Deployed 5287b59 with MkDocs version: 1.6.1

2026-10-10 07:55:34 +02:00 · 2026-05-12 21:45:50 +00:00
445 changed files with 76274 additions and 23760 deletions
@@ -1,24 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-ARCH="$1"
-SCRATCH_PATH=".build/$ARCH"
-OUTPUT_PATH=".build/prebuilt/$ARCH"
-
-swift build \
-  --build-system swiftbuild \
-  --scratch-path "$SCRATCH_PATH" \
-  --arch "$ARCH" \
-  --configuration release \
-  --product tart
-
-BIN_PATH=$(swift build \
-  --build-system swiftbuild \
-  --scratch-path "$SCRATCH_PATH" \
-  --arch "$ARCH" \
-  --configuration release \
-  --show-bin-path)
-
-mkdir -p "$OUTPUT_PATH"
-cp "$BIN_PATH/tart" "$OUTPUT_PATH/tart"
@@ -1,18 +0,0 @@
-#!/bin/sh
-
-set -e
-
-export VERSION="${VERSION:-0}"
-
-mkdir -p .ci/pkg/
-cp .build/arm64-apple-macosx/release/tart .ci/pkg/tart
-cp Resources/embedded.provisionprofile .ci/pkg/embedded.provisionprofile
-cp Resources/AppIcon.png .ci/pkg/AppIcon.png
-cp Resources/Info.plist .ci/pkg/Info.plist
-pkgbuild --root .ci/pkg/ --identifier com.github.cirruslabs.tart --version $VERSION \
-  --scripts .ci/pkg/scripts \
-  --install-location "/Library/Application Support/Tart" \
-  --sign "Developer ID Installer: Cirrus Labs, Inc. (9M2P8L4D89)" \
-  "./.ci/Tart-$VERSION.pkg"
-xcrun notarytool submit "./.ci/Tart-$VERSION.pkg" --keychain-profile "notarytool" --wait
-xcrun stapler staple "./.ci/Tart-$VERSION.pkg"
@@ -1,15 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# fix structure
-mkdir -p "$2/tart.app/Contents/MacOS" "$2/tart.app/Resources"
-mv "$2/tart" "$2/tart.app/Contents/MacOS/tart"
-mv "$2/embedded.provisionprofile" "$2/tart.app/Contents/embedded.provisionprofile"
-mv "$2/AppIcon.png" "$2/tart.app/Resources/AppIcon.png"
-mv "$2/Info.plist" "$2/tart.app/Contents/Info.plist"
-
-echo "#!/bin/sh" > /usr/local/bin/tart
-echo "exec '$2/tart.app/Contents/MacOS/tart' \"\$@\"" >> /usr/local/bin/tart
-
-chmod +x /usr/local/bin/tart
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-set -e
-
-: "${VERSION:?VERSION must be set}"
-
-TMPFILE=$(mktemp)
-perl -pe 's/\$\{VERSION\}/$ENV{VERSION}/g' Sources/tart/CI/CI.swift > "$TMPFILE"
-mv "$TMPFILE" Sources/tart/CI/CI.swift
-
-/usr/libexec/PlistBuddy -c "Add :CFBundleShortVersionString string ${VERSION}" Resources/Info.plist
@@ -1,41 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-APP_PATH="dist/tart_darwin_all/tart.app"
-
-if [ "${TART_RELEASE_SNAPSHOT:-false}" = "true" ]; then
-  codesign \
-    --force \
-    --deep \
-    --sign - \
-    --entitlements Resources/tart-dev.entitlements \
-    "$APP_PATH"
-else
-  codesign \
-    --force \
-    --verbose \
-    --sign "Developer ID Application: Cirrus Labs, Inc. (9M2P8L4D89)" \
-    --timestamp \
-    --options runtime \
-    --keychain "$RUNNER_TEMP/build.keychain" \
-    --entitlements Resources/tart-prod.entitlements \
-    "$APP_PATH"
-fi
-
-codesign --verify --strict --verbose=2 "$APP_PATH"
-"$APP_PATH/Contents/MacOS/tart" --version
-
-if [ "${TART_RELEASE_SNAPSHOT:-false}" != "true" ]; then
-  NOTARIZATION_ARCHIVE="$RUNNER_TEMP/tart-notarization.zip"
-
-  ditto -c -k --keepParent "$APP_PATH" "$NOTARIZATION_ARCHIVE"
-  xcrun notarytool submit "$NOTARIZATION_ARCHIVE" \
-    --keychain-profile "notarytool" \
-    --keychain "$RUNNER_TEMP/build.keychain" \
-    --wait \
-    --timeout 20m
-  xcrun stapler staple "$APP_PATH"
-  xcrun stapler validate "$APP_PATH"
-  spctl --assess --type execute --verbose=4 "$APP_PATH"
-fi
@@ -1,78 +0,0 @@
-use_compute_credits: true
-
-task:
-  name: Test
-  alias: test
-  persistent_worker:
-    labels:
-      name: dev-mini
-    resources:
-      tart-vms: 1
-  build_script:
-    - swift build
-  test_script:
-    # Add /usr/sbin to PATH, otherwise testDiskutilInfo() fails to locate "diskutil"
-    - export PATH=$PATH:/usr/sbin
-    - swift test
-  integration_test_script:
-    - codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/debug/tart
-    - export PATH=$(pwd)/.build/arm64-apple-macosx/debug:$PATH
-    # Run integration tests
-    - cd integration-tests
-    - python3 -m venv --symlinks venv
-    - source venv/bin/activate
-    - pip install -r requirements.txt
-    - pytest --verbose --junit-xml=pytest-junit.xml
-    - go test -v ./...
-  pytest_junit_result_artifacts:
-    path: "integration-tests/pytest-junit.xml"
-    format: junit
-
-task:
-  name: Markdown Lint
-  only_if: $CIRRUS_BRANCH != 'gh-pages' && changesInclude('**.md')
-  container:
-    image: node:latest
-  install_script: npm install -g markdownlint-cli
-  lint_script: markdownlint --config=docs/.markdownlint.yml docs/
-
-task:
-  name: Lint
-  alias: lint
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:tahoe
-  lint_script:
-    - swift package plugin --allow-writing-to-package-directory swiftformat --cache ignore --lint --report swiftformat.json .
-  always:
-    swiftformat_report_artifacts:
-      path: swiftformat.json
-      format: swiftformat
-
-task:
-  only_if: $CIRRUS_TAG == ''
-  env:
-    matrix:
-      BUILD_ARCH: arm64
-      BUILD_ARCH: x86_64
-  name: Build ($BUILD_ARCH)
-  alias: build
-  macos_instance:
-    image: ghcr.io/cirruslabs/macos-runner:tahoe
-  build_script: swift build --arch $BUILD_ARCH --product tart
-  sign_script: codesign --sign - --entitlements Resources/tart-dev.entitlements --force .build/$BUILD_ARCH-apple-macosx/debug/tart
-  binary_artifacts:
-    path: .build/$BUILD_ARCH-apple-macosx/debug/tart
-
-task:
-  name: Deploy Documentation
-  only_if: $CIRRUS_BRANCH == 'main'
-  container:
-    image: ghcr.io/squidfunk/mkdocs-material:latest
-    registry_config: ENCRYPTED[!cf1a0f25325aa75bad3ce6ebc890bc53eb0044c02efa70d8cefb83ba9766275a994b4831706c52630a0692b2fa9cfb9e!]
-  env:
-    DEPLOY_TOKEN: ENCRYPTED[!45ed45666558902ed1c2400add734ec063103bec31841847e8c8764802fca229bfa6d85c690e16ad159e047574b48793!]
-  deploy_script:
-    - git config --global user.name "Cirrus CI"
-    - git config --global user.name "hello@cirruslabs.org"
-    - git remote set-url origin https://$DEPLOY_TOKEN@github.com/cirruslabs/tart/
-    - mkdocs --verbose gh-deploy --force --remote-branch gh-pages
@@ -1,11 +0,0 @@
-root = true
-
-[*]
-indent_style = space
-indent_size = 2
-insert_final_newline = true
-
-[integration-tests/**]
-indent_style = unset
-indent_size = unset
-insert_final_newline = unset
@@ -1 +0,0 @@
-* @edigaryev @fkorotkov
@@ -1 +0,0 @@
-github: [cirruslabs]
@@ -1,37 +0,0 @@
-name: Build
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  build_cached:
-    name: Build tart (cached)
-    runs-on: xcode-27
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
-      - name: Build
-        run: |
-          export COMPILATION_CACHE_ENABLE_CACHING=YES
-          export COMPILATION_CACHE_REMOTE_SERVICE_PATH="$HOME/.cirruslabs/omni-cache.sock"
-          export COMPILATION_CACHE_ENABLE_PLUGIN=YES
-          export COMPILATION_CACHE_ENABLE_INTEGRATED_QUERIES=YES
-          export COMPILATION_CACHE_ENABLE_DETACHED_KEY_QUERIES=YES
-          export SWIFT_ENABLE_COMPILE_CACHE=YES
-          export SWIFT_ENABLE_EXPLICIT_MODULES=YES
-          export SWIFT_USE_INTEGRATED_DRIVER=YES
-          export CLANG_ENABLE_COMPILE_CACHE=YES
-          export CLANG_ENABLE_MODULES=YES
-          swift build --build-system swiftbuild --product tart
-
-  build_no_cache:
-    name: Build tart (no cache)
-    runs-on: xcode-27
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
-      - name: Build
-        run: swift build --build-system swiftbuild --product tart
@@ -1,37 +0,0 @@
-name: CI
-
-on:
-  merge_group:
-  pull_request:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: Test
-    runs-on: xcode-27
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version-file: integration-tests/go.mod
-          cache-dependency-path: integration-tests/go.sum
-      - name: Build
-        run: swift build --build-system swiftbuild
-      - name: Run unit tests
-        run: |
-          export PATH="$PATH:/usr/sbin"
-          swift test --build-system swiftbuild
-      # The Python suite boots Tart VMs, but hosted ARM macOS runners do not support nested virtualization.
-      - name: Run OpenTelemetry integration tests
-        run: |
-          bin_path="$(swift build --build-system swiftbuild --show-bin-path)"
-          codesign --sign - --entitlements Resources/tart-dev.entitlements --force "$bin_path/tart"
-          cd integration-tests
-          PATH="$bin_path:$PATH" go test -v ./...
@@ -1,111 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - "*"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  release:
-    if: github.event_name == 'push' && github.repository == 'openai/tart'
-    name: Release
-    runs-on: xcode-27
-    environment: publish
-    timeout-minutes: 90
-    permissions:
-      contents: read
-    env:
-      VERSION: ${{ github.ref_name }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - name: Import signing certificate
-        env:
-          AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
-          KEYCHAIN_PASSWORD: temporary-password
-          MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
-          P12_PASSWORD: password101
-        run: |
-          echo "$MACOS_CERTIFICATE" | base64 --decode > "$RUNNER_TEMP/certificate.p12"
-          security create-keychain -p "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/build.keychain"
-          security set-keychain-settings -lut 21600 "$RUNNER_TEMP/build.keychain"
-          security default-keychain -s "$RUNNER_TEMP/build.keychain"
-          security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$RUNNER_TEMP/build.keychain"
-          security import "$RUNNER_TEMP/certificate.p12" \
-            -k "$RUNNER_TEMP/build.keychain" \
-            -P "$P12_PASSWORD" \
-            -T /usr/bin/codesign \
-            -T /usr/bin/pkgbuild
-          security set-key-partition-list \
-            -S apple-tool:,apple:,codesign: \
-            -s \
-            -k "$KEYCHAIN_PASSWORD" \
-            "$RUNNER_TEMP/build.keychain"
-          security list-keychain -d user -s "$RUNNER_TEMP/build.keychain"
-          xcrun notarytool store-credentials "notarytool" \
-            --apple-id "hello@cirruslabs.org" \
-            --team-id "9M2P8L4D89" \
-            --password "$AC_PASSWORD" \
-            --keychain "$RUNNER_TEMP/build.keychain"
-      - name: Create release app token for this repo
-        id: app-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
-        with:
-          app-id: ${{ secrets.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-          permission-contents: write
-      - name: Create release app token for homebrew-tools
-        id: tap-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
-        with:
-          app-id: ${{ secrets.RELEASE_APP_ID }}
-          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-          owner: openai
-          repositories: homebrew-tools
-          permission-contents: write
-          permission-pull-requests: write
-      - name: Release
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
-        with:
-          distribution: goreleaser-pro
-          version: "~> v2"
-          args: release --clean
-        env:
-          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
-          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.tap-token.outputs.token }}
-
-  snapshot:
-    if: github.event_name == 'workflow_dispatch'
-    name: Release (Dry Run)
-    runs-on: xcode-27
-    timeout-minutes: 90
-    permissions:
-      contents: read
-    env:
-      TART_RELEASE_SNAPSHOT: "true"
-      VERSION: snapshot
-    steps:
-      - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - name: Build snapshot
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
-        with:
-          distribution: goreleaser-pro
-          version: "~> v2"
-          args: release --skip=publish --snapshot --clean
-      - name: Upload snapshot artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: tart-snapshot
-          path: dist/*
@@ -1,24 +0,0 @@
-# Xcode's user settings
-xcuserdata/
-tart.xcodeproj/
-
-# SwiftPM
-.swiftpm/
-
-# AppCode
-.idea/
-
-# VS Code
-.vscode/
-
-# Swift
-.build/
-
-# GoReleaser
-dist/
-
-# mkdocs
-.cache
-
-# mkdocs-material
-site
@@ -1,86 +0,0 @@
-version: 2
-
-project_name: tart
-
-before:
-  hooks:
-    - .ci/set-version.sh
-    - sh .ci/build-release.sh arm64
-    - sh .ci/build-release.sh x86_64
-
-builds:
-  - id: tart
-    builder: prebuilt
-    goamd64: [v1]
-    goos:
-      - darwin
-    goarch:
-      - arm64
-      - amd64
-    binary: tart.app/Contents/MacOS/tart
-    prebuilt:
-      path: '.build/prebuilt/{{- if eq .Arch "arm64" }}arm64{{- else }}x86_64{{ end }}/tart'
-
-universal_binaries:
-  - name_template: tart.app/Contents/MacOS/tart
-    replace: true
-    hooks:
-      post:
-        - mkdir -p dist/tart_darwin_all/tart.app/Contents/Resources
-        - cp Resources/embedded.provisionprofile dist/tart_darwin_all/tart.app/Contents/
-        - cp Resources/Info.plist dist/tart_darwin_all/tart.app/Contents/
-        - cp "Resources/actool/UPW Tart.icns" "Resources/actool/Assets.car" dist/tart_darwin_all/tart.app/Contents/Resources/
-        - cmd: .ci/sign-release.sh
-          output: true
-
-archives:
-  - name_template: "{{ .ProjectName }}"
-    files:
-      - src: dist/tart_darwin_all/tart.app/Contents/Info.plist
-        dst: tart.app/Contents/Info.plist
-      - src: dist/tart_darwin_all/tart.app/Contents/embedded.provisionprofile
-        dst: tart.app/Contents/embedded.provisionprofile
-      - src: dist/tart_darwin_all/tart.app/Contents/Resources/UPW Tart.icns
-        dst: tart.app/Contents/Resources/UPW Tart.icns
-      - src: dist/tart_darwin_all/tart.app/Contents/Resources/Assets.car
-        dst: tart.app/Contents/Resources/Assets.car
-      - src: dist/tart_darwin_all/tart.app/Contents/_CodeSignature/CodeResources
-        dst: tart.app/Contents/_CodeSignature/CodeResources
-      - LICENSE
-
-release:
-  prerelease: auto
-
-brews:
-  - name: tart
-    directory: Formula
-    repository:
-      owner: openai
-      name: homebrew-tools
-      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
-      branch: "tart-{{ .Version }}"
-      pull_request:
-        enabled: true
-    caveats: |
-      Tart has been installed. You might want to reduce the default DHCP lease time
-      from 86,400 to 600 seconds to avoid DHCP shortage when running lots of VMs daily:
-
-        sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.InternetSharing.default.plist bootpd -dict DHCPLeaseTimeSecs -int 600
-
-      See https://tart.run/faq/#changing-the-default-dhcp-lease-time for more details.
-    homepage: https://github.com/openai/tart
-    license: FSL-1.1-ALv2
-    description: Run macOS and Linux VMs on Apple Hardware
-    skip_upload: auto
-    dependencies:
-      - "openai/tools/softnet"
-    install: |
-      libexec.install Dir["*"]
-      bin.write_exec_script "#{libexec}/tart.app/Contents/MacOS/tart"
-    custom_block: |
-      on_macos do
-        depends_on :macos => :ventura
-      end
-      def post_install
-        generate_completions_from_executable(libexec/"tart.app/Contents/MacOS/tart", "--generate-completion-script")
-      end
@@ -1,5 +0,0 @@
--disable all
--enable indent
--indent 2
--exclude Sources/tart/OCI/Reference/Generated
--swiftversion 5.7
@@ -1,41 +0,0 @@
-# Contributing to Tart
-
-Table of Contents
-----------------
-
- [How to Build](#how-to-build)
- [How to Create an Issue/Enhancement](#how-to-create-an-issueenhancement)
- [Style Guidelines](#style-guidelines)
- [Pull Requests](#Pull-Requests)
-
-## How to Build
-
-1. Fork the repository to your own GitHub account
-2. Clone the forked repository to your local machine
-3. If using Xcode, use from Xcode 15 or newer
-4. Run ./scripts/run-signed.sh from the root of your repository
-
-```bash
-./scripts/run-signed.sh list
-```
-## How to Create an Issue/Enhancement
-
-1. Go to the [Issue page](https://github.com/openai/tart/issues) of the repository
-2. Click on the "New Issue" button
-3. Provide a descriptive title and detailed description of the issue or enhancement you're suggesting
-4. Submit the issue
-
-## Style Guidelines
-
-1. Code should follow camel case
-2. Code should follow [SwiftFormat](https://github.com/nicklockwood/SwiftFormat#swift-package-manager-plugin) guidelines. You can auto-format the code by running the following command:
-
-```bash
-swift package plugin --allow-writing-to-package-directory swiftformat --cache ignore .
