@rallycry/conveyor-k3 0.1.12 → 0.1.13

package/dist/index.js

@@ -101,7 +101,7 @@ function createClusterProof(apiUrl, clusterToken, key) {
   const origin = new URL(apiUrl).origin;
   const timestamp = Date.now();
   const nonce = randomBytes(32).toString("base64url");
-  const message = `conveyor-device-v1
+  const message2 = `conveyor-device-v1
 ${origin}
 ${clusterToken}
 ${timestamp}
@@ -109,7 +109,7 @@ ${nonce}`;
   return {
     timestamp,
     nonce,
-    signature: sign(null, Buffer.from(message, "utf8"), key).toString("base64url")
+    signature: sign(null, Buffer.from(message2, "utf8"), key).toString("base64url")
   };
 }
 function deviceClusterAuth(apiUrl, clusterToken, keyPath = DEVICE_KEY_PATH, ownerUid = 0) {
@@ -487,104 +487,104 @@ ZodError.create = (issues) => {
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
-  let message;
+  let message2;
   switch (issue.code) {
     case ZodIssueCode.invalid_type:
       if (issue.received === ZodParsedType.undefined) {
-        message = "Required";
+        message2 = "Required";
       } else {
-        message = `Expected ${issue.expected}, received ${issue.received}`;
+        message2 = `Expected ${issue.expected}, received ${issue.received}`;
       }
       break;
     case ZodIssueCode.invalid_literal:
-      message = `Invalid literal value, expected ${JSON.stringify(issue.expected, util.jsonStringifyReplacer)}`;
+      message2 = `Invalid literal value, expected ${JSON.stringify(issue.expected, util.jsonStringifyReplacer)}`;
       break;
     case ZodIssueCode.unrecognized_keys:
-      message = `Unrecognized key(s) in object: ${util.joinValues(issue.keys, ", ")}`;
+      message2 = `Unrecognized key(s) in object: ${util.joinValues(issue.keys, ", ")}`;
       break;
     case ZodIssueCode.invalid_union:
-      message = `Invalid input`;
+      message2 = `Invalid input`;
       break;
     case ZodIssueCode.invalid_union_discriminator:
-      message = `Invalid discriminator value. Expected ${util.joinValues(issue.options)}`;
+      message2 = `Invalid discriminator value. Expected ${util.joinValues(issue.options)}`;
       break;
     case ZodIssueCode.invalid_enum_value:
-      message = `Invalid enum value. Expected ${util.joinValues(issue.options)}, received '${issue.received}'`;
+      message2 = `Invalid enum value. Expected ${util.joinValues(issue.options)}, received '${issue.received}'`;
       break;
     case ZodIssueCode.invalid_arguments:
-      message = `Invalid function arguments`;
+      message2 = `Invalid function arguments`;
       break;
     case ZodIssueCode.invalid_return_type:
-      message = `Invalid function return type`;
+      message2 = `Invalid function return type`;
       break;
     case ZodIssueCode.invalid_date:
-      message = `Invalid date`;
+      message2 = `Invalid date`;
       break;
     case ZodIssueCode.invalid_string:
       if (typeof issue.validation === "object") {
         if ("includes" in issue.validation) {
-          message = `Invalid input: must include "${issue.validation.includes}"`;
+          message2 = `Invalid input: must include "${issue.validation.includes}"`;
           if (typeof issue.validation.position === "number") {
-            message = `${message} at one or more positions greater than or equal to ${issue.validation.position}`;
+            message2 = `${message2} at one or more positions greater than or equal to ${issue.validation.position}`;
           }
         } else if ("startsWith" in issue.validation) {
-          message = `Invalid input: must start with "${issue.validation.startsWith}"`;
+          message2 = `Invalid input: must start with "${issue.validation.startsWith}"`;
         } else if ("endsWith" in issue.validation) {
-          message = `Invalid input: must end with "${issue.validation.endsWith}"`;
+          message2 = `Invalid input: must end with "${issue.validation.endsWith}"`;
         } else {
           util.assertNever(issue.validation);
         }
       } else if (issue.validation !== "regex") {
-        message = `Invalid ${issue.validation}`;
+        message2 = `Invalid ${issue.validation}`;
       } else {
-        message = "Invalid";
+        message2 = "Invalid";
       }
       break;
     case ZodIssueCode.too_small:
       if (issue.type === "array")
-        message = `Array must contain ${issue.exact ? "exactly" : issue.inclusive ? `at least` : `more than`} ${issue.minimum} element(s)`;
+        message2 = `Array must contain ${issue.exact ? "exactly" : issue.inclusive ? `at least` : `more than`} ${issue.minimum} element(s)`;
       else if (issue.type === "string")
-        message = `String must contain ${issue.exact ? "exactly" : issue.inclusive ? `at least` : `over`} ${issue.minimum} character(s)`;
+        message2 = `String must contain ${issue.exact ? "exactly" : issue.inclusive ? `at least` : `over`} ${issue.minimum} character(s)`;
       else if (issue.type === "number")
-        message = `Number must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${issue.minimum}`;
+        message2 = `Number must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${issue.minimum}`;
       else if (issue.type === "bigint")
-        message = `Number must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${issue.minimum}`;
+        message2 = `Number must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${issue.minimum}`;
       else if (issue.type === "date")
-        message = `Date must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${new Date(Number(issue.minimum))}`;
+        message2 = `Date must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${new Date(Number(issue.minimum))}`;
       else
-        message = "Invalid input";
+        message2 = "Invalid input";
       break;
     case ZodIssueCode.too_big:
       if (issue.type === "array")
-        message = `Array must contain ${issue.exact ? `exactly` : issue.inclusive ? `at most` : `less than`} ${issue.maximum} element(s)`;
+        message2 = `Array must contain ${issue.exact ? `exactly` : issue.inclusive ? `at most` : `less than`} ${issue.maximum} element(s)`;
       else if (issue.type === "string")
-        message = `String must contain ${issue.exact ? `exactly` : issue.inclusive ? `at most` : `under`} ${issue.maximum} character(s)`;
+        message2 = `String must contain ${issue.exact ? `exactly` : issue.inclusive ? `at most` : `under`} ${issue.maximum} character(s)`;
       else if (issue.type === "number")
-        message = `Number must be ${issue.exact ? `exactly` : issue.inclusive ? `less than or equal to` : `less than`} ${issue.maximum}`;
+        message2 = `Number must be ${issue.exact ? `exactly` : issue.inclusive ? `less than or equal to` : `less than`} ${issue.maximum}`;
       else if (issue.type === "bigint")
-        message = `BigInt must be ${issue.exact ? `exactly` : issue.inclusive ? `less than or equal to` : `less than`} ${issue.maximum}`;
+        message2 = `BigInt must be ${issue.exact ? `exactly` : issue.inclusive ? `less than or equal to` : `less than`} ${issue.maximum}`;
       else if (issue.type === "date")
-        message = `Date must be ${issue.exact ? `exactly` : issue.inclusive ? `smaller than or equal to` : `smaller than`} ${new Date(Number(issue.maximum))}`;
+        message2 = `Date must be ${issue.exact ? `exactly` : issue.inclusive ? `smaller than or equal to` : `smaller than`} ${new Date(Number(issue.maximum))}`;
       else
-        message = "Invalid input";
+        message2 = "Invalid input";
       break;
     case ZodIssueCode.custom:
-      message = `Invalid input`;
+      message2 = `Invalid input`;
       break;
     case ZodIssueCode.invalid_intersection_types:
-      message = `Intersection results could not be merged`;
+      message2 = `Intersection results could not be merged`;
       break;
     case ZodIssueCode.not_multiple_of:
-      message = `Number must be a multiple of ${issue.multipleOf}`;
+      message2 = `Number must be a multiple of ${issue.multipleOf}`;
       break;
     case ZodIssueCode.not_finite:
-      message = "Number must be finite";
+      message2 = "Number must be finite";
       break;
     default:
-      message = _ctx.defaultError;
+      message2 = _ctx.defaultError;
       util.assertNever(issue);
   }
-  return { message };
+  return { message: message2 };
 };
 var en_default = errorMap;
 
@@ -710,8 +710,8 @@ var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
-  errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
-  errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
