@rallycry/conveyor-k3 0.1.12 → 0.1.14

package/dist/index.js

@@ -101,7 +101,7 @@ function createClusterProof(apiUrl, clusterToken, key) {
   const origin = new URL(apiUrl).origin;
   const timestamp = Date.now();
   const nonce = randomBytes(32).toString("base64url");
-  const message = `conveyor-device-v1
+  const message2 = `conveyor-device-v1
 ${origin}
 ${clusterToken}
 ${timestamp}
@@ -109,7 +109,7 @@ ${nonce}`;
   return {
     timestamp,
     nonce,
-    signature: sign(null, Buffer.from(message, "utf8"), key).toString("base64url")
+    signature: sign(null, Buffer.from(message2, "utf8"), key).toString("base64url")
   };
 }
 function deviceClusterAuth(apiUrl, clusterToken, keyPath = DEVICE_KEY_PATH, ownerUid = 0) {
@@ -487,104 +487,104 @@ ZodError.create = (issues) => {
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/locales/en.js
 var errorMap = (issue, _ctx) => {
-  let message;
+  let message2;
   switch (issue.code) {
     case ZodIssueCode.invalid_type:
       if (issue.received === ZodParsedType.undefined) {
-        message = "Required";
+        message2 = "Required";
       } else {
-        message = `Expected ${issue.expected}, received ${issue.received}`;
+        message2 = `Expected ${issue.expected}, received ${issue.received}`;
       }
       break;
     case ZodIssueCode.invalid_literal:
-      message = `Invalid literal value, expected ${JSON.stringify(issue.expected, util.jsonStringifyReplacer)}`;
+      message2 = `Invalid literal value, expected ${JSON.stringify(issue.expected, util.jsonStringifyReplacer)}`;
       break;
     case ZodIssueCode.unrecognized_keys:
-      message = `Unrecognized key(s) in object: ${util.joinValues(issue.keys, ", ")}`;
+      message2 = `Unrecognized key(s) in object: ${util.joinValues(issue.keys, ", ")}`;
       break;
     case ZodIssueCode.invalid_union:
-      message = `Invalid input`;
+      message2 = `Invalid input`;
       break;
     case ZodIssueCode.invalid_union_discriminator:
-      message = `Invalid discriminator value. Expected ${util.joinValues(issue.options)}`;
+      message2 = `Invalid discriminator value. Expected ${util.joinValues(issue.options)}`;
       break;
     case ZodIssueCode.invalid_enum_value:
-      message = `Invalid enum value. Expected ${util.joinValues(issue.options)}, received '${issue.received}'`;
+      message2 = `Invalid enum value. Expected ${util.joinValues(issue.options)}, received '${issue.received}'`;
       break;
     case ZodIssueCode.invalid_arguments:
-      message = `Invalid function arguments`;
+      message2 = `Invalid function arguments`;
       break;
     case ZodIssueCode.invalid_return_type:
-      message = `Invalid function return type`;
+      message2 = `Invalid function return type`;
       break;
     case ZodIssueCode.invalid_date:
-      message = `Invalid date`;
+      message2 = `Invalid date`;
       break;
     case ZodIssueCode.invalid_string:
       if (typeof issue.validation === "object") {
         if ("includes" in issue.validation) {
-          message = `Invalid input: must include "${issue.validation.includes}"`;
+          message2 = `Invalid input: must include "${issue.validation.includes}"`;
           if (typeof issue.validation.position === "number") {
-            message = `${message} at one or more positions greater than or equal to ${issue.validation.position}`;
+            message2 = `${message2} at one or more positions greater than or equal to ${issue.validation.position}`;
           }
         } else if ("startsWith" in issue.validation) {
-          message = `Invalid input: must start with "${issue.validation.startsWith}"`;
+          message2 = `Invalid input: must start with "${issue.validation.startsWith}"`;
         } else if ("endsWith" in issue.validation) {
-          message = `Invalid input: must end with "${issue.validation.endsWith}"`;
+          message2 = `Invalid input: must end with "${issue.validation.endsWith}"`;
         } else {
           util.assertNever(issue.validation);
         }
       } else if (issue.validation !== "regex") {
-        message = `Invalid ${issue.validation}`;
+        message2 = `Invalid ${issue.validation}`;
       } else {
-        message = "Invalid";
+        message2 = "Invalid";
       }
       break;
     case ZodIssueCode.too_small:
       if (issue.type === "array")
-        message = `Array must contain ${issue.exact ? "exactly" : issue.inclusive ? `at least` : `more than`} ${issue.minimum} element(s)`;
+        message2 = `Array must contain ${issue.exact ? "exactly" : issue.inclusive ? `at least` : `more than`} ${issue.minimum} element(s)`;
       else if (issue.type === "string")
-        message = `String must contain ${issue.exact ? "exactly" : issue.inclusive ? `at least` : `over`} ${issue.minimum} character(s)`;
+        message2 = `String must contain ${issue.exact ? "exactly" : issue.inclusive ? `at least` : `over`} ${issue.minimum} character(s)`;
       else if (issue.type === "number")
-        message = `Number must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${issue.minimum}`;
+        message2 = `Number must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${issue.minimum}`;
       else if (issue.type === "bigint")
-        message = `Number must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${issue.minimum}`;
+        message2 = `Number must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${issue.minimum}`;
       else if (issue.type === "date")
-        message = `Date must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${new Date(Number(issue.minimum))}`;
+        message2 = `Date must be ${issue.exact ? `exactly equal to ` : issue.inclusive ? `greater than or equal to ` : `greater than `}${new Date(Number(issue.minimum))}`;
       else
-        message = "Invalid input";
+        message2 = "Invalid input";
       break;
     case ZodIssueCode.too_big:
       if (issue.type === "array")
-        message = `Array must contain ${issue.exact ? `exactly` : issue.inclusive ? `at most` : `less than`} ${issue.maximum} element(s)`;
+        message2 = `Array must contain ${issue.exact ? `exactly` : issue.inclusive ? `at most` : `less than`} ${issue.maximum} element(s)`;
       else if (issue.type === "string")
-        message = `String must contain ${issue.exact ? `exactly` : issue.inclusive ? `at most` : `under`} ${issue.maximum} character(s)`;
+        message2 = `String must contain ${issue.exact ? `exactly` : issue.inclusive ? `at most` : `under`} ${issue.maximum} character(s)`;
       else if (issue.type === "number")
-        message = `Number must be ${issue.exact ? `exactly` : issue.inclusive ? `less than or equal to` : `less than`} ${issue.maximum}`;
+        message2 = `Number must be ${issue.exact ? `exactly` : issue.inclusive ? `less than or equal to` : `less than`} ${issue.maximum}`;
       else if (issue.type === "bigint")
-        message = `BigInt must be ${issue.exact ? `exactly` : issue.inclusive ? `less than or equal to` : `less than`} ${issue.maximum}`;
+        message2 = `BigInt must be ${issue.exact ? `exactly` : issue.inclusive ? `less than or equal to` : `less than`} ${issue.maximum}`;
       else if (issue.type === "date")
-        message = `Date must be ${issue.exact ? `exactly` : issue.inclusive ? `smaller than or equal to` : `smaller than`} ${new Date(Number(issue.maximum))}`;
+        message2 = `Date must be ${issue.exact ? `exactly` : issue.inclusive ? `smaller than or equal to` : `smaller than`} ${new Date(Number(issue.maximum))}`;
       else
-        message = "Invalid input";
+        message2 = "Invalid input";
       break;
     case ZodIssueCode.custom:
-      message = `Invalid input`;
+      message2 = `Invalid input`;
       break;
     case ZodIssueCode.invalid_intersection_types:
-      message = `Intersection results could not be merged`;
+      message2 = `Intersection results could not be merged`;
       break;
     case ZodIssueCode.not_multiple_of:
-      message = `Number must be a multiple of ${issue.multipleOf}`;
+      message2 = `Number must be a multiple of ${issue.multipleOf}`;
       break;
     case ZodIssueCode.not_finite:
-      message = "Number must be finite";
+      message2 = "Number must be finite";
       break;
     default:
-      message = _ctx.defaultError;
+      message2 = _ctx.defaultError;
       util.assertNever(issue);
   }
-  return { message };
+  return { message: message2 };
 };
 var en_default = errorMap;
 
