devchain-cli 0.24.1 → 0.25.0

package/dist/server/modules/remotes/docker/docker-handoff.js

@@ -13,6 +13,9 @@ exports.DockerHandoff = void 0;
 exports.dockerSelection = dockerSelection;
 exports.buildRecord = buildRecord;
 exports.captureSettings = captureSettings;
+const docker_ownership_1 = require("./docker-ownership");
+const docker_data_representation_1 = require("./docker-data-representation");
+const docker_project_resources_1 = require("./docker-project-resources");
 const docker_data_groups_1 = require("./docker-data-groups");
 const common_1 = require("@nestjs/common");
 const node_crypto_1 = require("node:crypto");
@@ -23,24 +26,29 @@ const error_types_1 = require("../../../common/errors/error-types");
 const logger_1 = require("../../../common/logging/logger");
 const docker_archive_journal_1 = require("../../core/controllers/docker-archive-journal");
 const docker_archive_1 = require("../../core/controllers/docker-archive");
+const docker_archive_owners_1 = require("../../core/controllers/docker-archive-owners");
+const docker_image_metadata_1 = require("../../core/controllers/docker-image-metadata");
 const docker_engine_client_1 = require("../../core/controllers/docker-engine.client");
 const docker_settings_1 = require("../../core/controllers/docker-settings");
 const file_sync_dto_1 = require("../../file-sync/file-sync.dto");
+const file_sync_service_1 = require("../../file-sync/file-sync.service");
 const file_sync_managed_exclusions_store_1 = require("../../file-sync/file-sync-managed-exclusions.store");
+const ignore_pattern_matcher_1 = require("../../file-sync/ignore-pattern-matcher");
 const docker_import_inventory_store_1 = require("../operations/docker-import-inventory.store");
 const remote_host_client_1 = require("../operations/remote-host.client");
 const remote_operation_errors_1 = require("../operations/remote-operation.errors");
 const remote_operation_types_1 = require("../operations/remote-operation.types");
+const host_docker_dto_1 = require("../host/host-docker.dto");
 const docker_plan_fit_1 = require("./docker-plan-fit");
 const docker_plan_files_1 = require("./docker-plan-files");
 const docker_plan_dto_1 = require("./docker-plan.dto");
 const docker_plan_policy_1 = require("./docker-plan-policy");
 const docker_plan_service_1 = require("./docker-plan.service");
+const connect_choices_store_1 = require("../connect-choices.store");
 const docker_plan_source_service_1 = require("./docker-plan-source.service");
 const docker_handoff_store_1 = require("./docker-handoff.store");
 const logger = (0, logger_1.createLogger)('DockerHandoff');
 const RATE_WARMUP_MS = 5_000;
-const DEFAULT_NETWORKS = new Set(['bridge', 'host', 'none', 'default']);
 function dockerSelection(details) {
     const selection = details.dockerSelection;
     return selection?.items?.length ? selection : null;
@@ -70,9 +78,11 @@ let DockerHandoff = class DockerHandoff {
     journal;
     exclusions;
     inventory;
+    choices;
+    files;
     active = new Map();
     rollbackLimits = { vmCleanupMs: 10 * 60_000, homeConnectMs: 30_000, homeStartMs: 60_000 };
-    constructor(plans, source, host, store, journal, exclusions, inventory) {
+    constructor(plans, source, host, store, journal, exclusions, inventory, choices, files) {
         this.plans = plans;
         this.source = source;
         this.host = host;
@@ -80,6 +90,8 @@ let DockerHandoff = class DockerHandoff {
         this.journal = journal;
         this.exclusions = exclusions;
         this.inventory = inventory;
+        this.choices = choices;
+        this.files = files;
     }
     interrupt(operationId) {
         this.active.get(operationId)?.abort();
@@ -90,9 +102,10 @@ let DockerHandoff = class DockerHandoff {
             const selection = dockerSelection(run.details);
             if (!selection)
                 return;
-            const plan = await this.plans.plan(projectId, { remoteId: run.operation.remoteId, items: selection.items }, signal, { estimate: false });
+            const plan = await this.plans.plan(projectId, { remoteId: run.operation.remoteId, items: selection.items }, signal, { estimate: false, reuse: false });
             if (!plan.availability.available || !plan.apiVersion)
                 throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_PLAN_REFUSED', plan.availability.reason?.message ?? 'Docker is unavailable.', { reason: plan.availability.reason?.code ?? null });
+            this.choices.recordPlan(projectId, run.operation.remoteId, plan.items);
             const selected = plan.items.filter((item) => item.selectedMode);
             if (!plan.canConnect) {
                 const reasons = [
@@ -105,25 +118,24 @@ let DockerHandoff = class DockerHandoff {
                 ];
                 throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_PLAN_REFUSED', reasons.join(' ') || 'The Docker import cannot proceed.', { fit: plan.fit });
             }
-            const record = buildRecord(plan.items, selected, plan.apiVersion, await this.plans.projectRoot(projectId));
+            const record = buildRecord(plan.items, selected, plan.apiVersion, await this.plans.projectRoot(projectId), plan.networks, plan.dataGroups, { uid: this.source.uid() ?? 0, gid: this.source.gid() ?? 0 }, this.inventory.get(projectId, run.operation.remoteId));
             const previousRecord = await this.store.read(run.operation.id);
+            for (const bind of record.emptyBinds ?? [])
+                if (bind.reset)
+                    bind.file = await resetBindIsFile(bind.path, true);
             record.inventoryBefore =
