@impz/testing 5.0.0 → 6.0.0

package/dist/index.js

@@ -21711,7 +21711,6 @@ var EnvSchema = z53.object({
   IMP_SESSION_LOG_IMP_MAX_MIB: CountSchema3.default(64),
   IMP_SESSION_LOG_IMP_MAX_LIVE: CountSchema3.default(8),
   IMP_SESSION_LOG_MAX_AGE_DAYS: CountSchema3.default(7),
-  DOCKER_HOST: z53.string().optional(),
   IMP_KSM: z53.enum(["0", "1"]).default("0"),
   IMP_KSM_EXEC: z53.string().default("ksm-exec"),
   IMP_KSM_HEADROOM_PERCENT: z53.string().default("100"),
@@ -21876,7 +21875,6 @@ function loadConfig(env) {
       impMaxLive: parsed.IMP_SESSION_LOG_IMP_MAX_LIVE,
       maxAgeMs: parsed.IMP_SESSION_LOG_MAX_AGE_DAYS * 86400000
     },
-    dockerHost: parsed.DOCKER_HOST ?? null,
     dns: parsed.IMP_DNS,
     subnet,
     ipv6: parseIpv6Setting(parsed.IMP_SUBNET6),
@@ -21951,7 +21949,7 @@ import { join as join46 } from "path";
 // packages/daemon/package.json
 var package_default = {
   name: "@impz/daemon",
-  version: "5.0.0",
+  version: "6.0.0",
   private: true,
   description: "impd: the imp host daemon",
   type: "module",
@@ -21960,6 +21958,7 @@ var package_default = {
     "./testing": "./testing/index.ts",
     "./testing/build-stub-clock": "./testing/platform/build-stub-clock.ts",
     "./testing/data-layout": "./src/vm/storage/data-layout.ts",
+    "./testing/pebble-images": "./testing/network/pebble-images.ts",
     "./testing/start-stub-agent": "./testing/vm/start-stub-agent.ts",
     "./testing/start-test-impd": "./testing/start-test-impd.ts",
     "./testing/test-token": "./testing/test-token.ts",
@@ -31995,11 +31994,7 @@ function createImpServer(options, caller, calls) {
   const printError = options.printError ?? console.error;
   const server = new McpServer({ name: "imp", title: "imp", version: options.version }, {
     capabilities: { tools: { listChanged: false } },
-    instructions: [
-      'imp runs persistent Linux microVMs ("imps") that sleep when idle and wake on use.',
-      `This server may touch ${caller.guard.summary}.`,
-      "Create an imp, run commands and read and write files in it, checkpoint before a risky change, fork to try two fixes, and destroy what you no longer need."
-    ].join(" "),
+    instructions: buildInstructions(caller),
     supportedProtocolVersions: [...PROTOCOL_VERSIONS, ...MODERN_PROTOCOL_VERSIONS]
   });
   server.server.fallbackRequestHandler = (request) => Promise.reject(new ProtocolError(ProtocolErrorCode.MethodNotFound, `unknown method: ${request.method}`));
@@ -32055,6 +32050,20 @@ function createImpServer(options, caller, calls) {
   }
   return server;
 }
+var SCOPE_GUIDES = {
+  read: "This caller has the read scope, so it can only look: list imps, their URLs, the images and the checkpoints. Running commands, reading or writing files, and creating, checkpointing, forking or destroying an imp need a wider grant: exec or manage.",
+  exec: "This caller has the exec scope: list imps, their URLs, the images and the checkpoints, run commands and read and write files in an imp, and put one to sleep. Creating, checkpointing, restoring, forking or destroying an imp needs a manage grant.",
+  manage: "Create an imp, run commands and read and write files in it, checkpoint before a risky change, fork to try two fixes, and destroy what you no longer need."
+};
+function buildInstructions(caller) {
+  const names = TOOLS.filter((tool) => hasScope(caller.scope, tool.scope)).map((tool) => tool.definition.name);
+  return [
+    'imp runs persistent Linux microVMs ("imps") that sleep when idle and wake on use.',
+    `This server may touch ${caller.guard.summary}.`,
+    SCOPE_GUIDES[caller.scope],
+    `Its tools: ${names.join(", ")}.`
+  ].join(" ");
+}
 function startProgress(ctx, options) {
   const token = ctx.mcpReq._meta?.progressToken;
   if (token === undefined) {
@@ -33440,7 +33449,7 @@ input=$target.in
 next=$target.tmp
 
 mkdir -p "$(dirname "$target")"
-cat >"$input"
+cat > "$input"
 
 # the first line that is the marker, matched whole and as a fixed string
 split=$(grep -n -x -F -e "$marker" "$input" | head -n 1 | cut -d : -f 1)
@@ -33467,7 +33476,7 @@ done
   fi
   echo
   head -n "$((split - 1))" "$input"
-} >"$next"
+} > "$next"
 
 rm -f "$input"
 
@@ -47420,7 +47429,7 @@ function createImpdServices(config, deps, parts) {
 
 // packages/daemon/src/imps/images/build/create-image-builds.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync20, rmSync as rmSync24, statSync as statSync12 } from "fs";
-import { join as join29, posix as posix3 } from "path";
+import { join as join28, posix as posix3 } from "path";
 
 // packages/local-tar/src/extract-local.ts
 import tar from "tar-stream";
@@ -47885,6 +47894,9 @@ function formatFamiliarRepository(reference) {
 }
 
 // packages/daemon/src/imps/docker-contract/check-registry.ts
+function checkReferenceRegistry(reference) {
+  return checkRegistry(parseImageReference(reference).registry);
+}
 function checkRegistry(registry) {
   const host = readRegistryHost(registry).toLowerCase();
   if (host === "localhost" || host.endsWith(".localhost")) {
@@ -47895,9 +47907,6 @@ function checkRegistry(registry) {
   }
   return null;
 }
-function checkReferenceRegistry(reference) {
-  return checkRegistry(parseImageReference(reference).registry);
-}
 function readRegistryHost(registry) {
   if (registry.startsWith("[")) {
     return registry.slice(1, registry.indexOf("]"));
@@ -48761,54 +48770,12 @@ class DockerBuildError extends Error {
 // packages/daemon/src/imps/images/build/guest-build.ts
 import * as z86 from "zod";
 
-// packages/daemon/src/vm/storage/count-tree-bytes.ts
-import { lstat as lstat3, readdir as readdir3 } from "fs/promises";
-import { join as join28 } from "path";
-async function countTreeBytes(root, deps = {}) {
-  const readDir = deps.readDir ?? readDirEntries;
-  const inodes = new Map;
-  const dirs = [root];
-  for (let directory = dirs.pop();directory !== undefined; directory = dirs.pop()) {
-    const entries = await readEntries2(readDir, directory);
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        dirs.push(join28(directory, entry.name));
-      }
-    }
-    const files = entries.filter((entry) => entry.isFile());
-    const stats = await Promise.all(files.map((entry) => readFileStats(join28(directory, entry.name))));
-    for (const stat of stats) {
-      if (stat !== undefined) {
-        inodes.set(`${String(stat.dev)}:${String(stat.ino)}`, Math.max(0, stat.blocks - 1) * 512);
-      }
-    }
-  }
-  return [...inodes.values()].reduce((sum, bytes) => sum + bytes, 0);
-}
-function readDirEntries(directory) {
-  return readdir3(directory, { withFileTypes: true });
-}
-async function readEntries2(readDir, directory) {
-  try {
-    return await readDir(directory);
-  } catch (error) {
-    if (isMissing(error)) {
-      return [];
-    }
-    throw error;
-  }
-}
-function isMissing(error) {
-  return error instanceof Error && "code" in error && error.code === "ENOENT";
-}
-async function readFileStats(path) {
-  try {
-    return await lstat3(path);
-  } catch (error) {
-    if (isMissing(error)) {
-      return;
-    }
-    throw error;
+// packages/daemon/src/imps/images/build/image-limit-error.ts
+class ImageLimitError extends ImpdError {
+  name = "ImageLimitError";
+  constructor(limit, max) {
+    const over = limit === "bytes" ? `over ${String(Math.floor(max / 1024 ** 2))} MiB (IMP_BUILD_IMAGE_MAX_MIB)` : `over ${String(max)} files (IMP_BUILD_IMAGE_MAX_FILES)`;
+    super("BAD_REQUEST", { message: `the built image's filesystem is ${over}` });
   }
 }
 