@@ -710,8 +710,8 @@ var isAsync = (x) => typeof Promise !== "undefined" && x instanceof Promise;
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/helpers/errorUtil.js
 var errorUtil;
 (function(errorUtil2) {
-  errorUtil2.errToObj = (message) => typeof message === "string" ? { message } : message || {};
-  errorUtil2.toString = (message) => typeof message === "string" ? message : message?.message;
+  errorUtil2.errToObj = (message2) => typeof message2 === "string" ? { message: message2 } : message2 || {};
+  errorUtil2.toString = (message2) => typeof message2 === "string" ? message2 : message2?.message;
 })(errorUtil || (errorUtil = {}));
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/types.js
@@ -763,16 +763,16 @@ function processCreateParams(params) {
   if (errorMap2)
     return { errorMap: errorMap2, description };
   const customMap = (iss, ctx) => {
-    const { message } = params;
+    const { message: message2 } = params;
     if (iss.code === "invalid_enum_value") {
-      return { message: message ?? ctx.defaultError };
+      return { message: message2 ?? ctx.defaultError };
     }
     if (typeof ctx.data === "undefined") {
-      return { message: message ?? required_error ?? ctx.defaultError };
+      return { message: message2 ?? required_error ?? ctx.defaultError };
     }
     if (iss.code !== "invalid_type")
       return { message: ctx.defaultError };
-    return { message: message ?? invalid_type_error ?? ctx.defaultError };
+    return { message: message2 ?? invalid_type_error ?? ctx.defaultError };
   };
   return { errorMap: customMap, description };
 }
@@ -898,14 +898,14 @@ var ZodType = class {
     const result = await (isAsync(maybeAsyncResult) ? maybeAsyncResult : Promise.resolve(maybeAsyncResult));
     return handleResult(ctx, result);
   }
-  refine(check, message) {
+  refine(check, message2) {
     const getIssueProperties = (val) => {
-      if (typeof message === "string" || typeof message === "undefined") {
-        return { message };
-      } else if (typeof message === "function") {
-        return message(val);
+      if (typeof message2 === "string" || typeof message2 === "undefined") {
+        return { message: message2 };
+      } else if (typeof message2 === "function") {
+        return message2(val);
       } else {
-        return message;
+        return message2;
       }
     };
     return this._refinement((val, ctx) => {
@@ -1441,11 +1441,11 @@ var ZodString = class _ZodString extends ZodType {
     }
     return { status: status.value, value: input.data };
   }
-  _regex(regex, validation, message) {
+  _regex(regex, validation, message2) {
     return this.refinement((data) => regex.test(data), {
       validation,
       code: ZodIssueCode.invalid_string,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
   _addCheck(check) {
@@ -1454,37 +1454,37 @@ var ZodString = class _ZodString extends ZodType {
       checks: [...this._def.checks, check]
     });
   }
-  email(message) {
-    return this._addCheck({ kind: "email", ...errorUtil.errToObj(message) });
+  email(message2) {
+    return this._addCheck({ kind: "email", ...errorUtil.errToObj(message2) });
   }
-  url(message) {
-    return this._addCheck({ kind: "url", ...errorUtil.errToObj(message) });
+  url(message2) {
+    return this._addCheck({ kind: "url", ...errorUtil.errToObj(message2) });
   }
-  emoji(message) {
-    return this._addCheck({ kind: "emoji", ...errorUtil.errToObj(message) });
+  emoji(message2) {
+    return this._addCheck({ kind: "emoji", ...errorUtil.errToObj(message2) });
   }
-  uuid(message) {
-    return this._addCheck({ kind: "uuid", ...errorUtil.errToObj(message) });
+  uuid(message2) {
+    return this._addCheck({ kind: "uuid", ...errorUtil.errToObj(message2) });
   }
-  nanoid(message) {
-    return this._addCheck({ kind: "nanoid", ...errorUtil.errToObj(message) });
+  nanoid(message2) {
+    return this._addCheck({ kind: "nanoid", ...errorUtil.errToObj(message2) });
   }
-  cuid(message) {
-    return this._addCheck({ kind: "cuid", ...errorUtil.errToObj(message) });
+  cuid(message2) {
+    return this._addCheck({ kind: "cuid", ...errorUtil.errToObj(message2) });
   }
-  cuid2(message) {
-    return this._addCheck({ kind: "cuid2", ...errorUtil.errToObj(message) });
+  cuid2(message2) {
+    return this._addCheck({ kind: "cuid2", ...errorUtil.errToObj(message2) });
   }
-  ulid(message) {
-    return this._addCheck({ kind: "ulid", ...errorUtil.errToObj(message) });
+  ulid(message2) {
+    return this._addCheck({ kind: "ulid", ...errorUtil.errToObj(message2) });
   }
-  base64(message) {
-    return this._addCheck({ kind: "base64", ...errorUtil.errToObj(message) });
+  base64(message2) {
+    return this._addCheck({ kind: "base64", ...errorUtil.errToObj(message2) });
   }
-  base64url(message) {
+  base64url(message2) {
     return this._addCheck({
       kind: "base64url",
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
   jwt(options) {
@@ -1514,8 +1514,8 @@ var ZodString = class _ZodString extends ZodType {
       ...errorUtil.errToObj(options?.message)
     });
   }
-  date(message) {
-    return this._addCheck({ kind: "date", message });
+  date(message2) {
+    return this._addCheck({ kind: "date", message: message2 });
   }
   time(options) {
     if (typeof options === "string") {
@@ -1531,14 +1531,14 @@ var ZodString = class _ZodString extends ZodType {
       ...errorUtil.errToObj(options?.message)
     });
   }
-  duration(message) {
-    return this._addCheck({ kind: "duration", ...errorUtil.errToObj(message) });
+  duration(message2) {
+    return this._addCheck({ kind: "duration", ...errorUtil.errToObj(message2) });
   }
-  regex(regex, message) {
+  regex(regex, message2) {
     return this._addCheck({
       kind: "regex",
       regex,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
   includes(value, options) {
@@ -1549,46 +1549,46 @@ var ZodString = class _ZodString extends ZodType {
       ...errorUtil.errToObj(options?.message)
     });
   }
-  startsWith(value, message) {
+  startsWith(value, message2) {
     return this._addCheck({
       kind: "startsWith",
       value,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
-  endsWith(value, message) {
+  endsWith(value, message2) {
     return this._addCheck({
       kind: "endsWith",
       value,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
-  min(minLength, message) {
+  min(minLength, message2) {
     return this._addCheck({
       kind: "min",
       value: minLength,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
-  max(maxLength, message) {
+  max(maxLength, message2) {
     return this._addCheck({
       kind: "max",
       value: maxLength,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
-  length(len, message) {
+  length(len, message2) {
     return this._addCheck({
       kind: "length",
       value: len,
-      ...errorUtil.errToObj(message)
+      ...errorUtil.errToObj(message2)
     });
   }
   /**
    * Equivalent to `.min(1)`
    */
-  nonempty(message) {
-    return this.min(1, errorUtil.errToObj(message));
+  nonempty(message2) {
+    return this.min(1, errorUtil.errToObj(message2));
   }
   trim() {
     return new _ZodString({
@@ -1781,19 +1781,19 @@ var ZodNumber = class _ZodNumber extends ZodType {
     }
     return { status: status.value, value: input.data };
   }
-  gte(value, message) {
-    return this.setLimit("min", value, true, errorUtil.toString(message));
+  gte(value, message2) {
+    return this.setLimit("min", value, true, errorUtil.toString(message2));
   }
-  gt(value, message) {
-    return this.setLimit("min", value, false, errorUtil.toString(message));
+  gt(value, message2) {
+    return this.setLimit("min", value, false, errorUtil.toString(message2));
   }
-  lte(value, message) {
-    return this.setLimit("max", value, true, errorUtil.toString(message));
+  lte(value, message2) {
+    return this.setLimit("max", value, true, errorUtil.toString(message2));
   }
-  lt(value, message) {
-    return this.setLimit("max", value, false, errorUtil.toString(message));
+  lt(value, message2) {
+    return this.setLimit("max", value, false, errorUtil.toString(message2));
   }
-  setLimit(kind, value, inclusive, message) {
+  setLimit(kind, value, inclusive, message2) {
     return new _ZodNumber({
       ...this._def,
       checks: [
@@ -1802,7 +1802,7 @@ var ZodNumber = class _ZodNumber extends ZodType {
           kind,
           value,
           inclusive,
-          message: errorUtil.toString(message)
+          message: errorUtil.toString(message2)
         }
       ]
     });
@@ -1813,68 +1813,68 @@ var ZodNumber = class _ZodNumber extends ZodType {
       checks: [...this._def.checks, check]
     });
   }
-  int(message) {
+  int(message2) {
     return this._addCheck({
       kind: "int",
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  positive(message) {
+  positive(message2) {
     return this._addCheck({
       kind: "min",
       value: 0,
       inclusive: false,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  negative(message) {
+  negative(message2) {
     return this._addCheck({
       kind: "max",
       value: 0,
       inclusive: false,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  nonpositive(message) {
+  nonpositive(message2) {
     return this._addCheck({
       kind: "max",
       value: 0,
       inclusive: true,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  nonnegative(message) {
+  nonnegative(message2) {
     return this._addCheck({
       kind: "min",
       value: 0,
       inclusive: true,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  multipleOf(value, message) {
+  multipleOf(value, message2) {
     return this._addCheck({
       kind: "multipleOf",
       value,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  finite(message) {
+  finite(message2) {
     return this._addCheck({
       kind: "finite",
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  safe(message) {
+  safe(message2) {
     return this._addCheck({
       kind: "min",
       inclusive: true,
       value: Number.MIN_SAFE_INTEGER,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     })._addCheck({
       kind: "max",
       inclusive: true,
       value: Number.MAX_SAFE_INTEGER,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
   get minValue() {
@@ -1997,19 +1997,19 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
     });
     return INVALID;
   }
-  gte(value, message) {
-    return this.setLimit("min", value, true, errorUtil.toString(message));
+  gte(value, message2) {
+    return this.setLimit("min", value, true, errorUtil.toString(message2));
   }
-  gt(value, message) {
-    return this.setLimit("min", value, false, errorUtil.toString(message));
+  gt(value, message2) {
+    return this.setLimit("min", value, false, errorUtil.toString(message2));
   }
-  lte(value, message) {
-    return this.setLimit("max", value, true, errorUtil.toString(message));
+  lte(value, message2) {
+    return this.setLimit("max", value, true, errorUtil.toString(message2));
   }
-  lt(value, message) {
-    return this.setLimit("max", value, false, errorUtil.toString(message));
+  lt(value, message2) {
+    return this.setLimit("max", value, false, errorUtil.toString(message2));
   }
-  setLimit(kind, value, inclusive, message) {
+  setLimit(kind, value, inclusive, message2) {
     return new _ZodBigInt({
       ...this._def,
       checks: [
@@ -2018,7 +2018,7 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
           kind,
           value,
           inclusive,
-          message: errorUtil.toString(message)
+          message: errorUtil.toString(message2)
         }
       ]
     });
@@ -2029,43 +2029,43 @@ var ZodBigInt = class _ZodBigInt extends ZodType {
       checks: [...this._def.checks, check]
     });
   }
-  positive(message) {
+  positive(message2) {
     return this._addCheck({
       kind: "min",
       value: BigInt(0),
       inclusive: false,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  negative(message) {
+  negative(message2) {
     return this._addCheck({
       kind: "max",
       value: BigInt(0),
       inclusive: false,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  nonpositive(message) {
+  nonpositive(message2) {
     return this._addCheck({
       kind: "max",
       value: BigInt(0),
       inclusive: true,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  nonnegative(message) {
+  nonnegative(message2) {
     return this._addCheck({
       kind: "min",
       value: BigInt(0),
       inclusive: true,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  multipleOf(value, message) {
+  multipleOf(value, message2) {
     return this._addCheck({
       kind: "multipleOf",
       value,
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
   get minValue() {
@@ -2188,18 +2188,18 @@ var ZodDate = class _ZodDate extends ZodType {
       checks: [...this._def.checks, check]
     });
   }
-  min(minDate, message) {
+  min(minDate, message2) {
     return this._addCheck({
       kind: "min",
       value: minDate.getTime(),
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
-  max(maxDate, message) {
+  max(maxDate, message2) {
     return this._addCheck({
       kind: "max",
       value: maxDate.getTime(),
-      message: errorUtil.toString(message)
+      message: errorUtil.toString(message2)
     });
   }
   get minDate() {
@@ -2431,26 +2431,26 @@ var ZodArray = class _ZodArray extends ZodType {
   get element() {
     return this._def.type;
   }
-  min(minLength, message) {
+  min(minLength, message2) {
     return new _ZodArray({
       ...this._def,
-      minLength: { value: minLength, message: errorUtil.toString(message) }
+      minLength: { value: minLength, message: errorUtil.toString(message2) }
     });
   }
-  max(maxLength, message) {
+  max(maxLength, message2) {
     return new _ZodArray({
       ...this._def,
-      maxLength: { value: maxLength, message: errorUtil.toString(message) }
+      maxLength: { value: maxLength, message: errorUtil.toString(message2) }
     });
   }
-  length(len, message) {
+  length(len, message2) {
     return new _ZodArray({
       ...this._def,
-      exactLength: { value: len, message: errorUtil.toString(message) }
+      exactLength: { value: len, message: errorUtil.toString(message2) }
     });
   }
-  nonempty(message) {
-    return this.min(1, message);
+  nonempty(message2) {
+    return this.min(1, message2);
   }
 };
 ZodArray.create = (schema, params) => {
@@ -2593,17 +2593,17 @@ var ZodObject = class _ZodObject extends ZodType {
   get shape() {
     return this._def.shape();
   }
-  strict(message) {
+  strict(message2) {
     errorUtil.errToObj;
     return new _ZodObject({
       ...this._def,
       unknownKeys: "strict",
-      ...message !== void 0 ? {
+      ...message2 !== void 0 ? {
         errorMap: (issue, ctx) => {
           const defaultError = this._def.errorMap?.(issue, ctx).message ?? ctx.defaultError;
           if (issue.code === "unrecognized_keys")
             return {
-              message: errorUtil.errToObj(message).message ?? defaultError
+              message: errorUtil.errToObj(message2).message ?? defaultError
             };
           return {
             message: defaultError
@@ -3359,23 +3359,23 @@ var ZodSet = class _ZodSet extends ZodType {
       return finalizeSet(elements);
     }
   }
-  min(minSize, message) {
+  min(minSize, message2) {
     return new _ZodSet({
       ...this._def,
-      minSize: { value: minSize, message: errorUtil.toString(message) }
+      minSize: { value: minSize, message: errorUtil.toString(message2) }
     });
   }
-  max(maxSize, message) {
+  max(maxSize, message2) {
     return new _ZodSet({
       ...this._def,
-      maxSize: { value: maxSize, message: errorUtil.toString(message) }
+      maxSize: { value: maxSize, message: errorUtil.toString(message2) }
     });
   }
-  size(size, message) {
-    return this.min(size, message).max(size, message);
+  size(size, message2) {
+    return this.min(size, message2).max(size, message2);
   }
-  nonempty(message) {
-    return this.min(1, message);
+  nonempty(message2) {
+    return this.min(1, message2);
   }
 };
 ZodSet.create = (valueType, params) => {
@@ -4162,7 +4162,7 @@ var coerce = {
 };
 var NEVER = INVALID;
 
-// ../shared/dist/chunk-BH4SLNGU.js
+// ../shared/dist/chunk-VSUBG7GR.js
 var DEFAULT_SONNET_MODEL = "claude-sonnet-5-5";
 var DEFAULT_OPUS_MODEL = "claude-opus-5-5";
 var DEFAULT_HAIKU_MODEL = "claude-haiku-4-5-20251001";
@@ -4356,6 +4356,15 @@ var ALLOWED_FILE_ACCEPT = [
 var EMBED_THRESHOLD_IMAGES = 5 * 1024 * 1024;
 var EMBED_THRESHOLD_TEXT = 2 * 1024 * 1024;
 var IDLE_HEARTBEAT_MS = 90 * 1e3;
+var siteAssetExtension = external_exports.string().regex(/^[a-z0-9]{1,10}$/);
+var RequestSiteAssetUploadRequestSchema = external_exports.object({
+  projectId: external_exports.string(),
+  siteId: external_exports.string().min(1).max(100),
+  sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  ext: siteAssetExtension,
+  sizeBytes: external_exports.number().int().positive()
+});
+var ListSiteAssetTargetsRequestSchema = external_exports.object({ projectId: external_exports.string() });
 var TurnEndToolCallSchema = external_exports.object({
   tool: external_exports.string(),
   input: external_exports.string().optional(),
@@ -4780,7 +4789,8 @@ var DiscoveredPortSchema = external_exports.object({
   port: external_exports.number().int().min(1).max(65535),
   label: external_exports.string().min(1).max(64).optional(),
   protocol: external_exports.enum(["http", "tcp"]).optional(),
-  detectedAt: external_exports.string()
+  detectedAt: external_exports.string(),
+  hidden: external_exports.boolean().optional()
 });
 var ReportDiscoveredPortsRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
@@ -4927,7 +4937,11 @@ var SubmitCodeReviewResultRequestSchema = external_exports.object({
 var CycleCodingAgentKeyRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
   rateLimitType: external_exports.string(),
-  resetsAt: external_exports.string().optional()
+  resetsAt: external_exports.string().optional(),
+  // The key the pod is actually running (CONVEYOR_CODING_AGENT_KEY_ID). Wins
+  // over the session's attribution stamp after owner validation; optional so
+  // older agents keep the session fallback.
+  codingAgentKeyId: external_exports.string().optional()
 });
 var PostChildChatMessageRequestSchema = external_exports.object({
   sessionId: external_exports.string(),
@@ -5341,11 +5355,12 @@ var QueryProjectGcpLogsRequestSchema = external_exports.object({
   sqlInstances: external_exports.array(external_exports.string().min(1).max(200)).max(25).optional(),
   allServices: external_exports.boolean().optional(),
   search: external_exports.string().max(256).optional(),
-  filter: external_exports.string().max(1e3).optional(),
+  filter: external_exports.string().max(2e3).optional(),
   startTime: external_exports.string().optional(),
   endTime: external_exports.string().optional(),
   limit: external_exports.number().int().min(1).max(200).optional().default(50),
-  pageToken: external_exports.string().max(4096).optional()
+  pageToken: external_exports.string().max(4096).optional(),
+  full: external_exports.boolean().optional()
 });
 var QueryProjectGrafanaLogsRequestSchema = external_exports.object({
   projectId: external_exports.string(),
@@ -6260,6 +6275,8 @@ var ANTHROPIC_CATALOG = [
   anthropicEntry(DEFAULT_HAIKU_MODEL, "Haiku 4.5", 1, 5, { supportsEffort: false }),
   anthropicEntry(FABLE_MODEL, "Fable 5.1", 10, 50)
 ];
+var PROJECT_ARCHIVE_RETENTION_DAYS = 30;
+var RETENTION_MS = PROJECT_ARCHIVE_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
 var CLAUDESPACE_WORKLOAD_LABEL = "rc-workload";
 var CLAUDESPACE_WORKLOAD_VALUE = "claudespace";
 var CONVEYOR_POD_SELECTOR = `${CLAUDESPACE_WORKLOAD_LABEL}=${CLAUDESPACE_WORKLOAD_VALUE}`;
@@ -6286,10 +6303,13 @@ var PERSONAL_LOCAL_REGISTRY_NAME = "conveyor-registry";
 var PERSONAL_LOCAL_REGISTRY_PORT = 5e3;
 var PERSONAL_LOCAL_REGISTRY_HOST = `${PERSONAL_LOCAL_REGISTRY_NAME}.${PERSONAL_LOCAL_REGISTRY_NAMESPACE}.svc.cluster.local:${PERSONAL_LOCAL_REGISTRY_PORT}`;
 var PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT = `http://127.0.0.1:${PERSONAL_LOCAL_REGISTRY_PORT}`;
+var PERSONAL_LOCAL_REGISTRY_PUSH_SECRET = "conveyor-registry-push";
+var PERSONAL_LOCAL_REGISTRY_PUSH_SECRET_KEY = "config.json";
 var BAKE_COMPONENT_LABEL = "claudespace.rallycry.com/component";
 var BAKE_COMPONENT_PREBAKE = "prebake";
 var BAKE_COMPONENT_STATE_BAKE = "state-bake";
 var BAKE_COMPONENT_VALUES = [BAKE_COMPONENT_PREBAKE, BAKE_COMPONENT_STATE_BAKE];
+var PERSONAL_BAKE_NAMESPACE = "conveyor-bakes";
 var MS_PER_DAY = 24 * 60 * 60 * 1e3;
 var POSTGRES_ENV = {
   POSTGRES_HOST_AUTH_METHOD: "trust",
@@ -6608,6 +6628,8 @@ var REPORT_CARD_TYPES = surfaceTypes("report");
 var DECISION_CARD_TYPES = surfaceTypes("decision");
 