-```
-
-## Pull Requests
-
-1. Provide a detailed description of the changes you made in the pull request
-2. Wait for pull request to be reviewed 
-3. Make adjustments if necessary
@@ -1,105 +0,0 @@
-# Functional Source License, Version 1.1, ALv2 Future License
-
-## Abbreviation
-
-FSL-1.1-ALv2
-
-## Notice
-
-Copyright 2022-2026 OpenAI
-
-## Terms and Conditions
-
-### Licensor ("We")
-
-The party offering the Software under these Terms and Conditions.
-
-### The Software
-
-The "Software" is each version of the software that we make available under
-these Terms and Conditions, as indicated by our inclusion of these Terms and
-Conditions with the Software.
-
-### License Grant
-
-Subject to your compliance with this License Grant and the Patents,
-Redistribution and Trademark clauses below, we hereby grant you the right to
-use, copy, modify, create derivative works, publicly perform, publicly display
-and redistribute the Software for any Permitted Purpose identified below.
-
-### Permitted Purpose
-
-A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
-means making the Software available to others in a commercial product or
-service that:
-
-1. substitutes for the Software;
-
-2. substitutes for any other product or service we offer using the Software
-   that exists as of the date we make the Software available; or
-
-3. offers the same or substantially similar functionality as the Software.
-
-Permitted Purposes specifically include using the Software:
-
-1. for your internal use and access;
-
-2. for non-commercial education;
-
-3. for non-commercial research; and
-
-4. in connection with professional services that you provide to a licensee
-   using the Software in accordance with these Terms and Conditions.
-
-### Patents
-
-To the extent your use for a Permitted Purpose would necessarily infringe our
-patents, the license grant above includes a license under our patents. If you
-make a claim against any party that the Software infringes or contributes to
-the infringement of any patent, then your patent license to the Software ends
-immediately.
-
-### Redistribution
-
-The Terms and Conditions apply to all copies, modifications and derivatives of
-the Software.
-
-If you redistribute any copies, modifications or derivatives of the Software,
-you must include a copy of or a link to these Terms and Conditions and not
-remove any copyright notices provided in or with the Software.
-
-### Disclaimer
-
-THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
-PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
-
-IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
-SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
-EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
-
-### Trademarks
-
-Except for displaying the License Details and identifying us as the origin of
-the Software, you have no right under these Terms and Conditions to use our
-trademarks, trade names, service marks or product names.
-
-## Grant of Future License
-
-We hereby irrevocably grant you an additional license to use the Software under
-the Apache License, Version 2.0 that is effective on the second anniversary of
-the date we make the Software available. On or after that date, you may use the
-Software under the Apache License, Version 2.0, in which case the following
-will apply:
-
-Licensed under the Apache License, Version 2.0 (the "License"); you may not use
-this file except in compliance with the License.
-
-You may obtain a copy of the License at
-
-http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software distributed
-under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
-CONDITIONS OF ANY KIND, either express or implied. See the License for the
-specific language governing permissions and limitations under the License.
@@ -1,64 +0,0 @@
-# Profiling Tart
-
-## Using `time(1)`
-
-Perhaps, the easiest, but not the most comprehensive way to tell what's going on with Tart is to use the [`time(1)`](https://ss64.com/mac/time.html) command.
-
-In the example below, you will run `tart pull` via `time(1)` to gather generalized CPU, I/O and memory usage metrics:
-
-```shell
-/usr/bin/time -l tart pull ghcr.io/cirruslabs/macos-tahoe-base:latest
-```
-
-**Note:** you need to specify a full path to `time(1)` binary, otherwise the shell's built-in `time` command will be invoked, which doesn't have the `-l` command-line argument.
-
-**Note:** The `-l` command-line argument makes `time(1)` return much more useful information, for example, maximum memory usage.
-
-When running the command above, you'll see the `tart pull` output first as it pulls the image, and then the `time(1)` output, which will be printed once the Tart process finishes:
-
-```
-      172.17 real        10.29 user         8.36 sys
-           353796096  maximum resident set size
-                   0  average shared memory size
-                   0  average unshared data size
-                   0  average unshared stack size
-               23838  page reclaims
-                  35  page faults
-                   0  swaps
-                   0  block input operations
-                   0  block output operations
-                   8  messages sent
-                   8  messages received
-                   0  signals received
-                 146  voluntary context switches
-              222950  involuntary context switches
-         39683070975  instructions retired
-         27562035252  cycles elapsed
-           170920448  peak memory footprint
-```
-
-From the output above, you can tell that `tart pull` spent nearly 90% of time off-CPU (`real` > `user` + `sys`), which means that Tart was mostly waiting for the I/O (be it a network or disk), instead of decompressing disk layers or doing other useful computations.
-
-## Using `xctrace(1)`
-
-[`xctrace(1)`](https://keith.github.io/xcode-man-pages/xctrace.1.html) is a `.trace` format recorder for the [Instruments](https://en.wikipedia.org/wiki/Instruments_(software)) app, which yields much more powerful insights compared to `time(1)`. For example, it can tell which Tart functions spent the most time on the CPU, thus allowing the Tart developers to further optimize these functions.
-
-To use it, make sure that [Xcode](https://developer.apple.com/xcode/resources/) is installed. If you're installing Xcode for the first time on the machine, you'll need to launch it once and click the blue "Install" button. There's no need to choose any platforms except for the macOS.
-
-Once done, you can create a CPU profile of `tart pull`:
-
-```shell
-xctrace record --template "CPU Profiler" --target-stdout - --launch -- /opt/homebrew/bin/tart pull ghcr.io/cirruslabs/macos-tahoe-base:latest
-```
-
-Now that `xctrace(1)` is running, you'll see the `tart pull`-related output first, and once finished, the following line will appear:
-
-```
-Output file saved as: Launch_[...].trace
-```
-
-To view this trace in the Instruments app, simply find this directory in Finder and double-click it. Instruments app will appear:
-
-![](Resources/Instruments.png)
-
-To send this trace, right-click its directory in Finder and choose "Compress [...]". This will result in a similarly named file with a `.zip` at the end, which can now be conveniently sent via email or uploaded.
@@ -1,303 +0,0 @@
-{
-  "originHash" : "061dfe6cdf4e6dbf32b51c5e7023c4ae69726dcafb42a35b34e5489b0338c17f",
-  "pins" : [
-    {
-      "identity" : "antlr4",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/antlr/antlr4",
-      "state" : {
-        "revision" : "cc82115a4e7f53d71d9d905caa2c2dfa4da58899",
-        "version" : "4.13.2"
-      }
-    },
-    {
-      "identity" : "cirruslabs_tart-guest-agent_apple_swift",
-      "kind" : "remoteSourceControl",
-      "location" : "https://buf.build/gen/swift/git/1.33.3-20260114140118-bd09c26a260f.1/cirruslabs_tart-guest-agent_apple_swift.git",
-      "state" : {
-        "revision" : "5c49a653f4b003161077d194bc708b7373628c99",
-        "version" : "1.33.3-20260114140118-bd09c26a260f.1"
-      }
-    },
-    {
-      "identity" : "cirruslabs_tart-guest-agent_grpc_swift",
-      "kind" : "remoteSourceControl",
-      "location" : "https://buf.build/gen/swift/git/1.27.1-20260114140118-bd09c26a260f.1/cirruslabs_tart-guest-agent_grpc_swift.git",
-      "state" : {
-        "branch" : "main",
-        "revision" : "4935078c2fe2508360843596d71a1f844ce639a6"
-      }
-    },
-    {
-      "identity" : "dynamic",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/mhdhejazi/Dynamic",
-      "state" : {
-        "branch" : "master",
-        "revision" : "772883073d044bc754d401cabb6574624eb3778f"
-      }
-    },
-    {
-      "identity" : "grpc-swift",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/grpc/grpc-swift.git",
-      "state" : {
-        "revision" : "8f57f68b9d247fe3759fa9f18e1fe919911e6031",
-        "version" : "1.27.1"
-      }
-    },
-    {
-      "identity" : "opentelemetry-swift",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/open-telemetry/opentelemetry-swift",
-      "state" : {
-        "branch" : "main",
-        "revision" : "ed37be9525081509ab62410d38b705c2b3f0d5a4"
-      }
-    },
-    {
-      "identity" : "opentelemetry-swift-core",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/open-telemetry/opentelemetry-swift-core.git",
-      "state" : {
-        "revision" : "240c8d5e36c3c7b774ed961325369f0b1f2c965f",
-        "version" : "2.3.0"
-      }
-    },
-    {
-      "identity" : "opentracing-objc",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/undefinedlabs/opentracing-objc",
-      "state" : {
-        "revision" : "18c1a35ca966236cee0c5a714a51a73ff33384c1",
-        "version" : "0.5.2"
-      }
-    },
-    {
-      "identity" : "semaphore",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/groue/Semaphore",
-      "state" : {
-        "revision" : "2543679282aa6f6c8ecf2138acd613ed20790bc2",
-        "version" : "0.1.0"
-      }
-    },
-    {
-      "identity" : "swift-algorithms",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-algorithms",
-      "state" : {
-        "revision" : "f6919dfc309e7f1b56224378b11e28bab5bccc42",
-        "version" : "1.2.0"
-      }
-    },
-    {
-      "identity" : "swift-argument-parser",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-argument-parser",
-      "state" : {
-        "revision" : "309a47b2b1d9b5e991f36961c983ecec72275be3",
-        "version" : "1.6.1"
-      }
-    },
-    {
-      "identity" : "swift-atomics",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-atomics.git",
-      "state" : {
-        "revision" : "b601256eab081c0f92f059e12818ac1d4f178ff7",
-        "version" : "1.3.0"
-      }
-    },
-    {
-      "identity" : "swift-collections",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-collections.git",
-      "state" : {
-        "revision" : "671108c96644956dddcd89dd59c203dcdb36cec7",
-        "version" : "1.1.4"
-      }
-    },
-    {
-      "identity" : "swift-http-structured-headers",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-http-structured-headers.git",
-      "state" : {
-        "revision" : "db6eea3692638a65e2124990155cd220c2915903",
-        "version" : "1.3.0"
-      }
-    },
-    {
-      "identity" : "swift-http-types",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-http-types.git",
-      "state" : {
-        "revision" : "a0a57e949a8903563aba4615869310c0ebf14c03",
-        "version" : "1.4.0"
-      }
-    },
-    {
-      "identity" : "swift-log",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-log.git",
-      "state" : {
-        "revision" : "2778fd4e5a12a8aaa30a3ee8285f4ce54c5f3181",
-        "version" : "1.9.1"
-      }
-    },
-    {
-      "identity" : "swift-metrics",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-metrics.git",
-      "state" : {
-        "revision" : "0743a9364382629da3bf5677b46a2c4b1ce5d2a6",
-        "version" : "2.7.1"
-      }
-    },
-    {
-      "identity" : "swift-nio",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio.git",
-      "state" : {
-        "revision" : "233f61bc2cfbb22d0edeb2594da27a20d2ce514e",
-        "version" : "2.93.0"
-      }
-    },
-    {
-      "identity" : "swift-nio-extras",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio-extras.git",
-      "state" : {
-        "revision" : "f1f6f772198bee35d99dd145f1513d8581a54f2c",
-        "version" : "1.26.0"
-      }
-    },
-    {
-      "identity" : "swift-nio-http2",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio-http2.git",
-      "state" : {
-        "revision" : "4281466512f63d1bd530e33f4aa6993ee7864be0",
-        "version" : "1.36.0"
-      }
-    },
-    {
-      "identity" : "swift-nio-ssl",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio-ssl.git",
-      "state" : {
-        "revision" : "4b38f35946d00d8f6176fe58f96d83aba64b36c7",
-        "version" : "2.31.0"
-      }
-    },
-    {
-      "identity" : "swift-nio-transport-services",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-nio-transport-services.git",
-      "state" : {
-        "revision" : "cd1e89816d345d2523b11c55654570acd5cd4c56",
-        "version" : "1.24.0"
-      }
-    },
-    {
-      "identity" : "swift-numerics",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-numerics",
-      "state" : {
-        "revision" : "0a5bc04095a675662cf24757cc0640aa2204253b",
-        "version" : "1.0.2"
-      }
-    },
-    {
-      "identity" : "swift-protobuf",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-protobuf.git",
-      "state" : {
-        "revision" : "c169a5744230951031770e27e475ff6eefe51f9d",
-        "version" : "1.33.3"
-      }
-    },
-    {
-      "identity" : "swift-retry",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/fumoboy007/swift-retry",
-      "state" : {
-        "revision" : "df9d7b185d2e433147ec0083a73c257e665eea0d",
-        "version" : "0.2.4"
-      }
-    },
-    {
-      "identity" : "swift-sysctl",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/sersoft-gmbh/swift-sysctl.git",
-      "state" : {
-        "revision" : "a91be36de6803ebe48f678699dfd0694c2200d2f",
-        "version" : "1.8.0"
-      }
-    },
-    {
-      "identity" : "swift-system",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/apple/swift-system.git",
-      "state" : {
-        "revision" : "a34201439c74b53f0fd71ef11741af7e7caf01e1",
-        "version" : "1.4.2"
-      }
-    },
-    {
-      "identity" : "swift-xattr",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/jozefizso/swift-xattr",
-      "state" : {
-        "revision" : "f8605af7b3290dbb235fb182ec6e9035d0c8c3ac",
-        "version" : "3.0.0"
-      }
-    },
-    {
-      "identity" : "swiftdate",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/malcommac/SwiftDate",
-      "state" : {
-        "revision" : "5d943224c3bb173e6ecf27295611615eba90c80e",
-        "version" : "7.0.0"
-      }
-    },
-    {
-      "identity" : "swiftformat",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/nicklockwood/SwiftFormat",
-      "state" : {
-        "revision" : "ab6844edb79a7b88dc6320e6cee0a0db7674dac3",
-        "version" : "0.54.5"
-      }
-    },
-    {
-      "identity" : "swiftradix",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/orchetect/SwiftRadix",
-      "state" : {
-        "revision" : "a52c37a4c213403f7377ae77b4c68451bcab8330",
-        "version" : "1.3.1"
-      }
-    },
-    {
-      "identity" : "texttable",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/cfilipov/TextTable",
-      "state" : {
-        "branch" : "master",
-        "revision" : "e03289289155b4e7aa565e32862f9cb42140596a"
-      }
-    },
-    {
-      "identity" : "thrift-swift",
-      "kind" : "remoteSourceControl",
-      "location" : "https://github.com/undefinedlabs/Thrift-Swift",
-      "state" : {
-        "revision" : "18ff09e6b30e589ed38f90a1af23e193b8ecef8e",
-        "version" : "1.1.2"
-      }
-    }
-  ],
-  "version" : 3
-}
@@ -1,62 +0,0 @@
-// swift-tools-version:5.10
-
-import PackageDescription
-let package = Package(
-  name: "Tart",
-  platforms: [
-    .macOS(.v13)
-  ],
-  products: [
-    .executable(name: "tart", targets: ["tart"])
-  ],
-  dependencies: [
-    .package(url: "https://github.com/apple/swift-argument-parser", from: "1.6.1"),
-    .package(url: "https://github.com/mhdhejazi/Dynamic", branch: "master"),
-    .package(url: "https://github.com/apple/swift-algorithms", from: "1.2.0"),
-    .package(url: "https://github.com/malcommac/SwiftDate", from: "7.0.0"),
-    .package(url: "https://github.com/antlr/antlr4", exact: "4.13.2"),
-    .package(url: "https://github.com/apple/swift-atomics.git", .upToNextMajor(from: "1.2.0")),
-    .package(url: "https://github.com/nicklockwood/SwiftFormat", from: "0.53.6"),
-    .package(url: "https://github.com/cfilipov/TextTable", branch: "master"),
-    .package(url: "https://github.com/sersoft-gmbh/swift-sysctl.git", from: "1.8.0"),
-    .package(url: "https://github.com/orchetect/SwiftRadix", from: "1.3.1"),
-    .package(url: "https://github.com/groue/Semaphore", from: "0.0.8"),
-    .package(url: "https://github.com/fumoboy007/swift-retry", from: "0.2.3"),
-    .package(url: "https://github.com/jozefizso/swift-xattr", from: "3.0.0"),
-    .package(url: "https://github.com/grpc/grpc-swift.git", .upToNextMajor(from: "1.27.0")),
-    .package(url: "https://buf.build/gen/swift/git/1.27.1-20260114140118-bd09c26a260f.1/cirruslabs_tart-guest-agent_grpc_swift.git", branch: "main"),
-    .package(url: "https://github.com/open-telemetry/opentelemetry-swift", branch: "main"),
-    .package(url: "https://github.com/open-telemetry/opentelemetry-swift-core", from: "2.3.0"),
-
-  ],
-  targets: [
-    .executableTarget(name: "tart", dependencies: [
-      .product(name: "Algorithms", package: "swift-algorithms"),
-      .product(name: "ArgumentParser", package: "swift-argument-parser"),
-      .product(name: "Dynamic", package: "Dynamic"),
-      .product(name: "SwiftDate", package: "SwiftDate"),
-      .product(name: "Antlr4Static", package: "Antlr4"),
-      .product(name: "Atomics", package: "swift-atomics"),
-      .product(name: "TextTable", package: "TextTable"),
-      .product(name: "Sysctl", package: "swift-sysctl"),
-      .product(name: "SwiftRadix", package: "SwiftRadix"),
-      .product(name: "Semaphore", package: "Semaphore"),
-      .product(name: "DMRetry", package: "swift-retry"),
-      .product(name: "XAttr", package: "swift-xattr"),
-      .product(name: "GRPC", package: "grpc-swift"),
-      .product(name: "Cirruslabs_TartGuestAgent_Grpc_Swift", package: "cirruslabs_tart-guest-agent_grpc_swift"),
-      .product(name: "OpenTelemetryApi", package: "opentelemetry-swift-core"),
-      .product(name: "OpenTelemetrySdk", package: "opentelemetry-swift-core"),
-      .product(name: "OpenTelemetryProtocolExporterHTTP", package: "opentelemetry-swift"),
-      .product(name: "ResourceExtension", package: "opentelemetry-swift"),
-    ], exclude: [
-      "OCI/Reference/Makefile",
-      "OCI/Reference/Reference.g4",
-      "OCI/Reference/Generated/Reference.interp",
-      "OCI/Reference/Generated/Reference.tokens",
-      "OCI/Reference/Generated/ReferenceLexer.interp",
-      "OCI/Reference/Generated/ReferenceLexer.tokens",
-    ]),
-    .testTarget(name: "TartTests", dependencies: ["tart"])
-  ]
-)
@@ -1,59 +0,0 @@
-<img src="https://github.com/openai/tart/raw/main/Resources/TartSocial.png"/>
-
-*Tart* is a virtualization toolset to build, run and manage macOS and Linux virtual machines (VMs) on Apple Silicon.
