@impz/testing 6.7.0 → 6.8.0

package/dist/index.js

@@ -18998,517 +18998,82 @@ import invariant7 from "tiny-invariant";
 
 // packages/daemon/src/config.ts
 import { join as join4 } from "path";
-import * as z53 from "zod";
-// packages/shared/src/format-bytes.ts
-var UNITS = ["B", "KiB", "MiB", "GiB", "TiB"];
-function formatBytes(bytes) {
-  let value = bytes;
-  let unit = 0;
-  while (value >= 1024 && unit < UNITS.length - 1) {
-    value /= 1024;
-    unit += 1;
-  }
-  const digits = unit === 0 || value >= 100 ? 0 : 1;
-  return `${value.toFixed(digits)} ${UNITS[unit] ?? "B"}`;
-}
-// packages/shared/src/get-error-message.ts
-function getErrorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-// packages/shared/src/merge-bytes.ts
-function mergeBytes(chunks) {
-  const merged = new Uint8Array(chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0));
-  let offset = 0;
-  for (const chunk of chunks) {
-    merged.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return merged;
-}
-// packages/shared/src/to-plain-octets.ts
-var DOTTED_ENTRY = /^(?<octets>\d{1,3}(?:\.\d{1,3}){3})(?<prefix>\/\d{1,2})?$/u;
-function toPlainOctets(entry) {
-  const groups = DOTTED_ENTRY.exec(entry)?.groups;
-  if (groups === undefined) {
-    return entry;
-  }
-  const octets = (groups["octets"] ?? "").split(".").map((octet) => String(Number(octet)));
-  return `${octets.join(".")}${groups["prefix"] ?? ""}`;
-}
-// packages/daemon/src/host-net/net/addressing.ts
-import { IPv4 as IPv43 } from "ipaddr.js";
+// packages/api/src/schemas/lease-schema.ts
+import * as z2 from "zod";
 
-// packages/daemon/src/host-net/net/addressing6.ts
-import { IPv6 as IPv62 } from "ipaddr.js";
+// packages/api/src/schemas/name-schema.ts
+import * as z from "zod";
+var NameSchema = z.string().regex(/^[a-z][a-z0-9-]{0,30}$/u, "must be a lowercase letter followed by up to 30 lowercase letters, digits or hyphens");
 
-// packages/daemon/src/host-net/net/parse-address.ts
-import { IPv4, IPv6 } from "ipaddr.js";
-function parseAddress(text) {
-  if (IPv4.isValidFourPartDecimal(text)) {
-    return IPv4.parse(text);
-  }
-  if (text.includes("%")) {
-    return null;
-  }
-  const hex = toHexGroups(text);
-  return hex !== null && IPv6.isValid(hex) ? IPv6.parse(hex) : null;
-}
-function toHexGroups(text) {
-  const split = text.lastIndexOf(":");
-  const tail = text.slice(split + 1);
-  if (!tail.includes(".")) {
-    return text;
-  }
-  if (!IPv4.isValidFourPartDecimal(tail)) {
-    return null;
-  }
-  const [first = 0, second = 0, third = 0, fourth = 0] = IPv4.parse(tail).octets;
-  return `${text.slice(0, split + 1)}${toGroup(first, second)}:${toGroup(third, fourth)}`;
-}
-function toGroup(high, low) {
-  return (high * 256 + low).toString(16);
-}
+// packages/api/src/schemas/lease-schema.ts
+var LeaseLabelSchema = z2.string().regex(/^[\w.:-]{1,64}$/u, "must be 1\u201364 letters, digits, dots, underscores, colons or hyphens");
+var LeaseTtlSchema = z2.int().min(10).max(3600);
+var LeaseOwnerSchema = z2.object({
+  principal: z2.string(),
+  display: z2.string(),
+  label: z2.string()
+});
+var LeaseSchema = z2.object({
+  name: NameSchema,
+  owner: LeaseOwnerSchema,
+  until: z2.date().nullable()
+});
+var LeaseSummarySchema = z2.object({
+  leases: z2.array(LeaseSchema).readonly(),
+  otherCount: z2.int().nonnegative()
+});
+// packages/api/src/protocols/build-context-protocol.ts
+import * as z3 from "zod";
+var BUILD_CONTEXT_PATH = "/images/build-context";
+var DockerfilePathSchema = z3.string().min(1).refine((path) => !path.startsWith("/") && !path.split(/[/\\]/u).includes(".."), {
+  message: "the Dockerfile path must be relative and stay inside the build context"
+});
+var BuildContextQuerySchema = z3.object({
+  name: NameSchema,
+  dockerfile: DockerfilePathSchema.optional()
+});
+var BuildContextUploadSchema = z3.object({
+  id: z3.string().min(1),
+  expiresAt: z3.coerce.date()
+});
+var BuildContextErrorSchema = z3.object({ code: z3.string(), message: z3.string() });
+// packages/api/src/schemas/image-op-event-schema.ts
+import * as z5 from "zod";
 
-// packages/daemon/src/host-net/net/parse-cidr.ts
-import { IPv4 as IPv42 } from "ipaddr.js";
-function parseCidr(text) {
-  const [addressText = "", prefix, ...rest] = text.split("/");
-  const address = parseAddress(addressText);
-  if (address === null || rest.length > 0 || prefix !== undefined && !/^\d{1,3}$/v.test(prefix)) {
-    return null;
-  }
-  const maxBits = address instanceof IPv42 ? 32 : 128;
-  const bits = prefix === undefined ? maxBits : Number(prefix);
-  return bits > maxBits ? null : { address, bits };
-}
+// packages/api/src/schemas/image-schema.ts
+import * as z4 from "zod";
+var ImageSourceSchema = z4.enum(["oci", "imp"]);
+var ImageSchema = z4.object({
+  id: z4.string(),
+  name: NameSchema,
+  ref: z4.string(),
+  digest: z4.string(),
+  source: ImageSourceSchema,
+  createdAt: z4.date(),
+  sizeBytes: z4.int().nonnegative(),
+  pinned: z4.boolean().default(false)
+});
 