 // src/daemon/connection.ts
+var REDIAL_FIRST_MS = 5e3;
+var REDIAL_MAX_MS = 5 * 6e4;
 function unwrap(ack, what) {
   if (!ack?.ok || ack.data === void 0) {
     throw new Error(`${what} failed: ${ack?.error ?? "no response"}`);
@@ -6617,6 +6639,8 @@ function unwrap(ack, what) {
 var ClusterConnection = class {
   socket = null;
   config;
+  redialDelayMs = REDIAL_FIRST_MS;
+  redialTimer = null;
   /** Called when Conveyor says the desired state changed. */
   onSyncRequested = null;
   /** Called when Conveyor asks the machine to remove itself. */
@@ -6652,6 +6676,7 @@ var ClusterConnection = class {
       });
       this.socket = socket;
       socket.on("connect", () => {
+        this.redialDelayMs = REDIAL_FIRST_MS;
         if (!settled) {
           settled = true;
           resolve();
@@ -6670,6 +6695,9 @@ var ClusterConnection = class {
       socket.on("disconnect", (reason) => {
         process.stderr.write(`[conveyor-k3] disconnected: ${reason}
 `);
+        if (reason === "io server disconnect" && this.config.reconnectWhenReplaced) {
+          this.redial(socket);
+        }
       });
       socket.on(PERSONAL_CLUSTER_EVENTS.syncRequested, () => {
         this.onSyncRequested?.();
@@ -6731,7 +6759,20 @@ var ClusterConnection = class {
     } catch {
     }
   }
+  /** Dial again after the server closed the socket, waiting longer each time. */
+  redial(socket) {
+    if (this.redialTimer) return;
+    const delay = this.redialDelayMs;
+    this.redialDelayMs = Math.min(delay * 2, REDIAL_MAX_MS);
+    this.redialTimer = setTimeout(() => {
+      this.redialTimer = null;
+      if (this.socket === socket && !socket.connected) socket.connect();
+    }, delay);
+    this.redialTimer.unref?.();
+  }
   disconnect() {
+    if (this.redialTimer) clearTimeout(this.redialTimer);
+    this.redialTimer = null;
     this.socket?.disconnect();
     this.socket = null;
   }
@@ -6929,14 +6970,22 @@ async function readImageInventory(exec) {
   }
   return { images, referencedIds };
 }
+var CRICTL_RMI_TIMEOUT = "120s";
+var RMI_EXEC_TIMEOUT_MS = 15e4;
+var DEADLINE_EXCEEDED = "context deadline exceeded";
 async function pruneStrandedImages(exec, inventory, wantedImages) {
   const candidates = selectStrandedImages(inventory, wantedImages);
-  const result = { removed: 0, bytesReclaimed: 0, failures: [] };
+  const result = { removed: 0, bytesReclaimed: 0, failures: [], pending: [] };
   for (const candidate of candidates) {
-    const removal = await exec("crictl", ["rmi", candidate.id]);
+    const removal = await exec("crictl", ["--timeout", CRICTL_RMI_TIMEOUT, "rmi", candidate.id], {
+      timeoutMs: RMI_EXEC_TIMEOUT_MS
+    });
     if (removal.exitCode === 0) {
       result.removed += 1;
       result.bytesReclaimed += candidate.sizeBytes;
+    } else if (`${removal.stderr}
+${removal.stdout}`.includes(DEADLINE_EXCEEDED)) {
+      result.pending.push(candidate.id);
     } else {
       result.failures.push(`${candidate.id}: ${removal.stderr.trim().slice(0, 120)}`);
     }
@@ -7046,6 +7095,8 @@ var STATE_DIR = "/var/lib/conveyor-k3";
 var STATE_FILE = `${STATE_DIR}/state.json`;
 var LOCAL_REGISTRY_DATA_DIR = `${STATE_DIR}/registry`;
 var LOCAL_REGISTRY_MIRROR_RESTART_FILE = `${STATE_DIR}/registry-mirror-restart`;
+var LOCAL_REGISTRY_CREDENTIALS_FILE = `${STATE_DIR}/registry-credentials.json`;
+var LOCAL_REGISTRY_AUTH_STATE_FILE = `${STATE_DIR}/registry-auth.json`;
 var RANCHER_DIR = "/etc/rancher/k3s";
 var K3S_OWNER_CONFIG = `${RANCHER_DIR}/config.yaml`;
 var K3S_CONFIG_DROPIN_DIR = `${RANCHER_DIR}/config.yaml.d`;
@@ -7095,6 +7146,16 @@ function upsertRegistryAuth(file, host, auth) {
   next.configs = configs;
   return next;
 }
+function removeRegistryAuth(file, host) {
+  const existing = file.configs?.[host];
+  if (!existing?.auth) return file;
+  const { auth: _auth, ...rest } = existing;
+  const { [host]: _removed, ...others } = file.configs ?? {};
+  const configs = Object.keys(rest).length > 0 ? { ...others, [host]: rest } : others;
+  const next = { ...file, configs };
+  if (Object.keys(configs).length === 0) delete next.configs;
+  return next;
+}
 function mirrorEndpoints(file, host) {
   const entry = file.mirrors?.[host];
   if (!entry || typeof entry !== "object" || Array.isArray(entry)) return [];
@@ -7147,6 +7208,88 @@ async function writeState(fs, state) {
   await fs.writeFile(STATE_FILE, `${JSON.stringify(state, null, 2)}
 `, 384);
 }
+function managesK3s(desired, state) {
+  return desired.isolation === void 0 || state.k3sInstalledByConveyor === true;
+}
+
+// src/lib/manifest-guard.ts
+import { isAlias, isMap, isScalar, parseAllDocuments } from "yaml";
+var ALLOWED_MANIFEST_KINDS = [
+  "Namespace",
+  "Role",
+  "RoleBinding",
+  "ClusterRole",
+  "ClusterRoleBinding",
+  "PriorityClass"
+];
+var ALLOWED = new Set(ALLOWED_MANIFEST_KINDS);
+var MISSING_KIND = "(missing kind)";
+var UNPARSEABLE = "(unparseable)";
+var LIST_SHAPED = "(list-shaped document)";
+function isListShaped(map) {
+  return map.items.some(({ key }) => {
+    if (isAlias(key)) return true;
+    const name = isScalar(key) ? key.value : key;
+    return typeof name === "string" && (name === "<<" || name.toLowerCase() === "items");
+  });
+}
+function findDisallowedKinds(manifest) {
+  let documents;
+  try {
+    documents = parseAllDocuments(manifest);
+  } catch {
+    return [UNPARSEABLE];
+  }
+  const disallowed = [];
+  const record = (kind) => {
+    if (!disallowed.includes(kind)) disallowed.push(kind);
+  };
+  for (const doc of documents) {
+    if (doc.errors.length > 0) {
+      record(UNPARSEABLE);
+      continue;
+    }
+    if (doc.contents === null || doc.contents === void 0) continue;
+    if (isScalar(doc.contents) && doc.contents.value === null) continue;
+    if (!isMap(doc.contents)) {
+      record(MISSING_KIND);
+      continue;
+    }
+    if (isListShaped(doc.contents)) {
+      record(LIST_SHAPED);
+      continue;
+    }
+    const kind = doc.get("kind");
+    if (typeof kind !== "string" || kind.length === 0) {
+      record(MISSING_KIND);
+      continue;
+    }
+    if (!ALLOWED.has(kind)) record(kind);
+  }
+  return disallowed;
+}
+function withoutKind(manifest, kind) {
+  return parseAllDocuments(manifest).filter((doc) => !(isMap(doc.contents) && doc.get("kind") === kind)).map((doc) => doc.toString()).join("---\n");
+}
+function declaresPriorityClass(manifest, name, value) {
+  return parseAllDocuments(manifest).some(
+    (doc) => isMap(doc.contents) && doc.get("kind") === "PriorityClass" && doc.getIn(["metadata", "name"]) === name && doc.get("value") === value
+  );
+}
+
+// src/daemon/cluster-ops.ts
+async function kubectlApply(exec, manifest) {
+  await runOrThrow(exec, "k3s", ["kubectl", "apply", "-f", "-"], {
+    stdin: manifest,
+    timeoutMs: 6e4
+  });
+}
+function mayDisrupt(runningConveyorPods) {
+  return runningConveyorPods === 0;
+}
+function busyReason(runningConveyorPods) {
+  return runningConveyorPods === null ? "the number of running Conveyor pods could not be read" : `${runningConveyorPods} Conveyor pod(s) are running`;
+}
 
 // src/lib/k3s-config.ts
 var IMAGE_GC_HIGH = "image-gc-high-threshold";
@@ -7160,6 +7303,15 @@ var K3S_INSTALL_EXEC = [
   `--${WRITE_KUBECONFIG_MODE}`,
   KUBECONFIG_MODE
 ].join(" ");
+function bareToken(token) {
+  let bare = token.trim();
+  if (bare.endsWith("\\")) bare = bare.slice(0, -1).trim();
+  const quote = bare[0];
+  if (bare.length >= 2 && (quote === "'" || quote === '"') && bare.endsWith(quote)) {
+    bare = bare.slice(1, -1);
+  }
+  return bare;
+}
 function ownerConfiguredKubeletFlags(ownerConfig) {
   const found = /* @__PURE__ */ new Set();
   if (!ownerConfig) return found;
@@ -7185,7 +7337,7 @@ function ownerImageGcHighThreshold(ownerConfig) {
   const value = Number.parseInt(match[2] ?? "", 10);
   return Number.isInteger(value) && value >= 0 && value <= 100 ? value : null;
 }
-function renderK3sDropIn(kubelet, ownerConfig) {
+function renderK3sDropIn(kubelet, ownerConfig, options = {}) {
   const ownerFlags = ownerConfiguredKubeletFlags(ownerConfig);
   const ownerKeys = ownerConfiguredKeys(ownerConfig);
   const args = [];
@@ -7209,8 +7361,10 @@ function renderK3sDropIn(kubelet, ownerConfig) {
     "# Your own /etc/rancher/k3s/config.yaml is never modified; k3s merges both.",
     "# `kubelet-arg+` and `disable+` append rather than replacing a list you set."
   ];
-  lines2.push("disable+:");
-  for (const component of K3S_DISABLED_COMPONENTS) lines2.push(`  - ${component}`);
+  if (options.disableComponents !== false) {
+    lines2.push("disable+:");
+    for (const component of K3S_DISABLED_COMPONENTS) lines2.push(`  - ${component}`);
+  }
   if (ownerKeys.has(WRITE_KUBECONFIG_MODE)) {
     skipped.push(WRITE_KUBECONFIG_MODE);
   } else {
@@ -7221,76 +7375,345 @@ function renderK3sDropIn(kubelet, ownerConfig) {
   }
   return { content: [...lines2, ""].join("\n"), skipped };
 }
-var renderKubeletDropIn = renderK3sDropIn;
 
-// src/lib/manifest-guard.ts
-import { isMap, isScalar, parseAllDocuments } from "yaml";
-var ALLOWED_MANIFEST_KINDS = [
-  "Namespace",
-  "Role",
-  "RoleBinding",
-  "ClusterRole",
-  "ClusterRoleBinding",
-  "PriorityClass"
-];
-var ALLOWED = new Set(ALLOWED_MANIFEST_KINDS);
-var MISSING_KIND = "(missing kind)";
-var UNPARSEABLE = "(unparseable)";
-function findDisallowedKinds(manifest) {
-  let documents;
-  try {
-    documents = parseAllDocuments(manifest);
-  } catch {
-    return [UNPARSEABLE];
+// src/daemon/pod-cpu-quota.ts
+var POD_SLICE = "kubepods.slice";
+function cpuMillicores(quantity) {
+  const checked = assertQuantity(quantity, "reserveCpu");
+  const match = /^(\d+(?:\.\d+)?)(m?)$/.exec(checked);
+  if (!match?.[1])
+    throw new Error(`Invalid reserveCpu: ${JSON.stringify(checked)} is not a CPU amount`);
+  const amount = Number.parseFloat(match[1]);
+  return Math.round(match[2] === "m" ? amount : amount * 1e3);
+}
+function podCpuQuotaPercent(cores, reservedMillicores) {
+  const left = cores * 1e3 - reservedMillicores;
+  if (left < 10) return null;
+  return Math.floor(left / 10);
+}
+function setQuota(exec, value) {
+  return exec("systemctl", ["set-property", POD_SLICE, `CPUQuota=${value}`]);
+}
+async function liftPodCpuQuota(exec) {
+  const shown = await exec("systemctl", ["show", POD_SLICE, "-p", "CPUQuotaPerSecUSec", "--value"]);
+  if (shown.exitCode !== 0 || ["", "infinity"].includes(shown.stdout.trim())) return null;
+  const cleared = await setQuota(exec, "");
+  return cleared.exitCode === 0 ? null : cleared.stderr.trim().slice(0, 200);
+}
+async function reconcilePodCpuQuota(exec, desired, warnings) {
+  const reserve = desired.kubelet.systemReserved?.cpu;
+  if (!reserve) {
+    const failure = await liftPodCpuQuota(exec);
+    if (failure) warnings.push(`Could not lift the CPU cap on ${POD_SLICE}: ${failure}`);
+    return void 0;
   }
-  const disallowed = [];
-  const record = (kind) => {
-    if (!disallowed.includes(kind)) disallowed.push(kind);
+  const reserved = cpuMillicores(reserve);
+  const state = await exec("systemctl", ["show", POD_SLICE, "-p", "ActiveState", "--value"]);
+  if (state.exitCode !== 0 || state.stdout.trim() !== "active") {
+    warnings.push(
+      `Pods do not run under ${POD_SLICE} (k3s is not using the systemd cgroup driver), so the CPU you keep for this machine is weighted, not capped.`
+    );
+    return false;
+  }
+  const nproc = await exec("nproc", []);
+  const cores = Number.parseInt(nproc.stdout.trim(), 10);
+  if (nproc.exitCode !== 0 || !Number.isInteger(cores) || cores <= 0) {
+    warnings.push(
+      "Could not count this machine's CPUs, so the CPU you keep is weighted, not capped."
+    );
+    return false;
+  }
+  const percent = podCpuQuotaPercent(cores, reserved);
+  if (percent === null) {
+    warnings.push(
+      `The CPU you keep (${reserve}) leaves no CPU for builds on this ${cores}-CPU machine. Lower it in your Conveyor profile.`
+    );
+    return false;
+  }
+  const set = await setQuota(exec, `${percent}%`);
+  if (set.exitCode !== 0) {
+    warnings.push(
+      `Could not cap pod CPU at ${percent / 100} CPUs: ${set.stderr.trim().slice(0, 200)}`
+    );
+    return false;
+  }
+  return true;
+}
+
+// src/daemon/kubelet-upkeep.ts
+function ownerRestartWarning(change) {
+  return `${change} Conveyor did not install this server's k3s, so it never restarts it: run \`sudo systemctl restart k3s\` when no build runs.`;
+}
+async function reconcileKubelet(ctx, desired, result, managed) {
+  const ownerConfig = await ctx.fs.readFile(K3S_OWNER_CONFIG);
+  const rendered = renderK3sDropIn(desired.kubelet, ownerConfig, { disableComponents: managed });
+  result.skippedKubeletFlags = rendered.skipped;
+  result.effectiveImageGcHighThreshold = rendered.skipped.includes("image-gc-high-threshold") ? ownerImageGcHighThreshold(ownerConfig) : desired.kubelet.imageGcHighThreshold;
+  for (const flag of rendered.skipped) {
+    result.warnings.push(
+      `Left \`${flag}\` to your own /etc/rancher/k3s/config.yaml \u2014 Conveyor does not override a setting you chose.`
+    );
+  }
+  const current = await ctx.fs.readFile(K3S_CONFIG_DROPIN);
+  if (rendered.content === null) {
+    if (current !== null) await ctx.fs.removeFile(K3S_CONFIG_DROPIN);
+    return;
+  }
+  if (current === rendered.content) return;
+  await ctx.fs.ensureDir(K3S_CONFIG_DROPIN.slice(0, K3S_CONFIG_DROPIN.lastIndexOf("/")));
+  await ctx.fs.writeFile(K3S_CONFIG_DROPIN, rendered.content, 420);
+  if (!managed) {
+    result.warnings.push(ownerRestartWarning("Kubelet settings changed."));
+    return;
+  }
+  if (!mayDisrupt(ctx.runningConveyorPods)) {
+    result.warnings.push(
+      `Kubelet settings changed but ${busyReason(ctx.runningConveyorPods)} \u2014 the restart is deferred until the machine is idle.`
+    );
+    return;
+  }
+  const restart = await ctx.exec("systemctl", ["restart", "k3s"], { timeoutMs: 12e4 });
+  if (restart.exitCode === 0) {
+    result.restartedK3s = true;
+  } else {
+    result.warnings.push(
+      `Could not restart k3s to apply new kubelet settings: ${restart.stderr.trim().slice(0, 200)}`
+    );
+  }
+}
+
+// src/daemon/local-registry-upkeep.ts
+import { createHash as createHash3 } from "crypto";
+
+// src/lib/local-registry.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/lib/registry-credentials.ts
+import { createHash, randomBytes as randomBytes2 } from "crypto";
+
+// src/lib/bcrypt.ts
+var P_WORDS = 18;
+var S_WORDS = 1024;
+var MAGIC = "OrpheanBeholderScryDoubt";
+var ALPHABET = "./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+var MAX_KEY_BYTES = 72;
+var BCRYPT_SALT_BYTES = 16;
+function scaledAtanInverse(x, one) {
+  const xSquared = x * x;
+  let power = one / x;
+  let sum = 0n;
+  for (let n = 0n; power !== 0n; n++) {
+    const term = power / (2n * n + 1n);
+    sum = n % 2n === 0n ? sum + term : sum - term;
+    power /= xSquared;
+  }
+  return sum;
+}
+function piFractionWords(count) {
+  const guard = 64n;
+  const bits = BigInt(count * 32) + guard;
+  const one = 1n << bits;
+  const pi = 16n * scaledAtanInverse(5n, one) - 4n * scaledAtanInverse(239n, one);
+  const fraction = pi - 3n * one >> guard;
+  const words = new Uint32Array(count);
+  for (let index = 0; index < count; index++) {
+    words[index] = Number(fraction >> BigInt(32 * (count - 1 - index)) & 0xffffffffn);
+  }
+  return words;
+}
+var initialState = null;
+function blowfishInitialState() {
+  if (!initialState) {
+    const words = piFractionWords(P_WORDS + S_WORDS);
+    initialState = { p: words.slice(0, P_WORDS), s: words.slice(P_WORDS) };
+  }
+  return initialState;
+}
+function word(array, index) {
+  return array[index] ?? 0;
+}
+function round(s, x) {
+  const mixed = word(s, x >>> 24) + word(s, 256 + (x >>> 16 & 255)) ^ word(s, 512 + (x >>> 8 & 255));
+  return mixed + word(s, 768 + (x & 255)) | 0;
+}
+function encipher(state, data, offset) {
+  const { p, s } = state;
+  let left = word(data, offset) ^ word(p, 0);
+  let right = word(data, offset + 1);
+  for (let index = 1; index <= 16; index += 2) {
+    right ^= round(s, left) ^ word(p, index);
+    left ^= round(s, right) ^ word(p, index + 1);
+  }
+  data[offset] = right ^ word(p, 17);
+  data[offset + 1] = left;
+}
+function wordStream(bytes) {
+  let position = 0;
+  return () => {
+    let value = 0;
+    for (let index = 0; index < 4; index++) {
+      value = value << 8 | (bytes[position] ?? 0);
+      position = (position + 1) % bytes.length;
+    }
+    return value >>> 0;
   };
-  for (const doc of documents) {
-    if (doc.errors.length > 0) {
-      record(UNPARSEABLE);
-      continue;
+}
+function expandKey(state, key, salt) {
+  const nextKeyWord = wordStream(key);
+  for (let index = 0; index < P_WORDS; index++) {
+    state.p[index] = word(state.p, index) ^ nextKeyWord();
+  }
+  const nextSaltWord = salt ? wordStream(salt) : () => 0;
+  const block = new Uint32Array(2);
+  const fill = (target, length) => {
+    for (let index = 0; index < length; index += 2) {
+      block[0] = word(block, 0) ^ nextSaltWord();
+      block[1] = word(block, 1) ^ nextSaltWord();
+      encipher(state, block, 0);
+      target[index] = word(block, 0);
+      target[index + 1] = word(block, 1);
     }
-    if (doc.contents === null || doc.contents === void 0) continue;
-    if (isScalar(doc.contents) && doc.contents.value === null) continue;
-    if (!isMap(doc.contents)) {
-      record(MISSING_KIND);
-      continue;
+  };
+  fill(state.p, P_WORDS);
+  fill(state.s, S_WORDS);
+}
+function encodeBase64(bytes, length) {
+  let out = "";
+  let offset = 0;
+  while (offset < length) {
+    let first = bytes[offset++] ?? 0;
+    out += ALPHABET[first >> 2];
+    first = (first & 3) << 4;
+    if (offset >= length) {
+      out += ALPHABET[first];
+      break;
     }
-    const kind = doc.get("kind");
-    if (typeof kind !== "string" || kind.length === 0) {
-      record(MISSING_KIND);
-      continue;
+    let second = bytes[offset++] ?? 0;
+    out += ALPHABET[first | second >> 4];
+    first = (second & 15) << 2;
+    if (offset >= length) {
+      out += ALPHABET[first];
+      break;
     }
-    if (!ALLOWED.has(kind)) record(kind);
-  }
-  return disallowed;
+    second = bytes[offset++] ?? 0;
+    out += ALPHABET[first | second >> 6];
+    out += ALPHABET[second & 63];
+  }
+  return out;
+}
+function bcryptHash(password, cost, salt) {
+  if (!Number.isInteger(cost) || cost < 4 || cost > 31) {
+    throw new Error(`bcrypt cost must be an integer from 4 to 31, not ${cost}`);
+  }
+  if (salt.length !== BCRYPT_SALT_BYTES) {
+    throw new Error(`bcrypt needs a ${BCRYPT_SALT_BYTES}-byte salt`);
+  }
+  const passwordBytes = new TextEncoder().encode(password).slice(0, MAX_KEY_BYTES);
+  const key = new Uint8Array(passwordBytes.length + 1);
+  key.set(passwordBytes);
+  const base = blowfishInitialState();
+  const state = { p: base.p.slice(), s: base.s.slice() };
+  expandKey(state, key, salt);
+  for (let rounds = 2 ** cost; rounds > 0; rounds--) {
+    expandKey(state, key, null);
+    expandKey(state, salt, null);
+  }
+  const magic = new TextEncoder().encode(MAGIC);
+  const nextMagicWord = wordStream(magic);
+  const block = Uint32Array.from({ length: 6 }, () => nextMagicWord());
+  for (let pass = 0; pass < 64; pass++) {
+    for (let offset = 0; offset < 6; offset += 2) encipher(state, block, offset);
+  }
+  const digest = new Uint8Array(24);
+  block.forEach((value, index) => {
+    digest[index * 4] = value >>> 24;
+    digest[index * 4 + 1] = value >>> 16 & 255;
+    digest[index * 4 + 2] = value >>> 8 & 255;
+    digest[index * 4 + 3] = value & 255;
+  });
+  const costText = String(cost).padStart(2, "0");
+  return `$2y$${costText}$${encodeBase64(salt, BCRYPT_SALT_BYTES)}${encodeBase64(digest, 23)}`;
 }
 
