Blob) {
@@ -1436,15 +1760,860 @@ var APIClient = class {
     return this.cloudClient.requestOutput(applicationName, requestId);
   }
 };
+
+// src/sandbox-image.ts
+var import_promises = require("fs/promises");
+var import_node_path = __toESM(require("path"), 1);
+var import_node_util = require("util");
+
+// src/image.ts
+var import_node_crypto = require("crypto");
+var ImageBuildOperationType = {
+  ADD: "ADD",
+  COPY: "COPY",
+  ENV: "ENV",
+  RUN: "RUN",
+  WORKDIR: "WORKDIR"
+};
+function cloneOperation(op) {
+  return {
+    type: op.type,
+    args: [...op.args],
+    options: { ...op.options }
+  };
+}
+var Image = class {
+  _id;
+  _name;
+  _tag;
+  _baseImage;
+  _buildOperations;
+  constructor(nameOrOptions = {}, tag = "latest", baseImage = null) {
+    this._id = (0, import_node_crypto.randomUUID)();
+    this._buildOperations = [];
+    if (typeof nameOrOptions === "string") {
+      this._name = nameOrOptions;
+      this._tag = tag;
+      this._baseImage = baseImage;
+      return;
+    }
+    this._name = nameOrOptions.name ?? "default";
+    this._tag = nameOrOptions.tag ?? "latest";
+    this._baseImage = nameOrOptions.baseImage ?? null;
+  }
+  get name() {
+    return this._name;
+  }
+  get tag() {
+    return this._tag;
+  }
+  get baseImage() {
+    return this._baseImage;
+  }
+  get buildOperations() {
+    return this._buildOperations.map(cloneOperation);
+  }
+  add(src, dest, options = void 0) {
+    return this._addOperation({
+      type: ImageBuildOperationType.ADD,
+      args: [src, dest],
+      options: options == null ? {} : { ...options }
+    });
+  }
+  copy(src, dest, options = void 0) {
+    return this._addOperation({
+      type: ImageBuildOperationType.COPY,
+      args: [src, dest],
+      options: options == null ? {} : { ...options }
+    });
+  }
+  env(key, value) {
+    return this._addOperation({
+      type: ImageBuildOperationType.ENV,
+      args: [key, value],
+      options: {}
+    });
+  }
+  run(commands, options = void 0) {
+    return this._addOperation({
+      type: ImageBuildOperationType.RUN,
+      args: Array.isArray(commands) ? [...commands] : [commands],
+      options: options == null ? {} : { ...options }
+    });
+  }
+  workdir(directory) {
+    return this._addOperation({
+      type: ImageBuildOperationType.WORKDIR,
+      args: [directory],
+      options: {}
+    });
+  }
+  _addOperation(op) {
+    this._buildOperations.push(op);
+    return this;
+  }
+};
+function renderOptions(options) {
+  const entries = Object.entries(options);
+  if (entries.length === 0) {
+    return "";
+  }
+  return ` ${entries.map(([key, value]) => `--${key}=${value}`).join(" ")}`;
+}
+function renderBuildOp(op) {
+  const options = renderOptions(op.options);
+  if (op.type === ImageBuildOperationType.ENV) {
+    return `ENV${options} ${op.args[0]}=${JSON.stringify(op.args[1])}`;
+  }
+  return `${op.type}${options} ${op.args.join(" ")}`;
+}
+function dockerfileContent(image) {
+  const lines = image.baseImage == null ? [] : [`FROM ${image.baseImage}`];
+  lines.push(...image.buildOperations.map((op) => renderBuildOp(op)));
+  return lines.join("\n");
+}
+
+// src/sandbox-image.ts
+var BUILD_SANDBOX_PIP_ENV = { PIP_BREAK_SYSTEM_PACKAGES: "1" };
+var IGNORED_DOCKERFILE_INSTRUCTIONS = /* @__PURE__ */ new Set([
+  "CMD",
+  "ENTRYPOINT",
+  "EXPOSE",
+  "HEALTHCHECK",
+  "LABEL",
+  "STOPSIGNAL",
+  "VOLUME"
+]);
+var UNSUPPORTED_DOCKERFILE_INSTRUCTIONS = /* @__PURE__ */ new Set([
+  "ARG",
+  "ONBUILD",
+  "SHELL",
+  "USER"
+]);
+function defaultRegisteredName(dockerfilePath) {
+  const parsed = import_node_path.default.parse(dockerfilePath);
+  if (parsed.name.toLowerCase() === "dockerfile") {
+    const parentName = import_node_path.default.basename(import_node_path.default.dirname(dockerfilePath)).trim();
+    return parentName || "sandbox-image";
+  }
+  return parsed.name || "sandbox-image";
+}
+function logicalDockerfileLines(dockerfileText) {
