devchain-cli 0.24.2 → 0.25.0

package/dist/server/modules/remotes/docker/docker-handoff.js

@@ -13,7 +13,9 @@ exports.DockerHandoff = void 0;
 exports.dockerSelection = dockerSelection;
 exports.buildRecord = buildRecord;
 exports.captureSettings = captureSettings;
-const docker_project_compose_1 = require("./docker-project-compose");
+const docker_ownership_1 = require("./docker-ownership");
+const docker_data_representation_1 = require("./docker-data-representation");
+const docker_project_resources_1 = require("./docker-project-resources");
 const docker_data_groups_1 = require("./docker-data-groups");
 const common_1 = require("@nestjs/common");
 const node_crypto_1 = require("node:crypto");
@@ -24,11 +26,14 @@ const error_types_1 = require("../../../common/errors/error-types");
 const logger_1 = require("../../../common/logging/logger");
 const docker_archive_journal_1 = require("../../core/controllers/docker-archive-journal");
 const docker_archive_1 = require("../../core/controllers/docker-archive");
+const docker_archive_owners_1 = require("../../core/controllers/docker-archive-owners");
 const docker_image_metadata_1 = require("../../core/controllers/docker-image-metadata");
 const docker_engine_client_1 = require("../../core/controllers/docker-engine.client");
 const docker_settings_1 = require("../../core/controllers/docker-settings");
 const file_sync_dto_1 = require("../../file-sync/file-sync.dto");
+const file_sync_service_1 = require("../../file-sync/file-sync.service");
 const file_sync_managed_exclusions_store_1 = require("../../file-sync/file-sync-managed-exclusions.store");
+const ignore_pattern_matcher_1 = require("../../file-sync/ignore-pattern-matcher");
 const docker_import_inventory_store_1 = require("../operations/docker-import-inventory.store");
 const remote_host_client_1 = require("../operations/remote-host.client");
 const remote_operation_errors_1 = require("../operations/remote-operation.errors");
@@ -74,9 +79,10 @@ let DockerHandoff = class DockerHandoff {
     exclusions;
     inventory;
     choices;
+    files;
     active = new Map();
     rollbackLimits = { vmCleanupMs: 10 * 60_000, homeConnectMs: 30_000, homeStartMs: 60_000 };
-    constructor(plans, source, host, store, journal, exclusions, inventory, choices) {
+    constructor(plans, source, host, store, journal, exclusions, inventory, choices, files) {
         this.plans = plans;
         this.source = source;
         this.host = host;
@@ -85,6 +91,7 @@ let DockerHandoff = class DockerHandoff {
         this.exclusions = exclusions;
         this.inventory = inventory;
         this.choices = choices;
+        this.files = files;
     }
     interrupt(operationId) {
         this.active.get(operationId)?.abort();
@@ -95,7 +102,7 @@ let DockerHandoff = class DockerHandoff {
             const selection = dockerSelection(run.details);
             if (!selection)
                 return;
-            const plan = await this.plans.plan(projectId, { remoteId: run.operation.remoteId, items: selection.items }, signal, { estimate: false });
+            const plan = await this.plans.plan(projectId, { remoteId: run.operation.remoteId, items: selection.items }, signal, { estimate: false, reuse: false });
             if (!plan.availability.available || !plan.apiVersion)
                 throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_PLAN_REFUSED', plan.availability.reason?.message ?? 'Docker is unavailable.', { reason: plan.availability.reason?.code ?? null });
             this.choices.recordPlan(projectId, run.operation.remoteId, plan.items);
@@ -111,18 +118,24 @@ let DockerHandoff = class DockerHandoff {
                 ];
                 throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_PLAN_REFUSED', reasons.join(' ') || 'The Docker import cannot proceed.', { fit: plan.fit });
             }
-            const record = buildRecord(plan.items, selected, plan.apiVersion, await this.plans.projectRoot(projectId), plan.networks);
+            const record = buildRecord(plan.items, selected, plan.apiVersion, await this.plans.projectRoot(projectId), plan.networks, plan.dataGroups, { uid: this.source.uid() ?? 0, gid: this.source.gid() ?? 0 }, this.inventory.get(projectId, run.operation.remoteId));
             const previousRecord = await this.store.read(run.operation.id);
+            for (const bind of record.emptyBinds ?? [])