-// src/daemon/cluster-ops.ts
-async function kubectlApply(exec, manifest) {
-  await runOrThrow(exec, "k3s", ["kubectl", "apply", "-f", "-"], {
-    stdin: manifest,
-    timeoutMs: 6e4
-  });
+// src/lib/registry-credentials.ts
+var LOCAL_REGISTRY_USERNAME = "conveyor";
+var BCRYPT_COST = 5;
+var USERNAME = /^[a-z][a-z0-9-]{0,31}$/;
+var PASSWORD = /^[A-Za-z0-9_-]{32,128}$/;
+function generateRegistryCredentials(random = randomBytes2) {
+  const username = LOCAL_REGISTRY_USERNAME;
+  const password = Buffer.from(random(32)).toString("base64url");
+  const hash = bcryptHash(password, BCRYPT_COST, random(BCRYPT_SALT_BYTES));
+  return { username, password, htpasswd: `${username}:${hash}` };
+}
+function parseRegistryCredentials(raw) {
+  if (!raw) return null;
+  try {
+    const value = JSON.parse(raw);
+    const { username, password, htpasswd } = value ?? {};
+    if (typeof username !== "string" || !USERNAME.test(username)) return null;
+    if (typeof password !== "string" || !PASSWORD.test(password)) return null;
+    if (typeof htpasswd !== "string" || !htpasswd.startsWith(`${username}:$2`)) return null;
+    if (htpasswd.includes("\n")) return null;
+    return { username, password, htpasswd };
+  } catch {
+    return null;
+  }
 }
-function mayDisrupt(runningConveyorPods) {
-  return runningConveyorPods === 0;
+async function loadOrCreateRegistryCredentials(fs, random) {
+  const stored = parseRegistryCredentials(await fs.readFile(LOCAL_REGISTRY_CREDENTIALS_FILE));
+  if (stored) return stored;
+  const created = generateRegistryCredentials(random);
+  await fs.writeFile(LOCAL_REGISTRY_CREDENTIALS_FILE, `${JSON.stringify(created)}
+`, 384);
+  return created;
 }
-function busyReason(runningConveyorPods) {
-  return runningConveyorPods === null ? "the number of running Conveyor pods could not be read" : `${runningConveyorPods} Conveyor pod(s) are running`;
+function credentialFingerprint(credentials) {
+  return createHash("sha256").update(`${credentials.username}:${credentials.password}`).digest("hex").slice(0, 16);
+}
+function basicAuthorization(credentials) {
+  return `Basic ${Buffer.from(`${credentials.username}:${credentials.password}`).toString("base64")}`;
+}
+function registryDockerConfig(credentials, host) {
+  const auth = Buffer.from(`${credentials.username}:${credentials.password}`).toString("base64");
+  return JSON.stringify({ auths: { [host]: { auth } } });
+}
+function parseRegistryAuthState(raw) {
+  if (!raw) return null;
+  try {
+    const value = JSON.parse(raw);
+    if (typeof value?.credential !== "string") return null;
+    const writtenAt = typeof value.writtenAt === "string" && !Number.isNaN(Date.parse(value.writtenAt)) ? value.writtenAt : null;
+    return { credential: value.credential, writtenAt, enforced: value.enforced === true };
+  } catch {
+    return null;
+  }
+}
+async function registryAuthEnforced(readFile3) {
+  return parseRegistryAuthState(await readFile3(LOCAL_REGISTRY_AUTH_STATE_FILE))?.enforced === true;
+}
+function withRegistryCredentials(fetchImpl, readFile3) {
+  let credentials = null;
+  return async (url, init) => {
+    credentials ??= readFile3(LOCAL_REGISTRY_CREDENTIALS_FILE).then(parseRegistryCredentials);
+    const stored = await credentials;
+    if (!stored) return fetchImpl(url, init);
+    const headers = new Headers(init?.headers);
+    headers.set("Authorization", basicAuthorization(stored));
+    return fetchImpl(url, { ...init, headers });
+  };
 }
-
-// src/daemon/local-registry-upkeep.ts
-import { createHash } from "crypto";
 
 // src/lib/local-registry.ts
 var LOCAL_REGISTRY_IMAGE = "docker.io/library/registry:3.1.2@sha256:c87f33837722a100572e95d7dc4bf539fc42cf68202b13c3bc03c0ff54c3a649";
 var LOCAL_REGISTRY_CONFIG = "/etc/distribution/config.yml";
 var LOCAL_REGISTRY_GC_JOB = "conveyor-registry-gc";
+var LOCAL_REGISTRY_HTPASSWD_SECRET = "conveyor-registry-htpasswd";
+var HTPASSWD_KEY = "htpasswd";
+var AUTH_MOUNT = "/etc/distribution/auth";
 var LOCAL_REGISTRY_SELECTOR = { "app.kubernetes.io/name": PERSONAL_LOCAL_REGISTRY_NAME };
 var MANAGED_BY = { "app.kubernetes.io/managed-by": "conveyor-k3" };
+var AUTH_CHECKSUM_ANNOTATION = "conveyor.rallycry.com/registry-auth";
 var DATA_MOUNT = "/var/lib/registry";
 var REGISTRY_ENV = [
   { name: "REGISTRY_STORAGE_DELETE_ENABLED", value: "true" },
@@ -7305,6 +7728,23 @@ var VOLUME_MOUNTS = [
   { name: "data", mountPath: DATA_MOUNT },
   { name: "tmp", mountPath: "/tmp" }
 ];
+var AUTH_ENV = [
+  { name: "REGISTRY_AUTH", value: "htpasswd" },
+  { name: "REGISTRY_AUTH_HTPASSWD_REALM", value: "conveyor" },
+  { name: "REGISTRY_AUTH_HTPASSWD_PATH", value: `${AUTH_MOUNT}/${HTPASSWD_KEY}` }
+];
+var AUTH_VOLUME = {
+  name: "auth",
+  secret: {
+    secretName: LOCAL_REGISTRY_HTPASSWD_SECRET,
+    items: [{ key: HTPASSWD_KEY, path: HTPASSWD_KEY }],
+    defaultMode: 256
+  }
+};
+var AUTH_VOLUME_MOUNT = { name: "auth", mountPath: AUTH_MOUNT, readOnly: true };
+function htpasswdChecksum(htpasswd) {
+  return createHash2("sha256").update(htpasswd).digest("hex").slice(0, 16);
+}
 var VOLUMES = [
   { name: "data", hostPath: { path: LOCAL_REGISTRY_DATA_DIR, type: "Directory" } },
   { name: "tmp", emptyDir: { sizeLimit: "64Mi" } }
@@ -7341,7 +7781,34 @@ function registryNetworkPolicy(metadata) {
     }
   };
 }
-function renderLocalRegistryManifests() {
+function renderLocalRegistrySecrets(credentials) {
+  const encode = (value) => Buffer.from(value).toString("base64");
+  const secret = (namespace, name, key, value) => ({
+    apiVersion: "v1",
+    kind: "Secret",
+    metadata: { name, namespace, labels: { ...MANAGED_BY } },
+    type: "Opaque",
+    data: { [key]: encode(value) }
+  });
+  const items = [
+    secret(
+      PERSONAL_LOCAL_REGISTRY_NAMESPACE,
+      LOCAL_REGISTRY_HTPASSWD_SECRET,
+      HTPASSWD_KEY,
+      `${credentials.htpasswd}
+`
+    ),
+    secret(
+      PERSONAL_BAKE_NAMESPACE,
+      PERSONAL_LOCAL_REGISTRY_PUSH_SECRET,
+      PERSONAL_LOCAL_REGISTRY_PUSH_SECRET_KEY,
+      registryDockerConfig(credentials, PERSONAL_LOCAL_REGISTRY_HOST)
+    )
+  ];
+  return `${JSON.stringify({ apiVersion: "v1", kind: "List", items }, null, 2)}
+`;
+}
+function renderLocalRegistryManifests(auth = null) {
   const metadata = {
     name: PERSONAL_LOCAL_REGISTRY_NAME,
     namespace: PERSONAL_LOCAL_REGISTRY_NAMESPACE,
@@ -7357,15 +7824,19 @@ function renderLocalRegistryManifests() {
       strategy: { type: "Recreate" },
       selector: { matchLabels: LOCAL_REGISTRY_SELECTOR },
       template: {
-        metadata: { labels: metadata.labels },
+        metadata: {
+          labels: metadata.labels,
+          ...auth ? { annotations: { [AUTH_CHECKSUM_ANNOTATION]: htpasswdChecksum(auth.htpasswd) } } : {}
+        },
         spec: {
           ...POD_BASE,
+          ...auth ? { volumes: [...VOLUMES, AUTH_VOLUME] } : {},
           containers: [
             {
               name: "registry",
               image: LOCAL_REGISTRY_IMAGE,
               imagePullPolicy: "IfNotPresent",
-              env: REGISTRY_ENV,
+              env: auth ? [...REGISTRY_ENV, ...AUTH_ENV] : REGISTRY_ENV,
               ports: [
                 {
                   name: "registry",
@@ -7377,8 +7848,10 @@ function renderLocalRegistryManifests() {
                   protocol: "TCP"
                 }
               ],
+              // A TCP check: once the credential is enforced, `/v2/` answers
+              // 401 to a probe that does not carry it.
               readinessProbe: {
-                httpGet: { path: "/v2/", port: PERSONAL_LOCAL_REGISTRY_PORT },
+                tcpSocket: { port: PERSONAL_LOCAL_REGISTRY_PORT },
                 periodSeconds: 10
               },
               resources: {
@@ -7386,7 +7859,7 @@ function renderLocalRegistryManifests() {
                 limits: { memory: "512Mi" }
               },
               securityContext: CONTAINER_SECURITY,
-              volumeMounts: VOLUME_MOUNTS
+              volumeMounts: auth ? [...VOLUME_MOUNTS, AUTH_VOLUME_MOUNT] : VOLUME_MOUNTS
             }
           ]
         }
@@ -7477,11 +7950,18 @@ async function registryAnswers(fetchImpl = fetch) {
 }
 async function localRegistryReady(ports) {
   const [answers, mirrored] = await Promise.all([
-    registryAnswers(ports.fetch),
+    registryAnswers(withRegistryCredentials(ports.fetch ?? fetch, ports.readFile)),
     mirrorLoaded(ports.readFile)
   ]);
   return answers && mirrored;
 }
+async function localRegistryStatus(ports) {
+  const [ready, authEnforced] = await Promise.all([
+    localRegistryReady(ports),
+    registryAuthEnforced(ports.readFile)
+  ]);
+  return { ready, authEnforced };
+}
 