-// packages/daemon/src/host-net/net/addressing6.ts
-var GROUPS = 8;
-var GROUP_BITS = 16n;
-var PREFIX_LENGTH = 64;
-var GATEWAY_IP6 = "fe80::1";
-function parseIpv6(text) {
-  const address = parseAddress(text);
-  return address instanceof IPv62 ? toBigint(address) : null;
-}
-function formatIpv6(address) {
-  const groups = Array.from({ length: GROUPS }, (_, index) => Number(address >> GROUP_BITS * BigInt(GROUPS - 1 - index) & 0xffffn));
-  return new IPv62(groups).toRFC5952String();
-}
-function formatCidr6(text) {
-  const parsed = parseCidr(text);
-  if (parsed === null || !(parsed.address instanceof IPv62)) {
-    return null;
-  }
-  const hostBits = BigInt(128 - parsed.bits);
-  const network = toBigint(parsed.address) >> hostBits << hostBits;
-  return `${formatIpv6(network)}/${String(parsed.bits)}`;
-}
-function parsePrefix64(cidr) {
-  const parsed = parseCidr(cidr);
-  const network = parsed?.address instanceof IPv62 ? toBigint(parsed.address) : null;
-  if (network === null || !cidr.endsWith(`/${String(PREFIX_LENGTH)}`) || network % 2n ** 64n !== 0n) {
-    return null;
-  }
-  return { network, text: `${formatIpv6(network)}/${String(PREFIX_LENGTH)}` };
-}
-function buildUlaPrefix(random) {
-  if (random.length < 5) {
-    throw new Error("a ULA global ID needs 5 random bytes");
-  }
-  const globalId = [...random.subarray(0, 5)].reduce((acc, byte) => (acc << 8n) + BigInt(byte), 0n);
-  const network = (0xfdn << 40n) + globalId << 80n;
-  return { network, text: `${formatIpv6(network)}/${String(PREFIX_LENGTH)}` };
-}
-function findMappedIpv4(address) {
-  const parsed = parseAddress(address);
-  return parsed instanceof IPv62 && parsed.isIPv4MappedAddress() ? parsed.toIPv4Address().toString() : null;
-}
-function deriveGuestIp6(prefix, guestIpv4) {
-  return formatIpv6(prefix.network + BigInt(guestIpv4));
-}
-function toBigint(address) {
-  return address.parts.reduce((acc, group) => (acc << GROUP_BITS) + BigInt(group), 0n);
-}
-
-// packages/daemon/src/host-net/net/addressing.ts
-var SLOT_SIZE = 4;
-var SLOT_PREFIX_LENGTH = 30;
-function parseSubnet(cidr) {
-  const parsed = cidr.includes("/") ? parseCidr(cidr) : null;
-  if (parsed === null || !(parsed.address instanceof IPv43)) {
-    throw new Error(`subnet is not an IPv4 CIDR: ${cidr}`);
-  }
-  if (parsed.bits < 8 || parsed.bits > SLOT_PREFIX_LENGTH) {
-    throw new Error(`subnet prefix must be between /8 and /30: ${cidr}`);
-  }
-  const network = toNumber(parsed.address);
-  if (network % 2 ** (32 - parsed.bits) !== 0) {
-    throw new Error(`subnet has host bits set: ${cidr}`);
-  }
-  return { network, prefixLength: parsed.bits };
-}
-var TAILNET_NETWORK = 100 * 2 ** 24 + 64 * 2 ** 16;
-var TAILNET_SIZE = 2 ** 22;
-function isTailnetOverlap(subnet) {
-  const start = subnet.network;
-  const end = start + 2 ** (32 - subnet.prefixLength);
-  return start < TAILNET_NETWORK + TAILNET_SIZE && TAILNET_NETWORK < end;
-}
-function countSlots(subnet) {
-  return 2 ** (32 - subnet.prefixLength) / SLOT_SIZE;
-}
-function deriveSlotAddress(slot, plan) {
-  if (!Number.isInteger(slot) || slot < 0 || slot >= countSlots(plan.subnet)) {
-    throw new RangeError(`slot ${String(slot)} is outside the subnet`);
-  }
-  const base = plan.subnet.network + slot * SLOT_SIZE;
-  const guest = base + 2;
-  return {
-    slot,
-    tap: `imp${String(slot)}`,
-    hostIp: formatIpv4(base + 1),
-    guestIp: formatIpv4(guest),
-    prefixLength: SLOT_PREFIX_LENGTH,
-    netmask: "255.255.255.252",
-    guestMac: ["06", "00", ...splitOctets(guest).map((octet) => toHexByte(octet))].join(":"),
-    hostMac: ["06", "01", ...splitOctets(base + 1).map((octet) => toHexByte(octet))].join(":"),
-    guestIp6: plan.prefix6 === undefined || plan.prefix6 === null ? null : deriveGuestIp6(plan.prefix6, guest),
-    tailnetPort: plan.portBase + slot
-  };
-}
-function parseIpv4(text, allowMapped = false) {
-  const address = parseAddress(text);
-  if (address instanceof IPv43) {
-    return toNumber(address);
-  }
-  return allowMapped && address?.isIPv4MappedAddress() === true ? toNumber(address.toIPv4Address()) : null;
-}
-function findPeerSlot(peer, local, subnet) {
-  const peerIp = parseIpv4(peer, true);
-  const localIp = parseIpv4(local, true);
-  if (peerIp === null || localIp === null) {
-    return null;
-  }
-  const offset = peerIp - subnet.network;
-  if (offset < 0 || offset >= 2 ** (32 - subnet.prefixLength) || offset % SLOT_SIZE !== 2) {
-    return null;
-  }
-  return localIp === peerIp - 1 ? (offset - 2) / SLOT_SIZE : null;
-}
-function findGuestSlot(address, subnet) {
-  const ip = parseIpv4(address, true);
-  const offset = ip === null ? -1 : ip - subnet.network;
-  if (offset < 0 || offset >= 2 ** (32 - subnet.prefixLength) || offset % SLOT_SIZE !== 2) {
-    return null;
-  }
-  return (offset - 2) / SLOT_SIZE;
-}
-function formatSubnet(subnet) {
-  return `${formatIpv4(subnet.network)}/${String(subnet.prefixLength)}`;
-}
-function formatCidr4(text) {
-  const parsed = parseCidr(toPlainOctets(text));
-  if (parsed === null || !(parsed.address instanceof IPv43)) {
-    return null;
-  }
-  const ip = toNumber(parsed.address);
-  return formatSubnet({ network: ip - ip % 2 ** (32 - parsed.bits), prefixLength: parsed.bits });
-}
-function toNumber(address) {
-  return address.octets.reduce((acc, octet) => acc * 256 + octet, 0);
-}
-function formatIpv4(address) {
-  return splitOctets(address).join(".");
-}
-function splitOctets(address) {
-  return [
-    Math.floor(address / 2 ** 24) % 256,
-    Math.floor(address / 2 ** 16) % 256,
-    Math.floor(address / 2 ** 8) % 256,
-    address % 256
-  ];
-}
-function toHexByte(octet) {
-  return octet.toString(16).padStart(2, "0");
-}
-
-// packages/daemon/src/host-net/net/ipv6-plan.ts
-import { randomBytes } from "crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { dirname, join as join2 } from "path";
-
-// packages/daemon/src/platform/process/get-impd-logger.ts
-import { getLogger } from "@logtape/logtape";
-function getImpdLogger(area) {
-  return getLogger(["impd", area]);
-}
-
-// packages/daemon/src/platform/process/run-command.ts
-async function runCommand(argv, options = {}) {
-  const child = Bun.spawn([...argv], {
-    stdin: "ignore",
-    stdout: "pipe",
-    stderr: "pipe",
-    env: options.env === undefined ? process.env : { ...options.env },
-    ...options.signal !== undefined && { signal: options.signal }
-  });
-  const [stdout, stderr, exitCode] = await Promise.all([
-    new Response(child.stdout).text(),
-    new Response(child.stderr).text(),
-    child.exited
-  ]);
-  return { exitCode, stdout, stderr };
-}
-async function runChecked(argv, options = {}, run = runCommand) {
-  const result = await run(argv, options);
-  if (result.exitCode !== 0) {
-    throw buildExitError(argv, result);
-  }
-  return result.stdout;
-}
-function buildExitError(argv, result) {
-  const output = result.stderr.trim() || (result.stdout ?? "").trim();
-  return new Error(`${argv.join(" ")} exited ${String(result.exitCode)}: ${output}`);
-}
-
-// packages/daemon/src/host-net/net/nat66-ruleset.ts
-var NAT66_TABLE = "ip6 imp_nat66";
-function buildNat66Ruleset(prefix, uplink) {
-  return [
-    `table ${NAT66_TABLE} {}`,
-    `delete table ${NAT66_TABLE}`,
-    `table ${NAT66_TABLE} {`,
-    "  chain postrouting {",
-    "    type nat hook postrouting priority srcnat; policy accept;",
-    `    oifname "${uplink}" ip6 saddr ${prefix} masquerade`,
-    "  }",
-    "}",
-    ""
-  ].join(`
-`);
-}
-function buildNat66Removal() {
-  return `table ${NAT66_TABLE} {}
-delete table ${NAT66_TABLE}
-`;
-}
-
-// packages/daemon/src/host-net/net/ipv6-plan.ts
-function parseIpv6Setting(text) {
-  if (text === "auto" || text === "off") {
-    return { kind: text };
-  }
-  const prefix = parsePrefix64(text);
-  if (prefix === null) {
