@outerlayer/cli 0.8.0 → 0.8.1

package/dist/{chunk-5QLNZGAQ.js → chunk-KV47VQJZ.js}

@@ -5,9 +5,9 @@ import { detectActiveSession } from './chunk-BFESLKPP.js';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
 import { resolveRepoIdentity } from './chunk-GAYWY4GI.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { resolveGatewayCredentials, unauthorizedMessage } from './chunk-BOLTI6LR.js';
-import { signRunnerRequest } from './chunk-M5POMKKW.js';
+import { signRunnerRequest } from './chunk-V7NIVOFD.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);
@@ -347,7 +347,7 @@ async function runWorkLinkSession(opts) {
     return await linkSession(opts);
   } catch (err) {
     if (opts.logFailures) {
-      const { logHookError } = await import('./hook-fast-XBOZ3N6L.js');
+      const { logHookError } = await import('./hook-fast-5H5QBJKT.js');
       const reason = err instanceof Error ? err.message : String(err);
       logHookError(opts.home ?? homeFromEnv(opts.env ?? process.env), new Error(`work link-session #${opts.number} failed: ${reason}`));
     }

package/dist/{chunk-CM5QTKM4.js → chunk-M4ERCYDB.js}

@@ -3,24 +3,25 @@ import { createRequire } from 'node:module';
 import { readDefaultBranchHead, cloneRepository, buildRepositoryImage } from './chunk-TTNFGMHO.js';
 import { startTimeOf, isSameProcess } from './chunk-N5FOE5PS.js';
 import { currentCliBuild } from './chunk-OGFGZQA3.js';
-import { createDockerHost, childEnvironment, spawnRun } from './chunk-U3GOI2B4.js';
+import { createDockerHost, childEnvironment, spawnRun } from './chunk-TEKZRTM3.js';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-5TNS3PL7.js';
+import { builderSpec, runnerLabelValue, RUNNER_LABEL, BUILD_LABEL, prepareRunArgs, containerRunArgs, containerExecArgs } from './chunk-2BRSMBBB.js';
 import { CLAUDE_CODE_VERSION, firecrackerArch, MICROVM_ARCHES, DEFAULT_BASE_IMAGE, GUEST_HELPER_SHA256, GUEST_ASSETS_BASE_URL, GUEST_KERNEL_SHA256, FIRECRACKER_BINARY_SHA256, FIRECRACKER_SHA256, FIRECRACKER_VERSION, GUEST_ASSETS_VERSION } from './chunk-CX22S5BA.js';
 import { execCapture } from './chunk-ZOAEPWGL.js';
 import { GUEST_CID } from './chunk-R7STSBLC.js';
-import { WorkCommandError, postJson } from './chunk-5QLNZGAQ.js';
+import { WorkCommandError, postJson } from './chunk-KV47VQJZ.js';
 import { hostAllowed } from './chunk-UXYLWVTQ.js';
 import { parseDuKilobytes } from './chunk-7RQ73DLO.js';
 import { RELAY_PORT, CHECKOUT_DIR, JOB_MOUNT, claudeCredential, buildEnvironment, startBuildServices, checkEnvironment, AGENT_CREDENTIAL_MISSING } from './chunk-OD2VTIHN.js';
-import { defaultGitRunner, materializeContext } from './chunk-5FWNEQNZ.js';
+import { defaultGitRunner, materializeContext } from './chunk-BQFNZOMQ.js';
 import { readContextManifest, readSourceCache } from './chunk-ZZXLM64C.js';
-import { signingFetchFor } from './chunk-BCLJSQCV.js';
-import { signerFor } from './chunk-M5POMKKW.js';
+import { signingFetchFor } from './chunk-YO4PSLVB.js';
+import { signerFor } from './chunk-V7NIVOFD.js';
 import { rootfsPathFor, diskTemplatesDir, RUNNER_FILE_MODE, stagedContextDir, contextHomeDir, ghConfigDir, runnerDirOfBuild, spoolDir, mirrorDir, buildDir, RUNNER_DIR_MODE, vmAssetsDir } from './chunk-ZM2IMMYN.js';
 import { relative, join, dirname, basename } from 'path';
 import { readFileSync, existsSync, mkdirSync, chmodSync, truncateSync, rmSync, writeFileSync, accessSync, constants, readdirSync, statSync, rmdirSync, renameSync, lstatSync, unlinkSync, openSync, closeSync, mkdtempSync, createWriteStream, createReadStream } from 'fs';
 import { spawnSync, spawn } from 'child_process';
+import { availableParallelism, networkInterfaces } from 'os';
 import { randomBytes, createHash } from 'crypto';
 import { createServer, request } from 'http';
 import { request as request$1 } from 'https';
@@ -29,7 +30,6 @@ import { pipeline, finished } from 'stream/promises';
 import { createGunzip, gunzipSync, constants as constants$1 } from 'zlib';
 import { isIP, connect, createServer as createServer$1 } from 'net';
 import { lookup } from 'dns/promises';
-import { networkInterfaces } from 'os';
 
