@outerlayer/cli 0.34.0-next.20261025133402 → 0.34.0-next.20261025210240

package/dist/{command-ZAXYAZCI.js → command-KFYK3WEF.js}

@@ -1,50 +1,47 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { runRunnerInstall, launcherSummary, restartNote } from './chunk-T7N3BAOO.js';
-import './chunk-J246WRLZ.js';
-import { currentLink, execStartCommand } from './chunk-DUPM5LVJ.js';
-import { detectMachine, helperSocketPath, ensureFirecrackerAndJailer } from './chunk-POGPX7LI.js';
+import { realOwnership, accountNamed, handOver, runRunnerInstall, launcherSummary, restartNote, accountIdentity } from './chunk-GC5PVMIJ.js';
+import './chunk-OS7DJOQJ.js';
+import { currentLink, execStartCommand } from './chunk-UMYYYF7B.js';
+import { detectMachine, helperSocketPath, ensureFirecrackerAndJailer } from './chunk-JQSZTQSK.js';
 import './chunk-2PGI6RDE.js';
-import './chunk-EZ7L5IZU.js';
-import './chunk-3NFZN7H6.js';
-import './chunk-ENFBYN4A.js';
-import './chunk-JBJTC3UU.js';
+import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-IHY457PB.js';
-import './chunk-2RBIW2PD.js';
-import './chunk-AVLLJW5D.js';
-import './chunk-36T6W5RA.js';
+import './chunk-2ILU7UAU.js';
+import './chunk-OGPEHSNW.js';
+import './chunk-RFVIQLNB.js';
+import './chunk-SYVRBBLW.js';
 import './chunk-TQMI335S.js';
-import { DEFAULT_UNIT_NAME, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-AABYHGVO.js';
-import { runnerVmOf, loadRunnerConfig, builtinKind } from './chunk-4XYC2663.js';
-import './chunk-UC2DKBMS.js';
-import { readJobFile } from './chunk-MPDLZCXM.js';
-import './chunk-3Z3MPR55.js';
-import { firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, HOST_HELPER_ASSETS_VERSION, hostHelperPinned } from './chunk-ES4ULBAL.js';
+import './chunk-OQLF3MQQ.js';
+import { unitNameProblem, DEFAULT_UNIT_NAME, checkFit, installService, uninstallService, realTaskScheduler, UNIT_MARKER } from './chunk-INOUUSYI.js';
+import { runnerVmOf, loadRunnerConfig, builtinKind } from './chunk-2D6CKNR7.js';
+import './chunk-KM2HLQE3.js';
+import { parseSize, readJobFile } from './chunk-5AFPP3GZ.js';
+import { HOST_HELPER_ASSETS_VERSION, builderDiskPinned, hostHelperSupportsSlice, HOST_HELPER_SLICE_SINCE, firecrackerArch, MICROVM_ARCHES, FIRECRACKER_VERSION, FIRECRACKER_BINARY_SHA256, JAILER_BINARY_SHA256, HOST_HELPER_SHA256, HOST_HELPER_BASE_URL, hostHelperPinned } from './chunk-4UPET3R7.js';
 import { realLima } from './chunk-77MM5RYD.js';
 import { writeLaunchAgent, launchAgentPath } from './chunk-LF6MLJCY.js';
-import './chunk-IW6Z337K.js';
+import './chunk-YNMVVQOQ.js';
+import './chunk-JBJTC3UU.js';
+import './chunk-UN3SQTVL.js';
 import './chunk-IP7BIBXJ.js';
-import './chunk-3M6UYJSR.js';
-import './chunk-XA6PGME5.js';
-import './chunk-MECW77XP.js';
-import './chunk-AJYZNISW.js';
-import './chunk-NKOM4JKY.js';
+import './chunk-AVPLEFQR.js';
+import './chunk-FVCHHSHB.js';
 import './chunk-Y5YCX6AL.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-QOUR4CQ7.js';
+import './chunk-MECW77XP.js';
+import './chunk-NKOM4JKY.js';
+import './chunk-CAQCDYKF.js';
 import './chunk-JWNH4ZTF.js';
-import './chunk-TVGLNHEB.js';
+import './chunk-3N77LUQI.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-XLJLR7EK.js';
-import { runnerDir } from './chunk-N7LAEN3T.js';
-import './chunk-YOBQIXX6.js';
+import './chunk-MOI2KDLH.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-ZQSANKS4.js';
+import './chunk-AJYZNISW.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
@@ -54,11 +51,12 @@ import './chunk-YQR6E6OV.js';
 import './chunk-FGXT5OXS.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-HACGUL52.js';
+import { runnerDir, vmAssetsDir } from './chunk-PXGU3GKY.js';
+import { CLAUDE_ENV_FILE } from './chunk-G4W4B33M.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 import { userInfo, totalmem, tmpdir } from 'os';
-import { join, dirname } from 'path';
+import { dirname, join } from 'path';
