@impz/testing 5.0.0 → 6.0.1

package/dist/index.js

@@ -21711,7 +21711,6 @@ var EnvSchema = z53.object({
   IMP_SESSION_LOG_IMP_MAX_MIB: CountSchema3.default(64),
   IMP_SESSION_LOG_IMP_MAX_LIVE: CountSchema3.default(8),
   IMP_SESSION_LOG_MAX_AGE_DAYS: CountSchema3.default(7),
-  DOCKER_HOST: z53.string().optional(),
   IMP_KSM: z53.enum(["0", "1"]).default("0"),
   IMP_KSM_EXEC: z53.string().default("ksm-exec"),
   IMP_KSM_HEADROOM_PERCENT: z53.string().default("100"),
@@ -21876,7 +21875,6 @@ function loadConfig(env) {
       impMaxLive: parsed.IMP_SESSION_LOG_IMP_MAX_LIVE,
       maxAgeMs: parsed.IMP_SESSION_LOG_MAX_AGE_DAYS * 86400000
     },
-    dockerHost: parsed.DOCKER_HOST ?? null,
     dns: parsed.IMP_DNS,
     subnet,
     ipv6: parseIpv6Setting(parsed.IMP_SUBNET6),
@@ -21951,7 +21949,7 @@ import { join as join46 } from "path";
 // packages/daemon/package.json
 var package_default = {
   name: "@impz/daemon",
-  version: "5.0.0",
+  version: "6.0.1",
   private: true,
   description: "impd: the imp host daemon",
   type: "module",
@@ -21960,6 +21958,7 @@ var package_default = {
     "./testing": "./testing/index.ts",
     "./testing/build-stub-clock": "./testing/platform/build-stub-clock.ts",
     "./testing/data-layout": "./src/vm/storage/data-layout.ts",
+    "./testing/pebble-images": "./testing/network/pebble-images.ts",
     "./testing/start-stub-agent": "./testing/vm/start-stub-agent.ts",
     "./testing/start-test-impd": "./testing/start-test-impd.ts",
     "./testing/test-token": "./testing/test-token.ts",
@@ -26653,6 +26652,12 @@ import { FFIType, dlopen, read } from "bun:ffi";
 var CORE_SYMBOLS = {
   ioctl: { args: [FFIType.i32, FFIType.u64, FFIType.ptr], returns: FFIType.i32 },
   lseek: { args: [FFIType.i32, FFIType.i64, FFIType.i32], returns: FFIType.i64 },
+  mmap: {
+    args: [FFIType.u64, FFIType.u64, FFIType.i32, FFIType.i32, FFIType.i32, FFIType.i64],
+    returns: FFIType.i64
+  },
+  munmap: { args: [FFIType.u64, FFIType.u64], returns: FFIType.i32 },
+  mlock: { args: [FFIType.u64, FFIType.u64], returns: FFIType.i32 },
   __errno_location: { args: [], returns: FFIType.ptr }
 };
 var PIDFD_SYMBOLS = {
@@ -31995,11 +32000,7 @@ function createImpServer(options, caller, calls) {
   const printError = options.printError ?? console.error;
   const server = new McpServer({ name: "imp", title: "imp", version: options.version }, {
     capabilities: { tools: { listChanged: false } },
-    instructions: [
-      'imp runs persistent Linux microVMs ("imps") that sleep when idle and wake on use.',
-      `This server may touch ${caller.guard.summary}.`,
-      "Create an imp, run commands and read and write files in it, checkpoint before a risky change, fork to try two fixes, and destroy what you no longer need."
-    ].join(" "),
+    instructions: buildInstructions(caller),
     supportedProtocolVersions: [...PROTOCOL_VERSIONS, ...MODERN_PROTOCOL_VERSIONS]
   });
   server.server.fallbackRequestHandler = (request) => Promise.reject(new ProtocolError(ProtocolErrorCode.MethodNotFound, `unknown method: ${request.method}`));
@@ -32055,6 +32056,20 @@ function createImpServer(options, caller, calls) {
   }
   return server;
 }
+var SCOPE_GUIDES = {
+  read: "This caller has the read scope, so it can only look: list imps, their URLs, the images and the checkpoints. Running commands, reading or writing files, and creating, checkpointing, forking or destroying an imp need a wider grant: exec or manage.",
+  exec: "This caller has the exec scope: list imps, their URLs, the images and the checkpoints, run commands and read and write files in an imp, and put one to sleep. Creating, checkpointing, restoring, forking or destroying an imp needs a manage grant.",
+  manage: "Create an imp, run commands and read and write files in it, checkpoint before a risky change, fork to try two fixes, and destroy what you no longer need."
+};
+function buildInstructions(caller) {
+  const names = TOOLS.filter((tool) => hasScope(caller.scope, tool.scope)).map((tool) => tool.definition.name);
+  return [
+    'imp runs persistent Linux microVMs ("imps") that sleep when idle and wake on use.',
+    `This server may touch ${caller.guard.summary}.`,
+    SCOPE_GUIDES[caller.scope],
+    `Its tools: ${names.join(", ")}.`
+  ].join(" ");
+}
 function startProgress(ctx, options) {
   const token = ctx.mcpReq._meta?.progressToken;
   if (token === undefined) {
@@ -33440,7 +33455,7 @@ input=$target.in
 next=$target.tmp
 
 mkdir -p "$(dirname "$target")"
-cat >"$input"
+cat > "$input"
 
 # the first line that is the marker, matched whole and as a fixed string
 split=$(grep -n -x -F -e "$marker" "$input" | head -n 1 | cut -d : -f 1)
@@ -33467,7 +33482,7 @@ done
   fi
   echo
   head -n "$((split - 1))" "$input"
-} >"$next"
+} > "$next"
 
 rm -f "$input"
 
@@ -37239,8 +37254,9 @@ function createRamGovernor(deps) {
     const listed = await deps.listAwake();
     const awake = listed.filter((imp) => imp.id !== excludeId);
     const byImp = new Map;
-    let usedMib = 0;
-    let effectiveMib = 0;
+    const lockedMib = deps.readLockedMib?.() ?? 0;
+    let usedMib = lockedMib;
+    let effectiveMib = lockedMib;
     const readings = await Promise.all(awake.map((imp) => readVmMib(imp.pid, imp.apiSocket)));
     for (const [index, imp] of awake.entries()) {
       const measured = readings[index] ?? 0;
@@ -38938,6 +38954,89 @@ async function setupVm(api, config) {
   await api.putBalloon(VM_DEVICES.balloon);
 }
 