                 previousRecord?.inventoryBefore !== undefined
                     ? previousRecord.inventoryBefore
                     : this.inventory.get(projectId, run.operation.remoteId);
             for (const kept of record.keptInventory ?? []) {
                 const prior = record.inventoryBefore?.items.find((item) => item.name === kept.name);
+                if (prior?.ownership &&
+                    record.items.find((item) => item.name === kept.name)?.targetAction === 'leave-as-is')
+                    kept.ownership = prior.ownership;
                 if (prior?.vmImageId && prior.imageId === kept.imageId)
                     kept.vmImageId = prior.vmImageId;
             }
-            const managed = [
-                ...new Set([
-                    ...plan.managedExclusions,
-                    ...(this.inventory
-                        .get(projectId, run.operation.remoteId)
-                        ?.items.flatMap((item) => item.bindPaths) ?? []),
-                ]),
-            ];
+            const managed = (0, docker_import_inventory_store_1.connectExclusions)(plan, this.inventory.get(projectId, run.operation.remoteId), await this.plans.projectRoot(projectId));
             if (managed.length > file_sync_dto_1.IGNORE_PATTERNS_MAX)
                 throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_TOO_MANY_DATA_FOLDERS', `The Docker data folders need ${managed.length} file-sync exclusions; at most ${file_sync_dto_1.IGNORE_PATTERNS_MAX} are supported.`, { count: managed.length });
             await this.store.write(run.operation.id, record);
@@ -200,18 +212,62 @@ let DockerHandoff = class DockerHandoff {
             const present = pendingImages.length
                 ? (await this.host.dockerImagesPresent(remoteId, [...new Set([...candidates.values()].flat())], options)).ids
                 : [];
+            const verify = async (image, vmId) => {
+                image.vmId = vmId;
+                record.verified.images.push(image.id);
+                await this.store.write(run.operation.id, record);
+            };
+            let matchUnsupported = false;
+            const missing = [];
             for (const image of pendingImages) {
+                let vmId = candidates.get(image.id).find((id) => present.includes(id));
+                if (!vmId) {
+                    const inspect = await client.json('GET', `/images/${encodeURIComponent(image.id)}/json`, undefined, { signal });
+                    const tags = inspect.RepoTags;
+                    if (tags?.length && !matchUnsupported) {
+                        try {
+                            const { images } = await this.host.dockerMatchImages(remoteId, tags, options);
+                            vmId = (0, docker_image_metadata_1.vmImageIdForTags)(inspect, tags, images);
+                        }
+                        catch (error) {
+                            if (!(error instanceof remote_host_client_1.RemoteHostRequestError && error.status === 404))
+                                throw error;
+                            matchUnsupported = true;
+                        }
+                    }
+                    if (!vmId) {
+                        missing.push({ image, tags: tags ?? [], layers: inspect.RootFS?.Layers ?? null });
+                        continue;
+                    }
+                }
                 progress.item(image.id, 'image', image.sizeBytes);
-                const vmId = candidates.get(image.id).find((id) => present.includes(id));
-                if (vmId)
-                    image.vmId = vmId;
-                else {
+                await verify(image, vmId);
+                progress.complete();
+            }
+            let supportsReferences = true;
+            for (const group of groupImages(missing)) {
+                progress.item(group.length === 1 ? group[0].image.id : `${group.length} images`, 'image', group.reduce((total, entry) => total + entry.image.sizeBytes, 0));
+                if (group.length > 1 && supportsReferences) {
+                    const archive = await saveImages(client, group.flatMap((entry) => entry.tags), signal);
+                    const loaded = await this.host.dockerLoadImage(remoteId, progress.count(archive), options);
+                    supportsReferences = hasReferences(loaded);
+                    if (supportsReferences) {
+                        const vmIds = group.map((entry) => loadedVmId(entry.image.id, entry.layers, loaded.images, entry.tags));
+                        for (const [index, entry] of group.entries()) {
+                            entry.image.vmId = vmIds[index];
+                            record.verified.images.push(entry.image.id);
+                        }
+                        await this.store.write(run.operation.id, record);
+                        progress.complete();
+                        continue;
+                    }
+                }
+                for (const { image } of group) {
                     const saved = await saveImage(client, image.id, signal);
                     const loaded = await this.host.dockerLoadImage(remoteId, progress.count(saved.archive), options);
-                    image.vmId = loadedVmId(image.id, saved.layers, loaded.images);
+                    supportsReferences &&= hasReferences(loaded);
+                    await verify(image, loadedVmId(image.id, saved.layers, loaded.images));
                 }
-                record.verified.images.push(image.id);
-                await this.store.write(run.operation.id, record);
                 progress.complete();
             }