 // src/daemon/registry-gc-lock.ts
 var REGISTRY_GC_MARK = "conveyor.rallycry.com/registry-gc";
@@ -7572,6 +8052,59 @@ async function deleteSweepJob(exec) {
   return result.exitCode === 0;
 }
 
+// src/daemon/registry-auth.ts
+var LOCAL_REGISTRY_AUTH_HOSTS = [
+  PERSONAL_LOCAL_REGISTRY_HOST,
+  new URL(PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT).host
+];
+function registryAuthConfigured(file, credentials) {
+  return LOCAL_REGISTRY_AUTH_HOSTS.every((host) => {
+    const auth = file.configs?.[host]?.auth;
+    return auth?.username === credentials.username && auth.password === credentials.password && auth.auth === void 0 && auth.identitytoken === void 0;
+  });
+}
+function withLocalRegistryAuth(file, credentials) {
+  return LOCAL_REGISTRY_AUTH_HOSTS.reduce(
+    (next, host) => upsertRegistryAuth(next, host, {
+      username: credentials.username,
+      password: credentials.password
+    }),
+    file
+  );
+}
+function monotonicNowUs() {
+  return Number(process.hrtime.bigint() / 1000n);
+}
+async function k3sStartedAtMs(exec, nowMs, monotonicNow = monotonicNowUs) {
+  const result = await exec(
+    "systemctl",
+    ["show", "k3s", "--property=ActiveEnterTimestampMonotonic", "--value"],
+    { timeoutMs: 1e4 }
+  ).catch(() => null);
+  if (!result || result.exitCode !== 0) return null;
+  const startedUs = Number.parseInt(result.stdout.trim(), 10);
+  if (!Number.isFinite(startedUs) || startedUs <= 0) return null;
+  return nowMs - (monotonicNow() - startedUs) / 1e3;
+}
+async function settleRegistryAuth(ctx, credentials, written) {
+  const now = (ctx.now ?? (() => /* @__PURE__ */ new Date()))();
+  const raw = await ctx.fs.readFile(LOCAL_REGISTRY_AUTH_STATE_FILE);
+  const credential = credentialFingerprint(credentials);
+  const stored = parseRegistryAuthState(raw);
+  const state = stored?.credential === credential ? stored : { credential, writtenAt: null, enforced: false };
+  if (!state.enforced && (written || state.writtenAt === null)) {
+    state.writtenAt = now.toISOString();
+  }
+  if (!state.enforced && state.writtenAt !== null) {
+    const startedAt = await k3sStartedAtMs(ctx.exec, now.getTime(), ctx.monotonicNowUs);
+    if (startedAt !== null && startedAt > Date.parse(state.writtenAt)) state.enforced = true;
+  }
+  const next = `${JSON.stringify(state)}
+`;
+  if (next !== raw) await ctx.fs.writeFile(LOCAL_REGISTRY_AUTH_STATE_FILE, next, 384);
+  return state.enforced;
+}
+
 // src/daemon/local-registry-upkeep.ts
 function nowDate() {
   return /* @__PURE__ */ new Date();
@@ -7580,33 +8113,47 @@ function mirrorConfigured(raw) {
   const endpoints = mirrorEndpoints(parseRegistries(raw), PERSONAL_LOCAL_REGISTRY_HOST);
   return endpoints.length === 1 && endpoints[0] === PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT;
 }
-async function applyUnlessCollecting(ctx) {
+async function applyUnlessCollecting(ctx, auth) {
   const deployment = await readRegistryDeployment(ctx.exec);
   if (!deployment) throw new Error("the registry's Deployment could not be read");
   if (gcMarkIsLive(deployment.mark, (ctx.now ?? nowDate)().getTime(), ctx.isAlive)) return false;
   if (deployment.mark !== null && !await deleteSweepJob(ctx.exec)) {
     throw new Error("a stopped cleanup's Job could not be deleted, so the registry stays stopped");
   }
-  await kubectlApply(ctx.exec, renderLocalRegistryManifests());
+  await kubectlApply(ctx.exec, renderLocalRegistryManifests(auth));
   if (deployment.mark !== null) await clearGcMark(ctx.exec);
   return true;
 }
 async function deployLocalRegistry(ctx) {
   await ctx.fs.ensureDir(LOCAL_REGISTRY_DATA_DIR, 448);
-  const applied = await applyUnlessCollecting(ctx);
+  const credentials = await loadOrCreateRegistryCredentials(ctx.fs, ctx.random);
   const raw = await ctx.fs.readFile(REGISTRIES_FILE);
-  if (mirrorConfigured(raw)) return { applied, mirrorWritten: false, backupPath: null };
-  const next = upsertRegistryMirror(parseRegistries(raw), PERSONAL_LOCAL_REGISTRY_HOST, [
-    PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT
-  ]);
-  const backupPath = await writeRegistriesWithBackup(ctx.fs, raw, next, (ctx.now ?? nowDate)());
-  return { applied, mirrorWritten: true, backupPath };
+  let file = parseRegistries(raw);
+  const mirrorWritten = !mirrorConfigured(raw);
+  const authWritten = !registryAuthConfigured(file, credentials);
+  let backupPath = null;
+  if (mirrorWritten) {
+    file = upsertRegistryMirror(file, PERSONAL_LOCAL_REGISTRY_HOST, [
+      PERSONAL_LOCAL_REGISTRY_NODE_ENDPOINT
+    ]);
+  }
+  if (authWritten) file = withLocalRegistryAuth(file, credentials);
+  if (mirrorWritten || authWritten) {
+    backupPath = await writeRegistriesWithBackup(ctx.fs, raw, file, (ctx.now ?? nowDate)());
+  }
+  const authEnforced = await settleRegistryAuth(ctx, credentials, authWritten);
+  await kubectlApply(ctx.exec, renderLocalRegistrySecrets(credentials));
+  const applied = await applyUnlessCollecting(ctx, authEnforced ? credentials : null);
+  return { applied, mirrorWritten, authWritten, backupPath, authEnforced };
 }
 async function readMirrorState(fs) {
   const raw = await fs.readFile(REGISTRIES_FILE);
-  const fingerprint = createHash("sha256").update(raw ?? "").digest("hex");
+  const authPending = !await registryAuthEnforced((path) => fs.readFile(path));
+  const fingerprint = createHash3("sha256").update(raw ?? "").digest("hex");
   if (!mirrorConfigured(raw)) return { state: "absent", fingerprint };
-  if (await mirrorLoaded((path) => fs.readFile(path))) return { state: "loaded", fingerprint };
+  if (!authPending && await mirrorLoaded((path) => fs.readFile(path))) {
+    return { state: "loaded", fingerprint };
+  }
   const tried = (await fs.readFile(LOCAL_REGISTRY_MIRROR_RESTART_FILE))?.trim() === fingerprint;
   return { state: tried ? "tried" : "owed", fingerprint };
 }
@@ -7618,14 +8165,14 @@ async function loadRegistryMirror(ctx) {
   if (state === "tried") {
     return {
       restarted: false,
-      warning: `k3s restarted but did not load the local image registry's mirror, so pods cannot pull from that registry. Conveyor restarts k3s for it again only after /etc/rancher/k3s/registries.yaml changes. Check that k3s reads that file and keeps its data in the default directory: the mirror should appear under ${K3S_CERTS_D}.`
+      warning: `k3s restarted but did not load the local image registry's mirror or credential, so pods cannot pull from that registry or the registry stays open to every account on this machine. Conveyor restarts k3s for it again only after /etc/rancher/k3s/registries.yaml changes. Check that k3s reads that file and keeps its data in the default directory: the mirror should appear under ${K3S_CERTS_D}.`
     };
   }
   if (state !== "owed") return { restarted: false, warning: null };
   if (!mayDisrupt(ctx.runningConveyorPods)) {
     return {
       restarted: false,
-      warning: `The local image registry needs a k3s restart to load its mirror, but ${busyReason(ctx.runningConveyorPods)} \u2014 the restart is deferred until the machine is idle.`
+      warning: `The local image registry needs a k3s restart to load its mirror or credential, but ${busyReason(ctx.runningConveyorPods)} \u2014 the restart is deferred until the machine is idle.`
     };
   }
   const restart = await ctx.exec("systemctl", ["restart", "k3s"], { timeoutMs: 12e4 });
@@ -7640,21 +8187,257 @@ async function loadRegistryMirror(ctx) {
   return { restarted: true, warning: null };
 }
 
-// src/daemon/prune-namespaces.ts
-var POOL_NAMESPACE_PREFIX = "claudespace-";
-var WORKSPACE_MANAGER_ROLE = "conveyor-workspace-manager";
-var MAX_NAMESPACE_DELETES_PER_RUN = 5;
-var KUBECTL_TIMEOUT = "--request-timeout=10s";
-var EXEC_OPTIONS = { timeoutMs: 15e3 };
-function kubectl(exec, args) {
-  return exec("k3s", ["kubectl", ...args, KUBECTL_TIMEOUT], EXEC_OPTIONS).catch(() => null);
+// src/lib/isolation.ts
+var EGRESS_POLICY_NAME = "conveyor-k3-egress";
+var MANAGED_BY2 = { "app.kubernetes.io/managed-by": "conveyor-k3" };
+var NON_ROUTABLE_IPV4 = [
+  "0.0.0.0/8",
+  "10.0.0.0/8",
+  "100.64.0.0/10",
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "172.16.0.0/12",
+  "192.0.0.0/24",
+  "192.0.2.0/24",
+  "192.88.99.0/24",
+  "192.168.0.0/16",
+  "198.18.0.0/15",
+  "198.51.100.0/24",
+  "203.0.113.0/24",
+  "224.0.0.0/4",
+  "240.0.0.0/4"
+];
+var KUBE_DNS = { namespace: "kube-system", labels: { "k8s-app": "kube-dns" } };
+var PSA_PREFIX = "pod-security.kubernetes.io";
+function psaLabels(level) {
+  const advisory = level === "baseline" ? "restricted" : level;
+  return {
+    [`${PSA_PREFIX}/enforce`]: level,
+    [`${PSA_PREFIX}/warn`]: advisory,
+    [`${PSA_PREFIX}/audit`]: advisory
+  };
 }
-function candidateNamespaces(listing, wanted) {
-  const names = [];
-  for (const line of listing.split("\n")) {
-    const [name, phase] = line.trim().split(/\s+/);
-    if (!name?.startsWith(POOL_NAMESPACE_PREFIX) || wanted.has(name)) continue;
-    if (phase === "Terminating") continue;
+var PSA_LABEL_KEYS = Object.keys(psaLabels("baseline"));
+function ipv4Value(address) {
+  const parts = address.split(".");
+  if (parts.length !== 4) return null;
+  let value = 0;
+  for (const part of parts) {
+    if (!/^\d{1,3}$/.test(part)) return null;
+    const octet = Number(part);
+    if (octet > 255) return null;
+    value = value * 256 + octet;
+  }
+  return value;
+}
+function inNonRoutableRange(address) {
+  const value = ipv4Value(address);
+  if (value === null) return false;
+  return NON_ROUTABLE_IPV4.some((cidr) => {
+    const [base = "", bits = "32"] = cidr.split("/");
+    const start = ipv4Value(base) ?? 0;
+    return value >= start && value < start + 2 ** (32 - Number(bits));
+  });
+}
+function hostAddressExceptions(addresses) {
+  const kept = /* @__PURE__ */ new Set();
+  for (const raw of addresses) {
+    const address = raw.trim();
+    if (ipv4Value(address) === null || inNonRoutableRange(address)) continue;
+    kept.add(`${address}/32`);
+  }
+  return [...kept].sort();
+}
+function renderEgressNetworkPolicy(namespace, hostAddresses) {
+  const policy = {
+    apiVersion: "networking.k8s.io/v1",
+    kind: "NetworkPolicy",
+    metadata: {
+      name: EGRESS_POLICY_NAME,
+      namespace: assertK8sName(namespace, "namespace"),
+      labels: MANAGED_BY2
+    },
+    spec: {
+      podSelector: {},
+      policyTypes: ["Egress"],
+      egress: [
+        {
+          to: [
+            {
+              namespaceSelector: {
+                matchLabels: { "kubernetes.io/metadata.name": KUBE_DNS.namespace }
+              },
+              podSelector: { matchLabels: KUBE_DNS.labels }
+            }
+          ],
+          ports: [
+            { protocol: "UDP", port: 53 },
+            { protocol: "TCP", port: 53 }
+          ]
+        },
+        {
+          // kube-router enforces after the Service's DNAT, so the registry is
+          // reached by its pods' labels, never by the service range.
+          to: [
+            {
+              namespaceSelector: {
+                matchLabels: { "kubernetes.io/metadata.name": PERSONAL_LOCAL_REGISTRY_NAMESPACE }
+              },
+              podSelector: { matchLabels: LOCAL_REGISTRY_SELECTOR }
+            }
+          ],
+          ports: [{ protocol: "TCP", port: PERSONAL_LOCAL_REGISTRY_PORT }]
+        },
+        {
+          to: [
+            {
+              ipBlock: {
+                cidr: "0.0.0.0/0",
+                except: [...NON_ROUTABLE_IPV4, ...hostAddressExceptions(hostAddresses)]
+              }
+            }
+          ]
+        }
+      ]
+    }
+  };
+  return `${JSON.stringify(policy, null, 2)}
+`;
+}
+var DISABLE_KEY = /(?:^|[\s{,])(["']?)disable-network-policy\1\s*:([^,}]*)/g;
+var DISABLE_FLAGS = /* @__PURE__ */ new Set(["--disable-network-policy", "-disable-network-policy"]);
+var FALSE_VALUES = /* @__PURE__ */ new Set(["false", "no", "off", "n", "f", "0"]);
+function setsTrue(raw) {
+  const value = bareToken(raw).trim().toLowerCase();
+  return !FALSE_VALUES.has(value);
+}
+function uncommented(line) {
+  return /^\s*#/.test(line) ? "" : line.replace(/\s#.*$/, "");
+}
+function configSetsKey(text) {
+  return text.split("\n").map(uncommented).some((line) => [...line.matchAll(DISABLE_KEY)].some((match) => setsTrue(match[2] ?? "")));
+}
+function unitLines(unitText) {
+  const lines2 = [];
+  let pending = "";
+  for (const raw of unitText.split("\n")) {
+    const line = raw.trimEnd();
+    if (/^\s*[#;]/.test(line)) continue;
+    if (line.endsWith("\\")) {
+      pending += `${line.slice(0, -1)} `;
+      continue;
+    }
+    lines2.push(pending + line);
+    pending = "";
+  }
+  return pending ? [...lines2, pending] : lines2;
+}
+function flagSetIn(line) {
+  return line.split(/\s+/).some((raw) => {
+    const token = bareToken(raw).replace(/^["']+|["']+$/g, "");
+    const [name = "", ...value] = token.split("=");
+    return DISABLE_FLAGS.has(name) && (value.length === 0 || setsTrue(value.join("=")));
+  });
+}
+function networkPolicyControllerDisabled(sources) {
+  if (sources.configs.some((text) => text !== null && configSetsKey(text))) return true;
+  return unitLines(sources.unitText).some(flagSetIn);
+}
+
+// src/daemon/isolation-probes.ts
+var CONTROLLER_DISABLED_WARNING = "k3s runs with its network policy controller disabled, so the egress policy Conveyor applies here is not enforced. Remove disable-network-policy from the k3s config or unit and restart k3s. Until then this server is not isolated; Conveyor checks again within 10 minutes.";
+var CONTROLLER_UNKNOWN_WARNING = "Could not read the k3s unit or its config files to check that its network policy controller is on, so this server does not count as isolated. Check `systemctl cat k3s.service` and /etc/rancher/k3s; Conveyor checks again within 10 minutes.";
+var NODE_ADDRESSES_JSONPATH = '{range .items[*]}{range .status.addresses[?(@.type=="InternalIP")]}{.address}{"\\n"}{end}{range .status.addresses[?(@.type=="ExternalIP")]}{.address}{"\\n"}{end}{end}';
+var API_ENDPOINTS_JSONPATH = "{.items[*].endpoints[*].addresses[*]}";
+var IPV4_ON_INTERFACE = /\binet (\d{1,3}(?:\.\d{1,3}){3})(?:\/| peer )/g;
+async function stdoutOf(exec, bin, args) {
+  const run = await exec(bin, args, { timeoutMs: 1e4 }).catch(() => null);
+  return run && run.exitCode === 0 ? run.stdout : null;
+}
+async function dropInDirExists(exec) {
+  const run = await exec("test", ["-d", K3S_CONFIG_DROPIN_DIR], { timeoutMs: 1e4 }).catch(
+    () => null
+  );
+  if (run === null) return null;
+  if (run.exitCode === 0) return true;
+  return run.exitCode === 1 && run.stderr.trim() === "" ? false : null;
+}
+async function readK3sConfigs(ctx) {
+  const dirExists = await dropInDirExists(ctx.exec);
+  if (dirExists === null) return null;
+  if (!dirExists) return [await ctx.fs.readFile(K3S_OWNER_CONFIG)];
+  const listed = await stdoutOf(ctx.exec, "find", [
+    "-L",
+    K3S_CONFIG_DROPIN_DIR,
+    "-maxdepth",
+    "1",
+    "-type",
+    "f",
+    "(",
+    "-iname",
+    "*.yaml",
+    "-o",
+    "-iname",
+    "*.yml",
+    ")"
+  ]);
+  if (listed === null) return null;
+  const paths = listed.split("\n").map((path) => path.trim()).filter(Boolean).sort();
+  const dropIns = await Promise.all(paths.map((path) => ctx.fs.readFile(path)));
+  if (dropIns.some((text) => text === null)) return null;
+  return [await ctx.fs.readFile(K3S_OWNER_CONFIG), ...dropIns];
+}
+async function controllerProblem(ctx) {
+  const unitText = await stdoutOf(ctx.exec, "systemctl", ["cat", "k3s.service"]);
+  const configs = unitText === null ? null : await readK3sConfigs(ctx);
+  if (unitText === null || configs === null) return CONTROLLER_UNKNOWN_WARNING;
+  return networkPolicyControllerDisabled({ configs, unitText }) ? CONTROLLER_DISABLED_WARNING : null;
+}
+async function readHostAddresses(exec) {
+  const nodes = await stdoutOf(exec, "k3s", [
+    "kubectl",
+    "get",
+    "nodes",
+    "-o",
+    `jsonpath=${NODE_ADDRESSES_JSONPATH}`
+  ]);
+  const interfaces = await stdoutOf(exec, "ip", ["-o", "-4", "addr", "show"]);
+  const api = await stdoutOf(exec, "k3s", [
+    "kubectl",
+    "get",
+    "endpointslices",
+    "-n",
+    "default",
+    "-l",
+    "kubernetes.io/service-name=kubernetes",
+    "-o",
+    `jsonpath=${API_ENDPOINTS_JSONPATH}`
+  ]);
+  if (nodes === null || interfaces === null || api === null) return null;
+  const onInterfaces = [...interfaces.matchAll(IPV4_ON_INTERFACE)].map((match) => match[1] ?? "");
+  return [...nodes.split(/\s+/), ...onInterfaces, ...api.split(/\s+/)].filter(Boolean);
+}
+async function recheckIsolation(ctx, reconciled) {
+  if (reconciled?.applied !== true) return { isolation: reconciled, warnings: [] };
+  const problem = await controllerProblem(ctx);
+  return problem ? { isolation: { applied: false }, warnings: [problem] } : { isolation: reconciled, warnings: [] };
+}
+
+// src/daemon/prune-namespaces.ts
+var POOL_NAMESPACE_PREFIX = "claudespace-";
+var WORKSPACE_MANAGER_ROLE = "conveyor-workspace-manager";
+var MAX_NAMESPACE_DELETES_PER_RUN = 5;
+var KUBECTL_TIMEOUT = "--request-timeout=10s";
+var EXEC_OPTIONS = { timeoutMs: 15e3 };
+function kubectl(exec, args) {
+  return exec("k3s", ["kubectl", ...args, KUBECTL_TIMEOUT], EXEC_OPTIONS).catch(() => null);
+}
+function candidateNamespaces(listing, wanted) {
+  const names = [];
+  for (const line of listing.split("\n")) {
+    const [name, phase] = line.trim().split(/\s+/);
+    if (!name?.startsWith(POOL_NAMESPACE_PREFIX) || wanted.has(name)) continue;
+    if (phase === "Terminating") continue;
     try {
       names.push(assertK8sName(name, "namespace"));
     } catch {
@@ -7702,6 +8485,192 @@ async function pruneStaleNamespaces(ctx, desired, result) {
   }
 }
 