+                if (bind.reset)
+                    bind.file = await resetBindIsFile(bind.path, true);
             record.inventoryBefore =
                 previousRecord?.inventoryBefore !== undefined
                     ? previousRecord.inventoryBefore
                     : this.inventory.get(projectId, run.operation.remoteId);
             for (const kept of record.keptInventory ?? []) {
                 const prior = record.inventoryBefore?.items.find((item) => item.name === kept.name);
+                if (prior?.ownership &&
+                    record.items.find((item) => item.name === kept.name)?.targetAction === 'leave-as-is')
+                    kept.ownership = prior.ownership;
                 if (prior?.vmImageId && prior.imageId === kept.imageId)
                     kept.vmImageId = prior.vmImageId;
             }
-            const managed = (0, docker_import_inventory_store_1.connectExclusions)(plan, this.inventory.get(projectId, run.operation.remoteId));
+            const managed = (0, docker_import_inventory_store_1.connectExclusions)(plan, this.inventory.get(projectId, run.operation.remoteId), await this.plans.projectRoot(projectId));
             if (managed.length > file_sync_dto_1.IGNORE_PATTERNS_MAX)
                 throw new remote_operation_errors_1.RemoteOperationStepRefusedError('DOCKER_TOO_MANY_DATA_FOLDERS', `The Docker data folders need ${managed.length} file-sync exclusions; at most ${file_sync_dto_1.IGNORE_PATTERNS_MAX} are supported.`, { count: managed.length });
             await this.store.write(run.operation.id, record);
@@ -280,6 +293,7 @@ let DockerHandoff = class DockerHandoff {
                 const restore = restoresData(record, volume.name);
                 progress.item(volume.name, 'volume', restore ? volume.sizeBytes : 0);
                 if (!restore &&
+                    !record.items.some((item) => item.resetData && item.volumes.includes(volume.name)) &&
                     existing.has(volume.name) &&
                     !record.created.volumes.includes(volume.name)) {
                     record.verified.volumes.push(volume.name);
@@ -293,7 +307,7 @@ let DockerHandoff = class DockerHandoff {
                 await this.store.write(run.operation.id, record);
                 await this.host.dockerCreateVolume(remoteId, { projectId, name: volume.name, labels }, options);
                 if (restore) {
-                    await this.copy(client, progress, remoteId, { projectId, image: volume.helperImage, mountType: 'volume', source: volume.name }, vmImageId(record, volume.helperImage), options);
+                    volume.alreadyTargetEntries = await this.copy(client, progress, remoteId, { projectId, image: volume.helperImage, mountType: 'volume', source: volume.name }, vmImageId(record, volume.helperImage), options, (0, docker_data_representation_1.recordedDataRepresentation)({ volumes: [volume.name], bindPaths: [] }, record.dataGroups ?? []));
                     (record.copiedData ??= { volumes: [], binds: [] }).volumes.push(volume.name);
                 }
                 record.verified.volumes.push(volume.name);
@@ -318,6 +332,41 @@ let DockerHandoff = class DockerHandoff {
                         .ensureBinds.slice(offset, offset + 64)
                         .map((path) => ({ path, replace: false })),
                 }, options);
+            for (const bind of record.emptyBinds ?? []) {
+                if (bind.prepared)
+                    continue;
+                if (bind.reset) {
+                    if (bind.file === undefined) {
+                        bind.file = await resetBindIsFile(bind.path, false);
+                        await this.store.write(run.operation.id, record);
+                    }
+                    const vm = await this.host.dockerScan(remoteId, [bind.path], options, []);
+                    for (const holder of vm.containers)
+                        if ((0, docker_data_groups_1.overlapsData)((0, docker_data_groups_1.mountedData)(holder.mounts), { volumes: [], bindPaths: [bind.path] })) {
+                            if (!(0, docker_project_resources_1.projectContainer)(holder, record.projectRoot, projectId, vm.volumes))
+                                throw new DockerHandoffError(`An unrelated VM container holds ${bind.path}.`);
+                            await this.host.dockerStopContainer(remoteId, holder.id, projectId, {
