@impz/testing 4.2.5 → 5.0.0

package/dist/index.js

@@ -18990,7 +18990,7 @@ import invariant6 from "tiny-invariant";
 
 // packages/daemon/src/config.ts
 import { join as join4 } from "path";
-import * as z52 from "zod";
+import * as z53 from "zod";
 // packages/shared/src/format-bytes.ts
 var UNITS = ["B", "KiB", "MiB", "GiB", "TiB"];
 function formatBytes(bytes) {
@@ -19425,7 +19425,7 @@ function buildRangeMatcher(ranges) {
 }
 
 // packages/daemon/src/identity/auth/parse-tailnet-rules.ts
-import * as z47 from "zod";
+import * as z48 from "zod";
 // packages/api/src/schemas/lease-schema.ts
 import * as z2 from "zod";
 
@@ -19923,11 +19923,14 @@ var BrokerRuleSchema = z15.object({
   user: BasicUserSchema.optional(),
   upstream: BrokerUpstreamSchema.optional()
 });
-var SecretKindSchema = z15.enum(["github", "anthropic", "npm", "custom", "oauth"]);
+var SecretPresetSchema = z15.enum(["github", "anthropic", "npm"]);
+var SecretKindSchema = z15.enum(["static", "oauth"]);
 var OAuthConfigSchema = z15.object({
   tokenUrl: z15.url({ protocol: /^https$/u }).max(2048),
   clientId: PrintableSchema.min(1).max(256),
   tokenFormat: z15.enum(["json", "form"]).default("form")
+}, {
+  error: (issue) => issue.input === undefined ? "needs a token URL and a client id" : undefined
 });
 var OAuthStateSchema = OAuthConfigSchema.extend({
   status: z15.enum(["pending", "ready", "needs_login"]),
@@ -19936,10 +19939,24 @@ var OAuthStateSchema = OAuthConfigSchema.extend({
   error: z15.string().nullable(),
   idClaims: z15.record(z15.string(), z15.unknown()).readonly().nullable()
 });
+var BROKER_ENV_NAMES = [
+  "HTTPS_PROXY",
+  "https_proxy",
+  "NO_PROXY",
+  "no_proxy",
+  "NODE_USE_ENV_PROXY",
+  "SSL_CERT_FILE",
+  "NODE_EXTRA_CA_CERTS",
+  "GIT_SSL_CAINFO",
+  "REQUESTS_CA_BUNDLE",
+  "CURL_CA_BUNDLE"
+];
+var SecretEnvSchema = z15.array(z15.string().regex(/^[A-Z_][A-Z0-9_]{0,63}$/u, "must be an upper-case variable name").refine((name) => !BROKER_ENV_NAMES.includes(name), "must not be a variable the broker sets")).max(16).readonly();
 var SecretSchema = z15.object({
   name: SecretNameSchema,
   kind: SecretKindSchema,
   rules: z15.array(BrokerRuleSchema).readonly(),
+  env: SecretEnvSchema,
   imps: z15.array(NameSchema).readonly(),
   createdAt: z15.date(),
   oauth: OAuthStateSchema.optional()
@@ -20200,7 +20217,7 @@ var REFERENCE = new RegExp(String.raw`^(?:${DOMAIN}/)?${PATH_COMPONENT}(?:/${PAT
 var ImageRefSchema = z19.string().max(255).regex(REFERENCE, "must be an image reference such as ubuntu:24.04 or ghcr.io/org/app@sha256:\u2026");
 // packages/api/src/contract/caller-contract.ts
 import { eventIterator } from "@orpc/contract";
-import * as z41 from "zod";
+import * as z42 from "zod";
 
 // packages/api/src/schemas/backup-schema.ts
 import * as z20 from "zod";
@@ -20370,83 +20387,140 @@ function isAllowedRedirectUri(text) {
   return url.protocol === "http:" && ["127.0.0.1", "[::1]", "localhost"].includes(url.hostname);
 }
 
-// packages/api/src/schemas/service-schema.ts
+// packages/api/src/schemas/secret-add-schema.ts
 import * as z29 from "zod";
+var SecretRulesSchema = z29.array(BrokerRuleSchema, {
+  error: (issue) => issue.input === undefined ? "needs at least one host" : undefined
+}).min(1, "needs at least one host").max(16).superRefine((rules, context) => {
+  const hosts = rules.map((rule) => rule.host);
+  const repeated = hosts.find((host, index) => hosts.indexOf(host) !== index);
+  if (repeated !== undefined) {
+    context.addIssue({ code: "custom", message: `${repeated} has more than one rule` });
+  }
+}).readonly();
+var StaticBindingSchema = z29.strictObject({
+  kind: z29.literal("static"),
+  rules: SecretRulesSchema,
+  env: SecretEnvSchema.optional()
+});
+var OAuthBindingSchema = z29.strictObject({
+  kind: z29.literal("oauth"),
+  rules: SecretRulesSchema.refine((rules) => rules.every((rule) => rule.upstream === undefined), "an oauth secret cannot have an upstream; it is for kind static"),
+  env: SecretEnvSchema.optional(),
+  oauth: OAuthConfigSchema
+});
+var OldPresetBindingSchema = z29.strictObject({ kind: SecretPresetSchema });
+var SecretAddKindSchema = z29.enum([
+  ...SecretKindSchema.options,
+  ...SecretPresetSchema.options,
+  "custom"
+]);
+var OldCustomBindingSchema = z29.strictObject({
+  kind: z29.literal("custom"),
+  rules: SecretRulesSchema
+});
+var PresetBindingSchema = z29.strictObject({
+  kind: z29.undefined().optional(),
+  preset: SecretPresetSchema
+});
+var SecretBindingSchema = z29.discriminatedUnion("kind", [
+  StaticBindingSchema,
+  OAuthBindingSchema,
+  PresetBindingSchema,
+  OldPresetBindingSchema,
+  OldCustomBindingSchema
+]);
+var AddFields = {
+  name: SecretNameSchema,
+  value: SecretValueSchema,
+  replace: z29.boolean().optional(),
+  rebind: z29.boolean().optional()
+};
+var SecretAddSchema = z29.discriminatedUnion("kind", [
+  StaticBindingSchema.extend(AddFields),
+  OAuthBindingSchema.extend(AddFields),
+  PresetBindingSchema.extend(AddFields),
+  OldPresetBindingSchema.extend(AddFields),
+  OldCustomBindingSchema.extend(AddFields)
+]);
+
+// packages/api/src/schemas/service-schema.ts
+import * as z30 from "zod";
 var SERVICE_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/u;
-var ServiceNameSchema = z29.string().regex(SERVICE_NAME_PATTERN, "must be a lowercase letter or digit followed by up to 62 lowercase letters, digits or -");
+var ServiceNameSchema = z30.string().regex(SERVICE_NAME_PATTERN, "must be a lowercase letter or digit followed by up to 62 lowercase letters, digits or -");
 var SERVICE_LOG_MAX_LINES = 1e5;
-var ServiceRestartSchema = z29.enum(["always", "on-failure", "never"]);
-var EnvEntrySchema = z29.string().regex(/^[A-Za-z_][A-Za-z0-9_]*=/u, "must be KEY=VALUE");
-var ServiceDefSchema = z29.object({
+var ServiceRestartSchema = z30.enum(["always", "on-failure", "never"]);
+var EnvEntrySchema = z30.string().regex(/^[A-Za-z_][A-Za-z0-9_]*=/u, "must be KEY=VALUE");
+var ServiceDefSchema = z30.object({
   name: ServiceNameSchema,
-  argv: z29.array(z29.string().min(1)).min(1).max(256).readonly(),
-  env: z29.array(EnvEntrySchema).max(256).readonly().optional(),
-  cwd: z29.string().min(1).optional(),
-  user: z29.string().min(1).optional(),
+  argv: z30.array(z30.string().min(1)).min(1).max(256).readonly(),
+  env: z30.array(EnvEntrySchema).max(256).readonly().optional(),
+  cwd: z30.string().min(1).optional(),
+  user: z30.string().min(1).optional(),
   restart: ServiceRestartSchema.optional()
 });
-var ServiceStateSchema = z29.enum(["starting", "running", "backoff", "stopped", "exited"]);
-var ServiceSchema = z29.object({
-  name: z29.string(),
+var ServiceStateSchema = z30.enum(["starting", "running", "backoff", "stopped", "exited"]);
+var ServiceSchema = z30.object({
+  name: z30.string(),
   state: ServiceStateSchema,
-  pid: z29.int().positive().nullable(),
-  restarts: z29.int().nonnegative(),
-  lastExit: z29.object({ code: z29.int(), signal: z29.string().nullable() }).nullable(),
-  argv: z29.array(z29.string()).readonly(),
-  envKeys: z29.array(z29.string()).readonly(),
-  cwd: z29.string().nullable(),
-  user: z29.string().nullable(),
+  pid: z30.int().positive().nullable(),
+  restarts: z30.int().nonnegative(),
+  lastExit: z30.object({ code: z30.int(), signal: z30.string().nullable() }).nullable(),
+  argv: z30.array(z30.string()).readonly(),
+  envKeys: z30.array(z30.string()).readonly(),
+  cwd: z30.string().nullable(),
+  user: z30.string().nullable(),
   restart: ServiceRestartSchema,
-  source: z29.enum(["image", "api"]),
-  root: z29.boolean()
+  source: z30.enum(["image", "api"]),
+  root: z30.boolean()
 });
-var ServiceLogSchema = z29.discriminatedUnion("type", [
-  z29.object({ type: z29.literal("log"), service: z29.string(), text: z29.string() }),
-  z29.object({ type: z29.literal("sleeping"), state: ImpStateSchema }),
-  z29.object({ type: z29.literal("awake") }),
-  z29.object({ type: z29.literal("restarting") })
+var ServiceLogSchema = z30.discriminatedUnion("type", [
+  z30.object({ type: z30.literal("log"), service: z30.string(), text: z30.string() }),
+  z30.object({ type: z30.literal("sleeping"), state: ImpStateSchema }),
+  z30.object({ type: z30.literal("awake") }),
+  z30.object({ type: z30.literal("restarting") })
 ]);
-var ServiceListSchema = z29.object({
-  services: z29.array(ServiceSchema).readonly(),
-  recorded: z29.boolean()
+var ServiceListSchema = z30.object({
+  services: z30.array(ServiceSchema).readonly(),
+  recorded: z30.boolean()
 });
 
 // packages/api/src/schemas/session-log-schema.ts
-import * as z30 from "zod";
+import * as z31 from "zod";
 var SESSION_LOG_READ_MAX_BYTES = 1048576;
-var SessionLogSchema = z30.object({
+var SessionLogSchema = z31.object({
   session: SessionNameSchema,
   executionGeneration: ExecutionGenerationSchema,
-  bootId: z30.string(),
-  state: z30.enum(["live", "ended"]),
+  bootId: z31.string(),
+  state: z31.enum(["live", "ended"]),
   logStart: OffsetSchema,
   logEnd: OffsetSchema,
   bytes: OffsetSchema,
   end: OffsetSchema.optional(),
-  exitCode: z30.int().nullable().optional(),
-  complete: z30.boolean(),
-  stopped: z30.enum(["disk_full", "imp_limit"]).optional(),
-  startedAt: z30.date(),
-  endedAt: z30.date().optional()
+  exitCode: z31.int().nullable().optional(),
+  complete: z31.boolean(),
+  stopped: z31.enum(["disk_full", "imp_limit"]).optional(),
+  startedAt: z31.date(),
+  endedAt: z31.date().optional()
 }).readonly();
-var SessionLogListInputSchema = z30.object({
+var SessionLogListInputSchema = z31.object({
   name: NameSchema,
   session: SessionNameSchema.optional()
 });
-var SessionLogReadInputSchema = z30.object({
+var SessionLogReadInputSchema = z31.object({
   name: NameSchema,
   session: SessionNameSchema,
   executionGeneration: ExecutionGenerationSchema,
   from: OffsetSchema,
-  limit: z30.int().min(1).max(SESSION_LOG_READ_MAX_BYTES).optional()
+  limit: z31.int().min(1).max(SESSION_LOG_READ_MAX_BYTES).optional()
 });
-var SessionLogReadSchema = z30.object({
+var SessionLogReadSchema = z31.object({
   offset: OffsetSchema,
-  gap: z30.object({ from: OffsetSchema, to: OffsetSchema }).readonly().optional(),
-  data: z30.instanceof(Blob),
+  gap: z31.object({ from: OffsetSchema, to: OffsetSchema }).readonly().optional(),
+  data: z31.instanceof(Blob),
   log: SessionLogSchema
 }).readonly();
-var SessionLogDeleteInputSchema = z30.object({
+var SessionLogDeleteInputSchema = z31.object({
   name: NameSchema,
   session: SessionNameSchema.optional(),
   executionGeneration: ExecutionGenerationSchema.optional()
@@ -20456,144 +20530,145 @@ var SessionLogDeleteInputSchema = z30.object({
 });
 
 // packages/api/src/schemas/storage-schema.ts
-import * as z31 from "zod";
-var DroppedStorageSchema = z31.object({
-  kind: z31.enum(["imp", "checkpoint", "image", "snapshot", "memory", "secrets"]),
-  id: z31.string()
+import * as z32 from "zod";
+var DroppedStorageSchema = z32.object({
+  kind: z32.enum(["imp", "checkpoint", "image", "snapshot", "memory", "secrets"]),
+  id: z32.string()
 }).readonly();
-var OrphanStorageSchema = z31.object({
-  kind: z31.enum(["imp", "image", "memory", "checkpoint", "secrets"]),
-  id: z31.string(),
-  location: z31.string(),
-  bytes: z31.int().nonnegative(),
-  createdAt: z31.date().nullable(),
-  snapshots: z31.array(z31.string()).readonly(),
-  files: z31.array(z31.string()).readonly().optional()
+var OrphanStorageSchema = z32.object({
+  kind: z32.enum(["imp", "image", "memory", "checkpoint", "secrets"]),
+  id: z32.string(),
+  location: z32.string(),
+  bytes: z32.int().nonnegative(),
+  createdAt: z32.date().nullable(),
+  snapshots: z32.array(z32.string()).readonly(),
+  files: z32.array(z32.string()).readonly().optional()
 }).readonly();
-var StorageGcSchema = z31.object({
-  dryRun: z31.boolean(),
-  dropped: z31.array(DroppedStorageSchema).readonly(),
-  kept: z31.array(OrphanStorageSchema).readonly().optional()
+var StorageGcSchema = z32.object({
+  dryRun: z32.boolean(),
+  dropped: z32.array(DroppedStorageSchema).readonly(),
+  kept: z32.array(OrphanStorageSchema).readonly().optional()
 }).readonly();
-var DatabaseCopySchema = z31.object({
-  path: z31.string(),
-  sizeBytes: z31.int().nonnegative(),
-  lastMigration: z31.string(),
-  impVersion: z31.string(),
-  createdAt: z31.date(),
-  integrity: z31.string()
+var DatabaseCopySchema = z32.object({
+  path: z32.string(),
+  sizeBytes: z32.int().nonnegative(),
+  lastMigration: z32.string(),
+  impVersion: z32.string(),
+  createdAt: z32.date(),
+  integrity: z32.string()
 });
 
 // packages/api/src/schemas/system-info-schema.ts
-import * as z32 from "zod";
-var CountSchema = z32.int().nonnegative();
-var NameFailureSchema = z32.object({ name: NameSchema, error: z32.string() });
-var TailnetNamesSchema = z32.object({
+import * as z33 from "zod";
+var CountSchema = z33.int().nonnegative();
+var NameFailureSchema = z33.object({ name: NameSchema, error: z33.string() });
+var TailnetNamesSchema = z33.object({
   live: CountSchema,
-  failed: z32.array(NameFailureSchema).readonly()
+  failed: z33.array(NameFailureSchema).readonly()
 });
-var BootStatusSchema = z32.object({
+var BootStatusSchema = z33.object({
   coldBoots: CountSchema,
-  outdated: z32.object({
+  outdated: z33.object({
     firecracker: CountSchema,
     kernel: CountSchema,
     agent: CountSchema,
     ipv6: CountSchema.optional()
   })
 });
-var PassStatusSchema = z32.object({
-  isOk: z32.boolean(),
-  error: z32.string().nullable(),
-  at: z32.date()
+var PassStatusSchema = z33.object({
+  isOk: z33.boolean(),
+  error: z33.string().nullable(),
+  at: z33.date()
 });
-var HttpsInfoSchema = z32.object({
-  domain: z32.string(),
+var HttpsInfoSchema = z33.object({
+  domain: z33.string(),
   dnsToken: PassStatusSchema.nullable()
 });
-var PublicInfoSchema = z32.object({
-  ip: z32.ipv4(),
+var PublicInfoSchema = z33.object({
+  ip: z33.ipv4(),
   imps: CountSchema,
   records: PassStatusSchema.nullable()
 });
-var SystemFeaturesSchema = z32.object({
-  sessionOffsets: z32.boolean(),
-  leases: z32.boolean(),
-  grantableTokens: z32.boolean().optional(),
-  secretRebind: z32.boolean().optional(),
-  tokenUpdate: z32.boolean().optional(),
-  tokenImageAdd: z32.boolean().optional(),
-  databaseCopy: z32.boolean().optional(),
-  imageOpStream: z32.boolean().optional(),
-  imageBuilds: z32.boolean().optional(),
-  execRequire: z32.boolean().optional(),
-  oauthGrants: z32.boolean().optional(),
-  secretFilesGc: z32.boolean().optional(),
-  sessionLog: z32.boolean().optional(),
-  publicEgress: z32.boolean().optional(),
-  oauthSecrets: z32.boolean().optional(),
-  secretUpstream: z32.boolean().optional(),
-  backupOptOut: z32.boolean().optional(),
-  brokerRefusals: z32.boolean().optional(),
-  grantFilters: z32.boolean().optional(),
-  readOnlyFiles: z32.boolean().optional(),
-  execDropSysAdmin: z32.boolean().optional(),
-  guestScratch: z32.boolean().optional(),
-  imagePins: z32.boolean().optional(),
-  buildContextUpload: z32.boolean().optional()
+var SystemFeaturesSchema = z33.object({
+  sessionOffsets: z33.boolean(),
+  leases: z33.boolean(),
+  grantableTokens: z33.boolean().optional(),
+  secretRebind: z33.boolean().optional(),
+  tokenUpdate: z33.boolean().optional(),
+  tokenImageAdd: z33.boolean().optional(),
+  databaseCopy: z33.boolean().optional(),
+  imageOpStream: z33.boolean().optional(),
+  imageBuilds: z33.boolean().optional(),
+  execRequire: z33.boolean().optional(),
+  oauthGrants: z33.boolean().optional(),
+  secretFilesGc: z33.boolean().optional(),
+  sessionLog: z33.boolean().optional(),
+  publicEgress: z33.boolean().optional(),
+  oauthSecrets: z33.boolean().optional(),
+  secretUpstream: z33.boolean().optional(),
+  secretPresets: z33.boolean().optional(),
+  backupOptOut: z33.boolean().optional(),
+  brokerRefusals: z33.boolean().optional(),
+  grantFilters: z33.boolean().optional(),
+  readOnlyFiles: z33.boolean().optional(),
+  execDropSysAdmin: z33.boolean().optional(),
+  guestScratch: z33.boolean().optional(),
+  imagePins: z33.boolean().optional(),
+  buildContextUpload: z33.boolean().optional()
 });
-var GuestInfoSchema = z32.object({
-  scratchDir: z32.string(),
-  isClearedOnBoot: z32.boolean()
+var GuestInfoSchema = z33.object({
+  scratchDir: z33.string(),
+  isClearedOnBoot: z33.boolean()
 });
-var SystemInfoSchema = z32.object({
-  version: z32.string(),
-  ramBudgetMib: z32.int().nonnegative(),
-  ramUsedMib: z32.int().nonnegative(),
-  ramReservedMib: z32.int().nonnegative(),
-  ramCommittedMib: z32.int().nonnegative(),
-  ramSleepingMib: z32.int().nonnegative().optional(),
-  awakeCount: z32.int().nonnegative(),
-  impCount: z32.int().nonnegative(),
-  sessionCount: z32.int().nonnegative(),
+var SystemInfoSchema = z33.object({
+  version: z33.string(),
+  ramBudgetMib: z33.int().nonnegative(),
+  ramUsedMib: z33.int().nonnegative(),
+  ramReservedMib: z33.int().nonnegative(),
+  ramCommittedMib: z33.int().nonnegative(),
+  ramSleepingMib: z33.int().nonnegative().optional(),
+  awakeCount: z33.int().nonnegative(),
+  impCount: z33.int().nonnegative(),
+  sessionCount: z33.int().nonnegative(),
   bootStatus: BootStatusSchema,
-  firecrackerVersion: z32.string().nullable(),
-  guestKernel: z32.object({ version: z32.string().nullable(), sha256: z32.string() }),
-  systemDrive: z32.object({ sha256: z32.string() }),
+  firecrackerVersion: z33.string().nullable(),
+  guestKernel: z33.object({ version: z33.string().nullable(), sha256: z33.string() }),
+  systemDrive: z33.object({ sha256: z33.string() }),
   guest: GuestInfoSchema.optional(),
-  storage: z32.object({
-    backend: z32.enum(["xfs", "zfs"]),
-    usedBytes: z32.int().nonnegative(),
-    availableBytes: z32.int().nonnegative(),
-    reserveBytes: z32.int().nonnegative(),
-    pendingBytes: z32.int().nonnegative(),
-    isLow: z32.boolean(),
-    impDiskBytes: z32.int().nonnegative()
+  storage: z33.object({
+    backend: z33.enum(["xfs", "zfs"]),
+    usedBytes: z33.int().nonnegative(),
+    availableBytes: z33.int().nonnegative(),
+    reserveBytes: z33.int().nonnegative(),
+    pendingBytes: z33.int().nonnegative(),
+    isLow: z33.boolean(),
+    impDiskBytes: z33.int().nonnegative()
   }),
-  tailscale: z32.object({
-    enabled: z32.boolean(),
-    state: z32.string().nullable(),
-    hostname: z32.string().nullable(),
-    ip: z32.string().nullable(),
+  tailscale: z33.object({
+    enabled: z33.boolean(),
+    state: z33.string().nullable(),
+    hostname: z33.string().nullable(),
+    ip: z33.string().nullable(),
     names: TailnetNamesSchema.nullable()
   }),
-  ksm: z32.object({
-    running: z32.boolean(),
+  ksm: z33.object({
+    running: z33.boolean(),
     sharedMib: CountSchema,
-    profitMib: z32.int(),
+    profitMib: z33.int(),
     zeroMib: CountSchema,
     headroomMib: CountSchema,
     unmergeable: CountSchema
   }).nullable().optional(),
-  rebootReason: z32.string().nullable().optional(),
-  cpu: z32.object({ hostCpus: z32.int().positive(), limitsEnforced: z32.boolean() }).optional(),
-  defaults: z32.object({ memoryMib: z32.int().positive(), image: z32.string().nullable() }).optional(),
-  egress: z32.object({ isEnforced: z32.boolean() }).optional(),
+  rebootReason: z33.string().nullable().optional(),
+  cpu: z33.object({ hostCpus: z33.int().positive(), limitsEnforced: z33.boolean() }).optional(),
+  defaults: z33.object({ memoryMib: z33.int().positive(), image: z33.string().nullable() }).optional(),
+  egress: z33.object({ isEnforced: z33.boolean() }).optional(),
   public: PublicInfoSchema.nullable().optional(),
   https: HttpsInfoSchema.nullable().optional(),
   features: SystemFeaturesSchema.optional()
 });
-var SystemFeaturesInfoSchema = z32.object({
-  version: z32.string(),
+var SystemFeaturesInfoSchema = z33.object({
+  version: z33.string(),
   features: SystemFeaturesSchema
 });
 var SYSTEM_FEATURES = SystemFeaturesSchema.required().parse(Object.fromEntries(SystemFeaturesSchema.keyof().options.map((name) => [name, true])));
@@ -20618,7 +20693,7 @@ var ACCESS = {
 import { oc } from "@orpc/contract";
 