-    throw new Error(`IMP_SUBNET6 must be auto, off or an IPv6 /64, got ${text}`);
-  }
-  return { kind: "routed", prefix };
-}
-async function resolveIpv6Plan(setting, deps) {
-  const stopIpv6 = async (reason) => {
-    await removeNat66(deps);
-    getImpdLogger("ipv6").info("off ({reason})", { reason });
-    return null;
-  };
-  if (setting.kind === "off") {
-    return stopIpv6("IMP_SUBNET6=off");
-  }
-  const uplink = await deps.readDefaultRoute();
-  if (setting.kind === "auto" && uplink === null) {
-    return stopIpv6("IMP_SUBNET6=auto, and the container has no IPv6 default route");
-  }
-  const missing = await deps.checkHostRules();
-  if (missing !== null) {
-    return stopIpv6(`the host's IPv6 rules are not in place: ${missing}`);
-  }
-  if (setting.kind === "routed") {
-    await removeNat66(deps);
-    getImpdLogger("ipv6").info("{text}, routed{route}", {
-      text: setting.prefix.text,
-      route: uplink === null ? "; the container has no IPv6 default route" : ` via ${uplink}`
-    });
-    return { prefix: setting.prefix, nat66: false, uplink };
-  }
-  const prefix = deps.readUlaPrefix();
-  try {
-    await deps.runNft(buildNat66Ruleset(prefix.text, uplink ?? ""));
-  } catch (error) {
-    return stopIpv6(`NAT66: ${getErrorMessage(error)}`);
-  }
-  getImpdLogger("ipv6").info("{text}, NAT66 out of {uplink}", {
-    text: prefix.text,
-    uplink: uplink ?? ""
-  });
-  return { prefix, nat66: true, uplink };
-}
-async function removeNat66(deps) {
-  try {
-    await deps.runNft(buildNat66Removal());
-  } catch {}
-}
-var HOST_RULES6 = [
-  ["filter", "-A INPUT -i imp+ -j DROP"],
-  ["filter", "-A FORWARD -i imp+ -o imp+ -j DROP"],
-  ["filter", "-A FORWARD -o imp+ -j DROP"],
-  ["filter", "-A FORWARD -i imp+ -j DROP"],
-  ["raw", "-A PREROUTING -i imp+ -m rpfilter --invert -j DROP"]
-];
-var HOST_SYSCTLS6 = [
-  ["default/accept_ra", "0"],
-  ["default/accept_redirects", "0"],
-  ["all/forwarding", "1"]
-];
-async function checkHostRules6(procSys = "/proc/sys/net/ipv6/conf", run = runCommand) {
-  for (const table of ["filter", "raw"]) {
-    const result = await run(["ip6tables", "-w", "-t", table, "-S"]);
-    const rules = new Set(result.stdout.split(`
-`).map((line) => line.trim()));
-    const missing = HOST_RULES6.find(([inTable, rule]) => inTable === table && !rules.has(rule));
-    if (result.exitCode !== 0) {
-      return `ip6tables -t ${table}: ${result.stderr.trim()}`;
-    }
-    if (missing !== undefined) {
-      return `no ip6tables -t ${table} ${missing[1]}`;
-    }
-  }
-  for (const [key, wanted] of HOST_SYSCTLS6) {
-    const value = readSysctl(join2(procSys, key));
-    if (value !== wanted) {
-      return `net.ipv6.conf.${key.replace("/", ".")} is ${value ?? "missing"}, not ${wanted}`;
-    }
-  }
-  return null;
-}
-function readSysctl(path) {
-  try {
-    return readFileSync2(path, "utf8").trim();
-  } catch {
-    return null;
-  }
-}
-function readOrCreateUlaPrefix(path) {
-  if (existsSync2(path)) {
-    const prefix = parsePrefix64(readFileSync2(path, "utf8").trim());
-    if (prefix !== null) {
-      return prefix;
-    }
-  }
-  const prefix = buildUlaPrefix(randomBytes(5));
-  mkdirSync2(dirname(path), { recursive: true });
-  writeFileSync(path, `${prefix.text}
-`);
-  return prefix;
-}
-
-// packages/daemon/src/host-net/net/range-matcher.ts
-import { IPv4 as IPv44 } from "ipaddr.js";
-function buildRangeMatcher(ranges) {
-  const ranges4 = [];
-  const ranges6 = [];
-  for (const range of ranges) {
-    const cidr = parseCidr(range);
-    if (cidr === null) {
-      throw new Error(`not an address range: ${range}`);
-    }
-    if (cidr.address instanceof IPv44) {
-      ranges4.push([cidr.address, cidr.bits]);
-    } else {
-      ranges6.push([cidr.address, cidr.bits]);
-    }
-  }
-  const isIn4 = (ip) => ranges4.some(([network, bits]) => ip.match(network, bits));
-  const isIn6 = (ip) => ranges6.some(([network, bits]) => ip.match(network, bits));
-  return (address) => {
-    const ip = parseAddress(address);
-    if (ip === null) {
-      return false;
-    }
-    if (ip instanceof IPv44) {
-      return isIn4(ip);
-    }
-    return isIn6(ip) || ip.isIPv4MappedAddress() && isIn4(ip.toIPv4Address());
-  };
-}
-
-// packages/daemon/src/identity/auth/parse-tailnet-rules.ts
-import * as z48 from "zod";
-// packages/api/src/schemas/lease-schema.ts
-import * as z2 from "zod";
-
-// packages/api/src/schemas/name-schema.ts
-import * as z from "zod";
-var NameSchema = z.string().regex(/^[a-z][a-z0-9-]{0,30}$/u, "must be a lowercase letter followed by up to 30 lowercase letters, digits or hyphens");
-
-// packages/api/src/schemas/lease-schema.ts
-var LeaseLabelSchema = z2.string().regex(/^[\w.:-]{1,64}$/u, "must be 1\u201364 letters, digits, dots, underscores, colons or hyphens");
-var LeaseTtlSchema = z2.int().min(10).max(3600);
-var LeaseOwnerSchema = z2.object({
-  principal: z2.string(),
-  display: z2.string(),
-  label: z2.string()
-});
-var LeaseSchema = z2.object({
-  name: NameSchema,
-  owner: LeaseOwnerSchema,
-  until: z2.date().nullable()
-});
-var LeaseSummarySchema = z2.object({
-  leases: z2.array(LeaseSchema).readonly(),
-  otherCount: z2.int().nonnegative()
-});
-// packages/api/src/protocols/build-context-protocol.ts
-import * as z3 from "zod";
-var BUILD_CONTEXT_PATH = "/images/build-context";
-var DockerfilePathSchema = z3.string().min(1).refine((path) => !path.startsWith("/") && !path.split(/[/\\]/u).includes(".."), {
-  message: "the Dockerfile path must be relative and stay inside the build context"
-});
-var BuildContextQuerySchema = z3.object({
-  name: NameSchema,
-  dockerfile: DockerfilePathSchema.optional()
-});
-var BuildContextUploadSchema = z3.object({
-  id: z3.string().min(1),
-  expiresAt: z3.coerce.date()
-});
-var BuildContextErrorSchema = z3.object({ code: z3.string(), message: z3.string() });
-// packages/api/src/schemas/image-op-event-schema.ts
-import * as z5 from "zod";
-
-// packages/api/src/schemas/image-schema.ts
-import * as z4 from "zod";
-var ImageSourceSchema = z4.enum(["oci", "imp"]);
-var ImageSchema = z4.object({
-  id: z4.string(),
-  name: NameSchema,
-  ref: z4.string(),
-  digest: z4.string(),
-  source: ImageSourceSchema,
-  createdAt: z4.date(),
-  sizeBytes: z4.int().nonnegative(),
-  pinned: z4.boolean().default(false)
-});
-
-// packages/api/src/schemas/image-op-event-schema.ts
-var ImageBuildPhaseSchema = z5.enum(["upload", "pack", "build", "pull", "unpack", "copy"]);
-var IMAGE_BUILD_LOG_MAX_CHARS = 8192;
-var ImageBuildProgressSchema = z5.object({
-  type: z5.literal("progress"),
-  phase: ImageBuildPhaseSchema,
-  elapsedMs: z5.number().nonnegative(),
-  step: z5.string().optional()
-});
-var ImageBuildLogSchema = z5.object({
-  type: z5.literal("log"),
-  text: z5.string().max(IMAGE_BUILD_LOG_MAX_CHARS)
-});
-var ImageOpEventSchema = z5.discriminatedUnion("type", [
-  ImageBuildProgressSchema,
-  ImageBuildLogSchema,
-  z5.object({ type: z5.literal("image"), image: ImageSchema })
-]);
-// packages/api/src/protocols/exec-protocol.ts
-import * as z9 from "zod";
+// packages/api/src/schemas/image-op-event-schema.ts
+var ImageBuildPhaseSchema = z5.enum(["upload", "pack", "build", "pull", "unpack", "copy"]);
+var IMAGE_BUILD_LOG_MAX_CHARS = 8192;
+var ImageBuildProgressSchema = z5.object({
+  type: z5.literal("progress"),
+  phase: ImageBuildPhaseSchema,
+  elapsedMs: z5.number().nonnegative(),
+  step: z5.string().optional()
+});
+var ImageBuildLogSchema = z5.object({
+  type: z5.literal("log"),
+  text: z5.string().max(IMAGE_BUILD_LOG_MAX_CHARS)
+});
+var ImageOpEventSchema = z5.discriminatedUnion("type", [
+  ImageBuildProgressSchema,
+  ImageBuildLogSchema,
+  z5.object({ type: z5.literal("image"), image: ImageSchema })
+]);
+// packages/api/src/protocols/exec-protocol.ts
+import * as z9 from "zod";
 