+                                ...options,
+                                projectRoot: record.projectRoot,
+                            });
+                        }
+                    await this.confirmResetExclusion(projectId, remoteId, record.projectRoot, bind.path, signal);
+                }
+                await this.host.dockerPrepareBinds(remoteId, {
+                    projectId,
+                    paths: [
+                        {
+                            path: bind.path,
+                            replace: bind.reset,
+                            image: vmImageId(record, bind.image),
+                            ...(bind.file ? { file: true } : {}),
+                            ...(bind.owner ? { owner: bind.owner } : {}),
+                        },
+                    ],
+                }, options);
+                bind.prepared = true;
+                await this.store.write(run.operation.id, record);
+            }
             const binds = record.binds.filter((b) => !record.verified.binds.includes(b.path));
             const files = new Set();
             for (const bind of binds)
@@ -337,8 +386,7 @@ let DockerHandoff = class DockerHandoff {
                     const vm = await this.host.dockerScan(remoteId, [bind.path], options, []);
                     for (const holder of vm.containers)
                         if ((0, docker_data_groups_1.overlapsData)((0, docker_data_groups_1.mountedData)(holder.mounts), { volumes: [], bindPaths: [bind.path] }) &&
-                            (holder.labels[host_docker_dto_1.DOCKER_PROJECT_LABEL] === projectId ||
-                                (0, docker_project_compose_1.projectCompose)(holder.labels, record.projectRoot, projectId)) &&
+                            (0, docker_project_resources_1.projectContainer)(holder, record.projectRoot, projectId, vm.volumes) &&
                             holder.metadata?.running !== false)
                             await this.host.dockerStopContainer(remoteId, holder.id, projectId, {
                                 ...options,
@@ -364,12 +412,12 @@ let DockerHandoff = class DockerHandoff {
             }
             for (const bind of binds) {
                 progress.item(bind.path, 'bind', bind.sizeBytes);
-                await this.copy(client, progress, remoteId, {
+                bind.alreadyTargetEntries = await this.copy(client, progress, remoteId, {
                     projectId,
                     image: bind.helperImage,
                     mountType: files.has(bind.path) ? 'file' : 'bind',
                     source: bind.path,
-                }, vmImageId(record, bind.helperImage), options);
+                }, vmImageId(record, bind.helperImage), options, (0, docker_data_representation_1.recordedDataRepresentation)({ volumes: [], bindPaths: [bind.path] }, record.dataGroups ?? []));
                 (record.copiedData ??= { volumes: [], binds: [] }).binds.push(bind.path);
                 record.verified.binds.push(bind.path);
                 await this.store.write(run.operation.id, record);
@@ -427,7 +475,7 @@ let DockerHandoff = class DockerHandoff {
                     projectId,
                     name: item.name,
                     config: {
-                        ...captured.config,
+                        ...(0, docker_ownership_1.dockerTargetConfig)(captured.config, item.ownership),
                         Image: vmImageId(record, String(captured.config.Image)),
                     },
                 }, options);
@@ -444,6 +492,12 @@ let DockerHandoff = class DockerHandoff {
                 !record.keptInventory?.some((kept) => kept.name === item.name))
                 .map((item) => ({
                 name: item.name,
+                ...(item.ownership
+                    ? {
+                        ownership: (0, docker_ownership_1.ownershipRecord)(item.ownership, item.targetUser ?? settings[item.id]?.config.User),
+                        dataRepresentations: itemDataRepresentations(record, item.id),
+                    }
+                    : {}),
                 imageId: item.imageIds[0] ?? item.id,
                 ...vmPair(item.imageIds[0] ?? item.id),
                 volumes: item.volumes.map((name) => ({
@@ -471,22 +525,36 @@ let DockerHandoff = class DockerHandoff {
                     .every((i) => i.targetAction !== 'leave-as-is' && i.mode !== 'without-data') &&
