devchain-cli 0.24.1 → 0.25.0

package/dist/server/modules/remotes/docker/docker-copy-back.js

@@ -13,13 +13,16 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DockerCopyBack = void 0;
+const docker_project_resources_1 = require("./docker-project-resources");
 const common_1 = require("@nestjs/common");
 const node_crypto_1 = require("node:crypto");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = require("node:path");
 const node_stream_1 = require("node:stream");
+const promises_2 = require("node:stream/promises");
 const error_types_1 = require("../../../common/errors/error-types");
 const docker_archive_journal_1 = require("../../core/controllers/docker-archive-journal");
+const docker_archive_owners_1 = require("../../core/controllers/docker-archive-owners");
 const docker_archive_1 = require("../../core/controllers/docker-archive");
 const docker_engine_client_1 = require("../../core/controllers/docker-engine.client");
 const host_docker_dto_1 = require("../host/host-docker.dto");
@@ -34,8 +37,19 @@ const docker_handoff_store_1 = require("./docker-handoff.store");
 const docker_plan_dto_1 = require("./docker-plan.dto");
 const docker_plan_service_1 = require("./docker-plan.service");
 const docker_plan_source_service_1 = require("./docker-plan-source.service");
+const docker_copy_back_exclusions_1 = require("./docker-copy-back-exclusions");
+const vm_user_identity_1 = require("../vm-user-identity");
+const docker_ownership_1 = require("./docker-ownership");
+const docker_data_representation_1 = require("./docker-data-representation");
+const docker_plan_files_1 = require("./docker-plan-files");
 const NEEDS_CHOICE = new Set(['both-changed', 'unknown']);
 const RUNNING_STATES = new Set(['running', 'restarting', 'paused']);
+const KEPT_VOLUME_LABELS = [
+    host_docker_dto_1.DOCKER_PROJECT_LABEL,
+    host_docker_dto_1.COMPOSE_PROJECT_LABEL,
+    host_docker_dto_1.COMPOSE_VOLUME_LABEL,
+    host_docker_dto_1.COMPOSE_VERSION_LABEL,
+];
 class DockerCopyBackError extends error_types_1.AppError {
     constructor(message, code = 'DOCKER_COPY_BACK_FAILED', status = 502) {
         super(message, code, status);
@@ -64,23 +78,81 @@ function importedGroups(groups, inventory, root) {
     };
     return groups.filter((group) => (0, docker_data_groups_1.overlapsData)(group, imported));
 }
+function itemData(item, root) {
+    return {
+        volumes: item.volumes.map((volume) => volume.name),
+        bindPaths: item.bindPaths.map((path) => (0, node_path_1.join)(root, path)),
+    };
+}
+function recordedGroupOwnership(inventory, group, root) {
+    const records = (inventory?.groups ?? [])
+        .filter((record) => (0, docker_data_groups_1.overlapsData)(group, record))
+        .map((record) => record.ownership)
+        .concat((inventory?.items ?? [])
+        .filter((item) => (0, docker_data_groups_1.overlapsData)(group, itemData(item, root)))
+        .map((item) => item.ownership));
+    return records.find((entry) => entry?.class === 'follows-user') ?? records.find(Boolean);
+}
+function recordedCopyBackData(inventory, group, root) {
+    const groups = inventory?.groups ?? [];
+    const records = [
+        ...groups,
+        ...(inventory?.items ?? []).flatMap((item) => (item.dataRepresentations ?? [])
+            .flatMap((snapshot) => (0, docker_data_representation_1.resourceMembers)(snapshot).map((members) => ({
+            ...members,
+            representation: snapshot.representation,
+            ownership: item.ownership,
+        })))
+            .filter((snapshot) => !groups.some((record) => (0, docker_data_groups_1.overlapsData)(record, snapshot)))),
+    ];
+    return (0, docker_data_representation_1.splitDataRepresentations)(group, records).map((part) => ({
+        volumes: part.volumes,
+        bindPaths: part.bindPaths,
+        representation: part.representation,
+        ownership: part.ownership ?? recordedGroupOwnership(inventory, part, root),
+    }));
+}
+function wasImported(members, inventory, root) {
+    return Boolean(inventory?.groups?.some((record) => (0, docker_data_groups_1.overlapsData)(record, members)) ||
+        inventory?.items.some((item) => (0, docker_data_groups_1.overlapsData)(members, itemData(item, root)) ||
+            item.dataRepresentations?.some((record) => (0, docker_data_groups_1.overlapsData)(record, members))));
+}
+function unknownFollowsData(parts, inventory) {
+    const records = [
+        ...(inventory?.groups ?? []),
+        ...(inventory?.items ?? []).flatMap((item) => item.dataRepresentations ?? []),
+    ];
+    return parts.some((part) => !part.representation &&
+        (part.ownership?.class === 'follows-user' ||
+            records.some((record) => record.representation?.kind === 'mapped' && (0, docker_data_groups_1.overlapsData)(record, part))));
+}
 function holds(container, members) {
     return (!container.labels[docker_archive_1.DOCKER_ARCHIVE_HELPER_LABEL] &&
         (0, docker_data_groups_1.overlapsData)((0, docker_data_groups_1.mountedData)(container.mounts), members));
 }
-function projectHolder(holder, vm, projectId) {
-    const compose = holder.labels[host_docker_dto_1.COMPOSE_PROJECT_LABEL];
-    return (holder.labels[host_docker_dto_1.DOCKER_PROJECT_LABEL] === projectId ||
-        (!holder.labels[host_docker_dto_1.DOCKER_PROJECT_LABEL] &&
-            compose !== undefined &&
-            vm.volumes.some((v) => v.labels[host_docker_dto_1.DOCKER_PROJECT_LABEL] === projectId &&
-                v.labels[host_docker_dto_1.COMPOSE_PROJECT_LABEL] === compose)));
-}
 const homeName = (c) => c.Names?.[0]?.replace(/^\//, '') ?? c.Id;
 const homeMounted = (c) => ({
     labels: c.Labels ?? {},
     mounts: (c.Mounts ?? []).map((m) => ({ type: m.Type, name: m.Name, source: m.Source })),
 });
+function blockedBinds(group, confirmed) {
+    const created = group.createdOnVm
+        ? group.bindPaths
+        : (group.dataRepresentations ?? [])
+            .filter((part) => part.createdOnVm)
+            .flatMap((part) => part.bindPaths);
+    return created.filter((path) => !confirmed.includes(path));
+}
+function keptParts(group) {
+    if (!group.createdOnVm && group.dataRepresentations?.length)
+        return group.dataRepresentations;
+    return [{ volumes: group.volumes, bindPaths: group.bindPaths, ownership: group.ownership }];
+}
+function skippedProgress(record) {
+    return Object.values(record.fileSyncSkipped ?? {})
+        .flat()
+        .map((path) => ({ path, reason: docker_copy_back_dto_1.FILE_SYNC_SKIP_REASON }));
+}
 let DockerCopyBack = class DockerCopyBack {
     plans;
     source;
@@ -89,8 +161,9 @@ let DockerCopyBack = class DockerCopyBack {
     journal;
     inventory;
     health;
+    exclusions;
     active = new Map();
-    constructor(plans, source, host, store, journal, inventory, health) {
+    constructor(plans, source, host, store, journal, inventory, health, exclusions) {
         this.plans = plans;
         this.source = source;
         this.host = host;
@@ -98,20 +171,12 @@ let DockerCopyBack = class DockerCopyBack {
         this.journal = journal;
         this.inventory = inventory;
         this.health = health;
+        this.exclusions = exclusions;
     }
     async syncState(projectId, input, signal) {
         const { remoteId } = docker_copy_back_dto_1.DockerSyncStateRequestSchema.parse(input);
         const inventory = this.inventory.get(projectId, remoteId);