 // packages/api/src/schemas/session-output-schema.ts
 import * as z7 from "zod";
@@ -20643,6 +20208,7 @@ var SystemInfoSchema = z33.object({
   ramUsedMib: z33.int().nonnegative(),
   ramReservedMib: z33.int().nonnegative(),
   ramCommittedMib: z33.int().nonnegative(),
+  ramPriorityKeptMib: z33.int().nonnegative().optional(),
   ramSleepingMib: z33.int().nonnegative().optional(),
   awakeCount: z33.int().nonnegative(),
   impCount: z33.int().nonnegative(),
@@ -21105,166 +20671,603 @@ var authContract = {
   logout: contractBase.meta(ACCESS.noSession).output(EmptySchema)
 };
 
-// packages/api/src/contract/session-contract.ts
-var sessionContract = { auth: authContract };
-// packages/api/src/contract/collect-procedure-access.ts
-import { isContractProcedure } from "@orpc/contract";
-import * as z45 from "zod";
+// packages/api/src/contract/session-contract.ts
+var sessionContract = { auth: authContract };
+// packages/api/src/contract/collect-procedure-access.ts
+import { isContractProcedure } from "@orpc/contract";
+import * as z45 from "zod";
+
+// packages/api/src/schemas/procedure-access-schema.ts
+import * as z44 from "zod";
+var FieldsSchema = z44.array(z44.string()).readonly();
+var NoSessionAccessSchema = z44.object({ on: z44.literal("none") });
+var HostAccessSchema = z44.object({
+  scope: ScopeSchema,
+  on: z44.literal("host"),
+  audit: z44.union([z44.literal(false), z44.literal("refusals")]).optional()
+});
+var ImpAccessSchema = z44.object({
+  scope: ScopeSchema,
+  on: z44.literal("imp"),
+  fields: FieldsSchema,
+  noGrantable: z44.literal(true).optional(),
+  audit: z44.literal(false).optional()
+});
+var GrantAccessSchema = z44.object({
+  scope: ScopeSchema,
+  on: z44.literal("grant"),
+  fields: FieldsSchema,
+  secretField: z44.string(),
+  audit: z44.literal(false).optional()
+});
+var ImageAccessSchema = z44.object({
+  scope: ScopeSchema,
+  on: z44.literal("image"),
+  held: z44.literal(true).optional(),
+  audit: z44.union([z44.literal(false), z44.literal("refusals")]).optional()
+});
+var AnyAccessSchema = z44.object({
+  scope: ScopeSchema,
+  on: z44.literal("any"),
+  audit: z44.literal(false).optional()
+});
+var ProcedureAccessSchema = z44.discriminatedUnion("on", [
+  NoSessionAccessSchema,
+  HostAccessSchema,
+  ImpAccessSchema,
+  GrantAccessSchema,
+  ImageAccessSchema,
+  AnyAccessSchema
+]);
+
+// packages/api/src/contract/collect-procedure-access.ts
+var MetaSchema = z45.object({ access: ProcedureAccessSchema });
+function collectProcedureAccess(router, prefix = "") {
+  return Object.entries(router).flatMap(([key, value]) => {
+    const path = `${prefix}${key}`;
+    if (isContractProcedure(value)) {
+      const meta = value["~orpc"].meta;
+      const parsed = MetaSchema.safeParse(meta);
+      return [{ path, access: parsed.success ? parsed.data.access : null }];
+    }
+    return typeof value === "object" && value !== null ? collectProcedureAccess(value, `${path}.`) : [];
+  });
+}
+// packages/api/src/rules/is-imp-allowed.ts
+function isImpAllowed(patterns, name) {
+  return patterns === null || patterns.some((pattern) => isPatternMatch(pattern, name));
+}
+function isPatternMatch(pattern, name) {
+  const [first = "", ...rest] = pattern.split("*");
+  if (rest.length === 0) {
+    return name === first;
+  }
+  const last = rest.pop() ?? "";
+  if (!name.startsWith(first) || !name.endsWith(last) || name.length < first.length + last.length) {
+    return false;
+  }
+  let at = first.length;
+  const end = name.length - last.length;
+  for (const part of rest) {
+    const found = name.indexOf(part, at);
+    if (found === -1 || found + part.length > end) {
+      return false;
+    }
+    at = found + part.length;
+  }
+  return true;
+}
+// packages/api/src/protocols/login-shell.ts
+var CONSOLE_SHELL = buildConsoleShell("/etc/passwd", ["/bin/bash", "/bin/sh"]);
+function buildConsoleShell(passwdPath, fallbacks) {
+  return [
+    "uid=$(id -u 2>/dev/null) || uid=0",
+    "shell=",
+    "while IFS=: read -r _ _ id _ _ _ login; do",
+    '  if [ "$id" = "$uid" ]; then shell=$login; break; fi',
+    `done < ${passwdPath}`,
+    ...fallbacks.map((fallback) => `[ -x "$shell" ] || shell=${fallback}`),
+    'exec "$shell" -l'
+  ].join(`
+`);
+}
+// packages/api/src/protocols/mcp-path.ts
+var MCP_PATH = "/mcp";
+// packages/api/src/protocols/move-receive-path.ts
+var MOVE_RECEIVE_PATH = "/move/receive";
+// packages/api/src/contract/move-peer-contract.ts
+import { oc as oc2 } from "@orpc/contract";
+
+// packages/api/src/schemas/move-peer-schema.ts
+import * as z46 from "zod";
+var SystemDriveSchema = z46.string().regex(/^[\da-f]{64}$/v);
+var MoveOfferSchema = z46.object({
+  imageDigest: z46.string(),
+  receivedImageDigest: z46.string().nullable().default(null),
+  systemDrive: SystemDriveSchema.optional()
+});
+var MoveOfferReplySchema = z46.object({
+  needsImage: z46.boolean(),
+  needsSystemDrive: z46.boolean().default(false),
+  storage: z46.enum(["xfs", "zfs"]),
+  keepsMaxMemory: z46.boolean().default(false),
+  keepsLeases: z46.boolean().default(false),
+  keepsPublicEgress: z46.boolean().default(false),
+  keepsBackupOff: z46.boolean().default(false)
+});
+var MoveCommitReplySchema = z46.object({ isCommitted: z46.boolean() });
+
+// packages/api/src/contract/move-peer-contract.ts
+var movePeerContract = {
+  offer: oc2.route({ method: "POST", path: "/move/offer" }).input(MoveOfferSchema).output(MoveOfferReplySchema),
+  commit: oc2.route({ method: "POST", path: "/move/commit" }).output(MoveCommitReplySchema),
+  abort: oc2.route({ method: "POST", path: "/move/abort" }).output(MoveCommitReplySchema)
+};
+// packages/api/src/schemas/secret-presets.ts
+var SECRET_PRESETS = {
+  github: {
+    kind: "static",
+    rules: [
+      { host: "github.com", header: "authorization", scheme: "basic", user: "x-access-token" },
+      { host: "api.github.com", header: "authorization", scheme: "bearer" },
+      { host: "uploads.github.com", header: "authorization", scheme: "bearer" }
+    ],
+    env: ["GH_TOKEN", "GITHUB_TOKEN"]
+  },
+  anthropic: {
+    kind: "static",
+    rules: [{ host: "api.anthropic.com", header: "x-api-key", scheme: "raw" }],
+    env: ["ANTHROPIC_API_KEY"]
+  },
+  npm: {
+    kind: "static",
+    rules: [{ host: "registry.npmjs.org", header: "authorization", scheme: "bearer" }],
+    env: ["NPM_TOKEN"]
+  }
+};
+// packages/api/src/rules/has-scope.ts
+function hasScope(granted, needed) {
+  const grantedRank = ScopeSchema.options.indexOf(granted);
+  const neededRank = ScopeSchema.options.indexOf(needed);
+  return grantedRank !== -1 && neededRank !== -1 && grantedRank >= neededRank;
+}
+// packages/daemon/src/config.ts
+import * as z53 from "zod";
+// packages/shared/src/format-bytes.ts
+var UNITS = ["B", "KiB", "MiB", "GiB", "TiB"];
+function formatBytes(bytes) {
+  let value = bytes;
+  let unit = 0;
+  while (value >= 1024 && unit < UNITS.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  const digits = unit === 0 || value >= 100 ? 0 : 1;
+  return `${value.toFixed(digits)} ${UNITS[unit] ?? "B"}`;
+}
+// packages/shared/src/get-error-message.ts
+function getErrorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+// packages/shared/src/merge-bytes.ts
+function mergeBytes(chunks) {
+  const merged = new Uint8Array(chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0));
+  let offset = 0;
+  for (const chunk of chunks) {
+    merged.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return merged;
+}
+// packages/shared/src/to-plain-octets.ts
+var DOTTED_ENTRY = /^(?<octets>\d{1,3}(?:\.\d{1,3}){3})(?<prefix>\/\d{1,2})?$/u;
+function toPlainOctets(entry) {
+  const groups = DOTTED_ENTRY.exec(entry)?.groups;
+  if (groups === undefined) {
+    return entry;
+  }
+  const octets = (groups["octets"] ?? "").split(".").map((octet) => String(Number(octet)));
+  return `${octets.join(".")}${groups["prefix"] ?? ""}`;
+}
+// packages/daemon/src/host-net/net/addressing.ts
+import { IPv4 as IPv43 } from "ipaddr.js";
+
+// packages/daemon/src/host-net/net/addressing6.ts
+import { IPv6 as IPv62 } from "ipaddr.js";
+
+// packages/daemon/src/host-net/net/parse-address.ts
+import { IPv4, IPv6 } from "ipaddr.js";
+function parseAddress(text) {
+  if (IPv4.isValidFourPartDecimal(text)) {
+    return IPv4.parse(text);
+  }
+  if (text.includes("%")) {
+    return null;
+  }
+  const hex = toHexGroups(text);
+  return hex !== null && IPv6.isValid(hex) ? IPv6.parse(hex) : null;
+}
+function toHexGroups(text) {
+  const split = text.lastIndexOf(":");
+  const tail = text.slice(split + 1);
+  if (!tail.includes(".")) {
+    return text;
+  }
+  if (!IPv4.isValidFourPartDecimal(tail)) {
+    return null;
+  }
+  const [first = 0, second = 0, third = 0, fourth = 0] = IPv4.parse(tail).octets;
+  return `${text.slice(0, split + 1)}${toGroup(first, second)}:${toGroup(third, fourth)}`;
+}
+function toGroup(high, low) {
+  return (high * 256 + low).toString(16);
+}
+
+// packages/daemon/src/host-net/net/parse-cidr.ts
+import { IPv4 as IPv42 } from "ipaddr.js";
+function parseCidr(text) {
+  const [addressText = "", prefix, ...rest] = text.split("/");
+  const address = parseAddress(addressText);
+  if (address === null || rest.length > 0 || prefix !== undefined && !/^\d{1,3}$/v.test(prefix)) {
+    return null;
+  }
+  const maxBits = address instanceof IPv42 ? 32 : 128;
+  const bits = prefix === undefined ? maxBits : Number(prefix);
+  return bits > maxBits ? null : { address, bits };
+}
+
+// packages/daemon/src/host-net/net/addressing6.ts
+var GROUPS = 8;
+var GROUP_BITS = 16n;
+var PREFIX_LENGTH = 64;
+var GATEWAY_IP6 = "fe80::1";
+function parseIpv6(text) {
+  const address = parseAddress(text);
+  return address instanceof IPv62 ? toBigint(address) : null;
+}
+function formatIpv6(address) {
+  const groups = Array.from({ length: GROUPS }, (_, index) => Number(address >> GROUP_BITS * BigInt(GROUPS - 1 - index) & 0xffffn));
+  return new IPv62(groups).toRFC5952String();
+}
+function formatCidr6(text) {
+  const parsed = parseCidr(text);
+  if (parsed === null || !(parsed.address instanceof IPv62)) {
+    return null;
+  }
+  const hostBits = BigInt(128 - parsed.bits);
+  const network = toBigint(parsed.address) >> hostBits << hostBits;
+  return `${formatIpv6(network)}/${String(parsed.bits)}`;
+}
+function parsePrefix64(cidr) {
+  const parsed = parseCidr(cidr);
+  const network = parsed?.address instanceof IPv62 ? toBigint(parsed.address) : null;
+  if (network === null || !cidr.endsWith(`/${String(PREFIX_LENGTH)}`) || network % 2n ** 64n !== 0n) {
+    return null;
+  }
+  return { network, text: `${formatIpv6(network)}/${String(PREFIX_LENGTH)}` };
+}
+function buildUlaPrefix(random) {
+  if (random.length < 5) {
+    throw new Error("a ULA global ID needs 5 random bytes");
+  }
+  const globalId = [...random.subarray(0, 5)].reduce((acc, byte) => (acc << 8n) + BigInt(byte), 0n);
+  const network = (0xfdn << 40n) + globalId << 80n;
+  return { network, text: `${formatIpv6(network)}/${String(PREFIX_LENGTH)}` };
+}
+function findMappedIpv4(address) {
+  const parsed = parseAddress(address);
+  return parsed instanceof IPv62 && parsed.isIPv4MappedAddress() ? parsed.toIPv4Address().toString() : null;
+}
+function deriveGuestIp6(prefix, guestIpv4) {
+  return formatIpv6(prefix.network + BigInt(guestIpv4));
+}
+function toBigint(address) {
+  return address.parts.reduce((acc, group) => (acc << GROUP_BITS) + BigInt(group), 0n);
+}
+
+// packages/daemon/src/host-net/net/addressing.ts
+var SLOT_SIZE = 4;
+var SLOT_PREFIX_LENGTH = 30;
+function parseSubnet(cidr) {
+  const parsed = cidr.includes("/") ? parseCidr(cidr) : null;
+  if (parsed === null || !(parsed.address instanceof IPv43)) {
+    throw new Error(`subnet is not an IPv4 CIDR: ${cidr}`);
+  }
+  if (parsed.bits < 8 || parsed.bits > SLOT_PREFIX_LENGTH) {
+    throw new Error(`subnet prefix must be between /8 and /30: ${cidr}`);
+  }
+  const network = toNumber(parsed.address);
+  if (network % 2 ** (32 - parsed.bits) !== 0) {
+    throw new Error(`subnet has host bits set: ${cidr}`);
+  }
+  return { network, prefixLength: parsed.bits };
+}
+var TAILNET_NETWORK = 100 * 2 ** 24 + 64 * 2 ** 16;
+var TAILNET_SIZE = 2 ** 22;
+function isTailnetOverlap(subnet) {
+  const start = subnet.network;
+  const end = start + 2 ** (32 - subnet.prefixLength);
+  return start < TAILNET_NETWORK + TAILNET_SIZE && TAILNET_NETWORK < end;
+}
+function countSlots(subnet) {
+  return 2 ** (32 - subnet.prefixLength) / SLOT_SIZE;
+}
+function deriveSlotAddress(slot, plan) {
+  if (!Number.isInteger(slot) || slot < 0 || slot >= countSlots(plan.subnet)) {
+    throw new RangeError(`slot ${String(slot)} is outside the subnet`);
+  }
+  const base = plan.subnet.network + slot * SLOT_SIZE;
+  const guest = base + 2;
+  return {
+    slot,
+    tap: `imp${String(slot)}`,
+    hostIp: formatIpv4(base + 1),
+    guestIp: formatIpv4(guest),
+    prefixLength: SLOT_PREFIX_LENGTH,
+    netmask: "255.255.255.252",
+    guestMac: ["06", "00", ...splitOctets(guest).map((octet) => toHexByte(octet))].join(":"),
+    hostMac: ["06", "01", ...splitOctets(base + 1).map((octet) => toHexByte(octet))].join(":"),
+    guestIp6: plan.prefix6 === undefined || plan.prefix6 === null ? null : deriveGuestIp6(plan.prefix6, guest),
+    tailnetPort: plan.portBase + slot
+  };
+}
+function parseIpv4(text, allowMapped = false) {
+  const address = parseAddress(text);
+  if (address instanceof IPv43) {
+    return toNumber(address);
+  }
+  return allowMapped && address?.isIPv4MappedAddress() === true ? toNumber(address.toIPv4Address()) : null;
+}
+function findPeerSlot(peer, local, subnet) {
+  const peerIp = parseIpv4(peer, true);
+  const localIp = parseIpv4(local, true);
+  if (peerIp === null || localIp === null) {
+    return null;
+  }
+  const offset = peerIp - subnet.network;
+  if (offset < 0 || offset >= 2 ** (32 - subnet.prefixLength) || offset % SLOT_SIZE !== 2) {
+    return null;
+  }
+  return localIp === peerIp - 1 ? (offset - 2) / SLOT_SIZE : null;
+}
+function findGuestSlot(address, subnet) {
+  const ip = parseIpv4(address, true);
+  const offset = ip === null ? -1 : ip - subnet.network;
+  if (offset < 0 || offset >= 2 ** (32 - subnet.prefixLength) || offset % SLOT_SIZE !== 2) {
+    return null;
+  }
+  return (offset - 2) / SLOT_SIZE;
+}
+function formatSubnet(subnet) {
+  return `${formatIpv4(subnet.network)}/${String(subnet.prefixLength)}`;
+}
+function formatCidr4(text) {
+  const parsed = parseCidr(toPlainOctets(text));
+  if (parsed === null || !(parsed.address instanceof IPv43)) {
+    return null;
+  }
+  const ip = toNumber(parsed.address);
+  return formatSubnet({ network: ip - ip % 2 ** (32 - parsed.bits), prefixLength: parsed.bits });
+}
+function toNumber(address) {
+  return address.octets.reduce((acc, octet) => acc * 256 + octet, 0);
+}
+function formatIpv4(address) {
+  return splitOctets(address).join(".");
+}
+function splitOctets(address) {
+  return [
+    Math.floor(address / 2 ** 24) % 256,
+    Math.floor(address / 2 ** 16) % 256,
+    Math.floor(address / 2 ** 8) % 256,
+    address % 256
+  ];
+}
+function toHexByte(octet) {
+  return octet.toString(16).padStart(2, "0");
+}
 
