rightsize 0.5.0 → 0.6.1

package/dist/backend-msb/commands.js

@@ -20,14 +20,29 @@ export const MsbCommands = {
         for (const [key, value] of spec.env) {
             argv.push("-e", `${key}=${value}`);
         }
+        // The option block is always spelled out, never left to msb's defaults, for two
+        // reasons on top of each other. The access token (`ro`/`rw`) carries
+        // FileMount.readOnly, which msb enforces as a genuine guest-side write block — and it
+        // keeps OUR spec parseable on Windows: msb stages each mount into a temp directory
+        // and canonicalizes it, which there yields the extended-length `\\?\C:\...` form, and
+        // its splitter skips a drive prefix only for a bare drive letter, so a spec with no
+        // option block splits at the drive's colon and rejects the path tail as options.
+        // `nodev` exists because msb then rebuilds an INTERNAL `tag:staged_path[:opts]` spec
+        // for the same mount, carrying over only NON-DEFAULT option tokens — `rw` is its
+        // default and is dropped, which on Windows strips the internal spec's option block
+        // and re-creates the same misparse one layer down (captured: `--mount
+        // "fm_…:\\?\C:\…": expected flag or key=value option`). `nodev` always survives the
+        // carry-over, and for a single-file mount it is meaningless (no device nodes to
+        // block): verified against a real msb 0.6.8 — `rw,nodev` mounts `rw,nodev` and
+        // accepts an in-guest write, `ro,nodev` rejects one with `Read-only file system`.
         for (const mount of spec.mounts) {
-            argv.push("--mount-file", `${mount.hostPath}:${mount.guestPath}`);
+            argv.push("--mount-file", `${mount.hostPath}:${mount.guestPath}:${mount.readOnly ? "ro" : "rw"},nodev`);
         }
         if (spec.checkpointRef !== undefined) {
-            // `--snapshot` is mutually exclusive with the IMAGE positional arg —
+            // `--from-snapshot` is mutually exclusive with the IMAGE positional arg —
             // the snapshot itself pins the image (see MsbCliBackend's own doc on
             // fromCheckpoint/checkpointRef).
-            argv.push("--snapshot", spec.checkpointRef);
+            argv.push("--from-snapshot", spec.checkpointRef);
         }
         else {
             argv.push(spec.image);
@@ -50,13 +65,13 @@ export const MsbCommands = {
     snapshotInspect(name) {
         return ["snapshot", "inspect", name];
     },
-    /** `msb snapshot export <ref> <dest>` — writes a `.tar.zst` artifact archive; deliberately never `--with-image` (its import fails an integrity check in 0.6.6, see the checkpoints guide). `exportCheckpoint`'s backend call. */
+    /** `msb snapshot save <ref> <dest>` — writes a `.tar.zst` artifact archive; deliberately never `--with-image` (its import fails an integrity check in 0.6.6, see the checkpoints guide). `exportCheckpoint`'s backend call. */
     snapshotExport(ref, dest) {
-        return ["snapshot", "export", ref, dest];
+        return ["snapshot", "save", ref, dest];
     },
-    /** `msb snapshot import <archive>` — unpacks into a digest-derived directory under `~/.microsandbox/snapshots/`, never the original name; `importCheckpoint`'s backend call. */
+    /** `msb snapshot load <archive>` — unpacks into a digest-derived directory under `~/.microsandbox/snapshots/`, never the original name; `importCheckpoint`'s backend call. */
     snapshotImport(archive) {
-        return ["snapshot", "import", archive];
+        return ["snapshot", "load", archive];
     },
     /** `msb snapshot list --format json` — full `digest`/`name`/`artifact_path`/`image_ref` entries, used to CONFIRM an imported snapshot's digest-dir basename is present (the basename itself, not the `digest` field, is the effective ref — the full digest does not resolve as a snapshot ref). */
     snapshotList() {