+// src/daemon/namespace-upkeep.ts
+function message(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function renderLimitRange(namespace, limits) {
+  const ns = assertK8sName(namespace, "namespace");
+  const values = [
+    assertQuantity(limits.defaultRequest.cpu, "defaultRequest.cpu"),
+    assertQuantity(limits.defaultRequest.memory, "defaultRequest.memory"),
+    assertQuantity(limits.default.cpu, "default.cpu"),
+    assertQuantity(limits.default.memory, "default.memory")
+  ];
+  return [
+    "apiVersion: v1",
+    "kind: LimitRange",
+    "metadata:",
+    "  name: conveyor-k3-defaults",
+    `  namespace: ${ns}`,
+    "spec:",
+    "  limits:",
+    "  - type: Container",
+    "    defaultRequest:",
+    `      cpu: "${values[0]}"`,
+    `      memory: "${values[1]}"`,
+    "    default:",
+    `      cpu: "${values[2]}"`,
+    `      memory: "${values[3]}"`,
+    ""
+  ].join("\n");
+}
+async function reconcileNamespaces(ctx, desired, result) {
+  for (const namespace of desired.namespaces) {
+    try {
+      await kubectlApply(ctx.exec, renderLimitRange(namespace.name, namespace.limitRange));
+    } catch (error) {
+      result.warnings.push(
+        `Could not apply resource defaults to ${namespace.name} (${namespace.projectName}): ${message(error)}`
+      );
+    }
+  }
+}
+async function ensureBakeNamespace(ctx, desired) {
+  const found = await ctx.exec(
+    "k3s",
+    ["kubectl", "get", "namespace", PERSONAL_BAKE_NAMESPACE],
+    KUBECTL_TIMEOUT2
+  );
+  if (found.exitCode !== 0) {
+    await runOrThrow(
+      ctx.exec,
+      "k3s",
+      ["kubectl", "create", "namespace", PERSONAL_BAKE_NAMESPACE],
+      KUBECTL_TIMEOUT2
+    );
+  }
+  const limitRange = desired.namespaces[0]?.limitRange;
+  if (limitRange) {
+    await kubectlApply(ctx.exec, renderLimitRange(PERSONAL_BAKE_NAMESPACE, limitRange));
+  }
+}
+function knownStance(isolation) {
+  const { podSecurity, egress, ...rest } = { ...isolation };
+  const extra = Object.keys(rest);
+  if (podSecurity === "baseline" && egress === "no-private" && extra.length === 0) return null;
+  const named = `Pod Security "${String(podSecurity).slice(0, 40)}", egress "${String(egress).slice(0, 40)}"`;
+  return extra.length === 0 ? named : `${named}, and ${extra.slice(0, 3).join(", ").slice(0, 80)}`;
+}
+var KUBECTL_TIMEOUT2 = { timeoutMs: 3e4 };
+var RECHECK = "Conveyor checks again within 10 minutes.";
+async function isolateNamespace(ctx, namespace, isolation, fail) {
+  const ns = assertK8sName(namespace, "namespace");
+  const labels = Object.entries(psaLabels(isolation.podSecurity)).map(
+    ([key, value]) => `${key}=${value}`
+  );
+  const labelled = await ctx.exec(
+    "k3s",
+    ["kubectl", "label", "namespace", ns, "--overwrite", ...labels],
+    KUBECTL_TIMEOUT2
+  );
+  if (labelled.exitCode !== 0) {
+    fail(
+      `Could not apply Pod Security labels to ${ns}: ${labelled.stderr.trim().slice(0, 200)} ${RECHECK}`
+    );
+  }
+  if (isolation.hostAddresses === null) return;
+  try {
+    await kubectlApply(ctx.exec, renderEgressNetworkPolicy(ns, isolation.hostAddresses));
+  } catch (error) {
+    fail(`Could not apply the egress policy to ${ns}: ${message(error).slice(0, 200)} ${RECHECK}`);
+  }
+}
+async function reconcileIsolation(ctx, desired, result) {
+  try {
+    await ensureBakeNamespace(ctx, desired);
+  } catch (error) {
+    result.warnings.push(
+      `Could not prepare the bake namespace ${PERSONAL_BAKE_NAMESPACE}: ${message(error)}`
+    );
+  }
+  const isolation = desired.isolation;
+  if (!isolation) {
+    result.isolation = void 0;
+    return;
+  }
+  const unknown = knownStance(isolation);
+  if (unknown) {
+    result.warnings.push(
+      `Conveyor asks for pod isolation this version of conveyor-k3 does not know (${unknown}), so nothing was changed and this server does not count as isolated. Run \`sudo conveyor-k3 update\`.`
+    );
+    result.isolation = { applied: false };
+    return;
+  }
+  let applied = true;
+  const fail = (warning) => {
+    applied = false;
+    result.warnings.push(warning);
+  };
+  const problem = await controllerProblem(ctx);
+  if (problem) fail(problem);
+  const hostAddresses = await readHostAddresses(ctx.exec);
+  if (hostAddresses === null) {
+    fail(
+      `Could not read every address this server answers on, so the egress policies in place were left as they are and this server does not count as isolated. ${RECHECK}`
+    );
+  }
+  for (const namespace of desired.namespaces) {
+    await isolateNamespace(ctx, namespace.name, { podSecurity: "baseline", hostAddresses }, fail);
+  }
+  await isolateNamespace(
+    ctx,
+    PERSONAL_BAKE_NAMESPACE,
+    { podSecurity: "privileged", hostAddresses },
+    fail
+  );
+  result.isolation = { applied };
+}
+
+// src/lib/fs-port.ts
+import { chmod, mkdir, readFile, rm, writeFile } from "fs/promises";
+var nodeFileSystem = {
+  async readFile(path) {
+    try {
+      return await readFile(path, "utf8");
+    } catch {
+      return null;
+    }
+  },
+  async writeFile(path, content, mode) {
+    await mkdir(path.slice(0, path.lastIndexOf("/")), { recursive: true });
+    await writeFile(path, content, { encoding: "utf8", ...mode === void 0 ? {} : { mode } });
+    if (mode !== void 0) await chmod(path, mode);
+  },
+  async removeFile(path) {
+    await rm(path, { force: true });
+  },
+  async ensureDir(path, mode) {
+    await mkdir(path, { recursive: true });
+    if (mode !== void 0) await chmod(path, mode);
+  }
+};
+function createMemoryFileSystem(seed = {}) {
+  const files = new Map(Object.entries(seed));
+  const modes = /* @__PURE__ */ new Map();
+  const removed = [];
+  return {
+    files,
+    modes,
+    removed,
+    readFile: (path) => Promise.resolve(files.get(path) ?? null),
+    writeFile: (path, content, mode) => {
+      files.set(path, content);
+      if (mode !== void 0) modes.set(path, mode);
+      return Promise.resolve();
+    },
+    removeFile: (path) => {
+      files.delete(path);
+      removed.push(path);
+      return Promise.resolve();
+    },
+    ensureDir: (path, mode) => {
+      if (mode !== void 0) modes.set(path, mode);
+      return Promise.resolve();
+    }
+  };
+}
+
 // src/daemon/registry-tags.ts
 var REPO_NAME = /^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/;
 var TAG_NAME = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/;
@@ -7987,7 +8956,10 @@ async function collectRegistryGarbage(ports, options) {
     blobsCollected: false
   });
   const now = ports.now ?? Date.now;
-  const fetchImpl = ports.fetch ?? fetch;
+  const fetchImpl = withRegistryCredentials(
+    ports.fetch ?? fetch,
+    ports.readFile ?? ((path) => nodeFileSystem.readFile(path))
+  );
   const retain = await readRetainList(ports);
   if (typeof retain === "string") return skip(retain);
   const blocked = await registryBlocker(ports, now());
@@ -8153,17 +9125,26 @@ var GRANTED_COMMAND_NAMES = LOCAL_BAKE_ROOT_COMMANDS.map((command) => command.na
 
 // src/daemon/telemetry.ts
 var LOCAL_REGISTRY_WARN_AFTER_MS = 10 * 6e4;
+var LOCAL_REGISTRY_OPEN_WARNING = "The local image registry is open to every account on this machine: any of them can read and replace the images your workspaces start from. It requires its credential once k3s restarts and loads it.";
 async function reportLocalRegistry(ports, watch, now = Date.now()) {
   if (!watch) return { fields: {}, warnings: [] };
-  const ready = await localRegistryReady({ readFile: ports.readFile, fetch: ports.fetch });
+  const { ready, authEnforced } = await localRegistryStatus({
+    readFile: ports.readFile,
+    fetch: ports.fetch
+  });
   const paused = (watch.pausedUntil ?? 0) > now;
   watch.notReadySince = ready || paused ? null : watch.notReadySince ?? now;
   const stuckMs = watch.notReadySince === null ? 0 : now - watch.notReadySince;
-  return {
-    fields: { localRegistry: { host: PERSONAL_LOCAL_REGISTRY_HOST, ready } },
-    warnings: stuckMs >= LOCAL_REGISTRY_WARN_AFTER_MS ? [
+  const warnings = [];
+  if (stuckMs >= LOCAL_REGISTRY_WARN_AFTER_MS) {
+    warnings.push(
       `The local image registry has not been ready for ${Math.floor(stuckMs / 6e4)} minutes, so shadow bakes cannot use it yet. Check its pod with \`k3s kubectl -n conveyor-system get pods -l app.kubernetes.io/name=conveyor-registry\`. If the pod is running, k3s has not loaded the registry's mirror yet: it restarts k3s for that only while no Conveyor pod runs.`
-    ] : []
+    );
+  }
+  if (!authEnforced) warnings.push(LOCAL_REGISTRY_OPEN_WARNING);
+  return {
+    fields: { localRegistry: { host: PERSONAL_LOCAL_REGISTRY_HOST, ready, authEnforced } },
+    warnings
   };
 }
 var VM_CAPACITY_FILE = "/etc/conveyor-vm/capacity.json";
@@ -8285,14 +9266,23 @@ async function collectHeartbeat(ports, state, inventory) {
     ...runnerUsers.length > 0 ? { runnerUsers } : {},
     ...localImages ? { localImages } : {},
     ...registry.fields,
-    localWarnings: [
+    ...state.isolation ? { isolation: state.isolation } : {},
+    ...state.cpuQuotaApplied === void 0 ? {} : { cpuQuotaApplied: state.cpuQuotaApplied },
+    localWarnings: withinHeartbeatBounds([
       ...state.localWarnings,
       ...gcWarning ? [gcWarning] : [],
       ...ungranted.length > 0 ? [ungrantedRunnersWarning(ungranted)] : [],
       ...registry.warnings
-    ]
+    ])
   };
 }
+var HEARTBEAT_LIST_MAX = 64;
+var HEARTBEAT_STRING_MAX = 512;
+function withinHeartbeatBounds(warnings) {
+  return warnings.slice(0, HEARTBEAT_LIST_MAX).map(
+    (warning) => warning.length > HEARTBEAT_STRING_MAX ? `${warning.slice(0, HEARTBEAT_STRING_MAX - 1)}\u2026` : warning
+  );
+}
 async function readPodIdentities(exec) {
   const result = await exec(
     "k3s",
@@ -8328,7 +9318,15 @@ async function collect(ports, now) {
   if (watch) watch.pausedUntil = now.getTime() + REGISTRY_GC_MARK_TTL_MS;
   try {
     const outcome = await collectRegistryGarbage(
-      { exec, log, requestDesiredState, fetch: fetch2, sleep: sleep2, isAlive },
+      {
+        exec,
+        log,
+        requestDesiredState,
+        fetch: fetch2,
+        readFile: (path) => ports.fs.readFile(path),
+        sleep: sleep2,
+        isAlive
+      },
       { dryRun: false }
     );
     if (outcome.skipped) return outcome.skipped;
@@ -8374,41 +9372,7 @@ async function runRegistryUpkeep(ports, lastGcAt, maintenanceHour) {
 }
 