-Built by CI engineers for your automation needs. Here are some highlights of Tart:
-
-* Tart uses Apple's own `Virtualization.Framework` for [near-native performance](https://browser.geekbench.com/v5/cpu/compare/20382844?baseline=20382722).
-* Push/Pull virtual machines from any OCI-compatible container registry.
-* Use Tart Packer Plugin to automate VM creation.
-* Easily integrates with any CI system.
-
-Many companies are using Tart in their internal setups. Here are just a few of them:
-
-<p align="center">
-  <a href="https://atlassian.com/" target=_blank>
-    <img src="https://github.com/openai/tart/raw/main/Resources/Users/Atlassian.png" height="65"/>
-  </a>
-  <a href="https://www.figma.com/" target=_blank>
-    <img src="https://github.com/openai/tart/raw/main/Resources/Users/Figma.png" height="65"/>
-  </a>
-  <a href="https://mullvad.net/" target=_blank>
-    <img src="https://github.com/openai/tart/raw/main/Resources/Users/Mullvad.png" height="65"/>
-  </a>
-  <a href="https://krisp.ai/" target=_blank>
-    <img src="https://github.com/openai/tart/raw/main/Resources/Users/Krisp.png" height="65"/>
-  </a>
-  <a href="https://testingbot.com/" target=_blank>
-    <img src="https://github.com/openai/tart/raw/main/Resources/Users/TestingBot.png" height="65"/>
-  </a>
-  <a href="https://symflower.com/" target=_blank>
-    <img src="https://github.com/openai/tart/raw/main/Resources/Users/Symflower.png" height="65"/>
-  </a>
-  <a href="https://transloadit.com/" target=_blank>
-    <img src="https://github.com/openai/tart/raw/main/Resources/Users/Transloadit.png" height="65"/>
-  </a>
-  <a href="https://cirrus-ci.org/" target=_blank>
-    <img src="https://github.com/openai/tart/raw/main/Resources/Users/CirrusCI.png" height="65"/>
-  </a>
-  <a href="https://www.pitsdatarecovery.net/" target=_blank>
-    <img src="https://github.com/openai/tart/raw/main/Resources/Users/PITSGlobalDataRecoveryServices.png" height="65"/>
-  </a>
-  <a href="https://expo.dev/" target=_blank>
-    <img src="https://github.com/openai/tart/raw/main/Resources/Users/Expo.png" height="65"/>
-  </a>
-</p>
-
-**Note:** If your company or project is using Tart please consider [sharing with the community](https://github.com/openai/tart/discussions/857).
-
-## Usage
-
-Try running a Tart VM on your Apple Silicon device running macOS 13.0 (Ventura) or later (will download a 25 GB image):
-
-```bash
-brew install openai/tools/tart
-tart clone ghcr.io/cirruslabs/macos-tahoe-base:latest tahoe-base
-tart run tahoe-base
-```
-
-Please check the [official documentation](https://tart.run) for more information and/or feel free to use [discussions](https://github.com/openai/tart/discussions)
-for remaining questions.
@@ -1,29 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleName</key>
-	<string>Tart</string>
-	<key>CFBundleDisplayName</key>
-	<string>Tart</string>
-	<key>CFBundleIdentifier</key>
-	<string>com.github.cirruslabs.tart</string>
-	<key>CFBundleExecutable</key>
-	<string>tart</string>
-	<key>CFBundlePackageType</key>
-	<string>APPL</string>
-	<key>LSApplicationCategoryType</key>
-	<string>public.app-category.developer-tools</string>
-	<key>CFBundleIconFile</key>
-	<string>UPW Tart</string>
-	<key>CFBundleIconName</key>
-	<string>UPW Tart</string>
-	<key>NSAppTransportSecurity</key>
-	<dict>
-		<key>NSAllowsArbitraryLoads</key>
-		<true/>
-	</dict>
-  <key>NSLocalNetworkUsageDescription</key>
-  <string>Access to OCI registries on the local network</string>
-</dict>
-</plist>
@@ -1,140 +0,0 @@
-{
-  "fill" : "automatic",
-  "groups" : [
-    {
-      "blend-mode" : "normal",
-      "blur-material" : 0.5,
-      "layers" : [
-        {
-          "hidden" : false,
-          "image-name-specializations" : [
-            {
-              "value" : "4.4-–-layer.png"
-            },
-            {
-              "idiom" : "square",
-              "value" : "UPW Tart L4.png"
-            }
-          ],
-          "name" : "UPW Tart L4"
-        }
-      ],
-      "opacity" : 1,
-      "shadow" : {
-        "kind" : "neutral",
-        "opacity" : 1
-      },
-      "specular" : true,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.25
-      }
-    },
-    {
-      "layers" : [
-        {
-          "image-name-specializations" : [
-            {
-              "value" : "3.3-–-layer.png"
-            },
-            {
-              "idiom" : "square",
-              "value" : "UPW Tart L3.png"
-            }
-          ],
-          "name" : "UPW Tart L3",
-          "position-specializations" : [
-            {
-              "idiom" : "square",
-              "value" : {
-                "scale" : 1,
-                "translation-in-points" : [
-                  0,
-                  0
-                ]
-              }
-            }
-          ]
-        }
-      ],
-      "shadow" : {
-        "kind" : "none",
-        "opacity" : 1
-      },
-      "specular" : false,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.25
-      }
-    },
-    {
-      "blur-material" : null,
-      "layers" : [
-        {
-          "image-name-specializations" : [
-            {
-              "value" : "2.2-–-layer.png"
-            },
-            {
-              "idiom" : "square",
-              "value" : "UPW Tart L2.png"
-            }
-          ],
-          "name" : "UPW Tart L2"
-        }
-      ],
-      "position-specializations" : [
-        {
-          "idiom" : "square",
-          "value" : {
-            "scale" : 1,
-            "translation-in-points" : [
-              0,
-              0
-            ]
-          }
-        }
-      ],
-      "shadow" : {
-        "kind" : "none",
-        "opacity" : 1
-      },
-      "specular" : true,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.25
-      }
-    },
-    {
-      "layers" : [
-        {
-          "image-name-specializations" : [
-            {
-              "value" : "1.1-–-layer.png"
-            },
-            {
-              "idiom" : "square",
-              "value" : "UPW Tart L1.png"
-            }
-          ],
-          "name" : "UPW Tart L1"
-        }
-      ],
-      "shadow" : {
-        "kind" : "layer-color",
-        "opacity" : 0.5
-      },
-      "specular" : true,
-      "translucency" : {
-        "enabled" : true,
-        "value" : 0.25
-      }
-    }
-  ],
-  "supported-platforms" : {
-    "circles" : [
-      "watchOS"
-    ],
-    "squares" : "shared"
-  }
-}
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>CFBundleIconFile</key>
-	<string>UPW Tart</string>
-	<key>CFBundleIconName</key>
-	<string>UPW Tart</string>
-</dict>
-</plist>
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>com.apple.security.virtualization</key>
-	<true/>
-	<key>com.apple.security.get-task-allow</key>
-	<true/>
-</dict>
-</plist>
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>com.apple.security.virtualization</key>
-	<true/>
-	<key>com.apple.vm.networking</key>
-	<true/>
-</dict>
-</plist>
@@ -1,17 +0,0 @@
-struct CI {
-  private static let rawVersion = "${VERSION}"
-
-  static var version: String {
-    rawVersion.expanded() ? rawVersion : "SNAPSHOT"
-  }
-
-  static var release: String? {
-    rawVersion.expanded() ? "tart@\(rawVersion)" : nil
-  }
-}
-
-private extension String {
-  func expanded() -> Bool {
-    !isEmpty && !starts(with: "$")
-  }
-}
@@ -1,154 +0,0 @@
-import ArgumentParser
-import Foundation
-import SystemConfiguration
-
-struct Clone: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(
-    abstract: "Clone a VM",
-    discussion: """
-    Creates a local virtual machine by cloning either a remote or another local virtual machine.
-
-    Due to copy-on-write magic in Apple File System, a cloned VM won't actually claim all the space right away.
-    Only changes to a cloned disk will be written and claim new space. This also speeds up clones enormously.
-
-    By default, Tart checks available capacity in Tart's home directory and tries to reclaim minimum possible storage for the cloned image
-    to fit. This behaviour is called "automatic pruning" and can be disabled by setting TART_NO_AUTO_PRUNE environment variable.
-    """
-  )
-
-  @Argument(help: "source VM name", completion: .custom(completeMachines))
-  var sourceName: String
-
-  @Argument(help: "new VM name")
-  var newName: String
-
-  @Flag(help: "connect to the OCI registry via insecure HTTP protocol")
-  var insecure: Bool = false
-
-  @Option(help: "network concurrency to use when pulling a remote VM from the OCI-compatible registry")
-  var concurrency: UInt = 4
-
-  @Flag(help: .hidden)
-  var deduplicate: Bool = false
-
-  @Flag(help: "create a stacked disk that uses the source image as an immutable base")
-  var stacked: Bool = false
-
-  @Option(help: ArgumentHelp("limit automatic pruning to n gigabytes", valueName: "n"))
-  var pruneLimit: UInt = 100
-
-  func validate() throws {
-    if newName.contains("/") {
-      throw ValidationError("<new-name> should be a local name")
-    }
-
-    if concurrency < 1 {
-      throw ValidationError("network concurrency cannot be less than 1")
-    }
-  }
-
-  func run() async throws {
-    let ociStorage = try VMStorageOCI()
-    let localStorage = try VMStorageLocal()
-    let remoteName = try? RemoteName(sourceName)
-
-    if stacked {
-      guard remoteName != nil else {
-        throw ValidationError("--stacked requires a remote image")
-      }
-      try DiskImageStack.requireSupport()
-    }
-
-    if let remoteName, try !ociStorage.hasUsableCachedImageForClone(remoteName, requireManifest: stacked) {
-      // Pull the VM in case it's OCI-based and doesn't exist locally yet
-      let registry = try Registry(host: remoteName.host, namespace: remoteName.namespace, insecure: insecure)
-      var resolvedManifest: (manifest: OCIManifest, data: Data)?
-
-      // Fail before pulling disk content when this host cannot create a writable stacked disk.
-      if !stacked {
-        let (manifest, manifestData) = try await registry.pullManifest(reference: remoteName.reference.value)
-        if manifest.layers.contains(where: { $0.mediaType == asifOverlayMediaType }) {
-          try DiskImageStack.requireSupport()
-        }
-        resolvedManifest = (manifest, manifestData)
-      }
-
-      try await ociStorage.pull(
-        remoteName,
-        registry: registry,
-        concurrency: concurrency,
-        deduplicate: deduplicate,
-        requireManifest: stacked,
-        resolvedManifest: resolvedManifest
-      )
-    }
-
-    let sourceVM = try VMStorageHelper.open(sourceName)
-    if sourceVM.isStackedVM || sourceVM.isStackedCachedImage {
-      try DiskImageStack.requireSupport()
-    }
-    let tmpVMDir = try VMDirectory.temporary()
-
-    // Lock the temporary VM directory to prevent it's garbage collection
-    let tmpVMDirLock = try FileLock(lockURL: tmpVMDir.baseURL)
-    try tmpVMDirLock.lock()
-
-    try await withTaskCancellationHandler(operation: {
-      // Acquire a global lock
-      let lock = try FileLock(lockURL: Config().tartHomeDir)
-      try lock.lock()
-
-      let sourceState = try sourceVM.state()
-      let generateMAC = try localStorage.hasVMsWithMACAddress(macAddress: sourceVM.macAddress())
-        && sourceState != .Suspended
-
-      if stacked {
-        guard sourceVM.isStandalone else {
-          throw ValidationError("--stacked cannot use an image that already has a stacked disk")
-        }
-        guard try VMConfig(fromURL: sourceVM.configURL).os == .darwin else {
-          throw ValidationError("--stacked currently supports only macOS images")
-        }
-        try sourceVM.cloneAsStackedBase(to: tmpVMDir, generateMAC: generateMAC)
-      } else if sourceVM.isStackedCachedImage {
-        try sourceVM.cloneStacked(to: tmpVMDir, copyWritableOverlay: false, generateMAC: generateMAC)
-      } else if sourceVM.isStackedVM {
-        guard sourceState == .Stopped else {
-          throw RuntimeError.VMConfigurationError("VM \"\(sourceName)\" must be stopped before cloning")
-        }
-        try sourceVM.cloneStacked(to: tmpVMDir, copyWritableOverlay: true, generateMAC: generateMAC)
-      } else {
-        try sourceVM.clone(to: tmpVMDir, generateMAC: generateMAC)
-      }
-
-      try localStorage.move(newName, from: tmpVMDir)
-
-      try lock.unlock()
-
-      // APFS is doing copy-on-write, so the above cloning operation (just copying files on disk)
-      // is not actually claiming new space until the VM is started and it writes something to disk.
-      //
-      // So, once we clone the VM let's try to claim the rest of space for the VM to run without errors.
-      if sourceVM.isStandalone {
-        let unallocatedBytes = try sourceVM.sizeBytes() - sourceVM.allocatedSizeBytes()
-        // Avoid reclaiming an excessive amount of disk space.
-        let reclaimBytes = min(unallocatedBytes, Int(pruneLimit) * 1024 * 1024 * 1024)
-        if reclaimBytes > 0 {
-          try Prune.reclaimIfNeeded(UInt64(reclaimBytes), sourceVM)
-        }
-      } else if sourceVM.isStackedVM || sourceVM.isStackedCachedImage {
-        let clonedVM = try localStorage.open(newName)
-        // A stacked clone owns only its writable overlay locally, but that
-        // overlay may grow to the full guest-visible disk block layout at
-        // runtime. Reclaim against the clone so it is not pruned itself.
-        let unallocatedBytes = try clonedVM.diskSizeBytes() - clonedVM.allocatedSizeBytes()
-        let reclaimBytes = min(unallocatedBytes, Int(pruneLimit) * 1024 * 1024 * 1024)
-        if reclaimBytes > 0 {
-          try Prune.reclaimIfNeeded(UInt64(reclaimBytes), clonedVM)
-        }
-      }
-    }, onCancel: {
-      try? tmpVMDir.removeFromDisk()
-    })
-  }
-}
@@ -1,86 +0,0 @@
-import ArgumentParser
-import Dispatch
-import Foundation
-import SwiftUI
-import Virtualization
-
-struct Create: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Create a VM")
-
-  @Argument(help: "VM name")
-  var name: String
-
-  @Option(help: ArgumentHelp("create a macOS VM using path to the IPSW file or URL (or \"latest\", to fetch the latest supported IPSW automatically)", valueName: "path"), completion: .file())
-  var fromIPSW: String?
-
-  @Flag(help: "create a Linux VM")
-  var linux: Bool = false
-
-  @Option(help: ArgumentHelp("Disk size in GB"))
-  var diskSize: UInt16 = 50
-
-  @Option(help: ArgumentHelp("Disk image format", discussion: "ASIF format provides better performance but requires macOS 26 Tahoe or later"))
-  var diskFormat: DiskImageFormat = .raw
-
-  func validate() throws {
-    if fromIPSW == nil && !linux {
-      throw ValidationError("Please specify either a --from-ipsw or --linux option!")
-    }
-    #if arch(x86_64)
-      if fromIPSW != nil {
-        throw ValidationError("Only Linux VMs are supported on Intel!")
-      }
-    #endif
-
-    // Validate disk format support
-    if !diskFormat.isSupported {
-      throw ValidationError("Disk format '\(diskFormat.rawValue)' is not supported on this system.")
-    }
-  }
-
-  func run() async throws {
-    let tmpVMDir = try VMDirectory.temporary()
-
-    // Lock the temporary VM directory to prevent it's garbage collection
-    let tmpVMDirLock = try FileLock(lockURL: tmpVMDir.baseURL)
-    try tmpVMDirLock.lock()
-
-    try await withTaskCancellationHandler(operation: {
-      #if arch(arm64)
-        if let fromIPSW = fromIPSW {
-          let ipswURL: URL
-
-          if fromIPSW == "latest" {
-            defaultLogger.appendNewLine("Looking up the latest supported IPSW...")
-
-            let image = try await withCheckedThrowingContinuation { continuation in
-              VZMacOSRestoreImage.fetchLatestSupported() { result in
-                continuation.resume(with: result)
-              }
-            }
-
-            ipswURL = image.url
-          } else if fromIPSW.starts(with: "http://") || fromIPSW.starts(with: "https://") {
-            ipswURL = URL(string: fromIPSW)!
-          } else {
-            ipswURL = URL(fileURLWithPath: NSString(string: fromIPSW).expandingTildeInPath)
-          }
-
-          _ = try await VM(vmDir: tmpVMDir, ipswURL: ipswURL, diskSizeGB: diskSize, diskFormat: diskFormat)
-        }
-      #endif
-
-      if linux {
-        _ = try await VM.linux(vmDir: tmpVMDir, diskSizeGB: diskSize, diskFormat: diskFormat)
-      }
-
-      // Publish under the same lock that run holds while opening VM files.
-      let storageLock = try FileLock(lockURL: Config().tartHomeDir)
-      try storageLock.lock()
-      defer { withExtendedLifetime(storageLock) {} }
-      try VMStorageLocal().move(name, from: tmpVMDir)
-    }, onCancel: {
-      try? FileManager.default.removeItem(at: tmpVMDir.baseURL)
-    })
-  }
-}
@@ -1,16 +0,0 @@
-import ArgumentParser
-import Dispatch
-import SwiftUI
-
-struct Delete: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Delete a VM")
-
-  @Argument(help: "VM name", completion: .custom(completeMachines))
-  var name: [String]
-
-  func run() async throws {
-    for it in name {
-      try VMStorageHelper.delete(it)
-    }
-  }
-}
@@ -1,225 +0,0 @@
-import ArgumentParser
-import Foundation
-import GRPC
-import Cirruslabs_TartGuestAgent_Grpc_Swift
-
-struct ExecCustomExitCodeError: Error {
-  let exitCode: Int32
-}
-
-struct Exec: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Execute a command in a running VM", discussion: """
-  Requires Tart Guest Agent running in a guest VM.