@@ -48844,73 +48811,9 @@ var UNPACK_TAR_ARGS = [
   "-xpf",
   "-"
 ];
-async function writeExportedTree(containerId, root) {
-  const exporter = Bun.spawn(["docker", "export", containerId], {
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "pipe",
-    env: process.env
-  });
-  const tar = await spawnTar(root, exporter);
-  const state = { hasExportEnded: false, isTarFirst: false, isExportStopped: false };
-  const waitForExport = async () => {
-    await exporter.exited;
-    state.hasExportEnded = true;
-  };
-  const waitForTar = async () => {
-    const code = await tar.exited;
-    if (code !== 0 && !state.hasExportEnded) {
-      state.isTarFirst = true;
-      state.isExportStopped = true;
-      exporter.kill();
-    }
-  };
-  waitForExport();
-  waitForTar();
-  const [exportCode, exportStderr, tarCode, tarStderr] = await Promise.all([
-    exporter.exited,
-    new Response(exporter.stderr).text(),
-    tar.exited,
-    new Response(tar.stderr).text()
-  ]);
-  const failure = findUnpackFailure({
-    containerId,
-    exported: { exitCode: exportCode, stdout: "", stderr: exportStderr },
-    unpacked: { exitCode: tarCode, stdout: "", stderr: tarStderr },
-    isTarFirst: state.isTarFirst,
-    isExportStopped: state.isExportStopped && exporter.signalCode !== null
-  });
-  if (failure !== null) {
-    throw failure;
-  }
-  assertUnpacked({ exitCode: tarCode, stdout: "", stderr: tarStderr });
-}
-async function spawnTar(root, exporter) {
-  try {
-    return Bun.spawn([...UNPACK_TAR_ARGS, "-C", root], {
-      stdin: exporter.stdout,
-      stdout: "ignore",
-      stderr: "pipe",
-      env: { ...process.env, LC_ALL: "C" }
-    });
-  } catch (error) {
-    exporter.kill();
-    await exporter.exited;
-    throw error;
-  }
-}
-function findUnpackFailure(outcome) {
-  const exportFailure = outcome.exported.exitCode === 0 || outcome.isExportStopped ? null : buildExitError(["docker", "export", outcome.containerId], outcome.exported);
-  const tarFailure = outcome.unpacked.exitCode === 0 ? null : buildExitError(["tar"], outcome.unpacked);
-  if (exportFailure === null || tarFailure === null) {
-    return exportFailure ?? tarFailure;
-  }
-  const [first, second] = outcome.isTarFirst ? [tarFailure, exportFailure] : [exportFailure, tarFailure];
-  return new Error(`${first.message}; ${second.message}`);
-}
 function assertUnpacked(result) {
   if (result.exitCode !== 0) {
-    throw buildExitError(["docker", "export", "|", "tar"], result);
+    throw buildExitError(["tar"], result);
   }
   const failure = findXattrFailure(result.stderr);
   if (failure?.missingSetfcap === true) {
@@ -48946,6 +48849,122 @@ function readSetfcapWarning(status = readFileSync23("/proc/self/status", "utf8")
   return `no CAP_SETFCAP, so an image add or build fails on an image with a file capability; ${SETFCAP_HELP}`;
 }
 
+// packages/daemon/src/imps/images/rootfs/write-streamed-tree.ts
+var EXPORT_IDLE_MS = 120000;
+var GROW_STEP_BYTES = 256 * 1024 ** 2;
+var TAR_STOPPED = new Error("tar stopped before the export ended");
+async function writeStreamedTree(options) {
+  const root = options.root;
+  const limits = options.limits;
+  const grow = options.grow ?? (() => Promise.resolve());
+  const startTimer = options.startTimer;
+  const maxBytes = limits.maxBytes;
+  const tar = options.startTar([...UNPACK_TAR_ARGS, "-vv", "--quoting-style=escape", "-C", root]);
+  const sent = { bytes: 0 };
+  const unpacked = {};
+  const stopExport = new AbortController;
+  const readMax = (limit) => limit === "bytes" ? maxBytes : limits.maxFiles;
+  const listed = { bytes: 0 };
+  const held = { bytes: 0 };
+  const growHold = async () => {
+    const tree = Math.max(sent.bytes, listed.bytes);
+    const needed = 2 * tree + planRootfsOverhead(tree);
+    if (needed > held.bytes) {
+      held.bytes = (Math.floor(needed / GROW_STEP_BYTES) + 1) * GROW_STEP_BYTES;
+      const writtenBytes = await options.countTreeBytes(root);
+      await grow(held.bytes, writtenBytes);
+    }
+  };
+  const onCounted = (bytes) => {
+    listed.bytes = bytes;
+  };
+  const counting = countUnpacked(tar.stdout, limits, onCounted, (limit) => {
+    unpacked.over = limit;
+    const max = readMax(limit);
+    tar.kill();
+    stopExport.abort(new ImageLimitError(limit, max));
+  });
+  const waitForTar = async () => {
+    const code = await tar.exited;
+    if (code !== 0 && unpacked.ended !== true) {
+      stopExport.abort(TAR_STOPPED);
+    }
+  };
+  waitForTar();
+  const assertWithinLimits = () => {
+    const over = unpacked.over;
+    if (over !== undefined) {
+      throw new ImageLimitError(over, readMax(over));
+    }
+  };
+  const stopIdle = () => {
+    stopExport.abort(new Error(`${options.source} sent nothing in ${String(EXPORT_IDLE_MS / 1000)} s`));
+  };
+  const idle = { cancel: startTimer(stopIdle, EXPORT_IDLE_MS) };
+  const stderrText = new Response(tar.stderr).text();
+  try {
+    const exported = await options.runExport(async (chunk) => {
+      idle.cancel();
+      idle.cancel = startTimer(stopIdle, EXPORT_IDLE_MS);
+      sent.bytes += chunk.byteLength;
+      if (sent.bytes > maxBytes) {
+        throw new ImageLimitError("bytes", maxBytes);
+      }
+      assertWithinLimits();
+      await growHold();
+      await tar.stdin.write(chunk);
+      await tar.stdin.flush();
+    }, AbortSignal.any([options.signal, stopExport.signal]));
+    if (exported.exitCode !== 0) {
+      throw new Error(`${options.source}: ${exported.stderr.trim()}`);
+    }
+    unpacked.ended = true;
+    await tar.stdin.end();
+    const [exitCode, stderr] = await Promise.all([tar.exited, stderrText, counting]);
+    assertWithinLimits();
+    assertUnpacked({ exitCode, stdout: "", stderr });
+    await growHold();
+  } catch (error) {
+    tar.kill();
+    assertWithinLimits();
+    if (stopExport.signal.reason === TAR_STOPPED) {
+      const [exitCode, stderr] = await Promise.all([tar.exited, stderrText]);
+      assertUnpacked({ exitCode, stdout: "", stderr });
+    }
+    throw error;
+  } finally {
+    idle.cancel();
+  }
+}
+async function countUnpacked(stdout, limits, onCounted, onOver) {
+  const decoder = new TextDecoder;
+  const counted = { lines: 0, bytes: 0, rest: "" };
+  for await (const chunk of stdout) {
+    const lines = `${counted.rest}${decoder.decode(chunk, { stream: true })}`.split(`
+`);
+    counted.rest = lines.pop() ?? "";
+    for (const line of lines) {
+      counted.lines += 1;
+      counted.bytes += readAllocatedBytes(line);
+    }
+    onCounted(counted.bytes);
+    if (counted.bytes > limits.maxBytes) {
+      onOver("bytes");
+      return;
+    }
+    if (counted.lines > limits.maxFiles) {
+      onOver("files");
+      return;
+    }
+  }
+}
+var BLOCK_BYTES = 4096;
+function readAllocatedBytes(line) {
+  const size = line.trim().split(/\s+/v)[2] ?? "";
+  const bytes = /^\d+$/v.test(size) ? Number(size) : 0;
+  return Math.max(1, Math.ceil(bytes / BLOCK_BYTES)) * BLOCK_BYTES;
+}
+
 // packages/daemon/src/imps/images/build/create-build-steps.ts
 var STEP_PATTERN = /^\[(?:\S+ )?\d+\/\d+\] /v;
 function createBuildSteps(setStep) {
@@ -49018,15 +49037,6 @@ function createPlainLines(output) {
   };
 }
 