+// packages/daemon/src/vm/templates/template-locks.ts
+import { match as match6 } from "ts-pattern";
+
+// packages/daemon/src/vm/templates/can-admit-lock.ts
+var MAX_LOCKED_PERCENT = 10;
+var MIB3 = 1024 * 1024;
+function canAdmitLock(admission) {
+  const maxLockedBytes = Math.floor(admission.ramBudgetMib * MAX_LOCKED_PERCENT / 100) * MIB3;
+  return admission.heldBytes + admission.lockBytes <= maxLockedBytes;
+}
+
+// packages/daemon/src/vm/templates/pick-lock-outcome.ts
+import { P as P3, match as match5 } from "ts-pattern";
+var MIB4 = 1024 * 1024;
+function pickLockOutcome(result, isCurrent) {
+  return match5(result).with({ errno: P3.number }, (failed) => ({ kind: "failed", errno: failed.errno })).with({ declinedBytes: P3.number }, (declined) => ({
+    kind: "declined",
+    lockMib: Math.ceil(declined.declinedBytes / MIB4)
+  })).with({ lock: P3.select() }, (lock) => isCurrent ? { kind: "held", lock, lockMib: Math.ceil(lock.lockedBytes / MIB4) } : { kind: "stale", lock }).exhaustive();
+}
+
+// packages/daemon/src/vm/templates/template-locks.ts
+var MIB5 = 1024 * 1024;
+function createTemplateLocks(deps) {
+  const locks = new Map;
+  const locking = createSingleFlight();
+  const sizedBytes = new Map;
+  const state = { isStopping: false };
+  const readHeldBytes = () => [...locks.values()].reduce((total, held) => total + held.lockedBytes, 0) + [...sizedBytes.values()].reduce((total, bytes) => total + bytes, 0);
+  const runLock = async (target) => {
+    const key = target.key.slice(0, 12);
+    try {
+      const result = await deps.lockMemory(target.memFile, (lockBytes) => {
+        const isAdmitted = canAdmitLock({
+          heldBytes: readHeldBytes(),
+          lockBytes,
+          ramBudgetMib: deps.ramBudgetMib
+        });
+        if (isAdmitted) {
+          sizedBytes.set(target.buildId, lockBytes);
+        }
+        return isAdmitted;
+      });
+      match6(pickLockOutcome(result, deps.probeCurrent(target))).with({ kind: "failed" }, (failed) => {
+        deps.logger.warning("boot template {key} memory not locked (errno {errno}): a restore reads what the host dropped", { key, errno: String(failed.errno) });
+      }).with({ kind: "declined" }, (declined) => {
+        deps.logger.info("boot template {key} memory not locked: {lockMib} MiB would take the locks past a tenth of the RAM budget", { key, lockMib: String(declined.lockMib) });
+      }).with({ kind: "stale" }, (stale) => {
+        stale.lock.release();
+      }).with({ kind: "held" }, (held) => {
+        locks.set(target.key, held.lock);
+        deps.logger.info("boot template {key} memory locked: {lockMib} MiB", {
+          key,
+          lockMib: String(held.lockMib)
+        });
+      }).exhaustive();
+    } catch (error) {
+      deps.logger.warning("boot template {key} memory not locked: {error}", {
+        key,
+        error: getErrorMessage(error)
+      });
+    } finally {
+      sizedBytes.delete(target.buildId);
+    }
+  };
+  return {
+    lock: (target) => state.isStopping || locks.has(target.key) ? Promise.resolve() : locking.run(target.buildId, () => runLock(target)),
+    release: (key) => {
+      locks.get(key)?.release();
+      locks.delete(key);
+    },
+    readLockedMib: () => Math.ceil(readHeldBytes() / MIB5),
+    stop: async () => {
+      state.isStopping = true;
+      await locking.waitForAll();
+      for (const held of locks.values()) {
+        held.release();
+      }
+      locks.clear();
+    }
+  };
+}
+
 // packages/daemon/src/vm/templates/boot-templates.ts
 var TEMPLATE_BOOT_ARGS = [...BASE_BOOT_ARGS, "imp.template=1"].join(" ");
 var TEMPLATE_ADDRESS = {
@@ -38956,7 +39055,7 @@ var BUILD_JAIL_ID = "tpl-build";
 var BUILD_CPU = { limit: null, weight: 100 };
 var PLACEHOLDER_BYTES = 1024 * 1024;
 var PLACEHOLDER_NAME = "placeholder.ext4";
-var MIB3 = 1024 * 1024;
+var MIB6 = 1024 * 1024;
 var MIN_MISSES = 2;
 var MAX_TEMPLATES = 4;
 var MAX_BUILD_FAILURES = 3;
@@ -39030,6 +39129,7 @@ function createBootTemplates(deps) {
   };
   const listTemplateKeys = () => existsSync9(root) ? readdirSync3(root).filter((name) => name !== PLACEHOLDER_NAME && !name.startsWith(".")) : [];
   const removeDir = (name) => {
+    templateLocks.release(name);
     const gone = join18(root, `.gone-${Bun.randomUUIDv7()}`);
     try {
       renameSync3(join18(root, name), gone);
@@ -39039,6 +39139,12 @@ function createBootTemplates(deps) {
     rmSync15(gone, { recursive: true, force: true });
     lastUsed.delete(name);
   };
+  const templateLocks = createTemplateLocks({
+    lockMemory: deps.lockMemory,
+    probeCurrent: (target) => readMeta(target.key)?.buildId === target.buildId,
+    ramBudgetMib: deps.ramBudgetMib,
+    logger: getImpdLogger("boot")
+  });
   const readLastUsed = (key) => {
     const used = lastUsed.get(key);
     if (used !== undefined) {
@@ -39129,7 +39235,7 @@ function createBootTemplates(deps) {
       key: key.slice(0, 12),
       durationMs: String(durationMs)
     });
-    return {
+    const files = {
       key,
       buildId,
       vmstate: join18(root, key, "vmstate"),
@@ -39137,6 +39243,8 @@ function createBootTemplates(deps) {
       systemDrivePath: meta.systemDrivePath,
       placeholderPath: placeholder
     };
+    templateLocks.lock(files);
+    return files;
   };
   const runBuild = async (shape, key) => {
     const work = join18(root, `.build-${Bun.randomUUIDv7()}`);
@@ -39155,7 +39263,7 @@ function createBootTemplates(deps) {
         memoryMib: shape.memoryMib,
         maySleepImps: false
       });
-      return await (deps.diskBudget === undefined ? writeAdmitted() : deps.diskBudget.withRoom(shape.memoryMib * MIB3, writeAdmitted));
+      return await (deps.diskBudget === undefined ? writeAdmitted() : deps.diskBudget.withRoom(shape.memoryMib * MIB6, writeAdmitted));
     } catch (error) {
       if (progress.isBuilding) {
         throw error;
@@ -39270,10 +39378,98 @@ function createBootTemplates(deps) {
       const meta = readMeta(key);
       return meta === null ? [] : [meta.systemDrivePath];
     }),
-    stop: () => building.waitForAll()
+    lockKept: async () => {
+      for (const key of listTemplateKeys()) {
+        const ready = readReady(key);
+        if (ready !== null) {
+          await templateLocks.lock(ready);
+        }
+      }
+    },
+    readLockedMib: templateLocks.readLockedMib,
+    stop: async () => {
+      await Promise.all([templateLocks.stop(), building.waitForAll()]);
+    }
   };
 }
 
+// packages/daemon/src/vm/templates/create-memory-lock.ts
+import { closeSync as closeSync8, fstatSync as fstatSync3, openSync as openSync6 } from "fs";
+var PROT_READ = 1;
+var MAP_SHARED = 1;
+async function createMemoryLock(path, onSized) {
+  const libc = readLibc();
+  if (libc === null) {
+    return { errno: -1 };
+  }
+  const fd = openSync6(path, "r");
+  try {
+    const size = fstatSync3(fd).size;
+    const runs = readDataRuns(libc, fd, size);
+    if ("errno" in runs) {
+      return runs;
+    }
+    const lockedBytes = runs.reduce((total, run) => total + run.length, 0);
+    if (!onSized(lockedBytes)) {
+      return { declinedBytes: lockedBytes };
+    }
+    const address = Number(libc.mmap(0, size, PROT_READ, MAP_SHARED, fd, 0));
+    if (address === -1) {
+      return { errno: readErrno() };
+    }
+    const mapping = { isMapped: true };
+    const release = () => {
+      if (mapping.isMapped) {
+        mapping.isMapped = false;
+        libc.munmap(address, size);
+      }
+    };
+    for (const chunk of runs.flatMap((run) => splitRun(run))) {
+      if (libc.mlock(address + chunk.offset, chunk.length) !== 0) {
+        const errno = readErrno();
+        release();
+        return { errno };
+      }
+      await Bun.sleep(0);
+    }
+    return { lock: { lockedBytes, release } };
+  } finally {
+    closeSync8(fd);
+  }
+}
+var SEEK_DATA2 = 3;
+var SEEK_HOLE2 = 4;
+var ENXIO2 = 6;
+function readDataRuns(libc, fd, size) {
+  const runs = [];
+  let offset = 0;
+  while (offset < size) {
+    const data = Number(libc.lseek(fd, offset, SEEK_DATA2));
+    if (data < 0) {
+      const errno = readErrno();
+      if (errno === ENXIO2) {
+        break;
+      }
+      return { errno };
+    }
+    const hole = Number(libc.lseek(fd, data, SEEK_HOLE2));
+    if (hole < 0) {
+      return { errno: readErrno() };
+    }
+    const end = Math.min(hole, size);
+    runs.push({ offset: data, length: end - data });
+    offset = end;
+  }
+  return runs;
+}
+var CHUNK_BYTES = 4 * 1024 * 1024;
+function splitRun(run) {
+  return Array.from({ length: Math.ceil(run.length / CHUNK_BYTES) }, (_unused, index) => {
+    const offset = run.offset + index * CHUNK_BYTES;
+    return { offset, length: Math.min(CHUNK_BYTES, run.offset + run.length - offset) };
+  });
+}
+
 // packages/daemon/src/vm/vmm/vm-stats.ts
 import { readFileSync as readFileSync19, readdirSync as readdirSync4 } from "fs";
 import { readFile as readFile3 } from "fs/promises";
@@ -40846,7 +41042,9 @@ function createDefaultTemplates(deps, cgroups) {
     kernelPath: deps.config.kernelPath,
     minGuestUptimeMs: deps.config.sleepMinGuestUptimeMs,
     bootReservePercent: deps.config.bootReservePercent,
+    ramBudgetMib: deps.config.ramBudgetMib,
     buildVm: deps.vms.createTemplateVm,
+    lockMemory: createMemoryLock,
     taps: deps.taps,
     jail: deps.config.jailerBin === null ? null : { uid: TEMPLATE_BUILD_UID, gid: TEMPLATE_BUILD_UID },
     cgroups,
@@ -42455,12 +42653,12 @@ function readNumber(parsed, key) {
 // packages/daemon/src/vm/vmm/jail.ts
 import {
   chmodSync as chmodSync6,
-  closeSync as closeSync8,
+  closeSync as closeSync9,
   existsSync as existsSync12,
   lchownSync as lchownSync2,
   lstatSync as lstatSync3,
   mkdirSync as mkdirSync14,
-  openSync as openSync6,
+  openSync as openSync7,
   readdirSync as readdirSync7,
   rmSync as rmSync19,
   statSync as statSync9,
@@ -42549,7 +42747,7 @@ function createJails(deps) {
   };
   const setupReadOnlyBind = async (source, target) => {
     mkdirSync14(dirname9(target), { recursive: true });
-    closeSync8(openSync6(target, "a"));
+    closeSync9(openSync7(target, "a"));
     await runMount(["mount", "--bind", source, target]);
     await runMount(["mount", "-o", "remount,bind,ro,nosuid,nodev", target]);
   };
@@ -42696,7 +42894,7 @@ function setupOwnership(paths, user, isDiskLate) {
 }
 function setupScratchFile(source, target, user) {
   mkdirSync14(dirname9(target), { recursive: true });
-  closeSync8(openSync6(target, "wx", 384));
+  closeSync9(openSync7(target, "wx", 384));
   truncateSync3(target, statSync9(source).size);
   lchownSync2(target, user.uid, user.gid);
 }
@@ -44311,6 +44509,7 @@ function createImpdImps(config, deps, parts) {
     readRamMib: readRamMibAsync,
     readResidentMib,
     readHeadroomMib,
+    readLockedMib: () => imps.bootTemplates?.readLockedMib() ?? 0,
     isBusy,
     trySleepImp: imps.trySleepImp,
     readDiskFullError: imps.readDiskFullError,
@@ -45787,7 +45986,7 @@ function readSettled2(row, imp) {
 
 // packages/daemon/src/imp-ops/moves/move-sender.ts
 import invariant4 from "tiny-invariant";
-import { match as match5 } from "ts-pattern";
+import { match as match7 } from "ts-pattern";
 