-
-  Note that all non-vanilla Cirrus Labs VM images already have the Tart Guest Agent installed.
-  """)
-
-  @Flag(name: [.customShort("i")], help: "Attach host's standard input to a remote command")
-  var interactive: Bool = false
-
-  @Flag(name: [.customShort("t")], help: "Allocate a remote pseudo-terminal (PTY)")
-  var tty: Bool = false
-
-  @Argument(help: "VM name", completion: .custom(completeLocalMachines))
-  var name: String
-
-  @Argument(parsing: .captureForPassthrough, help: "Command to execute")
-  var command: [String]
-
-  func run() async throws {
-    // We only have withThrowingDiscardingTaskGroup available starting from macOS 14
-    if #unavailable(macOS 14) {
-      throw RuntimeError.Generic("\"tart exec\" is only available on macOS 14 (Sonoma) or newer")
-    }
-
-    // Open VM's directory
-    let vmDir = try VMStorageLocal().open(name)
-
-    // Ensure that the VM is running
-    if try !vmDir.running() {
-      throw RuntimeError.VMNotRunning(name)
-    }
-
-    // Change the current working directory to a VM's base directory
-    // to work around Unix domain socket 104 byte limitation [1]
-    //
-    // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
-    if let baseURL = vmDir.controlSocketURL.baseURL {
-      FileManager.default.changeCurrentDirectoryPath(baseURL.absoluteURL.path(percentEncoded: false))
-    }
-
-    // Switch controlling terminal into raw mode when remote pseudo-terminal is requested
-    var state: State? = nil
-
-    if tty && Term.IsTerminal() {
-      state = try Term.MakeRaw()
-    }
-    defer {
-      // Restore terminal to its initial state
-      if let state {
-        try! Term.Restore(state)
-      }
-    }
-
-    // Execute a command in a running VM
-    do {
-      let controlSocketPath = vmDir.controlSocketURL.relativePath
-      try await withGuestAgentChannel(unixDomainSocketPath: controlSocketPath) { channel in
-        try await execute(channel)
-      }
-    } catch let error as GRPCConnectionPoolError {
-      throw RuntimeError.Generic("Failed to connect to the VM using its control socket: \(error.localizedDescription), is the Tart Guest Agent running?")
-    }
-  }
-
-  private func execute(_ channel: GRPCChannel) async throws {
-    let agentAsyncClient = AgentAsyncClient(channel: channel)
-    let execCall = agentAsyncClient.makeExecCall()
-
-    try await execCall.requestStream.send(.with {
-      $0.type = .command(.with {
-        $0.name = command[0]
-        $0.args = Array(command.dropFirst(1))
-        $0.interactive = interactive
-        $0.tty = tty
-        if tty {
-          $0.terminalSize = .with {
-            let (width, height) = try! Term.GetSize()
-
-            $0.cols = UInt32(width)
-            $0.rows = UInt32(height)
-          }
-        }
-      })
-    })
-
-    // Process command events and optionally send our standard input and/or terminal dimensions
-    try await withThrowingTaskGroup { group in
-      // Stream host's standard input if interactive mode is enabled
-      if interactive {
-        let stdinStream = AsyncThrowingStream<Data, Error> { continuation in
-          let handle = FileHandle.standardInput
-
-          if isRegularFile(handle.fileDescriptor) {
-            // Standard input can be a regular file when input redirection (<) is used,
-            // in which case the handle won't receive any new readability events, so we
-            // just read the file normally here in chunks and consider done with it
-            //
-            // Ideally this is best handled by using non-blocking I/O, but Swift's
-            // standard library only offers inefficient bytes[1] property and SwiftNIO's
-            // NIOFileSystem doesn't seem to support opening raw file descriptors.
-            //
-            // [1]: https://developer.apple.com/documentation/foundation/filehandle/bytes
-            while true {
-              do {
-                let data = try handle.read(upToCount: 64 * 1024)
-                if let data = data {
-                  continuation.yield(data)
-                } else {
-                  continuation.finish()
-                  break
-                }
-              } catch (let error) {
-                continuation.finish(throwing: error)
-                break
-              }
-            }
-          } else {
-            handle.readabilityHandler = { handle in
-              let data = handle.availableData
-
-              if data.isEmpty {
-                // EOF: unregister the handler, otherwise the fd stays permanently
-                // "readable" and Foundation re-invokes us in a tight loop, burning
-                // 100% of a core for the rest of the command's lifetime
-                handle.readabilityHandler = nil
-
-                continuation.finish()
-              } else {
-                continuation.yield(data)
-              }
-            }
-          }
-        }
-
-        group.addTask {
-          for try await stdinData in stdinStream {
-            try await execCall.requestStream.send(.with {
-              $0.type = .standardInput(.with {
-                $0.data = stdinData
-              })
-            })
-          }
-
-          // Signal EOF as we're done reading standard input
-          try await execCall.requestStream.send(.with {
-            $0.type = .standardInput(.with {
-              $0.data = Data()
-            })
-          })
-        }
-      }
-
-      // Stream host's terminal dimensions if pseudo-terminal is requested
-      signal(SIGWINCH, SIG_IGN)
-      let sigwinchSrc = DispatchSource.makeSignalSource(signal: SIGWINCH)
-      sigwinchSrc.activate()
-
-      if tty {
-        let terminalDimensionsStream = AsyncStream { continuation in
-          sigwinchSrc.setEventHandler {
-            continuation.yield(try! Term.GetSize())
-          }
-        }
-
-        group.addTask {
-          for await (width, height) in terminalDimensionsStream {
-            try await execCall.requestStream.send(.with {
-              $0.type = .terminalResize(.with {
-                $0.cols = UInt32(width)
-                $0.rows = UInt32(height)
-              })
-            })
-          }
-        }
-      }
-
-      // Process command events
-      group.addTask {
-        for try await response in execCall.responseStream {
-          switch response.type {
-          case .standardOutput(let ioChunk):
-            try FileHandle.standardOutput.write(contentsOf: ioChunk.data)
-          case .standardError(let ioChunk):
-            try FileHandle.standardError.write(contentsOf: ioChunk.data)
-          case .exit(let exit):
-            throw ExecCustomExitCodeError(exitCode: exit.code)
-          default:
-            // Unknown event, do nothing
-            continue
-          }
-        }
-      }
-
-      while !group.isEmpty {
-        do {
-          try await group.next()
-        } catch {
-          group.cancelAll()
-
-          throw error
-        }
-      }
-    }
-  }
-}
-
-private func isRegularFile(_ fileDescriptor: Int32) -> Bool {
-  var stat = stat()
-
-  if fstat(fileDescriptor, &stat) != 0 {
-    return false
-  }
-
-  return (stat.st_mode & S_IFMT) == S_IFREG
-}
@@ -1,44 +0,0 @@
-import ArgumentParser
-import Foundation
-
-struct Export: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Export VM to a compressed .tvm file")
-
-  @Argument(help: "Source VM name.", completion: .custom(completeMachines))
-  var name: String
-
-  @Argument(help: "Path to the destination file.", completion: .file())
-  var path: String?
-
-  func run() async throws {
-    let correctedPath: String
-
-    if let path = path {
-      correctedPath = path
-    } else {
-      correctedPath = "\(name).tvm"
-
-      if FileManager.default.fileExists(atPath: correctedPath) {
-        while true {
-          if userWantsOverwrite(correctedPath) {
-            break
-          } else {
-            return
-          }
-        }
-      }
-    }
-
-    print("exporting...")
-
-    try VMStorageHelper.open(name).exportToArchive(path: correctedPath)
-  }
-
-  func userWantsOverwrite(_ filename: String) -> Bool {
-    print("file \(filename) already exists, are you sure you want to overwrite it? (yes, [no])? ", terminator: "")
-
-    let answer = readLine()
-
-    return answer == "yes"
-  }
-}
@@ -1,22 +0,0 @@
-import ArgumentParser
-import Foundation
-import SystemConfiguration
-
-struct FQN: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Get a fully-qualified VM name", shouldDisplay: false)
-
-  @Argument(help: "VM name", completion: .custom(completeMachines))
-  var name: String
-
-  func run() async throws {
-    if var remoteName = try? RemoteName(name) {
-      let digest = try VMStorageOCI().digest(remoteName)
-
-      remoteName.reference = Reference(digest: digest)
-
-      print(remoteName)
-    } else {
-      print(name)
-    }
-  }
-}
@@ -1,46 +0,0 @@
-import ArgumentParser
-import Foundation
-
-fileprivate struct VMInfo: Encodable {
-  let OS: OS
-  let CPU: Int
-  let Memory: UInt64
-  let Disk: HumanReadableByteCount
-  let DiskFormat: String
-  let Size: HumanReadableByteCount
-  let Display: String
-  let Running: Bool
-  let State: String
-}
-
-struct Get: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(commandName: "get", abstract: "Get a VM's configuration")
-
-  @Argument(help: "VM name.", completion: .custom(completeLocalMachines))
-  var name: String
-
-  @Option(help: "Output format: text or json")
-  var format: Format = .text
-
-  func run() async throws {
-    let vmDir = try VMStorageLocal().open(name)
-    let vmConfig = try VMConfig(fromURL: vmDir.configURL)
-    let memorySizeInMb = vmConfig.memorySize / 1024 / 1024
-
-    let info = VMInfo(
-      OS: vmConfig.os,
-      CPU: vmConfig.cpuCount,
-      Memory: memorySizeInMb,
-      // ASIF capacity lookup can fail while a running VM holds the disk open.
-      Disk: HumanReadableByteCount(try? vmDir.diskSizeBytes()) { $0 / 1000 / 1000 / 1000 },
-      DiskFormat: vmConfig.diskFormat.rawValue,
-      Size: HumanReadableByteCount(try vmDir.allocatedSizeBytes()) {
-        String(format: "%.3f", Float($0) / 1000 / 1000 / 1000)
-      },
-      Display: vmConfig.display.description,
-      Running: try vmDir.running(),
-      State: try vmDir.state().rawValue
-    )
-    print(format.renderSingle(info))
-  }
-}
@@ -1,90 +0,0 @@
-import ArgumentParser
-import Foundation
-import Network
-import SystemConfiguration
-
-enum IPResolutionStrategy: String, ExpressibleByArgument, CaseIterable {
-  case dhcp, arp, agent
-
-  private(set) static var allValueStrings: [String] = Self.allCases.map { "\($0)"}
-}
-
-struct IP: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Get VM's IP address")
-
-  @Argument(help: "VM name", completion: .custom(completeLocalMachines))
-  var name: String
-
-  @Option(help: "Number of seconds to wait for a potential VM booting")
-  var wait: UInt16 = 0
-
-  @Option(help: ArgumentHelp("Strategy for resolving IP address",
-                             discussion: """
-                             By default, Tart is using a "dhcp" resolver which parses the DHCP lease file on host and tries to find an entry containing the VM's MAC address. This method is fast and the most reliable, but only works for VMs are not using the bridged networking.\n
-                             Alternatively, Tart has an "arp" resolver which calls an external "arp" executable and parses it's output. This works for VMs using bridged networking and returns their IP, but when they generate enough network activity to populate the host's ARP table. Note that "arp" strategy won't work for VMs using the Softnet networking.\n
-                             A third strategy, "agent" works in all cases reliably, but requires Guest agent for Tart VMs (https://github.com/cirruslabs/tart-guest-agent) to be installed inside of a VM.
-                             """))
-  var resolver: IPResolutionStrategy = .dhcp
-
-  func run() async throws {
-    let vmDir = try VMStorageLocal().open(name)
-    let vmConfig = try VMConfig.init(fromURL: vmDir.configURL)
-    let vmMACAddress = MACAddress(fromString: vmConfig.macAddress.string)!
-
-    guard let ip = try await IP.resolveIP(vmMACAddress, resolutionStrategy: resolver, secondsToWait: wait, controlSocketURL: vmDir.controlSocketURL) else {
-      var message = "no IP address found"
-
-      if try !vmDir.running() {
-        message += ", is your VM running?"
-      }
-
-      if (resolver == .agent) {
-        message += " (also make sure that Guest agent for Tart is running inside of a VM)"
-      } else if (vmConfig.os == .linux && resolver == .arp) {
-        message += " (not all Linux distributions are compatible with the ARP resolver)"
-      }
-
-      throw RuntimeError.NoIPAddressFound(message)
-    }
-
-    print(ip)
-  }
-
-  static public func resolveIP(_ vmMACAddress: MACAddress, resolutionStrategy: IPResolutionStrategy = .dhcp, secondsToWait: UInt16 = 0, controlSocketURL: URL? = nil) async throws -> IPv4Address? {
-    let waitUntil = Calendar.current.date(byAdding: .second, value: Int(secondsToWait), to: Date.now)!
-
-    repeat {
-      switch resolutionStrategy {
-      case .arp:
-        if let ip = try ARPCache().ResolveMACAddress(macAddress: vmMACAddress) {
-          return ip
-        }
-      case .dhcp:
-        if let leases = try Leases(), let ip = leases.ResolveMACAddress(macAddress: vmMACAddress) {
-          return ip
-        }
-      case .agent:
-        guard let controlSocketURL = controlSocketURL else {
-          throw RuntimeError.Generic("Cannot perform IP resolution via Tart Guest Agent when control socket URL is not set")
-        }
-
-        // Change the current working directory to a VM's base directory
-        // to work around Unix domain socket 104 byte limitation [1]
-        //
-        // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
-        if let baseURL = controlSocketURL.baseURL {
-          FileManager.default.changeCurrentDirectoryPath(baseURL.absoluteURL.path(percentEncoded: false))
-        }
-
-        if let ip = try await AgentResolver.ResolveIP(controlSocketURL.relativePath) {
-          return ip
-        }
-      }
-
-      // wait a second
-      try await Task.sleep(nanoseconds: 1_000_000_000)
-    } while Date.now < waitUntil
-
-    return nil
-  }
-}
@@ -1,57 +0,0 @@
-import ArgumentParser
-import Foundation
-
-struct Import: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Import VM from a compressed .tvm file")
-
-  @Argument(help: "Path to a file created with \"tart export\".", completion: .file())
-  var path: String
-
-  @Argument(help: "Destination VM name.", completion: .custom(completeLocalMachines))
-  var name: String
-
-  func validate() throws {
-    if name.contains("/") {
-      throw ValidationError("<name> should be a local name")
-    }
-  }
-
-  func run() async throws {
-    let localStorage = try VMStorageLocal()
-
-    // Create a temporary VM directory to which we will load the export file
-    let tmpVMDir = try VMDirectory.temporary()
-    defer {
-      try? tmpVMDir.removeFromDisk()
-    }
-
-    // Lock the temporary VM directory to prevent it's garbage collection
-    // while we're running
-    let tmpVMDirLock = try FileLock(lockURL: tmpVMDir.baseURL)
-    try tmpVMDirLock.lock()
-
-    // Populate the temporary VM directory with the export file contents
-    print("importing...")
-    try tmpVMDir.importFromArchive(path: path)
-    guard tmpVMDir.initialized else {
-      throw RuntimeError.ImportFailed("archive does not contain a runnable VM")
-    }
-
-    try await withTaskCancellationHandler(operation: {
-      // Acquire a global lock
-      let lock = try FileLock(lockURL: Config().tartHomeDir)
-      try lock.lock()
-
-      // Re-generate the VM's MAC address importing it will result in address collision
-      if try localStorage.hasVMsWithMACAddress(macAddress: tmpVMDir.macAddress()) {
-        try tmpVMDir.regenerateMACAddress()
-      }
-
-      try localStorage.move(name, from: tmpVMDir)
-
-      try lock.unlock()
-    }, onCancel: {
-      try? tmpVMDir.removeFromDisk()
-    })
-  }
-}
@@ -1,93 +0,0 @@
-import ArgumentParser
-import Dispatch
-import SwiftUI
-
-fileprivate struct VMInfo: Encodable {
-  let Source: String
-  let Name: String
-  let Disk: HumanReadableByteCount
-  let Size: HumanReadableByteCount
-  let Accessed: String
-  let Running: Bool
-  let State: String
-}
-
-struct List: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "List created VMs")
-
-  @Option(help: ArgumentHelp("Only display VMs from the specified source (e.g. --source local, --source oci)."))
-  var source: String?
-
-  @Option(help: "Output format: text or json", completion: .list(["text", "json"]))
-  var format: Format = .text
-
-  @Flag(name: [.short, .long], help: ArgumentHelp("Only display VM names."))
-  var quiet: Bool = false
-
-  func validate() throws {
-    guard let source = source else {
-      return
-    }
-
-    if !["local", "oci"].contains(source) {
-      throw ValidationError("'\(source)' is not a valid <source>")
-    }
-  }
-
-  func run() async throws {
-    var infos: [VMInfo] = []
-
-    if source == nil || source == "local" {
-      infos += sortedInfos(try VMStorageLocal().list().map { (name, vmDir) in
-        try VMInfo(
-          Source: "local",
-          Name: name,
-          // ASIF capacity lookup can fail while a running VM holds the disk open.