-// packages/daemon/src/imps/images/build/image-limit-error.ts
-class ImageLimitError extends ImpdError {
-  name = "ImageLimitError";
-  constructor(limit, max) {
-    const over = limit === "bytes" ? `over ${String(Math.floor(max / 1024 ** 2))} MiB (IMP_BUILD_IMAGE_MAX_MIB)` : `over ${String(max)} files (IMP_BUILD_IMAGE_MAX_FILES)`;
-    super("BAD_REQUEST", { message: `the built image's filesystem is ${over}` });
-  }
-}
-
 // packages/daemon/src/imps/images/build/guest-build.ts
 var GUEST_BUILD_TAG = "imp-build:latest";
 var LOG_MAX_CHARS = 8000;
@@ -49082,55 +49092,9 @@ async function loadGuestImage(exec, options) {
 var DIGEST_PREFIX = "imp-build-";
 var DIGEST_DOMAIN = `imp build image v1
 `;
-var EXPORT_IDLE_MS = 120000;
-var GROW_STEP_BYTES = 256 * 1024 ** 2;
-var TAR_STOPPED = new Error("tar stopped before the export ended");
-function createImageHash(configText) {
-  const config = new TextEncoder().encode(configText);
-  const length = new Uint8Array(8);
-  new DataView(length.buffer).setBigUint64(0, BigInt(config.byteLength));
-  const hash = new Bun.CryptoHasher("sha256");
-  hash.update(DIGEST_DOMAIN);
-  hash.update(length);
-  hash.update(config);
-  return hash;
-}
-var BLOCK_BYTES = 4096;
-function readAllocatedBytes(line) {
-  const size = line.trim().split(/\s+/v)[2] ?? "";
-  const bytes = /^\d+$/v.test(size) ? Number(size) : 0;
-  return Math.max(1, Math.ceil(bytes / BLOCK_BYTES)) * BLOCK_BYTES;
-}
-async function countUnpacked(stdout, limits, onCounted, onOver) {
-  const decoder = new TextDecoder;
-  const counted = { lines: 0, bytes: 0, rest: "" };
-  for await (const chunk of stdout) {
-    const lines = `${counted.rest}${decoder.decode(chunk, { stream: true })}`.split(`
-`);
-    counted.rest = lines.pop() ?? "";
-    for (const line of lines) {
-      counted.lines += 1;
-      counted.bytes += readAllocatedBytes(line);
-    }
-    onCounted(counted.bytes);
-    if (counted.bytes > limits.maxBytes) {
-      onOver("bytes");
-      return;
-    }
-    if (counted.lines > limits.maxFiles) {
-      onOver("files");
-      return;
-    }
-  }
-}
 async function writeGuestTree(options) {
   const exec = options.exec;
-  const root = options.root;
-  const limits = options.limits;
   const signal = options.signal;
-  const grow = options.grow ?? (() => Promise.resolve());
-  const startTimer = options.startTimer ?? startRealTimer;
-  const maxBytes = limits.maxBytes;
   const inspected = await exec(["docker", "image", "inspect", "--format", "{{json .Config}}", GUEST_BUILD_TAG], { signal });
   if (inspected.exitCode !== 0) {
     throw new Error(`docker image inspect in the builder: ${inspected.stderr.trim()}`);
@@ -49142,94 +49106,36 @@ async function writeGuestTree(options) {
     throw new Error(`docker create in the builder: ${created.stderr.trim()}`);
   }
   const containerId = ContainerIdSchema.parse(created.stdout.trim());
-  const tar = Bun.spawn([...UNPACK_TAR_ARGS, "-vv", "--quoting-style=escape", "-C", root], {
-    stdin: "pipe",
-    stdout: "pipe",
-    stderr: "pipe",
-    env: { ...process.env, LC_ALL: "C" }
-  });
   const hash = createImageHash(configText);
-  const sent = { bytes: 0 };
-  const unpacked = {};
-  const stopExport = new AbortController;
-  const readMax = (limit) => limit === "bytes" ? maxBytes : limits.maxFiles;
-  const listed = { bytes: 0 };
-  const held = { bytes: 0 };
-  const growHold = async () => {
-    const tree = Math.max(sent.bytes, listed.bytes);
-    const needed = 2 * tree + planRootfsOverhead(tree);
-    if (needed > held.bytes) {
-      held.bytes = (Math.floor(needed / GROW_STEP_BYTES) + 1) * GROW_STEP_BYTES;
-      const writtenBytes = await countTreeBytes(root);
-      await grow(held.bytes, writtenBytes);
-    }
-  };
-  const onCounted = (bytes) => {
-    listed.bytes = bytes;
-  };
-  const counting = countUnpacked(tar.stdout, limits, onCounted, (limit) => {
-    unpacked.over = limit;
-    const max = readMax(limit);
-    tar.kill();
-    stopExport.abort(new ImageLimitError(limit, max));
-  });
-  const waitForTar = async () => {
-    const code = await tar.exited;
-    if (code !== 0 && unpacked.ended !== true) {
-      stopExport.abort(TAR_STOPPED);
-    }
-  };
-  waitForTar();
-  const assertWithinLimits = () => {
-    const over = unpacked.over;
-    if (over !== undefined) {
-      throw new ImageLimitError(over, readMax(over));
-    }
-  };
-  const stopIdle = () => {
-    stopExport.abort(new Error(`docker export in the builder sent nothing in ${String(EXPORT_IDLE_MS / 1000)} s`));
-  };
-  const idle = { cancel: startTimer(stopIdle, EXPORT_IDLE_MS) };
-  const stderrText = new Response(tar.stderr).text();
-  try {
-    const exported = await exec(["docker", "export", containerId], {
-      signal: AbortSignal.any([signal, stopExport.signal]),
+  await writeStreamedTree({
+    root: options.root,
+    limits: options.limits,
+    signal,
+    source: "docker export in the builder",
+    grow: options.grow,
+    startTimer: options.startTimer,
+    startTar: options.startTar,
+    countTreeBytes: options.countTreeBytes,
+    runExport: (onStdout, exportSignal) => exec(["docker", "export", containerId], {
+      signal: exportSignal,
       onStdout: async (chunk) => {
-        idle.cancel();
-        idle.cancel = startTimer(stopIdle, EXPORT_IDLE_MS);
-        sent.bytes += chunk.byteLength;
-        if (sent.bytes > maxBytes) {
-          throw new ImageLimitError("bytes", maxBytes);
-        }
-        assertWithinLimits();
-        await growHold();
+        await onStdout(chunk);
         hash.update(chunk);
-        await tar.stdin.write(chunk);
-        await tar.stdin.flush();
       }
-    });
-    if (exported.exitCode !== 0) {
-      throw new Error(`docker export in the builder: ${exported.stderr.trim()}`);
-    }
-    unpacked.ended = true;
-    await tar.stdin.end();
-    const [exitCode, stderr] = await Promise.all([tar.exited, stderrText, counting]);
-    assertWithinLimits();
-    assertUnpacked({ exitCode, stdout: "", stderr });
-    await growHold();
-  } catch (error) {
-    tar.kill();
-    assertWithinLimits();
-    if (stopExport.signal.reason === TAR_STOPPED) {
-      const [exitCode, stderr] = await Promise.all([tar.exited, stderrText]);
-      assertUnpacked({ exitCode, stdout: "", stderr });
-    }
-    throw error;
-  } finally {
-    idle.cancel();
-  }
+    })
+  });
   return { digest: `${DIGEST_PREFIX}${hash.digest("hex")}`, config };
 }
+function createImageHash(configText) {
+  const config = new TextEncoder().encode(configText);
+  const length = new Uint8Array(8);
+  new DataView(length.buffer).setBigUint64(0, BigInt(config.byteLength));
+  const hash = new Bun.CryptoHasher("sha256");
+  hash.update(DIGEST_DOMAIN);
+  hash.update(length);
+  hash.update(config);
+  return hash;
+}
 