 import { createHash } from 'crypto';
 import { rmSync, existsSync, readdirSync, mkdtempSync, writeFileSync, readFileSync, statSync, lstatSync } from 'fs';
 import { spawnSync } from 'child_process';
@@ -69,6 +67,7 @@ var ETC = "/etc/outerlayer";
 var UID_BASE = 2e9;
 var UID_COUNT = 256;
 var UID_ATTEMPTS = 8;
+var UID_STEP = 65536;
 function helperUnitFor(unitName) {
   return `${unitName}-helper`;
 }
@@ -84,6 +83,23 @@ function helperConfigPathFor(unitName) {
 function helperUnitPathFor(unitName) {
   return `/etc/systemd/system/${helperUnitFor(unitName)}.service`;
 }
+function sliceFor(unitName) {
+  return `${unitName}-builds.slice`;
+}
+function slicePathFor(unitName) {
+  return `/etc/systemd/system/${sliceFor(unitName)}`;
+}
+function sliceUnitText(unitName, limits) {
+  return `${UNIT_MARKER}
+[Unit]
+Description=OuterLayer builds of ${unitName}
+
+[Slice]
+${limits.memoryMaxBytes === void 0 ? "" : `MemoryMax=${limits.memoryMaxBytes}
+MemorySwapMax=0
+`}${limits.cpus === void 0 ? "" : `CPUQuota=${Math.round(limits.cpus * 100)}%
+`}`;
+}
 function sha256Of(bytes) {
   return createHash("sha256").update(bytes).digest("hex");
 }
@@ -119,6 +135,7 @@ function helperConfigText(input) {
       socket: helperSocketFor(input.unitName),
       uidBase: input.uidBase,
       uidCount: UID_COUNT,
+      ...input.slice ? { slice: sliceFor(input.unitName) } : {},
       jailer: { path: `${dir}/jailer`, sha256: input.pins.jailer },
       firecracker: { path: `${dir}/firecracker`, sha256: input.pins.firecracker },
       firecrackerVersion: input.pins.firecrackerVersion
@@ -153,9 +170,28 @@ async function installHelper(request, deps) {
       `no directory that only root can write, below only such directories, is on the same file system as ${buildsRoot}, so the root helper was not installed: it links each build's files into its jail, and a link cannot cross file systems. ${without}`
     ]);
   }
-  let uidBase = UID_BASE;
-  for (let attempt = 0; attempt < UID_ATTEMPTS && !helper.uidRangeFree(uidBase, UID_COUNT); attempt++) uidBase += 65536;
-  if (!helper.uidRangeFree(uidBase, UID_COUNT)) return notInstalled(true, [`every range of ${UID_COUNT} user ids that was tried is used by an account or a group, so the root helper was not installed: ${without}`]);
+  const others = helper.helperRanges().filter((range) => range.helper !== unit);
+  const own = helper.helperRanges().find((range) => range.helper === unit);
+  const takerOf = (base) => {
+    const account = helper.uidRangeTaker(base, UID_COUNT);
+    if (account !== void 0) return account;
+    const rival = others.find((range) => base < range.uidBase + range.uidCount && range.uidBase < base + UID_COUNT);
+    return rival === void 0 ? void 0 : `the root helper ${rival.helper}`;
+  };
+  const tried = [];
+  let uidBase;
+  const candidates = own === void 0 ? Array.from({ length: UID_ATTEMPTS + 1 }, (_, i) => UID_BASE + i * UID_STEP) : [own.uidBase, ...Array.from({ length: UID_ATTEMPTS + 1 }, (_, i) => UID_BASE + i * UID_STEP)];
+  for (const base of candidates) {
+    const taker = takerOf(base);
+    if (taker === void 0) {
+      uidBase = base;
+      break;
+    }
+    tried.push(`${base} to ${base + UID_COUNT - 1} is used by ${taker}`);
+  }
+  if (uidBase === void 0) {
+    return notInstalled(false, [`every range of ${UID_COUNT} user ids that was tried is taken (${tried.join("; ")}), so the root helper was not installed`]);
+  }
   let assets;
   let helperBytes;
   try {
@@ -167,7 +203,7 @@ async function installHelper(request, deps) {
   if (sha256Of(helperBytes) !== helper.pins.helper) {
     return notInstalled(false, [`the root helper that was downloaded has sha256 ${sha256Of(helperBytes)}, not the ${helper.pins.helper} this release pins, so it was not installed`]);
   }
-  const config = helperConfigText({ unitName: request.unitName, uid: identity.uid, gid: identity.gid, buildsRoot, jailBase, uidBase, pins: helper.pins });
