tensorlake 0.5.17 → 0.5.19

package/dist/index.cjs

@@ -35,7 +35,7 @@ var SDK_VERSION, API_URL, API_KEY, NAMESPACE, SANDBOX_PROXY_URL, DEFAULT_HTTP_TI
 var init_defaults = __esm({
   "src/defaults.ts"() {
     "use strict";
-    SDK_VERSION = "0.5.17";
+    SDK_VERSION = "0.5.19";
     API_URL = process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai";
     API_KEY = process.env.TENSORLAKE_API_KEY ?? void 0;
     NAMESPACE = process.env.INDEXIFY_NAMESPACE ?? "default";
@@ -4503,11 +4503,6 @@ var init_image = __esm({
        * and registers the snapshot as a named sandbox template.
        */
       async build(options = {}) {
-        if ((options.registeredName ?? this._name) === DEFAULT_IMAGE_NAME) {
-          console.warn(
-            `Building sandbox image with the default name "${DEFAULT_IMAGE_NAME}". Pass \`registeredName\` or \`Image({ name })\` to avoid collisions with other default-named images in this project.`
-          );
-        }
         const { createSandboxImage: createSandboxImage2 } = await Promise.resolve().then(() => (init_sandbox_image(), sandbox_image_exports));
         return createSandboxImage2(this, options);
       }
@@ -4522,263 +4517,61 @@ var init_image = __esm({
 // src/sandbox-image.ts
 var sandbox_image_exports = {};
 __export(sandbox_image_exports, {
+  __setNativeBindingForTest: () => __setNativeBindingForTest,
   createSandboxImage: () => createSandboxImage,
-  defaultRegisteredName: () => defaultRegisteredName,
-  loadDockerfilePlan: () => loadDockerfilePlan,
-  loadImagePlan: () => loadImagePlan,
-  logicalDockerfileLines: () => logicalDockerfileLines,
-  registerImage: () => registerImage,
   runCreateSandboxImageCli: () => runCreateSandboxImageCli
 });
-function defaultRegisteredName(dockerfilePath) {
-  const parsed = import_node_path.default.parse(dockerfilePath);
-  if (parsed.name.toLowerCase() === "dockerfile") {
-    const parentName = import_node_path.default.basename(import_node_path.default.dirname(dockerfilePath)).trim();
-    return parentName || "sandbox-image";
+function resolveRequire() {
+  if (typeof module !== "undefined" && module.exports != null && typeof require !== "undefined") {
+    return require;
   }
-  return parsed.name || "sandbox-image";
+  return (0, import_node_module.createRequire)(import_meta.url);
 }
-function logicalDockerfileLines(dockerfileText) {
-  const logicalLines = [];
-  let parts = [];
-  let startLine = null;
-  for (const [index, rawLine] of dockerfileText.split(/\r?\n/).entries()) {
-    const lineNumber = index + 1;
-    const stripped = rawLine.trim();
-    if (parts.length === 0 && (!stripped || stripped.startsWith("#"))) {
-      continue;
-    }
-    if (startLine == null) {
-      startLine = lineNumber;
-    }
-    let line = rawLine.replace(/\s+$/, "");
-    const continued = line.endsWith("\\");
-    if (continued) {
-      line = line.slice(0, -1);
-    }
-    const normalized = line.trim();
-    if (normalized && !normalized.startsWith("#")) {
-      parts.push(normalized);
-    }
-    if (continued) {
-      continue;
-    }
-    if (parts.length > 0) {
-      logicalLines.push({
-        lineNumber: startLine ?? lineNumber,
-        line: parts.join(" ")
-      });
-    }
-    parts = [];
-    startLine = null;
-  }
-  if (parts.length > 0) {
-    logicalLines.push({
-      lineNumber: startLine ?? 1,
-      line: parts.join(" ")
-    });
-  }
-  return logicalLines;
-}
-function splitInstruction(line, lineNumber) {
-  const trimmed = line.trim();
-  if (!trimmed) {
-    throw new Error(`line ${lineNumber}: empty Dockerfile instruction`);
-  }
-  const match = trimmed.match(/^(\S+)(?:\s+(.*))?$/);
-  if (!match) {
-    throw new Error(`line ${lineNumber}: invalid Dockerfile instruction`);
-  }
-  return {
-    keyword: match[1].toUpperCase(),
-    value: (match[2] ?? "").trim()
-  };
-}
-function shellSplit(input) {
-  const tokens = [];
-  let current = "";
-  let quote = null;
-  let escape = false;
-  for (let i = 0; i < input.length; i++) {
-    const char = input[i];
-    if (escape) {
-      current += char;
-      escape = false;
-      continue;
-    }
-    if (quote == null) {
-      if (/\s/.test(char)) {
-        if (current) {
-          tokens.push(current);
-          current = "";
-        }
-        continue;
-      }
-      if (char === "'" || char === '"') {
-        quote = char;
-        continue;
-      }
-      if (char === "\\") {
-        escape = true;
-        continue;
-      }
-      current += char;
-      continue;
-    }
-    if (quote === "'") {
-      if (char === "'") {
-        quote = null;
-      } else {