 // packages/daemon/src/imps/images/build/write-context-tar.ts
 import { open as open9 } from "fs/promises";
@@ -49397,7 +49303,7 @@ function createImageBuilds(deps, writer) {
       });
     }
     const uploadsDir = buildUploadsDir(deps.config.dataDir);
-    const tarPath = join29(uploadsDir, `${Bun.randomUUIDv7()}.tar`);
+    const tarPath = join28(uploadsDir, `${Bun.randomUUIDv7()}.tar`);
     mkdirSync20(uploadsDir, { recursive: true, mode: 448 });
     return deps.diskBudget.withRoom(tarBytes, async () => {
       try {
@@ -49516,96 +49422,33 @@ function buildImageRuntimeConfig(ociConfig) {
 
 // packages/daemon/src/imps/images/rootfs/create-image-writer.ts
 import { existsSync as existsSync19, mkdirSync as mkdirSync22, rmSync as rmSync26, statSync as statSync13, writeFileSync as writeFileSync8 } from "fs";
-import { join as join31 } from "path";
-import * as z89 from "zod";
-
-// packages/daemon/src/imps/docker-contract/refusal.ts
-import { z as z88 } from "zod";
-var PROXY_PREFIX = "imp-docker-proxy: ";
-var ENGINE_FAILURE_PREFIX = `${PROXY_PREFIX}the engine call failed: `;
-var REFUSAL_MAX_CHARS = 1000;
-var DAEMON_ERROR_PREFIX = "Error response from daemon: ";
-var UNABLE_TO_FIND_LINE = /^Unable to find image '[^'\n]+' locally$/u;
-var RefusalBodySchema = z88.strictObject({ message: z88.string() });
-function readProxyRefusal(text) {
-  const body = readJsonMessage(text.trim());
-  if (body !== null) {
-    return toRefusal(body);
-  }
-  const errorLine = readErrorLine(text.trimEnd().split(`
-`));
-  if (!errorLine.startsWith(DAEMON_ERROR_PREFIX)) {
-    return null;
-  }
-  const answer = errorLine.slice(DAEMON_ERROR_PREFIX.length);
-  return toRefusal(readJsonMessage(answer) ?? answer);
-}
-function readErrorLine(lines) {
-  const [first = "", second = ""] = lines;
-  if (lines.length === 1) {
-    return first;
-  }
-  return lines.length === 2 && UNABLE_TO_FIND_LINE.test(first) ? second : "";
-}
-function toRefusal(message) {
-  if (!message.startsWith(PROXY_PREFIX) || message.startsWith(ENGINE_FAILURE_PREFIX)) {
-    return null;
-  }
-  const firstLine = message.split(`
-`, 1)[0] ?? "";
-  return firstLine.trim().slice(0, REFUSAL_MAX_CHARS);
-}
-function readJsonMessage(text) {
-  if (!text.startsWith("{")) {
-    return null;
-  }
-  try {
-    const body = RefusalBodySchema.safeParse(JSON.parse(text));
-    return body.success ? body.data.message : null;
-  } catch {
-    return null;
-  }
-}
+import { join as join30 } from "path";
 
-// packages/daemon/src/imps/images/rootfs/run-docker.ts
-async function runDocker(argv, options = {}) {
-  const result = await runCommand(["docker", ...argv], {
-    ...options.env !== undefined && { env: options.env },
-    ...options.signal !== undefined && { signal: options.signal }
-  });
-  if (result.exitCode !== 0) {
-    const refused = readRefusalError(`docker ${argv[0] ?? ""}`, result.stderr);
-    if (refused !== null) {
-      throw refused;
-    }
-  }
-  return result;
-}
-function readRefusalError(call, output) {
-  const refusal = readProxyRefusal(output);
-  if (refusal === null) {
-    return null;
-  }
-  getImpdLogger("image").warning("{call} refused: {refusal}", { call, refusal });
-  return new ImpdError("BAD_REQUEST", { message: refusal });
-}
-async function runDockerChecked(argv, options = {}) {
-  const result = await runDocker(argv, options);
+// packages/daemon/src/imps/images/rootfs/read-oci-config.ts
+import * as z88 from "zod";
+var OciConfigSchema3 = z88.object({
+  digest: z88.string().regex(/^sha256:[a-f0-9]{64}$/v),
+  config: z88.record(z88.string(), z88.unknown()).nullable()
+});
+async function readOciConfig(ref, signal, run) {
+  const argv = ["oci-fetch", "config", ref];
+  const result = await run(argv, { signal });
+  signal.throwIfAborted();
   if (result.exitCode !== 0) {
-    throw buildExitError(["docker", ...argv], result);
+    throw buildExitError(argv, result);
   }
-  return result.stdout;
+  return OciConfigSchema3.parse(JSON.parse(result.stdout));
 }
 