 // packages/daemon/src/platform/db/move-send-steps.ts
 var MOVE_SEND_STEPS = [
@@ -46349,7 +46548,7 @@ function createMoveSender(deps) {
   };
   const recoverSend = async (imp, row) => {
     const log = getImpdLogger("move").with({ imp: imp.name });
-    await match5(pickSendRecovery(imp.moveState, row?.step)).with("unmark", () => removeMark(imp)).with("wait", () => {
+    await match7(pickSendRecovery(imp.moveState, row?.step)).with("unmark", () => removeMark(imp)).with("wait", () => {
       log.info("a prepared send waits for its send after a restart");
     }).with("abort", async () => {
       const isUndone = await resetSend(imp, row?.peer_url ?? null, row?.ticket ?? null);
@@ -46471,7 +46670,7 @@ function buildPublicError(name) {
 }
 function pickSendRecovery(moveState, step) {
   if (moveState === "sending") {
-    return match5(step).with(undefined, () => "unmark").with("prepared", () => "wait").with("streaming", () => "abort").with("sent", () => "commit").exhaustive();
+    return match7(step).with(undefined, () => "unmark").with("prepared", () => "wait").with("streaming", () => "abort").with("sent", () => "commit").exhaustive();
   }
   return moveState === "moved" && step === "sent" ? "commit" : "none";
 }
@@ -46523,7 +46722,7 @@ function createMoveService(deps) {
 // packages/daemon/src/surface/moves/create-move-peer-handler.ts
 import { OpenAPIHandler } from "@orpc/openapi/fetch";
 import { ORPCError as ORPCError7, implement as implement3, onError as onError3 } from "@orpc/server";
-import { match as match6 } from "ts-pattern";
+import { match as match8 } from "ts-pattern";
 function createMovePeerHandler(deps) {
   const withTicket = async (step, context, call) => {
     const startedAt = deps.now();
@@ -46574,7 +46773,7 @@ function createMovePeerHandler(deps) {
   const respondReceive = async (context) => {
     try {
       const received = await withTicket("receive", context, (checked) => deps.calls.receive(checked, context.request));
-      return match6(received).with({ kind: "part" }, (sent) => Response.json({ part: sent.part }, { status: 202 })).with({ kind: "receipt" }, (sent) => Response.json(sent.receipt)).exhaustive();
+      return match8(received).with({ kind: "part" }, (sent) => Response.json({ part: sent.part }, { status: 202 })).with({ kind: "receipt" }, (sent) => Response.json(sent.receipt)).exhaustive();
     } catch (error) {
       const failure = toPeerError(error);
       return Response.json(encodePeerError(failure), { status: failure.status });
@@ -47287,9 +47486,9 @@ function printSweep(logger, result, orphans) {
   }
   logger.info("kept {length} orphans the database does not name; `impz gc --orphans --dry-run` lists what `impz gc --orphans` would retire", { length: String(result.kept.length) });
 }
-var MIB4 = 1024 ** 2;
+var MIB7 = 1024 ** 2;
 function formatOrphan(orphan) {
-  const size = `${(orphan.bytes / MIB4).toFixed(1)} MiB`;
+  const size = `${(orphan.bytes / MIB7).toFixed(1)} MiB`;
   const created = orphan.createdAt?.toISOString() ?? "unknown";
   const snapshots = orphan.snapshots.length === 0 ? "none" : orphan.snapshots.join(", ");
   return `orphan ${orphan.kind} ${orphan.id} (${orphan.location}): ${size}, created ${created}, snapshots: ${snapshots}`;
@@ -47420,7 +47619,7 @@ function createImpdServices(config, deps, parts) {
 
 // packages/daemon/src/imps/images/build/create-image-builds.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync20, rmSync as rmSync24, statSync as statSync12 } from "fs";
-import { join as join29, posix as posix3 } from "path";
+import { join as join28, posix as posix3 } from "path";
 
 // packages/local-tar/src/extract-local.ts
 import tar from "tar-stream";
@@ -47885,6 +48084,9 @@ function formatFamiliarRepository(reference) {
 }
 
 // packages/daemon/src/imps/docker-contract/check-registry.ts
+function checkReferenceRegistry(reference) {
+  return checkRegistry(parseImageReference(reference).registry);
+}
 function checkRegistry(registry) {
   const host = readRegistryHost(registry).toLowerCase();
   if (host === "localhost" || host.endsWith(".localhost")) {
@@ -47895,9 +48097,6 @@ function checkRegistry(registry) {
   }
   return null;
 }
-function checkReferenceRegistry(reference) {
-  return checkRegistry(parseImageReference(reference).registry);
-}
 function readRegistryHost(registry) {
   if (registry.startsWith("[")) {
     return registry.slice(1, registry.indexOf("]"));
@@ -48761,64 +48960,22 @@ class DockerBuildError extends Error {
 // packages/daemon/src/imps/images/build/guest-build.ts
 import * as z86 from "zod";
 
-// packages/daemon/src/vm/storage/count-tree-bytes.ts
-import { lstat as lstat3, readdir as readdir3 } from "fs/promises";
-import { join as join28 } from "path";
-async function countTreeBytes(root, deps = {}) {
-  const readDir = deps.readDir ?? readDirEntries;
-  const inodes = new Map;
-  const dirs = [root];
-  for (let directory = dirs.pop();directory !== undefined; directory = dirs.pop()) {
-    const entries = await readEntries2(readDir, directory);
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        dirs.push(join28(directory, entry.name));
-      }
-    }
-    const files = entries.filter((entry) => entry.isFile());
-    const stats = await Promise.all(files.map((entry) => readFileStats(join28(directory, entry.name))));
-    for (const stat of stats) {
-      if (stat !== undefined) {
-        inodes.set(`${String(stat.dev)}:${String(stat.ino)}`, Math.max(0, stat.blocks - 1) * 512);
-      }
-    }
-  }
-  return [...inodes.values()].reduce((sum, bytes) => sum + bytes, 0);
-}
-function readDirEntries(directory) {
-  return readdir3(directory, { withFileTypes: true });
-}
-async function readEntries2(readDir, directory) {
-  try {
-    return await readDir(directory);
-  } catch (error) {
-    if (isMissing(error)) {
-      return [];
-    }
-    throw error;
-  }
-}
-function isMissing(error) {
-  return error instanceof Error && "code" in error && error.code === "ENOENT";
-}
-async function readFileStats(path) {
-  try {
-    return await lstat3(path);
-  } catch (error) {
-    if (isMissing(error)) {
-      return;
-    }
-    throw error;
+// packages/daemon/src/imps/images/build/image-limit-error.ts
+class ImageLimitError extends ImpdError {
+  name = "ImageLimitError";
+  constructor(limit, max) {
+    const over = limit === "bytes" ? `over ${String(Math.floor(max / 1024 ** 2))} MiB (IMP_BUILD_IMAGE_MAX_MIB)` : `over ${String(max)} files (IMP_BUILD_IMAGE_MAX_FILES)`;
+    super("BAD_REQUEST", { message: `the built image's filesystem is ${over}` });
   }
 }
 
 // packages/daemon/src/imps/images/rootfs/rootfs-plan.ts
 var GIB3 = 1024 ** 3;
-var MIB5 = 1024 ** 2;
+var MIB8 = 1024 ** 2;
 var ROOTFS_MIN_BYTES = 4 * GIB3;
 var ROOTFS_SPARE_BYTES = 2 * GIB3;
 var BYTES_PER_INODE = 16384;
-var ROOTFS_OVERHEAD_MIN_BYTES = 128 * MIB5;
+var ROOTFS_OVERHEAD_MIN_BYTES = 128 * MIB8;
 var ROOTFS_OVERHEAD_SHARE = 64;
 function planRootfs(tree) {
   const wanted = Math.ceil((tree.bytes * 1.2 + ROOTFS_SPARE_BYTES) / GIB3) * GIB3;
@@ -48844,73 +49001,9 @@ var UNPACK_TAR_ARGS = [
   "-xpf",
   "-"
 ];
-async function writeExportedTree(containerId, root) {
-  const exporter = Bun.spawn(["docker", "export", containerId], {
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "pipe",
-    env: process.env
-  });
-  const tar = await spawnTar(root, exporter);
-  const state = { hasExportEnded: false, isTarFirst: false, isExportStopped: false };
-  const waitForExport = async () => {
-    await exporter.exited;
-    state.hasExportEnded = true;
-  };
-  const waitForTar = async () => {
-    const code = await tar.exited;
-    if (code !== 0 && !state.hasExportEnded) {
-      state.isTarFirst = true;
-      state.isExportStopped = true;
-      exporter.kill();
-    }
-  };
-  waitForExport();
-  waitForTar();
-  const [exportCode, exportStderr, tarCode, tarStderr] = await Promise.all([
-    exporter.exited,
-    new Response(exporter.stderr).text(),
-    tar.exited,
-    new Response(tar.stderr).text()
-  ]);
-  const failure = findUnpackFailure({
-    containerId,
-    exported: { exitCode: exportCode, stdout: "", stderr: exportStderr },
-    unpacked: { exitCode: tarCode, stdout: "", stderr: tarStderr },
-    isTarFirst: state.isTarFirst,
-    isExportStopped: state.isExportStopped && exporter.signalCode !== null
-  });
-  if (failure !== null) {
-    throw failure;
-  }
-  assertUnpacked({ exitCode: tarCode, stdout: "", stderr: tarStderr });
-}
-async function spawnTar(root, exporter) {
-  try {
-    return Bun.spawn([...UNPACK_TAR_ARGS, "-C", root], {
-      stdin: exporter.stdout,
-      stdout: "ignore",
-      stderr: "pipe",
-      env: { ...process.env, LC_ALL: "C" }
-    });
-  } catch (error) {
-    exporter.kill();
-    await exporter.exited;
-    throw error;
-  }
-}
-function findUnpackFailure(outcome) {
-  const exportFailure = outcome.exported.exitCode === 0 || outcome.isExportStopped ? null : buildExitError(["docker", "export", outcome.containerId], outcome.exported);
-  const tarFailure = outcome.unpacked.exitCode === 0 ? null : buildExitError(["tar"], outcome.unpacked);
-  if (exportFailure === null || tarFailure === null) {
-    return exportFailure ?? tarFailure;
-  }
-  const [first, second] = outcome.isTarFirst ? [tarFailure, exportFailure] : [exportFailure, tarFailure];
-  return new Error(`${first.message}; ${second.message}`);
-}
 function assertUnpacked(result) {
   if (result.exitCode !== 0) {
-    throw buildExitError(["docker", "export", "|", "tar"], result);
+    throw buildExitError(["tar"], result);
   }
   const failure = findXattrFailure(result.stderr);
   if (failure?.missingSetfcap === true) {
@@ -48946,6 +49039,122 @@ function readSetfcapWarning(status = readFileSync23("/proc/self/status", "utf8")
   return `no CAP_SETFCAP, so an image add or build fails on an image with a file capability; ${SETFCAP_HELP}`;
 }
 