 // packages/api/src/contract/imp-errors.ts
-import * as z33 from "zod";
+import * as z34 from "zod";
 
 // packages/api/src/contract/define-errors.ts
 function defineErrors(errors) {
@@ -20626,7 +20701,7 @@ function defineErrors(errors) {
 }
 
 // packages/api/src/contract/imp-errors.ts
-var ResourceKindSchema = z33.enum([
+var ResourceKindSchema = z34.enum([
   "imp",
   "image",
   "checkpoint",
@@ -20643,22 +20718,22 @@ var ResourceKindSchema = z33.enum([
   "oauth-approval",
   "database-copy"
 ]);
-var ResourceDataSchema = z33.object({
+var ResourceDataSchema = z34.object({
   kind: ResourceKindSchema,
-  name: z33.string(),
-  reason: z33.enum(["binding_changed"]).optional()
+  name: z34.string(),
+  reason: z34.enum(["binding_changed"]).optional()
 });
-var ForbiddenReasonSchema = z33.enum(["imp_out_of_scope", "not_grantable", "scope"]);
-var ForbiddenDataSchema = z33.object({ reason: ForbiddenReasonSchema });
-var PreconditionDataSchema = z33.object({
-  reason: z33.enum(["broker_not_ready", "impd_outdated"]),
-  detail: z33.string()
+var ForbiddenReasonSchema = z34.enum(["imp_out_of_scope", "not_grantable", "scope"]);
+var ForbiddenDataSchema = z34.object({ reason: ForbiddenReasonSchema });
+var PreconditionDataSchema = z34.object({
+  reason: z34.enum(["broker_not_ready", "impd_outdated"]),
+  detail: z34.string()
 });
-var ProtectedImpSchema = z33.object({
+var ProtectedImpSchema = z34.object({
   name: NameSchema,
-  ramMib: z33.int().nonnegative(),
-  leased: z33.boolean(),
-  busy: z33.boolean()
+  ramMib: z34.int().nonnegative(),
+  leased: z34.boolean(),
+  busy: z34.boolean()
 });
 var IMP_ERRORS = defineErrors({
   NOT_FOUND: { message: "Not found", data: ResourceDataSchema },
@@ -20671,22 +20746,22 @@ var IMP_ERRORS = defineErrors({
   RAM_BUDGET_EXCEEDED: {
     message: "Not enough RAM budget, even after sleeping idle imps",
     status: 503,
-    data: z33.object({
-      budgetMib: z33.int().nonnegative(),
-      usedMib: z33.int().nonnegative(),
-      requestedMib: z33.int().nonnegative(),
-      neededMib: z33.int().nonnegative().optional(),
-      protected: z33.array(ProtectedImpSchema).readonly().optional(),
-      protectedHidden: z33.int().nonnegative().optional()
+    data: z34.object({
+      budgetMib: z34.int().nonnegative(),
+      usedMib: z34.int().nonnegative(),
+      requestedMib: z34.int().nonnegative(),
+      neededMib: z34.int().nonnegative().optional(),
+      protected: z34.array(ProtectedImpSchema).readonly().optional(),
+      protectedHidden: z34.int().nonnegative().optional()
     })
   },
   SERVICE_UNAVAILABLE: { message: "impd is stopping" },
   INVALID_STATE: {
     message: "The imp is not in a state that allows this",
     status: 409,
-    data: z33.object({
+    data: z34.object({
       state: ImpStateSchema,
-      allowed: z33.array(ImpStateSchema),
+      allowed: z34.array(ImpStateSchema),
       coldBoots: ColdBootsSchema.optional()
     })
   },
@@ -20698,10 +20773,10 @@ var IMP_ERRORS = defineErrors({
   DISK_FULL: {
     message: "Not enough free disk on the host",
     status: 507,
-    data: z33.object({
-      availableBytes: z33.int().nonnegative(),
-      reserveBytes: z33.int().nonnegative(),
-      requestedBytes: z33.int().nonnegative()
+    data: z34.object({
+      availableBytes: z34.int().nonnegative(),
+      reserveBytes: z34.int().nonnegative(),
+      requestedBytes: z34.int().nonnegative()
     })
   },
   LEASED: {
@@ -20714,7 +20789,7 @@ var IMP_ERRORS = defineErrors({
   MOVING: {
     message: "The imp is moving between hosts",
     status: 409,
-    data: z33.object({ retryAfterS: z33.int().positive() })
+    data: z34.object({ retryAfterS: z34.int().positive() })
   }
 });
 
@@ -20722,73 +20797,73 @@ var IMP_ERRORS = defineErrors({
 var contractBase = oc.$meta({}).errors(IMP_ERRORS);
 
 // packages/api/src/contract/imps-contract.ts
-import * as z39 from "zod";
+import * as z40 from "zod";
 
 // packages/api/src/schemas/cpu-limit-schema.ts
-import * as z34 from "zod";
-var CpuLimitSchema = z34.number().min(0.1);
+import * as z35 from "zod";
+var CpuLimitSchema = z35.number().min(0.1);
 
 // packages/api/src/schemas/cpu-weight-schema.ts
-import * as z35 from "zod";
-var CpuWeightSchema = z35.int().min(1).max(1e4);
+import * as z36 from "zod";
+var CpuWeightSchema = z36.int().min(1).max(1e4);
 
 // packages/api/src/schemas/imp-create-input-schema.ts
-import * as z38 from "zod";
+import * as z39 from "zod";
 
 // packages/api/src/schemas/port-schema.ts
-import * as z36 from "zod";
-var PortSchema = z36.int().min(1).max(65535);
+import * as z37 from "zod";
+var PortSchema = z37.int().min(1).max(65535);
 
 // packages/api/src/schemas/vcpus-schema.ts
-import * as z37 from "zod";
-var VcpusSchema = z37.int().min(1).max(32);
+import * as z38 from "zod";
+var VcpusSchema = z38.int().min(1).max(32);
 
 // packages/api/src/schemas/imp-create-input-schema.ts
-var ImpCreateInputSchema = z38.object({
+var ImpCreateInputSchema = z39.object({
   name: NameSchema.optional(),
   image: NameSchema.optional(),
   vcpus: VcpusSchema.optional(),
-  memoryMib: z38.int().min(128).optional(),
-  maxMemoryMib: z38.int().min(128).optional(),
-  diskMib: z38.int().min(1024).optional(),
+  memoryMib: z39.int().min(128).optional(),
+  maxMemoryMib: z39.int().min(128).optional(),
+  diskMib: z39.int().min(1024).optional(),
   httpPort: PortSchema.optional(),
   policy: EgressPolicySchema.optional(),
   cpuLimit: CpuLimitSchema.nullable().optional(),
   cpuWeight: CpuWeightSchema.optional(),
-  networks: z38.array(NameSchema).max(MAX_CREATE_NETWORKS).optional(),
-  backup: z38.boolean().optional()
+  networks: z39.array(NameSchema).max(MAX_CREATE_NETWORKS).optional(),
+  backup: z39.boolean().optional()
 });
 
 // packages/api/src/contract/imps-contract.ts
-var ForceInputSchema = z39.object({ name: NameSchema, force: z39.boolean().optional() });
+var ForceInputSchema = z40.object({ name: NameSchema, force: z40.boolean().optional() });
 var impsContract = {
   create: contractBase.meta(ACCESS.manageImp).input(ImpCreateInputSchema).output(ImpSchema),
-  list: contractBase.meta(ACCESS.readAny).input(z39.object({ builders: z39.boolean().optional() }).optional()).output(z39.array(ImpSchema)),
+  list: contractBase.meta(ACCESS.readAny).input(z40.object({ builders: z40.boolean().optional() }).optional()).output(z40.array(ImpSchema)),
   get: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(ImpSchema),
   destroy: contractBase.meta(ACCESS.manageImp).input(NameInputSchema).output(EmptySchema),
   start: contractBase.meta(ACCESS.execImp).input(NameInputSchema).output(ImpSchema),
   stop: contractBase.meta(ACCESS.execImp).input(ForceInputSchema).output(ImpSchema),
   sleep: contractBase.meta(ACCESS.execImp).input(ForceInputSchema).output(ImpSchema),
-  wake: contractBase.meta(ACCESS.execImp).input(z39.object({ name: NameSchema, restartError: z39.boolean().optional() })).output(ImpSchema),
-  hold: contractBase.meta(ACCESS.execImp).input(z39.object({ name: NameSchema, seconds: z39.int().nonnegative() })).output(ImpSchema),
-  resizeDisk: contractBase.meta(ACCESS.manageImp).input(z39.object({ name: NameSchema, diskMib: z39.int().min(1024) })).output(ImpSchema),
-  url: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(z39.object({
-    local: z39.url(),
-    https: z39.url().nullable(),
-    public: z39.url().nullable(),
-    service: z39.url().nullable(),
-    tailnet: z39.url().nullable()
+  wake: contractBase.meta(ACCESS.execImp).input(z40.object({ name: NameSchema, restartError: z40.boolean().optional() })).output(ImpSchema),
+  hold: contractBase.meta(ACCESS.execImp).input(z40.object({ name: NameSchema, seconds: z40.int().nonnegative() })).output(ImpSchema),
+  resizeDisk: contractBase.meta(ACCESS.manageImp).input(z40.object({ name: NameSchema, diskMib: z40.int().min(1024) })).output(ImpSchema),
+  url: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(z40.object({
+    local: z40.url(),
+    https: z40.url().nullable(),
+    public: z40.url().nullable(),
+    service: z40.url().nullable(),
+    tailnet: z40.url().nullable()
   })),
   policy: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(EgressPolicySchema),
-  setPolicy: contractBase.meta(ACCESS.manageImp).input(z39.object({ name: NameSchema, policy: EgressPolicySchema })).output(EgressPolicySchema),
+  setPolicy: contractBase.meta(ACCESS.manageImp).input(z40.object({ name: NameSchema, policy: EgressPolicySchema })).output(EgressPolicySchema),
   expose: contractBase.meta(ACCESS.manageHost).input(ExposeInputSchema).output(ExposeResultSchema),
   unexpose: contractBase.meta(ACCESS.manageHost).input(NameInputSchema).output(ImpSchema),
-  fork: contractBase.meta({ access: { scope: "manage", on: "imp", fields: ["source", "name"], noGrantable: true } }).input(z39.object({
+  fork: contractBase.meta({ access: { scope: "manage", on: "imp", fields: ["source", "name"], noGrantable: true } }).input(z40.object({
     source: NameSchema,
     name: NameSchema,
     checkpoint: CheckpointRefSchema.optional()
   })).output(ForkResultSchema),
-  update: contractBase.meta(ACCESS.manageImp).input(z39.object({
+  update: contractBase.meta(ACCESS.manageImp).input(z40.object({
     name: NameSchema,
     cpuLimit: CpuLimitSchema.nullable().optional(),
     cpuWeight: CpuWeightSchema.optional(),
@@ -20798,184 +20873,176 @@ var impsContract = {
 };
 
 // packages/api/src/contract/tokens-contract.ts
-import * as z40 from "zod";
+import * as z41 from "zod";
 var tokensContract = {
-  list: contractBase.meta(ACCESS.manageHost).output(z40.array(TokenSchema)),
-  create: contractBase.meta(ACCESS.manageHost).input(z40.object({
+  list: contractBase.meta(ACCESS.manageHost).output(z41.array(TokenSchema)),
+  create: contractBase.meta(ACCESS.manageHost).input(z41.object({
     name: NameSchema,
     scope: ScopeSchema,
-    imps: z40.array(ImpPatternSchema).min(1).max(32).optional(),
-    sshKeys: z40.array(SshPublicKeySchema).min(1).max(MAX_SSH_KEYS).optional(),
+    imps: z41.array(ImpPatternSchema).min(1).max(32).optional(),
+    sshKeys: z41.array(SshPublicKeySchema).min(1).max(MAX_SSH_KEYS).optional(),
     grantable: GrantableSchema.optional(),
     imageRefPrefix: ImageRefPrefixSchema.optional()
-  })).output(z40.object({ token: TokenSchema, secret: z40.string() })),
-  update: contractBase.meta(ACCESS.manageHost).input(z40.object({
+  })).output(z41.object({ token: TokenSchema, secret: z41.string() })),
+  update: contractBase.meta(ACCESS.manageHost).input(z41.object({
     name: NameSchema,
     grantable: GrantableUpdateSchema.optional(),
     imageRefPrefix: ImageRefPrefixSchema.nullable().optional()
   }).refine((input) => input.grantable !== undefined || input.imageRefPrefix !== undefined, "must set grantable, imageRefPrefix or both")).output(TokenSchema),
   delete: contractBase.meta(ACCESS.manageHost).input(NameInputSchema).output(EmptySchema),
-  addKey: contractBase.meta(ACCESS.manageHost).input(z40.object({ name: NameSchema, key: SshPublicKeySchema })).output(SshKeySchema),
-  removeKey: contractBase.meta(ACCESS.manageHost).input(z40.object({ name: NameSchema, fingerprint: z40.string() })).output(EmptySchema),
+  addKey: contractBase.meta(ACCESS.manageHost).input(z41.object({ name: NameSchema, key: SshPublicKeySchema })).output(SshKeySchema),
+  removeKey: contractBase.meta(ACCESS.manageHost).input(z41.object({ name: NameSchema, fingerprint: z41.string() })).output(EmptySchema),
   whoami: contractBase.meta(ACCESS.readAny).output(IdentitySchema)
 };
 