             const presentKeptVolumes = record.ensureVolumes?.length
@@ -237,6 +293,7 @@ let DockerHandoff = class DockerHandoff {
                 const restore = restoresData(record, volume.name);
                 progress.item(volume.name, 'volume', restore ? volume.sizeBytes : 0);
                 if (!restore &&
+                    !record.items.some((item) => item.resetData && item.volumes.includes(volume.name)) &&
                     existing.has(volume.name) &&
                     !record.created.volumes.includes(volume.name)) {
                     record.verified.volumes.push(volume.name);
@@ -250,7 +307,7 @@ let DockerHandoff = class DockerHandoff {
                 await this.store.write(run.operation.id, record);
                 await this.host.dockerCreateVolume(remoteId, { projectId, name: volume.name, labels }, options);
                 if (restore) {
-                    await this.copy(client, progress, remoteId, { projectId, image: volume.helperImage, mountType: 'volume', source: volume.name }, vmImageId(record, volume.helperImage), options);
+                    volume.alreadyTargetEntries = await this.copy(client, progress, remoteId, { projectId, image: volume.helperImage, mountType: 'volume', source: volume.name }, vmImageId(record, volume.helperImage), options, (0, docker_data_representation_1.recordedDataRepresentation)({ volumes: [volume.name], bindPaths: [] }, record.dataGroups ?? []));
                     (record.copiedData ??= { volumes: [], binds: [] }).volumes.push(volume.name);
                 }
                 record.verified.volumes.push(volume.name);
@@ -275,6 +332,41 @@ let DockerHandoff = class DockerHandoff {
                         .ensureBinds.slice(offset, offset + 64)
                         .map((path) => ({ path, replace: false })),
                 }, options);
+            for (const bind of record.emptyBinds ?? []) {
+                if (bind.prepared)
+                    continue;
+                if (bind.reset) {
+                    if (bind.file === undefined) {
+                        bind.file = await resetBindIsFile(bind.path, false);
+                        await this.store.write(run.operation.id, record);
+                    }
+                    const vm = await this.host.dockerScan(remoteId, [bind.path], options, []);
+                    for (const holder of vm.containers)
+                        if ((0, docker_data_groups_1.overlapsData)((0, docker_data_groups_1.mountedData)(holder.mounts), { volumes: [], bindPaths: [bind.path] })) {
+                            if (!(0, docker_project_resources_1.projectContainer)(holder, record.projectRoot, projectId, vm.volumes))
+                                throw new DockerHandoffError(`An unrelated VM container holds ${bind.path}.`);
+                            await this.host.dockerStopContainer(remoteId, holder.id, projectId, {
+                                ...options,
+                                projectRoot: record.projectRoot,
+                            });
+                        }
+                    await this.confirmResetExclusion(projectId, remoteId, record.projectRoot, bind.path, signal);
+                }
+                await this.host.dockerPrepareBinds(remoteId, {
+                    projectId,
+                    paths: [
+                        {
+                            path: bind.path,
+                            replace: bind.reset,
+                            image: vmImageId(record, bind.image),
+                            ...(bind.file ? { file: true } : {}),
+                            ...(bind.owner ? { owner: bind.owner } : {}),
+                        },
+                    ],
+                }, options);
+                bind.prepared = true;
+                await this.store.write(run.operation.id, record);
+            }
             const binds = record.binds.filter((b) => !record.verified.binds.includes(b.path));
             const files = new Set();
             for (const bind of binds)
@@ -291,6 +383,15 @@ let DockerHandoff = class DockerHandoff {
                 }, options);
             for (const bind of binds.filter((b) => b.replace)) {
                 try {
+                    const vm = await this.host.dockerScan(remoteId, [bind.path], options, []);
+                    for (const holder of vm.containers)
+                        if ((0, docker_data_groups_1.overlapsData)((0, docker_data_groups_1.mountedData)(holder.mounts), { volumes: [], bindPaths: [bind.path] }) &&
+                            (0, docker_project_resources_1.projectContainer)(holder, record.projectRoot, projectId, vm.volumes) &&
+                            holder.metadata?.running !== false)
+                            await this.host.dockerStopContainer(remoteId, holder.id, projectId, {
+                                ...options,
+                                projectRoot: record.projectRoot,
+                            });
                     await this.host.dockerPrepareBinds(remoteId, {
                         projectId,
                         paths: [
@@ -311,33 +412,51 @@ let DockerHandoff = class DockerHandoff {
             }
             for (const bind of binds) {
                 progress.item(bind.path, 'bind', bind.sizeBytes);
-                await this.copy(client, progress, remoteId, {
+                bind.alreadyTargetEntries = await this.copy(client, progress, remoteId, {
                     projectId,
                     image: bind.helperImage,
                     mountType: files.has(bind.path) ? 'file' : 'bind',
                     source: bind.path,