-        current += char;
-      }
-      continue;
-    }
-    if (char === '"') {
-      quote = null;
-      continue;
-    }
-    if (char === "\\") {
-      const next = input[++i];
-      if (next == null) {
-        throw new Error(`unterminated escape sequence in '${input}'`);
-      }
-      current += next;
-      continue;
-    }
-    current += char;
-  }
-  if (escape) {
-    throw new Error(`unterminated escape sequence in '${input}'`);
-  }
-  if (quote != null) {
-    throw new Error(`unterminated quoted string in '${input}'`);
-  }
-  if (current) {
-    tokens.push(current);
+function loadNativeBinding() {
+  if (cachedNativeBinding) return cachedNativeBinding;
+  if (cachedNativeBindingError) throw cachedNativeBindingError;
+  try {
+    const { loadNative } = resolveRequire()("../lib/runtime.cjs");
+    cachedNativeBinding = loadNative();
+    return cachedNativeBinding;
+  } catch (error) {
+    cachedNativeBindingError = error instanceof Error ? error : new Error(String(error));
+    throw cachedNativeBindingError;
   }
-  return tokens;
 }
-function stripLeadingFlags(value) {
-  const flags = {};
-  let remaining = value.trimStart();
-  while (remaining.startsWith("--")) {
-    const firstSpace = remaining.indexOf(" ");
-    if (firstSpace === -1) {
-      throw new Error(`invalid Dockerfile flag syntax: ${value}`);
-    }
-    const token = remaining.slice(0, firstSpace);
-    const rest = remaining.slice(firstSpace + 1).trimStart();
-    const flagBody = token.slice(2);
-    if (flagBody.includes("=")) {
-      const [key, flagValue2] = flagBody.split(/=(.*)/s, 2);
-      flags[key] = flagValue2;
-      remaining = rest;
-      continue;
-    }
-    const [flagValue, ...restTokens] = shellSplit(rest);
-    if (flagValue == null) {
-      throw new Error(`missing value for Dockerfile flag '${token}'`);
-    }
-    flags[flagBody] = flagValue;
-    remaining = restTokens.join(" ");
-  }
-  return { flags, remaining };
+function __setNativeBindingForTest(binding) {
+  cachedNativeBinding = binding;
+  cachedNativeBindingError = void 0;
 }
-function parseFromValue(value, lineNumber) {
-  const { remaining } = stripLeadingFlags(value);
-  const tokens = shellSplit(remaining);
-  if (tokens.length === 0) {
-    throw new Error(`line ${lineNumber}: FROM must include a base image`);
-  }
-  if (tokens.length > 1 && tokens[1].toLowerCase() !== "as") {
-    throw new Error(`line ${lineNumber}: unsupported FROM syntax '${value}'`);
-  }
-  return tokens[0];
+function nonEmpty(value) {
+  return value && value.length > 0 ? value : void 0;
 }
-function buildPlanFromDockerfileText(dockerfileText, dockerfilePath, contextDir, registeredName) {
-  let baseImage;
-  const instructions = [];
-  for (const logicalLine of logicalDockerfileLines(dockerfileText)) {
-    const { keyword, value } = splitInstruction(
-      logicalLine.line,
-      logicalLine.lineNumber
-    );
-    if (keyword === "FROM") {
-      if (baseImage != null) {
-        throw new Error(
-          `line ${logicalLine.lineNumber}: multi-stage Dockerfiles are not supported for sandbox image creation`
-        );
-      }
-      baseImage = parseFromValue(value, logicalLine.lineNumber);
-      continue;
-    }
-    if (UNSUPPORTED_DOCKERFILE_INSTRUCTIONS.has(keyword)) {
-      throw new Error(
-        `line ${logicalLine.lineNumber}: Dockerfile instruction '${keyword}' is not supported for sandbox image creation`
-      );
-    }
-    instructions.push({
-      keyword,
-      value,
-      lineNumber: logicalLine.lineNumber
-    });
-  }
-  if (!baseImage) {
-    throw new Error("Dockerfile must contain a FROM instruction");
-  }
-  return {
-    dockerfilePath,
-    contextDir,
-    registeredName: registeredName ?? defaultRegisteredName(dockerfilePath),
-    dockerfileText,
-    baseImage,
-    instructions
-  };
-}
-async function loadDockerfilePlan(dockerfilePath, registeredName) {
-  const resolvedPath = import_node_path.default.resolve(dockerfilePath);
-  const fileStats = await (0, import_promises.stat)(resolvedPath).catch(() => null);
-  if (!fileStats?.isFile()) {
-    throw new Error(`Dockerfile not found: ${dockerfilePath}`);
-  }
-  const dockerfileText = await (0, import_promises.readFile)(resolvedPath, "utf8");
-  return buildPlanFromDockerfileText(
-    dockerfileText,
-    resolvedPath,
-    import_node_path.default.dirname(resolvedPath),
-    registeredName
-  );
-}
-function loadImagePlan(image, options = {}) {
-  const contextDir = import_node_path.default.resolve(options.contextDir ?? process.cwd());
-  const dockerfileText = dockerfileContent(image);