 createRequire(import.meta.url);
 function logStamp(at) {
@@ -469,6 +469,63 @@ function lifecycleSteps(lifecycle) {
 function lifecycleFailureReason(step, exitCode) {
   return `lifecycle command ${step.name} (${step.source}) exited ${exitCode}`;
 }
+function parseCpuList(text) {
+  const cores = /* @__PURE__ */ new Set();
+  for (const part of text.trim().split(",")) {
+    const match = /^(\d+)(?:-(\d+))?$/.exec(part.trim());
+    if (match === null) return void 0;
+    const low = Number(match[1]);
+    const high = match[2] === void 0 ? low : Number(match[2]);
+    if (high < low) return void 0;
+    for (let core = low; core <= high; core++) cores.add(core);
+  }
+  return [...cores].sort((a, b) => a - b);
+}
+function formatCpuList(cores) {
+  const sorted = [...new Set(cores)].sort((a, b) => a - b);
+  const parts = [];
+  for (let i = 0; i < sorted.length; i++) {
+    const start = sorted[i];
+    while (sorted[i + 1] === sorted[i] + 1) i++;
+    parts.push(start === sorted[i] ? String(start) : `${start}-${sorted[i]}`);
+  }
+  return parts.join(",");
+}
+function usableCpus(deps = {}) {
+  try {
+    const status = (deps.readStatus ?? (() => readFileSync("/proc/self/status", "utf8")))();
+    const cores = parseCpuList(/^Cpus_allowed_list:\s*(.+)$/m.exec(status)?.[1] ?? "");
+    if (cores !== void 0) return cores;
+  } catch {
+  }
+  return Array.from({ length: Math.max(1, (deps.parallelism ?? availableParallelism)()) }, (_unused, core) => core);
+}
+function createCpuAllocator(cores) {
+  const usable = [...new Set(cores)].sort((a, b) => a - b);
+  const held = /* @__PURE__ */ new Map();
+  const holders = (core) => {
+    let count = 0;
+    for (const set of held.values()) if (set.includes(core)) count++;
+    return count;
+  };
+  return {
+    acquire(buildId, cpus) {
+      const existing = held.get(buildId);
+      if (existing !== void 0) return existing;
+      const wanted = Math.min(Math.ceil(cpus), usable.length);
+      const ranked = usable.map((core) => ({ core, count: holders(core) })).sort((a, b) => a.count - b.count);
+      const chosen = ranked.slice(0, wanted).map(({ core }) => core).sort((a, b) => a - b);
+      held.set(buildId, chosen);
+      return chosen;
+    },
+    hold(buildId, set) {
+      held.set(buildId, [...set]);
+    },
+    release(buildId) {
+      held.delete(buildId);
+    }
+  };
+}
 var AssetError = class extends Error {
   constructor(file, message) {
     super(message);
@@ -583,7 +640,7 @@ function templateScript() {
   ].join("\n");
 }
 var ids = () => ({ uid: String(process.getuid?.() ?? 0), gid: String(process.getgid?.() ?? 0) });
-function converterArgs(dest, extra, script) {
+function converterArgs(dest, memoryBytes, extra, script) {
   const { uid, gid } = ids();
   return [
     "run",
@@ -591,6 +648,10 @@ function converterArgs(dest, extra, script) {
     "-i",
     "--network",
     "none",
+    "--memory",
+    String(memoryBytes),
+    "--memory-swap",
+    String(memoryBytes),
     "--mount",
     `type=bind,src=${dirname(dest)},dst=/out`,
     "-e",
@@ -636,18 +697,18 @@ function exportInto(container, converter) {
 function createRootfsHost() {
   const env = () => childEnvironment(process.env);
   return {
-    async convert({ imageId, dest }) {
+    async convert({ imageId, dest, memoryBytes }) {
       const created = await spawnRun("docker", ["create", imageId, "none"], { env: env() });
       if (created.status !== 0) throw new Error(`docker create ${imageId} failed: ${firstLine2(created.stderr)}`);
       const container = created.stdout.trim();
       try {
-        await exportInto(container, converterArgs(dest, [], converterScript()));
+        await exportInto(container, converterArgs(dest, memoryBytes, [], converterScript()));
       } finally {
         await spawnRun("docker", ["rm", "--force", "--volumes", container], { env: env() });
       }
     },
-    async makeTemplate({ bytes, dest }) {
-      const made = await spawnRun("docker", converterArgs(dest, ["-e", `BYTES=${bytes}`], templateScript()), { env: env() });
+    async makeTemplate({ bytes, dest, memoryBytes }) {
+      const made = await spawnRun("docker", converterArgs(dest, memoryBytes, ["-e", `BYTES=${bytes}`], templateScript()), { env: env() });