 // packages/daemon/src/imps/images/rootfs/write-image-config.ts
 import { closeSync as closeSync9, constants as constants5, lstatSync as lstatSync5, mkdirSync as mkdirSync21, openSync as openSync7, rmSync as rmSync25, writeSync as writeSync3 } from "fs";
-import { join as join30 } from "path";
+import { join as join29 } from "path";
 function writeImageConfig(root, contents) {
-  const etc = join30(root, "etc");
-  const directory = join30(etc, "imp");
+  const etc = join29(root, "etc");
+  const directory = join29(etc, "imp");
   createDirectory(etc, "/etc");
   createDirectory(directory, "/etc/imp");
-  const file = join30(directory, "image.json");
+  const file = join29(directory, "image.json");
   rmSync25(file, { recursive: true, force: true });
   const fd = openSync7(file, constants5.O_WRONLY | constants5.O_CREAT | constants5.O_EXCL | constants5.O_NOFOLLOW, 420);
   try {
@@ -49627,14 +49470,22 @@ function createDirectory(path, name) {
   }
 }
 
+// packages/daemon/src/imps/images/rootfs/write-oci-tree.ts
+function writeOciTree(options) {
+  return writeStreamedTree({
+    root: options.root,
+    limits: options.limits,
+    signal: options.signal,
+    source: `oci-fetch export ${options.ref}`,
+    grow: options.grow,
+    startTimer: options.startTimer,
+    startTar: options.startTar,
+    countTreeBytes: options.countTreeBytes,
+    runExport: (onStdout, signal) => options.runStreamed(["oci-fetch", "export", options.ref], onStdout, signal)
+  });
+}
+
 // packages/daemon/src/imps/images/rootfs/create-image-writer.ts
-var InspectSchema = z89.tuple([
-  z89.object({
-    Id: z89.string(),
-    Config: z89.unknown(),
-    Size: z89.number().optional()
-  })
-]);
 function createImageWriter(deps) {
   const storageGate = deps.storageGate;
   const logger = getImpdLogger("image");
@@ -49642,22 +49493,10 @@ function createImageWriter(deps) {
   const publishers = new Map;
   const freshRootfs = new Set;
   const guestRootfsLock = buildKeyedMutex();
-  const docker = { env: deps.dockerEnv };
-  const readInspect = async (ref, signal) => {
-    const options = { ...docker, signal };
-    const first = await runDocker(["image", "inspect", ref], options);
-    if (first.exitCode === 0) {
-      return InspectSchema.parse(JSON.parse(first.stdout))[0];
-    }
-    await runDockerChecked(["pull", "--quiet", ref], options);
-    signal.throwIfAborted();
-    const stdout = await runDockerChecked(["image", "inspect", ref], options);
-    return InspectSchema.parse(JSON.parse(stdout))[0];
-  };
   const makeWorkDir = () => {
     const images = buildImagesDir(deps.config.dataDir);
-    const work = join31(images, `.build-${Bun.randomUUIDv7()}`);
-    const root = join31(work, "root");
+    const work = join30(images, `.build-${Bun.randomUUIDv7()}`);
+    const root = join30(work, "root");
     mkdirSync22(images, { recursive: true });
     mkdirSync22(work, { mode: 448 });
     mkdirSync22(root, { mode: 493 });
@@ -49668,7 +49507,7 @@ function createImageWriter(deps) {
     const usage = await readTreeUsage(root);
     const plan = planRootfs(usage);
     await deps.storage.createImage(digest, async (directory) => {
-      const image = join31(directory, "rootfs.ext4");
+      const image = join30(directory, "rootfs.ext4");
       await runChecked(["truncate", "-s", String(plan.bytes), image]);
       await runChecked([
         "mkfs.ext4",
@@ -49681,29 +49520,10 @@ function createImageWriter(deps) {
         root,
         image
       ]);
-      writeFileSync8(join31(directory, "config.json"), JSON.stringify(ociConfig ?? {}, null, 2));
+      writeFileSync8(join30(directory, "config.json"), JSON.stringify(ociConfig ?? {}, null, 2));
     });
     return readDiskUsage(buildImagePaths(deps.config.dataDir, digest).rootfs);
   };
-  const createRootfs = async (ref, digest, ociConfig) => {
-    const paths = buildImagePaths(deps.config.dataDir, digest);
-    if (existsSync19(paths.rootfs)) {
-      return readDiskUsage(paths.rootfs);
-    }
-    const created = await runDockerChecked(["create", ref, "/bin/true"], docker);
-    const containerId = created.trim();
-    try {
-      const workDir = makeWorkDir();
-      try {
-        await writeExportedTree(containerId, workDir.root);
-        return await writeRootfs(workDir.root, digest, ociConfig);
-      } finally {
-        rmSync26(workDir.work, { recursive: true, force: true });
-      }
-    } finally {
-      await runCommand(["docker", "rm", "-f", containerId]);
-    }
-  };
   const createRootfsOnce = (digest, create) => building.run(digest, create);
   const writeDockerImageRow = async (imageName, ref, digest, sizeBytes) => {
     const at = deps.clock.now();
@@ -49757,22 +49577,6 @@ function createImageWriter(deps) {
       });
     }
   });
-  const createImageOnHost = async (ref, imageName, options) => {
-    const inspect = await readInspect(ref, options.signal);
-    options.onPulled();
-    const treeBytes = inspect.Size ?? 0;
-    const buildBytes = 2 * treeBytes + planRootfsOverhead(treeBytes);
-    const withRoom = deps.diskBudget.withRoom;
-    return withRoom(buildBytes, () => storageGate.join(async () => {
-      await holdPublisher(inspect.Id);
-      try {
-        const sizeBytes = await createRootfsOnce(inspect.Id, () => createRootfs(ref, inspect.Id, inspect.Config));
-        return await writeDockerImageRow(imageName, ref, inspect.Id, sizeBytes);
-      } finally {
-        await releasePublisher(inspect.Id, imageName);
-      }
-    }));
-  };
   const writeGuestRootfsAndRow = async (guest) => {
     const digest = guest.digest;
     const rootfs = buildImagePaths(deps.config.dataDir, digest).rootfs;
@@ -49803,7 +49607,10 @@ function createImageWriter(deps) {
           root,
           limits: { maxBytes, maxFiles: deps.config.build.imageMaxFiles },
           signal,
-          grow
+          grow,
+          startTar: deps.startTar,
+          countTreeBytes: deps.countTreeBytes,
+          startTimer: deps.startTimer
         });
         return await writeGuestRootfsAndRow({
           root,
@@ -49818,6 +49625,41 @@ function createImageWriter(deps) {
       }
     }));
   };
+  const createBuilderImage = async (imageName, options) => {
+    const ref = deps.config.build.image;
+    const signal = options.signal;
+    const build = deps.config.build;
+    const limits = { maxBytes: build.imageMaxBytes, maxFiles: build.imageMaxFiles };
+    const image = await readOciConfig(ref, signal, deps.runCommand);
+    return deps.diskBudget.withGrowingRoom((grow) => storageGate.join(async () => {
+      const workDir = makeWorkDir();
+      const root = workDir.root;
+      try {
+        await writeOciTree({
+          ref,
+          root,
+          limits,
+          signal,
+          grow,
+          runStreamed: deps.runStreamed,
+          startTar: deps.startTar,
+          countTreeBytes: deps.countTreeBytes,
+          startTimer: deps.startTimer
+        });
+        options.onFetched();
+        return await writeGuestRootfsAndRow({
+          root,
+          digest: image.digest,
+          config: image.config,
+          imageName,
+          ref,
+          signal: new AbortController().signal
+        });
+      } finally {
+        rmSync26(workDir.work, { recursive: true, force: true });
+      }
+    }));
+  };
   const withPublisher = async (digest, imageName, publish) => {
     await holdPublisher(digest);
     try {
@@ -49826,7 +49668,7 @@ function createImageWriter(deps) {
       await releasePublisher(digest, imageName);
     }
   };
-  return { createImageOnHost, writeGuestImage, removeIdleRootfs, removeIdleImage, withPublisher };
+  return { createBuilderImage, writeGuestImage, removeIdleRootfs, removeIdleImage, withPublisher };
 }
 function requireDockerImage(existing) {
   if (existing?.source === "imp") {
@@ -49900,18 +49742,18 @@ function createImageAdds(deps, writer) {
   const createBuilderImage = async (ref) => {
     const pullMs = deps.builderImagePullMs ?? BUILDER_IMAGE_PULL_MS;
     const timeout = deps.startPullLimit?.(pullMs) ?? AbortSignal.timeout(pullMs);
-    const step = { pulled: false };
+    const step = { fetched: false };
     try {
-      return await writer.createImageOnHost(ref, BUILDER_IMAGE, {
+      return await writer.createBuilderImage(BUILDER_IMAGE, {
         signal: timeout,
-        onPulled: () => {
-          step.pulled = true;
+        onFetched: () => {
+          step.fetched = true;
         }
       });
     } catch (error) {
-      const reason = timeout.aborted && !step.pulled ? `the pull did not finish in ${formatPullLimit(pullMs)}; on a slow link, pull ${ref} on the host engine first (docker pull ${ref}), and impd takes it from there` : getErrorMessage(error);
+      const reason = timeout.aborted && !step.fetched ? `the fetch did not finish in ${formatPullLimit(pullMs)}` : getErrorMessage(error);
       throw new ImpdError("SERVICE_UNAVAILABLE", {
-        message: `impd cannot add its builder image ${ref} (IMP_BUILD_IMAGE) from the host engine, so no image add or build can run: ${reason}`
+        message: `impd cannot add its builder image ${ref} (IMP_BUILD_IMAGE) from its registry, so no image add or build can run: ${reason}`
       });
     }
   };
@@ -50103,7 +49945,10 @@ function createImageEviction(deps) {
 // packages/daemon/src/imps/images/image-service.ts
 function createImageService(deps) {
   const clock = deps.clock ?? REAL_CLOCK;
-  const writer = createImageWriter({ ...deps, clock });
+  const writer = createImageWriter({
+    ...deps,
+    clock
+  });
   const builds = createImageBuilds({ ...deps, clock }, writer);
   const adds = createImageAdds({ ...deps, clock }, writer);
   const eviction = createImageEviction({
@@ -50190,6 +50035,91 @@ function createImageService(deps) {
   };
 }
 