+  const logicalLines = [];
+  let parts = [];
+  let startLine = null;
+  for (const [index, rawLine] of dockerfileText.split(/\r?\n/).entries()) {
+    const lineNumber = index + 1;
+    const stripped = rawLine.trim();
+    if (parts.length === 0 && (!stripped || stripped.startsWith("#"))) {
+      continue;
+    }
+    if (startLine == null) {
+      startLine = lineNumber;
+    }
+    let line = rawLine.replace(/\s+$/, "");
+    const continued = line.endsWith("\\");
+    if (continued) {
+      line = line.slice(0, -1);
+    }
+    const normalized = line.trim();
+    if (normalized && !normalized.startsWith("#")) {
+      parts.push(normalized);
+    }
+    if (continued) {
+      continue;
+    }
+    if (parts.length > 0) {
+      logicalLines.push({
+        lineNumber: startLine ?? lineNumber,
+        line: parts.join(" ")
+      });
+    }
+    parts = [];
+    startLine = null;
+  }
+  if (parts.length > 0) {
+    logicalLines.push({
+      lineNumber: startLine ?? 1,
+      line: parts.join(" ")
+    });
+  }
+  return logicalLines;
+}
+function splitInstruction(line, lineNumber) {
+  const trimmed = line.trim();
+  if (!trimmed) {
+    throw new Error(`line ${lineNumber}: empty Dockerfile instruction`);
+  }
+  const match = trimmed.match(/^(\S+)(?:\s+(.*))?$/);
+  if (!match) {
+    throw new Error(`line ${lineNumber}: invalid Dockerfile instruction`);
+  }
+  return {
+    keyword: match[1].toUpperCase(),
+    value: (match[2] ?? "").trim()
+  };
+}
+function shellSplit(input) {
+  const tokens = [];
+  let current = "";
+  let quote = null;
+  let escape = false;
+  for (let i = 0; i < input.length; i++) {
+    const char = input[i];
+    if (escape) {
+      current += char;
+      escape = false;
+      continue;
+    }
+    if (quote == null) {
+      if (/\s/.test(char)) {
+        if (current) {
+          tokens.push(current);
+          current = "";
+        }
+        continue;
+      }
+      if (char === "'" || char === '"') {
+        quote = char;
+        continue;
+      }
+      if (char === "\\") {
+        escape = true;
+        continue;
+      }
+      current += char;
+      continue;
+    }
+    if (quote === "'") {
+      if (char === "'") {
+        quote = null;
+      } else {
+        current += char;
+      }
+      continue;
+    }
+    if (char === '"') {
+      quote = null;
+      continue;
+    }
+    if (char === "\\") {
+      const next = input[++i];
+      if (next == null) {
+        throw new Error(`unterminated escape sequence in '${input}'`);
+      }
+      current += next;
+      continue;
+    }
+    current += char;
+  }
+  if (escape) {
+    throw new Error(`unterminated escape sequence in '${input}'`);
+  }
+  if (quote != null) {
+    throw new Error(`unterminated quoted string in '${input}'`);
+  }
+  if (current) {
+    tokens.push(current);
+  }
+  return tokens;
+}
+function shellQuote(value) {
+  if (!value) {
+    return "''";
+  }
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function stripLeadingFlags(value) {
+  const flags = {};
+  let remaining = value.trimStart();
+  while (remaining.startsWith("--")) {
+    const firstSpace = remaining.indexOf(" ");
+    if (firstSpace === -1) {
+      throw new Error(`invalid Dockerfile flag syntax: ${value}`);
+    }
+    const token = remaining.slice(0, firstSpace);
+    const rest = remaining.slice(firstSpace + 1).trimStart();
+    const flagBody = token.slice(2);
+    if (flagBody.includes("=")) {
+      const [key, flagValue2] = flagBody.split(/=(.*)/s, 2);
+      flags[key] = flagValue2;
+      remaining = rest;
+      continue;
+    }
+    const [flagValue, ...restTokens] = shellSplit(rest);
+    if (flagValue == null) {
+      throw new Error(`missing value for Dockerfile flag '${token}'`);
+    }
+    flags[flagBody] = flagValue;
+    remaining = restTokens.join(" ");
+  }
+  return { flags, remaining };
+}
+function parseFromValue(value, lineNumber) {