 // packages/api/src/contract/caller-contract.ts
-var LeaseInputSchema = z41.object({
+var LeaseInputSchema = z42.object({
   name: NameSchema,
   label: LeaseLabelSchema.refine((label) => label !== "hold", "hold is the label imps.hold writes"),
   ttlSeconds: LeaseTtlSchema
 });
-var ImageAddInputSchema = z41.union([
-  z41.object({ ref: ImageRefSchema, name: NameSchema.optional() }),
-  z41.object({ imp: NameSchema, name: NameSchema })
+var ImageAddInputSchema = z42.union([
+  z42.object({ ref: ImageRefSchema, name: NameSchema.optional() }),
+  z42.object({ imp: NameSchema, name: NameSchema })
 ]);
-var ImageBuildInputSchema = z41.object({
-  contextDir: z41.string().startsWith("/"),
+var ImageBuildInputSchema = z42.object({
+  contextDir: z42.string().startsWith("/"),
   name: NameSchema,
   dockerfile: DockerfilePathSchema.optional(),
-  logs: z41.boolean().optional()
+  logs: z42.boolean().optional()
 });
-var ImageBuildStreamInputSchema = z41.union([
+var ImageBuildStreamInputSchema = z42.union([
   ImageBuildInputSchema,
-  z41.object({ upload: z41.string().min(1), logs: z41.boolean().optional() })
+  z42.object({ upload: z42.string().min(1), logs: z42.boolean().optional() })
 ]);
-var CheckpointCreateInputSchema = z41.object({
+var CheckpointCreateInputSchema = z42.object({
   name: NameSchema,
-  label: z41.string().min(1).max(64).optional()
+  label: z42.string().min(1).max(64).optional()
 });
 var callerContract = {
   imps: impsContract,
   leases: {
     acquire: contractBase.meta(ACCESS.execImp).input(LeaseInputSchema).output(LeaseSchema),
     renew: contractBase.meta(ACCESS.execImp).input(LeaseInputSchema).output(LeaseSchema),
-    release: contractBase.meta(ACCESS.execImp).input(z41.object({ name: NameSchema, label: LeaseLabelSchema })).output(z41.object({ released: z41.boolean() })),
-    list: contractBase.meta({ access: { scope: "exec", on: "any", audit: false } }).input(z41.object({ name: NameSchema.optional(), label: LeaseLabelSchema.optional() })).output(z41.array(LeaseSchema))
+    release: contractBase.meta(ACCESS.execImp).input(z42.object({ name: NameSchema, label: LeaseLabelSchema })).output(z42.object({ released: z42.boolean() })),
+    list: contractBase.meta({ access: { scope: "exec", on: "any", audit: false } }).input(z42.object({ name: NameSchema.optional(), label: LeaseLabelSchema.optional() })).output(z42.array(LeaseSchema))
   },
   moves: {
-    prepare: contractBase.meta(ACCESS.manageImpNoGrantable).input(z41.object({
+    prepare: contractBase.meta(ACCESS.manageImpNoGrantable).input(z42.object({
       name: NameSchema,
-      stop: z41.boolean().optional(),
-      force: z41.boolean().optional(),
-      targetStorage: z41.enum(["xfs", "zfs"]).optional(),
+      stop: z42.boolean().optional(),
+      force: z42.boolean().optional(),
+      targetStorage: z42.enum(["xfs", "zfs"]).optional(),
       target: WarmHostSchema.optional()
     })).output(MovePlanSchema),
     facts: contractBase.meta(ACCESS.manageHost).output(WarmHostSchema),
-    receive: contractBase.meta(ACCESS.manageHost).input(z41.object({
+    receive: contractBase.meta(ACCESS.manageHost).input(z42.object({
       name: NameSchema,
-      bytes: z41.int().nonnegative(),
+      bytes: z42.int().nonnegative(),
       warm: WarmMoveSchema.optional()
     })).output(MoveTicketSchema),
-    send: contractBase.meta(ACCESS.manageImpNoGrantable).input(z41.object({ name: NameSchema, to: PeerUrlSchema, ticket: z41.string() })).output(MoveStatusSchema),
-    status: contractBase.meta(ACCESS.readImp).input(z41.object({ name: NameSchema })).output(MoveStatusSchema),
-    reissue: contractBase.meta(ACCESS.manageHost).input(z41.object({ name: NameSchema })).output(MoveTicketSchema),
-    resume: contractBase.meta(ACCESS.manageImpNoGrantable).input(z41.object({ name: NameSchema, ticket: z41.string().optional() })).output(MoveStatusSchema),
-    abort: contractBase.meta(ACCESS.manageImp).input(z41.object({ name: NameSchema })).output(MoveStatusSchema)
+    send: contractBase.meta(ACCESS.manageImpNoGrantable).input(z42.object({ name: NameSchema, to: PeerUrlSchema, ticket: z42.string() })).output(MoveStatusSchema),
+    status: contractBase.meta(ACCESS.readImp).input(z42.object({ name: NameSchema })).output(MoveStatusSchema),
+    reissue: contractBase.meta(ACCESS.manageHost).input(z42.object({ name: NameSchema })).output(MoveTicketSchema),
+    resume: contractBase.meta(ACCESS.manageImpNoGrantable).input(z42.object({ name: NameSchema, ticket: z42.string().optional() })).output(MoveStatusSchema),
+    abort: contractBase.meta(ACCESS.manageImp).input(z42.object({ name: NameSchema })).output(MoveStatusSchema)
   },
   checkpoints: {
     create: contractBase.meta(ACCESS.manageImp).input(CheckpointCreateInputSchema).output(CheckpointSchema),
-    list: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(z41.array(CheckpointSchema)),
-    restore: contractBase.meta(ACCESS.manageImp).input(z41.object({ name: NameSchema, checkpoint: CheckpointRefSchema })).output(ImpSchema),
-    delete: contractBase.meta(ACCESS.manageImp).input(z41.object({ name: NameSchema, checkpoint: CheckpointRefSchema })).output(EmptySchema)
+    list: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(z42.array(CheckpointSchema)),
+    restore: contractBase.meta(ACCESS.manageImp).input(z42.object({ name: NameSchema, checkpoint: CheckpointRefSchema })).output(ImpSchema),
+    delete: contractBase.meta(ACCESS.manageImp).input(z42.object({ name: NameSchema, checkpoint: CheckpointRefSchema })).output(EmptySchema)
   },
   backups: {
     run: contractBase.meta(ACCESS.manageHost).output(BackupRunSchema),
     list: contractBase.meta(ACCESS.readHost).output(BackupStatusSchema),
-    restore: contractBase.meta(ACCESS.manageHost).input(z41.object({
+    restore: contractBase.meta(ACCESS.manageHost).input(z42.object({
       name: NameSchema.optional(),
-      all: z41.boolean().optional(),
-      at: z41.date().optional(),
+      all: z42.boolean().optional(),
+      at: z42.date().optional(),
       as: NameSchema.optional(),
-      merge: z41.boolean().optional()
+      merge: z42.boolean().optional()
     })).output(BackupRestoreSchema),
-    check: contractBase.meta(ACCESS.manageHost).input(z41.object({ subset: BackupCheckSubsetSchema.optional() })).output(EmptySchema)
+    check: contractBase.meta(ACCESS.manageHost).input(z42.object({ subset: BackupCheckSubsetSchema.optional() })).output(EmptySchema)
   },
   images: {
-    list: contractBase.meta(ACCESS.readAny).output(z41.array(ImageSchema)),
+    list: contractBase.meta(ACCESS.readAny).output(z42.array(ImageSchema)),
     add: contractBase.meta(ACCESS.manageImage).input(ImageAddInputSchema).output(ImageSchema),
     build: contractBase.meta(ACCESS.manageHost).input(ImageBuildInputSchema).output(ImageSchema),
     addStream: contractBase.meta({ access: { scope: "manage", on: "image", audit: "refusals" } }).input(ImageAddInputSchema).output(eventIterator(ImageOpEventSchema)),
     buildStream: contractBase.meta({ access: { scope: "manage", on: "host", audit: "refusals" } }).input(ImageBuildStreamInputSchema).output(eventIterator(ImageOpEventSchema)),
-    builds: contractBase.meta(ACCESS.readHost).output(z41.array(ImageBuildRunSchema)),
+    builds: contractBase.meta(ACCESS.readHost).output(z42.array(ImageBuildRunSchema)),
     delete: contractBase.meta(ACCESS.manageHost).input(NameInputSchema).output(EmptySchema),
     pin: contractBase.meta(ACCESS.manageHeldImage).input(NameInputSchema).output(ImageSchema),
     unpin: contractBase.meta(ACCESS.manageHeldImage).input(NameInputSchema).output(ImageSchema)
   },
   exec: {
-    ticket: contractBase.meta({ access: { scope: "exec", on: "imp", fields: ["name"], audit: false } }).input(NameInputSchema).output(z41.object({ ticket: z41.string(), expiresAt: z41.date() }))
+    ticket: contractBase.meta({ access: { scope: "exec", on: "imp", fields: ["name"], audit: false } }).input(NameInputSchema).output(z42.object({ ticket: z42.string(), expiresAt: z42.date() }))
   },
   sessions: {
-    list: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(z41.array(SessionSchema)),
-    kill: contractBase.meta(ACCESS.execImp).input(z41.object({ name: NameSchema, session: SessionNameSchema })).output(EmptySchema),
-    logs: contractBase.meta(ACCESS.readImp).input(SessionLogListInputSchema).output(z41.array(SessionLogSchema)),
+    list: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(z42.array(SessionSchema)),
+    kill: contractBase.meta(ACCESS.execImp).input(z42.object({ name: NameSchema, session: SessionNameSchema })).output(EmptySchema),
+    logs: contractBase.meta(ACCESS.readImp).input(SessionLogListInputSchema).output(z42.array(SessionLogSchema)),
     readLog: contractBase.meta(ACCESS.execImp).input(SessionLogReadInputSchema).output(SessionLogReadSchema),
-    deleteLog: contractBase.meta(ACCESS.execImp).input(SessionLogDeleteInputSchema).output(z41.object({ deleted: z41.int().nonnegative() }))
+    deleteLog: contractBase.meta(ACCESS.execImp).input(SessionLogDeleteInputSchema).output(z42.object({ deleted: z42.int().nonnegative() }))
   },
   services: {
     list: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(ServiceListSchema),
-    add: contractBase.meta(ACCESS.execImp).input(z41.object({
+    add: contractBase.meta(ACCESS.execImp).input(z42.object({
       name: NameSchema,
       service: ServiceDefSchema,
-      replace: z41.boolean().optional()
+      replace: z42.boolean().optional()
     })).output(EmptySchema),
-    remove: contractBase.meta(ACCESS.execImp).input(z41.object({ name: NameSchema, service: ServiceNameSchema })).output(EmptySchema),
-    restart: contractBase.meta(ACCESS.execImp).input(z41.object({ name: NameSchema, service: ServiceNameSchema })).output(EmptySchema),
-    logs: contractBase.meta(ACCESS.execImp).input(z41.object({
+    remove: contractBase.meta(ACCESS.execImp).input(z42.object({ name: NameSchema, service: ServiceNameSchema })).output(EmptySchema),
+    restart: contractBase.meta(ACCESS.execImp).input(z42.object({ name: NameSchema, service: ServiceNameSchema })).output(EmptySchema),
+    logs: contractBase.meta(ACCESS.execImp).input(z42.object({
       name: NameSchema,
       service: ServiceNameSchema.optional(),
-      lines: z41.int().min(0).max(SERVICE_LOG_MAX_LINES).optional(),
-      follow: z41.boolean().optional()
+      lines: z42.int().min(0).max(SERVICE_LOG_MAX_LINES).optional(),
+      follow: z42.boolean().optional()
     })).output(eventIterator(ServiceLogSchema))
   },
   files: {
-    write: contractBase.meta(ACCESS.execImp).input(z41.object({ name: NameSchema, path: FilePathSchema, content: FileContentSchema })).output(z41.object({ path: z41.string() })),
-    remove: contractBase.meta(ACCESS.execImp).input(z41.object({ name: NameSchema, path: FilePathSchema })).output(z41.object({ removed: z41.boolean() }))
+    write: contractBase.meta(ACCESS.execImp).input(z42.object({ name: NameSchema, path: FilePathSchema, content: FileContentSchema })).output(z42.object({ path: z42.string() })),
+    remove: contractBase.meta(ACCESS.execImp).input(z42.object({ name: NameSchema, path: FilePathSchema })).output(z42.object({ removed: z42.boolean() }))
   },
   secrets: {
-    add: contractBase.meta(ACCESS.manageHost).input(z41.object({
-      name: SecretNameSchema,
-      kind: SecretKindSchema,
-      value: SecretValueSchema,
-      rules: z41.array(BrokerRuleSchema).min(1).max(16).optional(),
-      oauth: OAuthConfigSchema.optional(),
-      replace: z41.boolean().optional(),
-      rebind: z41.boolean().optional()
-    })).output(SecretAddedSchema),
-    list: contractBase.meta(ACCESS.readAny).output(z41.array(SecretSchema)),
-    refresh: contractBase.meta(ACCESS.manageHost).input(z41.object({ name: SecretNameSchema })).output(SecretSchema),
-    delete: contractBase.meta(ACCESS.manageHost).input(z41.object({ name: SecretNameSchema })).output(EmptySchema)
+    add: contractBase.meta(ACCESS.manageHost).input(SecretAddSchema).output(SecretAddedSchema),
+    list: contractBase.meta(ACCESS.readAny).output(z42.array(SecretSchema)),
+    refresh: contractBase.meta(ACCESS.manageHost).input(z42.object({ name: SecretNameSchema })).output(SecretSchema),
+    delete: contractBase.meta(ACCESS.manageHost).input(z42.object({ name: SecretNameSchema })).output(EmptySchema)
   },
   networks: {
-    list: contractBase.meta(ACCESS.readAny).output(z41.array(NetworkSchema)),
+    list: contractBase.meta(ACCESS.readAny).output(z42.array(NetworkSchema)),
     create: contractBase.meta(ACCESS.manageHost).input(NameInputSchema).output(NetworkSchema),
     delete: contractBase.meta(ACCESS.manageHost).input(NameInputSchema).output(EmptySchema),
-    join: contractBase.meta(ACCESS.manageHost).input(z41.object({ network: NameSchema, name: NameSchema })).output(NetworkJoinSchema),
-    warnings: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(z41.array(z41.string())),
-    leave: contractBase.meta(ACCESS.manageHost).input(z41.object({ network: NameSchema, name: NameSchema })).output(NetworkSchema)
+    join: contractBase.meta(ACCESS.manageHost).input(z42.object({ network: NameSchema, name: NameSchema })).output(NetworkJoinSchema),
+    warnings: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(z42.array(z42.string())),
+    leave: contractBase.meta(ACCESS.manageHost).input(z42.object({ network: NameSchema, name: NameSchema })).output(NetworkSchema)
   },
   grants: {
-    add: contractBase.meta(ACCESS.manageGrant).input(z41.object({
+    add: contractBase.meta(ACCESS.manageGrant).input(z42.object({
       name: NameSchema,
       secret: SecretNameSchema,
       filter: GrantFilterSchema.optional()
     })).output(EmptySchema),
-    delete: contractBase.meta(ACCESS.manageGrant).input(z41.object({ name: NameSchema, secret: SecretNameSchema })).output(EmptySchema),
-    list: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(z41.array(SecretNameSchema)),
-    details: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(z41.array(GrantSchema))
+    delete: contractBase.meta(ACCESS.manageGrant).input(z42.object({ name: NameSchema, secret: SecretNameSchema })).output(EmptySchema),
+    list: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(z42.array(SecretNameSchema)),
+    details: contractBase.meta(ACCESS.readImp).input(NameInputSchema).output(z42.array(GrantSchema))
   },
   audit: {
-    list: contractBase.meta(ACCESS.readAny).input(z41.object({
+    list: contractBase.meta(ACCESS.readAny).input(z42.object({
       name: NameSchema.optional(),
-      limit: z41.int().min(1).max(1000).optional()
-    })).output(z41.array(AuditEntrySchema)),
-    refused: contractBase.meta(ACCESS.readAny).input(z41.object({
+      limit: z42.int().min(1).max(1000).optional()
+    })).output(z42.array(AuditEntrySchema)),
+    refused: contractBase.meta(ACCESS.readAny).input(z42.object({
       name: NameSchema.optional(),
-      limit: z41.int().min(1).max(1000).optional()
-    })).output(z41.array(RefusedRequestSchema)),
-    calls: contractBase.meta(ACCESS.readAny).input(z41.object({
+      limit: z42.int().min(1).max(1000).optional()
+    })).output(z42.array(RefusedRequestSchema)),
+    calls: contractBase.meta(ACCESS.readAny).input(z42.object({
       name: NameSchema.optional(),
-      limit: z41.int().min(1).max(1000).optional()
-    })).output(z41.array(ApiCallSchema))
+      limit: z42.int().min(1).max(1000).optional()
+    })).output(z42.array(ApiCallSchema))
   },
   events: {
     stream: contractBase.meta(ACCESS.readAny).output(eventIterator(ImpEventSchema))
@@ -20983,40 +21050,40 @@ var callerContract = {
   system: {
     info: contractBase.meta(ACCESS.readAny).output(SystemInfoSchema),
     features: contractBase.meta(ACCESS.readAny).output(SystemFeaturesInfoSchema),
-    gc: contractBase.meta(ACCESS.manageHost).input(z41.object({
-      dryRun: z41.boolean().optional(),
-      orphans: z41.boolean().optional(),
-      secretFiles: z41.boolean().optional(),
-      removeSecretFiles: z41.boolean().optional()
+    gc: contractBase.meta(ACCESS.manageHost).input(z42.object({
+      dryRun: z42.boolean().optional(),
+      orphans: z42.boolean().optional(),
+      secretFiles: z42.boolean().optional(),
+      removeSecretFiles: z42.boolean().optional()
     })).output(StorageGcSchema),
-    copyDatabase: contractBase.meta(ACCESS.manageHost).input(z41.object({ name: NameSchema.optional() })).output(DatabaseCopySchema)
+    copyDatabase: contractBase.meta(ACCESS.manageHost).input(z42.object({ name: NameSchema.optional() })).output(DatabaseCopySchema)
   },
   oauth: {
     clients: {
-      list: contractBase.meta(ACCESS.manageHost).output(z41.array(OAuthClientSchema)),
-      add: contractBase.meta(ACCESS.manageHost).input(z41.object({ name: NameSchema, redirectUris: RedirectUrisSchema })).output(OAuthClientSchema),
-      update: contractBase.meta(ACCESS.manageHost).input(z41.object({ name: NameSchema, redirectUris: RedirectUrisSchema })).output(OAuthClientSchema),
+      list: contractBase.meta(ACCESS.manageHost).output(z42.array(OAuthClientSchema)),
+      add: contractBase.meta(ACCESS.manageHost).input(z42.object({ name: NameSchema, redirectUris: RedirectUrisSchema })).output(OAuthClientSchema),
+      update: contractBase.meta(ACCESS.manageHost).input(z42.object({ name: NameSchema, redirectUris: RedirectUrisSchema })).output(OAuthClientSchema),
       delete: contractBase.meta(ACCESS.manageHost).input(NameInputSchema).output(EmptySchema)
     },
     grants: {
-      list: contractBase.meta(ACCESS.manageHost).output(z41.array(OAuthGrantSchema)),
-      delete: contractBase.meta(ACCESS.manageHost).input(z41.object({ id: z41.string().min(1).max(64) })).output(EmptySchema)
+      list: contractBase.meta(ACCESS.manageHost).output(z42.array(OAuthGrantSchema)),
+      delete: contractBase.meta(ACCESS.manageHost).input(z42.object({ id: z42.string().min(1).max(64) })).output(EmptySchema)
     },
     approvals: {
-      get: contractBase.meta(ACCESS.readAny).input(z41.object({ code: ApprovalCodeSchema })).output(OAuthApprovalSchema),
-      approve: contractBase.meta(ACCESS.readAny).input(z41.object({
+      get: contractBase.meta(ACCESS.readAny).input(z42.object({ code: ApprovalCodeSchema })).output(OAuthApprovalSchema),
+      approve: contractBase.meta(ACCESS.readAny).input(z42.object({
         code: ApprovalCodeSchema,
         scope: ScopeSchema,
-        imps: z41.array(GrantPatternSchema).min(1).max(32).optional()
+        imps: z42.array(GrantPatternSchema).min(1).max(32).optional()
       })).output(EmptySchema)
     }
   },
   tokens: tokensContract
 };
 // packages/api/src/contract/auth-contract.ts
-import * as z42 from "zod";
+import * as z43 from "zod";
 var authContract = {
-  login: contractBase.meta(ACCESS.noSession).errors({ UNAUTHORIZED: { message: "The token authenticates nobody" } }).input(z42.object({ token: z42.string() })).output(EmptySchema),
+  login: contractBase.meta(ACCESS.noSession).errors({ UNAUTHORIZED: { message: "The token authenticates nobody" } }).input(z43.object({ token: z43.string() })).output(EmptySchema),
   logout: contractBase.meta(ACCESS.noSession).output(EmptySchema)
 };
 
@@ -21024,43 +21091,43 @@ var authContract = {
 var sessionContract = { auth: authContract };
 // packages/api/src/contract/collect-procedure-access.ts
 import { isContractProcedure } from "@orpc/contract";
-import * as z44 from "zod";
+import * as z45 from "zod";
 
 // packages/api/src/schemas/procedure-access-schema.ts
-import * as z43 from "zod";
-var FieldsSchema = z43.array(z43.string()).readonly();
-var NoSessionAccessSchema = z43.object({ on: z43.literal("none") });
-var HostAccessSchema = z43.object({
+import * as z44 from "zod";
+var FieldsSchema = z44.array(z44.string()).readonly();
+var NoSessionAccessSchema = z44.object({ on: z44.literal("none") });
+var HostAccessSchema = z44.object({
   scope: ScopeSchema,
-  on: z43.literal("host"),
-  audit: z43.union([z43.literal(false), z43.literal("refusals")]).optional()
+  on: z44.literal("host"),
+  audit: z44.union([z44.literal(false), z44.literal("refusals")]).optional()
 });
-var ImpAccessSchema = z43.object({
+var ImpAccessSchema = z44.object({
   scope: ScopeSchema,
-  on: z43.literal("imp"),
+  on: z44.literal("imp"),
   fields: FieldsSchema,
-  noGrantable: z43.literal(true).optional(),
-  audit: z43.literal(false).optional()
+  noGrantable: z44.literal(true).optional(),
+  audit: z44.literal(false).optional()
 });
-var GrantAccessSchema = z43.object({
+var GrantAccessSchema = z44.object({
   scope: ScopeSchema,
-  on: z43.literal("grant"),
+  on: z44.literal("grant"),
   fields: FieldsSchema,
-  secretField: z43.string(),
-  audit: z43.literal(false).optional()
+  secretField: z44.string(),
+  audit: z44.literal(false).optional()
 });
-var ImageAccessSchema = z43.object({
+var ImageAccessSchema = z44.object({
   scope: ScopeSchema,
-  on: z43.literal("image"),
-  held: z43.literal(true).optional(),
-  audit: z43.union([z43.literal(false), z43.literal("refusals")]).optional()
+  on: z44.literal("image"),
+  held: z44.literal(true).optional(),
+  audit: z44.union([z44.literal(false), z44.literal("refusals")]).optional()
 });
-var AnyAccessSchema = z43.object({
+var AnyAccessSchema = z44.object({
   scope: ScopeSchema,
-  on: z43.literal("any"),
-  audit: z43.literal(false).optional()
+  on: z44.literal("any"),
+  audit: z44.literal(false).optional()
 });
-var ProcedureAccessSchema = z43.discriminatedUnion("on", [
+var ProcedureAccessSchema = z44.discriminatedUnion("on", [
   NoSessionAccessSchema,
   HostAccessSchema,
   ImpAccessSchema,
@@ -21070,7 +21137,7 @@ var ProcedureAccessSchema = z43.discriminatedUnion("on", [
 ]);
 
 // packages/api/src/contract/collect-procedure-access.ts
-var MetaSchema = z44.object({ access: ProcedureAccessSchema });
+var MetaSchema = z45.object({ access: ProcedureAccessSchema });
 function collectProcedureAccess(router, prefix = "") {
   return Object.entries(router).flatMap(([key, value]) => {
     const path = `${prefix}${key}`;
@@ -21128,23 +21195,23 @@ var MOVE_RECEIVE_PATH = "/move/receive";
 import { oc as oc2 } from "@orpc/contract";
 
 // packages/api/src/schemas/move-peer-schema.ts
-import * as z45 from "zod";
-var SystemDriveSchema = z45.string().regex(/^[\da-f]{64}$/v);
-var MoveOfferSchema = z45.object({
-  imageDigest: z45.string(),
-  receivedImageDigest: z45.string().nullable().default(null),
+import * as z46 from "zod";
+var SystemDriveSchema = z46.string().regex(/^[\da-f]{64}$/v);
+var MoveOfferSchema = z46.object({
+  imageDigest: z46.string(),
+  receivedImageDigest: z46.string().nullable().default(null),
   systemDrive: SystemDriveSchema.optional()
 });
-var MoveOfferReplySchema = z45.object({
-  needsImage: z45.boolean(),
-  needsSystemDrive: z45.boolean().default(false),
-  storage: z45.enum(["xfs", "zfs"]),
-  keepsMaxMemory: z45.boolean().default(false),
-  keepsLeases: z45.boolean().default(false),
-  keepsPublicEgress: z45.boolean().default(false),
-  keepsBackupOff: z45.boolean().default(false)
+var MoveOfferReplySchema = z46.object({
+  needsImage: z46.boolean(),
+  needsSystemDrive: z46.boolean().default(false),
+  storage: z46.enum(["xfs", "zfs"]),
+  keepsMaxMemory: z46.boolean().default(false),
+  keepsLeases: z46.boolean().default(false),
+  keepsPublicEgress: z46.boolean().default(false),
+  keepsBackupOff: z46.boolean().default(false)
 });
-var MoveCommitReplySchema = z45.object({ isCommitted: z45.boolean() });
+var MoveCommitReplySchema = z46.object({ isCommitted: z46.boolean() });
 
 // packages/api/src/contract/move-peer-contract.ts
 var movePeerContract = {
@@ -21152,6 +21219,28 @@ var movePeerContract = {
   commit: oc2.route({ method: "POST", path: "/move/commit" }).output(MoveCommitReplySchema),
   abort: oc2.route({ method: "POST", path: "/move/abort" }).output(MoveCommitReplySchema)
 };
+// packages/api/src/schemas/secret-presets.ts
+var SECRET_PRESETS = {
+  github: {
+    kind: "static",
+    rules: [
+      { host: "github.com", header: "authorization", scheme: "basic", user: "x-access-token" },
+      { host: "api.github.com", header: "authorization", scheme: "bearer" },
+      { host: "uploads.github.com", header: "authorization", scheme: "bearer" }
+    ],
+    env: ["GH_TOKEN", "GITHUB_TOKEN"]
+  },
+  anthropic: {
+    kind: "static",
+    rules: [{ host: "api.anthropic.com", header: "x-api-key", scheme: "raw" }],
+    env: ["ANTHROPIC_API_KEY"]
+  },
+  npm: {
+    kind: "static",
+    rules: [{ host: "registry.npmjs.org", header: "authorization", scheme: "bearer" }],
+    env: ["NPM_TOKEN"]
+  }
+};
 // packages/api/src/rules/has-scope.ts
 function hasScope(granted, needed) {
   const grantedRank = ScopeSchema.options.indexOf(granted);
@@ -21159,7 +21248,7 @@ function hasScope(granted, needed) {
   return grantedRank !== -1 && neededRank !== -1 && grantedRank >= neededRank;
 }
 // packages/daemon/src/identity/auth/tailnet-identity.ts
-import * as z46 from "zod";
+import * as z47 from "zod";
 
 // packages/daemon/src/platform/process/ttl-cache.ts
 import { LRUCache } from "lru-cache";
@@ -21173,16 +21262,16 @@ function createTtlCache(options) {
 }
 
 // packages/daemon/src/identity/auth/tailnet-identity.ts
-var TailnetRuleSchema = z46.object({
-  match: z46.string().regex(/^(?:user:\S+|tag:[\w-]+|\*)$/u, "must be user:<login>, tag:<tag> or *"),
+var TailnetRuleSchema = z47.object({
+  match: z47.string().regex(/^(?:user:\S+|tag:[\w-]+|\*)$/u, "must be user:<login>, tag:<tag> or *"),
   scope: ScopeSchema,
-  imps: z46.array(ImpPatternSchema).min(1).readonly().optional()
+  imps: z47.array(ImpPatternSchema).min(1).readonly().optional()
 }).readonly();
-var TailnetRulesSchema = z46.array(TailnetRuleSchema).min(1).readonly();
-var TagsSchema = z46.array(z46.string()).nullable().optional();
-var WhoisSchema = z46.object({
-  Node: z46.object({ Name: z46.string(), Tags: TagsSchema, StableID: z46.string().optional() }),
-  UserProfile: z46.object({ LoginName: z46.string() })
+var TailnetRulesSchema = z47.array(TailnetRuleSchema).min(1).readonly();
+var TagsSchema = z47.array(z47.string()).nullable().optional();
+var WhoisSchema = z47.object({
+  Node: z47.object({ Name: z47.string(), Tags: TagsSchema, StableID: z47.string().optional() }),
+  UserProfile: z47.object({ LoginName: z47.string() })
 });
 var WHOIS_TTL_MS = 60000;
 var MAX_CACHED = 256;
@@ -21305,16 +21394,16 @@ function parseTailnetRules(text) {
   }
   const rules = TailnetRulesSchema.safeParse(json);
   if (!rules.success) {
-    throw new Error(`IMP_TAILNET_IDENTITIES: ${z47.prettifyError(rules.error)}`);
+    throw new Error(`IMP_TAILNET_IDENTITIES: ${z48.prettifyError(rules.error)}`);
   }
   return rules.data;
 }
 