package/dist/backend-msb/commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/backend-msb/commands.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,GAAG,CAAC,IAAmB;QACrB,MAAM,IAAI,GAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,uEAAuE;YACvE,oEAAoE;YACpE,kDAAkD;YAClD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,qEAAqE;YACrE,qEAAqE;YACrE,iCAAiC;YACjC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,+DAA+D;YAC/D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0JAA0J;IAC1J,cAAc,CAAC,OAAe,EAAE,IAAY;QAC1C,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,yGAAyG;IACzG,cAAc,CAAC,IAAY;QACzB,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,mIAAmI;IACnI,eAAe,CAAC,IAAY;QAC1B,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,iOAAiO;IACjO,cAAc,CAAC,GAAW,EAAE,IAAY;QACtC,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,gLAAgL;IAChL,cAAc,CAAC,OAAe;QAC5B,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAED,oSAAoS;IACpS,YAAY;QACV,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,yIAAyI;IACzI,MAAM,CAAC,QAAgB,EAAE,IAAY,EAAE,aAAqB;QAC1D,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,aAAa,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,2FAA2F;IAC3F,OAAO,CAAC,IAAY,EAAE,aAAqB,EAAE,QAAgB;QAC3D,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,aAAa,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,IAAY,EAAE,GAAsB;QACvC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,UAAU,CAAC,IAAY,EAAE,GAAsB;QAC7C,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,IAAY;QACf,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,IAAY;QACf,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,EAAE,CAAC,IAAY;QACb,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,EAAE;QACA,qEAAqE;QACrE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAAiB;QAC3B,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;CACF,CAAC"}
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/backend-msb/commands.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,GAAG,CAAC,IAAmB;QACrB,MAAM,IAAI,GAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,uEAAuE;YACvE,oEAAoE;YACpE,kDAAkD;YAClD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,gFAAgF;QAChF,qEAAqE;QACrE,sFAAsF;QACtF,mFAAmF;QACnF,sFAAsF;QACtF,oFAAoF;QACpF,iFAAiF;QACjF,qFAAqF;QACrF,iFAAiF;QACjF,mFAAmF;QACnF,sEAAsE;QACtE,oFAAoF;QACpF,gFAAgF;QAChF,+EAA+E;QAC/E,kFAAkF;QAClF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;QAC1G,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,0EAA0E;YAC1E,qEAAqE;YACrE,iCAAiC;YACjC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,+DAA+D;YAC/D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0JAA0J;IAC1J,cAAc,CAAC,OAAe,EAAE,IAAY;QAC1C,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,yGAAyG;IACzG,cAAc,CAAC,IAAY;QACzB,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,mIAAmI;IACnI,eAAe,CAAC,IAAY;QAC1B,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,+NAA+N;IAC/N,cAAc,CAAC,GAAW,EAAE,IAAY;QACtC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,8KAA8K;IAC9K,cAAc,CAAC,OAAe;QAC5B,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,oSAAoS;IACpS,YAAY;QACV,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,yIAAyI;IACzI,MAAM,CAAC,QAAgB,EAAE,IAAY,EAAE,aAAqB;QAC1D,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,aAAa,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,2FAA2F;IAC3F,OAAO,CAAC,IAAY,EAAE,aAAqB,EAAE,QAAgB;QAC3D,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,aAAa,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,CAAC,IAAY,EAAE,GAAsB;QACvC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,UAAU,CAAC,IAAY,EAAE,GAAsB;QAC7C,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,IAAY;QACf,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,IAAY;QACf,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,EAAE,CAAC,IAAY;QACb,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,EAAE;QACA,qEAAqE;QACrE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,SAAiB;QAC3B,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;CACF,CAAC"}

package/dist/backend-msb/platform.js

@@ -23,8 +23,8 @@ const KRUN_ASSETS = {
 // re-verify all names when bumping the pin.
 const KRUN_INSTALL_NAMES = {
     "darwin-arm64": "libkrunfw.5.dylib",
-    "linux-x64": "libkrunfw.so.5.5.0",
-    "linux-arm64": "libkrunfw.so.5.5.0",
+    "linux-x64": "libkrunfw.so.5.6.1",
+    "linux-arm64": "libkrunfw.so.5.6.1",
     "win32-x64": "libkrunfw.dll",
     "win32-arm64": "libkrunfw.dll",
 };

package/dist/backend-msb/provisioner.d.ts

@@ -1,5 +1,5 @@
 import type { Platform } from "./platform.js";
-export declare const MSB_VERSION = "0.6.6";
+export declare const MSB_VERSION = "0.6.8";
 /** Test seam: the full resolution logic parameterized over the release base URL, cache dir, and environment. */
 export declare function ensureInstalledAt(baseUrl: string, cacheDir: string, env: Record<string, string | undefined>): Promise<string>;
 /** Resolves (downloading and verifying if needed) a runnable `msb` binary path, using the real GitHub release base, `RIGHTSIZE_CACHE_DIR`, and `process.env`. */

package/dist/backend-msb/provisioner.js

@@ -7,7 +7,7 @@ import { createHash } from "node:crypto";
 import { ProvisionError } from "../core/errors.js";
 import { cacheDir as defaultCacheDir } from "../core/cache-dir.js";
 import { PlatformInfo } from "./platform.js";
-export const MSB_VERSION = "0.6.6";
+export const MSB_VERSION = "0.6.8";
 const DEFAULT_BASE = `https://github.com/superradcompany/microsandbox/releases/download/v${MSB_VERSION}`;
 const CONNECT_READ_TIMEOUT_MS = 300_000;
 const STALE_LOCK_AGE_MS = 5 * 60 * 1000;