+  const config = helperConfigText({ unitName: request.unitName, uid: identity.uid, gid: identity.gid, buildsRoot, jailBase, uidBase, slice: request.slice !== void 0, pins: helper.pins });
   const unitPath = helperUnitPathFor(request.unitName);
   const existed = deps.systemd.read(unitPath) !== void 0;
   const staged = helper.stage({ "outerlayer-host-helper": helperBytes, "helper.json": config });
@@ -193,6 +229,9 @@ async function installHelper(request, deps) {
     }
     removeFiles();
   };
+  const removeNewSlice = () => {
+    if (deps.systemd.read(slicePathFor(request.unitName)) !== void 0) deps.systemd.remove(slicePathFor(request.unitName));
+  };
   try {
     const copies = [
       { from: join(staged.dir, "outerlayer-host-helper"), to: `${dir}/outerlayer-host-helper`, pin: helper.pins.helper, what: "helper" },
@@ -224,15 +263,29 @@ async function installHelper(request, deps) {
   } finally {
     staged.remove();
   }
-  say(`sudo tee ${unitPath}`);
+  const slicePath = slicePathFor(request.unitName);
   try {
+    if (request.slice !== void 0) {
+      say(`sudo tee ${slicePath}`);
+      deps.systemd.write(slicePath, sliceUnitText(request.unitName, request.slice));
+    } else if (deps.systemd.read(slicePath)?.startsWith(UNIT_MARKER) === true) {
+      say(`sudo rm ${slicePath}`);
+      deps.systemd.remove(slicePath);
+    }
+    say(`sudo tee ${unitPath}`);
     deps.systemd.write(unitPath, helperUnitText(request.unitName));
   } catch (err) {
-    if (!existed) removeFiles();
+    if (!existed) {
+      removeFiles();
+      removeNewSlice();
+    }
     return notInstalled(false, [...lines, err instanceof Error ? err.message : String(err)]);
   }
   if (!systemctl(["daemon-reload"]) || !systemctl(["enable", "--now", unit]) || existed && !systemctl(["restart", unit])) {
-    if (!existed) discard();
+    if (!existed) {
+      discard();
+      removeNewSlice();
+    }
     lines.push(`the unit ${unit} did not start, so the root helper is not running: ${without}`);
     return notInstalled(false, lines);
   }
@@ -272,6 +325,12 @@ function uninstallHelper(request, deps) {
   }
   root(["rm", "-rf", dir]);
   root(["rm", "-f", configFile]);
+  const slicePath = slicePathFor(request.unitName);
+  if (deps.systemd.read(slicePath)?.startsWith(UNIT_MARKER) === true) {
+    say(`sudo rm ${slicePath}`);
+    deps.systemd.remove(slicePath);
+    systemctl(["daemon-reload"]);
+  }
   if (jailBase !== void 0) root(["rmdir", `${jailBase}/firecracker`, jailBase]);
   lines.push(`removed the root helper ${unit}`);
   return { ok: true, installed: false, lines };
@@ -387,28 +446,44 @@ function findJailBase(buildsDir, unitName) {
 function overlaps(start, length, base, count) {
   return length > 0 && start < base + count && start + length > base;
 }
-function idRangeFree(base, count) {
+function idRangeTaker(base, count) {
   for (const file of ["/etc/passwd", "/etc/group"]) {
     const text = readText(file);
-    if (text === void 0) return false;
+    if (text === void 0) return `${file}, which could not be read`;
     for (const line of text.split("\n")) {
       const fields = line.split(":");
-      if (overlaps(Number(fields[2]), 1, base, count)) return false;
-      if (file === "/etc/passwd" && overlaps(Number(fields[3]), 1, base, count)) return false;
+      if (overlaps(Number(fields[2]), 1, base, count)) return `${file === "/etc/passwd" ? "the account" : "the group"} ${fields[0]}`;
+      if (file === "/etc/passwd" && overlaps(Number(fields[3]), 1, base, count)) return `the primary group of the account ${fields[0]}`;
     }
   }
   for (const file of ["/etc/subuid", "/etc/subgid"]) {
     for (const line of (readText(file) ?? "").split("\n")) {
       const fields = line.split(":");
-      if (overlaps(Number(fields[1]), Number(fields[2]), base, count)) return false;