-        if (!inventory)
-            return {
-                availability: {
-                    available: false,
-                    side: null,
-                    reason: { code: 'not-imported', message: 'No Docker data of this project is on the VM.' },
-                },
-                imported: false,
-                groups: [],
-            };
+        const imported = Boolean(inventory);
         const health = this.health.getState(remoteId);
         let unavailable = null;
         if (!health.online) {
@@ -129,24 +194,58 @@ let DockerCopyBack = class DockerCopyBack {
         if (unavailable)
             return {
                 availability: { available: false, side: 'remote', reason: unavailable },
-                imported: true,
+                imported,
                 groups: [],
             };
-        const plan = await this.plans.plan(projectId, { remoteId }, signal, { estimate: false });
-        if (!plan.availability.available)
-            return { availability: plan.availability, imported: true, groups: [] };
         const root = await this.plans.projectRoot(projectId);
+        const plan = await this.plans.plan(projectId, { remoteId }, signal, {
+            estimate: false,
+            dataBindPaths: (0, docker_import_inventory_store_1.inventoryBindPaths)(inventory, root),
+        });
+        if (!plan.availability.available)
+            return { availability: plan.availability, imported, groups: [] };
+        const groups = await this.candidates(projectId, remoteId, plan, inventory, root, signal);
+        const targets = groups.flatMap((group) => blockedBinds(group, []));
+        const confirmed = await this.exclusions.preview(projectId, remoteId, root, targets, signal);
         return {
-            availability: plan.availability,
-            imported: true,
-            groups: importedGroups(plan.dataGroups ?? [], inventory, root).map((group) => ({
-                key: (0, docker_data_groups_1.dockerDataGroupKey)(group),
-                itemNames: plan.items.filter((i) => group.itemIds.includes(i.id)).map((i) => i.name),
-                volumes: group.volumes,
-                bindPaths: group.bindPaths,
-                state: group.state,
-                needsChoice: NEEDS_CHOICE.has(group.state),
-            })),
+            availability: !inventory && !groups.length
+                ? {
+                    available: false,
+                    side: null,
+                    reason: {
+                        code: 'not-imported',
+                        message: 'No Docker data of this project is on the VM.',
+                    },
+                }
+                : plan.availability,
+            imported,
+            groups: groups.map((group) => {
+                const syncedByFileSync = blockedBinds(group, confirmed);
+                return {
+                    key: group.key,
+                    itemNames: group.itemNames,
+                    volumes: group.volumes,
+                    bindPaths: group.bindPaths,
+                    state: group.state,
+                    ...(group.dataRepresentations && {
+                        dataRepresentations: group.dataRepresentations.map((part) => ({
+                            volumes: part.volumes,
+                            bindPaths: part.bindPaths,
+                            ...(part.representation && {
+                                representation: {
+                                    kind: part.representation.kind,
+                                    home: { uid: part.representation.home.uid, gid: part.representation.home.gid },
+                                    vm: { uid: part.representation.vm.uid, gid: part.representation.vm.gid },
+                                },
+                            }),
+                        })),
+                    }),
+                    needsChoice: !group.skipReason && !syncedByFileSync.length && NEEDS_CHOICE.has(group.state),
+                    ...(group.skipReason ? { skipReason: group.skipReason } : {}),
+                    ...(group.createdOnVm && { createdOnVm: true }),
+                    ...(syncedByFileSync.length && { syncedByFileSync }),
+                };
+            }),
         };
     }
     interrupt(operationId) {
@@ -164,25 +263,70 @@ let DockerCopyBack = class DockerCopyBack {
         this.active.delete(operationId);
         await this.store.remove(operationId);
     }
+    prepareHomeCopy(run) {
+        return this.step(run, async (signal) => {
+            const record = await this.recordFor(run, signal);
+            await this.prepareExclusions(run, record, signal);
+        });
+    }
+    async recordFor(run, signal) {
+        const previous = await this.store.readCopyBack(run.operation.id);
+        if (!previous)
+            return this.decide(run, docker_copy_back_dto_1.DockerCopyBackRequestSchema.parse(run.details.dockerCopyBack ?? {}), signal);
+        const mismatch = (0, vm_user_identity_1.vmUserMismatch)(this.source.uid(), this.source.gid(), await this.host.remoteRuntime(run.operation.remoteId));
+        if (mismatch && (0, vm_user_identity_1.hasUnknownUserIds)(mismatch))
+            throw new DockerCopyBackError((0, vm_user_identity_1.dockerCopyBackMismatchMessage)(mismatch), 'DOCKER_COPY_BACK_UNAVAILABLE', 409);
+        const projectId = (0, remote_operation_types_1.requireProjectId)(run.operation);
+        const inventory = this.inventory.get(projectId, run.operation.remoteId);
+        const root = await this.plans.projectRoot(projectId);
+        for (const group of previous.groups) {
+            const ownership = group.ownership ?? recordedGroupOwnership(inventory, group, root);
+            group.dataRepresentations ??= recordedCopyBackData(inventory, { ...group, itemIds: [] }, root).map((part) => ({
+                ...part,
+                ownership: part.ownership ?? (!part.representation ? ownership : undefined),
+            }));
+            if (unknownFollowsData(group.dataRepresentations, inventory)) {
+                group.ownership = ownership;
+                group.skipReason = docker_copy_back_dto_1.FOLLOWS_USER_SKIP_REASON;
+                group.action = 'skip';
+            }
+        }
+        await this.store.writeCopyBack(run.operation.id, previous);
+        return previous;
+    }
+    async prepareExclusions(run, record, signal) {
+        const projectId = (0, remote_operation_types_1.requireProjectId)(run.operation);
+        const targets = record.groups
+            .filter((g) => g.action === 'copy-home' && !record.verified[g.key] && !record.absent.includes(g.key))
+            .flatMap((g) => g.bindPaths);
+        if (targets.length)
+            record.exclusions = await this.exclusions.prepare(projectId, run.operation.remoteId, await this.plans.projectRoot(projectId), [...new Set(targets)], signal);
+        await this.store.writeCopyBack(run.operation.id, record);
+    }
     copyHome(run) {
         return this.step(run, async (signal) => {
             const projectId = (0, remote_operation_types_1.requireProjectId)(run.operation);
             const { remoteId } = run.operation;
-            const request = docker_copy_back_dto_1.DockerCopyBackRequestSchema.parse(run.details.dockerCopyBack ?? {});
-            const record = (await this.store.readCopyBack(run.operation.id)) ??