-// packages/api/src/schemas/procedure-access-schema.ts
-import * as z44 from "zod";
-var FieldsSchema = z44.array(z44.string()).readonly();
-var NoSessionAccessSchema = z44.object({ on: z44.literal("none") });
-var HostAccessSchema = z44.object({
-  scope: ScopeSchema,
-  on: z44.literal("host"),
-  audit: z44.union([z44.literal(false), z44.literal("refusals")]).optional()
-});
-var ImpAccessSchema = z44.object({
-  scope: ScopeSchema,
-  on: z44.literal("imp"),
-  fields: FieldsSchema,
-  noGrantable: z44.literal(true).optional(),
-  audit: z44.literal(false).optional()
-});
-var GrantAccessSchema = z44.object({
-  scope: ScopeSchema,
-  on: z44.literal("grant"),
-  fields: FieldsSchema,
-  secretField: z44.string(),
-  audit: z44.literal(false).optional()
-});
-var ImageAccessSchema = z44.object({
-  scope: ScopeSchema,
-  on: z44.literal("image"),
-  held: z44.literal(true).optional(),
-  audit: z44.union([z44.literal(false), z44.literal("refusals")]).optional()
-});
-var AnyAccessSchema = z44.object({
-  scope: ScopeSchema,
-  on: z44.literal("any"),
-  audit: z44.literal(false).optional()
-});
-var ProcedureAccessSchema = z44.discriminatedUnion("on", [
-  NoSessionAccessSchema,
-  HostAccessSchema,
-  ImpAccessSchema,
-  GrantAccessSchema,
-  ImageAccessSchema,
-  AnyAccessSchema
-]);
+// packages/daemon/src/host-net/net/ipv6-plan.ts
+import { randomBytes } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname, join as join2 } from "path";
 
-// packages/api/src/contract/collect-procedure-access.ts
-var MetaSchema = z45.object({ access: ProcedureAccessSchema });
-function collectProcedureAccess(router, prefix = "") {
-  return Object.entries(router).flatMap(([key, value]) => {
-    const path = `${prefix}${key}`;
-    if (isContractProcedure(value)) {
-      const meta = value["~orpc"].meta;
-      const parsed = MetaSchema.safeParse(meta);
-      return [{ path, access: parsed.success ? parsed.data.access : null }];
-    }
-    return typeof value === "object" && value !== null ? collectProcedureAccess(value, `${path}.`) : [];
+// packages/daemon/src/platform/process/get-impd-logger.ts
+import { getLogger } from "@logtape/logtape";
+function getImpdLogger(area) {
+  return getLogger(["impd", area]);
+}
+
+// packages/daemon/src/platform/process/run-command.ts
+async function runCommand(argv, options = {}) {
+  const child = Bun.spawn([...argv], {
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "pipe",
+    env: options.env === undefined ? process.env : { ...options.env },
+    ...options.signal !== undefined && { signal: options.signal }
   });
+  const [stdout, stderr, exitCode] = await Promise.all([
+    new Response(child.stdout).text(),
+    new Response(child.stderr).text(),
+    child.exited
+  ]);
+  return { exitCode, stdout, stderr };
+}
+async function runChecked(argv, options = {}, run = runCommand) {
+  const result = await run(argv, options);
+  if (result.exitCode !== 0) {
+    throw buildExitError(argv, result);
+  }
+  return result.stdout;
+}
+function buildExitError(argv, result) {
+  const output = result.stderr.trim() || (result.stdout ?? "").trim();
+  return new Error(`${argv.join(" ")} exited ${String(result.exitCode)}: ${output}`);
+}
+
+// packages/daemon/src/host-net/net/nat66-ruleset.ts
+var NAT66_TABLE = "ip6 imp_nat66";
+function buildNat66Ruleset(prefix, uplink) {
+  return [
+    `table ${NAT66_TABLE} {}`,
+    `delete table ${NAT66_TABLE}`,
+    `table ${NAT66_TABLE} {`,
+    "  chain postrouting {",
+    "    type nat hook postrouting priority srcnat; policy accept;",
+    `    oifname "${uplink}" ip6 saddr ${prefix} masquerade`,
+    "  }",
+    "}",
+    ""
+  ].join(`
+`);
+}
+function buildNat66Removal() {
+  return `table ${NAT66_TABLE} {}
+delete table ${NAT66_TABLE}
+`;
 }
-// packages/api/src/rules/is-imp-allowed.ts
-function isImpAllowed(patterns, name) {
-  return patterns === null || patterns.some((pattern) => isPatternMatch(pattern, name));
+
+// packages/daemon/src/host-net/net/ipv6-plan.ts
+function parseIpv6Setting(text) {
+  if (text === "auto" || text === "off") {
+    return { kind: text };
+  }
+  const prefix = parsePrefix64(text);
+  if (prefix === null) {
+    throw new Error(`IMP_SUBNET6 must be auto, off or an IPv6 /64, got ${text}`);
+  }
+  return { kind: "routed", prefix };
 }
-function isPatternMatch(pattern, name) {
-  const [first = "", ...rest] = pattern.split("*");
-  if (rest.length === 0) {
-    return name === first;
+async function resolveIpv6Plan(setting, deps) {
+  const stopIpv6 = async (reason) => {
+    await removeNat66(deps);
+    getImpdLogger("ipv6").info("off ({reason})", { reason });
+    return null;
+  };
+  if (setting.kind === "off") {
+    return stopIpv6("IMP_SUBNET6=off");
   }
-  const last = rest.pop() ?? "";
-  if (!name.startsWith(first) || !name.endsWith(last) || name.length < first.length + last.length) {
-    return false;
+  const uplink = await deps.readDefaultRoute();
+  if (setting.kind === "auto" && uplink === null) {
+    return stopIpv6("IMP_SUBNET6=auto, and the container has no IPv6 default route");
   }
-  let at = first.length;
-  const end = name.length - last.length;
-  for (const part of rest) {
-    const found = name.indexOf(part, at);
-    if (found === -1 || found + part.length > end) {
-      return false;
+  const missing = await deps.checkHostRules();
+  if (missing !== null) {
+    return stopIpv6(`the host's IPv6 rules are not in place: ${missing}`);
+  }
+  if (setting.kind === "routed") {
+    await removeNat66(deps);
+    getImpdLogger("ipv6").info("{text}, routed{route}", {
+      text: setting.prefix.text,
+      route: uplink === null ? "; the container has no IPv6 default route" : ` via ${uplink}`
+    });
+    return { prefix: setting.prefix, nat66: false, uplink };
+  }
+  const prefix = deps.readUlaPrefix();
+  try {
+    await deps.runNft(buildNat66Ruleset(prefix.text, uplink ?? ""));
+  } catch (error) {
+    return stopIpv6(`NAT66: ${getErrorMessage(error)}`);
+  }
+  getImpdLogger("ipv6").info("{text}, NAT66 out of {uplink}", {
+    text: prefix.text,
+    uplink: uplink ?? ""
+  });
+  return { prefix, nat66: true, uplink };
+}
+async function removeNat66(deps) {
+  try {
+    await deps.runNft(buildNat66Removal());
+  } catch {}
+}
+var HOST_RULES6 = [
+  ["filter", "-A INPUT -i imp+ -j DROP"],
+  ["filter", "-A FORWARD -i imp+ -o imp+ -j DROP"],
+  ["filter", "-A FORWARD -o imp+ -j DROP"],
+  ["filter", "-A FORWARD -i imp+ -j DROP"],
+  ["raw", "-A PREROUTING -i imp+ -m rpfilter --invert -j DROP"]
+];
+var HOST_SYSCTLS6 = [
+  ["default/accept_ra", "0"],
+  ["default/accept_redirects", "0"],
+  ["all/forwarding", "1"]
+];
+async function checkHostRules6(procSys = "/proc/sys/net/ipv6/conf", run = runCommand) {
+  for (const table of ["filter", "raw"]) {
+    const result = await run(["ip6tables", "-w", "-t", table, "-S"]);
+    const rules = new Set(result.stdout.split(`
+`).map((line) => line.trim()));
+    const missing = HOST_RULES6.find(([inTable, rule]) => inTable === table && !rules.has(rule));
+    if (result.exitCode !== 0) {
+      return `ip6tables -t ${table}: ${result.stderr.trim()}`;
+    }
+    if (missing !== undefined) {
+      return `no ip6tables -t ${table} ${missing[1]}`;
     }
-    at = found + part.length;
   }
-  return true;
+  for (const [key, wanted] of HOST_SYSCTLS6) {
+    const value = readSysctl(join2(procSys, key));
+    if (value !== wanted) {
+      return `net.ipv6.conf.${key.replace("/", ".")} is ${value ?? "missing"}, not ${wanted}`;
+    }
+  }
+  return null;
 }
-// packages/api/src/protocols/login-shell.ts
-var CONSOLE_SHELL = buildConsoleShell("/etc/passwd", ["/bin/bash", "/bin/sh"]);
-function buildConsoleShell(passwdPath, fallbacks) {
-  return [
-    "uid=$(id -u 2>/dev/null) || uid=0",
-    "shell=",
-    "while IFS=: read -r _ _ id _ _ _ login; do",
-    '  if [ "$id" = "$uid" ]; then shell=$login; break; fi',
-    `done < ${passwdPath}`,
-    ...fallbacks.map((fallback) => `[ -x "$shell" ] || shell=${fallback}`),
-    'exec "$shell" -l'
-  ].join(`
+function readSysctl(path) {
+  try {
+    return readFileSync2(path, "utf8").trim();
+  } catch {
+    return null;
+  }
+}
+function readOrCreateUlaPrefix(path) {
+  if (existsSync2(path)) {
+    const prefix = parsePrefix64(readFileSync2(path, "utf8").trim());
+    if (prefix !== null) {
+      return prefix;
+    }
+  }
+  const prefix = buildUlaPrefix(randomBytes(5));
+  mkdirSync2(dirname(path), { recursive: true });
+  writeFileSync(path, `${prefix.text}
 `);
+  return prefix;
 }
-// packages/api/src/protocols/mcp-path.ts
-var MCP_PATH = "/mcp";
-// packages/api/src/protocols/move-receive-path.ts
-var MOVE_RECEIVE_PATH = "/move/receive";
-// packages/api/src/contract/move-peer-contract.ts
-import { oc as oc2 } from "@orpc/contract";
-
-// packages/api/src/schemas/move-peer-schema.ts
-import * as z46 from "zod";
-var SystemDriveSchema = z46.string().regex(/^[\da-f]{64}$/v);
-var MoveOfferSchema = z46.object({
-  imageDigest: z46.string(),
-  receivedImageDigest: z46.string().nullable().default(null),
-  systemDrive: SystemDriveSchema.optional()
-});
-var MoveOfferReplySchema = z46.object({
-  needsImage: z46.boolean(),
-  needsSystemDrive: z46.boolean().default(false),
-  storage: z46.enum(["xfs", "zfs"]),
-  keepsMaxMemory: z46.boolean().default(false),
-  keepsLeases: z46.boolean().default(false),
-  keepsPublicEgress: z46.boolean().default(false),
-  keepsBackupOff: z46.boolean().default(false)
-});
-var MoveCommitReplySchema = z46.object({ isCommitted: z46.boolean() });
 