+      if (overlaps(Number(fields[1]), Number(fields[2]), base, count)) return `the grant to ${fields[0]} in ${file}`;
     }
   }
-  return true;
+  return void 0;
 }
-function idOf(flag, account) {
-  const result = spawnSync("id", [flag, account], { encoding: "utf8" });
-  const id = Number(result.stdout);
-  return result.status === 0 && Number.isInteger(id) ? id : void 0;
+var HELPER_CONFIG_DIR = "/etc/outerlayer";
+function readHelperRanges(dir = HELPER_CONFIG_DIR) {
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return [];
+  }
+  const ranges = [];
+  for (const name of names) {
+    if (!name.endsWith("-helper.json")) continue;
+    const text = readText(join(dir, name));
+    if (text === void 0) continue;
+    try {
+      const config = JSON.parse(text);
+      if (typeof config.uidBase === "number" && typeof config.uidCount === "number") ranges.push({ helper: name.slice(0, -".json".length), uidBase: config.uidBase, uidCount: config.uidCount });
+    } catch {
+    }
+  }
+  return ranges;
 }
 function realHelperDeps() {
   const arch = firecrackerArch(process.arch);
@@ -438,13 +513,10 @@ function realHelperDeps() {
         return void 0;
       }
     },
-    identity: (account) => {
-      const uid = account === userInfo().username ? userInfo().uid : idOf("-u", account);
-      const gid = account === userInfo().username ? userInfo().gid : idOf("-g", account);
-      return uid === void 0 || gid === void 0 || uid < 0 || gid < 0 ? void 0 : { uid, gid };
-    },
+    identity: accountIdentity,
     jailBase: findJailBase,
-    uidRangeFree: idRangeFree,
+    uidRangeTaker: idRangeTaker,
+    helperRanges: () => readHelperRanges(),
     stage: (files) => {
       const dir = mkdtempSync(join(tmpdir(), "outerlayer-helper-"));
       for (const [name, content] of Object.entries(files)) writeFileSync(join(dir, name), content, { mode: 493 });
@@ -479,9 +551,57 @@ function accountCannotStart(account, nodePath, entry, can) {
   return void 0;
 }
 function vmArgs(input) {
-  return [...input.print === true ? ["--print"] : [], ...input.replace === true ? ["--replace"] : [], ...input.allowDowngrade === true ? ["--allow-downgrade"] : [], ...input.user === void 0 ? [] : ["--user", input.user], ...input.unitName === void 0 ? [] : ["--unit-name", input.unitName]];
+  return [
+    ...input.buildMemoryMax === void 0 ? [] : ["--build-memory-max", input.buildMemoryMax],
+    ...input.buildCpusMax === void 0 ? [] : ["--build-cpus-max", String(input.buildCpusMax)],
+    ...input.print === true ? ["--print"] : [],
+    ...input.replace === true ? ["--replace"] : [],
+    ...input.allowDowngrade === true ? ["--allow-downgrade"] : [],
+    ...input.user === void 0 ? [] : ["--user", input.user],
+    ...input.unitName === void 0 ? [] : ["--unit-name", input.unitName]
+  ];
+}
+var MAX_BUILD_CPUS = 1024;
+function cpusAreValid(cpus) {
+  return Number.isFinite(cpus) && Math.round(cpus * 100) >= 1 && cpus <= MAX_BUILD_CPUS;
+}
+function sliceOf(input, usesVm, helperVersion) {
+  if (input.buildMemoryMax === void 0 && input.buildCpusMax === void 0) return {};
+  if (!usesVm) return { refusal: "\u2717 --build-memory-max and --build-cpus-max limit microVM builds, and this runner's hooks are not builtin:vm. Nothing is set up" };
+  if (!hostHelperSupportsSlice(helperVersion)) {
+    return { refusal: `\u2717 the root helper this release pins (guest-${helperVersion}) cannot start builds in a slice, so the limits would not apply. Nothing is set up: update the CLI to a release that pins guest-${HOST_HELPER_SLICE_SINCE} or later, or install without --build-memory-max and --build-cpus-max` };
+  }
+  const parsedBytes = input.buildMemoryMax === void 0 ? void 0 : parseSize(input.buildMemoryMax);
+  const memoryMaxBytes = parsedBytes === void 0 ? void 0 : Math.floor(parsedBytes);