-  const logicalLines = logicalDockerfileLines(dockerfileText);
-  const instructions = image.baseImage == null ? logicalLines : logicalLines.slice(1);
+function buildContextFromEnv() {
+  const debugRaw = (process.env.TENSORLAKE_DEBUG ?? "").toLowerCase();
+  const debug = ["1", "true", "yes", "on"].includes(debugRaw);
   return {
-    dockerfilePath: import_node_path.default.join(contextDir, "Dockerfile"),
-    contextDir,
-    registeredName: options.registeredName ?? image.name,
-    dockerfileText,
-    baseImage: image.baseImage ?? void 0,
-    instructions: instructions.map(({ line, lineNumber }) => {
-      const parsed = splitInstruction(line, lineNumber);
-      return {
-        keyword: parsed.keyword,
-        value: parsed.value,
-        lineNumber
-      };
-    })
+    apiUrl: nonEmpty(process.env.TENSORLAKE_API_URL) ?? "https://api.tensorlake.ai",
+    apiKey: nonEmpty(process.env.TENSORLAKE_API_KEY),
+    personalAccessToken: nonEmpty(process.env.TENSORLAKE_PAT),
+    namespace: nonEmpty(process.env.INDEXIFY_NAMESPACE) ?? "default",
+    organizationId: nonEmpty(process.env.TENSORLAKE_ORGANIZATION_ID),
+    projectId: nonEmpty(process.env.TENSORLAKE_PROJECT_ID),
+    debug
   };
 }
-function ndjsonStdoutEmit(event) {
-  process.stdout.write(`${JSON.stringify(event)}
-`);
+function defaultRegisteredName(dockerfilePath) {
+  const parsed = import_node_path.default.parse(dockerfilePath);
+  if (parsed.name.toLowerCase() === "dockerfile") {
+    const parentName = import_node_path.default.basename(import_node_path.default.dirname(dockerfilePath)).trim();
+    return parentName || "sandbox-image";
+  }
+  return parsed.name || "sandbox-image";
 }
 function noopEmit(_event) {
 }
 function stderrEmit(event) {
-  const type = typeof event.type === "string" ? event.type : "";
   const message = typeof event.message === "string" ? event.message : "";
+  const type = typeof event.type === "string" ? event.type : "";
   if (type === "build_log") {
     const stream = typeof event.stream === "string" ? event.stream : "stdout";
     process.stderr.write(`[${stream}] ${message}
@@ -4788,557 +4581,103 @@ function stderrEmit(event) {
 `);
   }
 }
-function debugEnabled() {
-  return ["1", "true", "yes", "on"].includes(
-    (process.env.TENSORLAKE_DEBUG ?? "").toLowerCase()
-  );
+function ndjsonStdoutEmit(event) {
+  process.stdout.write(`${JSON.stringify(event)}
+`);
 }
-function buildContextFromEnv() {
-  return {
-    apiUrl: process.env.TENSORLAKE_API_URL ?? "https://api.tensorlake.ai",
-    apiKey: process.env.TENSORLAKE_API_KEY,
-    personalAccessToken: process.env.TENSORLAKE_PAT,
-    namespace: process.env.INDEXIFY_NAMESPACE ?? "default",
-    organizationId: process.env.TENSORLAKE_ORGANIZATION_ID,
-    projectId: process.env.TENSORLAKE_PROJECT_ID,
-    debug: debugEnabled()
+function eventToEmitDict(event) {
+  const out = {
+    type: event.eventType,
+    message: event.message
   };
+  if (event.stream != null) out.stream = event.stream;
+  return out;
 }
-function createDefaultClient(context) {
-  const useScopeHeaders = context.personalAccessToken != null && context.apiKey == null;
-  return new SandboxClient({
-    apiUrl: context.apiUrl,
-    apiKey: context.apiKey ?? context.personalAccessToken,
-    organizationId: useScopeHeaders ? context.organizationId : void 0,
-    projectId: useScopeHeaders ? context.projectId : void 0,
-    namespace: context.namespace
-  });
-}
-function baseApiUrl(context) {
-  return context.apiUrl.replace(/\/+$/, "");
-}
-function scopedBuildsPath(context) {
-  return `/platform/v1/organizations/${encodeURIComponent(context.organizationId)}/projects/${encodeURIComponent(context.projectId)}/sandbox-template-builds`;
-}
-function platformHeaders(context) {
-  const headers = {
-    Authorization: `Bearer ${context.bearerToken}`,
-    "Content-Type": "application/json"
-  };
-  if (context.useScopeHeaders) {
-    headers["X-Forwarded-Organization-Id"] = context.organizationId;
-    headers["X-Forwarded-Project-Id"] = context.projectId;
+async function createSandboxImage(source, options = {}, deps = {}) {
+  const emit = deps.emit ?? (options.verbose ? stderrEmit : noopEmit);
+  const context = buildContextFromEnv();
+  let dockerfilePath;
+  let dockerfileText;
+  let nativeContextDir;
+  let effectiveName;
+  if (source instanceof Image) {
+    if (!source.baseImage) {
+      throw new Error("Image must have a baseImage to build");
+    }
+    const resolvedContext = import_node_path.default.resolve(options.contextDir ?? process.cwd());
+    dockerfilePath = import_node_path.default.join(resolvedContext, "Dockerfile");