package/dist/backend-msb/snapshot-import.d.ts

@@ -1,7 +1,7 @@
 /**
- * True if `stderr` (an `msb snapshot import` non-zero exit) names msb's own
+ * True if `stderr` (an `msb snapshot load` non-zero exit) names msb's own
  * "this digest is already imported" signal, as opposed to some other import
- * failure. Observed verbatim against the real msb 0.6.6 binary:
+ * failure. Observed verbatim against the real msb 0.6.8 binary:
  *
  * ```
  * error: snapshot already exists: <path>
@@ -16,8 +16,8 @@
  */
 export declare function isSnapshotAlreadyExistsError(stderr: string): boolean;
 /**
- * Extracts the digest-dir basename from one `msb snapshot import`
- * invocation's output. Verified against the real msb 0.6.6 binary: on both a
+ * Extracts the digest-dir basename from one `msb snapshot load`
+ * invocation's output. Verified against the real msb 0.6.8 binary: on both a
  * success (the printed stdout line) and an already-exists failure (the
  * `error: snapshot already exists: <path>` stderr line), the relevant line
  * ENDS with the artifact path under `~/.microsandbox/snapshots/`, whose

package/dist/backend-msb/snapshot-import.js

@@ -1,8 +1,8 @@
 import * as path from "node:path";
 /**
- * True if `stderr` (an `msb snapshot import` non-zero exit) names msb's own
+ * True if `stderr` (an `msb snapshot load` non-zero exit) names msb's own
  * "this digest is already imported" signal, as opposed to some other import
- * failure. Observed verbatim against the real msb 0.6.6 binary:
+ * failure. Observed verbatim against the real msb 0.6.8 binary:
  *
  * ```
  * error: snapshot already exists: <path>
@@ -19,8 +19,8 @@ export function isSnapshotAlreadyExistsError(stderr) {
     return stderr.includes("snapshot already exists");
 }
 /**
- * Extracts the digest-dir basename from one `msb snapshot import`
- * invocation's output. Verified against the real msb 0.6.6 binary: on both a
+ * Extracts the digest-dir basename from one `msb snapshot load`
+ * invocation's output. Verified against the real msb 0.6.8 binary: on both a
  * success (the printed stdout line) and an already-exists failure (the
  * `error: snapshot already exists: <path>` stderr line), the relevant line
  * ENDS with the artifact path under `~/.microsandbox/snapshots/`, whose

package/dist/backend-msb/snapshot-list.d.ts

@@ -23,18 +23,18 @@ export interface SnapshotListEntry {
 export declare function parseSnapshotList(json: string): SnapshotListEntry[];
 /**
  * Confirms an imported snapshot's digest-dir basename (e.g.
- * `sha256-b9c0448ee9d54e33`, parsed from `msb snapshot import`'s own
+ * `sha256-b9c0448ee9d54e33`, parsed from `msb snapshot load`'s own
  * output — see `snapshot-import.ts`) actually appears in `msb snapshot
  * list`: an entry whose `name` equals `digestDirName` outright, or whose
  * `artifact_path`'s basename does (`msb snapshot list` was verified to
  * report both shapes depending on how the snapshot was created).
  *
  * Returns `digestDirName` itself once confirmed present — NOT the entry's
- * `digest` field. Live-verified against msb 0.6.6: the full
+ * `digest` field. Live-verified against msb 0.6.8: the full
  * `sha256:<64hex>` digest does not resolve as a snapshot ref at all (`msb
  * snapshot inspect sha256:<full>` fails "snapshot not found" — msb treats
  * it as a literal path). Only the digest-dir name resolves for
- * `inspect`/`rm`/`run --snapshot`, so it — not the `digest` field — is the
+ * `inspect`/`rm`/`run --from-snapshot`, so it — not the `digest` field — is the
  * effective ref `importCheckpoint` must hand back. `undefined` means no
  * entry matched — the caller throws rather than returning an unconfirmed
  * ref.

package/dist/backend-msb/snapshot-list.js

@@ -29,18 +29,18 @@ export function parseSnapshotList(json) {
 }
 /**
  * Confirms an imported snapshot's digest-dir basename (e.g.
- * `sha256-b9c0448ee9d54e33`, parsed from `msb snapshot import`'s own
+ * `sha256-b9c0448ee9d54e33`, parsed from `msb snapshot load`'s own
  * output — see `snapshot-import.ts`) actually appears in `msb snapshot
  * list`: an entry whose `name` equals `digestDirName` outright, or whose
  * `artifact_path`'s basename does (`msb snapshot list` was verified to
  * report both shapes depending on how the snapshot was created).
  *
  * Returns `digestDirName` itself once confirmed present — NOT the entry's
- * `digest` field. Live-verified against msb 0.6.6: the full
+ * `digest` field. Live-verified against msb 0.6.8: the full
  * `sha256:<64hex>` digest does not resolve as a snapshot ref at all (`msb
  * snapshot inspect sha256:<full>` fails "snapshot not found" — msb treats
  * it as a literal path). Only the digest-dir name resolves for
- * `inspect`/`rm`/`run --snapshot`, so it — not the `digest` field — is the
+ * `inspect`/`rm`/`run --from-snapshot`, so it — not the `digest` field — is the
  * effective ref `importCheckpoint` must hand back. `undefined` means no
  * entry matched — the caller throws rather than returning an unconfirmed
  * ref.