+  if (input.buildMemoryMax !== void 0 && (memoryMaxBytes === void 0 || !Number.isSafeInteger(memoryMaxBytes) || memoryMaxBytes <= 0)) return { refusal: `\u2717 --build-memory-max ${input.buildMemoryMax} is not a size such as 16g. Nothing is set up` };
+  if (input.buildCpusMax !== void 0 && !cpusAreValid(input.buildCpusMax)) return { refusal: `\u2717 --build-cpus-max ${input.buildCpusMax} is not a number of CPUs from 0.01 to 1024. Nothing is set up` };
+  return { limits: { memoryMaxBytes, cpus: input.buildCpusMax } };
 }
 async function installServiceCommand(input, deps = {}) {
+  if (input.print === true) return installServiceSteps(input, deps);
+  const ownership = deps.ownership ?? realOwnership();
+  const account = accountNamed(serviceAccount(input), ownership);
+  let result;
+  try {
+    result = await installServiceSteps(input, deps);
+  } finally {
+    const configDir = dirname(input.configPath);
+    const runner = runnerDir(input.configPath);
+    const problem = handOver(
+      account,
+      [{ path: join(configDir, CLAUDE_ENV_FILE) }, { path: join(configDir, "runner.env") }, { path: runner }, { path: dirname(vmAssetsDir(runner)) }, { path: vmAssetsDir(runner), tree: true }],
+      ownership
+    );
+    if (problem !== void 0 && result !== void 0) result = { ...result, ok: false, state: "refused", lines: [...result.lines, problem] };
+  }
+  return result;
+}
+function serviceAccount(input) {
+  return input.user ?? userInfo().username;
+}
+async function installServiceSteps(input, deps) {
+  const nameProblem = input.unitName === void 0 ? void 0 : unitNameProblem(input.unitName);
+  if (nameProblem !== void 0) return { ok: false, state: "refused", lines: [nameProblem] };
   const vm = runnerVmOf(input.configPath);
   if (vm !== void 0) {
     const result = await serviceInVm((deps.lima ?? realLima)(), vm.instance, "install", { home: input.home, extraArgs: vmArgs(input) });
@@ -500,13 +620,15 @@ async function installServiceCommand(input, deps = {}) {
       PATH: process.env.PATH,
       replace: input.replace,
       allowDowngrade: input.allowDowngrade,
-      command: "runner install --service"
+      command: "runner install --service",
+      account: serviceAccount(input),
+      ownership: deps.ownership
     });
     launcherLines = [launcherSummary(installed.launcher)].filter((line) => line !== void 0);
     launcherNotes = installed.launcher.notes;
     restartLine = restartNote(installed);
   }
-  const account = input.user ?? userInfo().username;
+  const account = serviceAccount(input);
   const serviceDeps = (deps.service ?? realServiceDeps)();
   if (input.print !== true && account !== userInfo().username && serviceDeps.accountCan !== void 0) {
     const entry = join(currentLink(input.configPath), "node_modules", "@outerlayer", "cli", "dist", "index.js");
@@ -515,8 +637,17 @@ async function installServiceCommand(input, deps = {}) {
   }
   const unitName = input.unitName ?? DEFAULT_UNIT_NAME;
   const usesVm = builtinKind(config.hooks.provision) === "vm";
-  const helper = input.print !== true && usesVm && serviceDeps.helper !== void 0 && serviceDeps.systemd.running() ? await installHelper({ configPath: input.configPath, unitName, user: account }, { ...serviceDeps, helper: serviceDeps.helper }) : void 0;
+  const slice = sliceOf(input, usesVm, deps.helperAssetsVersion ?? HOST_HELPER_ASSETS_VERSION);
+  if (slice.refusal !== void 0) return { ok: false, state: "refused", lines: [slice.refusal] };
+  if (slice.limits?.memoryMaxBytes !== void 0 && input.print !== true) {
+    const fit = checkFit({ concurrency: config.concurrency, buildMemory: config.build?.memory ?? "8g", usableBytes: 0, sliceBytes: slice.limits.memoryMaxBytes });
+    if (!fit.fits) return { ok: false, state: "refused", lines: [`${fit.message}. Nothing is set up: lower runner.concurrency or runner.build.memory, then run this again`] };
+  }