-                }, vmImageId(record, bind.helperImage), options);
+                }, vmImageId(record, bind.helperImage), options, (0, docker_data_representation_1.recordedDataRepresentation)({ volumes: [], bindPaths: [bind.path] }, record.dataGroups ?? []));
                 (record.copiedData ??= { volumes: [], binds: [] }).binds.push(bind.path);
                 record.verified.binds.push(bind.path);
                 await this.store.write(run.operation.id, record);
                 progress.complete();
             }
-            for (const network of record.networks) {
+            const settings = await this.store.readSettings(run.operation.id);
+            const automaticNetworks = new Set(record.automaticRangeNetworks);
+            const networks = record.networks
+                .map((network) => ({
+                ...network,
+                ipam: automaticNetworks.has(network.name) ? undefined : network.ipam,
+            }))
+                .sort((a, b) => Number(!!b.ipam) - Number(!!a.ipam));
+            for (const network of networks) {
                 progress.item(network.name, 'network');
-                const { created } = await this.host.dockerCreateNetwork(remoteId, {
-                    projectId,
-                    name: network.name,
-                    labels: network.labels,
-                    internal: network.internal,
-                    attachable: network.attachable,
-                    options: network.options,
-                }, options);
-                if (created && !record.created.networks.includes(network.name)) {
+                const shared = !network.labels[host_docker_dto_1.COMPOSE_PROJECT_LABEL];
+                let created;
+                try {
+                    ({ created } = await this.host.dockerCreateNetwork(remoteId, {
+                        projectId,
+                        name: network.name,
+                        labels: network.labels,
+                        internal: network.internal,
+                        attachable: network.attachable,
+                        options: network.options,
+                        ...(network.ipam ? { ipam: network.ipam } : {}),
+                        ...(shared ? { shared: true } : {}),
+                    }, options));
+                }
+                catch (error) {
+                    if (!(error instanceof error_types_1.AppError))
+                        throw error;
+                    throw new DockerHandoffError(`Network ${network.name}: ${error.message}`, error.code);
+                }
+                if (created && !shared && !record.created.networks.includes(network.name)) {
                     record.created.networks.push(network.name);
                     await this.store.write(run.operation.id, record);
                 }
             }
-            const settings = await this.store.readSettings(run.operation.id);
             for (const item of record.items.filter((i) => i.createsContainer)) {
                 if (record.verified.containers.includes(item.name))
                     continue;
@@ -346,14 +465,17 @@ let DockerHandoff = class DockerHandoff {
                     throw new DockerHandoffError(`The captured settings of ${item.name} are missing.`);
                 progress.item(item.name, 'container');
                 if (item.targetAction === 'replace' || record.created.containers.includes(item.name))
-                    await this.deleteIfPresent(remoteId, 'containers', item.name, projectId, options);
+                    await this.deleteIfPresent(remoteId, 'containers', item.name, projectId, {
+                        ...options,
+                        projectRoot: record.projectRoot,
+                    });
                 record.created.containers.push(item.name);
                 await this.store.write(run.operation.id, record);
                 await this.host.dockerCreateContainer(remoteId, {
                     projectId,
                     name: item.name,
                     config: {
-                        ...captured.config,
+                        ...(0, docker_ownership_1.dockerTargetConfig)(captured.config, item.ownership),
                         Image: vmImageId(record, String(captured.config.Image)),
                     },
                 }, options);
@@ -370,6 +492,12 @@ let DockerHandoff = class DockerHandoff {
                 !record.keptInventory?.some((kept) => kept.name === item.name))
                 .map((item) => ({
                 name: item.name,
+                ...(item.ownership
+                    ? {
+                        ownership: (0, docker_ownership_1.ownershipRecord)(item.ownership, item.targetUser ?? settings[item.id]?.config.User),
+                        dataRepresentations: itemDataRepresentations(record, item.id),
+                    }
+                    : {}),
                 imageId: item.imageIds[0] ?? item.id,
                 ...vmPair(item.imageIds[0] ?? item.id),
                 volumes: item.volumes.map((name) => ({
@@ -397,22 +525,36 @@ let DockerHandoff = class DockerHandoff {
                     .every((i) => i.targetAction !== 'leave-as-is' && i.mode !== 'without-data') &&
                 group.volumes.every((v) => record.copiedData?.volumes.includes(v)) &&
                 group.bindPaths.every((p) => record.copiedData?.binds.some((copied) => (0, docker_plan_files_1.within)(copied, p))))
-                .map(({ volumes, bindPaths }) => ({
-                volumes,
-                bindPaths,
+                .map((group) => ({
+                volumes: group.volumes,
+                bindPaths: group.bindPaths,