+  const { remaining } = stripLeadingFlags(value);
+  const tokens = shellSplit(remaining);
+  if (tokens.length === 0) {
+    throw new Error(`line ${lineNumber}: FROM must include a base image`);
+  }
+  if (tokens.length > 1 && tokens[1].toLowerCase() !== "as") {
+    throw new Error(`line ${lineNumber}: unsupported FROM syntax '${value}'`);
+  }
+  return tokens[0];
+}
+function parseCopyLikeValues(value, lineNumber, keyword) {
+  const { flags, remaining } = stripLeadingFlags(value);
+  if ("from" in flags) {
+    throw new Error(
+      `line ${lineNumber}: ${keyword} --from is not supported for sandbox image creation`
+    );
+  }
+  const payload = remaining.trim();
+  if (!payload) {
+    throw new Error(
+      `line ${lineNumber}: ${keyword} must include source and destination`
+    );
+  }
+  let parts;
+  if (payload.startsWith("[")) {
+    let parsed;
+    try {
+      parsed = JSON.parse(payload);
+    } catch (error) {
+      throw new Error(
+        `line ${lineNumber}: invalid JSON array syntax for ${keyword}: ${error.message}`
+      );
+    }
+    if (!Array.isArray(parsed) || parsed.length < 2 || parsed.some((item) => typeof item !== "string")) {
+      throw new Error(
+        `line ${lineNumber}: ${keyword} JSON array form requires at least two string values`
+      );
+    }
+    parts = parsed;
+  } else {
+    parts = shellSplit(payload);
+    if (parts.length < 2) {
+      throw new Error(
+        `line ${lineNumber}: ${keyword} must include at least one source and one destination`
+      );
+    }
+  }
+  return {
+    flags,
+    sources: parts.slice(0, -1),
+    destination: parts[parts.length - 1]
+  };
+}
+function parseEnvPairs(value, lineNumber) {
+  const tokens = shellSplit(value);
+  if (tokens.length === 0) {
+    throw new Error(`line ${lineNumber}: ENV must include a key and value`);
+  }
+  if (tokens.every((token) => token.includes("="))) {
+    return tokens.map((token) => {
+      const [key, envValue] = token.split(/=(.*)/s, 2);
+      if (!key) {
+        throw new Error(`line ${lineNumber}: invalid ENV token '${token}'`);
+      }
+      return [key, envValue];
+    });
+  }
+  if (tokens.length < 2) {
+    throw new Error(`line ${lineNumber}: ENV must include a key and value`);
+  }
+  return [[tokens[0], tokens.slice(1).join(" ")]];
+}
+function resolveContainerPath(containerPath, workingDir) {
+  if (!containerPath) {
+    return workingDir;
+  }
+  const normalized = containerPath.startsWith("/") ? import_node_path.default.posix.normalize(containerPath) : import_node_path.default.posix.normalize(import_node_path.default.posix.join(workingDir, containerPath));
+  return normalized.startsWith("/") ? normalized : `/${normalized}`;
+}
+function buildPlanFromDockerfileText(dockerfileText, dockerfilePath, contextDir, registeredName) {
+  let baseImage;
+  const instructions = [];
+  for (const logicalLine of logicalDockerfileLines(dockerfileText)) {
+    const { keyword, value } = splitInstruction(
+      logicalLine.line,
+      logicalLine.lineNumber
+    );
+    if (keyword === "FROM") {
+      if (baseImage != null) {
+        throw new Error(
+          `line ${logicalLine.lineNumber}: multi-stage Dockerfiles are not supported for sandbox image creation`
+        );
+      }
+      baseImage = parseFromValue(value, logicalLine.lineNumber);
+      continue;
+    }
+    if (UNSUPPORTED_DOCKERFILE_INSTRUCTIONS.has(keyword)) {
+      throw new Error(
+        `line ${logicalLine.lineNumber}: Dockerfile instruction '${keyword}' is not supported for sandbox image creation`
+      );
+    }
+    instructions.push({
+      keyword,
+      value,
+      lineNumber: logicalLine.lineNumber
+    });
+  }
+  if (!baseImage) {
+    throw new Error("Dockerfile must contain a FROM instruction");
+  }
+  return {
+    dockerfilePath,
+    contextDir,
+    registeredName: registeredName ?? defaultRegisteredName(dockerfilePath),
+    dockerfileText,