                 group.volumes.every((v) => record.copiedData?.volumes.includes(v)) &&
                 group.bindPaths.every((p) => record.copiedData?.binds.some((copied) => (0, docker_plan_files_1.within)(copied, p))))
-                .map(({ volumes, bindPaths }) => ({
-                volumes,
-                bindPaths,
+                .map((group) => ({
+                volumes: group.volumes,
+                bindPaths: group.bindPaths,
+                ...recordedOwners(group),
                 lastSyncedAt: record.inventoryStampedAt,
                 lastSyncDirection: 'to-vm',
             }));
             const preserved = new Map((record.inventoryBefore?.groups ?? []).map((g) => [(0, docker_data_groups_1.dataGroupIdentity)(g), g]));
-            for (const { volumes, bindPaths } of record.discardedHomeGroups ?? []) {
-                const key = (0, docker_data_groups_1.dataGroupIdentity)({ volumes, bindPaths });
+            for (const group of record.discardedHomeGroups ?? []) {
+                const key = (0, docker_data_groups_1.dataGroupIdentity)(group);
                 preserved.set(key, {
                     ...preserved.get(key),
-                    volumes,
-                    bindPaths,
+                    volumes: group.volumes,
+                    bindPaths: group.bindPaths,
                     homeDiscardedAt: record.inventoryStampedAt,
+                    ...recordedOwners(group),
                 });
             }
+            const emptyGroups = (record.dataGroups ?? []).filter((group) => record.items.some((item) => group.itemIds.includes(item.id) &&
+                (item.resetData ||
+                    (item.mode === 'without-data' &&
+                        item.ownership &&
+                        item.targetAction !== 'leave-as-is'))));
+            for (const group of emptyGroups)
+                preserved.set((0, docker_data_groups_1.dataGroupIdentity)(group), {
+                    volumes: group.volumes,
+                    bindPaths: group.bindPaths,
+                    vmDiscardedAt: record.inventoryStampedAt,
+                    ...recordedOwners(group),
+                });
             this.inventory.set(projectId, remoteId, {
                 groups: (0, docker_data_groups_1.supersedeGroupRecords)([...preserved.values()], stamped),
                 importedAt: record.inventoryStampedAt,
@@ -500,11 +568,34 @@ let DockerHandoff = class DockerHandoff {
                     result: {
                         withoutData: record.items.filter((i) => i.mode === 'without-data').map((i) => i.name),
                         dataOnly: record.items.filter((i) => i.mode === 'data-only').map((i) => i.name),
+                        alreadyTargetEntries: [
+                            ...record.volumes.filter((volume) => record.copiedData?.volumes.includes(volume.name)),
+                            ...record.binds.filter((bind) => record.copiedData?.binds.includes(bind.path)),
+                        ].reduce((sum, resource) => sum + (resource.alreadyTargetEntries ?? 0), 0),
                     },
                 },
             });
         });
     }
+    async confirmResetExclusion(projectId, remoteId, root, path, signal) {
+        const code = 'DOCKER_RESET_EXCLUSIONS_UNCONFIRMED';
+        let installed;
+        try {
+            const folder = (0, file_sync_service_1.codeFolderId)(projectId);
+            installed = await Promise.all([
+                this.files.installedIgnores(folder),
+                this.host.syncFolderIgnores(remoteId, folder),
+            ]);
+        }
+        catch {
+            signal.throwIfAborted();
+            throw new DockerHandoffError(`The file-sync exclusions for ${path} could not be read on both peers. Retry before resetting the VM data.`, code);
+        }
+        signal.throwIfAborted();
+        if (!(0, docker_plan_files_1.strictlyWithin)(root, path) ||
+            !installed.every((peer) => (0, ignore_pattern_matcher_1.ignoreListExcludesSubtree)(peer.ignore, (0, docker_plan_files_1.projectAnchoredPath)(root, path).slice(1))))
+            throw new DockerHandoffError(`The file-sync exclusions do not cover all of ${path} on both peers. Reinstall the exclusions before resetting the VM data.`, code);
+    }
     stopHost(run) {
         return this.step(run, async (signal) => {