+  errorUtil2.errToObj = (message2) => typeof message2 === "string" ? { message: message2 } : message2 || {};
+  errorUtil2.toString = (message2) => typeof message2 === "string" ? message2 : message2?.message;
 })(errorUtil || (errorUtil = {}));
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
@@ -763,16 +763,16 @@ function processCreateParams(params) {
   if (errorMap2)
     return { errorMap: errorMap2, description };
   const customMap = (iss, ctx) => {
-    const { message } = params;
+    const { message: message2 } = params;
     if (iss.code === "invalid_enum_value") {
-      return { message: message ?? ctx.defaultError };
+      return { message: message2 ?? ctx.defaultError };
     }
     if (typeof ctx.data === "undefined") {
-      return { message: message ?? required_error ?? ctx.defaultError };
+      return { message: message2 ?? required_error ?? ctx.defaultError };
     }
     if (iss.code !== "invalid_type")
       return { message: ctx.defaultError };
-    return { message: message ?? invalid_type_error ?? ctx.defaultError };
+    return { message: message2 ?? invalid_type_error ?? ctx.defaultError };
   };
   return { errorMap: customMap, description };
 }
@@ -898,14 +898,14 @@ var ZodType = class {
     const result = await (isAsync(maybeAsyncResult) ? maybeAsyncResult : Promise.resolve(maybeAsyncResult));
     return handleResult(ctx, result);
   }
-  refine(check, message) {
+  refine(check, message2) {
     const getIssueProperties = (val) => {
-      if (typeof message === "string" || typeof message === "undefined") {
-        return { message };
-      } else if (typeof message === "function") {
-        return message(val);
+      if (typeof message2 === "string" || typeof message2 === "undefined") {
+        return { message: message2 };
+      } else if (typeof message2 === "function") {
+        return message2(val);
       } else {
-        return message;
+        return message2;
       }
     };
     return this._refinement((val, ctx) => {
@@ -1441,11 +1441,11 @@ var ZodString = class _ZodString extends ZodType {
     }
     return { status: status.value, value: input.data };
   }
-  _regex(regex, validation, message) {
+  _regex(regex, validation, message2) {
     return this.refinement((data) => regex.test(data), {
       validation,
       code: ZodIssueCode.invalid_string,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
   _addCheck(check) {
@@ -1454,37 +1454,37 @@ var ZodString = class _ZodString extends ZodType {
       checks: [...this._def.checks, check]
     });
   }
-  email(message) {
-    return this._addCheck({ kind: "email", ...errorUtil.errToObj(message) });
+  email(message2) {
+    return this._addCheck({ kind: "email", ...errorUtil.errToObj(message2) });
   }
-  url(message) {
-    return this._addCheck({ kind: "url", ...errorUtil.errToObj(message) });
+  url(message2) {
+    return this._addCheck({ kind: "url", ...errorUtil.errToObj(message2) });
   }
-  emoji(message) {
-    return this._addCheck({ kind: "emoji", ...errorUtil.errToObj(message) });
+  emoji(message2) {
+    return this._addCheck({ kind: "emoji", ...errorUtil.errToObj(message2) });
   }
-  uuid(message) {
-    return this._addCheck({ kind: "uuid", ...errorUtil.errToObj(message) });
+  uuid(message2) {
+    return this._addCheck({ kind: "uuid", ...errorUtil.errToObj(message2) });
   }
-  nanoid(message) {
-    return this._addCheck({ kind: "nanoid", ...errorUtil.errToObj(message) });
+  nanoid(message2) {
+    return this._addCheck({ kind: "nanoid", ...errorUtil.errToObj(message2) });
   }
-  cuid(message) {
-    return this._addCheck({ kind: "cuid", ...errorUtil.errToObj(message) });
+  cuid(message2) {
+    return this._addCheck({ kind: "cuid", ...errorUtil.errToObj(message2) });
   }
-  cuid2(message) {
-    return this._addCheck({ kind: "cuid2", ...errorUtil.errToObj(message) });
+  cuid2(message2) {
+    return this._addCheck({ kind: "cuid2", ...errorUtil.errToObj(message2) });
   }
-  ulid(message) {
-    return this._addCheck({ kind: "ulid", ...errorUtil.errToObj(message) });
+  ulid(message2) {
+    return this._addCheck({ kind: "ulid", ...errorUtil.errToObj(message2) });
   }
-  base64(message) {
-    return this._addCheck({ kind: "base64", ...errorUtil.errToObj(message) });
+  base64(message2) {
+    return this._addCheck({ kind: "base64", ...errorUtil.errToObj(message2) });
   }
-  base64url(message) {
+  base64url(message2) {
     return this._addCheck({
       kind: "base64url",
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
   jwt(options) {
@@ -1514,8 +1514,8 @@ var ZodString = class _ZodString extends ZodType {
       ...errorUtil.errToObj(options?.message)
     });
   }
-  date(message) {
-    return this._addCheck({ kind: "date", message });
+  date(message2) {
+    return this._addCheck({ kind: "date", message: message2 });
   }
   time(options) {
     if (typeof options === "string") {
@@ -1531,14 +1531,14 @@ var ZodString = class _ZodString extends ZodType {
       ...errorUtil.errToObj(options?.message)
     });
   }
-  duration(message) {
-    return this._addCheck({ kind: "duration", ...errorUtil.errToObj(message) });
+  duration(message2) {
+    return this._addCheck({ kind: "duration", ...errorUtil.errToObj(message2) });
   }
-  regex(regex, message) {
+  regex(regex, message2) {
     return this._addCheck({
       kind: "regex",
       regex,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
   includes(value, options) {
@@ -1549,46 +1549,46 @@ var ZodString = class _ZodString extends ZodType {
       ...errorUtil.errToObj(options?.message)
     });
   }
-  startsWith(value, message) {
+  startsWith(value, message2) {
     return this._addCheck({
       kind: "startsWith",
       value,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
-  endsWith(value, message) {
+  endsWith(value, message2) {
     return this._addCheck({
       kind: "endsWith",
       value,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
-  min(minLength, message) {
+  min(minLength, message2) {
     return this._addCheck({
       kind: "min",
       value: minLength,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
-  max(maxLength, message) {
+  max(maxLength, message2) {
     return this._addCheck({
       kind: "max",
       value: maxLength,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
-  length(len, message) {
+  length(len, message2) {
     return this._addCheck({
       kind: "length",
       value: len,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
   /**
    * Equivalent to `.min(1)`
    */
-  nonempty(message) {
-    return this.min(1, errorUtil.errToObj(message));
+  nonempty(message2) {
+    return this.min(1, errorUtil.errToObj(message2));
   }
   trim() {
     return new _ZodString({
@@ -1781,19 +1781,19 @@ var ZodNumber = class _ZodNumber extends ZodType {
     }
     return { status: status.value, value: input.data };
   }
-  gte(value, message) {
-    return this.setLimit("min", value, true, errorUtil.toString(message));
+  gte(value, message2) {
+    return this.setLimit("min", value, true, errorUtil.toString(message2));
   }
-  gt(value, message) {
-    return this.setLimit("min", value, false, errorUtil.toString(message));
+  gt(value, message2) {
+    return this.setLimit("min", value, false, errorUtil.toString(message2));
   }
-  lte(value, message) {
-    return this.setLimit("max", value, true, errorUtil.toString(message));
+  lte(value, message2) {
+    return this.setLimit("max", value, true, errorUtil.toString(message2));
   }
-  lt(value, message) {
-    return this.setLimit("max", value, false, errorUtil.toString(message));
+  lt(value, message2) {
+    return this.setLimit("max", value, false, errorUtil.toString(message2));
   }
-  setLimit(kind, value, inclusive, message) {
+  setLimit(kind, value, inclusive, message2) {
     return new _ZodNumber({
       ...this._def,
       checks: [
@@ -1802,7 +1802,7 @@ var ZodNumber = class _ZodNumber extends ZodType {
           kind,
           value,
           inclusive,
-          message: errorUtil.toString(message)
+          message: errorUtil.toString(message2)
         }
       ]
     });
@@ -1813,68 +1813,68 @@ var ZodNumber = class _ZodNumber extends ZodType {
       checks: [...this._def.checks, check]
     });
   }
-  int(message) {
+  int(message2) {
     return this._addCheck({
       kind: "int",
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  positive(message) {
+  positive(message2) {
     return this._addCheck({