       if (made.status !== 0) throw new Error(`making the empty build disk failed: ${firstLine2(made.stderr)}`);
     },
     async imageConfig(imageId) {
@@ -696,14 +757,14 @@ async function ensureRootfs(input) {
   const path = rootfsPathFor(input.runnerDir, input.imageId);
   if (existsSync(path)) return path;
   const { uid, gid } = ids();
-  await madeAtomically(path, (temp) => input.host.convert({ imageId: input.imageId, dest: temp, uid: Number(uid), gid: Number(gid) }));
+  await madeAtomically(path, (temp) => input.host.convert({ imageId: input.imageId, dest: temp, uid: Number(uid), gid: Number(gid), memoryBytes: input.memoryBytes }));
   return path;
 }
 async function createBuildDisk(input) {
   const template = join(diskTemplatesDir(input.runnerDir), `${input.bytes}.ext4`);
   if (!existsSync(template)) {
     const { uid, gid } = ids();
-    await madeAtomically(template, (temp) => input.host.makeTemplate({ bytes: input.bytes, dest: temp, uid: Number(uid), gid: Number(gid) }));
+    await madeAtomically(template, (temp) => input.host.makeTemplate({ bytes: input.bytes, dest: temp, uid: Number(uid), gid: Number(gid), memoryBytes: input.memoryBytes }));
   }
   mkdirSync(dirname(input.dest), { recursive: true });
   if (input.host.copyTemplate) input.host.copyTemplate(template, input.dest);
@@ -1880,6 +1941,7 @@ function createContainerRuntime(opts = {}) {
   const { cli, remoteFor } = opts;
   return {
     host: opts.host ?? createContainerHost(),
+    cpus: opts.cpus ?? createCpuAllocator(usableCpus()),
     tunnels: opts.tunnels ?? /* @__PURE__ */ new Map(),
     buildImage: opts.buildImage ?? ((build) => buildRepositoryImage(
       {
@@ -2027,7 +2089,8 @@ async function provisionContainer(input) {
     imageId: report.imageId,
     containerEnv: report.apply.containerEnv,
     builtIns: true,
-    lifecycle: report.apply.lifecycle
+    lifecycle: report.apply.lifecycle,
+    cpuset: formatCpuList(runtime.cpus.acquire(buildId, config.build?.cpus ?? 4))
   };
   const env = buildEnvironment({
     config,
@@ -2079,7 +2142,7 @@ async function provisionContainer(input) {
   } catch (err) {
     return bail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
-  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096 };
+  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096, cpuset: state.cpuset };
   const runnerId = runnerLabelValue(config.configPath);
   const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the build's volume", volume);
@@ -2310,6 +2373,7 @@ async function cleanupContainer(runtime, state, jobDir) {
     await tunnel.close();
   }
   rmSync(state.buildDir, { recursive: true, force: true });
+  runtime.cpus.release(state.buildId);
   if (failures.length > 0) throw new Error(failures.join("; "));
 }
 async function startCheckContainer(input) {
@@ -2325,7 +2389,8 @@ async function startCheckContainer(input) {
   const name = `outerlayer-check-${buildId}`;
   const buildDir2 = buildDir(config.configPath, buildId);
   const agentUser = built.agentUser ?? ADDED_USER;
-  const state = { buildId, container: name, volume: name, buildDir: buildDir2, repository, imageId: built.imageId, agentUser };
+  const cpuset = built.cpuset ?? formatCpuList(runtime.cpus.acquire(buildId, config.build?.cpus ?? 4));
+  const state = { buildId, container: name, volume: name, buildDir: buildDir2, repository, imageId: built.imageId, agentUser, cpuset };
   const checksDir = join(jobDir, "checks");
   mkdirSync(checksDir, { recursive: true });
   const logPath = join(checksDir, "environment.log");
@@ -2347,7 +2412,7 @@ async function startCheckContainer(input) {
   } catch (err) {
     return fail(`the tunnel could not start: ${describeCallFailure(err)}`);
   }
-  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096 };
+  const limits2 = { memory: config.build?.memory ?? "8g", cpus: config.build?.cpus ?? 4, pids: config.build?.pids ?? 4096, cpuset };
   const runnerId = runnerLabelValue(config.configPath);
   const volume = await host.createVolume(name, { [BUILD_LABEL]: buildId, [RUNNER_LABEL]: runnerId });
   if (volume.status !== 0) return dockerFailed("creating the check environment's volume", volume);
@@ -2383,4 +2448,4 @@ async function startCheckContainer(input) {
   };
 }
 