-                (await this.decide(run, request, signal));
+            const record = await this.recordFor(run, signal);
+            if (!record.exclusions?.pending)
+                await this.prepareExclusions(run, record, signal);
+            if (record.exclusions) {
+                record.exclusions.pending = false;
+                await this.store.writeCopyBack(run.operation.id, record);
+            }
+            const projectRoot = await this.plans.projectRoot(projectId);
             const kept = record.groups.filter((g) => g.action === 'keep-home');
             if (kept.length && !record.keptAt) {
                 const options = { signal, apiVersion: record.apiVersion };
                 for (const group of kept)
-                    await this.stopVmProjectHolders(remoteId, projectId, await this.scanVm(remoteId, group, options), group, options);
+                    await this.stopVmProjectHolders(remoteId, projectId, await this.scanVm(remoteId, group, options), group, options, projectRoot);
                 record.keptAt = new Date().toISOString();
                 await this.store.writeCopyBack(run.operation.id, record);
             }
             if (record.keptAt)
                 this.discardVm(projectId, remoteId, kept, record.keptAt);
             for (const verified of Object.values(record.verified))
-                this.stamp(projectId, remoteId, verified, verified.at);
+                this.stamp(projectId, remoteId, verified, verified.at, projectRoot);
             const pending = record.groups.filter((g) => g.action === 'copy-home' && !record.verified[g.key] && !record.absent.includes(g.key));
             if (pending.length) {
                 const client = await this.source.connect(signal);
@@ -205,6 +349,17 @@ let DockerCopyBack = class DockerCopyBack {
                         await this.copyGroup(run.operation.id, record, group, client, projectId, remoteId, {
                             options,
                             progress,
+                            projectRoot,
+                            run,
+                            confirmBinds: async (paths) => {
+                                if (!paths.length)
+                                    return [];
+                                const proof = record.exclusions;
+                                if (!proof)
+                                    return [];
+                                const live = await this.exclusions.confirm(projectId, remoteId, projectRoot, paths, proof.revision, signal);
+                                return live.filter((path) => proof.confirmed.includes(path));
+                            },
                         });
                     }
                     catch (error) {
@@ -221,12 +376,19 @@ let DockerCopyBack = class DockerCopyBack {
                     throw new DockerCopyBackError(`Docker data was not copied home. ${failures.join(' ')} Retry copies only what is left.`);
             }
             await run.progress({
+                dockerOwnershipSkipped: record.groups
+                    .filter((group) => group.skipReason)
+                    .map((group) => ({ label: group.label, reason: group.skipReason })),
+                dockerCopyBackSkipped: skippedProgress(record),
                 dockerCopyBackResult: {
                     copied: record.groups.filter((g) => record.verified[g.key]).map((g) => g.label),
                     kept: kept.map((g) => g.label),
                     skipped: record.groups
-                        .filter((g) => g.action === 'skip' || record.absent.includes(g.key))
+                        .filter((g) => g.action === 'skip' ||
+                        record.absent.includes(g.key) ||
+                        record.fileSyncSkipped?.[g.key]?.length)
                         .map((g) => g.label),
+                    alreadyTargetEntries: Object.values(record.verified).reduce((sum, verified) => sum + (verified.alreadyTargetEntries ?? 0), 0),
                 },
             });
         });
@@ -244,70 +406,422 @@ let DockerCopyBack = class DockerCopyBack {
             decidedAt: new Date().toISOString(),
         };
         const inventory = this.inventory.get(projectId, remoteId);
-        if (inventory) {
-            const plan = await this.plans.plan(projectId, { remoteId }, signal, { estimate: false });
-            if (!plan.availability.available || !plan.apiVersion) {
-                const reason = plan.availability.reason?.message ?? 'Docker is unavailable.';
-                throw new DockerCopyBackError(plan.availability.side === 'home'
-                    ? `Docker on this PC cannot be used: ${reason} Fix it and press Retry, or Cancel.`
-                    : `The VM's Docker cannot be used: ${reason} Start it and press Retry, or Cancel.`, 'DOCKER_COPY_BACK_UNAVAILABLE');
-            }
-            const root = await this.plans.projectRoot(projectId);
-            record.apiVersion = plan.apiVersion;
-            record.projectContainers = plan.items
-                .filter((item) => item.kind === 'container' &&
-                (item.linkedReasons.length > 0 || inventory.items.some((i) => i.name === item.name)))
-                .map((item) => item.id);
-            record.groups = importedGroups(plan.dataGroups ?? [], inventory, root).map((group) => {
-                const key = (0, docker_data_groups_1.dockerDataGroupKey)(group);
-                const items = plan.items.filter((i) => group.itemIds.includes(i.id));
-                const choice = request.choices[key];
-                const images = [...new Set(items.flatMap((i) => i.images.map((image) => image.id)))];
-                return {
-                    key,
-                    label: items.map((i) => i.name).join(', ') || key,
-                    state: group.state,
-                    action: copyBackAction(group.state, choice),
-                    volumes: group.volumes,
-                    bindPaths: group.bindPaths,
-                    images,
-                    vmImages: images.map((id) => inventory.items.find((item) => item.imageId === id && item.vmImageId)?.vmImageId ??
-                        id),
-                    sizeBytes: groupSize(items, group),
-                };
-            });
-            const unresolved = record.groups.filter((g) => NEEDS_CHOICE.has(g.state) && !request.choices[g.key]);
-            if (unresolved.length)
-                throw choiceRequired(unresolved.map((g) => g.state === 'unknown'
-                    ? `The changes of ${g.label} cannot be checked.`
-                    : `${g.label} changed on both this PC and the VM.`));
+        const root = await this.plans.projectRoot(projectId);
+        const plan = await this.plans.plan(projectId, { remoteId }, signal, {
+            estimate: false,
+            dataBindPaths: (0, docker_import_inventory_store_1.inventoryBindPaths)(inventory, root),
+        });
+        if (plan.availability.reason?.code === 'vm-user-mismatch')
+            throw new DockerCopyBackError(plan.availability.userMismatch
+                ? (0, vm_user_identity_1.dockerCopyBackMismatchMessage)(plan.availability.userMismatch)
+                : plan.availability.reason.message, 'DOCKER_COPY_BACK_UNAVAILABLE', 409);
+        if (!plan.availability.available || !plan.apiVersion) {
+            const reason = plan.availability.reason?.message ?? 'Docker is unavailable.';
+            throw new DockerCopyBackError(plan.availability.side === 'home'
+                ? `Docker on this PC cannot be used: ${reason} Fix it and press Retry, or Cancel.`
+                : `The VM's Docker cannot be used: ${reason} Start it and press Retry, or Cancel.`, 'DOCKER_COPY_BACK_UNAVAILABLE');
         }
+        record.apiVersion = plan.apiVersion;
+        record.projectContainers = plan.items
+            .filter((item) => item.kind === 'container' &&
+            (item.linkedReasons.length > 0 || inventory?.items.some((i) => i.name === item.name)))
+            .map((item) => item.id);
+        const candidates = await this.candidates(projectId, remoteId, plan, inventory, root, signal);