+// packages/daemon/src/imps/images/rootfs/start-tar-process.ts
+function startTarProcess(argv) {
+  return Bun.spawn([...argv], {
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { ...process.env, LC_ALL: "C" }
+  });
+}
+
+// packages/daemon/src/platform/process/run-streamed.ts
+async function runStreamed(argv, onStdout, signal) {
+  const child = Bun.spawn([...argv], {
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: process.env,
+    signal
+  });
+  const stderr = new Response(child.stderr).text();
+  try {
+    for await (const chunk of child.stdout) {
+      await onStdout(chunk);
+    }
+  } catch (error) {
+    child.kill();
+    await child.exited;
+    throw error;
+  }
+  const exitCode = await child.exited;
+  signal.throwIfAborted();
+  return { exitCode, stdout: "", stderr: await stderr };
+}
+
+// packages/daemon/src/vm/storage/count-tree-bytes.ts
+import { lstat as lstat3, readdir as readdir3 } from "fs/promises";
+import { join as join31 } from "path";
+async function countTreeBytes(root, deps = {}) {
+  const readDir = deps.readDir ?? readDirEntries;
+  const inodes = new Map;
+  const dirs = [root];
+  for (let directory = dirs.pop();directory !== undefined; directory = dirs.pop()) {
+    const entries = await readEntries2(readDir, directory);
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        dirs.push(join31(directory, entry.name));
+      }
+    }
+    const files = entries.filter((entry) => entry.isFile());
+    const stats = await Promise.all(files.map((entry) => readFileStats(join31(directory, entry.name))));
+    for (const stat of stats) {
+      if (stat !== undefined) {
+        inodes.set(`${String(stat.dev)}:${String(stat.ino)}`, Math.max(0, stat.blocks - 1) * 512);
+      }
+    }
+  }
+  return [...inodes.values()].reduce((sum, bytes) => sum + bytes, 0);
+}
+function readDirEntries(directory) {
+  return readdir3(directory, { withFileTypes: true });
+}
+async function readEntries2(readDir, directory) {
+  try {
+    return await readDir(directory);
+  } catch (error) {
+    if (isMissing(error)) {
+      return [];
+    }
+    throw error;
+  }
+}
+function isMissing(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+async function readFileStats(path) {
+  try {
+    return await lstat3(path);
+  } catch (error) {
+    if (isMissing(error)) {
+      return;
+    }
+    throw error;
+  }
+}
+
 // packages/daemon/src/vm/storage/disk-usage-cache.ts
 var REFRESH_DELAY_MS = 1e4;
 var CHANGES_USAGE = new Set([
@@ -50301,6 +50231,11 @@ function createImpdStorage(config, deps) {
     storageGate,
     diskBudget,
     readBuilders: () => buildersHolder.builders,
+    runCommand,
+    runStreamed,
+    startTar: startTarProcess,
+    countTreeBytes,
+    startTimer: startRealTimer,
     ...deps.now !== undefined && { clock: { now: deps.now } },
     ...deps.images
   });
@@ -50317,11 +50252,11 @@ function createImpdStorage(config, deps) {
 }
 
 // packages/daemon/src/host-net/net/tailscale-status.ts
-import * as z90 from "zod";
-var IpListSchema = z90.array(z90.string()).nullable().optional();
-var StatusSchema = z90.object({
-  BackendState: z90.string(),
-  Self: z90.object({ HostName: z90.string(), DNSName: z90.string().optional(), TailscaleIPs: IpListSchema }).optional()
+import * as z89 from "zod";
+var IpListSchema = z89.array(z89.string()).nullable().optional();
+var StatusSchema = z89.object({
+  BackendState: z89.string(),
+  Self: z89.object({ HostName: z89.string(), DNSName: z89.string().optional(), TailscaleIPs: IpListSchema }).optional()
 });
 var UNKNOWN = { state: null, hostname: null, dnsName: null, ip: null, ips: [] };
 var STATUS_TTL_MS = 30000;
@@ -50599,18 +50534,18 @@ import { getOAuthProviderApi } from "@better-auth/oauth-provider";
 import { createAuthEndpoint } from "better-auth/api";
 import { setSessionCookie } from "better-auth/cookies";
 import { generateRandomString } from "better-auth/crypto";
-import * as z91 from "zod";
+import * as z90 from "zod";
 var CLIENT_SCOPES = [...ScopeSchema.options, "offline_access"];
 var APPROVAL_EMAIL_DOMAIN = "approval.imp.invalid";
-var SignInBodySchema = z91.object({
-  oauth_query: z91.string(),
-  tokenID: z91.string().min(1),
-  tokenName: z91.string().min(1),
-  imps: z91.array(z91.string()).nullable()
+var SignInBodySchema = z90.object({
+  oauth_query: z90.string(),
+  tokenID: z90.string().min(1),
+  tokenName: z90.string().min(1),
+  imps: z90.array(z90.string()).nullable()
 });
-var FixedClientBodySchema = z91.object({
-  name: z91.string().min(1),
-  redirectURIs: z91.array(z91.string()).min(1)
+var FixedClientBodySchema = z90.object({
+  name: z90.string().min(1),
+  redirectURIs: z90.array(z90.string()).min(1)
 });
 function createApproverPlugin() {
   return {
@@ -50636,7 +50571,7 @@ function createApproverPlugin() {
       }),
       verifyMCPAccessToken: createAuthEndpoint("/imp/verify-access-token", {
         method: "POST",
-        body: z91.object({ token: z91.string() }),
+        body: z90.object({ token: z90.string() }),
         metadata: { SERVER_ONLY: true }
       }, async (ctx) => {
         const provider = ctx.context.getPlugin("oauth-provider");
@@ -50680,7 +50615,7 @@ function createApproverPlugin() {
 