+                ...recordedOwners(group),
                 lastSyncedAt: record.inventoryStampedAt,
                 lastSyncDirection: 'to-vm',
             }));
             const preserved = new Map((record.inventoryBefore?.groups ?? []).map((g) => [(0, docker_data_groups_1.dataGroupIdentity)(g), g]));
-            for (const { volumes, bindPaths } of record.discardedHomeGroups ?? []) {
-                const key = (0, docker_data_groups_1.dataGroupIdentity)({ volumes, bindPaths });
+            for (const group of record.discardedHomeGroups ?? []) {
+                const key = (0, docker_data_groups_1.dataGroupIdentity)(group);
                 preserved.set(key, {
                     ...preserved.get(key),
-                    volumes,
-                    bindPaths,
+                    volumes: group.volumes,
+                    bindPaths: group.bindPaths,
                     homeDiscardedAt: record.inventoryStampedAt,
+                    ...recordedOwners(group),
                 });
             }
+            const emptyGroups = (record.dataGroups ?? []).filter((group) => record.items.some((item) => group.itemIds.includes(item.id) &&
+                (item.resetData ||
+                    (item.mode === 'without-data' &&
+                        item.ownership &&
+                        item.targetAction !== 'leave-as-is'))));
+            for (const group of emptyGroups)
+                preserved.set((0, docker_data_groups_1.dataGroupIdentity)(group), {
+                    volumes: group.volumes,
+                    bindPaths: group.bindPaths,
+                    vmDiscardedAt: record.inventoryStampedAt,
+                    ...recordedOwners(group),
+                });
             this.inventory.set(projectId, remoteId, {
                 groups: (0, docker_data_groups_1.supersedeGroupRecords)([...preserved.values()], stamped),
                 importedAt: record.inventoryStampedAt,
@@ -426,11 +568,34 @@ let DockerHandoff = class DockerHandoff {
                     result: {
                         withoutData: record.items.filter((i) => i.mode === 'without-data').map((i) => i.name),
                         dataOnly: record.items.filter((i) => i.mode === 'data-only').map((i) => i.name),
+                        alreadyTargetEntries: [
+                            ...record.volumes.filter((volume) => record.copiedData?.volumes.includes(volume.name)),
+                            ...record.binds.filter((bind) => record.copiedData?.binds.includes(bind.path)),
+                        ].reduce((sum, resource) => sum + (resource.alreadyTargetEntries ?? 0), 0),
                     },
                 },
             });
         });
     }
+    async confirmResetExclusion(projectId, remoteId, root, path, signal) {
+        const code = 'DOCKER_RESET_EXCLUSIONS_UNCONFIRMED';
+        let installed;
+        try {
+            const folder = (0, file_sync_service_1.codeFolderId)(projectId);
+            installed = await Promise.all([
+                this.files.installedIgnores(folder),
+                this.host.syncFolderIgnores(remoteId, folder),
+            ]);
+        }
+        catch {
+            signal.throwIfAborted();
+            throw new DockerHandoffError(`The file-sync exclusions for ${path} could not be read on both peers. Retry before resetting the VM data.`, code);
+        }
+        signal.throwIfAborted();
+        if (!(0, docker_plan_files_1.strictlyWithin)(root, path) ||
+            !installed.every((peer) => (0, ignore_pattern_matcher_1.ignoreListExcludesSubtree)(peer.ignore, (0, docker_plan_files_1.projectAnchoredPath)(root, path).slice(1))))
+            throw new DockerHandoffError(`The file-sync exclusions do not cover all of ${path} on both peers. Reinstall the exclusions before resetting the VM data.`, code);
+    }
     stopHost(run) {
         return this.step(run, async (signal) => {
             const projectId = (0, remote_operation_types_1.requireProjectId)(run.operation);
@@ -533,7 +698,10 @@ let DockerHandoff = class DockerHandoff {
         const { holders } = await this.host.dockerVolumeHolders(remoteId, volume.name, options);
         for (const holder of holders) {
             try {
-                await this.host.dockerDelete(remoteId, 'containers', holder.id, projectId, options);
+                await this.host.dockerDelete(remoteId, 'containers', holder.id, projectId, {
+                    ...options,
+                    projectRoot: record.projectRoot,
+                });
             }
             catch (error) {
                 if (notFound(error))
@@ -562,16 +730,35 @@ let DockerHandoff = class DockerHandoff {
             return false;
         }
     }
-    async copy(client, progress, remoteId, request, vmImage, options) {
+    async copy(client, progress, remoteId, request, vmImage, options, representation) {
         const layout = (0, docker_archive_1.dockerArchiveLayout)(request.mountType, request.source);
         const helper = await this.journal.create(client, request.image, [{ ...layout.mount, ReadOnly: true }], options.signal);
         try {
             const archive = await (0, docker_archive_1.readDockerArchive)(client, helper.id, options.signal, layout.readPath);
             const hash = (0, node_crypto_1.createHash)('sha256');
-            const body = progress.count(archive, (chunk) => hash.update(chunk));
-            const { sha256 } = await this.host.dockerWriteArchive(remoteId, { ...request, image: vmImage }, body, options);
-            if (sha256 !== hash.digest('hex'))
-                throw new DockerHandoffError('The copied data did not match on the VM; retry the copy.');