+    baseImage,
+    instructions
+  };
+}
+async function loadDockerfilePlan(dockerfilePath, registeredName) {
+  const resolvedPath = import_node_path.default.resolve(dockerfilePath);
+  const fileStats = await (0, import_promises.stat)(resolvedPath).catch(() => null);
+  if (!fileStats?.isFile()) {
+    throw new Error(`Dockerfile not found: ${dockerfilePath}`);
+  }
+  const dockerfileText = await (0, import_promises.readFile)(resolvedPath, "utf8");
+  return buildPlanFromDockerfileText(
+    dockerfileText,
+    resolvedPath,
+    import_node_path.default.dirname(resolvedPath),
+    registeredName
+  );
+}
+function loadImagePlan(image, options = {}) {
+  const contextDir = import_node_path.default.resolve(options.contextDir ?? process.cwd());
+  const dockerfileText = dockerfileContent(image);
+  const logicalLines = logicalDockerfileLines(dockerfileText);
+  const instructions = image.baseImage == null ? logicalLines : logicalLines.slice(1);
+  return {
+    dockerfilePath: import_node_path.default.join(contextDir, "Dockerfile"),
+    contextDir,
+    registeredName: options.registeredName ?? image.name,
+    dockerfileText,
+    baseImage: image.baseImage ?? void 0,
+    instructions: instructions.map(({ line, lineNumber }) => {
+      const parsed = splitInstruction(line, lineNumber);
+      return {
+        keyword: parsed.keyword,
+        value: parsed.value,
+        lineNumber
+      };
+    })
+  };
+}
+function defaultEmit(event) {
+  process.stdout.write(`${JSON.stringify(event)}
+`);
+}
+function debugEnabled() {
+  return ["1", "true", "yes", "on"].includes(
+    (process.env.TENSORLAKE_DEBUG ?? "").toLowerCase()
+  );
+}
+function buildContextFromEnv() {
+  return {
+    apiUrl: process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai",
+    apiKey: process.env.TENSORLAKE_API_KEY,
+    personalAccessToken: process.env.TENSORLAKE_PAT,
+    namespace: process.env.INDEXIFY_NAMESPACE ?? "default",
+    organizationId: process.env.TENSORLAKE_ORGANIZATION_ID,
+    projectId: process.env.TENSORLAKE_PROJECT_ID,
+    debug: debugEnabled()
+  };
+}
+function createDefaultClient(context) {
+  return new SandboxClient({
+    apiUrl: context.apiUrl,
+    apiKey: context.apiKey ?? context.personalAccessToken,
+    organizationId: context.organizationId,
+    projectId: context.projectId,
+    namespace: context.namespace
+  });
+}
+async function runChecked(sandbox, command, args, env, workingDir) {
+  const result = await sandbox.run(command, {
+    args,
+    env,
+    workingDir
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `Command '${command} ${args.join(" ")}' failed with exit code ${result.exitCode}`
+    );
+  }
+  return result;
+}
+async function runStreaming(sandbox, emit, sleep4, command, args = [], env, workingDir) {
+  const proc = await sandbox.startProcess(command, {
+    args,
+    env,
+    workingDir
+  });
+  let stdoutSeen = 0;
+  let stderrSeen = 0;
+  let info;
+  while (true) {
+    const stdoutResp = await sandbox.getStdout(proc.pid);
+    emitOutputLines(emit, "stdout", stdoutResp, stdoutSeen);
+    stdoutSeen = stdoutResp.lines.length;
+    const stderrResp = await sandbox.getStderr(proc.pid);
+    emitOutputLines(emit, "stderr", stderrResp, stderrSeen);
+    stderrSeen = stderrResp.lines.length;
+    info = await sandbox.getProcess(proc.pid);
+    if (info.status !== "running" /* RUNNING */) {
+      const finalStdout = await sandbox.getStdout(proc.pid);
+      emitOutputLines(emit, "stdout", finalStdout, stdoutSeen);
+      stdoutSeen = finalStdout.lines.length;
+      const finalStderr = await sandbox.getStderr(proc.pid);
+      emitOutputLines(emit, "stderr", finalStderr, stderrSeen);
+      break;
+    }
+    await sleep4(300);
+  }
+  for (let i = 0; i < 10; i++) {
+    if (info.exitCode != null || info.signal != null) {
+      break;
+    }
+    await sleep4(200);
+    info = await sandbox.getProcess(proc.pid);
+  }