 // packages/daemon/src/identity/oauth/create-oauth-handlers.ts
 import { verifyOAuthQueryParams } from "@better-auth/oauth-provider";
-import * as z92 from "zod";
+import * as z91 from "zod";
 
 // packages/daemon/src/identity/oauth/build-bad-token-request.ts
 function buildBadTokenRequest() {
@@ -51052,9 +50987,9 @@ var MINUTE_MS2 = 60000;
 var CONSENT_MS = 10 * MINUTE_MS2;
 var MAX_FORM_BYTES = 16 * 1024;
 var METADATA_HEADERS = { "cache-control": "no-store" };
-var PKCEMissSchema = z92.object({
-  error: z92.literal("invalid_request"),
-  error_description: z92.literal("code verification failed")
+var PKCEMissSchema = z91.object({
+  error: z91.literal("invalid_request"),
+  error_description: z91.literal("code verification failed")
 });
 function createOAuthHandlers(deps) {
   const host = new URL(deps.origin).host;
@@ -51746,8 +51681,8 @@ function loadOrCreateHostId(dataDir) {
 
 // packages/daemon/src/network/tailnet-names/oauth-credential.ts
 import { readFileSync as readFileSync26, statSync as statSync14 } from "fs";
-import * as z93 from "zod";
-var CredentialSchema = z93.object({ clientId: z93.string().min(1), clientSecret: z93.string().min(1) });
+import * as z92 from "zod";
+var CredentialSchema = z92.object({ clientId: z92.string().min(1), clientSecret: z92.string().min(1) });
 function readOAuthCredential(path) {
   const mode = statSync14(path).mode & 511;
   if ((mode & 63) !== 0) {
@@ -51768,17 +51703,17 @@ function readJson(path) {
 }
 
 // packages/daemon/src/host-net/net/tailscale-serve.ts
-import * as z94 from "zod";
-var HandlerSchema = z94.object({ Proxy: z94.string().optional() });
-var WebSchema = z94.object({
-  Handlers: z94.record(z94.string(), HandlerSchema).nullable().optional()
+import * as z93 from "zod";
+var HandlerSchema = z93.object({ Proxy: z93.string().optional() });
+var WebSchema = z93.object({
+  Handlers: z93.record(z93.string(), HandlerSchema).nullable().optional()
 });
-var ServiceConfigSchema = z94.object({
-  Web: z94.record(z94.string(), WebSchema).nullable().optional()
+var ServiceConfigSchema = z93.object({
+  Web: z93.record(z93.string(), WebSchema).nullable().optional()
 });
-var ServeStatusSchema = z94.object({
-  TCP: z94.record(z94.string(), z94.unknown()).optional(),
-  Services: z94.record(z94.string(), ServiceConfigSchema).nullable().optional()
+var ServeStatusSchema = z93.object({
+  TCP: z93.record(z93.string(), z93.unknown()).optional(),
+  Services: z93.record(z93.string(), ServiceConfigSchema).nullable().optional()
 });
 function parseServeStatus(json) {
   try {
@@ -51829,17 +51764,17 @@ function createServiceServe(run = runChecked) {
 }
 
 // packages/daemon/src/network/tailnet-names/services-api.ts
-import * as z95 from "zod";
+import * as z94 from "zod";
 var TAILSCALE_API = "https://api.tailscale.com/api/v2";
 var TOKEN_MARGIN_MS = 60000;
-var ServiceSchema2 = z95.object({
-  name: z95.string(),
-  comment: z95.string().optional(),
-  ports: z95.array(z95.string()).readonly().optional(),
-  tags: z95.array(z95.string()).readonly().nullable().optional()
+var ServiceSchema2 = z94.object({
+  name: z94.string(),
+  comment: z94.string().optional(),
+  ports: z94.array(z94.string()).readonly().optional(),
+  tags: z94.array(z94.string()).readonly().nullable().optional()
 }).readonly();
-var ServiceListSchema2 = z95.object({ vipServices: z95.array(ServiceSchema2).nullable().optional() });
-var TokenSchema3 = z95.object({ access_token: z95.string(), expires_in: z95.number().positive() });
+var ServiceListSchema2 = z94.object({ vipServices: z94.array(ServiceSchema2).nullable().optional() });
+var TokenSchema3 = z94.object({ access_token: z94.string(), expires_in: z94.number().positive() });
 
 class TailscaleApiError extends Error {
   status;
@@ -51928,7 +51863,7 @@ function createServicesApi(options) {
     }
   };
 }
-var ErrorSchema = z95.object({ message: z95.string() });
+var ErrorSchema = z94.object({ message: z94.string() });
 function readErrorText(text) {
   try {
     return ErrorSchema.parse(JSON.parse(text)).message;
@@ -52186,7 +52121,6 @@ async function listPublicImpNames(db) {
 
 // packages/daemon/src/network/https/acme/acme-issuer.ts
 import { Agent } from "https";
-import * as acme from "acme-client";
 
 // packages/daemon/src/network/https/acme/renewal-policy.ts
 var FIRST_BACKOFF_MS2 = 15 * 60000;
@@ -52228,10 +52162,12 @@ function findRenewalReason(info, domain, now) {
 