+    let text = dockerfileContent(source);
+    if (!text.endsWith("\n")) text += "\n";
+    dockerfileText = text;
+    nativeContextDir = resolvedContext;
+    effectiveName = options.registeredName ?? source.name;
+  } else if (typeof source === "string") {
+    const resolvedPath = import_node_path.default.resolve(source);
+    if (!(0, import_node_fs.existsSync)(resolvedPath)) {
+      throw new Error(`Dockerfile not found: ${source}`);
+    }
+    dockerfilePath = resolvedPath;
+    dockerfileText = void 0;
+    nativeContextDir = void 0;
+    effectiveName = options.registeredName ?? defaultRegisteredName(resolvedPath);
+  } else {
+    throw new TypeError(
+      `source must be an Image or a Dockerfile path, got ${typeof source}`
+    );
   }
-  return headers;
-}
-async function requestJson(url, init, errorPrefix) {
-  const response = await fetch(url, init);
-  if (!response.ok) {
-    throw new Error(
-      `${errorPrefix} (HTTP ${response.status}): ${await response.text()}`
+  if (effectiveName === DEFAULT_IMAGE_NAME2) {
+    console.warn(
+      `Building sandbox image with the default name "${DEFAULT_IMAGE_NAME2}". Pass \`registeredName\` or \`Image({ name })\` to avoid collisions with other default-named images in this project.`
     );
   }
-  const text = await response.text();
-  return text ? JSON.parse(text) : {};
-}
-async function resolveBuildContext(context) {
   const bearerToken = context.apiKey ?? context.personalAccessToken;
   if (!bearerToken) {
-    throw new Error("Missing TENSORLAKE_API_KEY or TENSORLAKE_PAT.");
-  }
-  if (context.apiKey) {
-    const scope = await requestJson(
-      `${baseApiUrl(context)}/platform/v1/keys/introspect`,
-      {
-        method: "POST",
-        headers: {
-          Authorization: `Bearer ${bearerToken}`,
-          "Content-Type": "application/json"
-        }
-      },
-      "API key introspection failed"
-    );
-    if (!scope.organizationId || !scope.projectId) {
-      throw new Error("API key introspection response is missing organizationId or projectId");
-    }
-    return {
-      ...context,
-      bearerToken,
-      organizationId: scope.organizationId,
-      projectId: scope.projectId,
-      useScopeHeaders: false
-    };
-  }
-  if (!context.organizationId || !context.projectId) {
-    throw new Error(
-      "Personal Access Token authentication requires TENSORLAKE_ORGANIZATION_ID and TENSORLAKE_PROJECT_ID to be set (e.g. via 'tl login && tl init'). To skip this requirement, authenticate with TENSORLAKE_API_KEY instead \u2014 API keys are bound to a single project at creation."
-    );
-  }
-  return {
-    ...context,
-    bearerToken,
-    organizationId: context.organizationId,
-    projectId: context.projectId,
-    useScopeHeaders: true
-  };
-}
-async function prepareRootfsBuild(context, plan, isPublic) {
-  if (!plan.baseImage) {
-    throw new Error("Sandbox image builds require a Dockerfile FROM image or Image baseImage");
-  }
-  const spec = await requestJson(
-    `${baseApiUrl(context)}${scopedBuildsPath(context)}`,
-    {
-      method: "POST",
-      headers: platformHeaders(context),
-      body: JSON.stringify({
-        name: plan.registeredName,
-        dockerfile: plan.dockerfileText,
-        baseImage: plan.baseImage,
-        public: isPublic
-      })
-    },
-    "failed to prepare sandbox image build"
-  );
-  return { prepared: parsePreparedBuild(spec), spec };
-}
-function parsePreparedBuild(raw) {
-  const builder = raw.builder;
-  if (!builder) {
-    throw new Error("platform API response is missing rootfs builder configuration");
-  }
-  const prepared = {
-    ...raw,
-    buildId: requiredString(raw, "buildId"),
-    snapshotId: requiredString(raw, "snapshotId"),
-    snapshotUri: requiredString(raw, "snapshotUri"),
-    rootfsNodeKind: requiredString(raw, "rootfsNodeKind"),
-    builder: {
-      image: requiredString(builder, "image"),
-      command: requiredString(builder, "command"),
-      cpus: requiredNumber(builder, "cpus"),
-      memoryMb: requiredNumber(builder, "memoryMb"),
-      diskMb: requiredNumber(builder, "diskMb")
-    }
-  };
-  const parent = raw.parent;
-  if (parent != null) {
-    prepared.parent = {
-      parentManifestUri: requiredString(parent, "parentManifestUri"),
-      rootfsDiskBytes: optionalNumber(parent, "rootfsDiskBytes")
-    };
+    throw new Error("Missing TENSORLAKE_API_KEY or TENSORLAKE_PAT credentials.");
   }
-  return prepared;
-}
-async function completeRootfsBuild(context, buildId, request) {
-  return requestJson(
-    `${baseApiUrl(context)}${scopedBuildsPath(context)}/${encodeURIComponent(buildId)}/complete`,