-          Disk: HumanReadableByteCount(try? vmDir.diskSizeBytes()) { $0 / 1000 / 1000 / 1000 },
-          Size: HumanReadableByteCount(try vmDir.allocatedSizeBytes()) { $0 / 1000 / 1000 / 1000 },
-          Accessed: formatAccessDate(try vmDir.accessDate()),
-          Running: vmDir.running(),
-          State: vmDir.state().rawValue
-        )
-      })
-    }
-
-    if source == nil || source == "oci" {
-      infos += sortedInfos(try VMStorageOCI().list().map { (name, vmDir, _) in
-        try VMInfo(
-          Source: "OCI",
-          Name: name,
-          Disk: HumanReadableByteCount(try? vmDir.diskSizeBytes()) { $0 / 1000 / 1000 / 1000 },
-          Size: HumanReadableByteCount(try vmDir.allocatedSizeBytes()) { $0 / 1000 / 1000 / 1000 },
-          Accessed: formatAccessDate(try vmDir.accessDate()),
-          Running: vmDir.running(),
-          State: vmDir.state().rawValue
-        )
-      })
-    }
-
-    if (quiet) {
-      for info in infos {
-        print(info.Name)
-      }
-    } else {
-      print(format.renderList(infos))
-    }
-  }
-
-  private func sortedInfos(_ infos: [VMInfo]) -> [VMInfo] {
-    infos.sorted(by: { left, right in left.Name < right.Name })
-  }
-
-  private func formatAccessDate(_ accessDate: Date) -> String {
-    switch format {
-    case .text:
-      let formatter = RelativeDateTimeFormatter()
-      formatter.unitsStyle = .full
-      return formatter.localizedString(for: accessDate, relativeTo: Date())
-    case .json:
-      let formatter = ISO8601DateFormatter()
-      return formatter.string(from: accessDate)
-    }
-  }
-}
@@ -1,82 +0,0 @@
-import ArgumentParser
-import Dispatch
-import SwiftUI
-
-struct Login: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Login to a registry")
-
-  @Argument(help: "host")
-  var host: String
-
-  @Option(help: "username")
-  var username: String?
-
-  @Flag(help: "password-stdin")
-  var passwordStdin: Bool = false
-
-  @Flag(help: "connect to the OCI registry via insecure HTTP protocol")
-  var insecure: Bool = false
-
-  @Flag(help: "skip validation of the registry's credentials before logging-in")
-  var noValidate: Bool = false
-
-  func validate() throws {
-    let usernameProvided = username != nil
-    let passwordProvided = passwordStdin
-
-    if usernameProvided != passwordProvided {
-      throw ValidationError("both --username and --password-stdin are required")
-    }
-  }
-
-  func run() async throws {
-    var user: String
-    var password: String
-
-    if let username = username {
-      user = username
-
-      let passwordData = FileHandle.standardInput.readDataToEndOfFile()
-      password = String(decoding: passwordData, as: UTF8.self)
-
-      // Support "echo $PASSWORD | tart login --username $USERNAME --password-stdin $REGISTRY"
-      password.trimSuffix { c in c.isNewline }
-    } else {
-      (user, password) = try StdinCredentials.retrieve()
-    }
-    let credentialsProvider = DictionaryCredentialsProvider([
-      host: (user, password)
-    ])
-
-    if !noValidate {
-      let registry = try Registry(host: host, namespace: "", insecure: insecure,
-                                  credentialsProviders: [credentialsProvider])
-
-      do {
-        try await registry.ping()
-      } catch {
-        throw RuntimeError.InvalidCredentials("invalid credentials: \(error)")
-      }
-    }
-
-    try KeychainCredentialsProvider().store(host: host, user: user, password: password)
-  }
-}
-
-fileprivate class DictionaryCredentialsProvider: CredentialsProvider {
-  let userFriendlyName = "static dictionary credentials provider"
-
-  var credentials: Dictionary<String, (String, String)>
-
-  init(_ credentials: Dictionary<String, (String, String)>) {
-    self.credentials = credentials
-  }
-
-  func retrieve(host: String) throws -> (String, String)? {
-    credentials[host]
-  }
-
-  func store(host: String, user: String, password: String) throws {
-    credentials[host] = (user, password)
-  }
-}
@@ -1,14 +0,0 @@
-import ArgumentParser
-import Dispatch
-import SwiftUI
-
-struct Logout: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Logout from a registry")
-
-  @Argument(help: "host")
-  var host: String
-
-  func run() async throws {
-    try KeychainCredentialsProvider().remove(host: host)
-  }
-}
@@ -1,202 +0,0 @@
-import ArgumentParser
-import Dispatch
-import OpenTelemetryApi
-import SwiftUI
-import SwiftDate
-
-struct Prune: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Prune OCI and IPSW caches or local VMs")
-
-  @Option(help: ArgumentHelp("Entries to remove: \"caches\" targets OCI and IPSW caches and \"vms\" targets local VMs."), completion: .list(["caches", "vms"]))
-  var entries: String = "caches"
-
-  @Option(help: ArgumentHelp("Remove entries that were last accessed more than n days ago",
-                             discussion: "For example, --older-than=7 will remove entries that weren't accessed by Tart in the last 7 days.",
-                             valueName: "n"))
-  var olderThan: UInt?
-
-  @Option(help: .hidden)
-  var cacheBudget: UInt?
-
-  @Option(help: ArgumentHelp("Remove the least recently used entries that do not fit the specified space size budget n, expressed in gigabytes",
-                             discussion: "For example, --space-budget=50 will effectively shrink all entries to a total size of 50 gigabytes.",
-                             valueName: "n"))
-  var spaceBudget: UInt?
-
-  @Flag(help: .hidden)
-  var gc: Bool = false
-
-  mutating func validate() throws {
-    // --cache-budget deprecation logic
-    if let cacheBudget = cacheBudget {
-      fputs("--cache-budget is deprecated, please use --space-budget\n", stderr)
-
-      if spaceBudget != nil {
-        throw ValidationError("--cache-budget is deprecated, please use --space-budget")
-      }
-
-      spaceBudget = cacheBudget
-    }
-
-    if olderThan == nil && spaceBudget == nil && !gc {
-      throw ValidationError("at least one pruning criteria must be specified")
-    }
-  }
-
-  func run() async throws {
-    if gc {
-      try VMStorageOCI().gc()
-    }
-
-    // Build a list of prunable storages that we're going to prune based on user's request
-    let prunableStorages: [PrunableStorage]
-
-    switch entries {
-    case "caches":
-      prunableStorages = [try VMStorageOCI(), try IPSWCache()]
-    case "vms":
-      prunableStorages = [try VMStorageLocal()]
-    default:
-      throw ValidationError("unsupported --entries value, please specify either \"caches\" or \"vms\"")
-    }
-
-    // Clean up cache entries based on last accessed date
-    if let olderThan = olderThan {
-      let olderThanInterval = Int(exactly: olderThan)!.days.timeInterval
-      let olderThanDate = Date() - olderThanInterval
-
-      try Prune.pruneOlderThan(prunableStorages: prunableStorages, olderThanDate: olderThanDate)
-    }
-
-    // Clean up cache entries based on imposed cache size limit and entry's last accessed date
-    if let spaceBudget = spaceBudget {
-      try Prune.pruneSpaceBudget(prunableStorages: prunableStorages, spaceBudgetBytes: UInt64(spaceBudget) * 1024 * 1024 * 1024)
-    }
-  }
-
-  static func pruneOlderThan(prunableStorages: [PrunableStorage], olderThanDate: Date) throws {
-    let prunables: [Prunable] = try prunableStorages.flatMap { try $0.prunables() }
-
-    try prunables.filter { try $0.accessDate() <= olderThanDate }.forEach { try $0.delete() }
-  }
-
-  static func pruneSpaceBudget(prunableStorages: [PrunableStorage], spaceBudgetBytes: UInt64) throws {
-    while true {
-      let prunables: [Prunable] = try prunableStorages
-        .flatMap { try $0.prunables() }
-        .sorted { try $0.accessDate() > $1.accessDate() }
-
-      var remainingBudgetBytes = spaceBudgetBytes
-      var prunableToDelete: Prunable?
-
-      for prunable in prunables {
-        let prunableSizeBytes = UInt64(try prunable.allocatedSizeBytes())
-
-        if prunableSizeBytes <= remainingBudgetBytes {
-          // Don't mark for deletion as there is budget available
-          remainingBudgetBytes -= prunableSizeBytes
-        } else {
-          prunableToDelete = prunable
-          break
-        }
-      }
-
-      guard let prunableToDelete else {
-        return
-      }
-
-      // Deleting one cached stacked image can change which remaining image
-      // owns shared immutable content. Rebuild before choosing another.
-      try prunableToDelete.delete()
-    }
-  }
-
-  static func reclaimIfNeeded(_ requiredBytes: UInt64, _ initiator: Prunable? = nil) throws {
-    if ProcessInfo.processInfo.environment.keys.contains("TART_NO_AUTO_PRUNE") {
-      return
-    }
-
-    OpenTelemetry.instance.contextProvider.activeSpan?.setAttribute(
-      key: "prune.required-bytes",
-      value: .int(Int(requiredBytes))
-    )
-
-    // Figure out how much disk space is available
-    let attrs = try Config().tartCacheDir.resourceValues(forKeys: [
-      .volumeAvailableCapacityKey,
-      .volumeAvailableCapacityForImportantUsageKey
-    ])
-    let volumeAvailableCapacityCalculated = max(
-      UInt64(attrs.volumeAvailableCapacity!),
-      UInt64(attrs.volumeAvailableCapacityForImportantUsage!)
-    )
-
-    OpenTelemetry.instance.contextProvider.activeSpan?.setAttributes([
-      "prune.volume-available-capacity-bytes": .int(Int(attrs.volumeAvailableCapacity!)),
-      "prune.volume-available-capacity-for-important-usage-bytes": .int(Int(attrs.volumeAvailableCapacityForImportantUsage!)),
-      "prune.volume-available-capacity-calculated": .int(Int(volumeAvailableCapacityCalculated)),
-    ])
-
-    if volumeAvailableCapacityCalculated <= 0 {
-      OpenTelemetry.instance.contextProvider.activeSpan?.addEvent(name: "Zero volume capacity reported")
-
-      return
-    }
-
-    // Now that we know how much free space is left,
-    // check if we even need to reclaim anything
-    if requiredBytes < volumeAvailableCapacityCalculated {
-      return
-    }
-
-    try Prune.reclaimIfPossible(requiredBytes - volumeAvailableCapacityCalculated, initiator)
-  }
-
-  static func reclaimIfPossible(_ reclaimBytes: UInt64, _ initiator: Prunable? = nil) throws {
-    let span = OTel.shared.tracer.spanBuilder(spanName: "prune").startSpan()
-    defer { span.end() }
-
-    let prunableStorages: [PrunableStorage] = [try VMStorageOCI(), try IPSWCache()]
-    let prunables = {
-      try prunableStorages
-        .flatMap { try $0.prunables() }
-        .sorted { try $0.accessDate() < $1.accessDate() }
-    }
-
-    // Does it even make sense to start?
-    let initialPrunables = try prunables()
-    let initialCacheUsedBytes = try initialPrunables.map { try $0.allocatedSizeBytes() }.reduce(0, +)
-    guard let reclaimBytes = Int(exactly: reclaimBytes), initialCacheUsedBytes >= reclaimBytes else {
-      return
-    }
-
-    let targetCacheUsedBytes = initialCacheUsedBytes - reclaimBytes
-    var currentCacheUsedBytes = initialCacheUsedBytes
-    let initiatorPath = initiator.map {
-      $0.url.resolvingSymlinksInPath().standardizedFileURL.path
-    }
-
-    while currentCacheUsedBytes > targetCacheUsedBytes {
-      // Deleting one cached stacked image can transfer ownership of shared
-      // immutable content to another record without reclaiming those bytes.
-      // Rebuild the candidates after every deletion so automatic pruning
-      // measures the cache that remains rather than a stale ownership snapshot.
-      guard let prunable = try prunables().first(where: {
-        $0.url.resolvingSymlinksInPath().standardizedFileURL.path != initiatorPath
-      }) else {
-        break
-      }
-
-      let allocatedSizeBytes = try prunable.allocatedSizeBytes()
-
-      OpenTelemetry.instance.contextProvider.activeSpan?
-        .addEvent(name: "Pruned \(allocatedSizeBytes) bytes for \(prunable.url.path)")
-
-      try prunable.delete()
-      currentCacheUsedBytes = try prunables().map { try $0.allocatedSizeBytes() }.reduce(0, +)
-    }
-
-    OpenTelemetry.instance.contextProvider.activeSpan?
-      .addEvent(name: "Reclaimed \(initialCacheUsedBytes - currentCacheUsedBytes) bytes")
-  }
-}
@@ -1,51 +0,0 @@
-import ArgumentParser
-import Dispatch
-import SwiftUI
-
-struct Pull: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(
-    abstract: "Pull a VM from a registry",
-    discussion: """
-    Pulls a virtual machine from a remote OCI-compatible registry. Supports authorization via Keychain (see "tart login --help"),
-    Docker credential helpers defined in ~/.docker/config.json or via TART_REGISTRY_USERNAME/TART_REGISTRY_PASSWORD environment variables.
-
-    By default, Tart checks available capacity in Tart's home directory and tries to reclaim minimum possible storage for the remote image
-    to fit. This behaviour is called "automatic pruning" and can be disabled by setting TART_NO_AUTO_PRUNE environment variable.
-    """
-  )
-
-  @Argument(help: "remote VM name")
-  var remoteName: String
-
-  @Flag(help: "connect to the OCI registry via insecure HTTP protocol")
-  var insecure: Bool = false
-
-  @Option(help: "network concurrency to use when pulling a remote VM from the OCI-compatible registry")
-  var concurrency: UInt = 4
-
-  @Flag(help: .hidden)
-  var deduplicate: Bool = false
-
-  func validate() throws {
-    if concurrency < 1 {
-      throw ValidationError("network concurrency cannot be less than 1")
-    }
-  }
-
-  func run() async throws {
-    // Be more liberal when accepting local image as argument,
-    // see https://github.com/cirruslabs/tart/issues/36
-    if try VMStorageLocal().exists(remoteName) {
-      print("\"\(remoteName)\" is a local image, nothing to pull here!")
-
-      return
-    }
-
-    let remoteName = try RemoteName(remoteName)
-    let registry = try Registry(host: remoteName.host, namespace: remoteName.namespace, insecure: insecure)
-
-    defaultLogger.appendNewLine("pulling \(remoteName)...")
-
-    try await VMStorageOCI().pull(remoteName, registry: registry, concurrency: concurrency, deduplicate: deduplicate)
-  }
-}
@@ -1,155 +0,0 @@
-import ArgumentParser
-import Dispatch
-import Foundation
-import Compression
-
-struct Push: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Push a VM to a registry")
-
-  @Argument(help: "local or remote VM name", completion: .custom(completeMachines))
-  var localName: String
-
-  @Argument(help: "remote VM name(s)")
-  var remoteNames: [String]
-
-  @Flag(help: "connect to the OCI registry via insecure HTTP protocol")
-  var insecure: Bool = false
-
-  @Option(help: "network concurrency to use when pushing a local VM to the OCI-compatible registry")
-  var concurrency: UInt = 4
-
-  @Option(help: ArgumentHelp("chunk size in MB if registry supports chunked uploads",
-                             discussion: """
-                             By default monolithic method is used for uploading blobs to the registry but some registries support a more efficient chunked method.
-                             For example, AWS Elastic Container Registry supports only chunks larger than 5MB but GitHub Container Registry supports only chunks smaller than 4MB. Google Container Registry on the other hand doesn't support chunked uploads at all.
-                             Please refer to the documentation of your particular registry in order to see if this option is suitable for you and what's the recommended chunk size.
-                             """))
-  var chunkSize: Int = 0
-
-
-  @Option(name: [.customLong("label")], help: ArgumentHelp("additional metadata to attach to the OCI image configuration in key=value format",
-                                                           discussion: "Can be specified multiple times to attach multiple labels."))
-  var labels: [String] = []
-
-  @Flag(help: ArgumentHelp("cache pushed images locally",
-                           discussion: "Increases disk usage, but saves time if you're going to pull the pushed images later."))
-  var populateCache: Bool = false
-
-  func run() async throws {
-    let ociStorage = try VMStorageOCI()
-    let localVMDir = try VMStorageHelper.open(localName)
-    let lock = try localVMDir.lock()
-    if try !lock.trylock() {
-      throw RuntimeError.VMIsRunning(localName)
-    }
-
-    // Parse remote names supplied by the user
-    let remoteNames = try remoteNames.map{
-      try RemoteName($0)
-    }
-
-    // Group remote names by registry
-    struct RegistryIdentifier: Hashable, Equatable {
-      var host: String
-      var namespace: String
-    }
-
-    let registryGroups = Dictionary(grouping: remoteNames, by: {
-      RegistryIdentifier(host: $0.host, namespace: $0.namespace)
-    })
-
-    // Push VM
-    for (registryIdentifier, remoteNamesForRegistry) in registryGroups {
-      let registry = try Registry(host: registryIdentifier.host, namespace: registryIdentifier.namespace,
-                                  insecure: insecure)
-
-      defaultLogger.appendNewLine("pushing \(localName) to "
-        + "\(registryIdentifier.host)/\(registryIdentifier.namespace)\(remoteNamesForRegistry.referenceNames())...")
-
-      let references = remoteNamesForRegistry.map{ $0.reference.value }
-
-      let pushedRemoteName: RemoteName
-      // If we're pushing a cached remote image, check if it points to an existing registry manifest
-      // and if so, only upload manifests (without config, disk and NVRAM) to the user-specified references
-      if let remoteName = try? RemoteName(localName) {
-        pushedRemoteName = try await lightweightPushToRegistry(
-          registry: registry, 
-          remoteName: remoteName,
-          references: references
-        )
-      } else {
-        let pushedImage = try await localVMDir.pushToRegistry(
-          registry: registry,
-          references: references,
-          chunkSizeMb: chunkSize,
-          concurrency: concurrency,
-          labels: parseLabels()
-        )
-        pushedRemoteName = pushedImage.name
-
-        // Populate the local cache (if requested)
-        if populateCache {
-          try ociStorage.populate(pushedImage.name, from: localVMDir, manifest: pushedImage.manifest)
-        }
-      }
-
-      // link the rest remote names
-      if populateCache {
-        for remoteName in remoteNamesForRegistry {
-          try ociStorage.link(from: remoteName, to: pushedRemoteName)
-        }
-      }
-    }
-  }
-
-  func lightweightPushToRegistry(registry: Registry, remoteName: RemoteName, references: [String]) async throws -> RemoteName {
-    // Is the cached remote image already present in the registry?
-    let digest = try VMStorageOCI().digest(remoteName)
-
-    let (remoteManifest, _) = try await registry.pullManifest(reference: digest)
-
-    // Overwrite registry's references with the retrieved manifest
-    for reference in references {
-      defaultLogger.appendNewLine("pushing manifest for \(reference)...")