       kind: "min",
       value: 0,
       inclusive: false,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  negative(message) {
+  negative(message2) {
     return this._addCheck({
       kind: "max",
       value: 0,
       inclusive: false,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  nonpositive(message) {
+  nonpositive(message2) {
     return this._addCheck({
       kind: "max",
       value: 0,
       inclusive: true,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  nonnegative(message) {
+  nonnegative(message2) {
     return this._addCheck({
       kind: "min",
       value: 0,
       inclusive: true,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  multipleOf(value, message) {
+  multipleOf(value, message2) {
     return this._addCheck({
       kind: "multipleOf",
       value,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  finite(message) {
+  finite(message2) {
     return this._addCheck({
       kind: "finite",
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  safe(message) {
+  safe(message2) {
     return this._addCheck({
       kind: "min",
       inclusive: true,
       value: Number.MIN_SAFE_INTEGER,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     })._addCheck({
       kind: "max",
       inclusive: true,
       value: Number.MAX_SAFE_INTEGER,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
   get minValue() {
@@ -1997,19 +1997,19 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
     });
     return INVALID;
   }
-  gte(value, message) {
-    return this.setLimit("min", value, true, errorUtil.toString(message));
+  gte(value, message2) {
+    return this.setLimit("min", value, true, errorUtil.toString(message2));
   }
-  gt(value, message) {
-    return this.setLimit("min", value, false, errorUtil.toString(message));
+  gt(value, message2) {
+    return this.setLimit("min", value, false, errorUtil.toString(message2));
   }
-  lte(value, message) {
-    return this.setLimit("max", value, true, errorUtil.toString(message));
+  lte(value, message2) {
+    return this.setLimit("max", value, true, errorUtil.toString(message2));
   }
-  lt(value, message) {
-    return this.setLimit("max", value, false, errorUtil.toString(message));
+  lt(value, message2) {
+    return this.setLimit("max", value, false, errorUtil.toString(message2));
   }
-  setLimit(kind, value, inclusive, message) {
+  setLimit(kind, value, inclusive, message2) {
     return new _ZodBigInt({
       ...this._def,
       checks: [
@@ -2018,7 +2018,7 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
           kind,
           value,
           inclusive,
-          message: errorUtil.toString(message)
+          message: errorUtil.toString(message2)
         }
       ]
     });
@@ -2029,43 +2029,43 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
       checks: [...this._def.checks, check]
     });
   }
-  positive(message) {
+  positive(message2) {
     return this._addCheck({
       kind: "min",
       value: BigInt(0),
       inclusive: false,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  negative(message) {
+  negative(message2) {
     return this._addCheck({
       kind: "max",
       value: BigInt(0),
       inclusive: false,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  nonpositive(message) {
+  nonpositive(message2) {
     return this._addCheck({
       kind: "max",
       value: BigInt(0),
       inclusive: true,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  nonnegative(message) {
+  nonnegative(message2) {
     return this._addCheck({
       kind: "min",
       value: BigInt(0),
       inclusive: true,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  multipleOf(value, message) {
+  multipleOf(value, message2) {
     return this._addCheck({
       kind: "multipleOf",
       value,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
   get minValue() {
@@ -2188,18 +2188,18 @@ var ZodDate = class _ZodDate extends ZodType {
       checks: [...this._def.checks, check]
     });
   }
-  min(minDate, message) {
+  min(minDate, message2) {
     return this._addCheck({
       kind: "min",
       value: minDate.getTime(),
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  max(maxDate, message) {
+  max(maxDate, message2) {
     return this._addCheck({
       kind: "max",
       value: maxDate.getTime(),
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
   get minDate() {
@@ -2431,26 +2431,26 @@ var ZodArray = class _ZodArray extends ZodType {
   get element() {
     return this._def.type;
   }
-  min(minLength, message) {
+  min(minLength, message2) {
     return new _ZodArray({
       ...this._def,
-      minLength: { value: minLength, message: errorUtil.toString(message) }
+      minLength: { value: minLength, message: errorUtil.toString(message2) }
     });
   }
-  max(maxLength, message) {
+  max(maxLength, message2) {
     return new _ZodArray({
       ...this._def,
-      maxLength: { value: maxLength, message: errorUtil.toString(message) }
+      maxLength: { value: maxLength, message: errorUtil.toString(message2) }
     });
   }
-  length(len, message) {
+  length(len, message2) {
     return new _ZodArray({
       ...this._def,
-      exactLength: { value: len, message: errorUtil.toString(message) }
+      exactLength: { value: len, message: errorUtil.toString(message2) }
     });
   }
-  nonempty(message) {
-    return this.min(1, message);
+  nonempty(message2) {
+    return this.min(1, message2);
   }
 };
 ZodArray.create = (schema, params) => {
@@ -2593,17 +2593,17 @@ var ZodObject = class _ZodObject extends ZodType {
   get shape() {
     return this._def.shape();
   }
-  strict(message) {
+  strict(message2) {
     errorUtil.errToObj;
     return new _ZodObject({
       ...this._def,
       unknownKeys: "strict",
-      ...message !== void 0 ? {
+      ...message2 !== void 0 ? {
         errorMap: (issue, ctx) => {
           const defaultError = this._def.errorMap?.(issue, ctx).message ?? ctx.defaultError;
           if (issue.code === "unrecognized_keys")
             return {
-              message: errorUtil.errToObj(message).message ?? defaultError
+              message: errorUtil.errToObj(message2).message ?? defaultError
             };
           return {
             message: defaultError
@@ -3359,23 +3359,23 @@ var ZodSet = class _ZodSet extends ZodType {
       return finalizeSet(elements);
     }
   }
-  min(minSize, message) {
+  min(minSize, message2) {
     return new _ZodSet({
       ...this._def,
-      minSize: { value: minSize, message: errorUtil.toString(message) }
+      minSize: { value: minSize, message: errorUtil.toString(message2) }
     });
   }
-  max(maxSize, message) {
+  max(maxSize, message2) {
     return new _ZodSet({
       ...this._def,
-      maxSize: { value: maxSize, message: errorUtil.toString(message) }
+      maxSize: { value: maxSize, message: errorUtil.toString(message2) }
     });
   }
-  size(size, message) {
-    return this.min(size, message).max(size, message);
+  size(size, message2) {
+    return this.min(size, message2).max(size, message2);
   }
-  nonempty(message) {
-    return this.min(1, message);
+  nonempty(message2) {
+    return this.min(1, message2);
   }
 };
 ZodSet.create = (valueType, params) => {
@@ -4162,7 +4162,7 @@ var coerce = {
 };
 var NEVER = INVALID;
 
-// ../shared/dist/chunk-BH4SLNGU.js
+// ../shared/dist/chunk-VSUBG7GR.js
 var DEFAULT_SONNET_MODEL = "claude-sonnet-5-5";
 var DEFAULT_OPUS_MODEL = "claude-opus-5-5";
 var DEFAULT_HAIKU_MODEL = "claude-haiku-4-5-20251001";
@@ -4780,7 +4780,8 @@ var DiscoveredPortSchema = external_exports.object({
   port: external_exports.number().int().min(1).max(65535),
   label: external_exports.string().min(1).max(64).optional(),
   protocol: external_exports.enum(["http", "tcp"]).optional(),
-  detectedAt: external_exports.string()
+  detectedAt: external_exports.string(),
+  hidden: external_exports.boolean().optional()
 });
 var ReportDiscoveredPortsRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
@@ -4927,7 +4928,11 @@ var SubmitCodeReviewResultRequestSchema = external_exports.object({
 var CycleCodingAgentKeyRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
   rateLimitType: external_exports.string(),
-  resetsAt: external_exports.string().optional()
+  resetsAt: external_exports.string().optional(),
+  // The key the pod is actually running (CONVEYOR_CODING_AGENT_KEY_ID). Wins
+  // over the session's attribution stamp after owner validation; optional so
+  // older agents keep the session fallback.