+  const exitCode = info.exitCode != null ? info.exitCode : info.signal != null ? -info.signal : 0;
+  if (exitCode !== 0) {
+    throw new Error(
+      `Command '${command} ${args.join(" ")}' failed with exit code ${exitCode}`
+    );
+  }
+}
+function emitOutputLines(emit, stream, response, seen) {
+  for (const line of response.lines.slice(seen)) {
+    emit({ type: "build_log", stream, message: line });
+  }
+}
+function isPathWithinContext(contextDir, localPath) {
+  const relative = import_node_path.default.relative(contextDir, localPath);
+  return relative === "" || !relative.startsWith("..") && !import_node_path.default.isAbsolute(relative);
+}
+function resolveContextSourcePath(contextDir, source) {
+  const resolvedContextDir = import_node_path.default.resolve(contextDir);
+  const resolvedSource = import_node_path.default.resolve(resolvedContextDir, source);
+  if (!isPathWithinContext(resolvedContextDir, resolvedSource)) {
+    throw new Error(`Local path escapes the build context: ${source}`);
+  }
+  return resolvedSource;
+}
+async function copyLocalPathToSandbox(sandbox, localPath, remotePath) {
+  const fileStats = await (0, import_promises.stat)(localPath).catch(() => null);
+  if (!fileStats) {
+    throw new Error(`Local path not found: ${localPath}`);
+  }
+  if (fileStats.isFile()) {
+    await runChecked(sandbox, "mkdir", ["-p", import_node_path.default.posix.dirname(remotePath)]);
+    await sandbox.writeFile(remotePath, await (0, import_promises.readFile)(localPath));
+    return;
+  }
+  if (!fileStats.isDirectory()) {
+    throw new Error(`Local path not found: ${localPath}`);
+  }
+  const entries = await (0, import_promises.readdir)(localPath, { withFileTypes: true });
+  for (const entry of entries) {
+    const sourcePath = import_node_path.default.join(localPath, entry.name);
+    const destinationPath = import_node_path.default.posix.join(remotePath, entry.name);
+    if (entry.isDirectory()) {
+      await runChecked(sandbox, "mkdir", ["-p", destinationPath]);
+      await copyLocalPathToSandbox(sandbox, sourcePath, destinationPath);
+    } else if (entry.isFile()) {
+      await runChecked(
+        sandbox,
+        "mkdir",
+        ["-p", import_node_path.default.posix.dirname(destinationPath)]
+      );
+      await sandbox.writeFile(destinationPath, await (0, import_promises.readFile)(sourcePath));
+    }
+  }
+}
+async function persistEnvVar(sandbox, processEnv, key, value) {
+  const exportLine = `export ${key}=${shellQuote(value)}`;
+  await runChecked(
+    sandbox,
+    "sh",
+    ["-c", `printf '%s\\n' ${shellQuote(exportLine)} >> /etc/environment`],
+    processEnv
+  );
+}
+async function copyFromContext(sandbox, emit, contextDir, sources, destination, workingDir, keyword) {
+  const destinationPath = resolveContainerPath(destination, workingDir);
+  if (sources.length > 1 && !destinationPath.endsWith("/")) {
+    throw new Error(
+      `${keyword} with multiple sources requires a directory destination ending in '/'`
+    );
+  }
+  for (const source of sources) {
+    const localSource = resolveContextSourcePath(contextDir, source);
+    const localStats = await (0, import_promises.stat)(localSource).catch(() => null);
+    if (!localStats) {
+      throw new Error(`Local path not found: ${localSource}`);
+    }
+    let remoteDestination = destinationPath;
+    if (sources.length > 1) {
+      remoteDestination = import_node_path.default.posix.join(
+        destinationPath.replace(/\/$/, ""),
+        import_node_path.default.posix.basename(source.replace(/\/$/, ""))
+      );
+    } else if (localStats.isFile() && destinationPath.endsWith("/")) {
+      remoteDestination = import_node_path.default.posix.join(
+        destinationPath.replace(/\/$/, ""),
+        import_node_path.default.basename(source)
+      );
+    }
+    emit({
+      type: "status",
+      message: `${keyword} ${source} -> ${remoteDestination}`
+    });
+    await copyLocalPathToSandbox(sandbox, localSource, remoteDestination);