+            const owners = representation?.kind === 'mapped'
+                ? new docker_archive_owners_1.DockerArchiveOwnerTransform({ from: representation.home, to: representation.vm })
+                : null;
+            const body = new node_stream_1.PassThrough();
+            const sent = (0, promises_2.pipeline)([
+                archive,
+                ...(owners ? [owners] : []),
+                progress.counter((chunk) => hash.update(chunk)),
+                body,
+            ], { signal: options.signal });
+            try {
+                const [{ sha256 }] = await Promise.all([
+                    this.host.dockerWriteArchive(remoteId, { ...request, image: vmImage }, body, options),
+                    sent,
+                ]);
+                if (sha256 !== hash.digest('hex'))
+                    throw new DockerHandoffError('The copied data did not match on the VM; retry the copy.');
+                return owners?.result?.alreadyTargetEntries ?? 0;
+            }
+            finally {
+                body.destroy();
+                await sent.catch(() => undefined);
+            }
         }
         finally {
             await this.journal.cleanup(client, helper);
@@ -587,12 +774,34 @@ exports.DockerHandoff = DockerHandoff = __decorate([
         docker_handoff_store_1.DockerHandoffStore,
         docker_archive_journal_1.DockerArchiveJournal,
         file_sync_managed_exclusions_store_1.FileSyncManagedExclusionsStore,
-        docker_import_inventory_store_1.DockerImportInventoryStore])
+        docker_import_inventory_store_1.DockerImportInventoryStore,
+        connect_choices_store_1.ConnectChoicesStore,
+        file_sync_service_1.FileSyncService])
 ], DockerHandoff);
-function buildRecord(all, selected, apiVersion, projectRoot) {
+function recordedOwners({ ownership, representation, }) {
+    return {
+        ...(ownership ? { ownership: (0, docker_ownership_1.ownershipRecord)(ownership) } : {}),
+        ...(representation ? { representation } : {}),
+    };
+}
+function itemDataRepresentations(record, id) {
+    const item = record.items.find((entry) => entry.id === id);
+    return (record.dataGroups ?? [])
+        .filter((group) => group.itemIds.includes(id))
+        .map(({ volumes, bindPaths, representation }) => ({
+        volumes: volumes.filter((volume) => item.volumes.includes(volume)),
+        bindPaths: bindPaths.filter((path) => item.binds.some((parent) => (0, docker_plan_files_1.within)(parent, path))),
+        ...(representation ? { representation } : {}),
+    }))
+        .filter((group) => group.volumes.length || group.bindPaths.length);
+}
+function buildRecord(all, selected, apiVersion, projectRoot, networks = [], plannedGroups, fallbackOwner, inventory) {
     const moving = selected.filter(docker_plan_fit_1.movesToVm);
+    const copiedImages = selected
+        .filter((item) => (0, docker_plan_fit_1.copiesImages)(item, projectRoot))
+        .flatMap((item) => item.images);
     const helperImage = (item) => {
-        const image = item.images[0]?.id ?? moving.flatMap((i) => i.images)[0]?.id;
+        const image = item.images[0]?.id ?? copiedImages[0]?.id;
         if (!image)
             throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_PLAN_REFUSED', `${item.name}: no local image is available to copy its data.`);
         return image;
@@ -619,7 +828,10 @@ function buildRecord(all, selected, apiVersion, projectRoot) {
         for (const name of emptyVolumes(item))
             if (!volumes.some((v) => v.name === name))
                 volumes.push({ name, helperImage: helperImage(item), sizeBytes: 0 });
-    const images = [...new Map(moving.flatMap((i) => i.images).map((i) => [i.id, i])).values()].map((image) => ({ id: image.id, sizeBytes: image.size.bytes }));
+    const images = [...new Map(copiedImages.map((i) => [i.id, i])).values()].map((image) => ({
+        id: image.id,
+        sizeBytes: image.size.bytes,
+    }));
     const containerIds = new Set(all.filter((i) => i.kind === 'container').map((i) => i.id));
     const stopIds = new Set();
     for (const item of moving) {
@@ -632,9 +844,19 @@ function buildRecord(all, selected, apiVersion, projectRoot) {
     }
     const items = selected.map((item) => {
         const mounts = copied.get(item);
+        const { retainedOwnership } = item;
+        const ownership = retainedOwnership
+            ? { class: retainedOwnership.class, home: retainedOwnership.home, vm: retainedOwnership.vm }
+            : item.ownership;
         return {
             id: item.id,
             name: item.name,
+            ...(ownership ? { ownership } : {}),
+            targetUser: item.targetAction === 'leave-as-is'
+                ? (item.vmUser ?? item.runtimeUser)
+                : (0, docker_ownership_1.dockerTargetUser)(item),
+            ...(item.retainedOwnership ? { retainedOwnership: item.retainedOwnership } : {}),
+            ...(item.dataAction === 'start-empty' ? { resetData: true } : {}),
             kind: item.kind,
             mode: item.selectedMode,
             temporary: item.temporary,
@@ -650,25 +872,64 @@ function buildRecord(all, selected, apiVersion, projectRoot) {
                     ...emptyVolumes(item),
                 ]),
             ],
-            binds: mounts.filter((m) => !(0, docker_plan_dto_1.isVolumeMount)(m.kind)).map((m) => m.source),
+            binds: [
+                ...new Set([
+                    ...mounts.filter((m) => !(0, docker_plan_dto_1.isVolumeMount)(m.kind)).map((m) => m.source),