             const projectId = (0, remote_operation_types_1.requireProjectId)(run.operation);
@@ -639,16 +730,35 @@ let DockerHandoff = class DockerHandoff {
             return false;
         }
     }
-    async copy(client, progress, remoteId, request, vmImage, options) {
+    async copy(client, progress, remoteId, request, vmImage, options, representation) {
         const layout = (0, docker_archive_1.dockerArchiveLayout)(request.mountType, request.source);
         const helper = await this.journal.create(client, request.image, [{ ...layout.mount, ReadOnly: true }], options.signal);
         try {
             const archive = await (0, docker_archive_1.readDockerArchive)(client, helper.id, options.signal, layout.readPath);
             const hash = (0, node_crypto_1.createHash)('sha256');
-            const body = progress.count(archive, (chunk) => hash.update(chunk));
-            const { sha256 } = await this.host.dockerWriteArchive(remoteId, { ...request, image: vmImage }, body, options);
-            if (sha256 !== hash.digest('hex'))
-                throw new DockerHandoffError('The copied data did not match on the VM; retry the copy.');
+            const owners = representation?.kind === 'mapped'
+                ? new docker_archive_owners_1.DockerArchiveOwnerTransform({ from: representation.home, to: representation.vm })
+                : null;
+            const body = new node_stream_1.PassThrough();
+            const sent = (0, promises_2.pipeline)([
+                archive,
+                ...(owners ? [owners] : []),
+                progress.counter((chunk) => hash.update(chunk)),
+                body,
+            ], { signal: options.signal });
+            try {
+                const [{ sha256 }] = await Promise.all([
+                    this.host.dockerWriteArchive(remoteId, { ...request, image: vmImage }, body, options),
+                    sent,
+                ]);
+                if (sha256 !== hash.digest('hex'))
+                    throw new DockerHandoffError('The copied data did not match on the VM; retry the copy.');
+                return owners?.result?.alreadyTargetEntries ?? 0;
+            }
+            finally {
+                body.destroy();
+                await sent.catch(() => undefined);
+            }
         }
         finally {
             await this.journal.cleanup(client, helper);
@@ -665,9 +775,27 @@ exports.DockerHandoff = DockerHandoff = __decorate([
         docker_archive_journal_1.DockerArchiveJournal,
         file_sync_managed_exclusions_store_1.FileSyncManagedExclusionsStore,
         docker_import_inventory_store_1.DockerImportInventoryStore,
-        connect_choices_store_1.ConnectChoicesStore])
+        connect_choices_store_1.ConnectChoicesStore,
+        file_sync_service_1.FileSyncService])
 ], DockerHandoff);
-function buildRecord(all, selected, apiVersion, projectRoot, networks = []) {
+function recordedOwners({ ownership, representation, }) {
+    return {
+        ...(ownership ? { ownership: (0, docker_ownership_1.ownershipRecord)(ownership) } : {}),
+        ...(representation ? { representation } : {}),
+    };
+}
+function itemDataRepresentations(record, id) {
+    const item = record.items.find((entry) => entry.id === id);
+    return (record.dataGroups ?? [])
+        .filter((group) => group.itemIds.includes(id))
+        .map(({ volumes, bindPaths, representation }) => ({
+        volumes: volumes.filter((volume) => item.volumes.includes(volume)),
+        bindPaths: bindPaths.filter((path) => item.binds.some((parent) => (0, docker_plan_files_1.within)(parent, path))),
+        ...(representation ? { representation } : {}),
+    }))
+        .filter((group) => group.volumes.length || group.bindPaths.length);
+}
+function buildRecord(all, selected, apiVersion, projectRoot, networks = [], plannedGroups, fallbackOwner, inventory) {
     const moving = selected.filter(docker_plan_fit_1.movesToVm);
     const copiedImages = selected
         .filter((item) => (0, docker_plan_fit_1.copiesImages)(item, projectRoot))
@@ -716,9 +844,19 @@ function buildRecord(all, selected, apiVersion, projectRoot, networks = []) {
     }
     const items = selected.map((item) => {
         const mounts = copied.get(item);
+        const { retainedOwnership } = item;
+        const ownership = retainedOwnership
+            ? { class: retainedOwnership.class, home: retainedOwnership.home, vm: retainedOwnership.vm }