+// packages/daemon/src/imps/images/rootfs/write-streamed-tree.ts
+var EXPORT_IDLE_MS = 120000;
+var GROW_STEP_BYTES = 256 * 1024 ** 2;
+var TAR_STOPPED = new Error("tar stopped before the export ended");
+async function writeStreamedTree(options) {
+  const root = options.root;
+  const limits = options.limits;
+  const grow = options.grow ?? (() => Promise.resolve());
+  const startTimer = options.startTimer;
+  const maxBytes = limits.maxBytes;
+  const tar = options.startTar([...UNPACK_TAR_ARGS, "-vv", "--quoting-style=escape", "-C", root]);
+  const sent = { bytes: 0 };
+  const unpacked = {};
+  const stopExport = new AbortController;
+  const readMax = (limit) => limit === "bytes" ? maxBytes : limits.maxFiles;
+  const listed = { bytes: 0 };
+  const held = { bytes: 0 };
+  const growHold = async () => {
+    const tree = Math.max(sent.bytes, listed.bytes);
+    const needed = 2 * tree + planRootfsOverhead(tree);
+    if (needed > held.bytes) {
+      held.bytes = (Math.floor(needed / GROW_STEP_BYTES) + 1) * GROW_STEP_BYTES;
+      const writtenBytes = await options.countTreeBytes(root);
+      await grow(held.bytes, writtenBytes);
+    }
+  };
+  const onCounted = (bytes) => {
+    listed.bytes = bytes;
+  };
+  const counting = countUnpacked(tar.stdout, limits, onCounted, (limit) => {
+    unpacked.over = limit;
+    const max = readMax(limit);
+    tar.kill();
+    stopExport.abort(new ImageLimitError(limit, max));
+  });
+  const waitForTar = async () => {
+    const code = await tar.exited;
+    if (code !== 0 && unpacked.ended !== true) {
+      stopExport.abort(TAR_STOPPED);
+    }
+  };
+  waitForTar();
+  const assertWithinLimits = () => {
+    const over = unpacked.over;
+    if (over !== undefined) {
+      throw new ImageLimitError(over, readMax(over));
+    }
+  };
+  const stopIdle = () => {
+    stopExport.abort(new Error(`${options.source} sent nothing in ${String(EXPORT_IDLE_MS / 1000)} s`));
+  };
+  const idle = { cancel: startTimer(stopIdle, EXPORT_IDLE_MS) };
+  const stderrText = new Response(tar.stderr).text();
+  try {
+    const exported = await options.runExport(async (chunk) => {
+      idle.cancel();
+      idle.cancel = startTimer(stopIdle, EXPORT_IDLE_MS);
+      sent.bytes += chunk.byteLength;
+      if (sent.bytes > maxBytes) {
+        throw new ImageLimitError("bytes", maxBytes);
+      }
+      assertWithinLimits();
+      await growHold();
+      await tar.stdin.write(chunk);
+      await tar.stdin.flush();
+    }, AbortSignal.any([options.signal, stopExport.signal]));
+    if (exported.exitCode !== 0) {
+      throw new Error(`${options.source}: ${exported.stderr.trim()}`);
+    }
+    unpacked.ended = true;
+    await tar.stdin.end();
+    const [exitCode, stderr] = await Promise.all([tar.exited, stderrText, counting]);
+    assertWithinLimits();
+    assertUnpacked({ exitCode, stdout: "", stderr });
+    await growHold();
+  } catch (error) {
+    tar.kill();
+    assertWithinLimits();
+    if (stopExport.signal.reason === TAR_STOPPED) {
+      const [exitCode, stderr] = await Promise.all([tar.exited, stderrText]);
+      assertUnpacked({ exitCode, stdout: "", stderr });
+    }
+    throw error;
+  } finally {
+    idle.cancel();
+  }
+}
+async function countUnpacked(stdout, limits, onCounted, onOver) {
+  const decoder = new TextDecoder;
+  const counted = { lines: 0, bytes: 0, rest: "" };
+  for await (const chunk of stdout) {
+    const lines = `${counted.rest}${decoder.decode(chunk, { stream: true })}`.split(`
+`);
+    counted.rest = lines.pop() ?? "";
+    for (const line of lines) {
+      counted.lines += 1;
+      counted.bytes += readAllocatedBytes(line);
+    }
+    onCounted(counted.bytes);
+    if (counted.bytes > limits.maxBytes) {
+      onOver("bytes");
+      return;
+    }
+    if (counted.lines > limits.maxFiles) {
+      onOver("files");
+      return;
+    }
+  }
+}
+var BLOCK_BYTES = 4096;
+function readAllocatedBytes(line) {
+  const size = line.trim().split(/\s+/v)[2] ?? "";
+  const bytes = /^\d+$/v.test(size) ? Number(size) : 0;
+  return Math.max(1, Math.ceil(bytes / BLOCK_BYTES)) * BLOCK_BYTES;
+}
+
 // packages/daemon/src/imps/images/build/create-build-steps.ts
 var STEP_PATTERN = /^\[(?:\S+ )?\d+\/\d+\] /v;
 function createBuildSteps(setStep) {
@@ -49018,15 +49227,6 @@ function createPlainLines(output) {
   };
 }
 
-// packages/daemon/src/imps/images/build/image-limit-error.ts
-class ImageLimitError extends ImpdError {
-  name = "ImageLimitError";
-  constructor(limit, max) {
-    const over = limit === "bytes" ? `over ${String(Math.floor(max / 1024 ** 2))} MiB (IMP_BUILD_IMAGE_MAX_MIB)` : `over ${String(max)} files (IMP_BUILD_IMAGE_MAX_FILES)`;
-    super("BAD_REQUEST", { message: `the built image's filesystem is ${over}` });
-  }
-}
-
 // packages/daemon/src/imps/images/build/guest-build.ts
 var GUEST_BUILD_TAG = "imp-build:latest";
 var LOG_MAX_CHARS = 8000;
@@ -49082,55 +49282,9 @@ async function loadGuestImage(exec, options) {
 var DIGEST_PREFIX = "imp-build-";
 var DIGEST_DOMAIN = `imp build image v1
 `;
-var EXPORT_IDLE_MS = 120000;
-var GROW_STEP_BYTES = 256 * 1024 ** 2;
-var TAR_STOPPED = new Error("tar stopped before the export ended");
-function createImageHash(configText) {
-  const config = new TextEncoder().encode(configText);
-  const length = new Uint8Array(8);
-  new DataView(length.buffer).setBigUint64(0, BigInt(config.byteLength));
-  const hash = new Bun.CryptoHasher("sha256");
-  hash.update(DIGEST_DOMAIN);
-  hash.update(length);
-  hash.update(config);
-  return hash;
-}
-var BLOCK_BYTES = 4096;
-function readAllocatedBytes(line) {
-  const size = line.trim().split(/\s+/v)[2] ?? "";
-  const bytes = /^\d+$/v.test(size) ? Number(size) : 0;
-  return Math.max(1, Math.ceil(bytes / BLOCK_BYTES)) * BLOCK_BYTES;
-}
-async function countUnpacked(stdout, limits, onCounted, onOver) {
-  const decoder = new TextDecoder;
-  const counted = { lines: 0, bytes: 0, rest: "" };
-  for await (const chunk of stdout) {
-    const lines = `${counted.rest}${decoder.decode(chunk, { stream: true })}`.split(`
-`);
-    counted.rest = lines.pop() ?? "";
-    for (const line of lines) {
-      counted.lines += 1;
-      counted.bytes += readAllocatedBytes(line);
-    }
-    onCounted(counted.bytes);
-    if (counted.bytes > limits.maxBytes) {
-      onOver("bytes");
-      return;
-    }
-    if (counted.lines > limits.maxFiles) {
-      onOver("files");
-      return;
-    }
-  }
-}
 async function writeGuestTree(options) {
   const exec = options.exec;
-  const root = options.root;
-  const limits = options.limits;
   const signal = options.signal;
-  const grow = options.grow ?? (() => Promise.resolve());
-  const startTimer = options.startTimer ?? startRealTimer;
-  const maxBytes = limits.maxBytes;
   const inspected = await exec(["docker", "image", "inspect", "--format", "{{json .Config}}", GUEST_BUILD_TAG], { signal });
   if (inspected.exitCode !== 0) {
     throw new Error(`docker image inspect in the builder: ${inspected.stderr.trim()}`);
@@ -49142,94 +49296,36 @@ async function writeGuestTree(options) {
     throw new Error(`docker create in the builder: ${created.stderr.trim()}`);
   }
   const containerId = ContainerIdSchema.parse(created.stdout.trim());
-  const tar = Bun.spawn([...UNPACK_TAR_ARGS, "-vv", "--quoting-style=escape", "-C", root], {
-    stdin: "pipe",
-    stdout: "pipe",
-    stderr: "pipe",
-    env: { ...process.env, LC_ALL: "C" }
-  });
   const hash = createImageHash(configText);
-  const sent = { bytes: 0 };
-  const unpacked = {};
-  const stopExport = new AbortController;
-  const readMax = (limit) => limit === "bytes" ? maxBytes : limits.maxFiles;
-  const listed = { bytes: 0 };
-  const held = { bytes: 0 };
-  const growHold = async () => {
-    const tree = Math.max(sent.bytes, listed.bytes);
-    const needed = 2 * tree + planRootfsOverhead(tree);
-    if (needed > held.bytes) {
-      held.bytes = (Math.floor(needed / GROW_STEP_BYTES) + 1) * GROW_STEP_BYTES;
-      const writtenBytes = await countTreeBytes(root);
-      await grow(held.bytes, writtenBytes);
-    }
-  };
-  const onCounted = (bytes) => {
-    listed.bytes = bytes;
-  };
-  const counting = countUnpacked(tar.stdout, limits, onCounted, (limit) => {
-    unpacked.over = limit;
-    const max = readMax(limit);
-    tar.kill();
-    stopExport.abort(new ImageLimitError(limit, max));
-  });
-  const waitForTar = async () => {
-    const code = await tar.exited;
-    if (code !== 0 && unpacked.ended !== true) {
-      stopExport.abort(TAR_STOPPED);
-    }
-  };
-  waitForTar();
-  const assertWithinLimits = () => {
-    const over = unpacked.over;
-    if (over !== undefined) {
-      throw new ImageLimitError(over, readMax(over));
-    }
-  };
-  const stopIdle = () => {
-    stopExport.abort(new Error(`docker export in the builder sent nothing in ${String(EXPORT_IDLE_MS / 1000)} s`));
-  };
-  const idle = { cancel: startTimer(stopIdle, EXPORT_IDLE_MS) };
-  const stderrText = new Response(tar.stderr).text();
-  try {
-    const exported = await exec(["docker", "export", containerId], {
-      signal: AbortSignal.any([signal, stopExport.signal]),
+  await writeStreamedTree({
+    root: options.root,
+    limits: options.limits,
+    signal,
+    source: "docker export in the builder",
+    grow: options.grow,
+    startTimer: options.startTimer,
+    startTar: options.startTar,
+    countTreeBytes: options.countTreeBytes,
+    runExport: (onStdout, exportSignal) => exec(["docker", "export", containerId], {
+      signal: exportSignal,
       onStdout: async (chunk) => {
-        idle.cancel();
-        idle.cancel = startTimer(stopIdle, EXPORT_IDLE_MS);
-        sent.bytes += chunk.byteLength;
-        if (sent.bytes > maxBytes) {
-          throw new ImageLimitError("bytes", maxBytes);
-        }
-        assertWithinLimits();
-        await growHold();
+        await onStdout(chunk);
         hash.update(chunk);
-        await tar.stdin.write(chunk);
-        await tar.stdin.flush();
       }
-    });
-    if (exported.exitCode !== 0) {
-      throw new Error(`docker export in the builder: ${exported.stderr.trim()}`);
-    }
-    unpacked.ended = true;
-    await tar.stdin.end();
-    const [exitCode, stderr] = await Promise.all([tar.exited, stderrText, counting]);
-    assertWithinLimits();
-    assertUnpacked({ exitCode, stdout: "", stderr });
-    await growHold();
-  } catch (error) {
-    tar.kill();
-    assertWithinLimits();
-    if (stopExport.signal.reason === TAR_STOPPED) {
-      const [exitCode, stderr] = await Promise.all([tar.exited, stderrText]);
-      assertUnpacked({ exitCode, stdout: "", stderr });
-    }
-    throw error;
-  } finally {
-    idle.cancel();
-  }
+    })
+  });
   return { digest: `${DIGEST_PREFIX}${hash.digest("hex")}`, config };
 }
+function createImageHash(configText) {
+  const config = new TextEncoder().encode(configText);
+  const length = new Uint8Array(8);
+  new DataView(length.buffer).setBigUint64(0, BigInt(config.byteLength));
+  const hash = new Bun.CryptoHasher("sha256");
+  hash.update(DIGEST_DOMAIN);
+  hash.update(length);
+  hash.update(config);
+  return hash;
+}
 