+  emit({ type: "status", message: `Building image '${effectiveName}'...` });
+  const binding = loadNativeBinding();
+  let emitError;
+  const resultJson = await binding.buildSandboxImage(
     {
-      method: "POST",
-      headers: platformHeaders(context),
-      body: JSON.stringify(request)
+      apiUrl: context.apiUrl,
+      bearerToken,
+      dockerfilePath,
+      registeredName: effectiveName,
+      diskMb: options.diskMb,
+      builderDiskMb: options.builderDiskMb,
+      cpus: options.cpus,
+      memoryMb: options.memoryMb,
+      isPublic: options.isPublic ?? false,
+      organizationId: context.organizationId,
+      projectId: context.projectId,
+      namespace: context.namespace,
+      useScopeHeaders: context.personalAccessToken != null && context.apiKey == null,
+      userAgent: void 0,
+      dockerfileText,
+      contextDir: nativeContextDir
     },
-    "failed to complete sandbox image build"
-  );
-}
-async function resolvedDockerConfigJson() {
-  const configDir = process.env.DOCKER_CONFIG ?? import_node_path.default.join((0, import_node_os.homedir)(), ".docker");
-  const configPath = import_node_path.default.join(configDir, "config.json");
-  try {
-    const content = await (0, import_promises.readFile)(configPath, "utf8");
-    const parsed = JSON.parse(content);
-    const auths = parsed.auths;
-    if (auths != null && Object.keys(auths).length > 0) {
-      return JSON.stringify({ auths });
-    }
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return void 0;
-    }
-    throw error;
-  }
-  return void 0;
-}
-function rootfsDiskBytes(diskMb, prepared) {
-  if (diskMb != null) {
-    return diskMb * 1024 * 1024;
-  }
-  if (prepared.parent != null) {
-    if (prepared.parent.rootfsDiskBytes == null) {
-      throw new Error(
-        "platform API did not return parent rootfsDiskBytes for diff build; pass diskMb explicitly or update Platform API"
-      );
-    }
-    return prepared.parent.rootfsDiskBytes;
-  }
-  return DEFAULT_ROOTFS_DISK_MB * 1024 * 1024;
-}
-function rootfsDiskBytesToMb(bytes) {
-  return Math.ceil(bytes / (1024 * 1024));
-}
-async function buildRootfsSpec(preparedSpec, prepared, plan, diskMb) {
-  const spec = {
-    ...preparedSpec,
-    dockerfile: plan.dockerfileText,
-    contextDir: REMOTE_CONTEXT_DIR,
-    baseImage: plan.baseImage,
-    rootfsDiskBytes: rootfsDiskBytes(diskMb, prepared)
-  };
-  const dockerConfigJson = await resolvedDockerConfigJson();
-  if (dockerConfigJson != null) {
-    spec.dockerConfigJson = dockerConfigJson;
-  }
-  return spec;
-}
-function rootfsBuilderExecutable(executable) {
-  return executable === ROOTFS_BUILDER_COMMAND ? `${ROOTFS_BUILDER_BIN_DIR}/${ROOTFS_BUILDER_COMMAND}` : executable;
-}
-function rootfsBuilderEnv() {
-  return { PATH: ROOTFS_BUILDER_PATH };
-}
-async function runRootfsBuilder(sandbox, command, emit, sleep3) {
-  const parts = shellSplit(command);
-  const [executable, ...commandArgs] = parts;
-  if (!executable) {
-    throw new Error("empty rootfs builder command returned by platform API");
-  }
-  await runStreaming(
-    sandbox,
-    emit,
-    sleep3,
-    rootfsBuilderExecutable(executable),
-    [...commandArgs, "--spec", REMOTE_SPEC_PATH, "--metadata-out", REMOTE_METADATA_PATH],
-    rootfsBuilderEnv(),
-    REMOTE_BUILD_DIR
-  );
-}
-function metadataString(metadata, snakeKey, camelKey) {
-  const value = metadata[snakeKey] ?? metadata[camelKey];
-  return typeof value === "string" ? value : void 0;
-}
-function metadataNumber(metadata, snakeKey, camelKey) {
-  const value = metadata[snakeKey] ?? metadata[camelKey];
-  if (typeof value === "number") {
-    return value;
-  }
-  if (typeof value === "string" && value.trim()) {
-    const parsed = Number(value);
-    return Number.isFinite(parsed) ? parsed : void 0;
-  }
-  return void 0;
-}
-function completeRequestFromMetadata(prepared, metadata) {
-  const rootfsNodeKind = metadataString(metadata, "rootfs_node_kind", "rootfsNodeKind") ?? prepared.rootfsNodeKind;
-  const parentManifestUri = metadataString(metadata, "parent_manifest_uri", "parentManifestUri") ?? (rootfsNodeKind === "diff" ? prepared.parent?.parentManifestUri : void 0);
-  if (rootfsNodeKind === "diff" && parentManifestUri == null) {
-    throw new Error("rootfs diff build completed without parent_manifest_uri");
-  }
-  const snapshotFormatVersion = metadataString(
-    metadata,
-    "snapshot_format_version",
-    "snapshotFormatVersion"
-  );
-  const snapshotSizeBytes = metadataNumber(
-    metadata,
-    "snapshot_size_bytes",
-    "snapshotSizeBytes"
-  );
-  const rootfsDiskBytesValue = metadataNumber(