 // packages/daemon/src/identity/oauth/public-mcp-config.ts
-import * as z48 from "zod";
-var PublicMcpEnvSchema = z48.object({
-  IMP_MCP_PUBLIC_URL: z48.string().optional(),
-  IMP_MCP_PUBLIC_PORT: z48.coerce.number().pipe(z48.int().min(1).max(65535)).default(7071)
+import * as z49 from "zod";
+var PublicMcpEnvSchema = z49.object({
+  IMP_MCP_PUBLIC_URL: z49.string().optional(),
+  IMP_MCP_PUBLIC_PORT: z49.coerce.number().pipe(z49.int().min(1).max(65535)).default(7071)
 });
 var LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]"]);
 function parsePublicMcpConfig(env, others, slotPorts) {
@@ -21352,16 +21441,16 @@ function parseOrigin(text) {
 }
 
 // packages/daemon/src/imp-ops/backup/backup-config.ts
-import * as z49 from "zod";
-var CountSchema2 = z49.coerce.number().pipe(z49.int().positive());
+import * as z50 from "zod";
+var CountSchema2 = z50.coerce.number().pipe(z50.int().positive());
 var KEEP_BUCKETS = ["hourly", "daily", "weekly"];
-var BackupEnvSchema = z49.object({
-  IMP_BACKUP_REPOSITORY: z49.string().optional(),
-  IMP_BACKUP_PASSWORD_FILE: z49.string().optional(),
+var BackupEnvSchema = z50.object({
+  IMP_BACKUP_REPOSITORY: z50.string().optional(),
+  IMP_BACKUP_PASSWORD_FILE: z50.string().optional(),
   IMP_BACKUP_INTERVAL_S: CountSchema2.default(21600),
-  IMP_BACKUP_KEEP: z49.string().default("hourly=24,daily=7,weekly=4"),
-  IMP_BACKUP_FORGET: z49.enum(["true", "false"]).default("true"),
-  IMP_BACKUP_DATABASE: z49.enum(["true", "false"]).default("false"),
+  IMP_BACKUP_KEEP: z50.string().default("hourly=24,daily=7,weekly=4"),
+  IMP_BACKUP_FORGET: z50.enum(["true", "false"]).default("true"),
+  IMP_BACKUP_DATABASE: z50.enum(["true", "false"]).default("false"),
   IMP_BACKUP_CPUS: CountSchema2.default(2),
   IMP_BACKUP_MEMORY_MIB: CountSchema2.default(512)
 });
@@ -21442,26 +21531,26 @@ function checkPublicPorts(ports, others, slotPorts) {
 
 // packages/daemon/src/network/https/https-config.ts
 import { existsSync as existsSync3 } from "fs";
-import * as z50 from "zod";
+import * as z51 from "zod";
 var LETS_ENCRYPT_DIRECTORY = "https://acme-v02.api.letsencrypt.org/directory";
-var DomainSchema = z50.string().transform((value) => value.toLowerCase().replace(/\.$/u, "")).pipe(z50.string().regex(/^(?:[a-z\d](?:[a-z\d-]{0,61}[a-z\d])?\.)+[a-z\d](?:[a-z\d-]{0,61}[a-z\d])?$/u, "IMP_DOMAIN must be a domain name such as imp.example.com"));
-var PortSchema2 = z50.coerce.number().pipe(z50.int().min(1).max(65535));
+var DomainSchema = z51.string().transform((value) => value.toLowerCase().replace(/\.$/u, "")).pipe(z51.string().regex(/^(?:[a-z\d](?:[a-z\d-]{0,61}[a-z\d])?\.)+[a-z\d](?:[a-z\d-]{0,61}[a-z\d])?$/u, "IMP_DOMAIN must be a domain name such as imp.example.com"));
+var PortSchema2 = z51.coerce.number().pipe(z51.int().min(1).max(65535));
 var DNS_PROVIDERS = ["cloudflare", "challtestsrv"];
-var HttpsEnvSchema = z50.object({
+var HttpsEnvSchema = z51.object({
   IMP_DOMAIN: DomainSchema.optional(),
   IMP_HTTPS_PORT: PortSchema2.default(443),
   IMP_HTTP_PORT: PortSchema2.default(80),
-  IMP_DNS_PROVIDER: z50.enum(DNS_PROVIDERS).optional(),
-  IMP_DNS_API_TOKEN: z50.string().optional(),
-  IMP_DNS_API_TOKEN_FILE: z50.string().optional(),
-  IMP_DNS_API_URL: z50.url().optional(),
-  IMP_ACME_DIRECTORY: z50.url().default(LETS_ENCRYPT_DIRECTORY),
-  IMP_ACME_EMAIL: z50.email().optional(),
-  IMP_ACME_CA_FILE: z50.string().optional(),
-  IMP_PUBLIC_IP: z50.ipv4().optional(),
+  IMP_DNS_PROVIDER: z51.enum(DNS_PROVIDERS).optional(),
+  IMP_DNS_API_TOKEN: z51.string().optional(),
+  IMP_DNS_API_TOKEN_FILE: z51.string().optional(),
+  IMP_DNS_API_URL: z51.url().optional(),
+  IMP_ACME_DIRECTORY: z51.url().default(LETS_ENCRYPT_DIRECTORY),
+  IMP_ACME_EMAIL: z51.email().optional(),
+  IMP_ACME_CA_FILE: z51.string().optional(),
+  IMP_PUBLIC_IP: z51.ipv4().optional(),
   IMP_PUBLIC_HTTPS_PORT: PortSchema2.default(7443),
   IMP_PUBLIC_HTTP_PORT: PortSchema2.default(7480),
-  IMP_E2E: z50.literal("1").optional()
+  IMP_E2E: z51.literal("1").optional()
 });
 function readHttpsConfig(env) {
   if (env.IMP_DNS_API_TOKEN !== undefined && env.IMP_DNS_API_TOKEN_FILE !== undefined) {
@@ -21556,12 +21645,12 @@ function checkSecureUrl(url) {
 
 // packages/daemon/src/network/tailnet-names/tailnet-names-config.ts
 import { join as join3 } from "path";
-import * as z51 from "zod";
-var PrefixSchema = z51.string().regex(/^[a-z][a-z\d-]{0,20}$/u, "IMP_TAILNET_NAME_PREFIX must be a lowercase letter followed by up to 20 letters, digits or hyphens");
-var TailnetNamesEnvSchema = z51.object({
-  IMP_TAILNET_NAMES: z51.literal("1").optional(),
+import * as z52 from "zod";
+var PrefixSchema = z52.string().regex(/^[a-z][a-z\d-]{0,20}$/u, "IMP_TAILNET_NAME_PREFIX must be a lowercase letter followed by up to 20 letters, digits or hyphens");
+var TailnetNamesEnvSchema = z52.object({
+  IMP_TAILNET_NAMES: z52.literal("1").optional(),
   IMP_TAILNET_NAME_PREFIX: PrefixSchema.optional(),
-  IMP_TAILNET_OAUTH_FILE: z51.string().optional()
+  IMP_TAILNET_OAUTH_FILE: z52.string().optional()
 });
 function parseTailnetNamesConfig(env, dataDir, isOnTailnet) {
   if (env.IMP_TAILNET_NAMES === undefined) {
@@ -21577,33 +21666,33 @@ function parseTailnetNamesConfig(env, dataDir, isOnTailnet) {
 }
 
 // packages/daemon/src/config.ts
-var PortSchema3 = z52.coerce.number().pipe(z52.int().min(1).max(65535));
-var CountSchema3 = z52.coerce.number().pipe(z52.int().positive());
-var DnsServersSchema = z52.array(z52.ipv4()).min(1);
-var PercentSchema = z52.coerce.number().pipe(z52.int().min(0).max(100));
-var MarkSchema = z52.coerce.number().pipe(z52.int().min(1).max(99));
-var EnvSchema = z52.object({
-  IMP_DATA_DIR: z52.string().default("/var/lib/imp"),
+var PortSchema3 = z53.coerce.number().pipe(z53.int().min(1).max(65535));
+var CountSchema3 = z53.coerce.number().pipe(z53.int().positive());
+var DnsServersSchema = z53.array(z53.ipv4()).min(1);
+var PercentSchema = z53.coerce.number().pipe(z53.int().min(0).max(100));
+var MarkSchema = z53.coerce.number().pipe(z53.int().min(1).max(99));
+var EnvSchema = z53.object({
+  IMP_DATA_DIR: z53.string().default("/var/lib/imp"),
   IMP_API_PORT: PortSchema3.default(7070),
   IMP_PROXY_PORT: PortSchema3.default(7080),
   IMP_PORT_BASE: PortSchema3.default(20000),
-  IMP_SSH_PORT: z52.coerce.number().pipe(z52.int().min(0).max(65535)).default(22),
-  IMP_SSH_AUTHORIZED_KEYS: z52.enum(["true", "false"]).default("true"),
+  IMP_SSH_PORT: z53.coerce.number().pipe(z53.int().min(0).max(65535)).default(22),
+  IMP_SSH_AUTHORIZED_KEYS: z53.enum(["true", "false"]).default("true"),
   IMP_BROKER_PORT: PortSchema3.default(7081),
-  IMP_BROKER_TEST_UPSTREAMS: z52.string().optional(),
+  IMP_BROKER_TEST_UPSTREAMS: z53.string().optional(),
   IMP_EGRESS_DNS_PORT: PortSchema3.default(7053),
-  IMP_EGRESS_DENY: z52.string().default(""),
-  IMP_HOST_ADDRESSES: z52.string().default(""),
+  IMP_EGRESS_DENY: z53.string().default(""),
+  IMP_HOST_ADDRESSES: z53.string().default(""),
   IMP_RAM_BUDGET_MIB: CountSchema3.default(16384),
   IMP_IDLE_TIMEOUT_S: CountSchema3.default(60),
-  IMP_IDLE_CPU_PERCENT: z52.coerce.number().nonnegative().default(10),
+  IMP_IDLE_CPU_PERCENT: z53.coerce.number().nonnegative().default(10),
   IMP_MEMORY_SHRINK_AFTER_S: CountSchema3.default(60),
-  IMP_BOOT_RESERVE_PERCENT: CountSchema3.pipe(z52.int().max(100)).default(50),
+  IMP_BOOT_RESERVE_PERCENT: CountSchema3.pipe(z53.int().max(100)).default(50),
   IMP_WAKE_RESERVE_MIB: CountSchema3.default(256),
-  IMP_SLEEP_MIN_GUEST_UPTIME_MS: z52.coerce.number().pipe(z52.int().nonnegative()).default(1500),
-  IMP_BOOT_TEMPLATES: z52.enum(["true", "false"]).default("true"),
+  IMP_SLEEP_MIN_GUEST_UPTIME_MS: z53.coerce.number().pipe(z53.int().nonnegative()).default(1500),
+  IMP_BOOT_TEMPLATES: z53.enum(["true", "false"]).default("true"),
   IMP_WATCHDOG_TIMEOUT_S: CountSchema3.default(60),
-  IMP_WATCHDOG_ACTION: z52.enum(["report", "restart", "snapshot"]).default("report"),
+  IMP_WATCHDOG_ACTION: z53.enum(["report", "restart", "snapshot"]).default("report"),
   IMP_DEFAULT_VCPUS: CountSchema3.default(2),
   IMP_DEFAULT_MEMORY_MIB: CountSchema3.default(2048),
   IMP_DEFAULT_DISK_GIB: CountSchema3.default(32),
@@ -21613,38 +21702,38 @@ var EnvSchema = z52.object({
   IMP_BUILD_DISK_GIB: CountSchema3.default(20),
   IMP_BUILD_IMAGE_MAX_MIB: CountSchema3.default(8192),
   IMP_BUILD_IMAGE_MAX_FILES: CountSchema3.default(1e6),
-  IMP_BUILD_IMAGE: z52.string().regex(BUILD_IMAGE_PATTERN, "must name an image by digest, <ref>@sha256:<hex>").default(DEFAULT_BUILD_IMAGE),
-  IMP_BUILD_TEST_REGISTRY: z52.string().regex(/^[a-z0-9][a-z0-9.\-]*:\d+$/v, "must be <name>:<port>").optional(),
-  IMP_BUILD_TEST_REGISTRY_CA: z52.string().optional(),
+  IMP_BUILD_IMAGE: z53.string().regex(BUILD_IMAGE_PATTERN, "must name an image by digest, <ref>@sha256:<hex>").default(DEFAULT_BUILD_IMAGE),
+  IMP_BUILD_TEST_REGISTRY: z53.string().regex(/^[a-z0-9][a-z0-9.\-]*:\d+$/v, "must be <name>:<port>").optional(),
+  IMP_BUILD_TEST_REGISTRY_CA: z53.string().optional(),
   IMP_IMAGE_EVICT_HIGH_PERCENT: MarkSchema.optional(),
   IMP_IMAGE_EVICT_LOW_PERCENT: MarkSchema.optional(),
   IMP_SESSION_LOG_MAX_MIB: CountSchema3.default(16),
   IMP_SESSION_LOG_IMP_MAX_MIB: CountSchema3.default(64),
   IMP_SESSION_LOG_IMP_MAX_LIVE: CountSchema3.default(8),
   IMP_SESSION_LOG_MAX_AGE_DAYS: CountSchema3.default(7),
-  DOCKER_HOST: z52.string().optional(),
-  IMP_KSM: z52.enum(["0", "1"]).default("0"),
-  IMP_KSM_EXEC: z52.string().default("ksm-exec"),
-  IMP_KSM_HEADROOM_PERCENT: z52.string().default("100"),
-  IMP_DNS: z52.string().default("1.1.1.1,8.8.8.8").transform(splitList).pipe(DnsServersSchema),
-  IMP_SUBNET: z52.cidrv4().default("10.66.0.0/16"),
-  IMP_SUBNET6: z52.string().default("auto"),
-  IMP_FIRECRACKER_BIN: z52.string().default("firecracker"),
-  IMP_JAILER: z52.enum(["true", "false"]).default("true"),
-  IMP_JAILER_BIN: z52.string().default("jailer"),
-  IMP_KERNEL: z52.string().optional(),
-  IMP_SYSTEM_DRIVE: z52.string().optional(),
-  IMP_DEFAULT_IMAGE: z52.string().default("base"),
-  IMP_STORAGE_BACKEND: z52.enum(["xfs", "zfs"]).default("xfs"),
-  IMP_ZFS_ROOT: z52.string().optional(),
-  IMP_ZFS_ALLOW_UIOMOVE_BUG: z52.enum(["0", "1"]).default("0"),
-  TAILSCALE_AUTHKEY: z52.string().optional(),
-  IMP_TAILSCALE_NODE: z52.literal("1").optional(),
-  IMP_TAILSCALE_HOSTNAME: z52.string().default("imp"),
-  IMP_DASHBOARD_DIR: z52.string().optional(),
-  IMP_TAILNET_IDENTITIES: z52.string().optional(),
-  IMP_PEER_URL: z52.url().optional(),
-  IMP_MOVE_TEST_CIDR: z52.cidrv4().optional(),
+  DOCKER_HOST: z53.string().optional(),
+  IMP_KSM: z53.enum(["0", "1"]).default("0"),
+  IMP_KSM_EXEC: z53.string().default("ksm-exec"),
+  IMP_KSM_HEADROOM_PERCENT: z53.string().default("100"),
+  IMP_DNS: z53.string().default("1.1.1.1,8.8.8.8").transform(splitList).pipe(DnsServersSchema),
+  IMP_SUBNET: z53.cidrv4().default("10.66.0.0/16"),
+  IMP_SUBNET6: z53.string().default("auto"),
+  IMP_FIRECRACKER_BIN: z53.string().default("firecracker"),
+  IMP_JAILER: z53.enum(["true", "false"]).default("true"),
+  IMP_JAILER_BIN: z53.string().default("jailer"),
+  IMP_KERNEL: z53.string().optional(),
+  IMP_SYSTEM_DRIVE: z53.string().optional(),
+  IMP_DEFAULT_IMAGE: z53.string().default("base"),
+  IMP_STORAGE_BACKEND: z53.enum(["xfs", "zfs"]).default("xfs"),
+  IMP_ZFS_ROOT: z53.string().optional(),
+  IMP_ZFS_ALLOW_UIOMOVE_BUG: z53.enum(["0", "1"]).default("0"),
+  TAILSCALE_AUTHKEY: z53.string().optional(),
+  IMP_TAILSCALE_NODE: z53.literal("1").optional(),
+  IMP_TAILSCALE_HOSTNAME: z53.string().default("imp"),
+  IMP_DASHBOARD_DIR: z53.string().optional(),
+  IMP_TAILNET_IDENTITIES: z53.string().optional(),
+  IMP_PEER_URL: z53.url().optional(),
+  IMP_MOVE_TEST_CIDR: z53.cidrv4().optional(),
   ...HttpsEnvSchema.shape,
   ...TailnetNamesEnvSchema.shape,
   ...PublicMcpEnvSchema.shape
@@ -21862,7 +21951,7 @@ import { join as join46 } from "path";
 // packages/daemon/package.json
 var package_default = {
   name: "@impz/daemon",
-  version: "4.2.5",
+  version: "5.0.0",
   private: true,
   description: "impd: the imp host daemon",
   type: "module",
@@ -22605,10 +22694,10 @@ import { Database } from "bun:sqlite";
 import { chmodSync, closeSync, mkdirSync as mkdirSync3, openSync, rmSync, statSync } from "fs";
 import { join as join5 } from "path";
 import { sql as sql2 } from "kysely";
-import * as z53 from "zod";
-var MigrationRowSchema = z53.object({ name: z53.string() });
-var IntegrityRowSchema = z53.object({ integrity_check: z53.string() });
-var SizeRowSchema = z53.object({ bytes: z53.int().nonnegative() });
+import * as z54 from "zod";
+var MigrationRowSchema = z54.object({ name: z54.string() });
+var IntegrityRowSchema = z54.object({ integrity_check: z54.string() });
+var SizeRowSchema = z54.object({ bytes: z54.int().nonnegative() });
 async function writeConsistentCopy(db, path) {
   await sql2`VACUUM INTO ${path}`.execute(db);
 }
@@ -22901,17 +22990,17 @@ function readFileState(path, stamp) {
 
 // packages/daemon/src/platform/db/secrets.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import * as z56 from "zod";
+import * as z57 from "zod";
 
 // packages/daemon/src/platform/db/tokens.ts
-import * as z55 from "zod";
+import * as z56 from "zod";
 
 // packages/daemon/src/platform/db/imps-schema.ts
-import * as z54 from "zod";
-var ImpsSchema = z54.array(z54.string()).nullable();
+import * as z55 from "zod";
+var ImpsSchema = z55.array(z55.string()).nullable();
 
 // packages/daemon/src/platform/db/tokens.ts
-var GrantableSchema2 = z55.array(z55.object({ name: z55.string(), generation: z55.string() }));
+var GrantableSchema2 = z56.array(z56.object({ name: z56.string(), generation: z56.string() }));
 async function listTokenRecords(db) {
   const rows = await db.selectFrom("tokens").selectAll().orderBy("name").execute();
   return rows.map((row) => toTokenRecord(row));
@@ -23017,12 +23106,14 @@ function toTokenSshKeyRecord(row) {
 }
 
 // packages/daemon/src/platform/db/secrets.ts
-var RulesSchema = z56.array(BrokerRuleSchema);
+var RulesSchema = z57.array(BrokerRuleSchema);
+var EnvSchema2 = z57.array(z57.string());
 async function createSecret(db, secret) {
   const row = await db.insertInto("secrets").values({
     name: secret.name,
     kind: secret.kind,
     rules: JSON.stringify(secret.rules),
+    env: JSON.stringify(secret.env ?? []),
     oauth: formatOAuthConfig(secret.oauth),
     generation: createGeneration(),
     value_file: secret.valueFile,
@@ -23051,6 +23142,7 @@ function upsertSecret(db, secret, rebind) {
     const row = await trx.updateTable("secrets").set({
       kind: secret.kind,
       rules: JSON.stringify(secret.rules),
+      env: JSON.stringify(secret.env ?? []),
       oauth: formatOAuthConfig(secret.oauth),
       value_file: secret.valueFile,
       ...!isRotation && { generation: createGeneration() }
@@ -23143,6 +23235,7 @@ async function listGrantedRules(db, impId) {
     "secrets.name",
     "secrets.kind",
     "secrets.rules",
+    "secrets.env",
     "secrets.value_file",
     "grants.filter"
   ]).where("grants.imp_id", "=", impId).orderBy("secrets.name").execute();
@@ -23150,6 +23243,7 @@ async function listGrantedRules(db, impId) {
     secretName: row.name,
     kind: parseKind(row.kind),
     rule,
+    env: parseEnv(row.env),
     valueFile: row.value_file,
     filter: parseFilter(row.filter)
   })));
@@ -23222,6 +23316,7 @@ function toSecretRecord(row) {
     name: row.name,
     kind: parseKind(row.kind),
     rules: parseRules(row.rules),
+    env: parseEnv(row.env),
     oauth: parseOAuth(row.oauth),
     generation: row.generation,
     valueFile: row.value_file,
@@ -23231,6 +23326,9 @@ function toSecretRecord(row) {
 function parseRules(json) {
   return RulesSchema.parse(JSON.parse(json));
 }
+function parseEnv(json) {
+  return EnvSchema2.parse(JSON.parse(json));
+}
 function parseFilter(json) {
   return json === null ? null : GrantFilterSchema.parse(JSON.parse(json));
 }
@@ -23867,7 +23965,7 @@ function findBadFieldValue(field, value) {
   return isGood ? undefined : name;
 }
 // packages/agent-protocol/src/frame-codec.ts
-import * as z57 from "zod";
+import * as z58 from "zod";
 var FRAME_TYPES = {
   request: 1,
   response: 2,
@@ -23933,7 +24031,7 @@ function buildFrameDecoder() {
   return { push: decodeChunk, end: checkEnded };
 }
 function decodeJsonPayload(frame) {
-  return z57.json().parse(JSON.parse(new TextDecoder().decode(frame.payload)));
+  return z58.json().parse(JSON.parse(new TextDecoder().decode(frame.payload)));
 }
 function mergeBytes2(left, right) {
   if (left.byteLength === 0) {
@@ -25315,7 +25413,7 @@ function toLeaseRecord(row) {
 // packages/daemon/src/vm/sleep/snapshot-meta.ts
 import { existsSync as existsSync4, rmSync as rmSync4 } from "fs";
 import { toJson as toJson3 } from "@bufbuild/protobuf";
-import * as z59 from "zod";
+import * as z60 from "zod";
 