+  codingAgentKeyId: external_exports.string().optional()
 });
 var PostChildChatMessageRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
@@ -5341,11 +5346,12 @@ var QueryProjectGcpLogsRequestSchema = external_exports.object({
   sqlInstances: external_exports.array(external_exports.string().min(1).max(200)).max(25).optional(),
   allServices: external_exports.boolean().optional(),
   search: external_exports.string().max(256).optional(),
-  filter: external_exports.string().max(1e3).optional(),
+  filter: external_exports.string().max(2e3).optional(),
   startTime: external_exports.string().optional(),
   endTime: external_exports.string().optional(),
   limit: external_exports.number().int().min(1).max(200).optional().default(50),
-  pageToken: external_exports.string().max(4096).optional()
+  pageToken: external_exports.string().max(4096).optional(),
+  full: external_exports.boolean().optional()
 });
 var QueryProjectGrafanaLogsRequestSchema = external_exports.object({
   projectId: external_exports.string(),
@@ -6290,6 +6296,7 @@ var BAKE_COMPONENT_LABEL = "claudespace.rallycry.com/component";
 var BAKE_COMPONENT_PREBAKE = "prebake";
 var BAKE_COMPONENT_STATE_BAKE = "state-bake";
 var BAKE_COMPONENT_VALUES = [BAKE_COMPONENT_PREBAKE, BAKE_COMPONENT_STATE_BAKE];
+var PERSONAL_BAKE_NAMESPACE = "conveyor-bakes";
 var MS_PER_DAY = 24 * 60 * 60 * 1e3;
 var POSTGRES_ENV = {
   POSTGRES_HOST_AUTH_METHOD: "trust",
@@ -6608,6 +6615,8 @@ var REPORT_CARD_TYPES = surfaceTypes("report");
 var DECISION_CARD_TYPES = surfaceTypes("decision");
 
 // src/daemon/connection.ts
+var REDIAL_FIRST_MS = 5e3;
+var REDIAL_MAX_MS = 5 * 6e4;
 function unwrap(ack, what) {
   if (!ack?.ok || ack.data === void 0) {
     throw new Error(`${what} failed: ${ack?.error ?? "no response"}`);
@@ -6617,6 +6626,8 @@ function unwrap(ack, what) {
 var ClusterConnection = class {
   socket = null;
   config;
+  redialDelayMs = REDIAL_FIRST_MS;
+  redialTimer = null;
   /** Called when Conveyor says the desired state changed. */
   onSyncRequested = null;
   /** Called when Conveyor asks the machine to remove itself. */
@@ -6652,6 +6663,7 @@ var ClusterConnection = class {
       });
       this.socket = socket;
       socket.on("connect", () => {
+        this.redialDelayMs = REDIAL_FIRST_MS;
         if (!settled) {
           settled = true;
           resolve();
@@ -6670,6 +6682,9 @@ var ClusterConnection = class {
       socket.on("disconnect", (reason) => {
         process.stderr.write(`[conveyor-k3] disconnected: ${reason}
 `);
+        if (reason === "io server disconnect" && this.config.reconnectWhenReplaced) {
+          this.redial(socket);
+        }
       });
       socket.on(PERSONAL_CLUSTER_EVENTS.syncRequested, () => {
         this.onSyncRequested?.();
@@ -6731,7 +6746,20 @@ var ClusterConnection = class {
     } catch {
     }
   }
+  /** Dial again after the server closed the socket, waiting longer each time. */
+  redial(socket) {
+    if (this.redialTimer) return;
+    const delay = this.redialDelayMs;
+    this.redialDelayMs = Math.min(delay * 2, REDIAL_MAX_MS);
+    this.redialTimer = setTimeout(() => {
+      this.redialTimer = null;
+      if (this.socket === socket && !socket.connected) socket.connect();
+    }, delay);
+    this.redialTimer.unref?.();
+  }
   disconnect() {
+    if (this.redialTimer) clearTimeout(this.redialTimer);
+    this.redialTimer = null;
     this.socket?.disconnect();
     this.socket = null;
   }
@@ -7147,6 +7175,9 @@ async function writeState(fs, state) {
   await fs.writeFile(STATE_FILE, `${JSON.stringify(state, null, 2)}
 `, 384);
 }
+function managesK3s(desired, state) {
+  return desired.isolation === void 0 || state.k3sInstalledByConveyor === true;
+}
 
 // src/lib/k3s-config.ts
 var IMAGE_GC_HIGH = "image-gc-high-threshold";
@@ -7160,6 +7191,15 @@ var K3S_INSTALL_EXEC = [
   `--${WRITE_KUBECONFIG_MODE}`,
   KUBECONFIG_MODE
 ].join(" ");
+function bareToken(token) {
+  let bare = token.trim();
+  if (bare.endsWith("\\")) bare = bare.slice(0, -1).trim();
+  const quote = bare[0];
+  if (bare.length >= 2 && (quote === "'" || quote === '"') && bare.endsWith(quote)) {
+    bare = bare.slice(1, -1);
+  }
+  return bare;
+}
 function ownerConfiguredKubeletFlags(ownerConfig) {
   const found = /* @__PURE__ */ new Set();
   if (!ownerConfig) return found;
@@ -7185,7 +7225,7 @@ function ownerImageGcHighThreshold(ownerConfig) {
   const value = Number.parseInt(match[2] ?? "", 10);
   return Number.isInteger(value) && value >= 0 && value <= 100 ? value : null;
 }
-function renderK3sDropIn(kubelet, ownerConfig) {
+function renderK3sDropIn(kubelet, ownerConfig, options = {}) {
   const ownerFlags = ownerConfiguredKubeletFlags(ownerConfig);
   const ownerKeys = ownerConfiguredKeys(ownerConfig);
   const args = [];
@@ -7209,8 +7249,10 @@ function renderK3sDropIn(kubelet, ownerConfig) {
     "# Your own /etc/rancher/k3s/config.yaml is never modified; k3s merges both.",
     "# `kubelet-arg+` and `disable+` append rather than replacing a list you set."