-    metadata,
-    "rootfs_disk_bytes",
-    "rootfsDiskBytes"
-  );
-  if (!snapshotFormatVersion) {
-    throw new Error("rootfs builder metadata is missing snapshot_format_version");
-  }
-  if (snapshotSizeBytes == null) {
-    throw new Error("rootfs builder metadata is missing numeric snapshot_size_bytes");
-  }
-  if (rootfsDiskBytesValue == null) {
-    throw new Error("rootfs builder metadata is missing numeric rootfs_disk_bytes");
-  }
-  return {
-    snapshotId: metadataString(metadata, "snapshot_id", "snapshotId") ?? prepared.snapshotId,
-    snapshotUri: metadataString(metadata, "snapshot_uri", "snapshotUri") ?? prepared.snapshotUri,
-    snapshotFormatVersion,
-    snapshotSizeBytes,
-    rootfsDiskBytes: rootfsDiskBytesValue,
-    rootfsNodeKind,
-    ...parentManifestUri ? { parentManifestUri } : {}
-  };
-}
-function requiredString(object, key) {
-  const value = object[key];
-  if (typeof value !== "string" || value.length === 0) {
-    throw new Error(`expected '${key}' to be a non-empty string`);
-  }
-  return value;
-}
-function requiredNumber(object, key) {
-  const value = object[key];
-  if (typeof value !== "number" || !Number.isFinite(value)) {
-    throw new Error(`expected '${key}' to be a finite number`);
-  }
-  return value;
-}
-function optionalNumber(object, key) {
-  const value = object[key];
-  if (value == null) {
-    return void 0;
-  }
-  if (typeof value !== "number" || !Number.isFinite(value)) {
-    throw new Error(`expected '${key}' to be a finite number`);
-  }
-  return value;
-}
-async function runChecked(sandbox, command, args, env, workingDir, user) {
-  const options = {
-    args,
-    env,
-    workingDir
-  };
-  if (user != null) {
-    options.user = user;
-  }
-  const result = await sandbox.run(command, options);
-  if (result.exitCode !== 0) {
-    throw new Error(
-      `Command '${command} ${args.join(" ")}' failed with exit code ${result.exitCode}`
-    );
-  }
-  return result;
-}
-async function runStreaming(sandbox, emit, sleep3, command, args = [], env, workingDir) {
-  const proc = await sandbox.startProcess(command, {
-    args,
-    env,
-    workingDir,
-    user: ROOTFS_BUILDER_PROCESS_USER
-  });
-  let stdoutSeen = 0;
-  let stderrSeen = 0;
-  let info;
-  while (true) {
-    const stdoutResp = await sandbox.getStdout(proc.pid);
-    emitOutputLines(emit, "stdout", stdoutResp, stdoutSeen);
-    stdoutSeen = stdoutResp.lines.length;
-    const stderrResp = await sandbox.getStderr(proc.pid);
-    emitOutputLines(emit, "stderr", stderrResp, stderrSeen);
-    stderrSeen = stderrResp.lines.length;
-    info = await sandbox.getProcess(proc.pid);
-    if (info.status !== "running" /* RUNNING */) {
-      const finalStdout = await sandbox.getStdout(proc.pid);
-      emitOutputLines(emit, "stdout", finalStdout, stdoutSeen);
-      stdoutSeen = finalStdout.lines.length;
-      const finalStderr = await sandbox.getStderr(proc.pid);
-      emitOutputLines(emit, "stderr", finalStderr, stderrSeen);
-      break;
-    }
-    await sleep3(300);
-  }
-  for (let i = 0; i < 10; i++) {
-    if (info.exitCode != null || info.signal != null) {
-      break;
+    (event) => {
+      try {
+        emit(eventToEmitDict(event));
+      } catch (error) {
+        emitError ??= error;
+      }
     }
-    await sleep3(200);
-    info = await sandbox.getProcess(proc.pid);
-  }
-  const exitCode = info.exitCode != null ? info.exitCode : info.signal != null ? -info.signal : 0;
-  if (exitCode !== 0) {
-    throw new Error(
-      `Command '${command} ${args.join(" ")}' failed with exit code ${exitCode}`
-    );
-  }
-}
-function emitOutputLines(emit, stream, response, seen) {
-  for (const line of response.lines.slice(seen)) {
-    emit({ type: "build_log", stream, message: line });
-  }
-}
-async function ensureRemoteBuildRoot(sandbox) {
-  await runChecked(
-    sandbox,
-    "mkdir",
-    ["-p", REMOTE_BUILD_DIR],
-    void 0,
-    void 0,
-    ROOTFS_BUILDER_PROCESS_USER
   );
-  await runChecked(
-    sandbox,
-    "chmod",
-    ["0777", REMOTE_BUILD_DIR],
-    void 0,
-    void 0,
-    ROOTFS_BUILDER_PROCESS_USER
-  );
-}
-async function ensureRemoteDirectory(sandbox, remotePath) {
-  await runChecked(sandbox, "mkdir", ["-p", remotePath]);
-}
-async function ensureRemoteParentDir(sandbox, remotePath) {
-  await ensureRemoteDirectory(sandbox, import_node_path.default.posix.dirname(remotePath));
-}
-async function copyLocalPathToSandbox(sandbox, localPath, remotePath) {
-  const fileStats = await (0, import_promises.stat)(localPath).catch(() => null);
-  if (!fileStats) {