-
-      _ = try await registry.pushManifest(reference: reference, manifest: remoteManifest)
-    }
-
-    return RemoteName(host: registry.host!, namespace: registry.namespace,
-                      reference: Reference(digest: digest))
-  }
-
-  // Helper method to convert labels array to dictionary
-  func parseLabels() -> [String: String] {
-    var result = [String: String]()
-
-    for label in labels {
-      let parts = label.trimmingCharacters(in: .whitespaces).split(separator: "=", maxSplits: 1, omittingEmptySubsequences: false)
-
-      let key = parts.count > 0 ? String(parts[0]) : ""
-      let value = parts.count > 1 ? String(parts[1]) : ""
-
-      // It sometimes makes sense to provide an empty value,
-      // but not an empty key
-      if key.isEmpty {
-        continue
-      }
-
-      result[key] = value
-    }
-
-    return result
-  }  
-}
-
-extension Collection where Element == RemoteName {
-  func referenceNames() -> String {
-    let references = self.map{ $0.reference.fullyQualified }
-
-    switch count {
-    case 0: return "∅"
-    case 1: return references.first!
-    default: return "{" + references.joined(separator: ",") + "}"
-    }
-  }
-}
@@ -1,35 +0,0 @@
-import ArgumentParser
-import Foundation
-
-struct Rename: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(abstract: "Rename a local VM")
-
-  @Argument(help: "VM name", completion: .custom(completeLocalMachines))
-  var name: String
-
-  @Argument(help: "new VM name")
-  var newName: String
-
-  func validate() throws {
-    if newName.contains("/") {
-      throw ValidationError("<new-name> should be a local name")
-    }
-  }
-
-  func run() async throws {
-    let localStorage = try VMStorageLocal()
-    let lock = try FileLock(lockURL: Config().tartHomeDir)
-    try lock.lock()
-    defer { withExtendedLifetime(lock) {} }
-
-    if !localStorage.exists(name) {
-      throw ValidationError("failed to rename a non-existent local VM: \(name)")
-    }
-
-    if localStorage.exists(newName) {
-      throw ValidationError("failed to rename VM \(name), target VM \(newName) already exists, delete it first!")
-    }
-
-    try localStorage.rename(name, newName)
-  }
-}
@@ -1,120 +0,0 @@
-import ArgumentParser
-import Foundation
-import Virtualization
-
-struct Set: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(commandName: "set", abstract: "Modify VM's configuration")
-
-  @Argument(help: "VM name", completion: .custom(completeLocalMachines))
-  var name: String
-
-  @Option(help: "Number of VM CPUs")
-  var cpu: UInt16?
-
-  @Option(help: "VM memory size in megabytes")
-  var memory: UInt64?
-
-  @Option(help: "VM display resolution in a format of WIDTHxHEIGHT[pt|px]. For example, 1200x800, 1200x800pt or 1920x1080px. Units are treated as hints and default to \"pt\" (points) for macOS VMs and \"px\" (pixels) for Linux VMs when not specified.")
-  var display: VMDisplayConfig?
-
-  @Flag(inversion: .prefixedNo, help: ArgumentHelp("Whether to automatically reconfigure the VM's display to fit the window"))
-  var displayRefit: Bool? = nil
-
-  @Flag(help: ArgumentHelp("Generate a new random MAC address for the VM."))
-  var randomMAC: Bool = false
-
-  #if arch(arm64)
-    @Flag(help: ArgumentHelp("Generate a new random serial number for the macOS VM."))
-  #endif
-  var randomSerial: Bool = false
-
-  @Option(help: ArgumentHelp("Replace the VM's disk contents with the disk contents at path.", valueName: "path"))
-  var disk: String?
-
-  @Option(help: ArgumentHelp("Resize the VMs disk to the specified size in GB (note that the disk size can only be increased to avoid losing data)",
-                             discussion: """
-                             See https://tart.run/faq/#disk-resizing for more details.
-                             """))
-  var diskSize: UInt16?
-
-  func run() async throws {
-    let vmDir = try VMStorageLocal().open(name)
-
-    // Replacing disk.img would leave a stacked VM with both disk.img and
-    // overlay.asif, which is not a supported local layout. Reject before
-    // saving any other requested configuration changes.
-    if disk != nil, vmDir.isStackedVM {
-      throw ValidationError("--disk is not supported for VMs with a stacked disk")
-    }
-
-    var vmConfig = try VMConfig(fromURL: vmDir.configURL)
-
-    if let cpu = cpu {
-      try vmConfig.setCPU(cpuCount: Int(cpu))
-    }
-
-    if let memory = memory {
-      try vmConfig.setMemory(memorySize: memory * 1024 * 1024)
-    }
-
-    if let display = display {
-      if (display.width > 0) {
-        vmConfig.display.width = display.width
-      }
-      if (display.height > 0) {
-        vmConfig.display.height = display.height
-      }
-      vmConfig.display.unit = display.unit
-    }
-
-    vmConfig.displayRefit = displayRefit
-
-    if randomMAC {
-      vmConfig.macAddress = VZMACAddress.randomLocallyAdministered()
-    }
-
-    #if arch(arm64)
-      if randomSerial, let oldPlatform = vmConfig.platform as? Darwin {
-        vmConfig.platform = Darwin(ecid: VZMacMachineIdentifier(), hardwareModel: oldPlatform.hardwareModel)
-      }
-    #endif
-
-    try vmConfig.save(toURL: vmDir.configURL)
-
-    if let disk = disk {
-      let temporaryDiskURL = try Config().tartTmpDir.appendingPathComponent("set-disk-\(UUID().uuidString)")
-
-      try FileManager.default.copyItem(atPath: disk, toPath: temporaryDiskURL.path())
-
-      _ = try FileManager.default.replaceItemAt(vmDir.diskURL, withItemAt: temporaryDiskURL)
-    }
-
-    if diskSize != nil {
-      try vmDir.resizeDisk(diskSize!)
-    }
-  }
-}
-
-extension VMDisplayConfig: ExpressibleByArgument {
-  public init(argument: String) {
-    var argument = argument
-    var unit: Unit? = nil
-
-    if argument.hasSuffix(Unit.pixel.rawValue) {
-      argument = String(argument.dropLast(Unit.pixel.rawValue.count))
-      unit = Unit.pixel
-    } else if argument.hasSuffix(Unit.point.rawValue) {
-      argument = String(argument.dropLast(Unit.point.rawValue.count))
-      unit = Unit.point
-    }
-
-    let parts = argument.components(separatedBy: "x").map {
-      Int($0) ?? 0
-    }
-    self = VMDisplayConfig(
-      width: parts[safe: 0] ?? 0,
-      height: parts[safe: 1] ?? 0,
-      unit: unit,
-    )
-  }
-}
@@ -1,75 +0,0 @@
-import ArgumentParser
-import Foundation
-import System
-import SwiftDate
-
-struct Stop: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(commandName: "stop", abstract: "Stop a VM")
-
-  @Argument(help: "VM name", completion: .custom(completeRunningMachines))
-  var name: String
-
-  @Option(name: [.short, .long], help: "Seconds to wait for graceful termination before forcefully terminating the VM")
-  var timeout: UInt64 = 30
-
-  func run() async throws {
-    let vmDir = try VMStorageLocal().open(name)
-    switch try vmDir.state() {
-    case .Suspended:
-      try stopSuspended(vmDir)
-    case .Running:
-      try await stopRunning(vmDir)
-    case .Stopped:
-      throw RuntimeError.VMNotRunning(name)
-    }
-  }
-
-  func stopSuspended(_ vmDir: VMDirectory) throws {
-    try? FileManager.default.removeItem(at: vmDir.stateURL)
-  }
-
-  func stopRunning(_ vmDir: VMDirectory) async throws {
-    let lock = try vmDir.lock()
-
-    // Find the VM's PID
-    var pid = try lock.pid()
-    if pid == 0 {
-      throw RuntimeError.VMNotRunning(name)
-    }
-
-    // Try to gracefully terminate the VM
-    //
-    // Note that we don't check the return code here
-    // to provide a clean exit from "tart stop" in cases
-    // when the VM is already shutting down and we hit
-    // a race condition.
-    //
-    // We check the return code in the kill(2) below, though,
-    // because it's a less common scenario and it would be
-    // nice to know for the user that we've tried all methods
-    // and failed to shutdown the VM.
-    kill(pid, SIGINT)
-
-    // Ensure that the VM has terminated
-    var gracefulWaitDuration = Measurement(value: Double(timeout), unit: UnitDuration.seconds)
-    let gracefulTickDuration = Measurement(value: Double(100), unit: UnitDuration.milliseconds)
-
-    while gracefulWaitDuration.value > 0 {
-      pid = try lock.pid()
-      if pid == 0 {
-        return
-      }
-
-      try await Task.sleep(nanoseconds: UInt64(gracefulTickDuration.converted(to: .nanoseconds).value))
-      gracefulWaitDuration = gracefulWaitDuration - gracefulTickDuration
-    }
-
-    // Seems that VM is still running, proceed with forceful termination
-    let ret = kill(pid, SIGKILL)
-    if ret != 0 {
-      let details = Errno(rawValue: CInt(errno))
-
-      throw RuntimeError.VMTerminationFailed("failed to forcefully terminate the VM \"\(name)\": \(details)")
-    }
-  }
-}
@@ -1,28 +0,0 @@
-import ArgumentParser
-import Foundation
-import System
-import SwiftDate
-
-struct Suspend: AsyncParsableCommand {
-  static var configuration = CommandConfiguration(commandName: "suspend", abstract: "Suspend a VM")
-
-  @Argument(help: "VM name", completion: .custom(completeRunningMachines))
-  var name: String
-
-  func run() async throws {
-    let vmDir = try VMStorageLocal().open(name)
-    let lock = try vmDir.lock()
-
-    // Find the VM's PID
-    let pid = try lock.pid()
-    if pid == 0 {
-      throw RuntimeError.VMNotRunning("VM \"\(name)\" is not running")
-    }
-
-    // Tell the "tart run" process to suspend the VM
-    let ret = kill(pid, SIGUSR1)
-    if ret != 0 {
-      throw RuntimeError.SuspendFailed("failed to send SIGUSR1 signal to the \"tart run\" process running VM \"\(name)\"")
-    }
-  }
-}
@@ -1,73 +0,0 @@
-import Foundation
-
-struct Config {
-  let tartHomeDir: URL
-  let tartCacheDir: URL
-  let tartTmpDir: URL
-
-  init() throws {
-    var tartHomeDir: URL
-
-    if let customTartHome = ProcessInfo.processInfo.environment["TART_HOME"] {
-      tartHomeDir = URL(fileURLWithPath: customTartHome, isDirectory: true)
-      try Self.validateTartHome(url: tartHomeDir)
-    } else {
-      tartHomeDir = FileManager.default
-        .homeDirectoryForCurrentUser
-        .appendingPathComponent(".tart", isDirectory: true)
-    }
-    self.tartHomeDir = tartHomeDir
-
-    tartCacheDir = tartHomeDir.appendingPathComponent("cache", isDirectory: true)
-    try FileManager.default.createDirectory(at: tartCacheDir, withIntermediateDirectories: true)
-
-    tartTmpDir = tartHomeDir.appendingPathComponent("tmp", isDirectory: true)
-    try FileManager.default.createDirectory(at: tartTmpDir, withIntermediateDirectories: true)
-  }
-
-  func gc() throws {
-    for entry in try FileManager.default.contentsOfDirectory(at: tartTmpDir,
-                                                             includingPropertiesForKeys: [], options: []) {
-      let lock = try FileLock(lockURL: entry)
-      if try !lock.trylock() {
-        continue
-      }
-
-      try VMDirectory(baseURL: entry).removeFromDisk()
-
-      try lock.unlock()
-    }
-  }
-
-  static func jsonEncoder() -> JSONEncoder {
-    let encoder = JSONEncoder()
-
-    encoder.outputFormatting = [.sortedKeys]
-
-    return encoder
-  }
-
-  static func jsonDecoder() -> JSONDecoder {
-    JSONDecoder()
-  }
-
-  private static func validateTartHome(url: URL) throws {
-    let urlComponents = url.pathComponents
-
-    let descendingURLs = urlComponents.indices.map { i in
-      URL(fileURLWithPath: urlComponents[0...i].joined(separator: "/"))
-    }
-
-    for descendingURL in descendingURLs {
-      if FileManager.default.fileExists(atPath: descendingURL.path) {
-        continue
-      }
-
-      do {
-        try FileManager.default.createDirectory(at: descendingURL, withIntermediateDirectories: false)
-      } catch {
-        throw RuntimeError.Generic("TART_HOME is invalid: \(descendingURL.path) does not exist, yet we can't create it: \(error.localizedDescription)")
-      }
-    }
-  }
-}
@@ -1,192 +0,0 @@
-import Foundation
-
-enum ContentStoreError: Error, Equatable {
-  case invalidContentDigest(String)
-  case contentDigestMismatch(expected: String, actual: String)
-}
-
-/// Opaque content-addressed storage for immutable reconstructed files.
-///
-/// Stacked disks currently use it for complete base disks and published ASIF
-/// overlays reconstructed from Tart disk chunks. OCI blob digests may differ
-/// across registries, so the key is the full reconstructed-file digest.
-struct ContentStore {
-  private static let digestAlgorithm = "sha256"
-  private static let digestPrefix = "\(digestAlgorithm):"
-
-  let baseURL: URL
-  private let digestDirectoryURL: URL
-  private let pruneLockURL: URL
-
-  init() throws {
-    try self.init(baseURL: Config().tartCacheDir.appendingPathComponent("content", isDirectory: true))
-  }
-
-  init(baseURL: URL) throws {
-    self.baseURL = baseURL
-    self.digestDirectoryURL = baseURL.appendingPathComponent(Self.digestAlgorithm, isDirectory: true)
-    self.pruneLockURL = baseURL.appendingPathComponent(".gc.lock")
-    try FileManager.default.createDirectory(at: digestDirectoryURL, withIntermediateDirectories: true)
-    if !FileManager.default.fileExists(atPath: pruneLockURL.path) {
-      _ = FileManager.default.createFile(atPath: pruneLockURL.path, contents: Data())
-    }
-  }
-
-  /// Serializes reference publication with the final reference check and
-  /// deletion of immutable cache entries across Tart processes.
-  func withPruneLock<T>(_ body: () throws -> T) throws -> T {
-    let lock = try FileLock(lockURL: pruneLockURL)
-    try lock.lock()
-    defer { try? lock.unlock() }
-
-    return try body()
-  }
-
-  /// Waits for any prune already scanning references to finish. After this
-  /// returns, later prune runs can see a reference the caller already wrote.
-  func synchronizePublishedReferences() throws {
-    try withPruneLock {}
-  }
-
-  func contentURL(for contentDigest: String) throws -> URL {
-    try contentURL(for: contentDigest, under: baseURL)
-  }
-
-  /// Returns the canonical path for a digest under an arbitrary content-store
-  /// root without creating directories or lock files.
-  func contentURL(for contentDigest: String, under baseURL: URL) throws -> URL {
-    let digestHex = try validatedDigestHex(contentDigest)
-
-    return baseURL
-      .appendingPathComponent(Self.digestAlgorithm, isDirectory: true)
-      .appendingPathComponent(digestHex)
-  }
-
-  func temporaryContentURL(for contentDigest: String) throws -> URL {
-    let targetURL = try contentURL(for: contentDigest)
-
-    return targetURL.deletingLastPathComponent().appendingPathComponent(".\(UUID().uuidString).tmp")
-  }
-
-  /// Returns a stable staging path so an interrupted registry pull can resume
-  /// reconstructing this content entry on a later attempt.
-  func resumableContentURL(for contentDigest: String) throws -> URL {
-    let targetURL = try contentURL(for: contentDigest)
-
-    return targetURL.deletingLastPathComponent().appendingPathComponent(".\(targetURL.lastPathComponent).partial")
-  }
-
-  /// Returns a stable lock file for serializing reconstruction of one content
-  /// entry. The file is intentionally retained; flock state lives on the file
-  /// descriptor and disappears when the owning process exits.
-  func lockURL(for contentDigest: String) throws -> URL {
-    let targetURL = try contentURL(for: contentDigest)
-
-    let lockURL = targetURL.deletingLastPathComponent().appendingPathComponent(".\(targetURL.lastPathComponent).lock")
-    if !FileManager.default.fileExists(atPath: lockURL.path) {
-      _ = FileManager.default.createFile(atPath: lockURL.path, contents: nil)
-    }
-
-    return lockURL
-  }
-
-  /// Returns an immutable digest-addressed entry without rereading it. Files
-  /// are verified when installed and when deciding whether a pull is a cache
-  /// hit; normal clone/run/push paths trust the store like Tart's disk.img.
-  func contentURLIfPresent(for contentDigest: String) throws -> URL? {
-    let url = try contentURL(for: contentDigest)
-
-    guard FileManager.default.fileExists(atPath: url.path) else {
-      return nil
-    }
-
-    try url.updateAccessDate()
-
-    return url
-  }
-
-  /// Returns a validated cache hit. Corrupt files are treated as misses so a
-  /// later pull can safely rebuild them.
-  func existingContentURL(for contentDigest: String) throws -> URL? {
-    guard let url = try contentURLIfPresent(for: contentDigest) else {
-      return nil
-    }
-
-    guard try Digest.hash(url) == contentDigest else {
-      return nil
-    }
-
-    return url
-  }
-
-  /// Returns immutable content files that no retained cached image or local VM
-  /// references. Callers may prune these like other cache entries.
-  func prunables(excluding referencedContentDigests: Swift.Set<String>) throws -> [URL] {
-    guard let enumerator = FileManager.default.enumerator(
-      at: digestDirectoryURL,
-      includingPropertiesForKeys: [.isRegularFileKey],
-      options: [.skipsSubdirectoryDescendants]
-    ) else {
-      return []
-    }
-
-    return try enumerator.compactMap { element in
-      guard let url = element as? URL,
-            try url.resourceValues(forKeys: [.isRegularFileKey]).isRegularFile == true else {
-        return nil
-      }
-
-      let contentDigest = "\(Self.digestPrefix)\(url.lastPathComponent)"
-      guard (try? validatedDigestHex(contentDigest)) != nil,
-            !referencedContentDigests.contains(contentDigest) else {
-        return nil
-      }
-
-      return url
-    }
-  }
-
-  /// Move a fully reconstructed temporary file into the cache after verifying
-  /// its semantic identity. The caller should create the temporary file with
-  /// temporaryContentURL(for:) or resumableContentURL(for:) so rename stays on
-  /// the same filesystem.