package/dist/backend-msb/snapshot-not-found.d.ts

@@ -1,7 +1,7 @@
 /**
  * True if `output` (an `msb snapshot inspect <ref>` non-zero exit's stderr)
  * names msb's own "this snapshot does not exist" signal, as opposed to some
- * other probe failure. Observed verbatim against the real msb 0.6.6 binary:
+ * other probe failure. Observed verbatim against the real msb 0.6.8 binary:
  *
  * ```
  * error: snapshot not found: <path>

package/dist/backend-msb/snapshot-not-found.js

@@ -1,7 +1,7 @@
 /**
  * True if `output` (an `msb snapshot inspect <ref>` non-zero exit's stderr)
  * names msb's own "this snapshot does not exist" signal, as opposed to some
- * other probe failure. Observed verbatim against the real msb 0.6.6 binary:
+ * other probe failure. Observed verbatim against the real msb 0.6.8 binary:
  *
  * ```
  * error: snapshot not found: <path>

package/dist/backend-msb/snapshot-save-fsync.d.ts

@@ -0,0 +1,55 @@
+/**
+ * True if `stderr` (an `msb snapshot save` non-zero exit) carries a Windows
+ * `ERROR_ACCESS_DENIED`, which on that platform is how EVERY `snapshot save`
+ * in msb 0.6.7 and 0.6.8 ends. Captured verbatim from a windows-2025 hosted
+ * runner:
+ *
+ * ```text
+ * msb snapshot save rz-ckpt-fccd7568-archive C:\...\artifact failed (exit 1):
+ * error: io error: Access is denied. (os error 5)
+ * ```
+ *
+ * The cause is in msb's own archive writer: having finished the archive it
+ * reopens the staging file READ-ONLY, then calls `sync_all()` on that handle
+ * before moving it onto the destination. On Windows `sync_all` is
+ * `FlushFileBuffers`, which requires write access, so it fails with error 5
+ * every time and the move on the next line never runs. On Unix an `fsync` of a
+ * read-only descriptor is legal, so the same code path is fine there — which
+ * is why `exportCheckpoint` consults this only on Windows. 0.6.6 wrote
+ * straight to the destination with no fsync step at all, hence the failure
+ * being new in 0.6.7.
+ *
+ * Matches the `(os error 5)` suffix rather than the `Access is denied.` text:
+ * that text comes from Windows' own `FormatMessage` and is localized to the
+ * machine's display language, while the numeric suffix is appended by Rust
+ * itself and reads the same on every host. The closing parenthesis is part of
+ * the needle so that codes in the fifties — `os error 53` (network path not
+ * found), `55`, `59` — cannot match on their leading digit.
+ */
+export declare function isSnapshotSaveAccessDeniedFailure(stderr: string): boolean;
+/**
+ * Completes the move msb's archive writer failed to reach (see
+ * `isSnapshotSaveAccessDeniedFailure`), resolving `true` if `destFile` now
+ * holds the finished archive.
+ *
+ * msb stages the archive beside its destination under
+ * `.<destination file name>.tmp.<msb pid>.<unix nanos>` and unlinks that
+ * staging file only when the archive WRITE fails — not when the trailing fsync
+ * does. So on the failure this handles, a complete, valid archive is sitting
+ * next to the destination and the only step left is the rename msb's own
+ * `replace_archive` would have performed on the very next line.
+ *
+ * Requires EXACTLY ONE candidate in the destination's parent directory. This
+ * library exports into a staging directory it creates fresh and owns for the
+ * one export, so a single candidate is the ordinary case; zero means the
+ * archive never got written and this is a different failure, and several means
+ * something else is writing there and picking one would be a guess. Both
+ * resolve `false`, which leaves the caller surfacing msb's own error unchanged
+ * — as does any filesystem error along the way, since msb's error describes
+ * the actual problem better than a failure to clean up after it would.
+ *
+ * Nothing here is Windows-specific by construction; the platform check lives
+ * at the call site so this stays exercisable by unit tests on any host.
+ */
+export declare function salvageStagedArchive(destFile: string): Promise<boolean>;
+//# sourceMappingURL=snapshot-save-fsync.d.ts.map

package/dist/backend-msb/snapshot-save-fsync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot-save-fsync.d.ts","sourceRoot":"","sources":["../../src/backend-msb/snapshot-save-fsync.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAmB7E"}