-    throw new Error(`Local path not found: ${localPath}`);
-  }
-  if (fileStats.isFile()) {
-    await ensureRemoteParentDir(sandbox, remotePath);
-    await sandbox.writeFile(remotePath, await (0, import_promises.readFile)(localPath));
-    return;
-  }
-  if (!fileStats.isDirectory()) {
-    throw new Error(`Local path not found: ${localPath}`);
-  }
-  const entries = await (0, import_promises.readdir)(localPath, { withFileTypes: true });
-  for (const entry of entries) {
-    const sourcePath = import_node_path.default.join(localPath, entry.name);
-    const destinationPath = import_node_path.default.posix.join(remotePath, entry.name);
-    if (entry.isDirectory()) {
-      await ensureRemoteDirectory(sandbox, destinationPath);
-      await copyLocalPathToSandbox(sandbox, sourcePath, destinationPath);
-    } else if (entry.isFile()) {
-      await ensureRemoteParentDir(sandbox, destinationPath);
-      await sandbox.writeFile(destinationPath, await (0, import_promises.readFile)(sourcePath));
-    }
-  }
-}
-async function registerImage(context, name, dockerfile, snapshotId, snapshotSandboxId, snapshotUri, snapshotSizeBytes, rootfsDiskBytes2, isPublic, snapshotFormatVersion) {
-  const bearerToken = context.apiKey ?? context.personalAccessToken;
-  if (!bearerToken) {
-    throw new Error("Missing TENSORLAKE_API_KEY or TENSORLAKE_PAT.");
+  if (emitError != null) {
+    throw emitError;
   }
-  const baseUrl = context.apiUrl.replace(/\/+$/, "");
-  const headers = {
-    Authorization: `Bearer ${bearerToken}`,
-    "Content-Type": "application/json"
-  };
-  let url;
-  if (context.apiKey) {
-    url = `${baseUrl}/platform/v1/sandbox-templates`;
-  } else {
-    if (!context.organizationId || !context.projectId) {
-      throw new Error(
-        "Personal Access Token authentication requires TENSORLAKE_ORGANIZATION_ID and TENSORLAKE_PROJECT_ID to be set (e.g. via 'tl login && tl init'). To skip this requirement, authenticate with TENSORLAKE_API_KEY instead \u2014 API keys are bound to a single project at creation."
-      );
-    }
-    url = `${baseUrl}/platform/v1/organizations/${encodeURIComponent(context.organizationId)}/projects/${encodeURIComponent(context.projectId)}/sandbox-templates`;
-    headers["X-Forwarded-Organization-Id"] = context.organizationId;
-    headers["X-Forwarded-Project-Id"] = context.projectId;
-  }
-  const response = await fetch(url, {
-    method: "POST",
-    headers,
-    body: JSON.stringify({
-      name,
-      dockerfile,
-      snapshotId,
-      snapshotSandboxId,
-      snapshotUri,
-      ...snapshotFormatVersion ? { snapshotFormatVersion } : {},
-      snapshotSizeBytes,
-      rootfsDiskBytes: rootfsDiskBytes2,
-      public: isPublic
-    })
-  });
-  if (!response.ok) {
-    throw new Error(
-      `${response.status} ${response.statusText}: ${await response.text()}`
-    );
+  let result = {};
+  if (resultJson.trim().length > 0) {
+    result = JSON.parse(resultJson);
   }
-  const text = await response.text();
-  return text ? JSON.parse(text) : {};
-}
-async function createSandboxImage(source, options = {}, deps = {}) {
-  const emit = deps.emit ?? (options.verbose ? stderrEmit : noopEmit);
-  const sleep3 = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const context = buildContextFromEnv();
-  const clientFactory = deps.createClient ?? createDefaultClient;
-  const sourceLabel = typeof source === "string" ? source : `Image(${source.name})`;
-  emit({ type: "status", message: `Loading ${sourceLabel}...` });
-  const plan = typeof source === "string" ? await loadDockerfilePlan(source, options.registeredName) : loadImagePlan(source, options);
   emit({
-    type: "status",
-    message: `Selected image name: ${plan.registeredName}`
+    type: "image_registered",
+    name: effectiveName,
+    image_id: typeof result.id === "string" && result.id || typeof result.templateId === "string" && result.templateId || ""
   });
-  emit({ type: "status", message: "Preparing rootfs build..." });
-  const resolvedContext = await resolveBuildContext(context);
-  const { prepared, spec: preparedSpec } = await prepareRootfsBuild(
-    resolvedContext,
-    plan,
-    options.isPublic ?? false
-  );
-  emit({
-    type: "status",
-    message: prepared.rootfsNodeKind === "diff" ? "Build mode: RootfsDiff" : "Build mode: RootfsBase"
-  });
-  const client = clientFactory(context);
-  let sandbox;
-  try {
-    const outputRootfsDiskBytes = rootfsDiskBytes(options.diskMb, prepared);
-    const builderDiskMb = Math.max(
-      rootfsDiskBytesToMb(outputRootfsDiskBytes),
-      options.builderDiskMb ?? prepared.builder.diskMb
-    );
-    emit({