 // src/daemon/reconcile.ts
-async function reconcileKubelet(ctx, desired, result) {
-  const ownerConfig = await ctx.fs.readFile(K3S_OWNER_CONFIG);
-  const rendered = renderK3sDropIn(desired.kubelet, ownerConfig);
-  result.skippedKubeletFlags = rendered.skipped;
-  result.effectiveImageGcHighThreshold = rendered.skipped.includes("image-gc-high-threshold") ? ownerImageGcHighThreshold(ownerConfig) : desired.kubelet.imageGcHighThreshold;
-  for (const flag of rendered.skipped) {
-    result.warnings.push(
-      `Left \`${flag}\` to your own /etc/rancher/k3s/config.yaml \u2014 Conveyor does not override a setting you chose.`
-    );
-  }
-  const current = await ctx.fs.readFile(K3S_CONFIG_DROPIN);
-  if (rendered.content === null) {
-    if (current !== null) await ctx.fs.removeFile(K3S_CONFIG_DROPIN);
-    return;
-  }
-  if (current === rendered.content) return;
-  await ctx.fs.ensureDir(K3S_CONFIG_DROPIN.slice(0, K3S_CONFIG_DROPIN.lastIndexOf("/")));
-  await ctx.fs.writeFile(K3S_CONFIG_DROPIN, rendered.content, 420);
-  if (!mayDisrupt(ctx.runningConveyorPods)) {
-    result.warnings.push(
-      `Kubelet settings changed but ${busyReason(ctx.runningConveyorPods)} \u2014 the restart is deferred until the machine is idle.`
-    );
-    return;
-  }
-  const restart = await ctx.exec("systemctl", ["restart", "k3s"], { timeoutMs: 12e4 });
-  if (restart.exitCode === 0) {
-    result.restartedK3s = true;
-  } else {
-    result.warnings.push(
-      `Could not restart k3s to apply new kubelet settings: ${restart.stderr.trim().slice(0, 200)}`
-    );
-  }
-}
-async function reconcilePriorityClass(ctx, desired, result) {
-  const name = assertK8sName(desired.priorityClass.name, "priorityClass.name");
+async function livePriorityClassValue(ctx, name) {
   const read = await ctx.exec("k3s", [
     "kubectl",
     "get",
@@ -8417,67 +9381,59 @@ async function reconcilePriorityClass(ctx, desired, result) {
     "-o",
     "jsonpath={.value}"
   ]);
-  if (read.exitCode !== 0) return;
-  const existingValue = Number.parseInt(read.stdout.trim(), 10);
-  if (existingValue === desired.priorityClass.value) return;
+  const value = Number.parseInt(read.stdout.trim(), 10);
+  return read.exitCode === 0 && Number.isFinite(value) ? value : null;
+}
+async function reconcilePriorityClass(ctx, desired, result) {
+  const name = assertK8sName(desired.priorityClass.name, "priorityClass.name");
+  const wanted = desired.priorityClass.value;
+  const existingValue = await livePriorityClassValue(ctx, name);
+  if (existingValue === null || existingValue === wanted) return "ready";
+  if (!declaresPriorityClass(desired.rbacManifest, name, wanted)) {
+    result.warnings.push(
+      `The \`${name}\` PriorityClass has value ${existingValue}, but Conveyor's manifest does not declare it at ${wanted}, so it is left as it is. This should never happen; report it.`
+    );
+    return "kept";
+  }
   if (!mayDisrupt(ctx.runningConveyorPods)) {
     result.warnings.push(
-      `The \`${name}\` PriorityClass has value ${existingValue}, but Conveyor needs ${desired.priorityClass.value}. The value is immutable, so it must be recreated \u2014 deferred because ${busyReason(ctx.runningConveyorPods)}.`
+      `The \`${name}\` PriorityClass has value ${existingValue}, but Conveyor needs ${wanted}. The value is immutable, so it must be recreated \u2014 deferred because ${busyReason(ctx.runningConveyorPods)}.`
     );
-    return;
+    return "kept";
   }
-  const removed = await ctx.exec("k3s", ["kubectl", "delete", "priorityclass", name]);
+  const removed = await ctx.exec("k3s", [
+    "kubectl",
+    "delete",
+    "priorityclass",
+    name,
+    "--ignore-not-found"
+  ]);
   if (removed.exitCode !== 0) {
     result.warnings.push(
-      `Could not replace the \`${name}\` PriorityClass (value ${existingValue}, needs ${desired.priorityClass.value}): ${removed.stderr.trim().slice(0, 160)}`
+      `Could not replace the \`${name}\` PriorityClass (value ${existingValue}, needs ${wanted}): ${removed.stderr.trim().slice(0, 160)}`
     );
-    return;
+    return "kept";
   }
+  return "removed";
+}
+async function applyRbac(ctx, desired, result) {
+  const outcome = await reconcilePriorityClass(ctx, desired, result);
+  const manifest = outcome === "kept" ? withoutKind(desired.rbacManifest, "PriorityClass") : desired.rbacManifest;
   try {
-    await kubectlApply(ctx.exec, desired.rbacManifest);
-    result.recreatedPriorityClass = true;
+    await kubectlApply(ctx.exec, manifest);
   } catch (error) {
+    if (outcome !== "removed") throw error;
+    const value = await livePriorityClassValue(ctx, desired.priorityClass.name).catch(() => null);
+    if (value === desired.priorityClass.value) {
+      result.recreatedPriorityClass = true;
+      throw error;
+    }
     result.warnings.push(
-      `The \`${name}\` PriorityClass was removed to change its value but could not be recreated: ${error instanceof Error ? error.message : String(error)}. No build can start on this machine until it exists \u2014 run \`conveyor-k3 sync\`.`
+      `The \`${desired.priorityClass.name}\` PriorityClass was removed to change its value but could not be recreated: ${error instanceof Error ? error.message : String(error)}. No build can start on this machine until it exists \u2014 run \`conveyor-k3 sync\`.`
     );
+    return;
   }
-}
-function renderLimitRange(namespace, limits) {
-  const ns = assertK8sName(namespace, "namespace");
-  const values = [
-    assertQuantity(limits.defaultRequest.cpu, "defaultRequest.cpu"),
-    assertQuantity(limits.defaultRequest.memory, "defaultRequest.memory"),
-    assertQuantity(limits.default.cpu, "default.cpu"),
-    assertQuantity(limits.default.memory, "default.memory")
-  ];
-  return [
-    "apiVersion: v1",
-    "kind: LimitRange",
-    "metadata:",
-    "  name: conveyor-k3-defaults",
-    `  namespace: ${ns}`,
-    "spec:",
-    "  limits:",
-    "  - type: Container",
-    "    defaultRequest:",
-    `      cpu: "${values[0]}"`,
-    `      memory: "${values[1]}"`,
-    "    default:",
-    `      cpu: "${values[2]}"`,
-    `      memory: "${values[3]}"`,
-    ""
-  ].join("\n");
-}
-async function reconcileNamespaces(ctx, desired, result) {
-  for (const namespace of desired.namespaces) {
-    try {
-      await kubectlApply(ctx.exec, renderLimitRange(namespace.name, namespace.limitRange));
-    } catch (error) {
-      result.warnings.push(
-        `Could not apply resource defaults to ${namespace.name} (${namespace.projectName}): ${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-  }
+  if (outcome === "removed") result.recreatedPriorityClass = true;
 }
 async function step(result, label, run) {
   try {
@@ -8503,18 +9459,19 @@ async function reconcile(ctx, desired) {
       `Conveyor sent a cluster manifest containing disallowed kind(s) ${disallowedKinds.join(", ")} \u2014 refused. RBAC and PriorityClass steps skipped; this should never happen, report it.`
     );
   } else {
-    await step(result, "Could not apply RBAC", () => kubectlApply(ctx.exec, desired.rbacManifest));
-    await step(
-      result,
-      "Could not reconcile the PriorityClass",
-      () => reconcilePriorityClass(ctx, desired, result)
-    );
+    await step(result, "Could not apply RBAC", () => applyRbac(ctx, desired, result));
   }
   await step(
     result,
     "Could not apply namespace defaults",
     () => reconcileNamespaces(ctx, desired, result)
   );
+  await step(
+    result,
+    "Could not apply pod isolation",
+    () => reconcileIsolation(ctx, desired, result)
+  );
+  if (desired.isolation && result.isolation === void 0) result.isolation = { applied: false };
   if (manifestAccepted) {
     await step(
       result,
@@ -8523,6 +9480,7 @@ async function reconcile(ctx, desired) {
     );
   }
   const registry = desired.localRegistry?.enabled === true;
+  const managed = managesK3s(desired, await readState(ctx.fs).catch(() => ({})));
   if (registry) {
     await step(result, "Could not reconcile the local image registry", async () => {
       await deployLocalRegistry(ctx);
@@ -8531,10 +9489,27 @@ async function reconcile(ctx, desired) {
   await step(
     result,
     "Could not apply kubelet settings",
-    () => reconcileKubelet(ctx, desired, result)
+    () => reconcileKubelet(ctx, desired, result, managed)
   );
+  if (desired.isolation !== void 0) {
+    await step(result, "Could not cap pod CPU", async () => {
+      result.cpuQuotaApplied = await reconcilePodCpuQuota(ctx.exec, desired, result.warnings);
+    });
+    if (desired.kubelet.systemReserved?.cpu && result.cpuQuotaApplied === void 0) {
+      result.cpuQuotaApplied = false;
+    }
+  }
   if (registry && !result.restartedK3s) {
     await step(result, "Could not load the local image registry mirror", async () => {
+      if (!managed) {
+        if (await registryMirrorPending(ctx.fs))
+          result.warnings.push(
+            ownerRestartWarning(
+              "The local image registry's mirror or credential is new, and the registry stays open to every account on this machine until k3s loads it."
+            )
+          );
+        return;
+      }
       const loaded = await loadRegistryMirror(ctx);
       result.restartedK3s = loaded.restarted;
       if (loaded.warning) result.warnings.push(loaded.warning);
@@ -8547,6 +9522,8 @@ async function reconcile(ctx, desired) {
 var HOUR_MS2 = 60 * 6e4;
 var DAY_MS = 24 * HOUR_MS2;
 var STORE_MEASURE_INTERVAL_MS = 55 * 6e4;
+var ISOLATION_RETRY_FIRST_MS = 6e4;
+var ISOLATION_RETRY_MAX_MS = 10 * 6e4;
 var DISK_PRESSURE_FREE_FRACTION = 0.2;
 var STRANDED_PRUNE_BYTES = 20 * 1024 ** 3;
 function flattenWanted(desired) {
@@ -8587,12 +9564,24 @@ var ClusterDaemon = class {
   localImageHashes = /* @__PURE__ */ new Map();
   /** How long the in-cluster registry has been not ready, across beats. */
   registryWatch = { notReadySince: null };
+  /**
+   * Whether pod isolation is in force, from the last reconcile; undefined
+   * while desired state does not ask for it. Every heartbeat checks it again
+   * against k3s's own settings before reporting it.
+   */
+  isolation = void 0;
+  /** Whether the pod slice's CPU cap is in force, from the last reconcile. */
+  cpuQuotaApplied = void 0;
   timers = [];
   /** When the last store walk started, so one that failed is not retried on every reconcile. */
   storeWalkStartedAt = 0;
   /** Serializes reconcile against itself — a sync nudge during a reconcile
    *  must queue, not interleave two kubectl applies of the same manifests. */
   reconciling = null;
+  /** The run queued behind the running one, until it starts. At most one waits. */
+  queuedRun = null;
+  /** The next reconcile while pod isolation is not applied; `dueAt` 0 = none. */
+  isolationRetry = { delayMs: ISOLATION_RETRY_FIRST_MS, dueAt: 0 };
   constructor(ports) {
     this.ports = ports;
   }
@@ -8628,10 +9617,27 @@ var ClusterDaemon = class {
   }
   /** Fetch the desired state and converge to it. Queued, never concurrent. */
   syncAndReconcile() {
-    const run = (this.reconciling ?? Promise.resolve()).then(() => this.runReconcile());
+    if (this.queuedRun) return this.queuedRun;
+    const run = (this.reconciling ?? Promise.resolve()).then(() => {
+      this.queuedRun = null;
+      return this.runReconcile();
+    });
+    this.queuedRun = run;
     this.reconciling = run.catch(() => void 0);
     return run;
   }
+  /** Reconcile again later while pod isolation is not applied; stop once it is. */
+  scheduleIsolationRetry() {
+    if (this.isolation?.applied !== false) {
+      this.isolationRetry = { delayMs: ISOLATION_RETRY_FIRST_MS, dueAt: 0 };
+      return;
+    }
+    const { delayMs } = this.isolationRetry;
+    this.isolationRetry = {
+      delayMs: Math.min(delayMs * 2, ISOLATION_RETRY_MAX_MS),
+      dueAt: Date.now() + delayMs
+    };
+  }
   async runReconcile() {
     try {
       this.desired = await this.ports.connection.requestDesiredState();
@@ -8647,6 +9653,9 @@ var ClusterDaemon = class {
       this.desired
     );
     this.warnings = result.warnings;
+    this.isolation = result.isolation;
+    this.cpuQuotaApplied = result.cpuQuotaApplied;
+    this.scheduleIsolationRetry();
     for (const warning of result.warnings) this.ports.log(warning);
     if (result.prunedNamespaces.length > 0) {
       this.ports.log(
@@ -8802,6 +9811,11 @@ var ClusterDaemon = class {
         );
       }
       for (const failure of result.failures) this.ports.log(`Image prune failed \u2014 ${failure}`);
+      if (result.pending.length > 0) {
+        this.ports.log(
+          `Image removal still in progress for ${result.pending.length} image(s); the next prune re-checks them.`
+        );
+      }
     } catch (error) {
       this.ports.log(
         `Skipping image prune: ${error instanceof Error ? error.message : String(error)}`
@@ -8817,6 +9831,10 @@ var ClusterDaemon = class {
     const inventory = await readImageInventory(this.ports.exec).catch(() => null);
     const registryOn = this.desired?.localRegistry?.enabled === true;
     if (!registryOn) this.registryWatch.notReadySince = null;
+    const isolation = await recheckIsolation(
+      { exec: this.ports.exec, fs: this.ports.fs },
+      this.isolation
+    );
     return await collectHeartbeat(
       {
         exec: this.ports.exec,
@@ -8831,10 +9849,12 @@ var ClusterDaemon = class {
         lastPruneAt: this.state?.lastPruneAt ?? null,
         lastWarmAt: this.state?.lastWarmAt ?? null,
         lastUpdateAt: this.state?.lastUpdateAt ?? null,
-        localWarnings: [...this.warnings, ...this.warmWarnings],
+        localWarnings: [...this.warnings, ...this.warmWarnings, ...isolation.warnings],
         imageGcHighThreshold: this.effectiveImageGcHigh,
         localImageHashes: this.localImageHashes,
         ...registryOn ? { localRegistry: this.registryWatch } : {},
+        ...isolation.isolation ? { isolation: isolation.isolation } : {},
+        cpuQuotaApplied: this.cpuQuotaApplied,
         k3sStoreBytes: this.measuredStoreBytes
       },
       inventory
@@ -8859,6 +9879,10 @@ var ClusterDaemon = class {
     return this.beating;
   }
   async runBeat() {
+    if (this.isolationRetry.dueAt > 0 && Date.now() >= this.isolationRetry.dueAt) {
+      this.isolationRetry.dueAt = 0;
+      void this.syncAndReconcile();
+    }
     try {
       const workloads = await this.ports.connection.sendHeartbeat({
         ...await this.buildHeartbeat(),
@@ -8965,58 +9989,10 @@ function renderAllUnits(options) {
   };
 }
 