package/dist/backend-msb/snapshot-save-fsync.js

@@ -0,0 +1,79 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+/**
+ * True if `stderr` (an `msb snapshot save` non-zero exit) carries a Windows
+ * `ERROR_ACCESS_DENIED`, which on that platform is how EVERY `snapshot save`
+ * in msb 0.6.7 and 0.6.8 ends. Captured verbatim from a windows-2025 hosted
+ * runner:
+ *
+ * ```text
+ * msb snapshot save rz-ckpt-fccd7568-archive C:\...\artifact failed (exit 1):
+ * error: io error: Access is denied. (os error 5)
+ * ```
+ *
+ * The cause is in msb's own archive writer: having finished the archive it
+ * reopens the staging file READ-ONLY, then calls `sync_all()` on that handle
+ * before moving it onto the destination. On Windows `sync_all` is
+ * `FlushFileBuffers`, which requires write access, so it fails with error 5
+ * every time and the move on the next line never runs. On Unix an `fsync` of a
+ * read-only descriptor is legal, so the same code path is fine there — which
+ * is why `exportCheckpoint` consults this only on Windows. 0.6.6 wrote
+ * straight to the destination with no fsync step at all, hence the failure
+ * being new in 0.6.7.
+ *
+ * Matches the `(os error 5)` suffix rather than the `Access is denied.` text:
+ * that text comes from Windows' own `FormatMessage` and is localized to the
+ * machine's display language, while the numeric suffix is appended by Rust
+ * itself and reads the same on every host. The closing parenthesis is part of
+ * the needle so that codes in the fifties — `os error 53` (network path not
+ * found), `55`, `59` — cannot match on their leading digit.
+ */
+export function isSnapshotSaveAccessDeniedFailure(stderr) {
+    return stderr.includes("(os error 5)");
+}
+/**
+ * Completes the move msb's archive writer failed to reach (see
+ * `isSnapshotSaveAccessDeniedFailure`), resolving `true` if `destFile` now
+ * holds the finished archive.
+ *
+ * msb stages the archive beside its destination under
+ * `.<destination file name>.tmp.<msb pid>.<unix nanos>` and unlinks that
+ * staging file only when the archive WRITE fails — not when the trailing fsync
+ * does. So on the failure this handles, a complete, valid archive is sitting
+ * next to the destination and the only step left is the rename msb's own
+ * `replace_archive` would have performed on the very next line.
+ *
+ * Requires EXACTLY ONE candidate in the destination's parent directory. This
+ * library exports into a staging directory it creates fresh and owns for the
+ * one export, so a single candidate is the ordinary case; zero means the
+ * archive never got written and this is a different failure, and several means
+ * something else is writing there and picking one would be a guess. Both
+ * resolve `false`, which leaves the caller surfacing msb's own error unchanged
+ * — as does any filesystem error along the way, since msb's error describes
+ * the actual problem better than a failure to clean up after it would.
+ *
+ * Nothing here is Windows-specific by construction; the platform check lives
+ * at the call site so this stays exercisable by unit tests on any host.
+ */
+export async function salvageStagedArchive(destFile) {
+    const parent = path.dirname(destFile);
+    const stagingPrefix = `.${path.basename(destFile)}.tmp.`;
+    try {
+        const candidates = (await fs.readdir(parent, { withFileTypes: true }))
+            // Regular files only: msb writes a file under the staging name, and a directory
+            // carrying it would otherwise consume the single-candidate slot and then be
+            // renamed onto the destination, where the archive step would bundle a directory.
+            .filter((entry) => entry.name.startsWith(stagingPrefix) && entry.isFile())
+            .map((entry) => entry.name);
+        const only = candidates.length === 1 ? candidates[0] : undefined;
+        if (only === undefined) {
+            return false;
+        }
+        await fs.rename(path.join(parent, only), destFile);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=snapshot-save-fsync.js.map

package/dist/backend-msb/snapshot-save-fsync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot-save-fsync.js","sourceRoot":"","sources":["../../src/backend-msb/snapshot-save-fsync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,iCAAiC,CAAC,MAAc;IAC9D,OAAO,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,gFAAgF;YAChF,4EAA4E;YAC5E,iFAAiF;aAChF,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;aACzE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/core/backend.d.ts