+        const confirmed = await this.exclusions.preview(projectId, remoteId, root, candidates.flatMap((group) => blockedBinds(group, [])), signal);
+        record.groups = candidates.map(({ itemNames: _names, ...group }) => {
+            const blocked = blockedBinds(group, confirmed);
+            if (blocked.length) {
+                record.fileSyncSkipped ??= {};
+                record.fileSyncSkipped[group.key] = blocked;
+            }
+            return {
+                ...group,
+                action: group.skipReason || blocked.length
+                    ? 'skip'
+                    : copyBackAction(group.state, request.choices[group.key]),
+            };
+        });
+        const unresolved = record.groups.filter((g) => !g.skipReason &&
+            NEEDS_CHOICE.has(g.state) &&
+            !record.fileSyncSkipped?.[g.key]?.length &&
+            !request.choices[g.key]);
+        if (unresolved.length)
+            throw choiceRequired(unresolved.map((g) => g.state === 'unknown'
+                ? `The changes of ${g.label} cannot be checked.`
+                : `${g.label} changed on both this PC and the VM.`));
         await this.store.writeCopyBack(run.operation.id, record);
         return record;
     }
+    async candidates(projectId, remoteId, plan, inventory, root, signal) {
+        const imported = inventory ? importedGroups(plan.dataGroups ?? [], inventory, root) : [];
+        const candidates = imported.map((group) => {
+            const items = plan.items.filter((i) => group.itemIds.includes(i.id));
+            const images = [...new Set(items.flatMap((i) => i.images.map((image) => image.id)))];
+            const itemNames = items.map((i) => i.name);
+            const ownership = recordedGroupOwnership(inventory, group, root);
+            const dataRepresentations = recordedCopyBackData(inventory, group, root);
+            return {
+                ...(ownership ? { ownership } : {}),
+                dataRepresentations,
+                ...(unknownFollowsData(dataRepresentations, inventory)
+                    ? { skipReason: docker_copy_back_dto_1.FOLLOWS_USER_SKIP_REASON }
+                    : {}),
+                key: (0, docker_data_groups_1.dockerDataGroupKey)(group),
+                label: itemNames.join(', ') || (0, docker_data_groups_1.dockerDataGroupKey)(group),
+                itemNames,
+                state: group.state,
+                volumes: group.volumes,
+                bindPaths: group.bindPaths,
+                images,
+                vmImages: images.map((id) => inventory?.items.find((item) => item.imageId === id && item.vmImageId)?.vmImageId ?? id),
+                sizeBytes: groupSize(items, group),
+            };
+        });
+        const options = { signal, apiVersion: plan.apiVersion };
+        const vm = await this.host.dockerScan(remoteId, [], options);
+        const items = [];
+        const overlapsImported = (members) => imported.some((g) => (0, docker_data_groups_1.overlapsData)(g, members));
+        for (const container of vm.containers) {
+            if (!(0, docker_project_resources_1.projectContainer)(container, root, projectId, vm.volumes))
+                continue;
+            const mounts = [];
+            for (const mount of container.mounts) {
+                if (mount.type === 'volume' && mount.name) {
+                    const volume = vm.volumes.find((v) => v.name === mount.name);
+                    if (volume &&
+                        (0, docker_project_resources_1.projectVolume)(volume.labels, vm.containers, root, projectId, vm.volumes) &&
+                        !overlapsImported({ volumes: [volume.name], bindPaths: [] }))
+                        mounts.push({
+                            kind: 'named-volume',
+                            source: volume.name,
+                            destination: mount.destination,
+                            readOnly: false,
+                            size: (0, docker_plan_source_service_1.unknownSize)(),
+                        });
+                    continue;
+                }
+                const source = mount.source;
+                if (mount.type !== 'bind' ||
+                    !source ||
+                    source === root ||
+                    !(0, docker_plan_files_1.within)(root, source) ||
+                    overlapsImported({ volumes: [], bindPaths: [source] }))
+                    continue;
+                const kind = await this.source.bindKind(root, source, false, [], signal);
+                if (kind === 'project-bind')
+                    mounts.push({
+                        kind,
+                        source,
+                        destination: mount.destination,
+                        readOnly: false,
+                        size: (0, docker_plan_source_service_1.unknownSize)(),
+                    });
+            }
+            items.push({ id: container.id, mounts, temporary: false });
+        }
+        const groups = (0, docker_data_groups_1.groupDockerData)(items, root);
+        const identities = await this.knownIdentities(remoteId);
+        const context = identities && (0, docker_ownership_1.userIdsDiffer)(identities) ? identities : undefined;
+        for (const candidate of candidates) {
+            if (identities)
+                await this.resolveImportedNewData(candidate, vm, projectId, root, inventory, identities, signal);
+            const refusal = await this.mappedOwnershipRefusal(candidate, candidate, vm, projectId, root, inventory, signal, identities);
+            if (refusal)
+                candidate.skipReason ??= refusal;
+        }
+        if (!groups.length)
+            return candidates;
+        const consumers = context
+            ? await this.vmOwnershipConsumers(vm, projectId, root, context, signal)
+            : [];
+        const client = await this.source.connect(signal);
+        client.apiVersion = plan.apiVersion;
+        const containers = await this.homeContainers(client, signal);
+        const holders = await Promise.all(containers.map(async (container) => {
+            const inspect = await (0, docker_engine_client_1.optionalDockerJson)(client, `/containers/${encodeURIComponent(container.Id)}/json`, signal);
+            return {
+                ...(0, docker_data_groups_1.mountedData)(homeMounted(container).mounts),
+                metadata: inspect
+                    ? {
+                        created: inspect.Created,
+                        startedAt: inspect.State?.StartedAt,
+                        running: inspect.State?.Running,
+                    }
+                    : undefined,
+            };
+        }));
+        for (const group of groups) {
+            const scanned = await this.scanVm(remoteId, group, options);
+            const members = (0, docker_data_groups_1.presentOnVm)(group, scanned, projectId, root);
+            if (!members.volumes.length && !members.bindPaths.length)
+                continue;
+            const check = (0, docker_data_groups_1.checkDockerDataGroup)({ ...members, itemIds: group.itemIds }, inventory?.groups ?? [], holders, scanned, projectId, root);
+            const hasHomeData = await this.hasHomeData(client, members, signal);
+            const state = check.state === 'unknown' ? (hasHomeData ? 'unknown' : 'vm-newer') : check.state;
+            const held = vm.containers.filter((c) => group.itemIds.includes(c.id));
+            if (context)
+                (0, docker_ownership_1.applyDockerGroupOwnership)([check], [], consumers, context);
+            const dataRepresentations = (0, docker_data_representation_1.splitDataRepresentations)(check).map((part) => ({
+                volumes: part.volumes,
+                bindPaths: part.bindPaths,
+                representation: part.representation,
+                ownership: (0, docker_ownership_1.ownershipRecord)(part.ownership),
+            }));
+            const itemNames = held.map((c) => c.name);
+            const images = [...new Set(held.flatMap((c) => (c.image ? [c.image] : [])))];
+            candidates.push({
+                dataRepresentations,
+                ...(check.ownership ? { ownership: (0, docker_ownership_1.ownershipRecord)(check.ownership) } : {}),