-// packages/api/src/contract/move-peer-contract.ts
-var movePeerContract = {
-  offer: oc2.route({ method: "POST", path: "/move/offer" }).input(MoveOfferSchema).output(MoveOfferReplySchema),
-  commit: oc2.route({ method: "POST", path: "/move/commit" }).output(MoveCommitReplySchema),
-  abort: oc2.route({ method: "POST", path: "/move/abort" }).output(MoveCommitReplySchema)
-};
-// packages/api/src/schemas/secret-presets.ts
-var SECRET_PRESETS = {
-  github: {
-    kind: "static",
-    rules: [
-      { host: "github.com", header: "authorization", scheme: "basic", user: "x-access-token" },
-      { host: "api.github.com", header: "authorization", scheme: "bearer" },
-      { host: "uploads.github.com", header: "authorization", scheme: "bearer" }
-    ],
-    env: ["GH_TOKEN", "GITHUB_TOKEN"]
-  },
-  anthropic: {
-    kind: "static",
-    rules: [{ host: "api.anthropic.com", header: "x-api-key", scheme: "raw" }],
-    env: ["ANTHROPIC_API_KEY"]
-  },
-  npm: {
-    kind: "static",
-    rules: [{ host: "registry.npmjs.org", header: "authorization", scheme: "bearer" }],
-    env: ["NPM_TOKEN"]
+// packages/daemon/src/host-net/net/range-matcher.ts
+import { IPv4 as IPv44 } from "ipaddr.js";
+function buildRangeMatcher(ranges) {
+  const ranges4 = [];
+  const ranges6 = [];
+  for (const range of ranges) {
+    const cidr = parseCidr(range);
+    if (cidr === null) {
+      throw new Error(`not an address range: ${range}`);
+    }
+    if (cidr.address instanceof IPv44) {
+      ranges4.push([cidr.address, cidr.bits]);
+    } else {
+      ranges6.push([cidr.address, cidr.bits]);
+    }
   }
-};
-// packages/api/src/rules/has-scope.ts
-function hasScope(granted, needed) {
-  const grantedRank = ScopeSchema.options.indexOf(granted);
-  const neededRank = ScopeSchema.options.indexOf(needed);
-  return grantedRank !== -1 && neededRank !== -1 && grantedRank >= neededRank;
+  const isIn4 = (ip) => ranges4.some(([network, bits]) => ip.match(network, bits));
+  const isIn6 = (ip) => ranges6.some(([network, bits]) => ip.match(network, bits));
+  return (address) => {
+    const ip = parseAddress(address);
+    if (ip === null) {
+      return false;
+    }
+    if (ip instanceof IPv44) {
+      return isIn4(ip);
+    }
+    return isIn6(ip) || ip.isIPv4MappedAddress() && isIn4(ip.toIPv4Address());
+  };
 }
+
+// packages/daemon/src/identity/auth/parse-tailnet-rules.ts
+import * as z48 from "zod";
+
 // packages/daemon/src/identity/auth/tailnet-identity.ts
 import * as z47 from "zod";
 