 // packages/daemon/src/platform/process/write-file-durably.ts
 import {
@@ -25406,11 +25504,11 @@ function writeToDisk(paths, sync = fsyncSync) {
 import { isMessage } from "@bufbuild/protobuf";
 
 // packages/daemon/src/vm/agent-client/agent-ids.ts
-import * as z58 from "zod";
+import * as z59 from "zod";
 var AgentGenerationSchema = ExecutionGenerationSchema;
 var AgentSessionNameSchema = SessionNameSchema;
-var AgentBootIdSchema = z58.string().regex(/^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})?$/u);
-var AgentLogIdentitySchema = z58.object({
+var AgentBootIdSchema = z59.string().regex(/^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})?$/u);
+var AgentLogIdentitySchema = z59.object({
   generation: AgentGenerationSchema,
   session: AgentSessionNameSchema,
   bootId: AgentBootIdSchema
@@ -25486,20 +25584,20 @@ function findCpuChange(snapshot, host) {
 }
 
 // packages/daemon/src/vm/sleep/snapshot-meta.ts
-var SnapshotIdentitySchema = z59.object({
-  firecrackerVersion: z59.string(),
-  snapshotVersion: z59.string(),
-  hostKernel: z59.string(),
-  guestKernel: z59.string(),
-  systemDrive: z59.string(),
-  systemDrivePath: z59.string().optional(),
-  agentVersion: z59.string().optional(),
-  ipv6Prefix: z59.string().nullable().optional(),
-  cpuModel: z59.string().optional(),
-  cpuFlags: z59.string().optional()
+var SnapshotIdentitySchema = z60.object({
+  firecrackerVersion: z60.string(),
+  snapshotVersion: z60.string(),
+  hostKernel: z60.string(),
+  guestKernel: z60.string(),
+  systemDrive: z60.string(),
+  systemDrivePath: z60.string().optional(),
+  agentVersion: z60.string().optional(),
+  ipv6Prefix: z60.string().nullable().optional(),
+  cpuModel: z60.string().optional(),
+  cpuFlags: z60.string().optional()
 });
 var AGENT_RECORD_JSON = { useProtoFieldName: true, alwaysEmitImplicit: true };
-var SeenSessionJsonSchema = z59.json().transform((json, ctx) => {
+var SeenSessionJsonSchema = z60.json().transform((json, ctx) => {
   try {
     if (typeof json !== "object" || json === null || Array.isArray(json)) {
       throw new Error("a session is a JSON object");
@@ -25512,23 +25610,23 @@ var SeenSessionJsonSchema = z59.json().transform((json, ctx) => {
     return typeof observed === "number" ? { ...session, observedUnixMs: observed } : session;
   } catch (error) {
     ctx.addIssue({ code: "custom", message: String(error) });
-    return z59.NEVER;
+    return z60.NEVER;
   }
 });
-var ServicesListJsonSchema = z59.json().transform((json, ctx) => {
+var ServicesListJsonSchema = z60.json().transform((json, ctx) => {
   try {
     return decodeAgentMessage(ServicesListSchema, json);
   } catch (error) {
     ctx.addIssue({ code: "custom", message: String(error) });
-    return z59.NEVER;
+    return z60.NEVER;
   }
 });
 var SnapshotMetaSchema = SnapshotIdentitySchema.extend({
-  createdAt: z59.int(),
-  memoryMib: z59.int(),
-  ramMib: z59.int().nonnegative(),
-  pluggedMib: z59.int().nonnegative().optional(),
-  sessions: z59.array(SeenSessionJsonSchema).readonly().optional(),
+  createdAt: z60.int(),
+  memoryMib: z60.int(),
+  ramMib: z60.int().nonnegative(),
+  pluggedMib: z60.int().nonnegative().optional(),
+  sessions: z60.array(SeenSessionJsonSchema).readonly().optional(),
   services: ServicesListJsonSchema.optional()
 });
 function buildSnapshotIdentity(vm, host) {
@@ -25655,19 +25753,19 @@ function countSessions(context, imp) {
 // packages/daemon/src/vm/sleep/vm-identity.ts
 import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
 import { release } from "os";
-import * as z60 from "zod";
-var VmIdentitySchema = z60.object({
-  firecrackerVersion: z60.string(),
-  snapshotVersion: z60.string(),
-  hostKernel: z60.string(),
-  guestKernel: z60.string(),
-  systemDrive: z60.string(),
-  systemDrivePath: z60.string(),
-  agentVersion: z60.string(),
-  bootReason: z60.string().nullable(),
-  ipv6Prefix: z60.string().nullable().optional(),
-  cpuModel: z60.string().optional(),
-  cpuFlags: z60.string().optional()
+import * as z61 from "zod";
+var VmIdentitySchema = z61.object({
+  firecrackerVersion: z61.string(),
+  snapshotVersion: z61.string(),
+  hostKernel: z61.string(),
+  guestKernel: z61.string(),
+  systemDrive: z61.string(),
+  systemDrivePath: z61.string(),
+  agentVersion: z61.string(),
+  bootReason: z61.string().nullable(),
+  ipv6Prefix: z61.string().nullable().optional(),
+  cpuModel: z61.string().optional(),
+  cpuFlags: z61.string().optional()
 });
 function readHostIdentity(firecrackerBin, systemFiles, ipv6Prefix = null) {
   return {
@@ -25982,7 +26080,7 @@ import {
   writeFileSync as writeFileSync2
 } from "fs";
 import { dirname as dirname6, join as join9 } from "path";
-import * as z64 from "zod";
+import * as z65 from "zod";
 
 // packages/daemon/src/platform/process/require-within.ts
 async function requireWithin(promise, durationMs, buildError, startTimer = startRealTimer) {
@@ -26294,43 +26392,43 @@ function buildKeyedMutex() {
 import { Database as Database2 } from "bun:sqlite";
 import { mkdirSync as mkdirSync4, rmSync as rmSync5 } from "fs";
 import { dirname as dirname4 } from "path";
-import * as z61 from "zod";
-var CopyImpSchema = z61.object({
-  id: z61.string(),
-  name: z61.string(),
-  imageId: z61.string(),
-  state: z61.string(),
-  vcpus: z61.int(),
-  memoryMib: z61.int(),
-  maxMemoryMib: z61.int().nullable(),
-  httpPort: z61.int(),
-  egressPolicy: z61.string(),
-  diskBytes: z61.int(),
-  egressAllow: z61.string(),
-  identityResetPending: z61.int(),
-  backup: z61.int()
+import * as z62 from "zod";
+var CopyImpSchema = z62.object({
+  id: z62.string(),
+  name: z62.string(),
+  imageId: z62.string(),
+  state: z62.string(),
+  vcpus: z62.int(),
+  memoryMib: z62.int(),
+  maxMemoryMib: z62.int().nullable(),
+  httpPort: z62.int(),
+  egressPolicy: z62.string(),
+  diskBytes: z62.int(),
+  egressAllow: z62.string(),
+  identityResetPending: z62.int(),
+  backup: z62.int()
 });
-var CopyGrantSchema = z61.object({
-  impId: z61.string(),
-  secretName: z61.string(),
-  filter: z61.string().nullable().transform((json) => json === null ? null : GrantFilterSchema.parse(JSON.parse(json)))
+var CopyGrantSchema = z62.object({
+  impId: z62.string(),
+  secretName: z62.string(),
+  filter: z62.string().nullable().transform((json) => json === null ? null : GrantFilterSchema.parse(JSON.parse(json)))
 });
-var CopyMemberSchema = z61.object({ impId: z61.string(), network: z61.string() });
-var CopyCheckpointSchema = z61.object({
-  id: z61.string(),
-  impId: z61.string(),
-  label: z61.string().nullable(),
-  createdAt: z61.int(),
-  diskBytes: z61.int()
+var CopyMemberSchema = z62.object({ impId: z62.string(), network: z62.string() });
+var CopyCheckpointSchema = z62.object({
+  id: z62.string(),
+  impId: z62.string(),
+  label: z62.string().nullable(),
+  createdAt: z62.int(),
+  diskBytes: z62.int()
 });
-var CopyImageSchema = z61.object({
-  id: z61.string(),
-  name: z61.string(),
-  ref: z61.string(),
-  digest: z61.string(),
+var CopyImageSchema = z62.object({
+  id: z62.string(),
+  name: z62.string(),
+  ref: z62.string(),
+  digest: z62.string(),
   source: ImageSourceSchema,
-  sourceImp: z61.string().nullable(),
-  sizeBytes: z61.int()
+  sourceImp: z62.string().nullable(),
+  sizeBytes: z62.int()
 });
 async function readDatabaseCopy(db, path) {
   mkdirSync4(dirname4(path), { recursive: true });
@@ -26351,11 +26449,11 @@ async function readDatabaseCopy(db, path) {
     const members = copy.query(`SELECT network_members.imp_id AS impId, networks.name AS network FROM network_members
            JOIN networks ON networks.id = network_members.network_id ORDER BY networks.name`).all();
     return {
-      imps: z61.array(CopyImpSchema).parse(imps),
-      grants: z61.array(CopyGrantSchema).parse(grants),
-      members: z61.array(CopyMemberSchema).parse(members),
-      checkpoints: z61.array(CopyCheckpointSchema).parse(checkpoints),
-      images: z61.array(CopyImageSchema).parse(images)
+      imps: z62.array(CopyImpSchema).parse(imps),
+      grants: z62.array(CopyGrantSchema).parse(grants),
+      members: z62.array(CopyMemberSchema).parse(members),
+      checkpoints: z62.array(CopyCheckpointSchema).parse(checkpoints),
+      images: z62.array(CopyImageSchema).parse(images)
     };
   } finally {
     copy.close();
@@ -26363,7 +26461,7 @@ async function readDatabaseCopy(db, path) {
 }
 
 // packages/daemon/src/imp-ops/backup/restic.ts
-import * as z62 from "zod";
+import * as z63 from "zod";
 var BACKUP_TAG = "imp-backup";
 var RESTIC_HOST = "impd";
 var NO_REPOSITORY_EXIT = 10;
@@ -26371,20 +26469,20 @@ var LOCKED_EXIT = 11;
 var RETRY_LOCK = "2m";
 var LOCK_HOLDER = /locked.* by PID /v;
 var NO_SNAPSHOT = "no matching ID found";
-var SnapshotSchema = z62.object({
-  id: z62.string(),
-  time: z62.coerce.date(),
-  paths: z62.array(z62.string()),
-  tags: z62.array(z62.string()).nullish()
+var SnapshotSchema = z63.object({
+  id: z63.string(),
+  time: z63.coerce.date(),
+  paths: z63.array(z63.string()),
+  tags: z63.array(z63.string()).nullish()
 });
-var ExitErrorSchema = z62.object({ message_type: z62.literal("exit_error"), message: z62.string() });
-var SummarySchema = z62.object({
-  message_type: z62.literal("summary"),
-  snapshot_id: z62.string(),
-  files_new: z62.number(),
-  files_changed: z62.number(),
-  files_unmodified: z62.number(),
-  data_added: z62.number()
+var ExitErrorSchema = z63.object({ message_type: z63.literal("exit_error"), message: z63.string() });
+var SummarySchema = z63.object({
+  message_type: z63.literal("summary"),
+  snapshot_id: z63.string(),
+  files_new: z63.number(),
+  files_changed: z63.number(),
+  files_unmodified: z63.number(),
+  data_added: z63.number()
 });
 
 class ResticError extends Error {
@@ -26488,7 +26586,7 @@ function createRestic(deps) {
   };
 }
 function parseSnapshots(stdout) {
-  const parsed = z62.array(SnapshotSchema).parse(JSON.parse(stdout || "[]"));
+  const parsed = z63.array(SnapshotSchema).parse(JSON.parse(stdout || "[]"));
   return parsed.map((snapshot) => ({
     id: snapshot.id,
     time: snapshot.time,
@@ -27847,61 +27945,61 @@ async function restoreGrants(deps, impName, imported) {
 }
 
 // packages/daemon/src/imp-ops/backup/backup-manifest.ts
-import * as z63 from "zod";
+import * as z64 from "zod";
 
 // packages/daemon/src/platform/process/legacy-disk-bytes.ts
 var LEGACY_DISK_BYTES = 32 * 1024 ** 3;
 
 // packages/daemon/src/imp-ops/backup/backup-manifest.ts
-var ManifestCheckpointSchema = z63.object({
-  id: z63.string(),
-  label: z63.string().nullable(),
-  createdAt: z63.coerce.date(),
-  disk: z63.string(),
-  diskBytes: z63.int().positive().default(LEGACY_DISK_BYTES),
-  usedBytes: z63.int().nonnegative().optional()
+var ManifestCheckpointSchema = z64.object({
+  id: z64.string(),
+  label: z64.string().nullable(),
+  createdAt: z64.coerce.date(),
+  disk: z64.string(),
+  diskBytes: z64.int().positive().default(LEGACY_DISK_BYTES),
+  usedBytes: z64.int().nonnegative().optional()
 }).readonly();
-var FilteredGrantSchema = z63.object({ secret: z63.string(), filter: GrantFilterSchema }).readonly();
-var ManifestImpSchema = z63.object({
-  id: z63.string(),
-  name: z63.string(),
-  imageDigest: z63.string(),
-  vcpus: z63.int(),
-  memoryMib: z63.int(),
-  maxMemoryMib: z63.int().nullable().optional(),
-  httpPort: z63.int(),
-  state: z63.string(),
-  synced: z63.boolean(),
-  dir: z63.string(),
-  disk: z63.string(),
-  diskBytes: z63.int().positive().default(LEGACY_DISK_BYTES),
-  usedBytes: z63.int().nonnegative().optional(),
-  egressPolicy: z63.string().default("open"),
-  egressAllow: z63.array(z63.string()).readonly().default([]),
-  grants: z63.array(z63.string()).readonly().default([]),
-  filteredGrants: z63.array(FilteredGrantSchema).readonly().default([]),
-  identityResetPending: z63.boolean().default(false),
-  networks: z63.array(z63.string()).readonly().default([]),
-  checkpoints: z63.array(ManifestCheckpointSchema).readonly()
+var FilteredGrantSchema = z64.object({ secret: z64.string(), filter: GrantFilterSchema }).readonly();
+var ManifestImpSchema = z64.object({
+  id: z64.string(),
+  name: z64.string(),
+  imageDigest: z64.string(),
+  vcpus: z64.int(),
+  memoryMib: z64.int(),
+  maxMemoryMib: z64.int().nullable().optional(),
+  httpPort: z64.int(),
+  state: z64.string(),
+  synced: z64.boolean(),
+  dir: z64.string(),
+  disk: z64.string(),
+  diskBytes: z64.int().positive().default(LEGACY_DISK_BYTES),
+  usedBytes: z64.int().nonnegative().optional(),
+  egressPolicy: z64.string().default("open"),
+  egressAllow: z64.array(z64.string()).readonly().default([]),
+  grants: z64.array(z64.string()).readonly().default([]),
+  filteredGrants: z64.array(FilteredGrantSchema).readonly().default([]),
+  identityResetPending: z64.boolean().default(false),
+  networks: z64.array(z64.string()).readonly().default([]),
+  checkpoints: z64.array(ManifestCheckpointSchema).readonly()
 }).readonly();
-var ManifestImageSchema = z63.object({
-  name: z63.string(),
-  ref: z63.string(),
-  digest: z63.string(),
+var ManifestImageSchema = z64.object({
+  name: z64.string(),
+  ref: z64.string(),
+  digest: z64.string(),
   source: ImageSourceSchema.default("oci"),
-  sourceImp: z63.string().nullable().default(null),
-  sizeBytes: z63.int(),
-  dir: z63.string()
+  sourceImp: z64.string().nullable().default(null),
+  sizeBytes: z64.int(),
+  dir: z64.string()
 }).readonly();
-var ManifestExcludedSchema = z63.object({ name: z63.string(), reason: z63.string() }).readonly();
-var BackupManifestSchema = z63.object({
-  version: z63.literal(1),
-  runId: z63.string(),
-  createdAt: z63.coerce.date(),
-  imps: z63.array(ManifestImpSchema).readonly(),
-  excluded: z63.array(ManifestExcludedSchema).readonly().default([]),
-  images: z63.array(ManifestImageSchema).readonly(),
-  database: z63.object({ file: z63.string(), sizeBytes: z63.int().nonnegative() }).readonly().nullable().default(null)
+var ManifestExcludedSchema = z64.object({ name: z64.string(), reason: z64.string() }).readonly();
+var BackupManifestSchema = z64.object({
+  version: z64.literal(1),
+  runId: z64.string(),
+  createdAt: z64.coerce.date(),
+  imps: z64.array(ManifestImpSchema).readonly(),
+  excluded: z64.array(ManifestExcludedSchema).readonly().default([]),
+  images: z64.array(ManifestImageSchema).readonly(),
+  database: z64.object({ file: z64.string(), sizeBytes: z64.int().nonnegative() }).readonly().nullable().default(null)
 }).readonly();
 
 // packages/daemon/src/platform/db/create-restored-secrets.ts
@@ -28578,6 +28676,28 @@ var MIGRATION_041_ADD_MOVE_SEND_STEPS = {
   }
 };
 
+// packages/daemon/src/platform/db/migrations/migration-042-add-secret-env.ts
+var PRESET_ENV = {
+  github: ["GH_TOKEN", "GITHUB_TOKEN"],
+  anthropic: ["ANTHROPIC_API_KEY"],
+  npm: ["NPM_TOKEN"]
+};
+var MIGRATION_042_ADD_SECRET_ENV = {
+  async up(db) {
+    await db.schema.alterTable("secrets").addColumn("env", "text", (column) => column.notNull().defaultTo("[]")).execute();
+    for (const [kind, env] of Object.entries(PRESET_ENV)) {
+      await db.updateTable("secrets").set({ env: JSON.stringify(env) }).where("kind", "=", kind).execute();
+    }
+  }
+};
+
+// packages/daemon/src/platform/db/migrations/migration-043-merge-secret-kinds.ts
+var MIGRATION_043_MERGE_SECRET_KINDS = {
+  async up(db) {
+    await db.updateTable("secrets").set({ kind: "static" }).where("kind", "in", ["github", "anthropic", "npm", "custom"]).execute();
+  }
+};
+
 // packages/daemon/src/platform/db/run-migrations.ts
 var MIGRATIONS = {
   "001_create_initial_schema": MIGRATION_001_CREATE_INITIAL_SCHEMA,
@@ -28620,7 +28740,9 @@ var MIGRATIONS = {
   "038_add_image_removals": MIGRATION_038_ADD_IMAGE_REMOVALS,
   "039_add_image_pins": MIGRATION_039_ADD_IMAGE_PINS,
   "040_add_image_received_digests": MIGRATION_040_ADD_IMAGE_RECEIVED_DIGESTS,
-  "041_add_move_send_steps": MIGRATION_041_ADD_MOVE_SEND_STEPS
+  "041_add_move_send_steps": MIGRATION_041_ADD_MOVE_SEND_STEPS,
+  "042_add_secret_env": MIGRATION_042_ADD_SECRET_ENV,
+  "043_merge_secret_kinds": MIGRATION_043_MERGE_SECRET_KINDS
 };
 var PROVIDER = {
   getMigrations: () => Promise.resolve(MIGRATIONS)
@@ -28925,11 +29047,11 @@ var CHECK_EVERY_MS = 7 * DAY_MS;
 var CHECK_SUBSET = "5%";
 var PRUNE_LOCK_TRIES = 6;
 var RETRY_FIRST_MS = 5 * 60 * 1000;
-var BackupStateSchema = z64.object({
-  lastRunAt: z64.coerce.date().nullable().default(null),
-  lastPruneAt: z64.coerce.date().nullable().default(null),
-  lastCheckAt: z64.coerce.date().nullable().default(null),
-  lastCheckError: z64.string().nullable().default(null)
+var BackupStateSchema = z65.object({
+  lastRunAt: z65.coerce.date().nullable().default(null),
+  lastPruneAt: z65.coerce.date().nullable().default(null),
+  lastCheckAt: z65.coerce.date().nullable().default(null),
+  lastCheckError: z65.string().nullable().default(null)
 });
 function buildBackupsOffError() {
   return new ImpdError("PRECONDITION_FAILED", {
@@ -30027,6 +30149,7 @@ function createSecretRoutes(os, deps) {
         name: secret.name,
         kind: secret.kind,
         rules: secret.rules,
+        env: secret.env,
         imps: secret.imps.filter((name) => isImpAllowed(patterns, name)),
         createdAt: secret.createdAt,
         oauth: secret.oauth
@@ -30873,11 +30996,11 @@ import {
 import { INVALID_PARAMS, isJSONRPCRequest } from "@modelcontextprotocol/server";
 
 // packages/mcp/src/tools/checkpoint-tools.ts
-import * as z67 from "zod";
+import * as z68 from "zod";
 
 // packages/mcp/src/tools/define-tool.ts
 import { ExecError, ORPCError as ORPCError4 } from "@impz/client";
-import * as z65 from "zod";
+import * as z66 from "zod";
 
 // packages/mcp/src/imp-guard.ts
 class GuardError extends Error {
@@ -30978,14 +31101,14 @@ function readPrefix(patterns) {
 }
 