@@ -139,7 +139,7 @@ export interface SandboxBackend {
      * Writes this checkpoint's backend payload to `destFile` — the artifact
      * step of `Checkpoints.exportTo`, byte-for-byte what the backend's own CLI
      * produces (docker: `docker save -o <destFile> <ref>`; microsandbox:
-     * `msb snapshot export <ref> <destFile>`, never `--with-image` — see the
+     * `msb snapshot save <ref> <destFile>`, never `--with-image` — see the
      * checkpoints guide for why). Only ever called once the generic layer has
      * already confirmed `ref` belongs to the ACTIVE backend and probed it
      * exists via `hasCheckpoint`; a failure surfaces the underlying tool's
@@ -150,7 +150,7 @@ export interface SandboxBackend {
      * Materializes an exported archive's backend payload from `srcFile` and
      * returns the EFFECTIVE ref to use from here on — not necessarily `ref`
      * itself. docker preserves the original tag on `docker load`, so its
-     * effective ref IS `ref`; microsandbox's `snapshot import` writes under a
+     * effective ref IS `ref`; microsandbox's `snapshot load` writes under a
      * digest-derived DIRECTORY NAME (e.g. `sha256-b9c0448ee9d54e33`) it never
      * lets the caller choose, so its effective ref is that directory name,
      * confirmed present via `snapshot list --format json` — never the full

package/dist/core/checkpoint/api.d.ts

@@ -91,7 +91,7 @@ export declare function exportTo(cp: Checkpoint, destPath: string): Promise<void
  * either way, before any backend call or registry write), then hands the
  * extracted `artifact` to `SandboxBackend.importCheckpoint`, which
  * materializes it and returns the EFFECTIVE ref (docker: the same `ref` the
- * archive recorded; microsandbox: the digest `snapshot import` actually
+ * archive recorded; microsandbox: the digest `snapshot load` actually
  * assigned it — never necessarily the archive's own `ref`).
  *
  * A NAMED archive (`name` non-null) gets replace semantics matching

package/dist/core/checkpoint/api.js

@@ -189,7 +189,7 @@ export async function exportTo(cp, destPath) {
  * either way, before any backend call or registry write), then hands the
  * extracted `artifact` to `SandboxBackend.importCheckpoint`, which
  * materializes it and returns the EFFECTIVE ref (docker: the same `ref` the
- * archive recorded; microsandbox: the digest `snapshot import` actually
+ * archive recorded; microsandbox: the digest `snapshot load` actually
  * assigned it — never necessarily the archive's own `ref`).
  *
  * A NAMED archive (`name` non-null) gets replace semantics matching

package/dist/core/docker-image-name.d.ts

@@ -0,0 +1,58 @@
+/**
+ * A parsed `[registry/]repository[:tag][@digest]` image reference, plus the
+ * Testcontainers-style compatibility override `asCompatibleSubstituteFor`
+ * sets. Every module constructor accepts `string | DockerImageName` and
+ * resolves it through `requireCompatible` before calling `super()`:
+ *
+ * ```ts
+ * new PostgresContainer("postgres:16")                                  // checked, common case
+ * new PostgresContainer(DockerImageName.parse("mycorp/pg-hardened:16")
+ *     .asCompatibleSubstituteFor("postgres"))                           // explicit override
+ * ```
+ *
+ * An explicitly supplied image is always used verbatim — `requireCompatible`
+ * only ever checks it and returns it unchanged; it never rewrites a tag or
+ * substitutes an image.
+ */
+export declare class DockerImageName {
+    /** The image reference exactly as given to `parse()` — what a module passes to the backend, unmodified. */
+    readonly raw: string;
+    /** The registry host, if the first path segment looked like one (contains `.` or `:`, or is `localhost`). */
+    readonly registry: string | undefined;
+    /** The repository component: registry, tag, and digest all stripped. */
+    readonly repository: string;
+    /** The tag component, if the reference carried one. */
+    readonly tag: string | undefined;
+    /** The digest component (everything after `@`), if the reference carried one. */
+    readonly digest: string | undefined;
+    private readonly substituteRepository;
+    private constructor();
+    /**
+     * Parses a full image reference into its registry/repository/tag/digest
+     * components. A pure string decomposition — never validates against a
+     * real registry, never performs I/O.
+     */
+    static parse(image: string): DockerImageName;
+    /**
+     * Declares this image a compatible drop-in for `repository` — the escape
+     * hatch for a fork, mirror, or hardened rebuild that doesn't share the
+     * expected module's own repository name. From here on,
+     * `requireCompatible` treats `repository` as this image's declared
+     * identity instead of its own parsed `repository`. Returns a new
+     * `DockerImageName`; the original is left untouched.
+     */
+    asCompatibleSubstituteFor(repository: string): DockerImageName;
+    /** The exact reference passed to `parse()`, unmodified. */
+    toString(): string;
+    /**
+     * Resolves `image` (parsing it first if it's a plain string) and checks
+     * that it names `expectedRepository` — either directly via its own parsed
+     * `repository`, or via a prior `asCompatibleSubstituteFor(expectedRepository)`
+     * override. Returns the exact image string to pass to `super()`: never
+     * rewritten, tag and all. Throws `IncompatibleImageError` — before any
+     * backend call, before the module's own constructor body runs — when
+     * neither matches.
+     */
+    static requireCompatible(image: string | DockerImageName, expectedRepository: string): string;
+}
+//# sourceMappingURL=docker-image-name.d.ts.map