 // packages/daemon/src/imps/images/build/write-context-tar.ts
 import { open as open9 } from "fs/promises";
@@ -49397,7 +49493,7 @@ function createImageBuilds(deps, writer) {
       });
     }
     const uploadsDir = buildUploadsDir(deps.config.dataDir);
-    const tarPath = join29(uploadsDir, `${Bun.randomUUIDv7()}.tar`);
+    const tarPath = join28(uploadsDir, `${Bun.randomUUIDv7()}.tar`);
     mkdirSync20(uploadsDir, { recursive: true, mode: 448 });
     return deps.diskBudget.withRoom(tarBytes, async () => {
       try {
@@ -49516,102 +49612,39 @@ function buildImageRuntimeConfig(ociConfig) {
 
 // packages/daemon/src/imps/images/rootfs/create-image-writer.ts
 import { existsSync as existsSync19, mkdirSync as mkdirSync22, rmSync as rmSync26, statSync as statSync13, writeFileSync as writeFileSync8 } from "fs";
-import { join as join31 } from "path";
-import * as z89 from "zod";
-
-// packages/daemon/src/imps/docker-contract/refusal.ts
-import { z as z88 } from "zod";
-var PROXY_PREFIX = "imp-docker-proxy: ";
-var ENGINE_FAILURE_PREFIX = `${PROXY_PREFIX}the engine call failed: `;
-var REFUSAL_MAX_CHARS = 1000;
-var DAEMON_ERROR_PREFIX = "Error response from daemon: ";
-var UNABLE_TO_FIND_LINE = /^Unable to find image '[^'\n]+' locally$/u;
-var RefusalBodySchema = z88.strictObject({ message: z88.string() });
-function readProxyRefusal(text) {
-  const body = readJsonMessage(text.trim());
-  if (body !== null) {
-    return toRefusal(body);
-  }
-  const errorLine = readErrorLine(text.trimEnd().split(`
-`));
-  if (!errorLine.startsWith(DAEMON_ERROR_PREFIX)) {
-    return null;
-  }
-  const answer = errorLine.slice(DAEMON_ERROR_PREFIX.length);
-  return toRefusal(readJsonMessage(answer) ?? answer);
-}
-function readErrorLine(lines) {
-  const [first = "", second = ""] = lines;
-  if (lines.length === 1) {
-    return first;
-  }
-  return lines.length === 2 && UNABLE_TO_FIND_LINE.test(first) ? second : "";
-}
-function toRefusal(message) {
-  if (!message.startsWith(PROXY_PREFIX) || message.startsWith(ENGINE_FAILURE_PREFIX)) {
-    return null;
-  }
-  const firstLine = message.split(`
-`, 1)[0] ?? "";
-  return firstLine.trim().slice(0, REFUSAL_MAX_CHARS);
-}
-function readJsonMessage(text) {
-  if (!text.startsWith("{")) {
-    return null;
-  }
-  try {
-    const body = RefusalBodySchema.safeParse(JSON.parse(text));
-    return body.success ? body.data.message : null;
-  } catch {
-    return null;
-  }
-}
+import { join as join30 } from "path";
 
-// packages/daemon/src/imps/images/rootfs/run-docker.ts
-async function runDocker(argv, options = {}) {
-  const result = await runCommand(["docker", ...argv], {
-    ...options.env !== undefined && { env: options.env },
-    ...options.signal !== undefined && { signal: options.signal }
-  });
-  if (result.exitCode !== 0) {
-    const refused = readRefusalError(`docker ${argv[0] ?? ""}`, result.stderr);
-    if (refused !== null) {
-      throw refused;
-    }
-  }
-  return result;
-}
-function readRefusalError(call, output) {
-  const refusal = readProxyRefusal(output);
-  if (refusal === null) {
-    return null;
-  }
-  getImpdLogger("image").warning("{call} refused: {refusal}", { call, refusal });
-  return new ImpdError("BAD_REQUEST", { message: refusal });
-}
-async function runDockerChecked(argv, options = {}) {
-  const result = await runDocker(argv, options);
+// packages/daemon/src/imps/images/rootfs/read-oci-config.ts
+import * as z88 from "zod";
+var OciConfigSchema3 = z88.object({
+  digest: z88.string().regex(/^sha256:[a-f0-9]{64}$/v),
+  config: z88.record(z88.string(), z88.unknown()).nullable()
+});
+async function readOciConfig(ref, signal, run) {
+  const argv = ["oci-fetch", "config", ref];
+  const result = await run(argv, { signal });
+  signal.throwIfAborted();
   if (result.exitCode !== 0) {
-    throw buildExitError(["docker", ...argv], result);
+    throw buildExitError(argv, result);
   }
-  return result.stdout;
+  return OciConfigSchema3.parse(JSON.parse(result.stdout));
 }
 
 // packages/daemon/src/imps/images/rootfs/write-image-config.ts
-import { closeSync as closeSync9, constants as constants5, lstatSync as lstatSync5, mkdirSync as mkdirSync21, openSync as openSync7, rmSync as rmSync25, writeSync as writeSync3 } from "fs";
-import { join as join30 } from "path";
+import { closeSync as closeSync10, constants as constants5, lstatSync as lstatSync5, mkdirSync as mkdirSync21, openSync as openSync8, rmSync as rmSync25, writeSync as writeSync3 } from "fs";
+import { join as join29 } from "path";
 function writeImageConfig(root, contents) {
-  const etc = join30(root, "etc");
-  const directory = join30(etc, "imp");
+  const etc = join29(root, "etc");
+  const directory = join29(etc, "imp");
   createDirectory(etc, "/etc");
   createDirectory(directory, "/etc/imp");
-  const file = join30(directory, "image.json");
+  const file = join29(directory, "image.json");
   rmSync25(file, { recursive: true, force: true });
-  const fd = openSync7(file, constants5.O_WRONLY | constants5.O_CREAT | constants5.O_EXCL | constants5.O_NOFOLLOW, 420);
+  const fd = openSync8(file, constants5.O_WRONLY | constants5.O_CREAT | constants5.O_EXCL | constants5.O_NOFOLLOW, 420);
   try {
     writeSync3(fd, contents);
   } finally {
-    closeSync9(fd);
+    closeSync10(fd);
   }
 }
 function createDirectory(path, name) {
@@ -49627,14 +49660,22 @@ function createDirectory(path, name) {
   }
 }
 