 // packages/mcp/src/tools/define-tool.ts
-var JsonObjectSchema = z65.record(z65.string(), z65.unknown());
+var JsonObjectSchema = z66.record(z66.string(), z66.unknown());
 function defineTool(spec) {
   const definition = {
     name: spec.name,
     title: spec.annotations.title,
     description: spec.description,
     inputSchema: {
-      ...JsonObjectSchema.parse(z65.toJSONSchema(spec.input, { io: "input" })),
+      ...JsonObjectSchema.parse(z66.toJSONSchema(spec.input, { io: "input" })),
       type: "object"
     },
     annotations: spec.annotations
@@ -31044,15 +31167,15 @@ function formatCoded(code, message) {
 }
 
 // packages/mcp/src/tools/imp-tools.ts
-import * as z66 from "zod";
+import * as z67 from "zod";
 var ImpNameInput = NameSchema.describe("The imp name, from imp_list");
-var NameOnly = z66.strictObject({ name: ImpNameInput });
+var NameOnly = z67.strictObject({ name: ImpNameInput });
 var IMP_TOOLS = [
   defineTool({
     name: "imp_list",
     scope: "read",
     description: "List the imps this server may touch: name, state (running, sleeping, stopped, error), image, memory and URL. A sleeping or stopped imp wakes or boots by itself on the next exec, file or HTTP request.",
-    input: z66.strictObject({}),
+    input: z67.strictObject({}),
     annotations: { title: "List imps", readOnlyHint: true, openWorldHint: false },
     run: async (_input, context) => {
       const imps = await context.client.imps.list();
@@ -31064,7 +31187,7 @@ var IMP_TOOLS = [
     scope: "manage",
     cancellable: false,
     description: "Create an imp, a persistent Linux microVM, and boot it. Its disk survives sleeps and restarts until imp_destroy. Without a name, the server picks one inside its guard. Returns the imp. A cancel does not stop the create, and its result still comes back.",
-    input: z66.strictObject({
+    input: z67.strictObject({
       name: ImpCreateInputSchema.shape.name.describe("The new imp's name: a lowercase letter, then up to 30 lowercase letters, digits or hyphens. Omit to have one picked."),
       image: ImpCreateInputSchema.shape.image.describe("The image to boot, from imp_image_list; impd's default when omitted"),
       vcpus: ImpCreateInputSchema.shape.vcpus.describe("Virtual CPUs; impd's default when omitted"),
@@ -31141,10 +31264,10 @@ var IMP_TOOLS = [
     scope: "manage",
     cancellable: false,
     description: "Create a new imp from the disk of another, now or as it was at one of its checkpoints. The fork boots fresh: it has the disk, not the running processes. Use it to try two approaches side by side. A token limited to some imps gives the fork only the source's secret grants it could make itself; grantsNotCopied names each grant the fork did not get, and grantsError says why it got none. A cancel does not stop the fork, and its result still comes back.",
-    input: z66.strictObject({
+    input: z67.strictObject({
       source: NameSchema.describe("The imp to fork, from imp_list"),
       name: NameSchema.optional().describe("The fork's name; omit to have one picked"),
-      checkpoint: z66.string().min(1).optional().describe("A checkpoint id or label of the source, from imp_checkpoint_list; the source's disk now when omitted")
+      checkpoint: z67.string().min(1).optional().describe("A checkpoint id or label of the source, from imp_checkpoint_list; the source's disk now when omitted")
     }),
     annotations: {
       title: "Fork an imp",
@@ -31177,7 +31300,7 @@ var IMP_TOOLS = [
     name: "imp_image_list",
     scope: "read",
     description: "List the images an imp can boot from, for imp_create.",
-    input: z66.strictObject({}),
+    input: z67.strictObject({}),
     annotations: { title: "List images", readOnlyHint: true, openWorldHint: false },
     run: async (_input, context) => {
       const images = await context.client.images.list();
@@ -31187,13 +31310,13 @@ var IMP_TOOLS = [
 ];
 
 // packages/mcp/src/tools/checkpoint-tools.ts
-var CheckpointRefInput = z67.string().min(1).describe("A checkpoint id or label, from imp_checkpoint_list");
+var CheckpointRefInput = z68.string().min(1).describe("A checkpoint id or label, from imp_checkpoint_list");
 var CHECKPOINT_TOOLS = [
   defineTool({
     name: "imp_checkpoint",
     scope: "manage",
     description: "Save the imp's disk as a checkpoint, in about 100 ms, without stopping it. Take one before a risky change; imp_restore goes back to it and imp_fork starts a new imp from it.",
-    input: z67.strictObject({
+    input: z68.strictObject({
       name: ImpNameInput,
       label: CheckpointCreateInputSchema.shape.label.describe("A label to find the checkpoint by, such as before-migration")
     }),
@@ -31216,7 +31339,7 @@ var CHECKPOINT_TOOLS = [
     name: "imp_checkpoint_list",
     scope: "read",
     description: "List the imp's checkpoints: id, label, time and size.",
-    input: z67.strictObject({ name: ImpNameInput }),
+    input: z68.strictObject({ name: ImpNameInput }),
     annotations: { title: "List checkpoints", readOnlyHint: true, openWorldHint: false },
     run: async (input, context) => {
       context.guard.require(input.name);
@@ -31229,7 +31352,7 @@ var CHECKPOINT_TOOLS = [
     scope: "manage",
     cancellable: false,
     description: "Put the imp's disk back to a checkpoint. Everything written since the checkpoint is lost, and so is the memory: an awake imp boots fresh, a sleeping or stopped one boots on its next use. A cancel does not stop the restore, and its result still comes back.",
-    input: z67.strictObject({ name: ImpNameInput, checkpoint: CheckpointRefInput }),
+    input: z68.strictObject({ name: ImpNameInput, checkpoint: CheckpointRefInput }),
     annotations: {
       title: "Restore a checkpoint",
       readOnlyHint: false,
@@ -31246,7 +31369,7 @@ var CHECKPOINT_TOOLS = [
     name: "imp_checkpoint_delete",
     scope: "manage",
     description: "Delete one of the imp's checkpoints for good. The imp itself is not touched.",
-    input: z67.strictObject({ name: ImpNameInput, checkpoint: CheckpointRefInput }),
+    input: z68.strictObject({ name: ImpNameInput, checkpoint: CheckpointRefInput }),
     annotations: {
       title: "Delete a checkpoint",
       readOnlyHint: false,
@@ -31262,7 +31385,7 @@ var CHECKPOINT_TOOLS = [
 ];
 
 // packages/mcp/src/tools/exec-tool.ts
-import * as z68 from "zod";
+import * as z69 from "zod";
 
 // packages/mcp/src/exec/output-cap.ts
 function createOutputCollector(maxBytes, headBytes) {
@@ -31500,16 +31623,16 @@ var MAX_TIMEOUT_S = 1800;
 var DEFAULT_OUTPUT_BYTES = 64 * 1024;
 var MAX_OUTPUT_BYTES = 256 * 1024;
 var HEAD_BYTES = 8 * 1024;
-var ExecInput = z68.strictObject({
+var ExecInput = z69.strictObject({
   name: ImpNameInput,
-  command: z68.string().min(1).optional().describe("A shell command line, run as /bin/sh -c COMMAND. Give this or argv."),
-  argv: z68.array(z68.string()).min(1).optional().describe("The program and its arguments, run as they are with no shell. Give this or command."),
-  stdin: z68.string().optional().describe("Text for the command's stdin, which then closes; closed at once when omitted"),
-  cwd: z68.string().optional().describe("The working directory; the image's workdir or HOME when omitted"),
-  env: z68.record(z68.string(), z68.string()).optional().describe("Environment variables, added to the image's"),
-  require: z68.array(z68.enum(EXEC_REQUIREMENTS)).optional().describe("What impd must ensure before the command starts, or the call fails with PRECONDITION_FAILED and nothing runs. broker: impd set the credential broker's proxy variables and CA bundle for this boot."),
-  timeoutSeconds: z68.int().min(1).max(MAX_TIMEOUT_S).default(DEFAULT_TIMEOUT_S).describe(`How long the command may run, waking the imp included (default ${String(DEFAULT_TIMEOUT_S)})`),
-  maxOutputBytes: z68.int().min(1024).max(MAX_OUTPUT_BYTES).default(DEFAULT_OUTPUT_BYTES).describe(`The most output kept per stream (default ${String(DEFAULT_OUTPUT_BYTES)}): the first ${String(HEAD_BYTES)} bytes and the last bytes, with a marker for the bytes dropped between`)
+  command: z69.string().min(1).optional().describe("A shell command line, run as /bin/sh -c COMMAND. Give this or argv."),
+  argv: z69.array(z69.string()).min(1).optional().describe("The program and its arguments, run as they are with no shell. Give this or command."),
+  stdin: z69.string().optional().describe("Text for the command's stdin, which then closes; closed at once when omitted"),
+  cwd: z69.string().optional().describe("The working directory; the image's workdir or HOME when omitted"),
+  env: z69.record(z69.string(), z69.string()).optional().describe("Environment variables, added to the image's"),
+  require: z69.array(z69.enum(EXEC_REQUIREMENTS)).optional().describe("What impd must ensure before the command starts, or the call fails with PRECONDITION_FAILED and nothing runs. broker: impd set the credential broker's proxy variables and CA bundle for this boot."),
+  timeoutSeconds: z69.int().min(1).max(MAX_TIMEOUT_S).default(DEFAULT_TIMEOUT_S).describe(`How long the command may run, waking the imp included (default ${String(DEFAULT_TIMEOUT_S)})`),
+  maxOutputBytes: z69.int().min(1024).max(MAX_OUTPUT_BYTES).default(DEFAULT_OUTPUT_BYTES).describe(`The most output kept per stream (default ${String(DEFAULT_OUTPUT_BYTES)}): the first ${String(HEAD_BYTES)} bytes and the last bytes, with a marker for the bytes dropped between`)
 }).refine((input) => input.command === undefined !== (input.argv === undefined), {
   message: "give either command or argv"
 });
@@ -31559,7 +31682,7 @@ var EXEC_TOOL = defineTool({
 });
 
 // packages/mcp/src/tools/file-tools.ts
-import * as z69 from "zod";
+import * as z70 from "zod";
 
 // packages/mcp/src/tools/write-script.ts
 var WRITE_SCRIPT = [
@@ -31588,15 +31711,15 @@ var MAX_READ_BYTES = 1024 * 1024;
 var MAX_WRITE_BYTES = 4 * 1024 * 1024;
 var FILE_TIMEOUT_MS = 60000;
 var STDERR_BYTES = 4096;
-var GuestPathInput = z69.string().startsWith("/", "must be an absolute path").describe("An absolute path in the imp");
-var MaxBytesInput = z69.int().min(1).max(MAX_READ_BYTES).default(DEFAULT_READ_BYTES).describe(`The most bytes to read (default ${String(DEFAULT_READ_BYTES)}); a larger file fails, so read a part of it with imp_exec (head, tail, sed -n)`);
-var EncodingInput = z69.enum(["utf8", "base64"]).default("utf8").describe("utf8 for text, base64 for any bytes (default utf8)");
+var GuestPathInput = z70.string().startsWith("/", "must be an absolute path").describe("An absolute path in the imp");
+var MaxBytesInput = z70.int().min(1).max(MAX_READ_BYTES).default(DEFAULT_READ_BYTES).describe(`The most bytes to read (default ${String(DEFAULT_READ_BYTES)}); a larger file fails, so read a part of it with imp_exec (head, tail, sed -n)`);
+var EncodingInput = z70.enum(["utf8", "base64"]).default("utf8").describe("utf8 for text, base64 for any bytes (default utf8)");
 var FILE_TOOLS = [
   defineTool({
     name: "imp_read_file",
     scope: "exec",
     description: `Read a file in an imp, up to maxBytes. A sleeping imp wakes and a stopped one boots first. Text comes back as utf8; a file that is not valid UTF-8 fails, so read it again with encoding base64.`,
-    input: z69.strictObject({
+    input: z70.strictObject({
       name: ImpNameInput,
       path: GuestPathInput,
       encoding: EncodingInput,
@@ -31636,10 +31759,10 @@ var FILE_TOOLS = [
     name: "imp_write_file",
     scope: "exec",
     description: `Write a file in an imp, replacing it whole, and create its parent directories. The write goes to a temp file that is renamed over the path, so no reader sees half a file; an existing file keeps its mode, a symlink is written through, and a directory is refused. At most ${String(MAX_WRITE_BYTES)} bytes.`,
-    input: z69.strictObject({
+    input: z70.strictObject({
       name: ImpNameInput,
       path: GuestPathInput,
-      content: z69.string().describe("The whole file, as text or as base64 (see encoding)"),
+      content: z70.string().describe("The whole file, as text or as base64 (see encoding)"),
       encoding: EncodingInput
     }),
     annotations: {
@@ -32275,14 +32398,14 @@ function createMcpEndpoint(deps) {
 }
 
 // packages/daemon/src/surface/with-retry-after.ts
-import * as z70 from "zod";
+import * as z71 from "zod";
 async function withRetryAfter(response) {
   if (response.status !== 409) {
     return response;
   }
   try {
     const body = await response.clone().json();
-    const MovingBodySchema = z70.object({ json: z70.object({ code: z70.literal("MOVING") }) });
+    const MovingBodySchema = z71.object({ json: z71.object({ code: z71.literal("MOVING") }) });
     if (!MovingBodySchema.safeParse(body).success) {
       return response;
     }
@@ -32738,7 +32861,7 @@ import { join as join16 } from "path";
 // packages/daemon/src/create-upstream-resolver.ts
 import { readFileSync as readFileSync13, statSync as statSync6 } from "fs";
 import { rootCertificates } from "tls";
-import * as z71 from "zod";
+import * as z72 from "zod";
 
 // packages/daemon/src/network/broker/tls/resolve-public-upstream.ts
 function resolvePublicUpstream(host) {
@@ -32746,9 +32869,9 @@ function resolvePublicUpstream(host) {
 }
 
 // packages/daemon/src/create-upstream-resolver.ts
-var FileSchema = z71.object({
-  ca: z71.string().includes("-----BEGIN CERTIFICATE-----"),
-  upstreams: z71.record(z71.string(), z71.url({ protocol: /^https$/u }))
+var FileSchema = z72.object({
+  ca: z72.string().includes("-----BEGIN CERTIFICATE-----"),
+  upstreams: z72.record(z72.string(), z72.url({ protocol: /^https$/u }))
 });
 function createUpstreamResolver(path) {
   const cache = {
@@ -33012,7 +33135,7 @@ function buildHostReach(ranges, uplinks, hasIPv6) {
 
 // packages/daemon/src/network/broker/broker-service.ts
 import { join as join15 } from "path";
-import { match as match2 } from "ts-pattern";
+import { match as match3 } from "ts-pattern";
 
 // packages/daemon/src/platform/db/broker-audit.ts
 var AUDIT_ROWS_PER_IMP = 1000;
@@ -33577,51 +33700,8 @@ async function readBrokerPeer(db, slot) {
 
 // packages/daemon/src/network/broker/secrets/connector-kinds.ts
 var PLACEHOLDER = "imp-broker-placeholder";
-var PRESETS = {
-  github: {
-    rules: [
-      { host: "github.com", header: "authorization", scheme: "basic", user: "x-access-token" },
-      { host: "api.github.com", header: "authorization", scheme: "bearer" },
-      { host: "uploads.github.com", header: "authorization", scheme: "bearer" }
-    ],
-    env: ["GH_TOKEN", "GITHUB_TOKEN"]
-  },
-  anthropic: {
-    rules: [{ host: "api.anthropic.com", header: "x-api-key", scheme: "raw" }],
-    env: ["ANTHROPIC_API_KEY"]
-  },
-  npm: {
-    rules: [{ host: "registry.npmjs.org", header: "authorization", scheme: "bearer" }],
-    env: ["NPM_TOKEN"]
-  }
-};
-
-class SecretRulesError extends Error {
-  name = "SecretRulesError";
-}
-function resolveRules(kind, given) {
-  if (kind !== "custom" && kind !== "oauth") {
-    if (given !== undefined) {
-      throw new SecretRulesError(`kind ${kind} has its own hosts; rules are for kinds custom and oauth`);
-    }
-    return PRESETS[kind].rules;
-  }
-  if (given === undefined || given.length === 0) {
-    throw new SecretRulesError(`kind ${kind} needs at least one host`);
-  }
-  if (kind !== "custom" && given.some((rule) => rule.upstream !== undefined)) {
-    throw new SecretRulesError(`kind ${kind} cannot have an upstream; it is for kind custom`);
-  }
-  const hosts = given.map((rule) => rule.host);
-  const repeated = hosts.find((host, index) => hosts.indexOf(host) !== index);
-  if (repeated !== undefined) {
-    throw new SecretRulesError(`${repeated} has more than one rule`);
-  }
-  return given;
-}
-function listPlaceholderEnv(kinds) {
-  const names = kinds.flatMap((kind) => kind === "custom" || kind === "oauth" ? [] : PRESETS[kind].env);
-  return [...new Set(names)];
+function listPlaceholderEnv(envLists) {
+  return [...new Set(envLists.flat())];
 }
 function renderCredential(rule, value) {
   if (rule.scheme === "bearer") {
@@ -33634,17 +33714,17 @@ function renderCredential(rule, value) {
 }
 
 // packages/daemon/src/network/broker/secrets/oauth-state.ts
-import * as z72 from "zod";
-var TokenSchema2 = z72.string().min(1).max(16384);
-var StateSchema = z72.object({
-  v: z72.literal(1),
+import * as z73 from "zod";
+var TokenSchema2 = z73.string().min(1).max(16384);
+var StateSchema = z73.object({
+  v: z73.literal(1),
   refreshToken: TokenSchema2,
   accessToken: TokenSchema2.nullable(),
   idToken: TokenSchema2.nullable(),
-  expiresAt: z72.number().nullable(),
-  refreshedAt: z72.number().nullable(),
-  status: z72.enum(["pending", "ready", "needs_login"]),
-  error: z72.string().max(200).nullable()
+  expiresAt: z73.number().nullable(),
+  refreshedAt: z73.number().nullable(),
+  status: z73.enum(["pending", "ready", "needs_login"]),
+  error: z73.string().max(200).nullable()
 });
 function buildPendingState(refreshToken) {
   return {
@@ -33706,6 +33786,23 @@ function readJwtExpiry(token) {
   return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp * 1000 : null;
 }
 
+// packages/daemon/src/network/broker/secrets/secret-kinds.ts
+var SECRET_KINDS = {
+  static: {
+    formatValueFile: (value) => value,
+    findCredential: (content) => ({ value: content, oauth: null }),
+    isRefreshed: false
+  },
+  oauth: {
+    formatValueFile: (refreshToken) => formatOAuthState(buildPendingState(refreshToken)),
+    findCredential: (content) => {
+      const state = parseOAuthState(content);
+      return state === null || state.accessToken === null ? null : { value: state.accessToken, oauth: { refreshedAt: state.refreshedAt } };
+    },
+    isRefreshed: true
+  }
+};
+
 // packages/daemon/src/platform/http/send-with-ca.ts
 function sendWithCA(url, init) {
   const tls = init.tls === undefined ? {} : { tls: { ca: [...init.tls.ca] } };
@@ -34451,18 +34548,17 @@ function createBrokerProxy(deps) {
   const readCredential = async (impId, host) => {
     const granted = await readRule(impId, host);
     const stored = granted === undefined ? null : files.read(granted.valueFile);
-    const oauth = granted?.kind === "oauth" && stored !== null ? parseOAuthState(stored) : null;
-    const value = granted?.kind === "oauth" ? oauth?.accessToken ?? null : stored;
-    if (granted === undefined || value === null) {
+    const credential = granted === undefined || stored === null ? null : SECRET_KINDS[granted.kind].findCredential(stored);
+    if (granted === undefined || credential === null) {
       return null;
     }
     return {
       secretName: granted.secretName,
       header: granted.rule.header,
-      value: renderCredential(granted.rule, value),
+      value: renderCredential(granted.rule, credential.value),
       upstream: granted.rule.upstream ?? null,
       filter: granted.filter,
-      oauth: oauth === null ? null : { refreshedAt: oauth.refreshedAt }
+      oauth: credential.oauth
     };
   };
   const writeAudit = async (entry) => {
@@ -34531,6 +34627,30 @@ function createBrokerProxy(deps) {
   };
 }
 
+// packages/daemon/src/network/broker/secrets/build-stored-binding.ts
+import { P, match as match2 } from "ts-pattern";
+function buildStoredBinding(input) {
+  return match2(input).returnType().with({ kind: "static" }, (given) => ({
+    kind: "static",
+    rules: given.rules,
+    env: given.env ?? [],
+    oauth: null
+  })).with({ kind: "oauth" }, (given) => ({
+    kind: "oauth",
+    rules: given.rules,
+    env: given.env ?? [],
+    oauth: given.oauth
+  })).with({ preset: P.string }, (given) => buildPresetBinding(given.preset)).with({ kind: "custom" }, (given) => ({
+    kind: "static",
+    rules: given.rules,
+    env: [],
+    oauth: null
+  })).with({ kind: P.union("github", "anthropic", "npm") }, (given) => buildPresetBinding(given.kind)).exhaustive();
+}
+function buildPresetBinding(preset) {
+  return { ...SECRET_PRESETS[preset], oauth: null };
+}
+
 // packages/daemon/src/network/broker/secrets/secret-files.ts
 import { randomBytes as randomBytes7 } from "crypto";
 import {
@@ -34653,6 +34773,7 @@ function createSecretStore(deps) {
       name: secret.name,
       kind: secret.kind,
       rules: secret.rules,
+      env: secret.env,
       imps,
       createdAt: secret.createdAt
     };
@@ -34704,38 +34825,19 @@ function createSecretStore(deps) {
   };
   return {
     addSecret: async (input) => {
-      let rules;
-      try {
-        rules = resolveRules(input.kind, input.rules);
-      } catch (error) {
-        if (error instanceof SecretRulesError) {
-          throw new ImpdError("BAD_REQUEST", { message: error.message });
-        }
-        throw error;
-      }
-      if (input.kind === "oauth" && input.oauth === undefined) {
-        throw new ImpdError("BAD_REQUEST", {
-          message: "kind oauth needs a token URL and a client id"
-        });
-      }
-      if (input.kind !== "oauth" && input.oauth !== undefined) {
-        throw new ImpdError("BAD_REQUEST", {
-          message: `kind ${input.kind} has no token URL or client id; they are for kind oauth`
-        });
-      }
-      const oauth = input.kind === "oauth" ? input.oauth ?? null : null;
+      const binding = buildStoredBinding(input);
+      const kind = SECRET_KINDS[binding.kind];
       const saved = await refresher.withLock(input.name, async () => {
         const valueFile = buildValueFile(input.name);
-        const content = input.kind === "oauth" ? formatOAuthState(buildPendingState(input.value)) : input.value;
-        files.write(valueFile, content);
-        const written = await writeSecretRow({ name: input.name, kind: input.kind, rules, oauth, valueFile }, input);
+        files.write(valueFile, kind.formatValueFile(input.value));
+        const written = await writeSecretRow({ name: input.name, ...binding, valueFile }, input);
         if (written.oldValueFile !== null) {
           await removeDisplacedFile(written.oldValueFile);
           await deps.applyGrants();
         }
         return written;
       });
-      if (input.kind === "oauth") {
+      if (kind.isRefreshed) {
         await refresher.refresh(input.name, true);
       }
       const latest = await readSecret(db, input.name);
@@ -34751,7 +34853,7 @@ function createSecretStore(deps) {
       if (secret === undefined) {
         throw buildNotFoundError("secret", name);
       }
-      if (secret.kind !== "oauth") {
+      if (!SECRET_KINDS[secret.kind].isRefreshed) {
         throw new ImpdError("BAD_REQUEST", { message: `secret ${name} is not an oauth secret` });
       }
       await refresher.refresh(name, true);
@@ -34890,7 +34992,7 @@ function isDue(state, at) {
 }
 