   ];
-  lines2.push("disable+:");
-  for (const component of K3S_DISABLED_COMPONENTS) lines2.push(`  - ${component}`);
+  if (options.disableComponents !== false) {
+    lines2.push("disable+:");
+    for (const component of K3S_DISABLED_COMPONENTS) lines2.push(`  - ${component}`);
+  }
   if (ownerKeys.has(WRITE_KUBECONFIG_MODE)) {
     skipped.push(WRITE_KUBECONFIG_MODE);
   } else {
@@ -7640,6 +7682,231 @@ async function loadRegistryMirror(ctx) {
   return { restarted: true, warning: null };
 }
 
+// src/lib/isolation.ts
+var EGRESS_POLICY_NAME = "conveyor-k3-egress";
+var MANAGED_BY2 = { "app.kubernetes.io/managed-by": "conveyor-k3" };
+var NON_ROUTABLE_IPV4 = [
+  "0.0.0.0/8",
+  "10.0.0.0/8",
+  "100.64.0.0/10",
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "172.16.0.0/12",
+  "192.0.0.0/24",
+  "192.0.2.0/24",
+  "192.88.99.0/24",
+  "192.168.0.0/16",
+  "198.18.0.0/15",
+  "198.51.100.0/24",
+  "203.0.113.0/24",
+  "224.0.0.0/4",
+  "240.0.0.0/4"
+];
+var KUBE_DNS = { namespace: "kube-system", labels: { "k8s-app": "kube-dns" } };
+var PSA_PREFIX = "pod-security.kubernetes.io";
+function psaLabels(level) {
+  const advisory = level === "baseline" ? "restricted" : level;
+  return {
+    [`${PSA_PREFIX}/enforce`]: level,
+    [`${PSA_PREFIX}/warn`]: advisory,
+    [`${PSA_PREFIX}/audit`]: advisory
+  };
+}
+var PSA_LABEL_KEYS = Object.keys(psaLabels("baseline"));
+function ipv4Value(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4) return null;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const octet = Number(part);
+    if (octet > 255) return null;
+    value = value * 256 + octet;
+  }
+  return value;
+}
+function inNonRoutableRange(address) {
+  const value = ipv4Value(address);
+  if (value === null) return false;
+  return NON_ROUTABLE_IPV4.some((cidr) => {
+    const [base = "", bits = "32"] = cidr.split("/");
+    const start = ipv4Value(base) ?? 0;
+    return value >= start && value < start + 2 ** (32 - Number(bits));
+  });
+}
+function hostAddressExceptions(addresses) {
+  const kept = /* @__PURE__ */ new Set();
+  for (const raw of addresses) {
+    const address = raw.trim();
+    if (ipv4Value(address) === null || inNonRoutableRange(address)) continue;
+    kept.add(`${address}/32`);
+  }
+  return [...kept].sort();
+}
+function renderEgressNetworkPolicy(namespace, hostAddresses) {
+  const policy = {
+    apiVersion: "networking.k8s.io/v1",
+    kind: "NetworkPolicy",
+    metadata: {
+      name: EGRESS_POLICY_NAME,
+      namespace: assertK8sName(namespace, "namespace"),
+      labels: MANAGED_BY2
+    },
+    spec: {
+      podSelector: {},
+      policyTypes: ["Egress"],
+      egress: [
+        {
+          to: [
+            {
+              namespaceSelector: {
+                matchLabels: { "kubernetes.io/metadata.name": KUBE_DNS.namespace }
+              },
+              podSelector: { matchLabels: KUBE_DNS.labels }
+            }
+          ],
+          ports: [
+            { protocol: "UDP", port: 53 },
+            { protocol: "TCP", port: 53 }
+          ]
+        },
+        {
+          // kube-router enforces after the Service's DNAT, so the registry is
+          // reached by its pods' labels, never by the service range.
+          to: [
+            {
+              namespaceSelector: {
+                matchLabels: { "kubernetes.io/metadata.name": PERSONAL_LOCAL_REGISTRY_NAMESPACE }
+              },
+              podSelector: { matchLabels: LOCAL_REGISTRY_SELECTOR }
+            }
+          ],
+          ports: [{ protocol: "TCP", port: PERSONAL_LOCAL_REGISTRY_PORT }]
+        },
+        {
+          to: [
+            {
+              ipBlock: {
+                cidr: "0.0.0.0/0",
+                except: [...NON_ROUTABLE_IPV4, ...hostAddressExceptions(hostAddresses)]
+              }
+            }
+          ]
+        }
+      ]
+    }
+  };
+  return `${JSON.stringify(policy, null, 2)}
+`;
+}
+var DISABLE_KEY = /(?:^|[\s{,])(["']?)disable-network-policy\1\s*:([^,}]*)/g;
+var DISABLE_FLAGS = /* @__PURE__ */ new Set(["--disable-network-policy", "-disable-network-policy"]);
+var FALSE_VALUES = /* @__PURE__ */ new Set(["false", "no", "off", "n", "f", "0"]);
+function setsTrue(raw) {
+  const value = bareToken(raw).trim().toLowerCase();
+  return !FALSE_VALUES.has(value);
+}
+function uncommented(line) {
+  return /^\s*#/.test(line) ? "" : line.replace(/\s#.*$/, "");
+}
+function configSetsKey(text) {
+  return text.split("\n").map(uncommented).some((line) => [...line.matchAll(DISABLE_KEY)].some((match) => setsTrue(match[2] ?? "")));
+}
+function unitLines(unitText) {
+  const lines2 = [];
+  let pending = "";
+  for (const raw of unitText.split("\n")) {
+    const line = raw.trimEnd();
+    if (/^\s*[#;]/.test(line)) continue;
+    if (line.endsWith("\\")) {
+      pending += `${line.slice(0, -1)} `;
+      continue;
+    }
+    lines2.push(pending + line);
+    pending = "";
+  }
+  return pending ? [...lines2, pending] : lines2;
+}
+function flagSetIn(line) {
+  return line.split(/\s+/).some((raw) => {
+    const token = bareToken(raw).replace(/^["']+|["']+$/g, "");
+    const [name = "", ...value] = token.split("=");
+    return DISABLE_FLAGS.has(name) && (value.length === 0 || setsTrue(value.join("=")));
+  });
+}
+function networkPolicyControllerDisabled(sources) {
+  if (sources.configs.some((text) => text !== null && configSetsKey(text))) return true;
+  return unitLines(sources.unitText).some(flagSetIn);
+}
+
+// src/daemon/isolation-probes.ts
+var CONTROLLER_DISABLED_WARNING = "k3s runs with its network policy controller disabled, so the egress policy Conveyor applies here is not enforced. Remove disable-network-policy from the k3s config or unit and restart k3s. Until then this server is not isolated; Conveyor checks again within 10 minutes.";
+var CONTROLLER_UNKNOWN_WARNING = "Could not read the k3s unit or its config files to check that its network policy controller is on, so this server does not count as isolated. Check `systemctl cat k3s.service` and /etc/rancher/k3s; Conveyor checks again within 10 minutes.";
+var NODE_ADDRESSES_JSONPATH = '{range .items[*]}{range .status.addresses[?(@.type=="InternalIP")]}{.address}{"\\n"}{end}{range .status.addresses[?(@.type=="ExternalIP")]}{.address}{"\\n"}{end}{end}';
+var API_ENDPOINTS_JSONPATH = "{.items[*].endpoints[*].addresses[*]}";
+var IPV4_ON_INTERFACE = /\binet (\d{1,3}(?:\.\d{1,3}){3})(?:\/| peer )/g;
+async function stdoutOf(exec, bin, args) {
+  const run = await exec(bin, args, { timeoutMs: 1e4 }).catch(() => null);
+  return run && run.exitCode === 0 ? run.stdout : null;
+}
+async function readK3sConfigs(ctx) {
+  const listed = await stdoutOf(ctx.exec, "find", [