-export { ADDED_USER, AgentUserError, AssetError, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer };
+export { ADDED_USER, AgentUserError, AssetError, BuildTokens, GH_CONFIG_YML, MIN_ENGINE_MAJOR, classifyRefusal, cleanupContainer, containerCommandLine, containerSenderCommand, createBuildDisk, createContainerRuntime, createRunnerLog, deleteBuildDisk, describeCallFailure, ensureRootfs, ensureTunnel, formatClock, formatDuration, ghHostsYml, gitRemoteFor, isLiteralAddress, keepGhConfigCurrent, lifecycleFailureReason, lifecycleSteps, machineConfig, measureDisk, obtainImage, outOfMemoryReason, parseCpuList, prepareBranch, provisionContainer, refusalCode, relativeToRunner, removeStagedContext, resolveAgentUser, retrySend, runBuildSteps, senderSignalScript, setUpRunnerCgroup, shellQuote, shortClaim, signalInContainer, stageGovernedContext, startCheckContainer, startServicesFor, stopContainer, syncInContainer };

package/dist/{chunk-K35RW5HP.js → chunk-PXFEYBDE.js}

@@ -4,7 +4,7 @@ import { autoConnect } from './chunk-4ACZCY4I.js';
 import { detectActiveSession } from './chunk-BFESLKPP.js';
 import { resolveRepoIdentity } from './chunk-GAYWY4GI.js';
 import { parseTrackerNumber, trackerNumberError } from './chunk-WZBHBH3J.js';
-import { defaultFetch } from './chunk-BCLJSQCV.js';
+import { defaultFetch } from './chunk-YO4PSLVB.js';
 import { unauthorizedMessage, resolveGatewayCredentials } from './chunk-BOLTI6LR.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 

package/dist/{chunk-IRCBTGWF.js → chunk-Q4432IZT.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { isPlaceholderCommand } from './chunk-NALVDFIS.js';
-import { describeCallFailure } from './chunk-CM5QTKM4.js';
-import { WorkCommandError, getJson } from './chunk-5QLNZGAQ.js';
+import { isPlaceholderCommand } from './chunk-Z2THOHPP.js';
+import { describeCallFailure } from './chunk-M4ERCYDB.js';
+import { WorkCommandError, getJson } from './chunk-KV47VQJZ.js';
 import { sanitizeTerminal } from './chunk-ZYHKJKSU.js';
 import { builtinKind } from './chunk-PWBILI5P.js';
 import { CLAUDE_CREDENTIAL_VARIABLES, claudeCredential } from './chunk-OD2VTIHN.js';
-import { signerFor } from './chunk-M5POMKKW.js';
+import { signerFor } from './chunk-V7NIVOFD.js';
 
 createRequire(import.meta.url);
 