 // packages/daemon/src/network/broker/secrets/parse-token-answer.ts
-import * as z73 from "zod";
+import * as z74 from "zod";
 function parseTokenAnswer(status, text) {
   let body = null;
   try {
@@ -34916,8 +35018,8 @@ function parseTokenAnswer(status, text) {
   }
   return parseTokens(body);
 }
-var ErrorObjectSchema = z73.object({ code: z73.string().nullish(), error: z73.string().nullish() });
-var ErrorAnswerSchema = z73.object({ error: z73.union([z73.string(), ErrorObjectSchema]) });
+var ErrorObjectSchema = z74.object({ code: z74.string().nullish(), error: z74.string().nullish() });
+var ErrorAnswerSchema = z74.object({ error: z74.union([z74.string(), ErrorObjectSchema]) });
 function findErrorCode(body) {
   const parsed = ErrorAnswerSchema.safeParse(body);
   if (!parsed.success) {
@@ -34927,11 +35029,11 @@ function findErrorCode(body) {
   const code = typeof error === "string" ? error : error.code ?? error.error;
   return code !== null && code !== undefined && /^[A-Za-z0-9_.-]{1,64}$/u.test(code) ? code : null;
 }
-var TokenAnswerSchema = z73.object({
-  access_token: z73.string().nullish(),
-  refresh_token: z73.string().nullish(),
-  id_token: z73.string().nullish(),
-  expires_in: z73.number().nullish()
+var TokenAnswerSchema = z74.object({
+  access_token: z74.string().nullish(),
+  refresh_token: z74.string().nullish(),
+  id_token: z74.string().nullish(),
+  expires_in: z74.number().nullish()
 });
 function parseTokens(body) {
   const parsed = TokenAnswerSchema.safeParse(body);
@@ -35457,7 +35559,7 @@ ${key.host}`));
       if (outcome.kind === "granted") {
         return;
       }
-      throw match2(outcome).with({ kind: "no-secret" }, () => buildNotFoundError("secret", secretName)).with({ kind: "no-token" }, () => buildTokenGoneError()).with({ kind: "not-grantable" }, () => buildStaleError(secretName)).with({ kind: "clash" }, (refused) => buildClashError(impName, secretName, refused.clash)).exhaustive();
+      throw match3(outcome).with({ kind: "no-secret" }, () => buildNotFoundError("secret", secretName)).with({ kind: "no-token" }, () => buildTokenGoneError()).with({ kind: "not-grantable" }, () => buildStaleError(secretName)).with({ kind: "clash" }, (refused) => buildClashError(impName, secretName, refused.clash)).exhaustive();
     },
     removeGrant: async (impName, secretName, authority = null) => {
       const imp = await requireImp(impName);
@@ -35533,7 +35635,7 @@ ${key.host}`));
       }).hostIp;
       const env = buildBrokerEnv({
         proxyUrl: `http://${gateway}:${String(proxy.getPort())}`,
-        placeholders: listPlaceholderEnv(granted.map((entry) => entry.kind)),
+        placeholders: listPlaceholderEnv(granted.map((entry) => entry.env)),
         placeholder: PLACEHOLDER
       });
       return { kind: "ready", env };
@@ -37552,7 +37654,7 @@ function createImpWatchdog(context, lock, ops) {
 }
 
 // packages/daemon/src/platform/events/imp-event-publisher.ts
-import { P, match as match3 } from "ts-pattern";
+import { P as P2, match as match4 } from "ts-pattern";
 function startImpEventPublisher(deps) {
   const pending = [];
   const state = { draining: false };
@@ -37579,7 +37681,7 @@ function startImpEventPublisher(deps) {
 }
 function readEvent(deps, write) {
   const envelope = { v: EVENT_VERSION, at: new Date(deps.now()) };
-  return match3(write).returnType().with({ kind: "added" }, async (added) => ({
+  return match4(write).returnType().with({ kind: "added" }, async (added) => ({
     ...envelope,
     ev: "ImpAdded",
     reason: "created",
@@ -37594,7 +37696,7 @@ function readEvent(deps, write) {
     ...envelope,
     ev: "ImpRemoved",
     imp: await deps.toApi(removed.imp)
-  })).with({ kind: P.union("checkpointAdded", "checkpointRemoved") }, async (checkpointWrite) => {
+  })).with({ kind: P2.union("checkpointAdded", "checkpointRemoved") }, async (checkpointWrite) => {
     const imp = await readImpById(deps.db, checkpointWrite.checkpoint.impId);
     if (imp === undefined) {
       return null;
@@ -38783,7 +38885,7 @@ import {
 } from "fs";
 import { join as join18 } from "path";
 import { withContext as withContext2 } from "@logtape/logtape";
-import * as z74 from "zod";
+import * as z75 from "zod";
 
 // packages/daemon/src/vm/vmm/configure-vm.ts
 function createMarks() {
@@ -38860,11 +38962,11 @@ var MAX_TEMPLATES = 4;
 var MAX_BUILD_FAILURES = 3;
 var MAX_RESTORE_FAILURES = 3;
 var BUILD_RETRY_MS = 60000;
-var TemplateMetaSchema = z74.object({
-  buildId: z74.string(),
-  vcpus: z74.int().positive(),
-  memoryMib: z74.int().positive(),
-  systemDrivePath: z74.string()
+var TemplateMetaSchema = z75.object({
+  buildId: z75.string(),
+  vcpus: z75.int().positive(),
+  memoryMib: z75.int().positive(),
+  systemDrivePath: z75.string()
 });
 
 class BuildRefusedError extends Error {
@@ -39261,7 +39363,7 @@ function readThreadIds(pid, procRoot = "/proc") {
 }
 
 // packages/daemon/src/imps/session-logs/session-log-service.ts
-import * as z76 from "zod";
+import * as z77 from "zod";
 
 // packages/daemon/src/imps/session-logs/build-log-key.ts
 function buildLogKey(impId, generation) {
@@ -39280,7 +39382,7 @@ import { basename as basename2, dirname as dirname8, join as join20, resolve as
 import { existsSync as existsSync10, readFileSync as readFileSync20, readdirSync as readdirSync5, rmSync as rmSync16 } from "fs";
 import { mkdir, open as open4, stat, truncate, unlink } from "fs/promises";
 import { join as join19 } from "path";
-import * as z75 from "zod";
+import * as z76 from "zod";
 
 // packages/daemon/src/imps/session-logs/plan-log-read.ts
 function getLogBounds(segments, origin) {
@@ -39325,20 +39427,20 @@ function planLogRead(segments, origin, from, limit) {
 var META_FILE = "meta.json";
 var SEGMENT_SUFFIX = ".seg";
 var COMMIT_DELAY_MS = 1000;
-var OffsetSchema2 = z75.int().nonnegative();
-var GenerationMetaSchema = z75.object({
-  version: z75.literal(1),
+var OffsetSchema2 = z76.int().nonnegative();
+var GenerationMetaSchema = z76.object({
+  version: z76.literal(1),
   session: AgentSessionNameSchema,
   executionGeneration: AgentGenerationSchema,
   bootId: AgentBootIdSchema,
-  startedAt: z75.int(),
+  startedAt: z76.int(),
   origin: OffsetSchema2,
-  segments: z75.array(z75.object({ start: OffsetSchema2, length: OffsetSchema2 })),
-  state: z75.enum(["live", "ended"]),
-  endedAt: z75.int().optional(),
+  segments: z76.array(z76.object({ start: OffsetSchema2, length: OffsetSchema2 })),
+  state: z76.enum(["live", "ended"]),
+  endedAt: z76.int().optional(),
   end: OffsetSchema2.optional(),
-  exitCode: z75.int().nullable().optional(),
-  stopped: z75.enum(["disk_full", "imp_limit"]).optional()
+  exitCode: z76.int().nullable().optional(),
+  stopped: z76.enum(["disk_full", "imp_limit"]).optional()
 });
 function getSegmentPath(directory, start) {
   return join19(directory, `${String(start)}${SEGMENT_SUFFIX}`);
@@ -40118,7 +40220,7 @@ function toExitCode(code, signal) {
 }
 
 // packages/daemon/src/imps/session-logs/session-log-service.ts
-var NoSessionPreviousSchema = z76.object({ previous: PreviousGenerationSchema.optional() });
+var NoSessionPreviousSchema = z77.object({ previous: PreviousGenerationSchema.optional() });
 function createSessionLogs(deps) {
   const openTap = deps.openTap ?? openTapStream;
   const createLog = deps.createLog ?? createGenerationLog;
@@ -42190,9 +42292,9 @@ async function waitForAgent(vsockPath, options) {
 }
 
 // packages/daemon/src/vm/vmm/firecracker-client.ts
-import * as z77 from "zod";
-var InstanceInfoSchema = z77.object({ state: z77.enum(["Not started", "Running", "Paused"]) });
-var MachineConfigSchema = z77.object({ track_dirty_pages: z77.boolean().optional() });
+import * as z78 from "zod";
+var InstanceInfoSchema = z78.object({ state: z78.enum(["Not started", "Running", "Paused"]) });
+var MachineConfigSchema = z78.object({ track_dirty_pages: z78.boolean().optional() });
 var DEFAULT_TIMEOUTS = { requestMs: 1e4, snapshotMs: 120000 };
 
 class FirecrackerApiError extends Error {
@@ -44310,78 +44412,78 @@ function buildOfferedDigests(digest, receivedDigest) {
 var COMMIT_WINDOW_MS = 24 * 60 * 60 * 1000;
 
 // packages/daemon/src/imp-ops/moves/move-header.ts
-import * as z78 from "zod";
-var CpuSchema = z78.object({ limit: z78.number().positive().nullable(), weight: z78.int() }).readonly();
-var EgressSchema = z78.object({ mode: z78.string(), allow: z78.array(z78.string()).readonly() }).readonly();
-var CheckpointSchema3 = z78.object({
-  label: z78.string().nullable(),
-  createdAt: z78.coerce.date(),
-  diskBytes: z78.int().positive()
+import * as z79 from "zod";
+var CpuSchema = z79.object({ limit: z79.number().positive().nullable(), weight: z79.int() }).readonly();
+var EgressSchema = z79.object({ mode: z79.string(), allow: z79.array(z79.string()).readonly() }).readonly();
+var CheckpointSchema3 = z79.object({
+  label: z79.string().nullable(),
+  createdAt: z79.coerce.date(),
+  diskBytes: z79.int().positive()
 }).readonly();
-var MovedBootSchema = z78.object({ bootId: z78.uuid(), cause: ColdBootCauseSchema, at: z78.iso.datetime() }).readonly();
+var MovedBootSchema = z79.object({ bootId: z79.uuid(), cause: ColdBootCauseSchema, at: z79.iso.datetime() }).readonly();
 var MAX_MOVED_LEASES = 1024;
 var MAX_LEASE_REMAINING_MS = 100 * 365 * 24 * 60 * 60 * 1000;
-var LeaseOwnerTextSchema = z78.string().min(1).max(256);
-var MovedLeaseOwnerSchema = z78.object({
+var LeaseOwnerTextSchema = z79.string().min(1).max(256);
+var MovedLeaseOwnerSchema = z79.object({
   principal: LeaseOwnerTextSchema,
   label: LeaseLabelSchema,
   display: LeaseOwnerTextSchema
 });
 var MovedLeaseSchema = MovedLeaseOwnerSchema.extend({
-  remainingMs: z78.int().nonnegative().max(MAX_LEASE_REMAINING_MS).nullable(),
-  createdAt: z78.coerce.date()
+  remainingMs: z79.int().nonnegative().max(MAX_LEASE_REMAINING_MS).nullable(),
+  createdAt: z79.coerce.date()
 }).readonly();
-var FilteredGrantSchema2 = z78.object({ secret: z78.string(), filter: GrantFilterSchema }).readonly();
-var ImpSchema2 = z78.object({
-  id: z78.uuid(),
-  name: z78.string(),
-  vcpus: z78.int().positive(),
-  memoryMib: z78.int().positive(),
-  maxMemoryMib: z78.int().positive().optional(),
-  httpPort: z78.int().positive(),
-  diskBytes: z78.int().positive(),
+var FilteredGrantSchema2 = z79.object({ secret: z79.string(), filter: GrantFilterSchema }).readonly();
+var ImpSchema2 = z79.object({
+  id: z79.uuid(),
+  name: z79.string(),
+  vcpus: z79.int().positive(),
+  memoryMib: z79.int().positive(),
+  maxMemoryMib: z79.int().positive().optional(),
+  httpPort: z79.int().positive(),
+  diskBytes: z79.int().positive(),
   cpu: CpuSchema,
   egress: EgressSchema,
-  grants: z78.array(z78.string()).readonly(),
-  filteredGrants: z78.array(FilteredGrantSchema2).readonly().default([]),
-  isIdentityResetPending: z78.boolean(),
-  isDiskGrowPending: z78.boolean().default(false),
-  isBackedUp: z78.boolean().default(true),
-  coldBoots: z78.array(MovedBootSchema).max(4).readonly().default([]),
-  leases: z78.array(MovedLeaseSchema).max(MAX_MOVED_LEASES).readonly().optional()
+  grants: z79.array(z79.string()).readonly(),
+  filteredGrants: z79.array(FilteredGrantSchema2).readonly().default([]),
+  isIdentityResetPending: z79.boolean(),
+  isDiskGrowPending: z79.boolean().default(false),
+  isBackedUp: z79.boolean().default(true),
+  coldBoots: z79.array(MovedBootSchema).max(4).readonly().default([]),
+  leases: z79.array(MovedLeaseSchema).max(MAX_MOVED_LEASES).readonly().optional()
 }).readonly();
-var StreamStepSchema = z78.object({
-  checkpoint: z78.int().nonnegative().nullable(),
-  dataset: z78.int().nonnegative(),
-  base: z78.int().nonnegative().nullable()
+var StreamStepSchema = z79.object({
+  checkpoint: z79.int().nonnegative().nullable(),
+  dataset: z79.int().nonnegative(),
+  base: z79.int().nonnegative().nullable()
 }).readonly();
-var HeldAnswerSchema = z78.object({
-  names: z78.array(z78.string()).readonly(),
-  address: z78.string(),
-  ttlS: z78.int().positive()
+var HeldAnswerSchema = z79.object({
+  names: z79.array(z79.string()).readonly(),
+  address: z79.string(),
+  ttlS: z79.int().positive()
 }).readonly();
-var WarmSchema = z78.object({
+var WarmSchema = z79.object({
   move: WarmMoveSchema,
   meta: SnapshotMetaSchema.extend({ systemDrive: SystemDriveSchema }),
   vm: VmIdentitySchema.nullable(),
-  isDriveIncluded: z78.boolean(),
-  answers: z78.array(HeldAnswerSchema).readonly()
+  isDriveIncluded: z79.boolean(),
+  answers: z79.array(HeldAnswerSchema).readonly()
 }).readonly();
-var MoveHeaderSchema = z78.object({
-  version: z78.literal(1),
+var MoveHeaderSchema = z79.object({
+  version: z79.literal(1),
   imp: ImpSchema2,
-  image: z78.object({
-    name: z78.string(),
-    ref: z78.string(),
-    digest: z78.string(),
-    receivedDigest: z78.string().nullable().default(null),
-    sizeBytes: z78.int().nonnegative(),
+  image: z79.object({
+    name: z79.string(),
+    ref: z79.string(),
+    digest: z79.string(),
+    receivedDigest: z79.string().nullable().default(null),
+    sizeBytes: z79.int().nonnegative(),
     source: ImageSourceSchema,
-    sourceImp: z78.string().nullable(),
-    isIncluded: z78.boolean()
+    sourceImp: z79.string().nullable(),
+    isIncluded: z79.boolean()
   }),
-  checkpoints: z78.array(CheckpointSchema3).readonly(),
-  streams: z78.array(StreamStepSchema).readonly().nullable(),
+  checkpoints: z79.array(CheckpointSchema3).readonly(),
+  streams: z79.array(StreamStepSchema).readonly().nullable(),
   warm: WarmSchema.nullable().default(null)
 }).readonly();
 var MOVE_PART_HEADER = "x-imp-move-part";
@@ -44543,7 +44645,7 @@ class MoveRequestError extends ImpdError {
 }
 
 // packages/daemon/src/imp-ops/moves/move-tickets.ts
-import * as z79 from "zod";
+import * as z80 from "zod";
 var MOVE_AUTH_SCHEME = "ImpMove";
 var MOVE_TICKET_PREFIX = "";
 function isSameHash(leftItem, rightItem) {
@@ -44557,19 +44659,19 @@ function readTicketHeader(request) {
 function buildTicketHeader(ticket) {
   return { authorization: `${MOVE_AUTH_SCHEME} ${ticket}` };
 }
-var ReceiptFileSchema = z79.object({
-  kind: z79.string(),
-  index: z79.int().nonnegative().optional(),
-  sha256: z79.string(),
-  bytes: z79.int().nonnegative()
+var ReceiptFileSchema = z80.object({
+  kind: z80.string(),
+  index: z80.int().nonnegative().optional(),
+  sha256: z80.string(),
+  bytes: z80.int().nonnegative()
 });
-var ReceiptBodySchema = z79.object({
-  ticketId: z79.string(),
-  name: z79.string(),
-  impId: z79.string(),
-  files: z79.array(ReceiptFileSchema)
+var ReceiptBodySchema = z80.object({
+  ticketId: z80.string(),
+  name: z80.string(),
+  impId: z80.string(),
+  files: z80.array(ReceiptFileSchema)
 });
-var ReceiptSchema = z79.object({ body: z79.string(), mac: z79.string() });
+var ReceiptSchema = z80.object({ body: z80.string(), mac: z80.string() });
 function buildReceipt(body, secret) {
   const text = JSON.stringify(body);
   return { body: text, mac: sign(secret, text).toString("hex") };
@@ -44794,7 +44896,7 @@ function createByteCounter(limit) {
 // packages/daemon/src/imp-ops/moves/move-frames.ts
 import { createHash as createHash8 } from "crypto";
 import { open as open6 } from "fs/promises";
-import * as z80 from "zod";
+import * as z81 from "zod";
 
 // packages/daemon/src/imp-ops/moves/create-content-hash.ts
 import { createHash as createHash7 } from "crypto";
@@ -44832,8 +44934,8 @@ var MOVE_BLOCK_BYTES = 1024 * 1024;
 var OFFSET_BYTES = 8;
 var HEADER_BYTES3 = 5;
 var MAX_PAYLOAD_BYTES = MOVE_BLOCK_BYTES + OFFSET_BYTES;
-var MoveFileSchema = z80.object({
-  kind: z80.enum([
+var MoveFileSchema = z81.object({
+  kind: z81.enum([
     "image-rootfs",
     "image-config",
     "checkpoint",
@@ -44843,13 +44945,13 @@ var MoveFileSchema = z80.object({
     "vmstate",
     "mem"
   ]),
-  index: z80.int().nonnegative().optional(),
-  sizeBytes: z80.int().nonnegative()
+  index: z81.int().nonnegative().optional(),
+  sizeBytes: z81.int().nonnegative()
 });
 function createFileContentHash(file) {
   return file.kind === "image-rootfs" || file.kind === "image-config" ? createContentHash(file.sizeBytes) : null;
 }
-var FileEndSchema = z80.object({ sha256: z80.string() });
+var FileEndSchema = z81.object({ sha256: z81.string() });
 function encodeFrame2(type, payload) {
   const frame = new Uint8Array(HEADER_BYTES3 + payload.length);
   const view = new DataView(frame.buffer);
@@ -45685,7 +45787,7 @@ function readSettled2(row, imp) {
 
 // packages/daemon/src/imp-ops/moves/move-sender.ts
 import invariant4 from "tiny-invariant";
-import { match as match4 } from "ts-pattern";
+import { match as match5 } from "ts-pattern";
 