+                ...(check.ownership?.refusalReasons?.length
+                    ? { skipReason: check.ownership.refusalReasons.map((reason) => reason.message).join(' ') }
+                    : {}),
+                key: (0, docker_data_groups_1.dockerDataGroupKey)(members),
+                label: itemNames.join(', ') || (0, docker_data_groups_1.dockerDataGroupKey)(members),
+                itemNames,
+                ...members,
+                state,
+                images,
+                vmImages: images,
+                imageReferences: [
+                    ...new Set(held.flatMap((c) => (c.imageReference ? [c.imageReference] : []))),
+                ],
+                createdOnVm: true,
+                sizeBytes: 0,
+            });
+        }
+        return candidates;
+    }
+    async knownIdentities(remoteId) {
+        const runtime = await this.host.remoteRuntime(remoteId);
+        const uid = this.source.uid();
+        const gid = this.source.gid();
+        if (uid === null || gid === null || runtime.uid == null || runtime.gid == null)
+            return undefined;
+        return { home: { uid, gid }, vm: { uid: runtime.uid, gid: runtime.gid } };
+    }
+    async resolveImportedNewData(group, vm, projectId, root, inventory, context, signal) {
+        const fresh = (0, docker_data_representation_1.resourceMembers)(group).filter((members) => !wasImported(members, inventory, root));
+        if (!fresh.length)
+            return;
+        const consumers = await this.vmOwnershipConsumers(vm, projectId, root, context, signal, inventory, true);
+        const freshMembers = {
+            volumes: fresh.flatMap((members) => members.volumes),
+            bindPaths: fresh.flatMap((members) => members.bindPaths),
+        };
+        group.dataRepresentations = (group.dataRepresentations ?? [])
+            .map((part) => ({
+            ...part,
+            volumes: part.volumes.filter((volume) => !freshMembers.volumes.includes(volume)),
+            bindPaths: part.bindPaths.filter((path) => !freshMembers.bindPaths.includes(path)),
+        }))
+            .filter((part) => part.volumes.length || part.bindPaths.length);
+        for (const members of fresh) {
+            const checked = { ...members, itemIds: [], state: group.state };
+            (0, docker_ownership_1.applyDockerGroupOwnership)([checked], [], consumers, context);
+            group.dataRepresentations.push({
+                ...members,
+                representation: (0, docker_data_representation_1.desiredDataRepresentation)(checked),
+                ownership: (0, docker_ownership_1.ownershipRecord)(checked.ownership),
+                createdOnVm: true,
+            });
+            if (checked.ownership?.refusalReasons?.length)
+                group.skipReason ??= checked.ownership.refusalReasons
+                    .map((reason) => reason.message)
+                    .join(' ');
+        }
+    }
+    async vmOwnershipConsumers(vm, projectId, root, context, signal, recorded, requireCurrentCompose = false) {
+        const ownershipOnVm = new Map();
+        const literalHomeOnVm = new Set();
+        const recordedFollower = (container) => {
+            if (!(0, docker_project_resources_1.projectContainer)(container, root, projectId, vm.volumes))
+                return undefined;
+            const item = recorded?.items.find((item) => item.name === container.name.replace(/^\//, '') &&
+                (item.vmImageId ?? item.imageId) === container.image);
+            const ownership = item?.ownership;
+            if (ownership?.class !== 'follows-user' ||
+                ownership.home.uid !== context.home.uid ||
+                ownership.home.gid !== context.home.gid ||
+                ownership.vm.uid !== context.vm.uid ||
+                ownership.vm.gid !== context.vm.gid)
+                return undefined;
+            const user = container.user;
+            const gid = user?.split(':')[1];
+            const compatible = ownership.targetUser !== undefined
+                ? user === ownership.targetUser
+                : (0, docker_ownership_1.dockerNumericUid)(user) === ownership.vm.uid &&
+                    (gid === undefined || gid === String(ownership.vm.gid));
+            return compatible ? { ...context, class: 'follows-user' } : undefined;
+        };
+        const resolved = new Map();
+        for (const container of vm.containers) {
+            const service = container.labels['com.docker.compose.service'];
+            const directory = container.labels['com.docker.compose.project.working_dir'] || root;
+            if (!service || !(0, docker_project_resources_1.projectContainer)(container, root, projectId, vm.volumes))
+                continue;
+            const files = container.labels['com.docker.compose.project.config_files']
+                ?.split(',')
+                .filter(Boolean);
+            const key = JSON.stringify([directory, files, service]);
+            if (!resolved.has(key))
+                resolved.set(key, (async () => {
+                    try {
+                        const [home, target] = await Promise.all([context.home, context.vm].map((ids) => this.source.compose(directory, {
+                            files,
+                            allProfiles: true,
+                            signal,
+                            env: { DEVCHAIN_UID: String(ids.uid), DEVCHAIN_GID: String(ids.gid) },
+                        })));
+                        if (!home || !target || !home.services?.[service] || !target.services?.[service])
+                            return null;
+                        return {
+                            homeUser: home.services[service].user,
+                            vmUser: target.services[service].user,
+                        };
+                    }
+                    catch (error) {
+                        if (signal?.aborted)
+                            throw error;
+                        return null;
+                    }
+                })());
+            const users = await resolved.get(key);
+            const retained = !users && !requireCurrentCompose ? recordedFollower(container) : undefined;
+            const ownership = retained ??
+                (0, docker_ownership_1.classifyDockerOwnership)(context, container.user, undefined, false, users ? { source: { directory, files: files ?? [], service }, ...users } : undefined, true);
+            if ((recorded !== undefined || requireCurrentCompose) &&
+                users &&
+                ownership.class === 'follows-user' &&
+                container.user !== users.vmUser) {
+                ownership.class = 'exact';
+                delete ownership.target;
+            }
+            const exactAllowed = (0, docker_ownership_1.exactUidAllowed)((0, docker_ownership_1.dockerNumericUid)(container.user), context);
+            if (!users &&
+                !retained &&
+                !(recorded !== undefined && !requireCurrentCompose && exactAllowed))
+                ownership.refusalReasons = [
+                    {
+                        code: 'ownership-resolution-failed',
+                        message: `${container.name}: Cannot resolve the VM Compose data ownership with both home and VM user ids. Verify the Compose configuration before copying this data home.`,
+                    },
+                ];
+            else if (users &&
+                (recorded === undefined || container.user === users.vmUser) &&
+                (0, docker_ownership_1.literalHomeComposeUser)(context, users.homeUser, users.vmUser))
+                literalHomeOnVm.add(container.id);
+            ownershipOnVm.set(container.id, ownership);
+        }
+        return vm.containers
+            .filter((container) => !container.labels[docker_archive_1.DOCKER_ARCHIVE_HELPER_LABEL])
+            .map((container) => ({
+            ...(0, docker_data_groups_1.mountedData)(container.mounts),
+            name: container.name,
+            user: container.user,
+            ownership: ownershipOnVm.get(container.id) ??
+                recordedFollower(container) ??