+  const helper = input.print !== true && usesVm && serviceDeps.helper !== void 0 && serviceDeps.systemd.running() ? await installHelper({ configPath: input.configPath, unitName, user: account, ...slice.limits === void 0 ? {} : { slice: slice.limits } }, { ...serviceDeps, helper: serviceDeps.helper }) : void 0;
   if (helper !== void 0 && !helper.ok) return { ok: false, state: "refused", lines: helper.lines };
+  if (slice.limits !== void 0 && input.print !== true && helper?.installed !== true) {
+    return { ok: false, state: "refused", lines: [...helper?.lines ?? [], "\u2717 --build-memory-max and --build-cpus-max need the root helper, and it is not installed, so the limits would not apply. Nothing else is set up"] };
+  }
   const outcome = installService(
     {
       configPath: input.configPath,
@@ -530,7 +661,10 @@ async function installServiceCommand(input, deps = {}) {
       print: input.print,
       replace: input.replace,
       restart: input.restart,
-      ...helper?.installed === true ? { helperSocket: helperSocketFor(unitName), helperUnit: helperUnitFor(unitName) } : {}
+      imageBuild: config.build?.imageBuild,
+      builderDiskPinned: builderDiskPinned(),
+      ...helper?.installed === true ? { helperSocket: helperSocketFor(unitName), helperUnit: helperUnitFor(unitName) } : {},
+      ...helper?.installed === true && slice.limits?.memoryMaxBytes !== void 0 ? { buildSliceMemoryBytes: slice.limits.memoryMaxBytes } : {}
     },
     serviceDeps
   );
@@ -538,6 +672,8 @@ async function installServiceCommand(input, deps = {}) {
   return { ok: outcome.ok, state: outcome.state, lines: [...helper?.lines ?? [], ...outcome.lines, ...outcome.ok ? [...restartLines, ...launcherLines] : []], unit: outcome.unit, ...launcherNotes.length > 0 ? { notes: launcherNotes } : {} };
 }
 async function uninstallServiceCommand(input, deps = {}) {
+  const nameProblem = input.unitName === void 0 ? void 0 : unitNameProblem(input.unitName);
+  if (nameProblem !== void 0) return { ok: false, state: "refused", lines: [nameProblem] };
   const vm = runnerVmOf(input.configPath);
   if (vm !== void 0) {
     const result = await serviceInVm((deps.lima ?? realLima)(), vm.instance, "uninstall", { home: input.home, extraArgs: input.unitName === void 0 ? [] : ["--unit-name", input.unitName] });
@@ -549,4 +685,4 @@ async function uninstallServiceCommand(input, deps = {}) {
   return { ok: outcome.ok, state: outcome.state, lines: [...outcome.lines, ...helper?.lines ?? []] };
 }
 
-export { installServiceCommand, uninstallServiceCommand };
+export { cpusAreValid, installServiceCommand, uninstallServiceCommand };

package/dist/{config-UN3X6AP2.js → config-QASNKYM6.js}

@@ -1,17 +1,15 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf } from './chunk-4XYC2663.js';
-import './chunk-UC2DKBMS.js';
-import './chunk-MPDLZCXM.js';
-import './chunk-3Z3MPR55.js';
-import './chunk-ES4ULBAL.js';
+export { DEFAULT_CHECK_TIME_LIMIT_MINUTES, DEFAULT_UPDATE_MAX_WAIT_HOURS, RunnerConfigError, builtinKind, checkHooks, defaultRunnerConfigPath, hasRunnerBlock, imageBuildOf, isBuiltinContainer, isBuiltinProcess, isBuiltinVm, keepsHostBuilder, loadRunnerConfig, resolveBuild, resolveHousekeeping, runnerCredentialProblem, runnerVmOf } from './chunk-2D6CKNR7.js';
+import './chunk-KM2HLQE3.js';
+import './chunk-5AFPP3GZ.js';
+import './chunk-4UPET3R7.js';
+import './chunk-MOI2KDLH.js';
 import './chunk-AJYZNISW.js';
-import './chunk-XLJLR7EK.js';
-import './chunk-N7LAEN3T.js';
-import './chunk-YOBQIXX6.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-HACGUL52.js';
+import './chunk-PXGU3GKY.js';
+import './chunk-G4W4B33M.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{connect-cmd-TWM4FEKD.js → connect-cmd-MEDWMW3L.js}

@@ -1,19 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-export { AGENTS_LAYOUT_COMMIT_LINE, COMMIT_LINE, autoConnectedLine, commitCommandsFor, commitLineFor, listText as factoryListText, slug as factorySlug, fetchFactories, hasUncommittedPolicy, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory } from './chunk-XA6PGME5.js';