+            : item.ownership;
         return {
             id: item.id,
             name: item.name,
+            ...(ownership ? { ownership } : {}),
+            targetUser: item.targetAction === 'leave-as-is'
+                ? (item.vmUser ?? item.runtimeUser)
+                : (0, docker_ownership_1.dockerTargetUser)(item),
+            ...(item.retainedOwnership ? { retainedOwnership: item.retainedOwnership } : {}),
+            ...(item.dataAction === 'start-empty' ? { resetData: true } : {}),
             kind: item.kind,
             mode: item.selectedMode,
             temporary: item.temporary,
@@ -734,25 +872,64 @@ function buildRecord(all, selected, apiVersion, projectRoot, networks = []) {
                     ...emptyVolumes(item),
                 ]),
             ],
-            binds: mounts.filter((m) => !(0, docker_plan_dto_1.isVolumeMount)(m.kind)).map((m) => m.source),
+            binds: [
+                ...new Set([
+                    ...mounts.filter((m) => !(0, docker_plan_dto_1.isVolumeMount)(m.kind)).map((m) => m.source),
+                    ...emptyBindMounts(item).map((mount) => mount.source),
+                ]),
+            ],
             sizeBytes: mounts.some((m) => m.size.unknown)
                 ? null
                 : mounts.reduce((sum, m) => sum + m.size.bytes, 0),
         };
     });
-    const dataGroups = (0, docker_data_groups_1.groupDockerData)(all, projectRoot).filter((g) => g.itemIds.some((id) => selected.some((i) => i.id === id)));
+    const dataGroups = (plannedGroups ?? (0, docker_data_groups_1.groupDockerData)(all, projectRoot))
+        .filter((g) => g.itemIds.some((id) => selected.some((i) => i.id === id)))
+        .flatMap((group) => (0, docker_data_representation_1.splitDataRepresentations)(group, selected.some((item) => group.itemIds.includes(item.id) && item.dataAction === 'keep-vm')
+        ? (inventory?.groups ?? [])
+        : undefined));
+    for (const group of dataGroups) {
+        const resetting = selected.filter((item) => group.itemIds.includes(item.id) && item.dataAction === 'start-empty');
+        const controller = resetting.find((item) => item.ownership?.class === 'follows-user') ?? resetting[0];
+        if (!controller)
+            continue;
+        const entry = items.find((item) => item.id === controller.id);
+        for (const name of group.volumes) {
+            if (!entry.volumes.includes(name))
+                entry.volumes.push(name);
+            if (!volumes.some((volume) => volume.name === name))
+                volumes.push({ name, helperImage: helperImage(controller), sizeBytes: 0 });
+        }
+        for (const path of group.bindPaths.filter((path) => (0, docker_plan_files_1.strictlyWithin)(projectRoot, path)))
+            if (!entry.binds.includes(path))
+                entry.binds.push(path);
+    }
     const keptGroups = dataGroups.filter((g) => selected.some((i) => g.itemIds.includes(i.id) && i.dataAction === 'keep-vm'));
     const keptItems = selected.filter((i) => i.dataAction === 'keep-vm');
     return {
         dataGroups,
         keptGroups,
         discardedHomeGroups: keptGroups.filter((g) => selected.some((i) => g.itemIds.includes(i.id) && i.dataChoice === 'keep-vm')),
+        emptyBinds: emptyBindRecords(moving, items, projectRoot, helperImage, fallbackOwner),
         ensureVolumes: [...new Set(keptItems.flatMap((i) => i.missingData?.volumes ?? []))],
         ensureBinds: [...new Set(keptItems.flatMap((i) => i.missingData?.bindPaths ?? []))],
         keptInventory: keptItems.map((i) => {
             const mounts = (0, docker_plan_fit_1.potentialDataMounts)(i, projectRoot);
+            const ownership = i.retainedOwnership ?? (0, docker_ownership_1.ownershipRecord)(i.ownership, (0, docker_ownership_1.dockerTargetUser)(i));
             return {
                 name: i.name,
+                ...(ownership ? { ownership } : {}),
+                ...(i.ownership
+                    ? {
+                        dataRepresentations: dataGroups
+                            .filter((group) => group.itemIds.includes(i.id))
+                            .map(({ volumes, bindPaths, representation }) => ({
+                            volumes,
+                            bindPaths,
+                            ...(representation ? { representation } : {}),
+                        })),