+                (0, docker_ownership_1.classifyDockerOwnership)(context, container.user, undefined, false, undefined, true),
+            literalHomeUser: literalHomeOnVm.has(container.id),
+        }));
+    }
+    async hasHomeData(client, members, signal) {
+        for (const name of members.volumes)
+            if (await (0, docker_engine_client_1.optionalDockerJson)(client, `/volumes/${encodeURIComponent(name)}`, signal))
+                return true;
+        for (const path of members.bindPaths) {
+            signal?.throwIfAborted();
+            try {
+                const stats = await (0, promises_1.lstat)(path);
+                if (!stats.isDirectory() || (await (0, promises_1.readdir)(path)).length)
+                    return true;
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    return true;
+            }
+        }
+        return false;
+    }
+    async mappedOwnershipRefusal(group, members, vm, projectId, root, inventory, signal, currentContext) {
+        for (const part of group.dataRepresentations ?? []) {
+            const representation = part.representation;
+            if (!representation || (representation.kind !== 'mapped' && !part.createdOnVm))
+                continue;
+            const context = part.createdOnVm ? (currentContext ?? representation) : representation;
+            const mapped = {
+                volumes: members.volumes.filter((volume) => part.volumes.includes(volume)),
+                bindPaths: members.bindPaths.filter((path) => (0, docker_data_groups_1.overlapsData)(part, { volumes: [], bindPaths: [path] })),
+            };
+            if (!mapped.volumes.length && !mapped.bindPaths.length)
+                continue;
+            const checked = { ...mapped, itemIds: [], state: group.state };
+            const consumers = await this.vmOwnershipConsumers(vm, projectId, root, context, signal, inventory, part.createdOnVm);
+            if (!group.createdOnVm && !part.createdOnVm)
+                consumers.push({
+                    ...mapped,
+                    name: group.label,
+                    ownership: { ...representation, class: 'follows-user' },
+                });
+            (0, docker_ownership_1.applyDockerGroupOwnership)([checked], [], consumers, context);
+            if (checked.ownership?.refusalReasons?.length)
+                return checked.ownership.refusalReasons.map((reason) => reason.message).join(' ');
+            if ((group.createdOnVm || part.createdOnVm) &&
+                (0, docker_data_representation_1.resourceMembers)(mapped).some((resource) => !(0, docker_data_representation_1.sameDataRepresentation)((0, docker_data_representation_1.desiredDataRepresentation)(checked, resource), representation)))
+                return `${[...mapped.volumes, ...mapped.bindPaths].join(', ')}: The current VM consumers require a different owner representation. Start Disconnect again after verifying their user ids and Compose configuration.`;
+        }
+    }
+    async checkMappedOwnership(group, members, vm, projectId, root, remoteId, signal) {
+        let currentContext;
+        if (group.dataRepresentations?.some((part) => part.createdOnVm)) {
+            currentContext = await this.knownIdentities(remoteId);
+            if (!currentContext)
+                throw new DockerCopyBackError('The current home and VM user ids cannot be verified before copying new Docker data.', 'DOCKER_COPY_BACK_OWNERSHIP_CHANGED', 409);
+        }
+        const refusal = await this.mappedOwnershipRefusal(group, members, vm, projectId, root, group.createdOnVm ? undefined : this.inventory.get(projectId, remoteId), signal, currentContext);
+        if (refusal)
+            throw new DockerCopyBackError(refusal, 'DOCKER_COPY_BACK_OWNERSHIP_CHANGED', 409);
+    }
     async copyGroup(operationId, record, group, client, projectId, remoteId, context) {
-        const { options } = context;
+        const { options, projectRoot } = context;
         const vm = await this.scanVm(remoteId, group, options);
-        const members = (0, docker_data_groups_1.presentOnVm)(group, vm, projectId);
+        const members = (0, docker_data_groups_1.presentOnVm)(group, vm, projectId, projectRoot);
         if (!members.volumes.length && !members.bindPaths.length) {
             record.absent.push(group.key);
             await this.store.writeCopyBack(operationId, record);
             return;
         }
-        const images = await this.helperImages(client, remoteId, group, options);
-        for (const volume of members.volumes)
-            if (!(await (0, docker_engine_client_1.optionalDockerJson)(client, `/volumes/${encodeURIComponent(volume)}`, options.signal)))
-                throw new DockerCopyBackError(`Volume ${volume} no longer exists on this PC.`);
+        const skippedAsSynced = async () => {
+            const confirmed = await context.confirmBinds(members.bindPaths);
+            const blocked = members.bindPaths.filter((path) => !confirmed.includes(path));
+            if (!blocked.length)
+                return false;
+            await this.skipSyncedBinds(context.run, record, group, blocked);
+            return true;
+        };
+        if (await skippedAsSynced())
+            return;
+        if (record.fileSyncSkipped)
+            delete record.fileSyncSkipped[group.key];
+        await this.checkMappedOwnership(group, members, vm, projectId, projectRoot, remoteId, options.signal);
+        const images = await this.helperImages(client, remoteId, group, vm, options);
+        const missingVolumes = [];
+        for (const volume of members.volumes) {
+            const home = await (0, docker_engine_client_1.optionalDockerJson)(client, `/volumes/${encodeURIComponent(volume)}`, options.signal);
+            if (!home)
+                missingVolumes.push(volume);
+            else if ((0, docker_project_resources_1.foreignProjectOwner)(home.Labels, projectId))
+                throw new DockerCopyBackError(`Volume ${volume} on this PC belongs to another project.`, 'DOCKER_UNRELATED_HOLDER');
+        }
         const vmHolders = vm.containers.filter((c) => holds(c, members));
-        const unrelated = vmHolders.filter((c) => !projectHolder(c, vm, projectId) && c.metadata?.running !== false);
+        const unrelated = vmHolders.filter((c) => !(0, docker_project_resources_1.projectContainer)(c, projectRoot, projectId, vm.volumes) && c.metadata?.running !== false);
         if (unrelated.length)
             throw new DockerCopyBackError(`Running VM containers that are not part of this project use its data: ${unrelated.map((c) => c.name).join(', ')}. Stop them on the VM and press Retry, or Cancel.`, 'DOCKER_UNRELATED_HOLDER');
         const homeHolders = (await this.homeContainers(client, options.signal)).filter((c) => holds(homeMounted(c), members));
         const homeRunning = homeHolders.filter((c) => RUNNING_STATES.has(c.State ?? ''));
-        const homeUnrelated = homeRunning.filter((c) => !record.projectContainers.includes(c.Id));
+        const homeUnrelated = homeRunning.filter((c) => (0, docker_project_resources_1.foreignProjectOwner)(c.Labels, projectId) || !record.projectContainers.includes(c.Id));
         if (homeUnrelated.length)
             throw new DockerCopyBackError(`Running containers on this PC that are not part of this project use its data: ${homeUnrelated.map(homeName).join(', ')}. Stop them and press Retry, or Cancel.`, 'DOCKER_UNRELATED_HOLDER');
-        await this.stopVmProjectHolders(remoteId, projectId, vm, members, options);
+        await this.stopVmProjectHolders(remoteId, projectId, vm, members, options, projectRoot);
         for (const holder of homeRunning)
             await (0, docker_engine_client_1.changeDockerContainerState)(client, holder.Id, 'stop', options.signal);
         const [vmAgain, homeAgain] = await Promise.all([
@@ -324,13 +838,24 @@ let DockerCopyBack = class DockerCopyBack {
         ];
         if (stillRunning.length)
             throw new DockerCopyBackError(`Containers that use its data are running again: ${stillRunning.join(', ')}. Stop them and press Retry, or Cancel.`);
+        await this.checkMappedOwnership(group, members, vmAgain, projectId, projectRoot, remoteId, options.signal);
         const change = await this.homeChange(client, record, group, homeAgain, options.signal);
         if (change)
             throw choiceRequired([change]);
+        if (await skippedAsSynced())
+            return;
         if (!record.started.includes(group.key)) {
             record.started.push(group.key);
             await this.store.writeCopyBack(operationId, record);
         }
+        for (const name of missingVolumes) {
+            const volume = vmAgain.volumes.find((v) => v.name === name);
+            if (!volume ||
+                !(0, docker_project_resources_1.projectVolume)(volume.labels, vmAgain.containers, projectRoot, projectId, vmAgain.volumes))
+                throw new DockerCopyBackError(`Volume ${name} is no longer held for this project on the VM.`);
+            const labels = Object.fromEntries(Object.entries(volume.labels).filter(([key]) => KEPT_VOLUME_LABELS.includes(key)));
+            await client.json('POST', '/volumes/create', { Name: name, Labels: labels }, { signal: options.signal });
+        }
         const files = new Set(vmAgain.paths.filter((p) => 'exists' in p && p.file).map((p) => p.path));
         const sources = [
             ...members.volumes.map((source) => ({ type: 'volume', source })),