-import './chunk-MECW77XP.js';
-import './chunk-AJYZNISW.js';
-import './chunk-NKOM4JKY.js';
+export { AGENTS_LAYOUT_COMMIT_LINE, COMMIT_LINE, autoConnectedLine, commitCommandsFor, commitLineFor, listText as factoryListText, slug as factorySlug, fetchFactories, hasUncommittedPolicy, promptOnTerminal, realConnectDeps, runConnect, runConnectCommand, saveFactoryConnection, selectFactory } from './chunk-FVCHHSHB.js';
 import './chunk-Y5YCX6AL.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-TVGLNHEB.js';
+import './chunk-MECW77XP.js';
+import './chunk-NKOM4JKY.js';
+import './chunk-3N77LUQI.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-XLJLR7EK.js';
-import './chunk-N7LAEN3T.js';
-import './chunk-YOBQIXX6.js';
+import './chunk-MOI2KDLH.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-ZQSANKS4.js';
+import './chunk-AJYZNISW.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
@@ -21,7 +19,8 @@ import './chunk-CRB3POP4.js';
 import './chunk-FGXT5OXS.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-HACGUL52.js';
+import './chunk-PXGU3GKY.js';
+import './chunk-G4W4B33M.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{container-start-JUNBJ7MU.js → container-start-2DHCWV73.js}

@@ -1,53 +1,49 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { reportFailedStart, BUILD_MEMORY_VARIABLE } from './chunk-ZV2JJPDS.js';
-import { readOwnContainer } from './chunk-Z76GVJGQ.js';
-import './chunk-RNVBSRZZ.js';
+import { reportFailedStart, BUILD_MEMORY_VARIABLE } from './chunk-O4Z2MNNL.js';
+import { readOwnContainer } from './chunk-RHV5SRI2.js';
+import './chunk-FD5ASWTG.js';
 import './chunk-ZVB57WI6.js';
-import './chunk-HAEDLXHA.js';
-import './chunk-75KZUBHD.js';
+import './chunk-63IVRRIO.js';
 import './chunk-I3LTIAOR.js';
-import './chunk-KDLQGTN6.js';
-import './chunk-WIK5KUGK.js';
-import './chunk-LMICI7AY.js';
+import './chunk-JBCOUY4M.js';
+import './chunk-QANM5COC.js';
+import './chunk-EGVHFHY4.js';
 import './chunk-ESVW4MJY.js';
+import './chunk-SI6WDF3U.js';
 import './chunk-TBT347UY.js';
-import { detectMachine, supportsContainerBuilds, MIN_ENGINE_MAJOR, describeMachineDocker, RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-POGPX7LI.js';
+import { detectMachine, supportsContainerBuilds, MIN_ENGINE_MAJOR, describeMachineDocker, RunnerInitError, prepareRunnerInit, writeRunnerInit } from './chunk-JQSZTQSK.js';
 import './chunk-2PGI6RDE.js';
-import { isAgentName, AGENT_COMMANDS } from './chunk-EZ7L5IZU.js';
-import './chunk-3NFZN7H6.js';
-import './chunk-ENFBYN4A.js';
-import './chunk-JBJTC3UU.js';
+import './chunk-UO4FQAOX.js';
 import './chunk-OGFGZQA3.js';
-import './chunk-IHY457PB.js';
-import './chunk-2RBIW2PD.js';
-import './chunk-AVLLJW5D.js';
-import { runnerImageVersion, IMAGE_VERSION_VARIABLE } from './chunk-36T6W5RA.js';
+import './chunk-2ILU7UAU.js';
+import './chunk-OGPEHSNW.js';
+import './chunk-RFVIQLNB.js';
+import { runnerImageVersion, IMAGE_VERSION_VARIABLE } from './chunk-SYVRBBLW.js';
 import './chunk-TQMI335S.js';
-import './chunk-AABYHGVO.js';
-import './chunk-4XYC2663.js';
-import './chunk-UC2DKBMS.js';
-import { parseSize } from './chunk-MPDLZCXM.js';
-import './chunk-3Z3MPR55.js';
-import './chunk-ES4ULBAL.js';
-import './chunk-IW6Z337K.js';
+import { isAgentName, AGENT_COMMANDS } from './chunk-OQLF3MQQ.js';
+import './chunk-INOUUSYI.js';
+import './chunk-2D6CKNR7.js';
+import './chunk-KM2HLQE3.js';
+import { parseSize } from './chunk-5AFPP3GZ.js';
+import './chunk-4UPET3R7.js';
+import './chunk-YNMVVQOQ.js';
+import './chunk-JBJTC3UU.js';
+import './chunk-UN3SQTVL.js';
 import './chunk-IP7BIBXJ.js';
-import './chunk-3M6UYJSR.js';
-import './chunk-XA6PGME5.js';
-import './chunk-MECW77XP.js';
-import './chunk-AJYZNISW.js';
-import './chunk-NKOM4JKY.js';
+import './chunk-AVPLEFQR.js';
+import './chunk-FVCHHSHB.js';