@@ -21702,6 +21705,8 @@ var EnvSchema = z53.object({
   IMP_EGRESS_DENY: z53.string().default(""),
   IMP_HOST_ADDRESSES: z53.string().default(""),
   IMP_RAM_BUDGET_MIB: CountSchema3.default(16384),
+  IMP_PRIORITY_RAM_MIB: CountSchema3.optional(),
+  IMP_PRIORITY_IMPS: z53.string().transform(splitList).pipe(z53.array(ImpPatternSchema)).optional(),
   IMP_IDLE_TIMEOUT_S: CountSchema3.default(60),
   IMP_IDLE_CPU_PERCENT: z53.coerce.number().nonnegative().default(10),
   IMP_MEMORY_SHRINK_AFTER_S: CountSchema3.default(60),
@@ -21866,6 +21871,7 @@ function loadConfig(env) {
     hostAddresses,
     brokerTestUpstreams: parsed.IMP_BROKER_TEST_UPSTREAMS ?? null,
     ramBudgetMib: parsed.IMP_RAM_BUDGET_MIB,
+    priorityRam: parsePriorityRam(parsed),
     idleTimeoutS: parsed.IMP_IDLE_TIMEOUT_S,
     idleCpuPercent: parsed.IMP_IDLE_CPU_PERCENT,
     memoryShrinkAfterMs: parsed.IMP_MEMORY_SHRINK_AFTER_S * 1000,
@@ -21922,6 +21928,20 @@ function loadConfig(env) {
     warnings: listHttpsWarnings(parsed)
   };
 }
+function parsePriorityRam(parsed) {
+  const mib = parsed.IMP_PRIORITY_RAM_MIB;
+  const patterns = parsed.IMP_PRIORITY_IMPS;
+  if (mib === undefined && patterns === undefined) {
+    return null;
+  }
+  if (mib === undefined || patterns === undefined) {
+    throw new Error("IMP_PRIORITY_RAM_MIB and IMP_PRIORITY_IMPS go together; set both or neither");
+  }
+  if (mib >= parsed.IMP_RAM_BUDGET_MIB) {
+    throw new Error(`IMP_PRIORITY_RAM_MIB ${String(mib)} leaves no room for other imps in the ${String(parsed.IMP_RAM_BUDGET_MIB)} MiB IMP_RAM_BUDGET_MIB`);
+  }
+  return { mib, patterns };
+}
 function parseTestRegistry(parsed) {
   const registry = parsed.IMP_BUILD_TEST_REGISTRY;
   const caPath = parsed.IMP_BUILD_TEST_REGISTRY_CA;
@@ -21971,7 +21991,7 @@ import { join as join48 } from "path";
 // packages/daemon/package.json
 var package_default = {
   name: "@impz/daemon",
-  version: "6.7.0",
+  version: "6.8.0",
   private: true,
   description: "impd: the imp host daemon",
   type: "module",
@@ -25003,7 +25023,7 @@ class RamBudgetError extends ImpdError {
         budgetMib: shortfall.budgetMib,
         usedMib: shortfall.usedMib,
         requestedMib: shortfall.requestedMib,
-        neededMib: buildNeededMib(shortfall.usedMib, shortfall.requestedMib, shortfall.budgetMib),
+        neededMib: buildNeededMib(shortfall.usedMib + (shortfall.kept?.mib ?? 0), shortfall.requestedMib, shortfall.budgetMib),
         protected: [],
         protectedHidden: shortfall.protected.length
       }
@@ -25023,25 +25043,35 @@ function buildRamBudgetError(shortfall) {
   const used = String(shortfall.usedMib);
   const budget = String(shortfall.budgetMib);
   const requested = String(shortfall.requestedMib);
-  return new RamBudgetError(`not enough RAM: ${used} of ${budget} MiB in use, ${requested} MiB requested, and no idle imp left to sleep`, shortfall, "ram");
+  const kept = formatKept(shortfall.kept);
+  return new RamBudgetError(`not enough RAM: ${used} of ${budget} MiB in use${kept}, ${requested} MiB requested, and no idle imp left to sleep`, shortfall, "ram");
 }
 function buildOrdinaryBudgetError(shortfall) {
   const used = String(shortfall.usedMib);
   const budget = String(shortfall.budgetMib);
   const requested = String(shortfall.requestedMib);
-  return new RamBudgetError(`not enough RAM outside the huge page pool: ${used} of ${budget} MiB in use, ${requested} MiB requested on 4 KiB pages, and no idle imp left to sleep`, shortfall, "ordinary");
+  const kept = formatKept(shortfall.kept);
+  return new RamBudgetError(`not enough RAM outside the huge page pool: ${used} of ${budget} MiB in use${kept}, ${requested} MiB requested on 4 KiB pages, and no idle imp left to sleep`, shortfall, "ordinary");
 }
 function buildHugePoolError(shortfall) {
   const committed = String(shortfall.committedMib);
   const total = String(shortfall.totalMib);
   const requested = String(shortfall.requestedMib);
-  return new RamBudgetError(`not enough 2 MiB pages: ${committed} of the host's ${total} MiB pool in use or promised to awake imps, ${requested} MiB requested`, {
+  const kept = formatKept(shortfall.kept);
+  return new RamBudgetError(`not enough 2 MiB pages: ${committed} of the host's ${total} MiB pool in use or promised to awake imps${kept}, ${requested} MiB requested`, {
     budgetMib: shortfall.totalMib,
     usedMib: shortfall.committedMib,
     requestedMib: shortfall.requestedMib,
-    protected: []
+    protected: [],
+    ...shortfall.kept !== undefined && { kept: shortfall.kept }
   }, "pool");
 }
+function formatKept(kept) {
+  if (kept === undefined || kept.mib === 0) {
+    return "";
+  }
+  return ` and ${String(kept.mib)} MiB kept for priority imps (${kept.patterns.join(", ")})`;
+}
 function buildNeededMib(usedMib, requestedMib, budgetMib) {
   return Math.max(0, usedMib + requestedMib - budgetMib);
 }
@@ -30535,6 +30565,7 @@ async function readSystemInfo(deps) {
     ramUsedMib: usage.usedMib,
     ramReservedMib: usage.reservedMib,
     ramCommittedMib: running.reduce((sum, imp) => sum + imp.maxMemoryMib, 0),
+    ramPriorityKeptMib: usage.priorityKeptMib,
     ramSleepingMib: sleeping.reduce((sum, imp) => sum + imp.memoryMib, 0),
     awakeCount: running.length,
     impCount: imps.length,
@@ -37697,6 +37728,61 @@ function buildBudgets(budgetMib, pool) {
   };
 }
 
+// packages/daemon/src/imp-ops/governor/build-usage-totals.ts
+function buildUsageTotals(input) {
+  const reserved = new Map(input.reservations.map((reservation) => [reservation.id, reservation]));
+  const byImp = new Map;
+  let usedMib = input.lockedMib;
+  let effectiveMib = input.lockedMib + input.headroomMib;
+  let ordinaryUsedMib = input.lockedMib;
+  let ordinaryEffectiveMib = input.lockedMib + input.headroomMib;
+  const priority = { ramMib: 0, ordinaryMib: 0, poolMib: 0 };
+  for (const [index, imp] of input.awake.entries()) {
+    const reading = input.readings[index] ?? null;
+    const measured = reading?.ramMib ?? 0;
+    const effective = Math.max(measured, reserved.get(imp.id)?.mib ?? 0);
+    const ordinary = imp.hugePagesMib > 0 ? Math.max(0, measured - (reading?.hugetlbMib ?? 0)) : effective;
+    byImp.set(imp.id, effective);
+    usedMib += measured;
+    effectiveMib += effective;
+    ordinaryUsedMib += imp.hugePagesMib > 0 ? ordinary : measured;
+    ordinaryEffectiveMib += ordinary;
+    if (imp.isPriority) {
+      priority.ramMib += effective;
+      priority.ordinaryMib += ordinary;
+      priority.poolMib += imp.hugePagesMib;
+    }
+  }
+  for (const reservation of input.reservations) {
+    if (!byImp.has(reservation.id)) {
+      const ordinary = reservation.isOnPool ? 0 : reservation.mib;
+      effectiveMib += reservation.mib;
+      ordinaryEffectiveMib += ordinary;
+      if (reservation.isPriority) {
+        priority.ramMib += reservation.mib;
+        priority.ordinaryMib += ordinary;
+      }
+    }
+  }
+  for (const pending of input.pendingPool) {
+    if (pending.isPriority && !byImp.has(pending.id)) {
+      priority.poolMib += pending.mib;
+    }
+  }
+  return {
+    byImp,
+    usedMib,
+    effectiveMib,
+    ordinaryUsedMib,
+    ordinaryEffectiveMib,
+    kept: {
+      ramMib: Math.max(0, input.priorityMib - priority.ramMib),
+      ordinaryMib: Math.max(0, input.priorityMib - priority.ordinaryMib),
+      poolMib: Math.max(0, input.priorityMib - priority.poolMib)
+    }
+  };
+}
+
 // packages/daemon/src/imp-ops/governor/build-huge-pool-admission.ts
 function buildHugePoolAdmission(input) {
   const growthMib = input.awake.reduce((sum, guest) => sum + Math.max(0, guest.hugePagesMib - guest.heldMib), 0);
@@ -37704,21 +37790,22 @@ function buildHugePoolAdmission(input) {
   const totalMib = input.pool?.totalMib ?? 0;
   const freeMib = input.pool?.freeMib ?? 0;
   const promisedMib = growthMib + pendingMib;
-  if (promisedMib + input.requestedMib <= freeMib) {
+  const wantedMib = promisedMib + input.keptMib + input.requestedMib;
+  if (wantedMib <= freeMib) {
     return { admitted: true };
   }
   return {
     admitted: false,
     totalMib,
     committedMib: totalMib - freeMib + promisedMib,
-    neededMib: promisedMib + input.requestedMib - freeMib
+    neededMib: wantedMib - freeMib
   };
 }
 
 // packages/daemon/src/imp-ops/governor/make-check-huge-pool.ts
 function makeCheckHugePool(deps) {
   const pendingHugePages = deps.pendingHugePages;
-  return async (request, hugePagesMib) => {
+  return async (request, hugePagesMib, kept) => {
     const listed = await deps.listAwake();
     const awake = listed.filter((imp) => imp.id !== request.id);
     for (const imp of awake) {
@@ -37734,7 +37821,8 @@ function makeCheckHugePool(deps) {
         heldMib: held[index] ?? 0
       })),
       pendingMib: [...pendingHugePages].filter(([id]) => id !== request.id).map(([, mib]) => mib),
-      requestedMib: hugePagesMib
+      requestedMib: hugePagesMib,
+      keptMib: kept?.mib ?? 0
     });
     if (poolAdmission.admitted) {
       return;
@@ -37750,7 +37838,8 @@ function makeCheckHugePool(deps) {
     throw buildHugePoolError({
       totalMib: poolAdmission.totalMib,
       committedMib: poolAdmission.committedMib,
-      requestedMib: hugePagesMib
+      requestedMib: hugePagesMib,
+      ...kept !== null && { kept }
     });
   };
 }
@@ -37775,6 +37864,17 @@ function pickShortfall(used, budgets, requestedMib) {
   } : ram;
 }
 