@@ -339,76 +864,126 @@ let DockerCopyBack = class DockerCopyBack {
                 source,
             })),
         ];
-        for (const { type, source } of sources)
-            await this.copyOne(client, remoteId, projectId, type, source, images, context);
+        context.missingVolumes = missingVolumes;
+        let alreadyTargetEntries = 0;
+        for (const { type, source } of sources) {
+            if (type !== 'volume' && !(await context.confirmBinds([source])).includes(source)) {
+                await this.skipSyncedBinds(context.run, record, group, [source]);
+                throw new DockerCopyBackError(`${source}: ${docker_copy_back_dto_1.FILE_SYNC_SKIP_REASON}.`);
+            }
+            alreadyTargetEntries += await this.copyOne(client, remoteId, projectId, type, source, images, context, (0, docker_data_representation_1.recordedDataRepresentation)(type === 'volume'
+                ? { volumes: [source], bindPaths: [] }
+                : { volumes: [], bindPaths: [source] }, group.dataRepresentations ?? []));
+        }
         const at = new Date().toISOString();
-        record.verified[group.key] = { at, ...members };
+        const dataRepresentations = (group.dataRepresentations ?? [])
+            .map((part) => ({
+            ...part,
+            volumes: part.volumes.filter((volume) => members.volumes.includes(volume)),
+            bindPaths: part.bindPaths.filter((path) => members.bindPaths.includes(path)),
+        }))
+            .filter((part) => part.volumes.length || part.bindPaths.length);
+        record.verified[group.key] = { at, ...members, dataRepresentations, alreadyTargetEntries };
         await this.store.writeCopyBack(operationId, record);
-        this.stamp(projectId, remoteId, members, at);
+        this.stamp(projectId, remoteId, record.verified[group.key], at, projectRoot);
+    }
+    async skipSyncedBinds(run, record, group, paths) {
+        record.fileSyncSkipped ??= {};
+        record.fileSyncSkipped[group.key] = paths;
+        await this.store.writeCopyBack(run.operation.id, record);
+        await run.progress({ dockerCopyBackSkipped: skippedProgress(record) });
     }
-    async stopVmProjectHolders(remoteId, projectId, vm, members, options) {
+    async stopVmProjectHolders(remoteId, projectId, vm, members, options, projectRoot) {
         for (const holder of vm.containers)
             if (holds(holder, members) &&
-                projectHolder(holder, vm, projectId) &&
+                (0, docker_project_resources_1.projectContainer)(holder, projectRoot, projectId, vm.volumes) &&
                 holder.metadata?.running !== false)
-                await this.host.dockerStopContainer(remoteId, holder.id, projectId, options);
+                await this.host.dockerStopContainer(remoteId, holder.id, projectId, {
+                    ...options,
+                    projectRoot,
+                });
     }
-    async copyOne(client, remoteId, projectId, type, source, { vmImage, homeImage }, { options, progress }) {
+    async copyOne(client, remoteId, projectId, type, source, { vmImage, homeImage }, context, representation) {
+        const { options, progress, projectRoot } = context;
         const signal = options.signal;
         progress.item(source, type === 'volume' ? 'volume' : 'bind');
+        const existed = type === 'volume'
+            ? !context.missingVolumes?.includes(source)
+            : await (0, promises_1.lstat)(source).then(() => true, (error) => {
+                if (error.code === 'ENOENT')
+                    return false;
+                throw error;
+            });
         if (type === 'bind')
             await (0, promises_1.mkdir)(source, { recursive: true });
         if (type === 'file')
             await (0, promises_1.mkdir)((0, node_path_1.dirname)(source), { recursive: true });
-        else
+        else if (existed)
             await this.clear(client, homeImage, type, source, signal);
         const layout = (0, docker_archive_1.dockerArchiveLayout)(type, source);
         const helper = await this.journal.create(client, homeImage, [layout.mount], signal);
+        let alreadyTargetEntries = 0;
         try {
-            const { archive, sha256 } = await this.host.dockerReadArchive(remoteId, { projectId, image: vmImage, mountType: type, source }, options);
+            const { archive, sha256 } = await this.host.dockerReadArchive(remoteId, { projectId, projectRoot, image: vmImage, mountType: type, source }, options);
             const hash = (0, node_crypto_1.createHash)('sha256');
             const toEngine = new node_stream_1.PassThrough();
-            const received = (async () => {
-                for await (const chunk of archive) {
+            const owners = representation?.kind === 'mapped'
+                ? new docker_archive_owners_1.DockerArchiveOwnerTransform({ from: representation.vm, to: representation.home })
+                : undefined;
+            const raw = new node_stream_1.Transform({
+                transform(chunk, _encoding, callback) {
                     hash.update(chunk);
                     progress.add(chunk.length);
+                    callback(null, chunk);
+                },
+            });
+            const relay = new node_stream_1.Writable({
+                write(chunk, _encoding, callback) {
                     if (toEngine.destroyed || toEngine.writableEnded)
-                        continue;
-                    if (!toEngine.write(chunk))
-                        await new Promise((done) => {
-                            const settle = () => {
-                                toEngine.off('drain', settle).off('close', settle);
-                                done();
-                            };
-                            toEngine.on('drain', settle).on('close', settle);
-                        });
-                }
-                if (!toEngine.destroyed)
-                    toEngine.end();
-            })();
+                        return callback();
+                    if (!toEngine.write(chunk)) {
+                        const settle = () => {
+                            toEngine.off('drain', settle).off('close', settle);
+                            callback();
+                        };
+                        toEngine.on('drain', settle).on('close', settle);
+                    }
+                    else
+                        callback();
+                },
+                final(callback) {
+                    if (!toEngine.destroyed)
+                        toEngine.end();
+                    callback();
+                },
+            });
+            const received = (0, promises_2.pipeline)([archive, raw, ...(owners ? [owners] : []), relay], { signal });
+            const restored = (0, docker_archive_1.writeDockerArchive)(client, helper.id, toEngine, signal, layout.writePath).catch((error) => {
+                archive.destroy();
+                throw error;
+            });
             try {
-                await Promise.all([
-                    received,
-                    (0, docker_archive_1.writeDockerArchive)(client, helper.id, toEngine, signal, layout.writePath).catch((error) => {
-                        archive.destroy();
-                        throw error;
-                    }),
-                ]);
+                await Promise.all([received, restored]);
+                const expected = sha256();
+                if (!expected || expected !== hash.digest('hex'))
+                    throw new DockerCopyBackError(`The data of ${source} copied from the VM did not match; press Retry.`, 'DOCKER_COPY_BACK_DIGEST_MISMATCH');
+                alreadyTargetEntries = owners?.result?.alreadyTargetEntries ?? 0;
             }
             catch (error) {
                 toEngine.destroy();
                 archive.destroy();
-                await received.catch(() => undefined);
+                await Promise.allSettled([received, restored]);
                 throw error;
             }
-            const expected = sha256();
-            if (!expected || expected !== hash.digest('hex'))
-                throw new DockerCopyBackError(`The data of ${source} copied from the VM did not match; press Retry.`, 'DOCKER_COPY_BACK_DIGEST_MISMATCH');
+            finally {
+                toEngine.destroy();
+            }
         }
         finally {
             await this.journal.cleanup(client, helper);
         }
         progress.complete();
+        return alreadyTargetEntries;
     }
     async clear(client, homeImage, type, source, signal) {
         try {
@@ -420,18 +995,39 @@ let DockerCopyBack = class DockerCopyBack {
             throw new DockerCopyBackError(`${type === 'volume' ? 'Volume' : 'Folder'} ${source} could not be emptied on this PC with image ${homeImage}. Empty it yourself and press Retry, or Cancel.`, 'DOCKER_COPY_BACK_CLEAR_FAILED');
         }
     }
-    async helperImages(client, remoteId, group, options) {
-        if (!group.images.length)
-            throw new DockerCopyBackError('No image of it is on this PC to run the copy helper; pull or build one of its images and press Retry.', 'DOCKER_COPY_BACK_IMAGE_MISSING');
+    async helperImages(client, remoteId, group, vm, options) {
         const vmCandidates = group.vmImages ?? group.images;
         const { ids } = await this.host.dockerImagesPresent(remoteId, vmCandidates, options);
-        const vmImage = vmCandidates.find((id) => ids.includes(id));
+        const vmImage = vmCandidates.find((id) => ids.includes(id)) ??