 // packages/daemon/src/network/https/acme/acme-issuer.ts
 function createAcmeIssuer(options) {
-  if (options.caPem !== null) {
-    acme.axios.defaults.httpsAgent = new Agent({ ca: options.caPem });
-  }
-  const openClient = async () => {
+  const loading = { promise: null };
+  const loadAcme = () => {
+    loading.promise ??= readAcmeClient(options.caPem);
+    return loading.promise;
+  };
+  const openClient = async (acme) => {
     const stored = options.store.readAccount(options.directoryUrl);
     if (stored !== null) {
       return new acme.Client({
@@ -52261,7 +52197,8 @@ function createAcmeIssuer(options) {
   };
   const runOrder = async (domain) => {
     await checkDirectory2(options.directoryUrl, options.caPem);
-    const client = await openClient();
+    const acme = await loadAcme();
+    const client = await openClient(acme);
     const names = listCertificateNames(domain);
     const order = await client.createOrder({
       identifiers: names.map((name) => ({ type: "dns", value: name }))
@@ -52310,24 +52247,12 @@ function createAcmeIssuer(options) {
     }
   };
 }
-function readCertificateInfo(chainPem) {
-  const info = acme.crypto.readCertificateInfo(chainPem);
-  const names = new Set([info.domains.commonName, ...info.domains.altNames]);
-  names.delete("");
-  return { notBefore: info.notBefore, notAfter: info.notAfter, names: [...names] };
-}
-async function removeRecords(options, records) {
-  for (const record of records) {
-    try {
-      await options.dns.removeTxt(record);
-    } catch (error) {
-      const reason = getErrorMessage(error);
-      getImpdLogger("https").warning("could not remove the TXT record {fqdn}: {reason}", {
-        fqdn: record.fqdn,
-        reason
-      });
-    }
+async function readAcmeClient(caPem) {
+  const acme = await import("acme-client");
+  if (caPem !== null) {
+    acme.axios.defaults.httpsAgent = new Agent({ ca: caPem });
   }
+  return acme;
 }
 async function checkDirectory2(directoryUrl, caPem) {
   try {
@@ -52344,6 +52269,19 @@ async function checkDirectory2(directoryUrl, caPem) {
     });
   }
 }
+async function removeRecords(options, records) {
+  for (const record of records) {
+    try {
+      await options.dns.removeTxt(record);
+    } catch (error) {
+      const reason = getErrorMessage(error);
+      getImpdLogger("https").warning("could not remove the TXT record {fqdn}: {reason}", {
+        fqdn: record.fqdn,
+        reason
+      });
+    }
+  }
+}
 function formatAcmeError(error) {
   const message = getErrorMessage(error);
   if (error instanceof TypeError && message.includes("response.config")) {
@@ -52355,14 +52293,14 @@ function formatAcmeError(error) {
 // packages/daemon/src/network/https/acme/cert-store.ts
 import { existsSync as existsSync22, mkdirSync as mkdirSync24, readFileSync as readFileSync27, rmSync as rmSync28 } from "fs";
 import { join as join35 } from "path";
-import * as z96 from "zod";
-var AttemptStateSchema = z96.object({
-  failures: z96.int().nonnegative(),
-  lastAttemptAt: z96.number().nullable(),
-  lastError: z96.string().nullable()
+import * as z95 from "zod";
+var AttemptStateSchema = z95.object({
+  failures: z95.int().nonnegative(),
+  lastAttemptAt: z95.number().nullable(),
+  lastError: z95.string().nullable()
 });
-var AccountSchema = z96.object({ directoryUrl: z96.string(), url: z96.string(), keyPem: z96.string() });
-var LegacyAccountSchema = z96.object({ directoryUrl: z96.string(), url: z96.string() });
+var AccountSchema = z95.object({ directoryUrl: z95.string(), url: z95.string(), keyPem: z95.string() });
+var LegacyAccountSchema = z95.object({ directoryUrl: z95.string(), url: z95.string() });
 var NO_ATTEMPTS = { failures: 0, lastAttemptAt: null, lastError: null };
 function createCertStore(dataDir) {
   const directory = join35(dataDir, "tls");
@@ -52500,7 +52438,7 @@ function createChalltestsrvProvider(apiUrl) {
 }
 
 // packages/daemon/src/network/https/dns/cloudflare-provider.ts
-import * as z97 from "zod";
+import * as z96 from "zod";
 
 // packages/daemon/src/network/https/dns/wait-for-txt.ts
 import { Resolver as Resolver2 } from "dns/promises";
@@ -52562,30 +52500,30 @@ var CLOUDFLARE_API = "https://api.cloudflare.com/client/v4";
 var TXT_TTL_S = 60;
 var A_TTL_S = 300;
 var PAGE_SIZE = 500;
-var ApiErrorSchema = z97.object({ code: z97.number().optional(), message: z97.string() });
-var EnvelopeSchema = z97.object({
-  success: z97.boolean(),
-  errors: z97.array(ApiErrorSchema).default([]),
-  result: z97.unknown().optional(),
-  result_info: z97.object({ page: z97.number(), total_pages: z97.number() }).optional()
+var ApiErrorSchema = z96.object({ code: z96.number().optional(), message: z96.string() });
+var EnvelopeSchema = z96.object({
+  success: z96.boolean(),
+  errors: z96.array(ApiErrorSchema).default([]),
+  result: z96.unknown().optional(),
+  result_info: z96.object({ page: z96.number(), total_pages: z96.number() }).optional()
 });
-var ZoneSchema = z97.object({
-  id: z97.string(),
-  name: z97.string(),
-  name_servers: z97.array(z97.string())
+var ZoneSchema = z96.object({
+  id: z96.string(),
+  name: z96.string(),
+  name_servers: z96.array(z96.string())
 });
-var RecordSchema = z97.object({
-  id: z97.string(),
-  name: z97.string().optional(),
-  type: z97.string().optional(),
-  content: z97.string(),
-  proxied: z97.boolean().optional(),
-  comment: z97.string().nullable().optional()
+var RecordSchema = z96.object({
+  id: z96.string(),
+  name: z96.string().optional(),
+  type: z96.string().optional(),
+  content: z96.string(),
+  proxied: z96.boolean().optional(),
+  comment: z96.string().nullable().optional()
 });
 var MANAGED_COMMENT = "managed by impd";
 var ADDRESS_TYPES = new Set(["A", "AAAA", "CNAME"]);
-var ZoneListSchema = z97.array(ZoneSchema);
-var RecordListSchema = z97.array(RecordSchema);
+var ZoneListSchema = z96.array(ZoneSchema);
+var RecordListSchema = z96.array(RecordSchema);
 function createCloudflareProvider(options) {
   const base = options.apiUrl ?? CLOUDFLARE_API;
   const send = options.fetch ?? fetch;
@@ -52751,6 +52689,20 @@ function createDnsProvider(config, token) {
   });
 }
 
+// packages/daemon/src/network/https/acme/read-certificate-info.ts
+import"reflect-metadata";
+import * as x5092 from "@peculiar/x509";
+function readCertificateInfo(chainPem) {
+  const certificate = new x5092.X509Certificate(x5092.PemConverter.decodeFirst(chainPem));
+  const altNames = certificate.getExtension(x5092.SubjectAlternativeNameExtension);
+  const names = new Set([
+    ...certificate.subjectName.getField("CN"),
+    ...altNames?.names.items.map((name) => name.value) ?? []
+  ]);
+  names.delete("");
+  return { notBefore: certificate.notBefore, notAfter: certificate.notAfter, names: [...names] };
+}
+
 // packages/daemon/src/network/https/acme/cert-manager.ts
 function createCertManager(options) {
   const domain = options.domain;
@@ -55104,8 +55056,8 @@ import {
   statSync as statSync15
 } from "fs";
 import { basename as basename5, dirname as dirname11, join as join37 } from "path";
-import * as z98 from "zod";
-var CopiesSchema = z98.record(z98.string(), z98.object({ ino: z98.string(), ctimeNs: z98.string(), size: z98.string() }));
+import * as z97 from "zod";
+var CopiesSchema = z97.record(z97.string(), z97.object({ ino: z97.string(), ctimeNs: z97.string(), size: z97.string() }));
 function createXfsBackups(ctx) {
   const backup = buildBackupPaths(ctx.dataDir);
   const freshCopies = new Set;