+// packages/daemon/src/imp-ops/governor/pick-effective-shortfall.ts
+function pickEffectiveShortfall(usage, budgets, requestedMib, isPriority) {
+  const kept = isPriority ? { ramMib: 0, ordinaryMib: 0 } : usage.kept;
+  const shortfall = pickShortfall({
+    ramMib: usage.effectiveMib + kept.ramMib,
+    ordinaryMib: usage.ordinaryEffectiveMib + kept.ordinaryMib
+  }, budgets, requestedMib);
+  const keptMib = shortfall.budget === "ordinary" ? kept.ordinaryMib : kept.ramMib;
+  return { ...shortfall, usedMib: shortfall.usedMib - keptMib, keptMib };
+}
+
 // packages/daemon/src/imp-ops/governor/pick-sleep-victims.ts
 function pickSleepVictims(candidates, needMib) {
   if (needMib <= 0) {
@@ -37802,8 +37902,12 @@ function createRamGovernor(deps) {
   const admission = createPrioritySemaphore(1);
   const reservations = new Map;
   const now = deps.now ?? Date.now;
+  const priority = deps.priority ?? null;
+  const isPriority = (name) => priority !== null && name !== null && isImpAllowed(priority.patterns, name);
+  const buildKept = (mib) => priority === null || mib === 0 ? null : { mib, patterns: priority.patterns };
   let stuckOver = false;
   const pendingHugePages = new Map;
+  const admittedPriority = new Set;
   const emitDecision = (decision) => {
     deps.events?.publish({
       v: EVENT_VERSION,
@@ -37834,6 +37938,11 @@ function createRamGovernor(deps) {
     if ((request.hugePagesMib ?? 0) > 0) {
       pendingHugePages.set(request.id, request.hugePagesMib ?? 0);
     }
+    if (isPriority(request.name)) {
+      admittedPriority.add(request.id);
+    } else {
+      admittedPriority.delete(request.id);
+    }
     emitAdmission(request, "admitted", usedMib);
   };
   const readReservation = (id) => {
@@ -37864,45 +37973,27 @@ function createRamGovernor(deps) {
   const readEffectiveUsage = async (excludeId, readVm = deps.readVmRam) => {
     const listed = await deps.listAwake();
     const awake = listed.filter((imp) => imp.id !== excludeId);
-    const byImp = new Map;
     const lockedMib = deps.readLockedMib?.() ?? 0;
-    let usedMib = lockedMib;
-    let effectiveMib = lockedMib;
-    let ordinaryUsedMib = lockedMib;
-    let ordinaryEffectiveMib = lockedMib;
     const readings = await Promise.all(awake.map((imp) => readVm(imp.pid, imp.apiSocket)));
-    for (const [index, imp] of awake.entries()) {
-      const reading = readings[index] ?? null;
-      const measured = reading?.ramMib ?? 0;
-      const effective = Math.max(measured, readReservation(imp.id));
-      const ordinary = imp.hugePagesMib > 0 ? Math.max(0, measured - (reading?.hugetlbMib ?? 0)) : effective;
-      byImp.set(imp.id, effective);
-      usedMib += measured;
-      effectiveMib += effective;
-      ordinaryUsedMib += imp.hugePagesMib > 0 ? ordinary : measured;
-      ordinaryEffectiveMib += ordinary;
-    }
-    for (const id of reservations.keys()) {
-      if (id !== excludeId && !byImp.has(id)) {
-        effectiveMib += readReservation(id);
-        if (!pendingHugePages.has(id)) {
-          ordinaryEffectiveMib += readReservation(id);
-        }
-      }
-    }
+    const live = [...reservations.keys()].filter((id) => id !== excludeId).map((id) => ({
+      id,
+      mib: readReservation(id),
+      isPriority: admittedPriority.has(id),
+      isOnPool: pendingHugePages.has(id)
+    }));
+    const pendingPool = [...pendingHugePages].filter(([id]) => id !== excludeId).map(([id, mib]) => ({ id, mib, isPriority: admittedPriority.has(id) }));
     const headroom = deps.readHeadroomMib?.(awake.map((imp) => imp.pid)) ?? Promise.resolve(0);
     const headroomMib = await headroom;
-    effectiveMib += headroomMib;
-    ordinaryEffectiveMib += headroomMib;
-    return {
-      awake,
-      byImp,
-      usedMib,
-      effectiveMib,
-      ordinaryUsedMib,
-      ordinaryEffectiveMib,
-      headroomMib
-    };
+    const totals = buildUsageTotals({
+      awake: awake.map((imp) => ({ ...imp, isPriority: isPriority(imp.name) })),
+      readings,
+      reservations: live,
+      pendingPool,
+      lockedMib,
+      headroomMib,
+      priorityMib: priority?.mib ?? 0
+    });
+    return { awake, headroomMib, ...totals };
   };
   const readFreeRoom = async (excludeId, findShortfall) => {
     const usage = await readEffectiveUsage(excludeId);
@@ -37930,7 +38021,7 @@ function createRamGovernor(deps) {
       const shortfall = options.findShortfall(usage);
       const missingMib = shortfall.missingMib;
       const isOrdinary = shortfall.budget === "ordinary";
-      const sleepable = usage.awake.filter((imp) => !isOrdinary || imp.hugePagesMib === 0);
+      const sleepable = usage.awake.filter((imp) => !isOrdinary || imp.hugePagesMib === 0).filter((imp) => !options.sparesPriority || !isPriority(imp.name));
       if (missingMib <= 0) {
         return {
           fits: true,
@@ -38015,20 +38106,23 @@ function createRamGovernor(deps) {
           requestedMib: request.memoryMib
         });
       }
+      const bound = await readEffectiveUsage(request.id, deps.readResidentRam);
+      const isPriorityRequest = isPriority(request.name);
       if (hugePagesMib > 0) {
-        await checkHugePool(request, hugePagesMib);
+        const kept = isPriorityRequest ? null : buildKept(bound.kept.poolMib);
+        await checkHugePool(request, hugePagesMib, kept);
       }
-      const bound = await readEffectiveUsage(request.id, deps.readResidentRam);
-      if (pickEffectiveShortfall(bound, budgets, request.reserveMib).missingMib <= 0) {
+      const findReserveShortfall = (usage) => pickEffectiveShortfall(usage, budgets, request.reserveMib, isPriorityRequest);
+      if (findReserveShortfall(bound).missingMib <= 0) {
         recordAdmission(request, bound.effectiveMib);
         return;
       }
-      const findReserveShortfall = (usage) => pickEffectiveShortfall(usage, budgets, request.reserveMib);
       const room = request.maySleepImps === false ? await readFreeRoom(request.id, findReserveShortfall) : await makeRoom({
         excludeId: request.id,
         reason: `to make room for ${request.name ?? request.id}`,
         whenShort: "giveUp",
-        findShortfall: findReserveShortfall
+        findShortfall: findReserveShortfall,
+        sparesPriority: !isPriorityRequest
       });
       const diskFull = room.diskFull ? deps.readDiskFullError?.() ?? null : null;
       if (!room.fits && diskFull !== null) {
@@ -38038,8 +38132,9 @@ function createRamGovernor(deps) {
         const usage = await readEffectiveUsage(request.id);
         const shortfall = findReserveShortfall(usage);
         const isOrdinary = shortfall.budget === "ordinary";
+        const kept = buildKept(shortfall.keptMib);
         emitAdmission(request, "refused", shortfall.usedMib, {
-          neededMib: buildNeededMib(shortfall.usedMib, request.reserveMib, shortfall.budgetMib),
+          neededMib: Math.max(0, shortfall.missingMib),
           protectedCount: room.protected.length,
           ...isOrdinary && { trigger: ORDINARY_TRIGGER }
         });
@@ -38047,7 +38142,8 @@ function createRamGovernor(deps) {
           budgetMib: shortfall.budgetMib,
           usedMib: shortfall.usedMib,
           requestedMib: request.reserveMib,
-          protected: room.protected
+          protected: room.protected,
+          ...kept !== null && { kept }
         };
         throw isOrdinary ? buildOrdinaryBudgetError(refusal) : buildRamBudgetError(refusal);
       }
@@ -38056,6 +38152,7 @@ function createRamGovernor(deps) {
     release: (id) => {
       reservations.delete(id);
       pendingHugePages.delete(id);
+      admittedPriority.delete(id);
     },
     admitGrow: (request) => admission.run("background", async () => {
       const listed = await deps.listAwake();
@@ -38063,15 +38160,17 @@ function createRamGovernor(deps) {
         return false;
       }
       const budgets = readBudgets();
+      const findGrowShortfall = (usage) => pickEffectiveShortfall(usage, budgets, request.mib, isPriority(request.name));
       const room = await makeRoom({
         excludeId: null,
         reason: `to grow ${request.name}`,
         whenShort: "giveUp",
-        findShortfall: (usage) => pickEffectiveShortfall(usage, budgets, request.mib),
-        protectedId: request.id
+        findShortfall: findGrowShortfall,
+        protectedId: request.id,
+        sparesPriority: !isPriority(request.name)
       });
       const usage = await readEffectiveUsage(null);
-      const shortfall = pickEffectiveShortfall(usage, budgets, request.mib);
+      const shortfall = findGrowShortfall(usage);
       const fits = room.fits && usage.awake.some((imp) => imp.id === request.id);
       emitDecision({
         decision: fits ? "admitted" : "refused",
@@ -38111,7 +38210,8 @@ function createRamGovernor(deps) {
       return {
         usedMib: usage.usedMib,
         reservedMib: usage.effectiveMib - usage.usedMib - usage.headroomMib,
-        headroomMib: usage.headroomMib
+        headroomMib: usage.headroomMib,
+        priorityKeptMib: usage.kept.ramMib
       };
     },
     enforce: () => admission.run("background", async () => {
@@ -38120,7 +38220,8 @@ function createRamGovernor(deps) {
         excludeId: null,
         reason: ENFORCE_TRIGGER,
         whenShort: "sleepAll",
-        findShortfall: (usage) => pickShortfall({ ramMib: usage.usedMib, ordinaryMib: usage.ordinaryUsedMib }, budgets, 0)
+        findShortfall: (usage) => pickShortfall({ ramMib: usage.usedMib, ordinaryMib: usage.ordinaryUsedMib }, budgets, 0),
+        sparesPriority: false
       });
       const over = `over budget by ${String(room.missingMib)} MiB`;
       if (room.fits) {
@@ -38138,9 +38239,6 @@ function createRamGovernor(deps) {
     })
   };
 }
-function pickEffectiveShortfall(usage, budgets, requestedMib) {
-  return pickShortfall({ ramMib: usage.effectiveMib, ordinaryMib: usage.ordinaryEffectiveMib }, budgets, requestedMib);
-}
 function toTaskPriority(request) {
   return request.isBackground === true ? "background" : "foreground";
 }
@@ -45638,6 +45736,7 @@ function createImpdImps(config, deps, parts) {
   });
   const governor = createRamGovernor({
     budgetMib: config.ramBudgetMib,
+    priority: config.priorityRam,
     listAwake: async () => {
       const listed = await listImps(deps.db);
       return listed.flatMap((imp) => {