-      type: "status",
-      message: `Creating rootfs builder sandbox from ${prepared.builder.image}...`
-    });
-    sandbox = await client.createAndConnect({
-      image: prepared.builder.image,
-      cpus: options.cpus ?? prepared.builder.cpus,
-      memoryMb: options.memoryMb ?? prepared.builder.memoryMb,
-      diskMb: builderDiskMb
-    });
-    emit({
-      type: "status",
-      message: `Rootfs builder sandbox ${sandbox.sandboxId} is running`
-    });
-    emit({ type: "status", message: "Uploading build context..." });
-    await ensureRemoteBuildRoot(sandbox);
-    await copyLocalPathToSandbox(sandbox, plan.contextDir, REMOTE_CONTEXT_DIR);
-    const spec = await buildRootfsSpec(
-      preparedSpec,
-      prepared,
-      plan,
-      options.diskMb
-    );
-    await ensureRemoteParentDir(sandbox, REMOTE_SPEC_PATH);
-    await sandbox.writeFile(
-      REMOTE_SPEC_PATH,
-      new TextEncoder().encode(JSON.stringify(spec, null, 2))
-    );
-    emit({ type: "status", message: "Running offline rootfs builder..." });
-    await runRootfsBuilder(sandbox, prepared.builder.command, emit, sleep3);
-    const metadataBytes = await sandbox.readFile(REMOTE_METADATA_PATH);
-    const metadata = JSON.parse(
-      new TextDecoder().decode(metadataBytes)
-    );
-    const completeRequest = completeRequestFromMetadata(prepared, metadata);
-    emit({ type: "status", message: "Completing image registration..." });
-    const result = await completeRootfsBuild(
-      resolvedContext,
-      prepared.buildId,
-      completeRequest
-    );
-    emit({
-      type: "image_registered",
-      name: plan.registeredName,
-      image_id: typeof result.id === "string" && result.id || typeof result.templateId === "string" && result.templateId || ""
-    });
-    emit({ type: "done" });
-    return result;
-  } finally {
-    if (sandbox) {
-      try {
-        await sandbox.terminate();
-      } catch {
-      }
-    }
-    client.close();
-  }
+  emit({ type: "done" });
+  return result;
 }
 async function runCreateSandboxImageCli(argv = process.argv.slice(2)) {
   const parsed = (0, import_node_util.parseArgs)({
@@ -5355,7 +4694,9 @@ async function runCreateSandboxImageCli(argv = process.argv.slice(2)) {
   });
   const dockerfilePath = parsed.positionals[0];
   if (!dockerfilePath) {
-    throw new Error("Usage: tensorlake-create-sandbox-image <dockerfile_path> [--name NAME] [--cpus N] [--memory MB] [--disk_mb MB] [--builder_disk_mb MB] [--public]");
+    throw new Error(
+      "Usage: tensorlake-create-sandbox-image <dockerfile_path> [--name NAME] [--cpus N] [--memory MB] [--disk_mb MB] [--builder_disk_mb MB] [--public]"
+    );
   }
   const cpus = parsed.values.cpus != null ? Number(parsed.values.cpus) : void 0;
   const memoryMb = parsed.values.memory != null ? Number(parsed.values.memory) : void 0;
@@ -5388,32 +4729,17 @@ async function runCreateSandboxImageCli(argv = process.argv.slice(2)) {
     { emit: ndjsonStdoutEmit }
   );
 }
-var import_promises, import_node_os, import_node_path, import_node_util, DEFAULT_ROOTFS_DISK_MB, REMOTE_BUILD_DIR, REMOTE_CONTEXT_DIR, REMOTE_SPEC_PATH, REMOTE_METADATA_PATH, ROOTFS_BUILDER_BIN_DIR, ROOTFS_BUILDER_PATH, ROOTFS_BUILDER_COMMAND, ROOTFS_BUILDER_PROCESS_USER, UNSUPPORTED_DOCKERFILE_INSTRUCTIONS;
+var import_node_module, import_node_path, import_node_fs, import_node_util, import_meta, cachedNativeBinding, cachedNativeBindingError, DEFAULT_IMAGE_NAME2;
 var init_sandbox_image = __esm({
   "src/sandbox-image.ts"() {
     "use strict";
-    import_promises = require("fs/promises");
-    import_node_os = require("os");
+    import_node_module = require("module");
     import_node_path = __toESM(require("path"), 1);
+    import_node_fs = require("fs");
     import_node_util = require("util");
-    init_models();
-    init_client();
     init_image();
-    DEFAULT_ROOTFS_DISK_MB = 10 * 1024;
-    REMOTE_BUILD_DIR = "/var/lib/tensorlake/rootfs-builder/build";
-    REMOTE_CONTEXT_DIR = "/var/lib/tensorlake/rootfs-builder/build/context";
-    REMOTE_SPEC_PATH = "/var/lib/tensorlake/rootfs-builder/build/spec.json";
-    REMOTE_METADATA_PATH = "/var/lib/tensorlake/rootfs-builder/build/metadata.json";
-    ROOTFS_BUILDER_BIN_DIR = "/usr/local/bin";
-    ROOTFS_BUILDER_PATH = "/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
-    ROOTFS_BUILDER_COMMAND = "tl-rootfs-build";
-    ROOTFS_BUILDER_PROCESS_USER = "root";
-    UNSUPPORTED_DOCKERFILE_INSTRUCTIONS = /* @__PURE__ */ new Set([
-      "ARG",
-      "ONBUILD",
-      "SHELL",
-      "USER"
-    ]);
+    import_meta = {};
+    DEFAULT_IMAGE_NAME2 = "default";
   }
 });