+                    ...emptyBindMounts(item).map((mount) => mount.source),
+                ]),
+            ],
             sizeBytes: mounts.some((m) => m.size.unknown)
                 ? null
                 : mounts.reduce((sum, m) => sum + m.size.bytes, 0),
         };
     });
-    const dataGroups = (0, docker_data_groups_1.groupDockerData)(all, projectRoot).filter((g) => g.itemIds.some((id) => selected.some((i) => i.id === id)));
+    const dataGroups = (plannedGroups ?? (0, docker_data_groups_1.groupDockerData)(all, projectRoot))
+        .filter((g) => g.itemIds.some((id) => selected.some((i) => i.id === id)))
+        .flatMap((group) => (0, docker_data_representation_1.splitDataRepresentations)(group, selected.some((item) => group.itemIds.includes(item.id) && item.dataAction === 'keep-vm')
+        ? (inventory?.groups ?? [])
+        : undefined));
+    for (const group of dataGroups) {
+        const resetting = selected.filter((item) => group.itemIds.includes(item.id) && item.dataAction === 'start-empty');
+        const controller = resetting.find((item) => item.ownership?.class === 'follows-user') ?? resetting[0];
+        if (!controller)
+            continue;
+        const entry = items.find((item) => item.id === controller.id);
+        for (const name of group.volumes) {
+            if (!entry.volumes.includes(name))
+                entry.volumes.push(name);
+            if (!volumes.some((volume) => volume.name === name))
+                volumes.push({ name, helperImage: helperImage(controller), sizeBytes: 0 });
+        }
+        for (const path of group.bindPaths.filter((path) => (0, docker_plan_files_1.strictlyWithin)(projectRoot, path)))
+            if (!entry.binds.includes(path))
+                entry.binds.push(path);
+    }
     const keptGroups = dataGroups.filter((g) => selected.some((i) => g.itemIds.includes(i.id) && i.dataAction === 'keep-vm'));
     const keptItems = selected.filter((i) => i.dataAction === 'keep-vm');
     return {
         dataGroups,
         keptGroups,
         discardedHomeGroups: keptGroups.filter((g) => selected.some((i) => g.itemIds.includes(i.id) && i.dataChoice === 'keep-vm')),
+        emptyBinds: emptyBindRecords(moving, items, projectRoot, helperImage, fallbackOwner),
         ensureVolumes: [...new Set(keptItems.flatMap((i) => i.missingData?.volumes ?? []))],
         ensureBinds: [...new Set(keptItems.flatMap((i) => i.missingData?.bindPaths ?? []))],
         keptInventory: keptItems.map((i) => {
             const mounts = (0, docker_plan_fit_1.potentialDataMounts)(i, projectRoot);
+            const ownership = i.retainedOwnership ?? (0, docker_ownership_1.ownershipRecord)(i.ownership, (0, docker_ownership_1.dockerTargetUser)(i));
             return {
                 name: i.name,
+                ...(ownership ? { ownership } : {}),
+                ...(i.ownership
+                    ? {
+                        dataRepresentations: dataGroups
+                            .filter((group) => group.itemIds.includes(i.id))
+                            .map(({ volumes, bindPaths, representation }) => ({
+                            volumes,
+                            bindPaths,
+                            ...(representation ? { representation } : {}),
+                        })),
+                    }
+                    : {}),
                 imageId: i.images[0]?.id ?? i.id,
                 volumes: mounts
                     .filter((m) => (0, docker_plan_dto_1.isVolumeMount)(m.kind))
@@ -691,24 +952,61 @@ function buildRecord(all, selected, apiVersion, projectRoot) {
         stopIds: [...stopIds],
         stopped: [],
         networks: [],
+        automaticRangeNetworks: networks
+            .filter((network) => network.kind === 'automatic-range')
+            .map((network) => network.name),
         verified: { images: [], volumes: [], binds: [], containers: [] },
         created: { volumes: [], networks: [], containers: [] },
         replaced: [],
         bytesTotal: totalBytes(images, volumes, binds),
     };
 }
+function startsEmpty(item) {
+    return ((item.selectedMode === 'without-data' || item.dataAction === 'start-empty') &&
+        item.dataAction !== 'keep-vm');
+}
 function emptyVolumes(item) {
-    if (item.selectedMode !== 'without-data' || item.dataAction === 'keep-vm')
+    if (!startsEmpty(item))
         return [];
     return item.mounts
         .filter((m) => (0, docker_plan_dto_1.isVolumeMount)(m.kind) && m.driver === 'local')
         .map((m) => m.source);
 }
+function emptyBindMounts(item) {
+    if (!startsEmpty(item))
+        return [];
+    return item.mounts.filter((mount) => mount.kind === 'project-bind');
+}
+function emptyBindOwner(item, fallbackOwner) {
+    const user = (0, docker_ownership_1.dockerTargetUser)(item);
+    const vm = item.ownership?.vm ?? fallbackOwner;
+    const uid = (0, docker_ownership_1.dockerNumericUid)(user);
+    const gid = user?.split(':')[1];
+    if (uid === null || (gid !== undefined && !/^\d+$/.test(gid)))
+        return vm;
+    return { uid, gid: gid === undefined ? (vm?.gid ?? uid) : Number(gid) };
+}
+function emptyBindRecords(moving, items, projectRoot, helperImage, fallbackOwner) {
+    const binds = new Map();
+    const ordered = [...moving].sort((a, b) => Number(a.ownership?.class === 'follows-user') - Number(b.ownership?.class === 'follows-user'));
+    for (const item of ordered) {
+        const reset = item.dataAction === 'start-empty';
+        const paths = reset
+            ? items
+                .find((entry) => entry.id === item.id)