 // packages/daemon/src/platform/db/move-send-steps.ts
 var MOVE_SEND_STEPS = [
@@ -46247,7 +46349,7 @@ function createMoveSender(deps) {
   };
   const recoverSend = async (imp, row) => {
     const log = getImpdLogger("move").with({ imp: imp.name });
-    await match4(pickSendRecovery(imp.moveState, row?.step)).with("unmark", () => removeMark(imp)).with("wait", () => {
+    await match5(pickSendRecovery(imp.moveState, row?.step)).with("unmark", () => removeMark(imp)).with("wait", () => {
       log.info("a prepared send waits for its send after a restart");
     }).with("abort", async () => {
       const isUndone = await resetSend(imp, row?.peer_url ?? null, row?.ticket ?? null);
@@ -46369,7 +46471,7 @@ function buildPublicError(name) {
 }
 function pickSendRecovery(moveState, step) {
   if (moveState === "sending") {
-    return match4(step).with(undefined, () => "unmark").with("prepared", () => "wait").with("streaming", () => "abort").with("sent", () => "commit").exhaustive();
+    return match5(step).with(undefined, () => "unmark").with("prepared", () => "wait").with("streaming", () => "abort").with("sent", () => "commit").exhaustive();
   }
   return moveState === "moved" && step === "sent" ? "commit" : "none";
 }
@@ -46421,7 +46523,7 @@ function createMoveService(deps) {
 // packages/daemon/src/surface/moves/create-move-peer-handler.ts
 import { OpenAPIHandler } from "@orpc/openapi/fetch";
 import { ORPCError as ORPCError7, implement as implement3, onError as onError3 } from "@orpc/server";
-import { match as match5 } from "ts-pattern";
+import { match as match6 } from "ts-pattern";
 function createMovePeerHandler(deps) {
   const withTicket = async (step, context, call) => {
     const startedAt = deps.now();
@@ -46472,7 +46574,7 @@ function createMovePeerHandler(deps) {
   const respondReceive = async (context) => {
     try {
       const received = await withTicket("receive", context, (checked) => deps.calls.receive(checked, context.request));
-      return match5(received).with({ kind: "part" }, (sent) => Response.json({ part: sent.part }, { status: 202 })).with({ kind: "receipt" }, (sent) => Response.json(sent.receipt)).exhaustive();
+      return match6(received).with({ kind: "part" }, (sent) => Response.json({ part: sent.part }, { status: 202 })).with({ kind: "receipt" }, (sent) => Response.json(sent.receipt)).exhaustive();
     } catch (error) {
       const failure = toPeerError(error);
       return Response.json(encodePeerError(failure), { status: failure.status });
@@ -46516,7 +46618,7 @@ import {
 } from "@orpc/client";
 import { ResponseValidationPlugin } from "@orpc/contract/plugins";
 import { OpenAPILink } from "@orpc/openapi-client/fetch";
-import * as z81 from "zod";
+import * as z82 from "zod";
 function makeConnectMovePeer(deps) {
   return (target) => {
     const sendLinkRequest = async (request) => {
@@ -46562,7 +46664,7 @@ function makeConnectMovePeer(deps) {
     };
   };
 }
-var PeerErrorBodySchema = z81.looseObject({ error: z81.string().optional() });
+var PeerErrorBodySchema = z82.looseObject({ error: z82.string().optional() });
 function decodePeerError(body, response) {
   const parsed = PeerErrorBodySchema.safeParse(body);
   if (!parsed.success) {
@@ -47322,7 +47424,7 @@ import { join as join29, posix as posix3 } from "path";
 
 // packages/local-tar/src/extract-local.ts
 import tar from "tar-stream";
-import * as z82 from "zod";
+import * as z83 from "zod";
 // packages/local-tar/src/pack-build-context.ts
 import { existsSync as existsSync17 } from "fs";
 import { lstat, readFile as readFile4, readdir } from "fs/promises";
@@ -48452,14 +48554,14 @@ function renderPinnedDockerfile(dockerfile, pins, platform) {
 }
 
 // packages/daemon/src/imps/images/pull/image-pin.ts
-import * as z83 from "zod";
+import * as z84 from "zod";
 var PIN_INSPECT_FORMAT = '{"Id":{{json .Id}},"RepoDigests":{{json .RepoDigests}},"Os":{{json .Os}},"Architecture":{{json .Architecture}},"Config":{{json .Config}}}';
-var ConfigSchema = z83.object({ OnBuild: z83.array(z83.unknown()).readonly().nullish() }).nullable();
-var PinInspectSchema = z83.object({
-  Id: z83.string(),
-  RepoDigests: z83.array(z83.string()).readonly().nullable(),
-  Os: z83.string(),
-  Architecture: z83.string(),
+var ConfigSchema = z84.object({ OnBuild: z84.array(z84.unknown()).readonly().nullish() }).nullable();
+var PinInspectSchema = z84.object({
+  Id: z84.string(),
+  RepoDigests: z84.array(z84.string()).readonly().nullable(),
+  Os: z84.string(),
+  Architecture: z84.string(),
   Config: ConfigSchema
 }).transform((inspect) => ({
   Id: inspect.Id,
@@ -48521,7 +48623,7 @@ impd pinned ${pinned}. On the containerd image store a retag of a multi-platform
 }
 
 // packages/daemon/src/imps/images/build/build-engine.ts
-import * as z84 from "zod";
+import * as z85 from "zod";
 
 // packages/daemon/src/imps/docker-contract/dockerfile-frontend.ts
 var DOCKERFILE_FRONTEND = "docker/dockerfile:1.28@sha256:bb22d9815c728170f72750f4e5b0d672e06176142e1d602c7e66c050100b7e5b";
@@ -48555,7 +48657,7 @@ function createBuildEngine(run) {
       if (version.exitCode !== 0) {
         throw new Error(`docker version: ${version.stderr.trim()}`);
       }
-      const [os, arch] = z84.tuple([z84.string(), z84.string()]).parse(version.stdout.trim().split(" ").map((part) => JSON.parse(part)));
+      const [os, arch] = z85.tuple([z85.string(), z85.string()]).parse(version.stdout.trim().split(" ").map((part) => JSON.parse(part)));
       return normalizePlatform(os, arch);
     },
     loadImage: async (image, signal) => {
@@ -48657,7 +48759,7 @@ class DockerBuildError extends Error {
 }
 
 // packages/daemon/src/imps/images/build/guest-build.ts
-import * as z85 from "zod";
+import * as z86 from "zod";
 
 // packages/daemon/src/vm/storage/count-tree-bytes.ts
 import { lstat as lstat3, readdir as readdir3 } from "fs/promises";
@@ -48928,8 +49030,8 @@ class ImageLimitError extends ImpdError {
 // packages/daemon/src/imps/images/build/guest-build.ts
 var GUEST_BUILD_TAG = "imp-build:latest";
 var LOG_MAX_CHARS = 8000;
-var ContainerIdSchema = z85.string().regex(/^[a-f0-9]{64}$/v);
-var OciConfigSchema = z85.record(z85.string(), z85.unknown()).nullable();
+var ContainerIdSchema = z86.string().regex(/^[a-f0-9]{64}$/v);
+var OciConfigSchema = z86.record(z86.string(), z86.unknown()).nullable();
 async function runGuestBuild(exec, options) {
   const lines = options.output === undefined ? null : createPlainLines(options.output);
   const result = await exec([
@@ -49388,7 +49490,7 @@ function normalizeDockerfilePath(path) {
 }
 
 // packages/daemon/src/imps/images/image-naming.ts
-import * as z86 from "zod";
+import * as z87 from "zod";
 var MAX_NAME_LENGTH2 = 31;
 function deriveImageName(ref) {
   const lastSegment = parseImageReference(ref).path.split("/").at(-1) ?? "";
@@ -49398,10 +49500,10 @@ function deriveImageName(ref) {
   }
   return name;
 }
-var OciConfigSchema2 = z86.object({
-  Env: z86.array(z86.string()).nullish(),
-  WorkingDir: z86.string().nullish(),
-  User: z86.string().nullish()
+var OciConfigSchema2 = z87.object({
+  Env: z87.array(z87.string()).nullish(),
+  WorkingDir: z87.string().nullish(),
+  User: z87.string().nullish()
 }).nullish();
 function buildImageRuntimeConfig(ociConfig) {
   const parsed = OciConfigSchema2.parse(ociConfig);
@@ -49415,16 +49517,16 @@ function buildImageRuntimeConfig(ociConfig) {
 // packages/daemon/src/imps/images/rootfs/create-image-writer.ts
 import { existsSync as existsSync19, mkdirSync as mkdirSync22, rmSync as rmSync26, statSync as statSync13, writeFileSync as writeFileSync8 } from "fs";
 import { join as join31 } from "path";
-import * as z88 from "zod";
+import * as z89 from "zod";
 
 // packages/daemon/src/imps/docker-contract/refusal.ts
-import { z as z87 } from "zod";
+import { z as z88 } from "zod";
 var PROXY_PREFIX = "imp-docker-proxy: ";
 var ENGINE_FAILURE_PREFIX = `${PROXY_PREFIX}the engine call failed: `;
 var REFUSAL_MAX_CHARS = 1000;
 var DAEMON_ERROR_PREFIX = "Error response from daemon: ";
 var UNABLE_TO_FIND_LINE = /^Unable to find image '[^'\n]+' locally$/u;
-var RefusalBodySchema = z87.strictObject({ message: z87.string() });
+var RefusalBodySchema = z88.strictObject({ message: z88.string() });
 function readProxyRefusal(text) {
   const body = readJsonMessage(text.trim());
   if (body !== null) {
@@ -49526,11 +49628,11 @@ function createDirectory(path, name) {
 }
 
 // packages/daemon/src/imps/images/rootfs/create-image-writer.ts
-var InspectSchema = z88.tuple([
-  z88.object({
-    Id: z88.string(),
-    Config: z88.unknown(),
-    Size: z88.number().optional()
+var InspectSchema = z89.tuple([
+  z89.object({
+    Id: z89.string(),
+    Config: z89.unknown(),
+    Size: z89.number().optional()
   })
 ]);
 function createImageWriter(deps) {
@@ -50215,11 +50317,11 @@ function createImpdStorage(config, deps) {
 }
 
 // packages/daemon/src/host-net/net/tailscale-status.ts
-import * as z89 from "zod";
-var IpListSchema = z89.array(z89.string()).nullable().optional();
-var StatusSchema = z89.object({
-  BackendState: z89.string(),
-  Self: z89.object({ HostName: z89.string(), DNSName: z89.string().optional(), TailscaleIPs: IpListSchema }).optional()
+import * as z90 from "zod";
+var IpListSchema = z90.array(z90.string()).nullable().optional();
+var StatusSchema = z90.object({
+  BackendState: z90.string(),
+  Self: z90.object({ HostName: z90.string(), DNSName: z90.string().optional(), TailscaleIPs: IpListSchema }).optional()
 });
 var UNKNOWN = { state: null, hostname: null, dnsName: null, ip: null, ips: [] };
 var STATUS_TTL_MS = 30000;
@@ -50497,18 +50599,18 @@ import { getOAuthProviderApi } from "@better-auth/oauth-provider";
 import { createAuthEndpoint } from "better-auth/api";
 import { setSessionCookie } from "better-auth/cookies";
 import { generateRandomString } from "better-auth/crypto";
-import * as z90 from "zod";
+import * as z91 from "zod";
 var CLIENT_SCOPES = [...ScopeSchema.options, "offline_access"];
 var APPROVAL_EMAIL_DOMAIN = "approval.imp.invalid";
-var SignInBodySchema = z90.object({
-  oauth_query: z90.string(),
-  tokenID: z90.string().min(1),
-  tokenName: z90.string().min(1),
-  imps: z90.array(z90.string()).nullable()
+var SignInBodySchema = z91.object({
+  oauth_query: z91.string(),
+  tokenID: z91.string().min(1),
+  tokenName: z91.string().min(1),
+  imps: z91.array(z91.string()).nullable()
 });
-var FixedClientBodySchema = z90.object({
-  name: z90.string().min(1),
-  redirectURIs: z90.array(z90.string()).min(1)
+var FixedClientBodySchema = z91.object({
+  name: z91.string().min(1),
+  redirectURIs: z91.array(z91.string()).min(1)
 });
 function createApproverPlugin() {
   return {
@@ -50534,7 +50636,7 @@ function createApproverPlugin() {
       }),
       verifyMCPAccessToken: createAuthEndpoint("/imp/verify-access-token", {
         method: "POST",
-        body: z90.object({ token: z90.string() }),
+        body: z91.object({ token: z91.string() }),
         metadata: { SERVER_ONLY: true }
       }, async (ctx) => {
         const provider = ctx.context.getPlugin("oauth-provider");
@@ -50578,7 +50680,7 @@ function createApproverPlugin() {
 
 // packages/daemon/src/identity/oauth/create-oauth-handlers.ts
 import { verifyOAuthQueryParams } from "@better-auth/oauth-provider";
-import * as z91 from "zod";
+import * as z92 from "zod";
 
 // packages/daemon/src/identity/oauth/build-bad-token-request.ts
 function buildBadTokenRequest() {
@@ -50806,14 +50908,14 @@ function expandScopes(asked) {
 }
 
 // packages/daemon/src/platform/http/render-html.ts
-import { P as P2, match as match6 } from "ts-pattern";
+import { P as P3, match as match7 } from "ts-pattern";
 var MARKUP = Symbol("markup");
 function renderHTML(strings, ...parts) {
   const html = parts.reduce((text, part, index) => `${text}${toHTML(part)}${strings[index + 1] ?? ""}`, strings[0] ?? "");
   return { [MARKUP]: true, html };
 }
 function toHTML(part) {
-  return match6(part).with(P2.string, (text) => escapeHTML(text)).with(P2.array(), (list) => list.map((each) => each.html).join("")).with({ html: P2.string }, (markup) => markup.html).exhaustive();
+  return match7(part).with(P3.string, (text) => escapeHTML(text)).with(P3.array(), (list) => list.map((each) => each.html).join("")).with({ html: P3.string }, (markup) => markup.html).exhaustive();
 }
 function escapeHTML(text) {
   return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
@@ -50950,9 +51052,9 @@ var MINUTE_MS2 = 60000;
 var CONSENT_MS = 10 * MINUTE_MS2;
 var MAX_FORM_BYTES = 16 * 1024;
 var METADATA_HEADERS = { "cache-control": "no-store" };
-var PKCEMissSchema = z91.object({
-  error: z91.literal("invalid_request"),
-  error_description: z91.literal("code verification failed")
+var PKCEMissSchema = z92.object({
+  error: z92.literal("invalid_request"),
+  error_description: z92.literal("code verification failed")
 });
 function createOAuthHandlers(deps) {
   const host = new URL(deps.origin).host;
@@ -51644,8 +51746,8 @@ function loadOrCreateHostId(dataDir) {
 
 // packages/daemon/src/network/tailnet-names/oauth-credential.ts
 import { readFileSync as readFileSync26, statSync as statSync14 } from "fs";
-import * as z92 from "zod";
-var CredentialSchema = z92.object({ clientId: z92.string().min(1), clientSecret: z92.string().min(1) });
+import * as z93 from "zod";
+var CredentialSchema = z93.object({ clientId: z93.string().min(1), clientSecret: z93.string().min(1) });
 function readOAuthCredential(path) {
   const mode = statSync14(path).mode & 511;
   if ((mode & 63) !== 0) {
@@ -51666,17 +51768,17 @@ function readJson(path) {
 }
 
 // packages/daemon/src/host-net/net/tailscale-serve.ts
-import * as z93 from "zod";
-var HandlerSchema = z93.object({ Proxy: z93.string().optional() });
-var WebSchema = z93.object({
-  Handlers: z93.record(z93.string(), HandlerSchema).nullable().optional()
+import * as z94 from "zod";
+var HandlerSchema = z94.object({ Proxy: z94.string().optional() });
+var WebSchema = z94.object({
+  Handlers: z94.record(z94.string(), HandlerSchema).nullable().optional()
 });
-var ServiceConfigSchema = z93.object({
-  Web: z93.record(z93.string(), WebSchema).nullable().optional()
+var ServiceConfigSchema = z94.object({
+  Web: z94.record(z94.string(), WebSchema).nullable().optional()
 });
-var ServeStatusSchema = z93.object({
-  TCP: z93.record(z93.string(), z93.unknown()).optional(),
-  Services: z93.record(z93.string(), ServiceConfigSchema).nullable().optional()
+var ServeStatusSchema = z94.object({
+  TCP: z94.record(z94.string(), z94.unknown()).optional(),
+  Services: z94.record(z94.string(), ServiceConfigSchema).nullable().optional()
 });
 function parseServeStatus(json) {
   try {
@@ -51727,17 +51829,17 @@ function createServiceServe(run = runChecked) {
 }
 
 // packages/daemon/src/network/tailnet-names/services-api.ts
-import * as z94 from "zod";
+import * as z95 from "zod";
 var TAILSCALE_API = "https://api.tailscale.com/api/v2";
 var TOKEN_MARGIN_MS = 60000;
-var ServiceSchema2 = z94.object({
-  name: z94.string(),
-  comment: z94.string().optional(),
-  ports: z94.array(z94.string()).readonly().optional(),
-  tags: z94.array(z94.string()).readonly().nullable().optional()
+var ServiceSchema2 = z95.object({
+  name: z95.string(),
+  comment: z95.string().optional(),
+  ports: z95.array(z95.string()).readonly().optional(),
+  tags: z95.array(z95.string()).readonly().nullable().optional()
 }).readonly();
-var ServiceListSchema2 = z94.object({ vipServices: z94.array(ServiceSchema2).nullable().optional() });
-var TokenSchema3 = z94.object({ access_token: z94.string(), expires_in: z94.number().positive() });
+var ServiceListSchema2 = z95.object({ vipServices: z95.array(ServiceSchema2).nullable().optional() });
+var TokenSchema3 = z95.object({ access_token: z95.string(), expires_in: z95.number().positive() });
 
 class TailscaleApiError extends Error {
   status;
@@ -51826,7 +51928,7 @@ function createServicesApi(options) {
     }
   };
 }
-var ErrorSchema = z94.object({ message: z94.string() });
+var ErrorSchema = z95.object({ message: z95.string() });
 function readErrorText(text) {
   try {
     return ErrorSchema.parse(JSON.parse(text)).message;
@@ -52253,14 +52355,14 @@ function formatAcmeError(error) {
 // packages/daemon/src/network/https/acme/cert-store.ts
 import { existsSync as existsSync22, mkdirSync as mkdirSync24, readFileSync as readFileSync27, rmSync as rmSync28 } from "fs";
 import { join as join35 } from "path";
-import * as z95 from "zod";
-var AttemptStateSchema = z95.object({
-  failures: z95.int().nonnegative(),
-  lastAttemptAt: z95.number().nullable(),
-  lastError: z95.string().nullable()
+import * as z96 from "zod";
+var AttemptStateSchema = z96.object({
+  failures: z96.int().nonnegative(),
+  lastAttemptAt: z96.number().nullable(),
+  lastError: z96.string().nullable()
 });
-var AccountSchema = z95.object({ directoryUrl: z95.string(), url: z95.string(), keyPem: z95.string() });
-var LegacyAccountSchema = z95.object({ directoryUrl: z95.string(), url: z95.string() });
+var AccountSchema = z96.object({ directoryUrl: z96.string(), url: z96.string(), keyPem: z96.string() });
+var LegacyAccountSchema = z96.object({ directoryUrl: z96.string(), url: z96.string() });
 var NO_ATTEMPTS = { failures: 0, lastAttemptAt: null, lastError: null };
 function createCertStore(dataDir) {
   const directory = join35(dataDir, "tls");
@@ -52398,7 +52500,7 @@ function createChalltestsrvProvider(apiUrl) {
 }
 
 // packages/daemon/src/network/https/dns/cloudflare-provider.ts
-import * as z96 from "zod";
+import * as z97 from "zod";
 
 // packages/daemon/src/network/https/dns/wait-for-txt.ts
 import { Resolver as Resolver2 } from "dns/promises";
@@ -52460,30 +52562,30 @@ var CLOUDFLARE_API = "https://api.cloudflare.com/client/v4";
 var TXT_TTL_S = 60;
 var A_TTL_S = 300;
 var PAGE_SIZE = 500;
-var ApiErrorSchema = z96.object({ code: z96.number().optional(), message: z96.string() });
-var EnvelopeSchema = z96.object({
-  success: z96.boolean(),
-  errors: z96.array(ApiErrorSchema).default([]),
-  result: z96.unknown().optional(),
-  result_info: z96.object({ page: z96.number(), total_pages: z96.number() }).optional()
+var ApiErrorSchema = z97.object({ code: z97.number().optional(), message: z97.string() });
+var EnvelopeSchema = z97.object({
+  success: z97.boolean(),
+  errors: z97.array(ApiErrorSchema).default([]),
+  result: z97.unknown().optional(),
+  result_info: z97.object({ page: z97.number(), total_pages: z97.number() }).optional()
 });
-var ZoneSchema = z96.object({
-  id: z96.string(),
-  name: z96.string(),
-  name_servers: z96.array(z96.string())
+var ZoneSchema = z97.object({
+  id: z97.string(),
+  name: z97.string(),
+  name_servers: z97.array(z97.string())
 });
-var RecordSchema = z96.object({
-  id: z96.string(),
-  name: z96.string().optional(),
-  type: z96.string().optional(),
-  content: z96.string(),
-  proxied: z96.boolean().optional(),
-  comment: z96.string().nullable().optional()
+var RecordSchema = z97.object({
+  id: z97.string(),
+  name: z97.string().optional(),
+  type: z97.string().optional(),
+  content: z97.string(),
+  proxied: z97.boolean().optional(),
+  comment: z97.string().nullable().optional()
 });
 var MANAGED_COMMENT = "managed by impd";
 var ADDRESS_TYPES = new Set(["A", "AAAA", "CNAME"]);
-var ZoneListSchema = z96.array(ZoneSchema);
-var RecordListSchema = z96.array(RecordSchema);
+var ZoneListSchema = z97.array(ZoneSchema);
+var RecordListSchema = z97.array(RecordSchema);
 function createCloudflareProvider(options) {
   const base = options.apiUrl ?? CLOUDFLARE_API;
   const send = options.fetch ?? fetch;
@@ -55002,8 +55104,8 @@ import {
   statSync as statSync15
 } from "fs";
 import { basename as basename5, dirname as dirname11, join as join37 } from "path";
-import * as z97 from "zod";
-var CopiesSchema = z97.record(z97.string(), z97.object({ ino: z97.string(), ctimeNs: z97.string(), size: z97.string() }));
+import * as z98 from "zod";
+var CopiesSchema = z98.record(z98.string(), z98.object({ ino: z98.string(), ctimeNs: z98.string(), size: z98.string() }));
 function createXfsBackups(ctx) {
   const backup = buildBackupPaths(ctx.dataDir);
   const freshCopies = new Set;