+    "-L",
+    K3S_CONFIG_DROPIN_DIR,
+    "-maxdepth",
+    "1",
+    "-type",
+    "f",
+    "(",
+    "-iname",
+    "*.yaml",
+    "-o",
+    "-iname",
+    "*.yml",
+    ")"
+  ]);
+  if (listed === null) return null;
+  const paths = listed.split("\n").map((path) => path.trim()).filter(Boolean).sort();
+  const dropIns = await Promise.all(paths.map((path) => ctx.fs.readFile(path)));
+  if (dropIns.some((text) => text === null)) return null;
+  return [await ctx.fs.readFile(K3S_OWNER_CONFIG), ...dropIns];
+}
+async function controllerProblem(ctx) {
+  const unitText = await stdoutOf(ctx.exec, "systemctl", ["cat", "k3s.service"]);
+  const configs = unitText === null ? null : await readK3sConfigs(ctx);
+  if (unitText === null || configs === null) return CONTROLLER_UNKNOWN_WARNING;
+  return networkPolicyControllerDisabled({ configs, unitText }) ? CONTROLLER_DISABLED_WARNING : null;
+}
+async function readHostAddresses(exec) {
+  const nodes = await stdoutOf(exec, "k3s", [
+    "kubectl",
+    "get",
+    "nodes",
+    "-o",
+    `jsonpath=${NODE_ADDRESSES_JSONPATH}`
+  ]);
+  const interfaces = await stdoutOf(exec, "ip", ["-o", "-4", "addr", "show"]);
+  const api = await stdoutOf(exec, "k3s", [
+    "kubectl",
+    "get",
+    "endpointslices",
+    "-n",
+    "default",
+    "-l",
+    "kubernetes.io/service-name=kubernetes",
+    "-o",
+    `jsonpath=${API_ENDPOINTS_JSONPATH}`
+  ]);
+  if (nodes === null || interfaces === null || api === null) return null;
+  const onInterfaces = [...interfaces.matchAll(IPV4_ON_INTERFACE)].map((match) => match[1] ?? "");
+  return [...nodes.split(/\s+/), ...onInterfaces, ...api.split(/\s+/)].filter(Boolean);
+}
+async function recheckIsolation(ctx, reconciled) {
+  if (reconciled?.applied !== true) return { isolation: reconciled, warnings: [] };
+  const problem = await controllerProblem(ctx);
+  return problem ? { isolation: { applied: false }, warnings: [problem] } : { isolation: reconciled, warnings: [] };
+}
+
 // src/daemon/prune-namespaces.ts
 var POOL_NAMESPACE_PREFIX = "claudespace-";
 var WORKSPACE_MANAGER_ROLE = "conveyor-workspace-manager";
@@ -7702,6 +7969,143 @@ async function pruneStaleNamespaces(ctx, desired, result) {
   }
 }
 
+// src/daemon/namespace-upkeep.ts
+function message(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function renderLimitRange(namespace, limits) {
+  const ns = assertK8sName(namespace, "namespace");
+  const values = [
+    assertQuantity(limits.defaultRequest.cpu, "defaultRequest.cpu"),
+    assertQuantity(limits.defaultRequest.memory, "defaultRequest.memory"),
+    assertQuantity(limits.default.cpu, "default.cpu"),
+    assertQuantity(limits.default.memory, "default.memory")
+  ];
+  return [
+    "apiVersion: v1",
+    "kind: LimitRange",
+    "metadata:",
+    "  name: conveyor-k3-defaults",
+    `  namespace: ${ns}`,
+    "spec:",
+    "  limits:",
+    "  - type: Container",
+    "    defaultRequest:",
+    `      cpu: "${values[0]}"`,
+    `      memory: "${values[1]}"`,
+    "    default:",
+    `      cpu: "${values[2]}"`,
+    `      memory: "${values[3]}"`,
+    ""
+  ].join("\n");
+}
+async function reconcileNamespaces(ctx, desired, result) {
+  for (const namespace of desired.namespaces) {
+    try {
+      await kubectlApply(ctx.exec, renderLimitRange(namespace.name, namespace.limitRange));
+    } catch (error) {
+      result.warnings.push(
+        `Could not apply resource defaults to ${namespace.name} (${namespace.projectName}): ${message(error)}`
+      );
+    }
+  }
+}
+async function ensureBakeNamespace(ctx, desired) {
+  const found = await ctx.exec(
+    "k3s",
+    ["kubectl", "get", "namespace", PERSONAL_BAKE_NAMESPACE],
+    KUBECTL_TIMEOUT2
+  );
+  if (found.exitCode !== 0) {
+    await runOrThrow(
+      ctx.exec,
+      "k3s",
+      ["kubectl", "create", "namespace", PERSONAL_BAKE_NAMESPACE],
+      KUBECTL_TIMEOUT2
+    );
+  }
+  const limitRange = desired.namespaces[0]?.limitRange;
+  if (limitRange) {
+    await kubectlApply(ctx.exec, renderLimitRange(PERSONAL_BAKE_NAMESPACE, limitRange));
+  }
+}
+function knownStance(isolation) {
+  const { podSecurity, egress, ...rest } = { ...isolation };
+  const extra = Object.keys(rest);
+  if (podSecurity === "baseline" && egress === "no-private" && extra.length === 0) return null;
+  const named = `Pod Security "${String(podSecurity).slice(0, 40)}", egress "${String(egress).slice(0, 40)}"`;
+  return extra.length === 0 ? named : `${named}, and ${extra.slice(0, 3).join(", ").slice(0, 80)}`;
+}
+var KUBECTL_TIMEOUT2 = { timeoutMs: 3e4 };
+var RECHECK = "Conveyor checks again within 10 minutes.";
+async function isolateNamespace(ctx, namespace, isolation, fail) {
+  const ns = assertK8sName(namespace, "namespace");
+  const labels = Object.entries(psaLabels(isolation.podSecurity)).map(
+    ([key, value]) => `${key}=${value}`
+  );
+  const labelled = await ctx.exec(
+    "k3s",
+    ["kubectl", "label", "namespace", ns, "--overwrite", ...labels],
+    KUBECTL_TIMEOUT2
+  );
+  if (labelled.exitCode !== 0) {
+    fail(
+      `Could not apply Pod Security labels to ${ns}: ${labelled.stderr.trim().slice(0, 200)} ${RECHECK}`
+    );
+  }
+  if (isolation.hostAddresses === null) return;
+  try {
+    await kubectlApply(ctx.exec, renderEgressNetworkPolicy(ns, isolation.hostAddresses));
+  } catch (error) {
+    fail(`Could not apply the egress policy to ${ns}: ${message(error).slice(0, 200)} ${RECHECK}`);
+  }
+}
+async function reconcileIsolation(ctx, desired, result) {
+  try {
+    await ensureBakeNamespace(ctx, desired);
+  } catch (error) {
+    result.warnings.push(
+      `Could not prepare the bake namespace ${PERSONAL_BAKE_NAMESPACE}: ${message(error)}`
+    );
+  }
+  const isolation = desired.isolation;
+  if (!isolation) {
+    result.isolation = void 0;
+    return;
+  }
+  const unknown = knownStance(isolation);
+  if (unknown) {
+    result.warnings.push(
+      `Conveyor asks for pod isolation this version of conveyor-k3 does not know (${unknown}), so nothing was changed and this server does not count as isolated. Run \`sudo conveyor-k3 update\`.`
+    );
+    result.isolation = { applied: false };
+    return;
+  }
+  let applied = true;
+  const fail = (warning) => {
+    applied = false;
+    result.warnings.push(warning);
+  };
+  const problem = await controllerProblem(ctx);
+  if (problem) fail(problem);
+  const hostAddresses = await readHostAddresses(ctx.exec);
+  if (hostAddresses === null) {
+    fail(
+      `Could not read every address this server answers on, so the egress policies in place were left as they are and this server does not count as isolated. ${RECHECK}`
+    );