 import './chunk-Y5YCX6AL.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import './chunk-QOUR4CQ7.js';
+import './chunk-MECW77XP.js';
+import './chunk-NKOM4JKY.js';
+import './chunk-CAQCDYKF.js';
 import './chunk-JWNH4ZTF.js';
-import './chunk-TVGLNHEB.js';
+import './chunk-3N77LUQI.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-XLJLR7EK.js';
-import './chunk-N7LAEN3T.js';
-import { readClaudeCredential, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES } from './chunk-YOBQIXX6.js';
-import './chunk-CXQCBAKO.js';
+import './chunk-MOI2KDLH.js';
+import './chunk-25GRRBTH.js';
 import './chunk-ZJSNLVCE.js';
 import './chunk-2O5KA67H.js';
 import './chunk-BKO6JEZI.js';
@@ -55,6 +51,7 @@ import './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-ZQSANKS4.js';
+import './chunk-AJYZNISW.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
@@ -67,7 +64,8 @@ import './chunk-TUSYOL2O.js';
 import './chunk-FGXT5OXS.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-HACGUL52.js';
+import './chunk-PXGU3GKY.js';
+import { readClaudeCredential, FORWARDED_CLAUDE_CREDENTIAL_VARIABLES } from './chunk-G4W4B33M.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 import { existsSync, readFileSync, writeFileSync } from 'fs';

package/dist/{context-show-cmd-K5LRMDEO.js → context-show-cmd-VSFCG663.js}

@@ -1,20 +1,18 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { autoConnect } from './chunk-3M6UYJSR.js';
-import './chunk-XA6PGME5.js';
-import './chunk-MECW77XP.js';
-import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
-import './chunk-NKOM4JKY.js';
+import { autoConnect } from './chunk-AVPLEFQR.js';
+import './chunk-FVCHHSHB.js';
 import './chunk-Y5YCX6AL.js';
 import './chunk-G2JWZDFA.js';
 import './chunk-ANPNT6PM.js';
-import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-TVGLNHEB.js';
+import './chunk-MECW77XP.js';
+import './chunk-NKOM4JKY.js';
+import { resolveGatewayCredentials, defaultFetch, unauthorizedMessage } from './chunk-3N77LUQI.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-XLJLR7EK.js';
-import './chunk-N7LAEN3T.js';
-import './chunk-YOBQIXX6.js';
+import './chunk-MOI2KDLH.js';
 import './chunk-BJ3KTMDH.js';
 import './chunk-ZQSANKS4.js';
+import { resolveRepoIdentity } from './chunk-AJYZNISW.js';
 import './chunk-5BHIBJDA.js';
 import './chunk-CDDED64E.js';
 import './chunk-RA3O54FC.js';
@@ -22,7 +20,8 @@ import { cliInvocation } from './chunk-CRB3POP4.js';
 import './chunk-FGXT5OXS.js';
 import './chunk-EOTMDIYC.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
-import './chunk-HACGUL52.js';
+import './chunk-PXGU3GKY.js';
+import './chunk-G4W4B33M.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 

package/dist/{control-plane-launch-LHOV2FPA.js → control-plane-launch-XBGHM7DB.js}

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { parseOwnerRepo, lookupGoverningSource, defaultGitRunner, materializeContext } from './chunk-QOUR4CQ7.js';
+import { parseOwnerRepo, lookupGoverningSource, defaultGitRunner, materializeContext } from './chunk-CAQCDYKF.js';
 import './chunk-JWNH4ZTF.js';
-import { resolveGatewayCredentials, defaultFetch } from './chunk-TVGLNHEB.js';
+import { resolveGatewayCredentials, defaultFetch } from './chunk-3N77LUQI.js';
 import './chunk-PJDQPF5N.js';
-import './chunk-XLJLR7EK.js';
-import './chunk-N7LAEN3T.js';
-import './chunk-YOBQIXX6.js';
+import './chunk-MOI2KDLH.js';
 import './chunk-ZJSNLVCE.js';
 import { layoutRefusalMessage, unsupportedLayout, sharedSkillNames, skillConflictMessage, composeDelivery } from './chunk-FGF52V4V.js';
 import './chunk-HCVLP7XA.js';
@@ -22,7 +20,8 @@ import './chunk-TUSYOL2O.js';
 import './chunk-FGXT5OXS.js';
 import './chunk-EOTMDIYC.js';
 import './chunk-VNVZDWO3.js';
-import './chunk-HACGUL52.js';
+import './chunk-PXGU3GKY.js';
+import './chunk-G4W4B33M.js';
 import './chunk-MESOOLF4.js';
 import './chunk-Z5GEFMRW.js';
 import { execFileSync } from 'child_process';