-  func install(_ temporaryURL: URL, contentDigest: String) throws -> URL {
-    let actualDigest = try Digest.hash(temporaryURL)
-    guard actualDigest == contentDigest else {
-      throw ContentStoreError.contentDigestMismatch(expected: contentDigest, actual: actualDigest)
-    }
-
-    let targetURL = try contentURL(for: contentDigest)
-    let lock = try FileLock(lockURL: baseURL)
-    try lock.lock()
-    defer { try? lock.unlock() }
-
-    if let existingURL = try existingContentURL(for: contentDigest) {
-      try? FileManager.default.removeItem(at: temporaryURL)
-      return existingURL
-    }
-
-    if FileManager.default.fileExists(atPath: targetURL.path) {
-      _ = try FileManager.default.replaceItemAt(targetURL, withItemAt: temporaryURL)
-    } else {
-      try FileManager.default.moveItem(at: temporaryURL, to: targetURL)
-    }
-
-    return targetURL
-  }
-
-  private func validatedDigestHex(_ contentDigest: String) throws -> String {
-    guard contentDigest.hasPrefix(Self.digestPrefix) else {
-      throw ContentStoreError.invalidContentDigest(contentDigest)
-    }
-
-    let digestHex = String(contentDigest.dropFirst(Self.digestPrefix.count))
-    let isHex = digestHex.allSatisfy { $0.isHexDigit && !$0.isUppercase }
-
-    guard digestHex.count == 64, isHex else {
-      throw ContentStoreError.invalidContentDigest(contentDigest)
-    }
-
-    return digestHex
-  }
-}
@@ -1,127 +0,0 @@
-import Foundation
-import Darwin
-import System
-import Virtualization
-import Network
-import os.log
-import NIO
-import NIOPosix
-
-@available(macOS 14, *)
-class ControlSocket {
-  typealias ServerChannel = NIOAsyncChannel<NIOAsyncChannel<ByteBuffer, ByteBuffer>, Never>
-
-  let controlSocketURL: URL
-  let vmPort: UInt32
-  let eventLoopGroup: MultiThreadedEventLoopGroup
-  let serverChannel: ServerChannel
-  let logger: os.Logger = os.Logger(subsystem: "org.cirruslabs.tart.control-socket", category: "network")
-
-  init(_ controlSocketURL: URL, vmPort: UInt32 = 8080) async throws {
-    self.controlSocketURL = controlSocketURL
-    self.vmPort = vmPort
-    let eventLoopGroup = MultiThreadedEventLoopGroup(numberOfThreads: 1)
-    self.eventLoopGroup = eventLoopGroup
-
-    // Remove control socket file from previous "tart run" invocations,
-    // if any, otherwise we may get the "address already in use" error
-    try? FileManager.default.removeItem(at: controlSocketURL)
-
-    // Change the current working directory to a VM's base directory
-    // to work around Unix domain socket 104 byte limitation [1]
-    //
-    // [1]: https://blog.8-p.info/en/2020/06/11/unix-domain-socket-length/
-    if let baseURL = controlSocketURL.baseURL {
-      FileManager.default.changeCurrentDirectoryPath(baseURL.absoluteURL.path(percentEncoded: false))
-    }
-
-    do {
-      self.serverChannel = try await ServerBootstrap(group: eventLoopGroup)
-        .bind(unixDomainSocketPath: controlSocketURL.relativePath) { childChannel in
-          childChannel.eventLoop.makeCompletedFuture {
-            return try NIOAsyncChannel<ByteBuffer, ByteBuffer>(
-              wrappingChannelSynchronously: childChannel
-            )
-          }
-        }
-    } catch {
-      try? await eventLoopGroup.shutdownGracefully()
-      throw error
-    }
-  }
-
-  func run() async throws {
-    try await withThrowingDiscardingTaskGroup { group in
-      try await serverChannel.executeThenClose { serverInbound in
-        for try await clientChannel in serverInbound {
-          group.addTask {
-            try await self.handleClient(clientChannel)
-          }
-        }
-      }
-    }
-  }
-
-  func handleClient(_ clientChannel: NIOAsyncChannel<ByteBuffer, ByteBuffer>) async throws {
-    self.logger.info("received new control socket connection from a client")
-
-    try await clientChannel.executeThenClose { clientInbound, clientOutbound in
-      self.logger.info("dialing to VM on port \(self.vmPort)...")
-
-      do {
-        guard let vmConnection = try await vm?.connect(toPort: self.vmPort) else {
-          throw RuntimeError.VMSocketFailed(self.vmPort, "VM is not running")
-        }
-
-        self.logger.info("running control socket proxy")
-
-        // Duplicate the connection's file descriptor
-        //
-        // This way VZVirtioSocketConnection and NIO won't race to close the same descriptor,
-        // which may result in "tart run" crashing because of NIO's fatal assertion on EBADF.
-        let vmSocket = try duplicateAndCloseConnection(vmConnection)
-
-        let vmChannel = try await ClientBootstrap(group: eventLoopGroup).withConnectedSocket(vmSocket) { childChannel in
-          childChannel.eventLoop.makeCompletedFuture {
-            try NIOAsyncChannel<ByteBuffer, ByteBuffer>(
-              wrappingChannelSynchronously: childChannel
-            )
-          }
-        }
-
-        try await vmChannel.executeThenClose { (vmInbound, vmOutbound) in
-          try await withThrowingDiscardingTaskGroup { group in
-            // Proxy data from a client (e.g. "tart exec") to a VM
-            group.addTask {
-              for try await message in clientInbound {
-                try await vmOutbound.write(message)
-              }
-            }
-
-            // Proxy data from a VM to a client (e.g. "tart exec")
-            group.addTask {
-              for try await message in vmInbound {
-                try await clientOutbound.write(message)
-              }
-            }
-          }
-        }
-
-        self.logger.info("control socket client disconnected")
-      } catch (let error) {
-        self.logger.error("control socket connection failed: \(error)")
-      }
-    }
-  }
-
-  private func duplicateAndCloseConnection(_ connection: VZVirtioSocketConnection) throws -> CInt {
-    defer { connection.close() }
-
-    let fd = fcntl(connection.fileDescriptor, F_DUPFD_CLOEXEC, 0)
-    guard fd >= 0 else {
-      throw Errno(rawValue: errno)
-    }
-
-    return fd
-  }
-}
@@ -1,11 +0,0 @@
-import Foundation
-
-enum CredentialsProviderError: Error {
-  case Failed(message: String)
-}
-
-protocol CredentialsProvider {
-  var userFriendlyName: String { get }
-  func retrieve(host: String) throws -> (String, String)?
-  func store(host: String, user: String, password: String) throws
-}
@@ -1,120 +0,0 @@
-import Foundation
-
-class DockerConfigCredentialsProvider: CredentialsProvider {
-  let userFriendlyName = "Docker configuration credentials provider"
-
-  func retrieve(host: String) throws -> (String, String)? {
-    let dockerConfigURL = FileManager.default.homeDirectoryForCurrentUser.appendingPathComponent(".docker").appendingPathComponent("config.json")
-    if !FileManager.default.fileExists(atPath: dockerConfigURL.path) {
-      return nil
-    }
-    let config = try JSONDecoder().decode(DockerConfig.self, from: Data(contentsOf: dockerConfigURL))
-
-    if let credentialsFromAuth = config.auths?[host]?.decodeCredentials() {
-      return credentialsFromAuth
-    }
-    if let helperProgram = try config.findCredHelper(host: host) {
-      return try executeHelper(binaryName: "docker-credential-\(helperProgram)", host: host)
-    }
-
-    return nil
-  }
-
-  private func executeHelper(binaryName: String, host: String) throws -> (String, String)? {
-    guard let executableURL = resolveBinaryPath(binaryName) else {
-      throw CredentialsProviderError.Failed(message: "\(binaryName) not found in PATH")
-    }
-
-    let process = Process.init()
-    process.executableURL = executableURL
-    process.arguments = ["get"]
-
-    let outPipe = Pipe()
-    let inPipe = Pipe()
-
-    process.standardOutput = outPipe
-    process.standardError = outPipe
-    process.standardInput = inPipe
-
-    process.launch()
-
-    do {
-      try inPipe.fileHandleForWriting.write(contentsOf: "\(host)\n".data(using: .utf8)!)
-    } catch {
-      throw CredentialsProviderError.Failed(message: "Failed to write host to Docker helper!")
-    }
-    inPipe.fileHandleForWriting.closeFile()
-
-    let outputData = try outPipe.fileHandleForReading.readToEnd()
-
-    process.waitUntilExit()
-
-    if !(process.terminationReason == .exit && process.terminationStatus == 0) {
-      if let outputData = outputData {
-        print(String(decoding: outputData, as: UTF8.self))
-      }
-      throw CredentialsProviderError.Failed(message: "Docker helper failed!")
-    }
-    if outputData == nil || outputData?.count == 0 {
-      throw CredentialsProviderError.Failed(message: "Docker helper output is empty!")
-    }
-
-    let getOutput = try JSONDecoder().decode(DockerGetOutput.self, from: outputData!)
-    return (getOutput.Username, getOutput.Secret)
-  }
-
-  func store(host: String, user: String, password: String) throws {
-    throw CredentialsProviderError.Failed(message: "Docker helpers don't support storing!")
-  }
-}
-
-struct DockerConfig: Codable {
-  var auths: Dictionary<String, DockerAuthConfig>? = Dictionary()
-  var credHelpers: Dictionary<String, String>? = Dictionary()
-
-  func findCredHelper(host: String) throws -> String? {
-    // Tart supports wildcards in credHelpers
-    // Similar to what is requested from Docker: https://github.com/docker/cli/issues/2928
-
-    guard let credHelpers else {
-      return nil
-    }
-
-    for (hostPattern, helperProgram) in credHelpers {
-      if (hostPattern == host) {
-        return helperProgram
-      }
-      let compiledPattern = try? Regex(hostPattern)
-      if (try compiledPattern?.wholeMatch(in: host) != nil) {
-        return helperProgram
-      }
-    }
-    return nil
-  }
-}
-
-struct DockerAuthConfig: Codable {
-  var auth: String? = nil
-
-  func decodeCredentials() -> (String, String)? {
-    // auth is a base64("username:password")
-    guard let authBase64 = auth else {
-      return nil
-    }
-    guard let data = Data(base64Encoded: authBase64) else {
-      return nil
-    }
-    guard let components = String(data: data, encoding: .utf8)?.components(separatedBy: ":") else {
-      return nil
-    }
-    if components.count != 2 {
-      return nil
-    }
-    return (components[0], components[1])
-  }
-}
-
-struct DockerGetOutput: Codable {
-  var Username: String
-  var Secret: String
-}
@@ -1,22 +0,0 @@
-import Foundation
-
-class EnvironmentCredentialsProvider: CredentialsProvider {
-  let userFriendlyName = "environment variable credentials provider"
-
-  func retrieve(host: String) throws -> (String, String)? {
-    if let tartRegistryHostname = ProcessInfo.processInfo.environment["TART_REGISTRY_HOSTNAME"],
-       tartRegistryHostname != host {
-      return nil
-    }
-
-    let username = ProcessInfo.processInfo.environment["TART_REGISTRY_USERNAME"]
-    let password = ProcessInfo.processInfo.environment["TART_REGISTRY_PASSWORD"]
-    if let username = username, let password = password {
-      return (username, password)
-    }
-    return nil
-  }
-
-  func store(host: String, user: String, password: String) throws {
-  }
-}
@@ -1,90 +0,0 @@
-import Foundation
-
-class KeychainCredentialsProvider: CredentialsProvider {
-  let userFriendlyName = "Keychain credentials provider"
-
-  func retrieve(host: String) throws -> (String, String)? {
-    let query: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
-                                kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
-                                kSecAttrServer as String: host,
-                                kSecMatchLimit as String: kSecMatchLimitOne,
-                                kSecReturnAttributes as String: true,
-                                kSecReturnData as String: true,
-                                kSecAttrLabel as String: "Tart Credentials",
-    ]
-
-    var item: CFTypeRef?
-    let status = SecItemCopyMatching(query as CFDictionary, &item)
-
-    if status != errSecSuccess {
-      if status == errSecItemNotFound {
-        return nil
-      }
-
-      throw CredentialsProviderError.Failed(message: "Keychain returned unsuccessful status \(status)")
-    }
-
-    guard let item = item as? [String: Any],
-          let user = item[kSecAttrAccount as String] as? String,
-          let passwordData = item[kSecValueData as String] as? Data,
-          let password = String(data: passwordData, encoding: .utf8)
-    else {
-      throw CredentialsProviderError.Failed(message: "Keychain item has unexpected format")
-    }
-
-    return (user, password)
-  }
-
-  func store(host: String, user: String, password: String) throws {
-    let passwordData = password.data(using: .utf8)
-    let key: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
-                              kSecAttrProtocol as String: kSecAttrProtocolHTTPS,
-                              kSecAttrServer as String: host,
-                              kSecAttrLabel as String: "Tart Credentials",
-    ]
-    let value: [String: Any] = [kSecAttrAccount as String: user,
-                                kSecValueData as String: passwordData as Any,
-    ]
-
-    let status = SecItemCopyMatching(key as CFDictionary, nil)
-
-    switch status {
-    case errSecItemNotFound:
-      let status = SecItemAdd(key.merging(value) { (current, _) in current } as CFDictionary, nil)
-      if status != errSecSuccess {
-        throw CredentialsProviderError.Failed(message: "Keychain failed to add item: \(status.explanation())")
-      }
-    case errSecSuccess:
-      let status = SecItemUpdate(key as CFDictionary, value as CFDictionary)
-      if status != errSecSuccess {
-        throw CredentialsProviderError.Failed(message: "Keychain failed to update item: \(status.explanation())")
-      }
-    default:
-      throw CredentialsProviderError.Failed(message: "Keychain failed to find item: \(status.explanation())")
-    }
-  }
-
-  func remove(host: String) throws {
-    let query: [String: Any] = [kSecClass as String: kSecClassInternetPassword,
-                                kSecAttrServer as String: host,
-                                kSecAttrLabel as String: "Tart Credentials",
-    ]
-
-    let status = SecItemDelete(query as CFDictionary)
-
-    switch status {
-    case errSecSuccess:
-      return
-    case errSecItemNotFound:
-      return
-    default:
-      throw CredentialsProviderError.Failed(message: "Failed to remove Keychain item(s): \(status.explanation())")
-    }
-  }
-}
-
-extension OSStatus {
-  func explanation() -> CFString {
-    SecCopyErrorMessageString(self, nil) ?? "Unknown status code \(self)." as CFString
-  }
-}
@@ -1,33 +0,0 @@
-import Foundation
-
-enum StdinCredentialsError: Error {
-  case CredentialRequired(which: String)
-  case CredentialTooLong(message: String)
-}
-
-class StdinCredentials {
-  let userFriendlyName = "standard input credentials provider"
-
-  static func retrieve() throws -> (String, String) {
-    let user = try readStdinCredential(name: "username", prompt: "User: ", isSensitive: false)
-    let password = try readStdinCredential(name: "password", prompt: "Password: ", isSensitive: true)
-
-    return (user, password)
-  }
-
-  private static func readStdinCredential(name: String, prompt: String, maxCharacters: Int = 8192, isSensitive: Bool) throws -> String {
-    var buf = [CChar](repeating: 0, count: maxCharacters + 1 /* sentinel */ + 1 /* NUL */)
-    guard let rawCredential = readpassphrase(prompt, &buf, buf.count, isSensitive ? RPP_ECHO_OFF : RPP_ECHO_ON) else {
-      throw StdinCredentialsError.CredentialRequired(which: name)
-    }
-
-    let credential = String(cString: rawCredential).trimmingCharacters(in: .newlines)
-
-    if credential.count > maxCharacters {
-      throw StdinCredentialsError.CredentialTooLong(
-        message: "\(name) should contain no more than \(maxCharacters) characters")
-    }
-
-    return credential
-  }
-}
@@ -1,37 +0,0 @@
-import Foundation
-import Sysctl
-
-class DeviceInfo {
-  private static var osMemoized: String? = nil
-  private static var modelMemoized: String? = nil
-
-  static var os: String {
-    if let os = osMemoized {
-      return os
-    }
-
-    osMemoized = getOS()
-
-    return osMemoized!
-  }
-
-  static var model: String {
-    if let model = modelMemoized {
-      return model
-    }
-
-    modelMemoized = getModel()
-
-    return modelMemoized!
-  }
-
-  private static func getOS() -> String {
-    let osVersion = ProcessInfo.processInfo.operatingSystemVersion
-
-    return "macOS \(osVersion.majorVersion).\(osVersion.minorVersion).\(osVersion.patchVersion)"
-  }
-
-  private static func getModel() -> String {
-    return SystemControl().hardware.model
-  }
-}
@@ -1,43 +0,0 @@
-import Foundation
-import ArgumentParser
-
-enum DiskImageFormat: String, CaseIterable, Codable {
-  case raw = "raw"
-  case asif = "asif"
-
-  var displayName: String {
-    switch self {
-    case .raw:
-      return "RAW"
-    case .asif:
-      return "ASIF (Apple Sparse Image Format)"
-    }
-  }
-
-
-  /// Check if the format is supported on the current system
-  var isSupported: Bool {
-    switch self {
-    case .raw:
-      return true
-    case .asif:
-      if #available(macOS 26, *) {
-        return true
-      } else {
-        return false
-      }
-    }
-  }
-
-
-}
-
-extension DiskImageFormat: ExpressibleByArgument {
-  init?(argument: String) {
-    self.init(rawValue: argument.lowercased())
-  }
-
-  static var allValueStrings: [String] {
-    return allCases.map { $0.rawValue }
-  }
-}
@@ -1,304 +0,0 @@
-import Foundation
-import Virtualization
-
-#if canImport(DiskImageKit)
-  import DiskImageKit
-#endif
-
-/// The logical block layout exposed by a disk image.