package/dist/{chunk-7VNURP6M.js → chunk-QB5JQH5V.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { writeJobFile, readJobFile } from './chunk-T6OIJQRT.js';
-import { senderPidfile } from './chunk-3S4P55NE.js';
+import { senderPidfile } from './chunk-4FPWKV7L.js';
 import { DOCKERD_LOG } from './chunk-WVGSB3Z2.js';
-import { installScrubContext } from './chunk-AIL2R4SI.js';
-import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, senderSignalScript } from './chunk-CM5QTKM4.js';
+import { installScrubContext } from './chunk-BF4KKEFY.js';
+import { AssetError, describeCallFailure, obtainImage, ensureRootfs, gitRemoteFor, startServicesFor, createBuildDisk, machineConfig, refusalCode, resolveAgentUser, AgentUserError, runBuildSteps, removeStagedContext, stageGovernedContext, shellQuote, createRunnerLog, createContainerRuntime, stopContainer, cleanupContainer, outOfMemoryReason, formatDuration, retrySend, formatClock, containerSenderCommand, syncInContainer, GH_CONFIG_YML, ghHostsYml, ADDED_USER, isLiteralAddress, signalInContainer, deleteBuildDisk, startCheckContainer, lifecycleSteps, lifecycleFailureReason, senderSignalScript } from './chunk-M4ERCYDB.js';
 import { readBranchHead, fetchCommit } from './chunk-TTNFGMHO.js';
 import { isSameProcess, startTimeOf } from './chunk-N5FOE5PS.js';
-import { childEnvironment } from './chunk-U3GOI2B4.js';
+import { childEnvironment } from './chunk-TEKZRTM3.js';
 import { CLAUDE_CODE_VERSION } from './chunk-CX22S5BA.js';
 import { waitForAgent, vmExecArgs } from './chunk-ZOAEPWGL.js';
 import { socketPathProblem, vsockLinks, linkVsockSockets } from './chunk-R7STSBLC.js';
-import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-5QLNZGAQ.js';
+import { WorkCommandError, postJson, isSignatureRefusal, getJson } from './chunk-KV47VQJZ.js';
 import { planArtifactUpload } from './chunk-ZYHKJKSU.js';
 import { scrubText } from './chunk-GAYWY4GI.js';
 import { isBuiltinContainer, isBuiltinProcess, isBuiltinVm, DEFAULT_CHECK_TIME_LIMIT_MINUTES } from './chunk-PWBILI5P.js';
@@ -21,7 +21,7 @@ import { withHooksPath, authorEnvironment, commitIdentityRecord } from './chunk-
 import { parsePolicy } from './chunk-7ZR5UPMB.js';
 import { readCloudConfig } from './chunk-EABW6AJQ.js';
 import { resolveVersion } from './chunk-RA3O54FC.js';
-import { signerFor } from './chunk-M5POMKKW.js';
+import { signerFor } from './chunk-V7NIVOFD.js';
 import { runnerDir, buildDir, vsockPath, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 import { spawn, spawnSync } from 'child_process';
@@ -43,6 +43,9 @@ var DOCKER_LOG_LINES = 20;
 var GUEST_GH_DIR = `${JOB_MOUNT}/gh`;
 var GUEST_HOOKS_DIR = `${JOB_MOUNT}/git-hooks`;
 var GUEST_CONTEXT_DIR = `${JOB_MOUNT}/context`;
+function buildMemoryBytes(config) {
+  return parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY);
+}
 function firstLine(text2) {
   return text2.trim().split("\n")[0] ?? "";
 }
@@ -166,7 +169,7 @@ async function provisionMicroVm(input) {
   if (input.aborted()) return bail("", true);
   let imageConfig;
   try {
-    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: report.imageId });
+    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: report.imageId, memoryBytes: buildMemoryBytes(config) });
     imageConfig = await vm.rootfs.imageConfig(report.imageId);
   } catch (err) {
     return bail(`the image could not be converted to a root disk: ${describeCallFailure(err)}`);
@@ -186,14 +189,14 @@ async function provisionMicroVm(input) {
   }
   const limits = {
     cpus: config.build?.cpus ?? DEFAULT_CPUS,
-    memoryBytes: parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY),
+    memoryBytes: buildMemoryBytes(config),
     diskBytes: parseSize(config.build?.disk ?? DEFAULT_DISK) ?? parseSize(DEFAULT_DISK)
   };
   const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: true });
   const configPath = join(buildDir2, "vm.json");
   try {
     linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
-    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk });
+    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk, memoryBytes: limits.memoryBytes });
     writeFileSync(
       configPath,
       JSON.stringify(
@@ -455,7 +458,7 @@ async function startCheckMicroVm(input) {
   }
   if (abandoned()) return fail(ABANDONED);
   try {
-    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: built.imageId });
+    state.rootfs = await ensureRootfs({ host: vm.rootfs, runnerDir: runnerDirPath, imageId: built.imageId, memoryBytes: buildMemoryBytes(config) });
   } catch (err) {
     return fail(`the image could not be converted to a root disk: ${describeCallFailure(err)}`);
   }
@@ -473,14 +476,14 @@ async function startCheckMicroVm(input) {
   if (abandoned()) return fail(ABANDONED);
   const limits = {
     cpus: config.build?.cpus ?? DEFAULT_CPUS,
-    memoryBytes: parseSize(config.build?.memory ?? DEFAULT_MEMORY) ?? parseSize(DEFAULT_MEMORY),
+    memoryBytes: buildMemoryBytes(config),
     diskBytes: parseSize(config.build?.disk ?? DEFAULT_DISK) ?? parseSize(DEFAULT_DISK)
   };
   const links = vsockLinks({ destinations: config.build?.destinations?.length ?? 0, builtIns: false });
   const configPath = join(buildDir2, "vm.json");
   try {
     linkVsockSockets({ buildDir: buildDir2, vsockPath: state.vsockPath, links });
-    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk });
+    await createBuildDisk({ host: vm.rootfs, runnerDir: runnerDirPath, bytes: limits.diskBytes, dest: state.buildDisk, memoryBytes: limits.memoryBytes });
     writeFileSync(
       configPath,
       JSON.stringify(