+            vm.containers.find((container) => container.image && holds(container, group))?.image;
         if (!vmImage)
             throw new DockerCopyBackError(`The VM has none of its images (${vmCandidates.join(', ')}) to read the data.`, 'DOCKER_COPY_BACK_IMAGE_MISSING');
         for (const id of group.images)
             if (await (0, docker_engine_client_1.optionalDockerJson)(client, `/images/${encodeURIComponent(id)}/json`, options.signal))
                 return { vmImage, homeImage: id };
-        throw new DockerCopyBackError(`Image ${group.images[0]} is missing on this PC; the copy needs it to restore the data. Pull or build it and press Retry.`, 'DOCKER_COPY_BACK_IMAGE_MISSING');
+        const references = [
+            ...new Set([
+                ...(group.imageReferences ?? []),
+                ...vm.containers
+                    .filter((c) => holds(c, group))
+                    .flatMap((c) => (c.imageReference ? [c.imageReference] : [])),
+            ]),
+        ];
+        for (const reference of references) {
+            try {
+                let present = await (0, docker_engine_client_1.optionalDockerJson)(client, `/images/${encodeURIComponent(reference)}/json`, options.signal);
+                if (!present) {
+                    await client.pullImage(reference, options.signal);
+                    present = await (0, docker_engine_client_1.optionalDockerJson)(client, `/images/${encodeURIComponent(reference)}/json`, options.signal);
+                }
+                if (present?.Id)
+                    return { vmImage, homeImage: present.Id };
+            }
+            catch {
+                options.signal?.throwIfAborted();
+            }
+        }
+        throw new DockerCopyBackError(`Image ${references[0] ?? group.images[0] ?? 'of this group'} is missing on this PC; the copy needs it to restore the data. Pull or build it and press Retry.`, 'DOCKER_COPY_BACK_IMAGE_MISSING');
     }
     scanVm(remoteId, group, options) {
         return (0, docker_plan_service_1.pagedDockerScan)(group.bindPaths, (paths) => this.host.dockerScan(remoteId, paths, options, group.volumes));
@@ -439,6 +1035,11 @@ let DockerCopyBack = class DockerCopyBack {
     async homeChange(client, record, group, containers, signal) {
         const decided = Date.parse(record.decidedAt);
         const automatic = group.state === 'vm-newer';
+        if (group.createdOnVm &&
+            automatic &&
+            !record.started.includes(group.key) &&
+            (await this.hasHomeData(client, group, signal)))
+            return `${group.label} now has data on this PC that the Disconnect did not decide to replace.`;
         for (const holder of containers) {
             if (!holds(homeMounted(holder), group))
                 continue;
@@ -455,29 +1056,54 @@ let DockerCopyBack = class DockerCopyBack {
     homeContainers(client, signal) {
         return client.json('GET', '/containers/json?all=true', undefined, { signal });
     }
-    stamp(projectId, remoteId, members, at) {
-        const inventory = this.inventory.get(projectId, remoteId);
-        if (!inventory)
-            return;
-        const groups = (0, docker_data_groups_1.supersedeGroupRecords)(inventory.groups ?? [], [
-            {
-                volumes: members.volumes,
-                bindPaths: members.bindPaths,
-                lastSyncedAt: at,
-                lastSyncDirection: 'to-home',
-            },
-        ]);
-        this.inventory.set(projectId, remoteId, { ...inventory, groups });
+    inventoryOrEmpty(projectId, remoteId, at) {
+        return this.inventory.get(projectId, remoteId) ?? { items: [], importedAt: at };
+    }
+    stamp(projectId, remoteId, members, at, root) {
+        const inventory = this.inventoryOrEmpty(projectId, remoteId, at);
+        const parts = members.dataRepresentations?.length
+            ? members.dataRepresentations
+            : [
+                {
+                    volumes: members.volumes,
+                    bindPaths: members.bindPaths,
+                    ownership: recordedGroupOwnership(inventory, members, root),
+                    representation: undefined,
+                },
+            ];
+        const groups = (0, docker_data_groups_1.supersedeGroupRecords)(inventory.groups ?? [], parts.map(({ createdOnVm: _createdOnVm, ...part }) => ({
+            ...part,
+            lastSyncedAt: at,
+            lastSyncDirection: 'to-home',
+        })));
+        const items = inventory.items.map((item) => {
+            const itemMembers = itemData(item, root);
+            const copied = parts
+                .map((part) => ({
+                volumes: part.volumes.filter((volume) => itemMembers.volumes.includes(volume)),
+                bindPaths: part.bindPaths.filter((path) => (0, docker_data_groups_1.overlapsData)({ volumes: [], bindPaths: [path] }, itemMembers)),
+                representation: part.representation,
+            }))
+                .filter((part) => part.volumes.length || part.bindPaths.length);
+            if (!copied.length)
+                return item;
+            return {
+                ...item,
+                dataRepresentations: (0, docker_data_groups_1.supersedeGroupRecords)(item.dataRepresentations ?? [], copied),
+            };
+        });
+        this.inventory.set(projectId, remoteId, { ...inventory, items, groups });
     }
     discardVm(projectId, remoteId, kept, at) {
-        const inventory = this.inventory.get(projectId, remoteId);
-        if (!inventory)
+        if (!kept.length)
             return;
+        const inventory = this.inventoryOrEmpty(projectId, remoteId, at);
         const groups = (inventory.groups ?? []).filter((record) => !(!record.lastSyncedAt &&
             record.vmDiscardedAt === at &&
-            kept.some((g) => (0, docker_data_groups_1.sameDataGroup)(g, record))));
+            kept.some((group) => keptParts(group).some((part) => (0, docker_data_groups_1.sameDataGroup)(part, record)))));
         for (const group of kept)
-            groups.push({ volumes: group.volumes, bindPaths: group.bindPaths, vmDiscardedAt: at });
+            for (const { createdOnVm: _createdOnVm, ...part } of keptParts(group))
+                groups.push({ ...part, vmDiscardedAt: at });
         this.inventory.set(projectId, remoteId, { ...inventory, groups });
     }
     async step(run, body) {
@@ -506,7 +1132,7 @@ exports.DockerCopyBack = DockerCopyBack = __decorate([
         remote_host_client_1.RemoteHostClient,
         docker_handoff_store_1.DockerHandoffStore,
         docker_archive_journal_1.DockerArchiveJournal,
-        docker_import_inventory_store_1.DockerImportInventoryStore, Object])
+        docker_import_inventory_store_1.DockerImportInventoryStore, Object, docker_copy_back_exclusions_1.DockerCopyBackExclusions])
 ], DockerCopyBack);
 function copyBackAction(state, choice) {
     if (state === 'vm-newer')