package/dist/core/docker-image-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-image-name.d.ts","sourceRoot":"","sources":["../../src/core/docker-image-name.ts"],"names":[],"mappings":"AAwDA;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,eAAe;IAExB,2GAA2G;IAC3G,QAAQ,CAAC,GAAG,EAAE,MAAM;IACpB,6GAA6G;IAC7G,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS;IACrC,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,MAAM;IAC3B,uDAAuD;IACvD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS;IAChC,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAXvC,OAAO;IAcP;;;;OAIG;IACH,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe;IAK5C;;;;;;;OAOG;IACH,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe;IAI9D,2DAA2D;IAC3D,QAAQ,IAAI,MAAM;IAIlB;;;;;;;;OAQG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,EAAE,kBAAkB,EAAE,MAAM,GAAG,MAAM;CAQ9F"}

package/dist/core/docker-image-name.js

@@ -0,0 +1,127 @@
+import { IncompatibleImageError } from "./errors.js";
+/** Splits off a trailing `@sha256:...` digest, if present — always the last `@` in the reference. */
+function splitDigest(ref) {
+    const at = ref.lastIndexOf("@");
+    if (at === -1) {
+        return [ref, undefined];
+    }
+    return [ref.slice(0, at), ref.slice(at + 1)];
+}
+/**
+ * Splits a registry host off the front, following the Docker convention:
+ * the first path segment is a registry only if it contains a `.` (a domain)
+ * or a `:` (an explicit port), or is the literal `localhost` — otherwise
+ * it's a namespace segment and stays part of the repository. This is why
+ * `quay.io/keycloak/keycloak` strips to repository `keycloak/keycloak`
+ * while `floci/floci` stays whole.
+ */
+function splitRegistry(ref) {
+    const slash = ref.indexOf("/");
+    if (slash === -1) {
+        return [undefined, ref];
+    }
+    const first = ref.slice(0, slash);
+    if (first.includes(".") || first.includes(":") || first === "localhost") {
+        return [first, ref.slice(slash + 1)];
+    }
+    return [undefined, ref];
+}
+/** Splits a trailing `:tag` off the repository — the last `:` counts only when it falls after the last `/`, so a registry-host port (already stripped by `splitRegistry`) is never mistaken for one. */
+function splitTag(ref) {
+    const lastSlash = ref.lastIndexOf("/");
+    const lastColon = ref.lastIndexOf(":");
+    if (lastColon > lastSlash) {
+        return [ref.slice(0, lastColon), ref.slice(lastColon + 1)];
+    }
+    return [ref, undefined];
+}
+function parseReference(image) {
+    const [withoutDigest, digest] = splitDigest(image);
+    const [registry, rest] = splitRegistry(withoutDigest);
+    const [repository, tag] = splitTag(rest);
+    return { registry, repository, tag, digest };
+}
+/**
+ * A parsed `[registry/]repository[:tag][@digest]` image reference, plus the
+ * Testcontainers-style compatibility override `asCompatibleSubstituteFor`
+ * sets. Every module constructor accepts `string | DockerImageName` and
+ * resolves it through `requireCompatible` before calling `super()`:
+ *
+ * ```ts
+ * new PostgresContainer("postgres:16")                                  // checked, common case
+ * new PostgresContainer(DockerImageName.parse("mycorp/pg-hardened:16")
+ *     .asCompatibleSubstituteFor("postgres"))                           // explicit override
+ * ```
+ *
+ * An explicitly supplied image is always used verbatim — `requireCompatible`
+ * only ever checks it and returns it unchanged; it never rewrites a tag or
+ * substitutes an image.
+ */
+export class DockerImageName {
+    raw;
+    registry;
+    repository;
+    tag;
+    digest;
+    substituteRepository;
+    constructor(
+    /** The image reference exactly as given to `parse()` — what a module passes to the backend, unmodified. */
+    raw, 
+    /** The registry host, if the first path segment looked like one (contains `.` or `:`, or is `localhost`). */
+    registry, 
+    /** The repository component: registry, tag, and digest all stripped. */
+    repository, 
+    /** The tag component, if the reference carried one. */
+    tag, 
+    /** The digest component (everything after `@`), if the reference carried one. */
+    digest, substituteRepository) {
+        this.raw = raw;
+        this.registry = registry;
+        this.repository = repository;
+        this.tag = tag;
+        this.digest = digest;
+        this.substituteRepository = substituteRepository;
+    }
+    /**
+     * Parses a full image reference into its registry/repository/tag/digest
+     * components. A pure string decomposition — never validates against a
+     * real registry, never performs I/O.
+     */
+    static parse(image) {
+        const { registry, repository, tag, digest } = parseReference(image);
+        return new DockerImageName(image, registry, repository, tag, digest, undefined);
+    }
+    /**
+     * Declares this image a compatible drop-in for `repository` — the escape
+     * hatch for a fork, mirror, or hardened rebuild that doesn't share the
+     * expected module's own repository name. From here on,
+     * `requireCompatible` treats `repository` as this image's declared
+     * identity instead of its own parsed `repository`. Returns a new
+     * `DockerImageName`; the original is left untouched.
+     */
+    asCompatibleSubstituteFor(repository) {
+        return new DockerImageName(this.raw, this.registry, this.repository, this.tag, this.digest, repository);
+    }
+    /** The exact reference passed to `parse()`, unmodified. */
+    toString() {
+        return this.raw;
+    }
+    /**
+     * Resolves `image` (parsing it first if it's a plain string) and checks
+     * that it names `expectedRepository` — either directly via its own parsed
+     * `repository`, or via a prior `asCompatibleSubstituteFor(expectedRepository)`
+     * override. Returns the exact image string to pass to `super()`: never
+     * rewritten, tag and all. Throws `IncompatibleImageError` — before any
+     * backend call, before the module's own constructor body runs — when
+     * neither matches.
+     */
+    static requireCompatible(image, expectedRepository) {
+        const name = typeof image === "string" ? DockerImageName.parse(image) : image;
+        const declaredRepository = name.substituteRepository ?? name.repository;
+        if (declaredRepository !== expectedRepository) {
+            throw new IncompatibleImageError(name.repository, expectedRepository);
+        }
+        return name.raw;
+    }
+}
+//# sourceMappingURL=docker-image-name.js.map