+  }
+}
+async function addUrlToSandbox(sandbox, emit, url, destination, workingDir, processEnv, sleep4) {
+  let destinationPath = resolveContainerPath(destination, workingDir);
+  const parsedUrl = new URL(url);
+  const fileName = import_node_path.default.posix.basename(parsedUrl.pathname.replace(/\/$/, "")) || "downloaded";
+  if (destinationPath.endsWith("/")) {
+    destinationPath = import_node_path.default.posix.join(destinationPath.replace(/\/$/, ""), fileName);
+  }
+  const parentDir = import_node_path.default.posix.dirname(destinationPath) || "/";
+  emit({
+    type: "status",
+    message: `ADD ${url} -> ${destinationPath}`
+  });
+  await runChecked(sandbox, "mkdir", ["-p", parentDir], processEnv);
+  await runStreaming(
+    sandbox,
+    emit,
+    sleep4,
+    "sh",
+    [
+      "-c",
+      `curl -fsSL --location ${shellQuote(url)} -o ${shellQuote(destinationPath)}`
+    ],
+    processEnv,
+    workingDir
+  );
+}
+async function executeDockerfilePlan(sandbox, plan, emit, sleep4) {
+  const processEnv = { ...BUILD_SANDBOX_PIP_ENV };
+  let workingDir = "/";
+  for (const instruction of plan.instructions) {
+    const { keyword, value, lineNumber } = instruction;
+    if (keyword === "RUN") {
+      emit({ type: "status", message: `RUN ${value}` });
+      await runStreaming(
+        sandbox,
+        emit,
+        sleep4,
+        "sh",
+        ["-c", value],
+        processEnv,
+        workingDir
+      );
+      continue;
+    }
+    if (keyword === "WORKDIR") {
+      const tokens = shellSplit(value);
+      if (tokens.length !== 1) {
+        throw new Error(`line ${lineNumber}: WORKDIR must include exactly one path`);
+      }
+      workingDir = resolveContainerPath(tokens[0], workingDir);
+      emit({ type: "status", message: `WORKDIR ${workingDir}` });
+      await runChecked(sandbox, "mkdir", ["-p", workingDir], processEnv);
+      continue;
+    }
+    if (keyword === "ENV") {
+      for (const [key, envValue] of parseEnvPairs(value, lineNumber)) {
+        emit({ type: "status", message: `ENV ${key}=${envValue}` });
+        processEnv[key] = envValue;
+        await persistEnvVar(sandbox, processEnv, key, envValue);
+      }
+      continue;
+    }
+    if (keyword === "COPY") {
+      const { sources, destination } = parseCopyLikeValues(
+        value,
+        lineNumber,
+        keyword
+      );
+      await copyFromContext(
+        sandbox,
+        emit,
+        plan.contextDir,
+        sources,
+        destination,
+        workingDir,
+        keyword
+      );
+      continue;
+    }
+    if (keyword === "ADD") {
+      const { sources, destination } = parseCopyLikeValues(
+        value,
+        lineNumber,
+        keyword
+      );
+      if (sources.length === 1 && /^https?:\/\//.test(sources[0])) {
+        await addUrlToSandbox(
+          sandbox,
+          emit,
+          sources[0],
+          destination,
+          workingDir,
+          processEnv,
+          sleep4
+        );
+      } else {
+        await copyFromContext(
+          sandbox,
+          emit,
+          plan.contextDir,
+          sources,
+          destination,
+          workingDir,
+          keyword
+        );
+      }
+      continue;
+    }
+    if (IGNORED_DOCKERFILE_INSTRUCTIONS.has(keyword)) {
+      emit({
+        type: "warning",
+        message: `Skipping Dockerfile instruction '${keyword}' during snapshot materialization. It is still preserved in the registered Dockerfile.`
+      });
+      continue;
+    }
+    throw new Error(
+      `line ${lineNumber}: Dockerfile instruction '${keyword}' is not supported for sandbox image creation`
+    );
+  }
+}
+async function registerImage(context, name, dockerfile, snapshotId, snapshotUri, isPublic) {
+  if (!context.organizationId || !context.projectId) {
+    throw new Error(
+      "Organization ID and Project ID are required. Run 'tl login' and 'tl init'."