+// packages/daemon/src/imps/images/rootfs/write-oci-tree.ts
+function writeOciTree(options) {
+  return writeStreamedTree({
+    root: options.root,
+    limits: options.limits,
+    signal: options.signal,
+    source: `oci-fetch export ${options.ref}`,
+    grow: options.grow,
+    startTimer: options.startTimer,
+    startTar: options.startTar,
+    countTreeBytes: options.countTreeBytes,
+    runExport: (onStdout, signal) => options.runStreamed(["oci-fetch", "export", options.ref], onStdout, signal)
+  });
+}
+
 // packages/daemon/src/imps/images/rootfs/create-image-writer.ts
-var InspectSchema = z89.tuple([
-  z89.object({
-    Id: z89.string(),
-    Config: z89.unknown(),
-    Size: z89.number().optional()
-  })
-]);
 function createImageWriter(deps) {
   const storageGate = deps.storageGate;
   const logger = getImpdLogger("image");
@@ -49642,22 +49683,10 @@ function createImageWriter(deps) {
   const publishers = new Map;
   const freshRootfs = new Set;
   const guestRootfsLock = buildKeyedMutex();
-  const docker = { env: deps.dockerEnv };
-  const readInspect = async (ref, signal) => {
-    const options = { ...docker, signal };
-    const first = await runDocker(["image", "inspect", ref], options);
-    if (first.exitCode === 0) {
-      return InspectSchema.parse(JSON.parse(first.stdout))[0];
-    }
-    await runDockerChecked(["pull", "--quiet", ref], options);
-    signal.throwIfAborted();
-    const stdout = await runDockerChecked(["image", "inspect", ref], options);
-    return InspectSchema.parse(JSON.parse(stdout))[0];
-  };
   const makeWorkDir = () => {
     const images = buildImagesDir(deps.config.dataDir);
-    const work = join31(images, `.build-${Bun.randomUUIDv7()}`);
-    const root = join31(work, "root");
+    const work = join30(images, `.build-${Bun.randomUUIDv7()}`);
+    const root = join30(work, "root");
     mkdirSync22(images, { recursive: true });
     mkdirSync22(work, { mode: 448 });
     mkdirSync22(root, { mode: 493 });
@@ -49668,7 +49697,7 @@ function createImageWriter(deps) {
     const usage = await readTreeUsage(root);
     const plan = planRootfs(usage);
     await deps.storage.createImage(digest, async (directory) => {
-      const image = join31(directory, "rootfs.ext4");
+      const image = join30(directory, "rootfs.ext4");
       await runChecked(["truncate", "-s", String(plan.bytes), image]);
       await runChecked([
         "mkfs.ext4",
@@ -49681,29 +49710,10 @@ function createImageWriter(deps) {
         root,
         image
       ]);
-      writeFileSync8(join31(directory, "config.json"), JSON.stringify(ociConfig ?? {}, null, 2));
+      writeFileSync8(join30(directory, "config.json"), JSON.stringify(ociConfig ?? {}, null, 2));
     });
     return readDiskUsage(buildImagePaths(deps.config.dataDir, digest).rootfs);
   };
-  const createRootfs = async (ref, digest, ociConfig) => {
-    const paths = buildImagePaths(deps.config.dataDir, digest);
-    if (existsSync19(paths.rootfs)) {
-      return readDiskUsage(paths.rootfs);
-    }
-    const created = await runDockerChecked(["create", ref, "/bin/true"], docker);
-    const containerId = created.trim();
-    try {
-      const workDir = makeWorkDir();
-      try {
-        await writeExportedTree(containerId, workDir.root);
-        return await writeRootfs(workDir.root, digest, ociConfig);
-      } finally {
-        rmSync26(workDir.work, { recursive: true, force: true });
-      }
-    } finally {
-      await runCommand(["docker", "rm", "-f", containerId]);
-    }
-  };
   const createRootfsOnce = (digest, create) => building.run(digest, create);
   const writeDockerImageRow = async (imageName, ref, digest, sizeBytes) => {
     const at = deps.clock.now();
@@ -49757,22 +49767,6 @@ function createImageWriter(deps) {
       });
     }
   });
-  const createImageOnHost = async (ref, imageName, options) => {
-    const inspect = await readInspect(ref, options.signal);
-    options.onPulled();
-    const treeBytes = inspect.Size ?? 0;
-    const buildBytes = 2 * treeBytes + planRootfsOverhead(treeBytes);
-    const withRoom = deps.diskBudget.withRoom;
-    return withRoom(buildBytes, () => storageGate.join(async () => {
-      await holdPublisher(inspect.Id);
-      try {
-        const sizeBytes = await createRootfsOnce(inspect.Id, () => createRootfs(ref, inspect.Id, inspect.Config));
-        return await writeDockerImageRow(imageName, ref, inspect.Id, sizeBytes);
-      } finally {
-        await releasePublisher(inspect.Id, imageName);
-      }
-    }));
-  };
   const writeGuestRootfsAndRow = async (guest) => {
     const digest = guest.digest;
     const rootfs = buildImagePaths(deps.config.dataDir, digest).rootfs;
@@ -49803,7 +49797,10 @@ function createImageWriter(deps) {
           root,
           limits: { maxBytes, maxFiles: deps.config.build.imageMaxFiles },
           signal,
-          grow
+          grow,
+          startTar: deps.startTar,
+          countTreeBytes: deps.countTreeBytes,
+          startTimer: deps.startTimer
         });
         return await writeGuestRootfsAndRow({
           root,
@@ -49818,6 +49815,41 @@ function createImageWriter(deps) {
       }
     }));
   };
+  const createBuilderImage = async (imageName, options) => {
+    const ref = deps.config.build.image;
+    const signal = options.signal;
+    const build = deps.config.build;
+    const limits = { maxBytes: build.imageMaxBytes, maxFiles: build.imageMaxFiles };
+    const image = await readOciConfig(ref, signal, deps.runCommand);
+    return deps.diskBudget.withGrowingRoom((grow) => storageGate.join(async () => {
+      const workDir = makeWorkDir();
+      const root = workDir.root;
+      try {
+        await writeOciTree({
+          ref,
+          root,
+          limits,
+          signal,
+          grow,
+          runStreamed: deps.runStreamed,
+          startTar: deps.startTar,
+          countTreeBytes: deps.countTreeBytes,
+          startTimer: deps.startTimer
+        });
+        options.onFetched();
+        return await writeGuestRootfsAndRow({
+          root,
+          digest: image.digest,
+          config: image.config,
+          imageName,
+          ref,
+          signal: new AbortController().signal
+        });
+      } finally {
+        rmSync26(workDir.work, { recursive: true, force: true });
+      }
+    }));
+  };
   const withPublisher = async (digest, imageName, publish) => {
     await holdPublisher(digest);
     try {
@@ -49826,7 +49858,7 @@ function createImageWriter(deps) {
       await releasePublisher(digest, imageName);
     }
   };
-  return { createImageOnHost, writeGuestImage, removeIdleRootfs, removeIdleImage, withPublisher };
+  return { createBuilderImage, writeGuestImage, removeIdleRootfs, removeIdleImage, withPublisher };
 }
 function requireDockerImage(existing) {
   if (existing?.source === "imp") {
@@ -49900,18 +49932,18 @@ function createImageAdds(deps, writer) {
   const createBuilderImage = async (ref) => {
     const pullMs = deps.builderImagePullMs ?? BUILDER_IMAGE_PULL_MS;
     const timeout = deps.startPullLimit?.(pullMs) ?? AbortSignal.timeout(pullMs);
-    const step = { pulled: false };
+    const step = { fetched: false };
     try {
-      return await writer.createImageOnHost(ref, BUILDER_IMAGE, {
+      return await writer.createBuilderImage(BUILDER_IMAGE, {
         signal: timeout,
-        onPulled: () => {
-          step.pulled = true;
+        onFetched: () => {
+          step.fetched = true;
         }
       });
     } catch (error) {
-      const reason = timeout.aborted && !step.pulled ? `the pull did not finish in ${formatPullLimit(pullMs)}; on a slow link, pull ${ref} on the host engine first (docker pull ${ref}), and impd takes it from there` : getErrorMessage(error);
+      const reason = timeout.aborted && !step.fetched ? `the fetch did not finish in ${formatPullLimit(pullMs)}` : getErrorMessage(error);
       throw new ImpdError("SERVICE_UNAVAILABLE", {
-        message: `impd cannot add its builder image ${ref} (IMP_BUILD_IMAGE) from the host engine, so no image add or build can run: ${reason}`
+        message: `impd cannot add its builder image ${ref} (IMP_BUILD_IMAGE) from its registry, so no image add or build can run: ${reason}`
       });
     }
   };
@@ -50103,7 +50135,10 @@ function createImageEviction(deps) {
 // packages/daemon/src/imps/images/image-service.ts
 function createImageService(deps) {
   const clock = deps.clock ?? REAL_CLOCK;
-  const writer = createImageWriter({ ...deps, clock });
+  const writer = createImageWriter({
+    ...deps,
+    clock
+  });
   const builds = createImageBuilds({ ...deps, clock }, writer);
   const adds = createImageAdds({ ...deps, clock }, writer);
   const eviction = createImageEviction({
@@ -50190,6 +50225,91 @@ function createImageService(deps) {
   };
 }
 