+                .binds.filter((path) => (0, docker_plan_files_1.strictlyWithin)(projectRoot, path))
+            : emptyBindMounts(item).map((mount) => mount.source);
+        const owner = emptyBindOwner(item, fallbackOwner);
+        for (const path of paths)
+            binds.set(path, { path, image: helperImage(item), reset, ...(owner ? { owner } : {}) });
+    }
+    return [...binds.values()];
+}
 function totalBytes(...lists) {
     return lists.reduce((sum, list) => sum + list.reduce((s, entry) => s + entry.sizeBytes, 0), 0);
 }
 function restoresData(record, volume) {
-    return record.items.some((i) => i.mode !== 'without-data' && i.volumes.includes(volume));
+    return record.items.some((i) => i.mode !== 'without-data' && !i.resetData && i.volumes.includes(volume));
 }
 function captureSettings(inspect, name, socketPath) {
     const config = (0, docker_settings_1.projectDockerCreate)(inspect, socketPath);
@@ -749,38 +1047,55 @@ function captureSettings(inspect, name, socketPath) {
         host.Mounts = mounts;
     return { name, config };
 }
+function endpoints(config) {
+    return (config?.NetworkingConfig
+        ?.EndpointsConfig ?? {});
+}
 function networkNames(config) {
-    const endpoints = config.NetworkingConfig
-        ?.EndpointsConfig;
-    return Object.keys(endpoints ?? {}).filter((name) => !DEFAULT_NETWORKS.has(name));
+    return Object.keys(endpoints(config)).filter((name) => !docker_settings_1.DEFAULT_NETWORKS.has(name));
 }
 async function homeNetwork(client, name, signal) {
     const network = await client.json('GET', `/networks/${encodeURIComponent(name)}`, undefined, { signal });
     if (network.Driver !== 'bridge')
         throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_PLAN_REFUSED', `Network ${name} uses the ${network.Driver} driver; only bridge networks move.`);
+    const ranges = (0, docker_settings_1.ipv4Ranges)(network.IPAM?.Config);
     return {
         name,
         labels: network.Labels ?? {},
         internal: network.Internal === true,
         attachable: network.Attachable === true,
         options: network.Options ?? {},
+        ...(ranges.length ? { ipam: { Config: ranges } } : {}),
     };
 }
 async function homeVolumeLabels(client, name, signal) {
     const volume = await client.json('GET', `/volumes/${encodeURIComponent(name)}`, undefined, { signal });
     return volume.Labels ?? {};
 }
+function groupImages(images) {
+    const groups = new Map();
+    for (const image of images) {
+        const key = image.tags.length && image.layers ? JSON.stringify(image.layers) : image.image.id;
+        groups.set(key, [...(groups.get(key) ?? []), image]);
+    }
+    return [...groups.values()];
+}
+const hasReferences = (loaded) => loaded.images.every((image) => image.references !== undefined);
+function saveImages(client, names, signal) {
+    const query = [...new Set(names)].map((name) => `names=${encodeURIComponent(name)}`).join('&');
+    return client.stream('GET', `/images/get?${query}`, { signal });
+}
 async function saveImage(client, id, signal) {
     const image = await client.json('GET', `/images/${encodeURIComponent(id)}/json`, undefined, { signal });
     const names = image.RepoTags?.length ? image.RepoTags : [id];
-    const query = names.map((n) => `names=${encodeURIComponent(n)}`).join('&');
     return {
-        archive: await client.stream('GET', `/images/get?${query}`, { signal }),
+        archive: await saveImages(client, names, signal),
         layers: image.RootFS?.Layers ?? [],
     };
 }
-function loadedVmId(homeId, homeLayers, reported) {
-    const matches = reported.filter((image) => image.layers.length === homeLayers.length &&
+function loadedVmId(homeId, homeLayers, reported, tags) {
+    const matches = reported.filter((image) => (tags === undefined || image.references?.some((reference) => tags.includes(reference))) &&
+        image.layers.length === homeLayers.length &&
         image.layers.every((layer, index) => layer === homeLayers[index]));
     const match = matches.find((image) => image.id === homeId) ?? matches[0];
     if (!match)
@@ -790,6 +1105,18 @@ function loadedVmId(homeId, homeLayers, reported) {
 function isFile(path) {
     return (0, promises_1.stat)(path).then((stats) => stats.isFile(), () => false);
 }
+async function resetBindIsFile(path, allowMissing) {
+    try {
+        const info = await (0, promises_1.stat)(path);
+        if (info.isFile() || info.isDirectory())
+            return info.isFile();
+    }
+    catch (error) {
+        if (allowMissing && error.code === 'ENOENT')
+            return false;
+    }
+    throw new DockerHandoffError('The home bind layout could not be determined safely. Create a fresh Connect plan before resetting its data.', 'DOCKER_BIND_LAYOUT_UNAVAILABLE');
+}
 function vmImageId(record, homeId) {
     return record.images.find((image) => image.id === homeId)?.vmId ?? homeId;
 }
@@ -827,15 +1154,18 @@ class TransferProgress {
         this.add(0);
     }
     count(source, observe) {
-        const counter = new node_stream_1.Transform({
+        const counter = this.counter(observe);
+        (0, promises_2.pipeline)(source, counter).catch(() => undefined);
+        return counter;
+    }
+    counter(observe) {
+        return new node_stream_1.Transform({
             transform: (chunk, _encoding, callback) => {
                 observe?.(chunk);
                 this.add(chunk.length);
                 callback(null, chunk);
             },
         });
-        (0, promises_2.pipeline)(source, counter).catch(() => undefined);
-        return counter;
     }
     async finish() {
         this.details.item = null;