package/dist/core/docker-image-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-image-name.js","sourceRoot":"","sources":["../../src/core/docker-image-name.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAUrD,qGAAqG;AACrG,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QACxE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,wMAAwM;AACxM,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,GAAG,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,eAAe;IAGf;IAEA;IAEA;IAEA;IAEA;IACQ;IAXnB;IACE,2GAA2G;IAClG,GAAW;IACpB,6GAA6G;IACpG,QAA4B;IACrC,wEAAwE;IAC/D,UAAkB;IAC3B,uDAAuD;IAC9C,GAAuB;IAChC,iFAAiF;IACxE,MAA0B,EAClB,oBAAwC;QAThD,QAAG,GAAH,GAAG,CAAQ;QAEX,aAAQ,GAAR,QAAQ,CAAoB;QAE5B,eAAU,GAAV,UAAU,CAAQ;QAElB,QAAG,GAAH,GAAG,CAAoB;QAEvB,WAAM,GAAN,MAAM,CAAoB;QAClB,yBAAoB,GAApB,oBAAoB,CAAoB;IACxD,CAAC;IAEJ;;;;OAIG;IACH,MAAM,CAAC,KAAK,CAAC,KAAa;QACxB,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAClF,CAAC;IAED;;;;;;;OAOG;IACH,yBAAyB,CAAC,UAAkB;QAC1C,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1G,CAAC;IAED,2DAA2D;IAC3D,QAAQ;QACN,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,iBAAiB,CAAC,KAA+B,EAAE,kBAA0B;QAClF,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9E,MAAM,kBAAkB,GAAG,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,UAAU,CAAC;QACxE,IAAI,kBAAkB,KAAK,kBAAkB,EAAE,CAAC;YAC9C,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;CACF"}

package/dist/core/errors.d.ts

@@ -163,6 +163,27 @@ export declare class CheckpointArtifactMissingError extends Error {
     /** The backend this ref was supposed to exist on. */
     backend: string);
 }
+/**
+ * Thrown by `DockerImageName.requireCompatible` — called by a module
+ * constructor before its own `super()` — when an explicitly supplied
+ * image's repository (registry host, tag, and digest all stripped) doesn't
+ * match the repository that module declares it understands, and no
+ * `asCompatibleSubstituteFor` override says otherwise. Thrown before any
+ * backend call and before the module's own builder calls ever run — never a
+ * bare wait-strategy timeout against a workload that was never going to
+ * answer on the expected protocol.
+ */
+export declare class IncompatibleImageError extends Error {
+    /** The supplied image's own parsed repository (after registry/tag/digest stripping). */
+    readonly suppliedRepository: string;
+    /** The repository this module declares it understands. */
+    readonly expectedRepository: string;
+    constructor(
+    /** The supplied image's own parsed repository (after registry/tag/digest stripping). */
+    suppliedRepository: string, 
+    /** The repository this module declares it understands. */
+    expectedRepository: string);
+}
 /**
  * Thrown by `Checkpoints.importFrom` when `srcPath` isn't a well-formed
  * rightsize checkpoint archive: the file doesn't exist, it isn't a valid tar,