+  }
+  for (const namespace of desired.namespaces) {
+    await isolateNamespace(ctx, namespace.name, { podSecurity: "baseline", hostAddresses }, fail);
+  }
+  await isolateNamespace(
+    ctx,
+    PERSONAL_BAKE_NAMESPACE,
+    { podSecurity: "privileged", hostAddresses },
+    fail
+  );
+  result.isolation = { applied };
+}
+
 // src/daemon/registry-tags.ts
 var REPO_NAME = /^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/;
 var TAG_NAME = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/;
@@ -8285,14 +8689,22 @@ async function collectHeartbeat(ports, state, inventory) {
     ...runnerUsers.length > 0 ? { runnerUsers } : {},
     ...localImages ? { localImages } : {},
     ...registry.fields,
-    localWarnings: [
+    ...state.isolation ? { isolation: state.isolation } : {},
+    localWarnings: withinHeartbeatBounds([
       ...state.localWarnings,
       ...gcWarning ? [gcWarning] : [],
       ...ungranted.length > 0 ? [ungrantedRunnersWarning(ungranted)] : [],
       ...registry.warnings
-    ]
+    ])
   };
 }
+var HEARTBEAT_LIST_MAX = 64;
+var HEARTBEAT_STRING_MAX = 512;
+function withinHeartbeatBounds(warnings) {
+  return warnings.slice(0, HEARTBEAT_LIST_MAX).map(
+    (warning) => warning.length > HEARTBEAT_STRING_MAX ? `${warning.slice(0, HEARTBEAT_STRING_MAX - 1)}\u2026` : warning
+  );
+}
 async function readPodIdentities(exec) {
   const result = await exec(
     "k3s",
@@ -8374,9 +8786,12 @@ async function runRegistryUpkeep(ports, lastGcAt, maintenanceHour) {
 }
 
 // src/daemon/reconcile.ts
-async function reconcileKubelet(ctx, desired, result) {
+function ownerRestartWarning(change) {
+  return `${change} Conveyor did not install this server's k3s, so it never restarts it: run \`sudo systemctl restart k3s\` when no build runs.`;
+}
+async function reconcileKubelet(ctx, desired, result, managed) {
   const ownerConfig = await ctx.fs.readFile(K3S_OWNER_CONFIG);
-  const rendered = renderK3sDropIn(desired.kubelet, ownerConfig);
+  const rendered = renderK3sDropIn(desired.kubelet, ownerConfig, { disableComponents: managed });
   result.skippedKubeletFlags = rendered.skipped;
   result.effectiveImageGcHighThreshold = rendered.skipped.includes("image-gc-high-threshold") ? ownerImageGcHighThreshold(ownerConfig) : desired.kubelet.imageGcHighThreshold;
   for (const flag of rendered.skipped) {
@@ -8392,6 +8807,10 @@ async function reconcileKubelet(ctx, desired, result) {
   if (current === rendered.content) return;
   await ctx.fs.ensureDir(K3S_CONFIG_DROPIN.slice(0, K3S_CONFIG_DROPIN.lastIndexOf("/")));
   await ctx.fs.writeFile(K3S_CONFIG_DROPIN, rendered.content, 420);
+  if (!managed) {
+    result.warnings.push(ownerRestartWarning("Kubelet settings changed."));
+    return;
+  }
   if (!mayDisrupt(ctx.runningConveyorPods)) {
     result.warnings.push(
       `Kubelet settings changed but ${busyReason(ctx.runningConveyorPods)} \u2014 the restart is deferred until the machine is idle.`
@@ -8442,43 +8861,6 @@ async function reconcilePriorityClass(ctx, desired, result) {
     );
   }
 }
-function renderLimitRange(namespace, limits) {
-  const ns = assertK8sName(namespace, "namespace");
-  const values = [
-    assertQuantity(limits.defaultRequest.cpu, "defaultRequest.cpu"),
-    assertQuantity(limits.defaultRequest.memory, "defaultRequest.memory"),
-    assertQuantity(limits.default.cpu, "default.cpu"),
-    assertQuantity(limits.default.memory, "default.memory")
-  ];
-  return [
-    "apiVersion: v1",
-    "kind: LimitRange",
-    "metadata:",
-    "  name: conveyor-k3-defaults",
-    `  namespace: ${ns}`,
-    "spec:",
-    "  limits:",
-    "  - type: Container",
-    "    defaultRequest:",
-    `      cpu: "${values[0]}"`,
-    `      memory: "${values[1]}"`,
-    "    default:",
-    `      cpu: "${values[2]}"`,
-    `      memory: "${values[3]}"`,
-    ""
-  ].join("\n");
-}
-async function reconcileNamespaces(ctx, desired, result) {
-  for (const namespace of desired.namespaces) {
-    try {
-      await kubectlApply(ctx.exec, renderLimitRange(namespace.name, namespace.limitRange));
-    } catch (error) {
-      result.warnings.push(
-        `Could not apply resource defaults to ${namespace.name} (${namespace.projectName}): ${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-  }
-}
 async function step(result, label, run) {
   try {
     await run();
@@ -8515,6 +8897,12 @@ async function reconcile(ctx, desired) {
     "Could not apply namespace defaults",
     () => reconcileNamespaces(ctx, desired, result)
   );
+  await step(
+    result,
+    "Could not apply pod isolation",
+    () => reconcileIsolation(ctx, desired, result)
+  );
+  if (desired.isolation && result.isolation === void 0) result.isolation = { applied: false };
   if (manifestAccepted) {
     await step(
       result,
@@ -8523,6 +8911,7 @@ async function reconcile(ctx, desired) {
     );
   }
   const registry = desired.localRegistry?.enabled === true;
+  const managed = managesK3s(desired, await readState(ctx.fs).catch(() => ({})));
   if (registry) {
     await step(result, "Could not reconcile the local image registry", async () => {
       await deployLocalRegistry(ctx);
@@ -8531,10 +8920,15 @@ async function reconcile(ctx, desired) {
   await step(
     result,
     "Could not apply kubelet settings",
-    () => reconcileKubelet(ctx, desired, result)
+    () => reconcileKubelet(ctx, desired, result, managed)
   );
   if (registry && !result.restartedK3s) {
     await step(result, "Could not load the local image registry mirror", async () => {
+      if (!managed) {
+        if (await registryMirrorPending(ctx.fs))
+          result.warnings.push(ownerRestartWarning("The local image registry's mirror is new."));
+        return;
+      }
       const loaded = await loadRegistryMirror(ctx);
       result.restartedK3s = loaded.restarted;
       if (loaded.warning) result.warnings.push(loaded.warning);
@@ -8547,6 +8941,8 @@ async function reconcile(ctx, desired) {
 var HOUR_MS2 = 60 * 6e4;
 var DAY_MS = 24 * HOUR_MS2;
 var STORE_MEASURE_INTERVAL_MS = 55 * 6e4;
+var ISOLATION_RETRY_FIRST_MS = 6e4;
+var ISOLATION_RETRY_MAX_MS = 10 * 6e4;
 var DISK_PRESSURE_FREE_FRACTION = 0.2;
 var STRANDED_PRUNE_BYTES = 20 * 1024 ** 3;
 function flattenWanted(desired) {
@@ -8587,12 +8983,22 @@ var ClusterDaemon = class {
   localImageHashes = /* @__PURE__ */ new Map();
   /** How long the in-cluster registry has been not ready, across beats. */
   registryWatch = { notReadySince: null };
+  /**
+   * Whether pod isolation is in force, from the last reconcile; undefined
+   * while desired state does not ask for it. Every heartbeat checks it again
+   * against k3s's own settings before reporting it.