+// packages/daemon/src/imps/images/rootfs/start-tar-process.ts
+function startTarProcess(argv) {
+  return Bun.spawn([...argv], {
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { ...process.env, LC_ALL: "C" }
+  });
+}
+
+// packages/daemon/src/platform/process/run-streamed.ts
+async function runStreamed(argv, onStdout, signal) {
+  const child = Bun.spawn([...argv], {
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: process.env,
+    signal
+  });
+  const stderr = new Response(child.stderr).text();
+  try {
+    for await (const chunk of child.stdout) {
+      await onStdout(chunk);
+    }
+  } catch (error) {
+    child.kill();
+    await child.exited;
+    throw error;
+  }
+  const exitCode = await child.exited;
+  signal.throwIfAborted();
+  return { exitCode, stdout: "", stderr: await stderr };
+}
+
+// packages/daemon/src/vm/storage/count-tree-bytes.ts
+import { lstat as lstat3, readdir as readdir3 } from "fs/promises";
+import { join as join31 } from "path";
+async function countTreeBytes(root, deps = {}) {
+  const readDir = deps.readDir ?? readDirEntries;
+  const inodes = new Map;
+  const dirs = [root];
+  for (let directory = dirs.pop();directory !== undefined; directory = dirs.pop()) {
+    const entries = await readEntries2(readDir, directory);
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        dirs.push(join31(directory, entry.name));
+      }
+    }
+    const files = entries.filter((entry) => entry.isFile());
+    const stats = await Promise.all(files.map((entry) => readFileStats(join31(directory, entry.name))));
+    for (const stat of stats) {
+      if (stat !== undefined) {
+        inodes.set(`${String(stat.dev)}:${String(stat.ino)}`, Math.max(0, stat.blocks - 1) * 512);
+      }
+    }
+  }
+  return [...inodes.values()].reduce((sum, bytes) => sum + bytes, 0);
+}
+function readDirEntries(directory) {
+  return readdir3(directory, { withFileTypes: true });
+}
+async function readEntries2(readDir, directory) {
+  try {
+    return await readDir(directory);
+  } catch (error) {
+    if (isMissing(error)) {
+      return [];
+    }
+    throw error;
+  }
+}
+function isMissing(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+async function readFileStats(path) {
+  try {
+    return await lstat3(path);
+  } catch (error) {
+    if (isMissing(error)) {
+      return;
+    }
+    throw error;
+  }
+}
+
 // packages/daemon/src/vm/storage/disk-usage-cache.ts
 var REFRESH_DELAY_MS = 1e4;
 var CHANGES_USAGE = new Set([
@@ -50301,6 +50421,11 @@ function createImpdStorage(config, deps) {
     storageGate,
     diskBudget,
     readBuilders: () => buildersHolder.builders,
+    runCommand,
+    runStreamed,
+    startTar: startTarProcess,
+    countTreeBytes,
+    startTimer: startRealTimer,
     ...deps.now !== undefined && { clock: { now: deps.now } },
     ...deps.images
   });
@@ -50317,11 +50442,11 @@ function createImpdStorage(config, deps) {
 }
 
 // packages/daemon/src/host-net/net/tailscale-status.ts
-import * as z90 from "zod";
-var IpListSchema = z90.array(z90.string()).nullable().optional();
-var StatusSchema = z90.object({
-  BackendState: z90.string(),
-  Self: z90.object({ HostName: z90.string(), DNSName: z90.string().optional(), TailscaleIPs: IpListSchema }).optional()
+import * as z89 from "zod";
+var IpListSchema = z89.array(z89.string()).nullable().optional();
+var StatusSchema = z89.object({
+  BackendState: z89.string(),
+  Self: z89.object({ HostName: z89.string(), DNSName: z89.string().optional(), TailscaleIPs: IpListSchema }).optional()
 });
 var UNKNOWN = { state: null, hostname: null, dnsName: null, ip: null, ips: [] };
 var STATUS_TTL_MS = 30000;
@@ -50599,18 +50724,18 @@ import { getOAuthProviderApi } from "@better-auth/oauth-provider";
 import { createAuthEndpoint } from "better-auth/api";
 import { setSessionCookie } from "better-auth/cookies";
 import { generateRandomString } from "better-auth/crypto";
-import * as z91 from "zod";
+import * as z90 from "zod";
 var CLIENT_SCOPES = [...ScopeSchema.options, "offline_access"];
 var APPROVAL_EMAIL_DOMAIN = "approval.imp.invalid";
-var SignInBodySchema = z91.object({
-  oauth_query: z91.string(),
-  tokenID: z91.string().min(1),
-  tokenName: z91.string().min(1),
-  imps: z91.array(z91.string()).nullable()
+var SignInBodySchema = z90.object({
+  oauth_query: z90.string(),
+  tokenID: z90.string().min(1),
+  tokenName: z90.string().min(1),
+  imps: z90.array(z90.string()).nullable()
 });
-var FixedClientBodySchema = z91.object({
-  name: z91.string().min(1),
-  redirectURIs: z91.array(z91.string()).min(1)
+var FixedClientBodySchema = z90.object({
+  name: z90.string().min(1),
+  redirectURIs: z90.array(z90.string()).min(1)
 });
 function createApproverPlugin() {
   return {
@@ -50636,7 +50761,7 @@ function createApproverPlugin() {
       }),
       verifyMCPAccessToken: createAuthEndpoint("/imp/verify-access-token", {
         method: "POST",
-        body: z91.object({ token: z91.string() }),
+        body: z90.object({ token: z90.string() }),
         metadata: { SERVER_ONLY: true }
       }, async (ctx) => {
         const provider = ctx.context.getPlugin("oauth-provider");
@@ -50680,7 +50805,7 @@ function createApproverPlugin() {
 
 // packages/daemon/src/identity/oauth/create-oauth-handlers.ts
 import { verifyOAuthQueryParams } from "@better-auth/oauth-provider";
-import * as z92 from "zod";
+import * as z91 from "zod";
 
 // packages/daemon/src/identity/oauth/build-bad-token-request.ts
 function buildBadTokenRequest() {
@@ -50908,14 +51033,14 @@ function expandScopes(asked) {
 }
 
 // packages/daemon/src/platform/http/render-html.ts
-import { P as P3, match as match7 } from "ts-pattern";
+import { P as P4, match as match9 } from "ts-pattern";
 var MARKUP = Symbol("markup");
 function renderHTML(strings, ...parts) {
   const html = parts.reduce((text, part, index) => `${text}${toHTML(part)}${strings[index + 1] ?? ""}`, strings[0] ?? "");
   return { [MARKUP]: true, html };
 }
 function toHTML(part) {
-  return match7(part).with(P3.string, (text) => escapeHTML(text)).with(P3.array(), (list) => list.map((each) => each.html).join("")).with({ html: P3.string }, (markup) => markup.html).exhaustive();
+  return match9(part).with(P4.string, (text) => escapeHTML(text)).with(P4.array(), (list) => list.map((each) => each.html).join("")).with({ html: P4.string }, (markup) => markup.html).exhaustive();
 }
 function escapeHTML(text) {
   return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
@@ -51052,9 +51177,9 @@ var MINUTE_MS2 = 60000;
 var CONSENT_MS = 10 * MINUTE_MS2;
 var MAX_FORM_BYTES = 16 * 1024;
 var METADATA_HEADERS = { "cache-control": "no-store" };
-var PKCEMissSchema = z92.object({
-  error: z92.literal("invalid_request"),
-  error_description: z92.literal("code verification failed")
+var PKCEMissSchema = z91.object({
+  error: z91.literal("invalid_request"),
+  error_description: z91.literal("code verification failed")
 });
 function createOAuthHandlers(deps) {
   const host = new URL(deps.origin).host;
@@ -51746,8 +51871,8 @@ function loadOrCreateHostId(dataDir) {
 
 // packages/daemon/src/network/tailnet-names/oauth-credential.ts
 import { readFileSync as readFileSync26, statSync as statSync14 } from "fs";
-import * as z93 from "zod";
-var CredentialSchema = z93.object({ clientId: z93.string().min(1), clientSecret: z93.string().min(1) });
+import * as z92 from "zod";
+var CredentialSchema = z92.object({ clientId: z92.string().min(1), clientSecret: z92.string().min(1) });
 function readOAuthCredential(path) {
   const mode = statSync14(path).mode & 511;
   if ((mode & 63) !== 0) {
@@ -51768,17 +51893,17 @@ function readJson(path) {
 }
 
 // packages/daemon/src/host-net/net/tailscale-serve.ts
-import * as z94 from "zod";
-var HandlerSchema = z94.object({ Proxy: z94.string().optional() });
-var WebSchema = z94.object({
-  Handlers: z94.record(z94.string(), HandlerSchema).nullable().optional()
+import * as z93 from "zod";
+var HandlerSchema = z93.object({ Proxy: z93.string().optional() });
+var WebSchema = z93.object({
+  Handlers: z93.record(z93.string(), HandlerSchema).nullable().optional()
 });
-var ServiceConfigSchema = z94.object({
-  Web: z94.record(z94.string(), WebSchema).nullable().optional()
+var ServiceConfigSchema = z93.object({
+  Web: z93.record(z93.string(), WebSchema).nullable().optional()
 });
-var ServeStatusSchema = z94.object({
-  TCP: z94.record(z94.string(), z94.unknown()).optional(),
-  Services: z94.record(z94.string(), ServiceConfigSchema).nullable().optional()
+var ServeStatusSchema = z93.object({
+  TCP: z93.record(z93.string(), z93.unknown()).optional(),
+  Services: z93.record(z93.string(), ServiceConfigSchema).nullable().optional()
 });
 function parseServeStatus(json) {
   try {
@@ -51829,17 +51954,17 @@ function createServiceServe(run = runChecked) {
 }
 