+    );
+  }
+  const bearerToken = context.apiKey ?? context.personalAccessToken;
+  if (!bearerToken) {
+    throw new Error("Missing TENSORLAKE_API_KEY or TENSORLAKE_PAT.");
+  }
+  const baseUrl = context.apiUrl.replace(/\/+$/, "");
+  const url = `${baseUrl}/platform/v1/organizations/${encodeURIComponent(context.organizationId)}/projects/${encodeURIComponent(context.projectId)}/sandbox-templates`;
+  const headers = {
+    Authorization: `Bearer ${bearerToken}`,
+    "Content-Type": "application/json"
+  };
+  if (context.personalAccessToken && !context.apiKey) {
+    headers["X-Forwarded-Organization-Id"] = context.organizationId;
+    headers["X-Forwarded-Project-Id"] = context.projectId;
+  }
+  const response = await fetch(url, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({
+      name,
+      dockerfile,
+      snapshotId,
+      snapshotUri,
+      isPublic
+    })
+  });
+  if (!response.ok) {
+    throw new Error(
+      `${response.status} ${response.statusText}: ${await response.text()}`
+    );
+  }
+  const text = await response.text();
+  return text ? JSON.parse(text) : {};
+}
+async function createSandboxImage(source, options = {}, deps = {}) {
+  const emit = deps.emit ?? defaultEmit;
+  const sleep4 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const context = buildContextFromEnv();
+  const clientFactory = deps.createClient ?? createDefaultClient;
+  const register = deps.registerImage ?? ((...args) => registerImage(...args));
+  const sourceLabel = typeof source === "string" ? source : `Image(${source.name})`;
+  emit({ type: "status", message: `Loading ${sourceLabel}...` });
+  const plan = typeof source === "string" ? await loadDockerfilePlan(source, options.registeredName) : loadImagePlan(source, options);
+  emit({
+    type: "status",
+    message: plan.baseImage == null ? "Starting build sandbox with the default server image..." : `Starting build sandbox from ${plan.baseImage}...`
+  });
+  const client = clientFactory(context);
+  let sandbox;
+  try {
+    sandbox = await client.createAndConnect({
+      ...plan.baseImage == null ? {} : { image: plan.baseImage },
+      cpus: options.cpus ?? 2,
+      memoryMb: options.memoryMb ?? 4096
+    });
+    emit({
+      type: "status",
+      message: `Materializing image in sandbox ${sandbox.sandboxId}...`
+    });
+    await executeDockerfilePlan(sandbox, plan, emit, sleep4);
+    emit({ type: "status", message: "Creating snapshot..." });
+    const snapshot = await client.snapshotAndWait(sandbox.sandboxId);
+    emit({
+      type: "snapshot_created",
+      snapshot_id: snapshot.snapshotId,
+      snapshot_uri: snapshot.snapshotUri ?? null
+    });
+    if (!snapshot.snapshotUri) {
+      throw new Error(
+        `Snapshot ${snapshot.snapshotId} is missing snapshotUri and cannot be registered as a sandbox image.`
+      );
+    }
+    emit({
+      type: "status",
+      message: `Registering image '${plan.registeredName}'...`
+    });
+    const result = await register(
+      context,
+      plan.registeredName,
+      plan.dockerfileText,
+      snapshot.snapshotId,
+      snapshot.snapshotUri,
+      options.isPublic ?? false
+    );
+    emit({
+      type: "image_registered",
+      name: plan.registeredName,
+      image_id: typeof result.id === "string" && result.id || typeof result.templateId === "string" && result.templateId || ""
+    });
+    emit({ type: "done" });
+    return result;
+  } finally {
+    if (sandbox) {
+      try {
+        await sandbox.terminate();
+      } catch {
+      }
+    }
+    client.close();
+  }
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   APIClient,
   CloudClient,
   ContainerState,
+  Image,
+  ImageBuildOperationType,
   OutputMode,
   PoolInUseError,
   PoolNotFoundError,
   ProcessStatus,
+  Pty,
   RemoteAPIError,
   RequestExecutionError,
   RequestFailedError,
@@ -1457,6 +2626,8 @@ var APIClient = class {
   SandboxNotFoundError,
   SandboxStatus,
   SnapshotStatus,
-  StdinMode
+  StdinMode,
+  createSandboxImage,
+  dockerfileContent
 });
 //# sourceMappingURL=index.cjs.map