-// src/lib/fs-port.ts
-import { chmod, mkdir, readFile, rm, writeFile } from "fs/promises";
-var nodeFileSystem = {
-  async readFile(path) {
-    try {
-      return await readFile(path, "utf8");
-    } catch {
-      return null;
-    }
-  },
-  async writeFile(path, content, mode) {
-    await mkdir(path.slice(0, path.lastIndexOf("/")), { recursive: true });
-    await writeFile(path, content, "utf8");
-    if (mode !== void 0) await chmod(path, mode);
-  },
-  async removeFile(path) {
-    await rm(path, { force: true });
-  },
-  async ensureDir(path, mode) {
-    await mkdir(path, { recursive: true });
-    if (mode !== void 0) await chmod(path, mode);
-  }
-};
-function createMemoryFileSystem(seed = {}) {
-  const files = new Map(Object.entries(seed));
-  const modes = /* @__PURE__ */ new Map();
-  const removed = [];
-  return {
-    files,
-    modes,
-    removed,
-    readFile: (path) => Promise.resolve(files.get(path) ?? null),
-    writeFile: (path, content, mode) => {
-      files.set(path, content);
-      if (mode !== void 0) modes.set(path, mode);
-      return Promise.resolve();
-    },
-    removeFile: (path) => {
-      files.delete(path);
-      removed.push(path);
-      return Promise.resolve();
-    },
-    ensureDir: (path, mode) => {
-      if (mode !== void 0) modes.set(path, mode);
-      return Promise.resolve();
-    }
-  };
-}
-
 // src/verbs.ts
 var VERBS = [
   "vm",
+  "host",
   "setup",
   "start",
   "stop",
@@ -9049,14 +10025,22 @@ function parseArgs(argv) {
   }
   return { verb, positional, flags };
 }
-var HELP = `conveyor-k3 \u2014 managed personal compute for Conveyor
+var HELP = `conveyor-k3 \u2014 Personal Compute for Conveyor
 
 Usage: conveyor-k3 <command> [options]
 
-Commands:
-  vm                    Manage isolated compute on macOS or Linux.
-                        Run conveyor-k3 vm for host lifecycle commands.
-  setup                 Install and enrol this machine. Safe to re-run.
+One product, two runtimes. Pick the one that fits the machine:
+
+On your computer or server:
+  vm                    Personal computer runtime: an isolated VM on macOS or
+                        Linux. Run conveyor-k3 vm for its commands.
+  host                  Dedicated server runtime: k3s and the daemon on this
+                        Linux machine, with no VM. Root only. Run
+                        conveyor-k3 host for its commands.
+
+Inside a linked machine (the VM guest, or the server itself):
+  setup                 VM guest only: install and enrol this machine. Safe
+                        to re-run. On a server, use conveyor-k3 host setup.
   start                 Start the tunnel and the daemon.
   stop                  Stop both, and tell Conveyor at once so your next
                         build goes straight to project compute.
@@ -9081,10 +10065,12 @@ Commands:
                         into this node and pin it. Writes one file under
                         /etc/sudoers.d, checked with visudo first. Needed only
                         when a project has Bake Locally turned on.
-  uninstall             Remove Conveyor's units, environment, state, and image
-                        registry. Your k3s config, your own registries.yaml
-                        entries, your workloads, and the registry's data are
-                        left alone.
+  uninstall             VM guest only: remove Conveyor's units, environment,
+                        state, and image registry. Your k3s config, your own
+                        registries.yaml entries, your workloads, and the
+                        registry's data are left alone. On a server, use
+                        conveyor-k3 host uninstall: it also removes the
+                        device key.
                           --purge-k3s --yes     also remove k3s itself and the
                                                 registry's data
   daemon                Run in the foreground (what the systemd unit calls).
@@ -9168,19 +10154,79 @@ async function removeLocalRegistry(ports) {
       `Could not remove the local image registry from the cluster: ${removed.stderr.trim().slice(0, 200)}`
     );
   }
+  for (const [namespace, name] of [
+    [PERSONAL_LOCAL_REGISTRY_NAMESPACE, LOCAL_REGISTRY_HTPASSWD_SECRET],
+    [PERSONAL_BAKE_NAMESPACE, PERSONAL_LOCAL_REGISTRY_PUSH_SECRET]
+  ]) {
+    const secret = await ports.exec(
+      "k3s",
+      ["kubectl", "-n", namespace, "delete", "secret", name, "--ignore-not-found"],
+      { timeoutMs: 6e4 }
+    );
+    if (secret.exitCode !== 0) {
+      ports.log(
+        `Could not remove the local image registry's Secret ${namespace}/${name}: ${secret.stderr.trim().slice(0, 200)}`
+      );
+    }
+  }
   const raw = await ports.fs.readFile(REGISTRIES_FILE);
   const parsed = parseRegistries(raw);
-  if (mirrorEndpoints(parsed, PERSONAL_LOCAL_REGISTRY_HOST).length === 0) return;
+  const next = LOCAL_REGISTRY_AUTH_HOSTS.reduce(
+    removeRegistryAuth,
+    removeRegistryMirror(parsed, PERSONAL_LOCAL_REGISTRY_HOST)
+  );
+  if (serializeRegistries(next) === serializeRegistries(parsed)) return;
   const backup = await writeRegistriesWithBackup(
     ports.fs,
     raw,
-    removeRegistryMirror(parsed, PERSONAL_LOCAL_REGISTRY_HOST),
+    next,
     (ports.now ?? (() => /* @__PURE__ */ new Date()))()
   );
   ports.log(
-    `Removed the local image registry's mirror from ${REGISTRIES_FILE} (backup: ${backup}).`
+    `Removed the local image registry's mirror and credential from ${REGISTRIES_FILE} (backup: ${backup}).`
   );
 }
+async function removeIsolation(ports) {
+  const [key, value] = Object.entries(MANAGED_BY2)[0] ?? [];
+  const removed = await ports.exec(
+    "k3s",
+    ["kubectl", "delete", "networkpolicy", "-A", "-l", `${key}=${value}`, "--ignore-not-found"],
+    { timeoutMs: 12e4 }
+  );
+  if (removed.exitCode !== 0) {
+    ports.log(
+      `Could not remove Conveyor's network policies: ${removed.stderr.trim().slice(0, 200)}`
+    );
+  }
+  const listed = await ports.exec("k3s", [
+    "kubectl",
+    "get",
+    "namespaces",
+    "-o",
+    "jsonpath={.items[*].metadata.name}"
+  ]);
+  if (listed.exitCode !== 0) {
+    ports.log(
+      `Could not list namespaces to remove Conveyor's Pod Security labels: ${listed.stderr.trim().slice(0, 200)}`
+    );
+    return;
+  }
+  const namespaces = listed.stdout.split(/\s+/).filter((name) => name.startsWith("claudespace-") || name === PERSONAL_BAKE_NAMESPACE);
+  for (const namespace of namespaces) {
+    const unlabelled = await ports.exec("k3s", [
+      "kubectl",
+      "label",
+      "namespace",
+      namespace,
+      ...PSA_LABEL_KEYS.map((labelKey) => `${labelKey}-`)
+    ]);
+    if (unlabelled.exitCode !== 0) {
+      ports.log(
+        `Could not remove Conveyor's Pod Security labels from ${namespace}: ${unlabelled.stderr.trim().slice(0, 200)}`
+      );
+    }
+  }
+}
 async function uninstall(ports, options = {}) {
   const result = { stoppedUnits: [], removedFiles: [], purgedK3s: false };
   if (options.purgeK3s && !options.confirmed) {
@@ -9193,6 +10239,11 @@ async function uninstall(ports, options = {}) {
     result.stoppedUnits.push(unit);
   }
   await removeLocalRegistry(ports);
+  await removeIsolation(ports);
+  const lifted = await liftPodCpuQuota(ports.exec).catch(
+    (error) => error instanceof Error ? error.message : String(error)
+  );
+  if (lifted) ports.log(`Could not lift Conveyor's CPU cap on kubepods.slice: ${lifted}`);
   for (const path of OWNED_FILES) {
     await ports.fs.removeFile(path);
     result.removedFiles.push(path);
@@ -9245,6 +10296,45 @@ async function uninstall(ports, options = {}) {
   return result;
 }
 
+// src/lib/bins.ts
+var INSTALLER_PATHS = {
+  bun: "/root/.bun/bin/bun",
+  cli: "/root/.bun/bin/conveyor-k3",
+  cloudflared: "/usr/local/bin/cloudflared"
+};
+var CLI_PATH_LINK = "/usr/local/bin/conveyor-k3";
+async function linkCliOnPath(exec, target = INSTALLER_PATHS.cli) {
+  if (target === CLI_PATH_LINK) return { linked: false };
+  const present = await exec("test", ["-x", target]).catch(() => null);
+  if (present?.exitCode !== 0) return { linked: false };
+  const link = await exec("ln", ["-sfn", target, CLI_PATH_LINK]).catch(() => null);
+  if (link?.exitCode === 0) return { linked: true };
+  return {
+    linked: false,
+    problem: `Could not link ${CLI_PATH_LINK} to ${target}: ${link?.stderr.trim().slice(0, 200) || "ln failed"}`
+  };
+}
+
+// src/lib/cloudflared.ts
+var PACKAGE_MANAGER_REFUSAL = "installed by a package manager";
+async function resolveRealPath(exec, bin) {
+  const result = await exec("readlink", ["-f", bin]).catch(() => null);
+  const resolved = result?.exitCode === 0 ? result.stdout.trim() : "";
+  return resolved.startsWith("/") ? resolved : bin;
+}
+async function cloudflaredUpdater(exec, bin) {
+  const real = await resolveRealPath(exec, bin);
+  const owner = await exec("dpkg", ["-S", real]).catch(() => null);
+  return owner?.exitCode === 0 ? "package-manager" : "conveyor";
+}
+function isPackageManagerRefusal(output) {
+  return `${output.stdout}
+${output.stderr}`.toLowerCase().includes(PACKAGE_MANAGER_REFUSAL);
+}
+function describeCloudflaredUpdater(updater) {
+  return updater === "package-manager" ? "cloudflared is updated by your package manager, not by Conveyor" : "cloudflared is updated by Conveyor's daily update";
+}
+
 // src/commands/update.ts
 var CLOUDFLARED_UPDATED_EXIT = 11;
 function readExecStart(unit) {
@@ -9259,12 +10349,6 @@ function readExecStart(unit) {
   }
   return collected.join(" ");
 }
-function bareToken(token) {
-  let bare = token.trim();
-  if (bare.endsWith("\\")) bare = bare.slice(0, -1).trim();
-  if (bare.length >= 2 && bare.startsWith("'") && bare.endsWith("'")) bare = bare.slice(1, -1);
-  return bare;
-}
 function parseForeignExecFlags(execStart) {
   const ours = new Set(K3S_INSTALL_EXEC.split(/\s+/).filter((token) => token.startsWith("--")));
   const foreign = [];
@@ -9284,6 +10368,12 @@ async function foreignK3sExecFlags(exec) {
   return parseForeignExecFlags(readExecStart(unit.stdout));
 }
 function decideK3sUpgrade(input) {
+  if (input.managesK3s === false) {
+    return {
+      upgrade: false,
+      reason: "Conveyor did not install this server's k3s, so its owner upgrades it"
+    };
+  }
   if (!input.autoUpgradeK3s) {
     return { upgrade: false, reason: "automatic k3s upgrades are turned off for this machine" };
   }
@@ -9332,7 +10422,22 @@ async function updatePackage(ports, result, targetVersion) {
   await ports.exec("systemctl", ["restart", DAEMON_UNIT]);
 }
 async function updateCloudflared(ports, result) {
+  const packaged = () => {
+    result.cloudflaredUpdater = "package-manager";
+    result.notes.push(
+      `cloudflared update skipped: ${describeCloudflaredUpdater("package-manager")}`
+    );
+  };
+  if (await cloudflaredUpdater(ports.exec, ports.bins.cloudflared) === "package-manager") {
+    packaged();
+    return;
+  }
   const update = await ports.exec(ports.bins.cloudflared, ["update"], { timeoutMs: 5 * 6e4 });
+  if (isPackageManagerRefusal(update)) {
+    packaged();
+    return;
+  }
+  result.cloudflaredUpdater = "conveyor";
   if (update.exitCode !== CLOUDFLARED_UPDATED_EXIT) return;
   result.cloudflaredUpdated = true;
   ports.log("cloudflared was updated; restarting the tunnel.");
@@ -9342,10 +10447,13 @@ async function runUpdate(ports, decision, channel, targetVersion) {
   const result = {
     packageUpdated: false,
     cloudflaredUpdated: false,
+    cloudflaredUpdater: null,
     k3sUpgraded: false,
     notes: []
   };
   await updatePackage(ports, result, targetVersion);
+  const linked = await linkCliOnPath(ports.exec);
+  if (linked.problem) result.notes.push(linked.problem);
   await updateCloudflared(ports, result);
   if (!decision.upgrade) {
     result.notes.push(`k3s upgrade skipped: ${decision.reason}`);
@@ -9378,6 +10486,9 @@ async function runUpdate(ports, decision, channel, targetVersion) {
   return result;
 }
 
+// src/lib/env.ts
+import { readFileSync as readFileSync3 } from "fs";
+
 // src/commands/setup.ts
 var K3S_MIN_MAJOR_MINOR = [1, 29];
 function parseK3sVersion(output) {
@@ -10381,7 +11492,6 @@ export {
   renderAllUnits,
   renderGuestDnsProvision,
   renderK3sDropIn,
-  renderKubeletDropIn,
   renderRegistryAuthSummary,
   resolveCloudflaredSrvRecords,
   resolveNetwork,