package/dist/{chunk-TUUMW4TC.js → chunk-QNRSFEGY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { MIN_ENGINE_MAJOR } from './chunk-CM5QTKM4.js';
+import { MIN_ENGINE_MAJOR } from './chunk-M4ERCYDB.js';
 import { firecrackerArch, MICROVM_ARCHES, guestAssetsPinned } from './chunk-CX22S5BA.js';
 import { spawnSync } from 'child_process';
 import { existsSync, accessSync, constants, statSync, readFileSync } from 'fs';

package/dist/{chunk-U3GOI2B4.js → chunk-TEKZRTM3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { RecipeError } from './chunk-QOZKPLVJ.js';
-import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-5TNS3PL7.js';
+import { trackImageBuild, isOutOfMemory, ensureBuilder } from './chunk-2BRSMBBB.js';
 import { spawn } from 'child_process';
 import { existsSync, mkdirSync, createWriteStream, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';

package/dist/{chunk-M5POMKKW.js → chunk-V7NIVOFD.js}

@@ -6,7 +6,7 @@ import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
 
 createRequire(import.meta.url);
 
-// ../../node_modules/structured-headers/dist/util.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/util.js
 var asciiRe = /^[\x20-\x7E]*$/;
 var tokenRe = /^[a-zA-Z*][:/!#$%&'*+\-.^_`|~A-Za-z0-9]*$/;
 var keyRe = /^[a-z*][*\-_.a-z0-9]*$/;
@@ -40,7 +40,7 @@ function base64ToArrayBuffer(b64) {
   return bytes.buffer;
 }
 
-// ../../node_modules/structured-headers/dist/token.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/token.js
 var Token = class {
   constructor(value) {
     if (!isValidTokenStr(value)) {
@@ -53,7 +53,7 @@ var Token = class {
   }
 };
 
-// ../../node_modules/structured-headers/dist/displaystring.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/displaystring.js
 var DisplayString = class {
   constructor(value) {
     this.value = value;
@@ -63,7 +63,7 @@ var DisplayString = class {
   }
 };
 
-// ../../node_modules/structured-headers/dist/serializer.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/serializer.js
 var SerializeError = class extends Error {
 };
 function serializeDictionary(input) {
@@ -186,7 +186,7 @@ function serializeKey(input) {
   return input;
 }
 
-// ../../node_modules/structured-headers/dist/parser.js
+// ../../node_modules/http-message-sig/node_modules/structured-headers/dist/parser.js
 function parseDictionary(input) {
   const parser = new Parser(input);
   return parser.parseDictionary();

package/dist/{chunk-BCLJSQCV.js → chunk-YO4PSLVB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
 import { readCloudConfig, cloudConfigPath } from './chunk-EABW6AJQ.js';
-import { signRunnerRequest, signerFor } from './chunk-M5POMKKW.js';
+import { signRunnerRequest, signerFor } from './chunk-V7NIVOFD.js';
 import { homeFromEnv } from './chunk-VNVZDWO3.js';
 
 createRequire(import.meta.url);

package/dist/{chunk-NALVDFIS.js → chunk-Z2THOHPP.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-TUUMW4TC.js';
-import { MIN_ENGINE_MAJOR } from './chunk-CM5QTKM4.js';
+import { detectMachine, supportsContainerBuilds, reachDockerStep, describeMachineDocker, supportsMicroVmBuilds } from './chunk-QNRSFEGY.js';
+import { MIN_ENGINE_MAJOR } from './chunk-M4ERCYDB.js';
 import { RUNNER_DIR_MODE, runnerDir, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync } from 'fs';
 import { dirname } from 'path';