+   */
+  isolation = void 0;
   timers = [];
   /** When the last store walk started, so one that failed is not retried on every reconcile. */
   storeWalkStartedAt = 0;
   /** Serializes reconcile against itself — a sync nudge during a reconcile
    *  must queue, not interleave two kubectl applies of the same manifests. */
   reconciling = null;
+  /** The run queued behind the running one, until it starts. At most one waits. */
+  queuedRun = null;
+  /** The next reconcile while pod isolation is not applied; `dueAt` 0 = none. */
+  isolationRetry = { delayMs: ISOLATION_RETRY_FIRST_MS, dueAt: 0 };
   constructor(ports) {
     this.ports = ports;
   }
@@ -8628,10 +9034,27 @@ var ClusterDaemon = class {
   }
   /** Fetch the desired state and converge to it. Queued, never concurrent. */
   syncAndReconcile() {
-    const run = (this.reconciling ?? Promise.resolve()).then(() => this.runReconcile());
+    if (this.queuedRun) return this.queuedRun;
+    const run = (this.reconciling ?? Promise.resolve()).then(() => {
+      this.queuedRun = null;
+      return this.runReconcile();
+    });
+    this.queuedRun = run;
     this.reconciling = run.catch(() => void 0);
     return run;
   }
+  /** Reconcile again later while pod isolation is not applied; stop once it is. */
+  scheduleIsolationRetry() {
+    if (this.isolation?.applied !== false) {
+      this.isolationRetry = { delayMs: ISOLATION_RETRY_FIRST_MS, dueAt: 0 };
+      return;
+    }
+    const { delayMs } = this.isolationRetry;
+    this.isolationRetry = {
+      delayMs: Math.min(delayMs * 2, ISOLATION_RETRY_MAX_MS),
+      dueAt: Date.now() + delayMs
+    };
+  }
   async runReconcile() {
     try {
       this.desired = await this.ports.connection.requestDesiredState();
@@ -8647,6 +9070,8 @@ var ClusterDaemon = class {
       this.desired
     );
     this.warnings = result.warnings;
+    this.isolation = result.isolation;
+    this.scheduleIsolationRetry();
     for (const warning of result.warnings) this.ports.log(warning);
     if (result.prunedNamespaces.length > 0) {
       this.ports.log(
@@ -8817,6 +9242,10 @@ var ClusterDaemon = class {
     const inventory = await readImageInventory(this.ports.exec).catch(() => null);
     const registryOn = this.desired?.localRegistry?.enabled === true;
     if (!registryOn) this.registryWatch.notReadySince = null;
+    const isolation = await recheckIsolation(
+      { exec: this.ports.exec, fs: this.ports.fs },
+      this.isolation
+    );
     return await collectHeartbeat(
       {
         exec: this.ports.exec,
@@ -8831,10 +9260,11 @@ var ClusterDaemon = class {
         lastPruneAt: this.state?.lastPruneAt ?? null,
         lastWarmAt: this.state?.lastWarmAt ?? null,
         lastUpdateAt: this.state?.lastUpdateAt ?? null,
-        localWarnings: [...this.warnings, ...this.warmWarnings],
+        localWarnings: [...this.warnings, ...this.warmWarnings, ...isolation.warnings],
         imageGcHighThreshold: this.effectiveImageGcHigh,
         localImageHashes: this.localImageHashes,
         ...registryOn ? { localRegistry: this.registryWatch } : {},
+        ...isolation.isolation ? { isolation: isolation.isolation } : {},
         k3sStoreBytes: this.measuredStoreBytes
       },
       inventory
@@ -8859,6 +9289,10 @@ var ClusterDaemon = class {
     return this.beating;
   }
   async runBeat() {
+    if (this.isolationRetry.dueAt > 0 && Date.now() >= this.isolationRetry.dueAt) {
+      this.isolationRetry.dueAt = 0;
+      void this.syncAndReconcile();
+    }
     try {
       const workloads = await this.ports.connection.sendHeartbeat({
         ...await this.buildHeartbeat(),
@@ -9017,6 +9451,7 @@ function createMemoryFileSystem(seed = {}) {
 // src/verbs.ts
 var VERBS = [
   "vm",
+  "host",
   "setup",
   "start",
   "stop",
@@ -9049,14 +9484,22 @@ function parseArgs(argv) {
   }
   return { verb, positional, flags };
 }
-var HELP = `conveyor-k3 \u2014 managed personal compute for Conveyor
+var HELP = `conveyor-k3 \u2014 Personal Compute for Conveyor
 
 Usage: conveyor-k3 <command> [options]
 
-Commands:
-  vm                    Manage isolated compute on macOS or Linux.
-                        Run conveyor-k3 vm for host lifecycle commands.
-  setup                 Install and enrol this machine. Safe to re-run.
+One product, two runtimes. Pick the one that fits the machine:
+
+On your computer or server:
+  vm                    Personal computer runtime: an isolated VM on macOS or
+                        Linux. Run conveyor-k3 vm for its commands.
+  host                  Dedicated server runtime: k3s and the daemon on this
+                        Linux machine, with no VM. Root only. Run
+                        conveyor-k3 host for its commands.
+
+Inside a linked machine (the VM guest, or the server itself):
+  setup                 VM guest only: install and enrol this machine. Safe
+                        to re-run. On a server, use conveyor-k3 host setup.
   start                 Start the tunnel and the daemon.
   stop                  Stop both, and tell Conveyor at once so your next
                         build goes straight to project compute.
@@ -9081,10 +9524,12 @@ Commands:
                         into this node and pin it. Writes one file under
                         /etc/sudoers.d, checked with visudo first. Needed only
                         when a project has Bake Locally turned on.
-  uninstall             Remove Conveyor's units, environment, state, and image
-                        registry. Your k3s config, your own registries.yaml
-                        entries, your workloads, and the registry's data are
-                        left alone.
+  uninstall             VM guest only: remove Conveyor's units, environment,
+                        state, and image registry. Your k3s config, your own
+                        registries.yaml entries, your workloads, and the
+                        registry's data are left alone. On a server, use
+                        conveyor-k3 host uninstall: it also removes the
+                        device key.
                           --purge-k3s --yes     also remove k3s itself and the
                                                 registry's data
   daemon                Run in the foreground (what the systemd unit calls).
@@ -9181,6 +9626,47 @@ async function removeLocalRegistry(ports) {
     `Removed the local image registry's mirror from ${REGISTRIES_FILE} (backup: ${backup}).`
   );
 }
+async function removeIsolation(ports) {
+  const [key, value] = Object.entries(MANAGED_BY2)[0] ?? [];
+  const removed = await ports.exec(
+    "k3s",
+    ["kubectl", "delete", "networkpolicy", "-A", "-l", `${key}=${value}`, "--ignore-not-found"],
+    { timeoutMs: 12e4 }
+  );
+  if (removed.exitCode !== 0) {
+    ports.log(
+      `Could not remove Conveyor's network policies: ${removed.stderr.trim().slice(0, 200)}`
+    );
+  }
+  const listed = await ports.exec("k3s", [
+    "kubectl",
+    "get",
+    "namespaces",
+    "-o",
+    "jsonpath={.items[*].metadata.name}"
+  ]);
+  if (listed.exitCode !== 0) {
+    ports.log(
+      `Could not list namespaces to remove Conveyor's Pod Security labels: ${listed.stderr.trim().slice(0, 200)}`
+    );
+    return;
+  }
+  const namespaces = listed.stdout.split(/\s+/).filter((name) => name.startsWith("claudespace-") || name === PERSONAL_BAKE_NAMESPACE);
+  for (const namespace of namespaces) {
+    const unlabelled = await ports.exec("k3s", [
+      "kubectl",
+      "label",
+      "namespace",
+      namespace,
+      ...PSA_LABEL_KEYS.map((labelKey) => `${labelKey}-`)
+    ]);
+    if (unlabelled.exitCode !== 0) {
+      ports.log(
+        `Could not remove Conveyor's Pod Security labels from ${namespace}: ${unlabelled.stderr.trim().slice(0, 200)}`
+      );
+    }
+  }
+}
 async function uninstall(ports, options = {}) {
   const result = { stoppedUnits: [], removedFiles: [], purgedK3s: false };
   if (options.purgeK3s && !options.confirmed) {
@@ -9193,6 +9679,7 @@ async function uninstall(ports, options = {}) {
     result.stoppedUnits.push(unit);
   }
   await removeLocalRegistry(ports);
+  await removeIsolation(ports);
   for (const path of OWNED_FILES) {
     await ports.fs.removeFile(path);
     result.removedFiles.push(path);
@@ -9259,12 +9746,6 @@ function readExecStart(unit) {
   }
   return collected.join(" ");
 }
-function bareToken(token) {
-  let bare = token.trim();
-  if (bare.endsWith("\\")) bare = bare.slice(0, -1).trim();
-  if (bare.length >= 2 && bare.startsWith("'") && bare.endsWith("'")) bare = bare.slice(1, -1);
-  return bare;
-}
 function parseForeignExecFlags(execStart) {
   const ours = new Set(K3S_INSTALL_EXEC.split(/\s+/).filter((token) => token.startsWith("--")));
   const foreign = [];
@@ -9284,6 +9765,12 @@ async function foreignK3sExecFlags(exec) {
   return parseForeignExecFlags(readExecStart(unit.stdout));
 }
 function decideK3sUpgrade(input) {
+  if (input.managesK3s === false) {
+    return {
+      upgrade: false,
+      reason: "Conveyor did not install this server's k3s, so its owner upgrades it"
+    };
+  }
   if (!input.autoUpgradeK3s) {
     return { upgrade: false, reason: "automatic k3s upgrades are turned off for this machine" };
   }