+                    }
+                    : {}),
                 imageId: i.images[0]?.id ?? i.id,
                 volumes: mounts
                     .filter((m) => (0, docker_plan_dto_1.isVolumeMount)(m.kind))
@@ -784,18 +961,52 @@ function buildRecord(all, selected, apiVersion, projectRoot, networks = []) {
         bytesTotal: totalBytes(images, volumes, binds),
     };
 }
+function startsEmpty(item) {
+    return ((item.selectedMode === 'without-data' || item.dataAction === 'start-empty') &&
+        item.dataAction !== 'keep-vm');
+}
 function emptyVolumes(item) {
-    if (item.selectedMode !== 'without-data' || item.dataAction === 'keep-vm')
+    if (!startsEmpty(item))
         return [];
     return item.mounts
         .filter((m) => (0, docker_plan_dto_1.isVolumeMount)(m.kind) && m.driver === 'local')
         .map((m) => m.source);
 }
+function emptyBindMounts(item) {
+    if (!startsEmpty(item))
+        return [];
+    return item.mounts.filter((mount) => mount.kind === 'project-bind');
+}
+function emptyBindOwner(item, fallbackOwner) {
+    const user = (0, docker_ownership_1.dockerTargetUser)(item);
+    const vm = item.ownership?.vm ?? fallbackOwner;
+    const uid = (0, docker_ownership_1.dockerNumericUid)(user);
+    const gid = user?.split(':')[1];
+    if (uid === null || (gid !== undefined && !/^\d+$/.test(gid)))
+        return vm;
+    return { uid, gid: gid === undefined ? (vm?.gid ?? uid) : Number(gid) };
+}
+function emptyBindRecords(moving, items, projectRoot, helperImage, fallbackOwner) {
+    const binds = new Map();
+    const ordered = [...moving].sort((a, b) => Number(a.ownership?.class === 'follows-user') - Number(b.ownership?.class === 'follows-user'));
+    for (const item of ordered) {
+        const reset = item.dataAction === 'start-empty';
+        const paths = reset
+            ? items
+                .find((entry) => entry.id === item.id)
+                .binds.filter((path) => (0, docker_plan_files_1.strictlyWithin)(projectRoot, path))
+            : emptyBindMounts(item).map((mount) => mount.source);
+        const owner = emptyBindOwner(item, fallbackOwner);
+        for (const path of paths)
+            binds.set(path, { path, image: helperImage(item), reset, ...(owner ? { owner } : {}) });
+    }
+    return [...binds.values()];
+}
 function totalBytes(...lists) {
     return lists.reduce((sum, list) => sum + list.reduce((s, entry) => s + entry.sizeBytes, 0), 0);
 }
 function restoresData(record, volume) {
-    return record.items.some((i) => i.mode !== 'without-data' && i.volumes.includes(volume));
+    return record.items.some((i) => i.mode !== 'without-data' && !i.resetData && i.volumes.includes(volume));
 }
 function captureSettings(inspect, name, socketPath) {
     const config = (0, docker_settings_1.projectDockerCreate)(inspect, socketPath);
@@ -894,6 +1105,18 @@ function loadedVmId(homeId, homeLayers, reported, tags) {
 function isFile(path) {
     return (0, promises_1.stat)(path).then((stats) => stats.isFile(), () => false);
 }
+async function resetBindIsFile(path, allowMissing) {
+    try {
+        const info = await (0, promises_1.stat)(path);
+        if (info.isFile() || info.isDirectory())
+            return info.isFile();
+    }
+    catch (error) {
+        if (allowMissing && error.code === 'ENOENT')
+            return false;
+    }
+    throw new DockerHandoffError('The home bind layout could not be determined safely. Create a fresh Connect plan before resetting its data.', 'DOCKER_BIND_LAYOUT_UNAVAILABLE');
+}
 function vmImageId(record, homeId) {
     return record.images.find((image) => image.id === homeId)?.vmId ?? homeId;
 }
@@ -931,15 +1154,18 @@ class TransferProgress {
         this.add(0);
     }
     count(source, observe) {
-        const counter = new node_stream_1.Transform({
+        const counter = this.counter(observe);
+        (0, promises_2.pipeline)(source, counter).catch(() => undefined);
+        return counter;
+    }
+    counter(observe) {
+        return new node_stream_1.Transform({
             transform: (chunk, _encoding, callback) => {
                 observe?.(chunk);
                 this.add(chunk.length);
                 callback(null, chunk);
             },
         });
-        (0, promises_2.pipeline)(source, counter).catch(() => undefined);
-        return counter;
     }
     async finish() {
         this.details.item = null;