 // packages/daemon/src/network/tailnet-names/services-api.ts
-import * as z95 from "zod";
+import * as z94 from "zod";
 var TAILSCALE_API = "https://api.tailscale.com/api/v2";
 var TOKEN_MARGIN_MS = 60000;
-var ServiceSchema2 = z95.object({
-  name: z95.string(),
-  comment: z95.string().optional(),
-  ports: z95.array(z95.string()).readonly().optional(),
-  tags: z95.array(z95.string()).readonly().nullable().optional()
+var ServiceSchema2 = z94.object({
+  name: z94.string(),
+  comment: z94.string().optional(),
+  ports: z94.array(z94.string()).readonly().optional(),
+  tags: z94.array(z94.string()).readonly().nullable().optional()
 }).readonly();
-var ServiceListSchema2 = z95.object({ vipServices: z95.array(ServiceSchema2).nullable().optional() });
-var TokenSchema3 = z95.object({ access_token: z95.string(), expires_in: z95.number().positive() });
+var ServiceListSchema2 = z94.object({ vipServices: z94.array(ServiceSchema2).nullable().optional() });
+var TokenSchema3 = z94.object({ access_token: z94.string(), expires_in: z94.number().positive() });
 
 class TailscaleApiError extends Error {
   status;
@@ -51928,7 +52053,7 @@ function createServicesApi(options) {
     }
   };
 }
-var ErrorSchema = z95.object({ message: z95.string() });
+var ErrorSchema = z94.object({ message: z94.string() });
 function readErrorText(text) {
   try {
     return ErrorSchema.parse(JSON.parse(text)).message;
@@ -52186,7 +52311,6 @@ async function listPublicImpNames(db) {
 
 // packages/daemon/src/network/https/acme/acme-issuer.ts
 import { Agent } from "https";
-import * as acme from "acme-client";
 
 // packages/daemon/src/network/https/acme/renewal-policy.ts
 var FIRST_BACKOFF_MS2 = 15 * 60000;
@@ -52228,10 +52352,12 @@ function findRenewalReason(info, domain, now) {
 
 // packages/daemon/src/network/https/acme/acme-issuer.ts
 function createAcmeIssuer(options) {
-  if (options.caPem !== null) {
-    acme.axios.defaults.httpsAgent = new Agent({ ca: options.caPem });
-  }
-  const openClient = async () => {
+  const loading = { promise: null };
+  const loadAcme = () => {
+    loading.promise ??= readAcmeClient(options.caPem);
+    return loading.promise;
+  };
+  const openClient = async (acme) => {
     const stored = options.store.readAccount(options.directoryUrl);
     if (stored !== null) {
       return new acme.Client({
@@ -52261,7 +52387,8 @@ function createAcmeIssuer(options) {
   };
   const runOrder = async (domain) => {
     await checkDirectory2(options.directoryUrl, options.caPem);
-    const client = await openClient();
+    const acme = await loadAcme();
+    const client = await openClient(acme);
     const names = listCertificateNames(domain);
     const order = await client.createOrder({
       identifiers: names.map((name) => ({ type: "dns", value: name }))
@@ -52310,24 +52437,12 @@ function createAcmeIssuer(options) {
     }
   };
 }
-function readCertificateInfo(chainPem) {
-  const info = acme.crypto.readCertificateInfo(chainPem);
-  const names = new Set([info.domains.commonName, ...info.domains.altNames]);
-  names.delete("");
-  return { notBefore: info.notBefore, notAfter: info.notAfter, names: [...names] };
-}
-async function removeRecords(options, records) {
-  for (const record of records) {
-    try {
-      await options.dns.removeTxt(record);
-    } catch (error) {
-      const reason = getErrorMessage(error);
-      getImpdLogger("https").warning("could not remove the TXT record {fqdn}: {reason}", {
-        fqdn: record.fqdn,
-        reason
-      });
-    }
+async function readAcmeClient(caPem) {
+  const acme = await import("acme-client");
+  if (caPem !== null) {
+    acme.axios.defaults.httpsAgent = new Agent({ ca: caPem });
   }
+  return acme;
 }
 async function checkDirectory2(directoryUrl, caPem) {
   try {
@@ -52344,6 +52459,19 @@ async function checkDirectory2(directoryUrl, caPem) {
     });
   }
 }
+async function removeRecords(options, records) {
+  for (const record of records) {
+    try {
+      await options.dns.removeTxt(record);
+    } catch (error) {
+      const reason = getErrorMessage(error);
+      getImpdLogger("https").warning("could not remove the TXT record {fqdn}: {reason}", {
+        fqdn: record.fqdn,
+        reason
+      });
+    }
+  }
+}
 function formatAcmeError(error) {
   const message = getErrorMessage(error);
   if (error instanceof TypeError && message.includes("response.config")) {
@@ -52355,14 +52483,14 @@ function formatAcmeError(error) {
 // packages/daemon/src/network/https/acme/cert-store.ts
 import { existsSync as existsSync22, mkdirSync as mkdirSync24, readFileSync as readFileSync27, rmSync as rmSync28 } from "fs";
 import { join as join35 } from "path";
-import * as z96 from "zod";
-var AttemptStateSchema = z96.object({
-  failures: z96.int().nonnegative(),
-  lastAttemptAt: z96.number().nullable(),
-  lastError: z96.string().nullable()
+import * as z95 from "zod";
+var AttemptStateSchema = z95.object({
+  failures: z95.int().nonnegative(),
+  lastAttemptAt: z95.number().nullable(),
+  lastError: z95.string().nullable()
 });
-var AccountSchema = z96.object({ directoryUrl: z96.string(), url: z96.string(), keyPem: z96.string() });
-var LegacyAccountSchema = z96.object({ directoryUrl: z96.string(), url: z96.string() });
+var AccountSchema = z95.object({ directoryUrl: z95.string(), url: z95.string(), keyPem: z95.string() });
+var LegacyAccountSchema = z95.object({ directoryUrl: z95.string(), url: z95.string() });
 var NO_ATTEMPTS = { failures: 0, lastAttemptAt: null, lastError: null };
 function createCertStore(dataDir) {
   const directory = join35(dataDir, "tls");
@@ -52500,7 +52628,7 @@ function createChalltestsrvProvider(apiUrl) {
 }
 
 // packages/daemon/src/network/https/dns/cloudflare-provider.ts
-import * as z97 from "zod";
+import * as z96 from "zod";
 
 // packages/daemon/src/network/https/dns/wait-for-txt.ts
 import { Resolver as Resolver2 } from "dns/promises";
@@ -52562,30 +52690,30 @@ var CLOUDFLARE_API = "https://api.cloudflare.com/client/v4";
 var TXT_TTL_S = 60;
 var A_TTL_S = 300;
 var PAGE_SIZE = 500;
-var ApiErrorSchema = z97.object({ code: z97.number().optional(), message: z97.string() });
-var EnvelopeSchema = z97.object({
-  success: z97.boolean(),
-  errors: z97.array(ApiErrorSchema).default([]),
-  result: z97.unknown().optional(),
-  result_info: z97.object({ page: z97.number(), total_pages: z97.number() }).optional()
+var ApiErrorSchema = z96.object({ code: z96.number().optional(), message: z96.string() });
+var EnvelopeSchema = z96.object({
+  success: z96.boolean(),
+  errors: z96.array(ApiErrorSchema).default([]),
+  result: z96.unknown().optional(),
+  result_info: z96.object({ page: z96.number(), total_pages: z96.number() }).optional()
 });
-var ZoneSchema = z97.object({
-  id: z97.string(),
-  name: z97.string(),
-  name_servers: z97.array(z97.string())
+var ZoneSchema = z96.object({
+  id: z96.string(),
+  name: z96.string(),
+  name_servers: z96.array(z96.string())
 });
-var RecordSchema = z97.object({
-  id: z97.string(),
-  name: z97.string().optional(),
-  type: z97.string().optional(),
-  content: z97.string(),
-  proxied: z97.boolean().optional(),
-  comment: z97.string().nullable().optional()
+var RecordSchema = z96.object({
+  id: z96.string(),
+  name: z96.string().optional(),
+  type: z96.string().optional(),
+  content: z96.string(),
+  proxied: z96.boolean().optional(),
+  comment: z96.string().nullable().optional()
 });
 var MANAGED_COMMENT = "managed by impd";
 var ADDRESS_TYPES = new Set(["A", "AAAA", "CNAME"]);
-var ZoneListSchema = z97.array(ZoneSchema);
-var RecordListSchema = z97.array(RecordSchema);
+var ZoneListSchema = z96.array(ZoneSchema);
+var RecordListSchema = z96.array(RecordSchema);
 function createCloudflareProvider(options) {
   const base = options.apiUrl ?? CLOUDFLARE_API;
   const send = options.fetch ?? fetch;
@@ -52751,6 +52879,20 @@ function createDnsProvider(config, token) {
   });
 }
 
+// packages/daemon/src/network/https/acme/read-certificate-info.ts
+import"reflect-metadata";
+import * as x5092 from "@peculiar/x509";
+function readCertificateInfo(chainPem) {
+  const certificate = new x5092.X509Certificate(x5092.PemConverter.decodeFirst(chainPem));
+  const altNames = certificate.getExtension(x5092.SubjectAlternativeNameExtension);
+  const names = new Set([
+    ...certificate.subjectName.getField("CN"),
+    ...altNames?.names.items.map((name) => name.value) ?? []
+  ]);
+  names.delete("");
+  return { notBefore: certificate.notBefore, notAfter: certificate.notAfter, names: [...names] };
+}
+
 // packages/daemon/src/network/https/acme/cert-manager.ts
 function createCertManager(options) {
   const domain = options.domain;
@@ -55104,8 +55246,8 @@ import {
   statSync as statSync15
 } from "fs";
 import { basename as basename5, dirname as dirname11, join as join37 } from "path";
-import * as z98 from "zod";
-var CopiesSchema = z98.record(z98.string(), z98.object({ ino: z98.string(), ctimeNs: z98.string(), size: z98.string() }));
+import * as z97 from "zod";
+var CopiesSchema = z97.record(z97.string(), z97.object({ ino: z97.string(), ctimeNs: z97.string(), size: z97.string() }));
 function createXfsBackups(ctx) {
   const backup = buildBackupPaths(ctx.dataDir);
   const freshCopies = new Set;
@@ -57082,6 +57224,7 @@ async function startImpdParts(config, boundaries, plan) {
         key: key.slice(0, 12)
       });
     }
+    imps.bootTemplates?.lockKept();
   });
   await runStep("system-drives", async () => {
     const removed = await removeUnusedDrives(db, {