-struct DiskImageBlockLayout {
-  let blockSize: UInt64
-  let blockCount: UInt64
-}
-
-enum DiskImageStackError: Error, Equatable, CustomStringConvertible {
-  case unavailable
-  case writableOverlayAlreadyExists(URL)
-  case writableOverlayMissing(URL)
-  case invalidBlockLayout(String)
-  case invalidDiskImage(URL, String)
-
-  var description: String {
-    switch self {
-    case .unavailable:
-      "stacked disks require DiskImageKit on macOS 27 or newer"
-    case .writableOverlayAlreadyExists(let url):
-      "writable overlay already exists: \(url.path)"
-    case .writableOverlayMissing(let url):
-      "writable overlay is missing: \(url.path)"
-    case .invalidBlockLayout(let reason):
-      reason
-    case .invalidDiskImage(let url, let reason):
-      "\(reason): \(url.path)"
-    }
-  }
-}
-
-struct DiskImageStack {
-  /// DiskImageKit-ready paths and block layout after Tart disk chunks have been
-  /// reconstructed into complete immutable files. The writable overlay stays
-  /// private to one VM.
-  let baseURL: URL
-  let baseFormat: DiskImageFormat
-  let immutableOverlayURLs: [URL]
-  let writableOverlayURL: URL
-  let blockSize: UInt64
-  let blockCount: UInt64
-
-  static var isSupported: Bool {
-    #if canImport(DiskImageKit)
-      if #available(macOS 27.0, *) {
-        return true
-      }
-    #endif
-
-    return false
-  }
-
-  static func requireSupport() throws {
-    guard isSupported else {
-      throw DiskImageStackError.unavailable
-    }
-  }
-
-  /// Reads a disk image's current block layout without resolving or validating a
-  /// whole stack. This is used for the VM's private writable overlay, whose
-  /// size may be newer than the pinned immutable parent manifest.
-  static func diskImageBlockLayout(at url: URL) throws -> DiskImageBlockLayout {
-    #if canImport(DiskImageKit)
-      if #available(macOS 27.0, *) {
-        let image = try DiskImage(opening: .open(url: url, mode: .readOnly))
-        return DiskImageBlockLayout(
-          blockSize: UInt64(image.blockSize.rawValue),
-          blockCount: UInt64(image.blockCount)
-        )
-      }
-    #endif
-
-    throw DiskImageStackError.unavailable
-  }
-
-  static func baseBlockLayout(
-    at url: URL,
-    expectedFormat: DiskImageFormat
-  ) throws -> DiskImageBlockLayout {
-    #if canImport(DiskImageKit)
-      if #available(macOS 27.0, *) {
-        let image = try DiskImage(opening: .open(url: url, mode: .readOnly))
-        try validateBase(image, at: url, expectedFormat: expectedFormat)
-
-        return DiskImageBlockLayout(
-          blockSize: UInt64(image.blockSize.rawValue),
-          blockCount: UInt64(image.blockCount)
-        )
-      }
-    #endif
-
-    throw DiskImageStackError.unavailable
-  }
-
-  func createWritableOverlay() throws {
-    #if canImport(DiskImageKit)
-      if #available(macOS 27.0, *) {
-        try createWritableOverlayWithDiskImageKit()
-        return
-      }
-    #endif
-
-    throw DiskImageStackError.unavailable
-  }
-
-  func copyWritableOverlay(to destinationURL: URL) throws {
-    guard !FileManager.default.fileExists(atPath: destinationURL.path) else {
-      throw DiskImageStackError.writableOverlayAlreadyExists(destinationURL)
-    }
-
-    try FileManager.default.copyItem(at: writableOverlayURL, to: destinationURL)
-  }
-
-  func makeAttachment(
-    readOnly: Bool = false,
-    cachingMode: VZDiskImageCachingMode = .automatic,
-    synchronizationMode: VZDiskImageSynchronizationMode = .full
-  ) throws -> VZStorageDeviceAttachment {
-    #if canImport(DiskImageKit)
-      if #available(macOS 27.0, *) {
-        return try attachmentWithDiskImageKit(
-          readOnly: readOnly,
-          cachingMode: cachingMode,
-          synchronizationMode: synchronizationMode
-        )
-      }
-    #endif
-
-    throw DiskImageStackError.unavailable
-  }
-
-  func growWritableOverlay(toBlockCount blockCount: UInt64) throws {
-    #if canImport(DiskImageKit)
-      if #available(macOS 27.0, *) {
-        try growWritableOverlayWithDiskImageKit(toBlockCount: blockCount)
-        return
-      }
-    #endif
-
-    throw DiskImageStackError.unavailable
-  }
-
-  #if canImport(DiskImageKit)
-    @available(macOS 27.0, *)
-    private func createWritableOverlayWithDiskImageKit() throws {
-      guard !FileManager.default.fileExists(atPath: writableOverlayURL.path) else {
-        throw DiskImageStackError.writableOverlayAlreadyExists(writableOverlayURL)
-      }
-
-      let parent = try validatedParentImage()
-      let stackedImage = try parent.appending(.asifLayer(url: writableOverlayURL, type: .overlay))
-      try validateAppendedOverlay(stackedImage, at: writableOverlayURL)
-    }
-
-    @available(macOS 27.0, *)
-    private func attachmentWithDiskImageKit(
-      readOnly: Bool,
-      cachingMode: VZDiskImageCachingMode,
-      synchronizationMode: VZDiskImageSynchronizationMode
-    ) throws -> VZDiskImageStorageDeviceAttachment {
-      guard FileManager.default.fileExists(atPath: writableOverlayURL.path) else {
-        throw DiskImageStackError.writableOverlayMissing(writableOverlayURL)
-      }
-
-      let parent = try validatedParentImage()
-      let writableOverlay = try openOverlay(
-        at: writableOverlayURL,
-        mode: readOnly ? .readOnly : .readWrite
-      )
-      let stackedImage = try append(writableOverlay, to: parent, at: writableOverlayURL)
-      try validateAppendedOverlay(stackedImage, at: writableOverlayURL)
-
-      return try VZDiskImageStorageDeviceAttachment(
-        diskImage: stackedImage,
-        cachingMode: cachingMode,
-        synchronizationMode: synchronizationMode
-      )
-    }
-
-    @available(macOS 27.0, *)
-    private func growWritableOverlayWithDiskImageKit(toBlockCount blockCount: UInt64) throws {
-      guard blockCount > 0, let desiredBlockCount = Int(exactly: blockCount) else {
-        throw DiskImageStackError.invalidBlockLayout("invalid stacked disk block count \(blockCount)")
-      }
-
-      let parent = try validatedParentImage()
-      let overlay = try openOverlay(
-        at: writableOverlayURL,
-        mode: .readWrite
-      )
-      let currentBlockCount = overlay.blockCount
-      let stackedImage = try append(overlay, to: parent, at: writableOverlayURL)
-      try validateAppendedOverlay(stackedImage, at: writableOverlayURL)
-      guard desiredBlockCount >= currentBlockCount else {
-        throw DiskImageStackError.invalidDiskImage(writableOverlayURL, "ASIF overlay block count shrinks the stacked disk")
-      }
-
-      guard let writableOverlay = stackedImage.layers.last else {
-        throw DiskImageStackError.invalidDiskImage(writableOverlayURL, "disk image must be an ASIF overlay")
-      }
-      if desiredBlockCount > currentBlockCount {
-        try writableOverlay.truncate(blockCount: desiredBlockCount)
-      }
-    }
-
-    @available(macOS 27.0, *)
-    private func validatedParentImage() throws -> DiskImage {
-      let expectedBlockSize = try diskImageBlockSize(blockSize)
-      guard blockCount > 0, let expectedBlockCount = Int(exactly: blockCount) else {
-        throw DiskImageStackError.invalidBlockLayout("invalid stacked disk block count \(blockCount)")
-      }
-
-      let baseImage = try DiskImage(opening: .open(url: baseURL, mode: .readOnly))
-      try Self.validateBase(baseImage, at: baseURL, expectedFormat: baseFormat)
-
-      var image = baseImage
-
-      for overlayURL in immutableOverlayURLs {
-        let openedOverlay = try openOverlay(
-          at: overlayURL,
-          mode: .readOnly
-        )
-        let stackedImage = try append(openedOverlay, to: image, at: overlayURL)
-        try validateAppendedOverlay(stackedImage, at: overlayURL)
-        image = stackedImage
-      }
-
-      guard image.blockSize == expectedBlockSize else {
-        throw DiskImageStackError.invalidBlockLayout("immutable disk stack does not match manifest block size")
-      }
-      guard image.blockCount == expectedBlockCount else {
-        throw DiskImageStackError.invalidBlockLayout("immutable disk stack does not match manifest block count")
-      }
-
-      return image
-    }
-
-    @available(macOS 27.0, *)
-    private static func validateBase(
-      _ image: DiskImage,
-      at url: URL,
-      expectedFormat: DiskImageFormat
-    ) throws {
-      let matchesFormat = switch expectedFormat {
-      case .raw:
-        image.format == .raw
-      case .asif:
-        image.format == .asif
-      }
-      guard matchesFormat else {
-        throw DiskImageStackError.invalidDiskImage(url, "base disk format does not match")
-      }
-      guard image.layerType == nil, image.parentUUID == nil else {
-        throw DiskImageStackError.invalidDiskImage(url, "base disk must not be an overlay")
-      }
-      if expectedFormat == .asif && image.layerUUID == nil {
-        throw DiskImageStackError.invalidDiskImage(url, "ASIF base disk is missing a UUID")
-      }
-    }
-
-    @available(macOS 27.0, *)
-    private func openOverlay(
-      at url: URL,
-      mode: OpenConfiguration.Mode
-    ) throws -> DiskImage {
-      let image = try DiskImage(opening: .open(url: url, mode: mode))
-      guard image.format == .asif else {
-        throw DiskImageStackError.invalidDiskImage(url, "overlay must use ASIF format")
-      }
-
-      return image
-    }
-
-    @available(macOS 27.0, *)
-    private func append(_ overlay: DiskImage, to parent: DiskImage, at url: URL) throws -> any StackedImage {
-      do {
-        return try parent.appending(overlay)
-      } catch is IncompatibleStackingError {
-        throw DiskImageStackError.invalidDiskImage(url, "ASIF overlay is incompatible with its parent")
-      }
-    }
-
-    @available(macOS 27.0, *)
-    private func validateAppendedOverlay(_ image: any StackedImage, at url: URL) throws {
-      guard image.layers.last?.layerType == .overlay else {
-        throw DiskImageStackError.invalidDiskImage(url, "disk image must be an ASIF overlay")
-      }
-    }
-
-    @available(macOS 27.0, *)
-    private func diskImageBlockSize(_ value: UInt64) throws -> DiskImage.BlockSize {
-      guard let intValue = Int(exactly: value), let blockSize = DiskImage.BlockSize(rawValue: intValue) else {
-        throw DiskImageStackError.invalidBlockLayout("unsupported stacked disk block size \(value)")
-      }
-
-      return blockSize
-    }
-  #endif
-}
@@ -1,108 +0,0 @@
-import Foundation
-
-struct ImageInfo: Codable {
-  let sizeInfo: SizeInfo?
-  let size: UInt64?
-
-  enum CodingKeys: String, CodingKey {
-    case sizeInfo = "Size Info"
-    case size = "Size"
-  }
-
-  func totalBytes() throws -> Int {
-    if let totalBytes = self.sizeInfo?.totalBytes {
-      return Int(totalBytes)
-    }
-
-    if let size = self.size {
-      return Int(size)
-    }
-
-    throw RuntimeError.Generic("Could not find size information in disk image info")
-  }
-}
-
-struct SizeInfo: Codable {
-  let totalBytes: UInt64?
-
-  enum CodingKeys: String, CodingKey {
-    case totalBytes = "Total Bytes"
-  }
-}
-
-struct Diskutil {
-  static func imageCreate(diskURL: URL, sizeGB: UInt16) throws {
-    do {
-      _ = try run([
-        "image", "create", "blank",
-        "--format", "ASIF",
-        "--size", "\(sizeGB)G",
-        "--volumeName", "Tart",
-        diskURL.path
-      ])
-    } catch {
-      throw RuntimeError.FailedToCreateDisk("Failed to create ASIF disk image: \(error)")
-    }
-  }
-
-  static func imageInfo(_ diskURL: URL) throws -> ImageInfo {
-    do {
-      let (stdoutData, _) = try run([
-        "image", "info", "--plist",
-        diskURL.path
-      ])
-
-      do {
-        return try PropertyListDecoder().decode(ImageInfo.self, from: stdoutData)
-      } catch {
-        throw RuntimeError.Generic("Failed to parse \"diskutil image info --plist\" output: \(error)")
-      }
-    }
-  }
-
-  private static func run(_ arguments: [String]) throws -> (Data, Data) {
-    guard let diskutilURL = resolveBinaryPath("diskutil") else {
-      throw RuntimeError.Generic("\"diskutil\" binary is not found in PATH")
-    }
-
-    let process = Process()
-    process.executableURL = diskutilURL
-    process.arguments = arguments
-
-    let stdoutPipe = Pipe()
-    process.standardOutput = stdoutPipe
-    let stderrPipe = Pipe()
-    process.standardError = stderrPipe
-
-    do {
-      try process.run()
-    } catch {
-      throw RuntimeError.Generic("\"\(arguments.joined(separator: " "))\" failed: \(error)")
-    }
-    process.waitUntilExit()
-
-    let stdoutData = stdoutPipe.fileHandleForReading.readDataToEndOfFile()
-    let stderrData = stderrPipe.fileHandleForReading.readDataToEndOfFile()
-
-    if process.terminationStatus != 0 {
-      let stdoutString = String(data: stdoutData, encoding: .utf8) ?? ""
-      let stderrString = String(data: stderrData, encoding: .utf8) ?? ""
-
-      throw RuntimeError.Generic("\"\(arguments.joined(separator: " "))\" failed with exit code \(process.terminationStatus): \(firstNonEmptyLine(stderrString, stdoutString))")
-    }
-
-    return (stdoutData, stderrData)
-  }
-
-  private static func firstNonEmptyLine(_ outputs: String...) -> String {
-    for output in outputs {
-      for line in output.split(separator: "\n", omittingEmptySubsequences: false) {
-        if !line.isEmpty {
-          return String(line)
-        }
-      }
-    }
-
-    return ""
-  }
-}
@@ -1,97 +0,0 @@
-import Foundation
-
-fileprivate var urlSession: URLSession = {
-  let config = URLSessionConfiguration.default
-
-  // Harbor expects a CSRF token to be present if the HTTP client
-  // carries a session cookie between its requests[1] and fails if
-  // it was not present[2].
-  //
-  // To fix that, we disable the automatic cookies carry in URLSession.
-  //
-  // [1]: https://github.com/goharbor/harbor/blob/a4c577f9ec4f18396207a5e686433a6ba203d4ef/src/server/middleware/csrf/csrf.go#L78
-  // [2]: https://github.com/cirruslabs/tart/issues/295
-  config.httpShouldSetCookies = false
-
-  return URLSession(configuration: config)
-}()
-
-class Fetcher {
-  static func fetch(_ request: URLRequest, viaFile: Bool = false) async throws -> (AsyncThrowingStream<Data, Error>, HTTPURLResponse) {
-    let task = urlSession.dataTask(with: request)
-
-    let delegate = Delegate()
-    task.delegate = delegate
-
-    let stream = AsyncThrowingStream<Data, Error> { continuation in
-      delegate.streamContinuation = continuation
-    }
-
-    let response = try await withCheckedThrowingContinuation { continuation in
-      delegate.responseContinuation = continuation
-      task.resume()
-    }
-
-    return (stream, response as! HTTPURLResponse)
-  }
-}
-
-fileprivate class Delegate: NSObject, URLSessionDataDelegate {
-  var responseContinuation: CheckedContinuation<URLResponse, Error>?
-  var streamContinuation: AsyncThrowingStream<Data, Error>.Continuation?
-
-  private var buffer: Data = Data()
-  private let bufferFlushSize = 16 * 1024 * 1024
-
-  func urlSession(
-    _ session: URLSession,
-    dataTask: URLSessionDataTask,
-    didReceive response: URLResponse,
-    completionHandler: @escaping (URLSession.ResponseDisposition) -> Void
-  ) {
-    // Soft-limit for the maximum buffer capacity
-    let capacity = min(response.expectedContentLength, Int64(bufferFlushSize))
-
-    // Pre-initialize buffer as we now know the capacity
-    buffer = Data(capacity: Int(capacity))
-
-    responseContinuation?.resume(returning: response)
-    responseContinuation = nil
-    completionHandler(.allow)
-  }
-
-  func urlSession(
-    _ session: URLSession,
-    dataTask: URLSessionDataTask,
-    didReceive data: Data
-  ) {
-    buffer.append(data)
-
-    if buffer.count >= bufferFlushSize {
-      streamContinuation?.yield(buffer)
-      buffer.removeAll(keepingCapacity: true)
-    }
-  }
-
-  func urlSession(
-    _ session: URLSession,
-    task: URLSessionTask,
-    didCompleteWithError error: Error?
-  ) {
-    if let error = error {
-      responseContinuation?.resume(throwing: error)
-      responseContinuation = nil
-
-      streamContinuation?.finish(throwing: error)
-      streamContinuation = nil
-    } else {
-      if !buffer.isEmpty {
-        streamContinuation?.yield(buffer)
-        buffer.removeAll(keepingCapacity: true)
-      }
-
-      streamContinuation?.finish()
-      streamContinuation = nil
-    }
-  }
-}
@@ -1,48 +0,0 @@
-import Foundation
-import System
-
-enum FileLockError: Error, Equatable {
-  case Failed(_ message: String)
-  case AlreadyLocked
-}
-
-class FileLock {
-  let url: URL
-  let fd: Int32
-
-  init(lockURL: URL) throws {
-    url = lockURL
-    fd = open(lockURL.path, 0)
-  }
-
-  deinit {
-    close(fd)
-  }
-
-  func trylock() throws -> Bool {
-    try flockWrapper(LOCK_EX | LOCK_NB)
-  }
-
-  func lock() throws {
-    _ = try flockWrapper(LOCK_EX)
-  }
-
-  func unlock() throws {
-    _ = try flockWrapper(LOCK_UN)
-  }
-
-  func flockWrapper(_ operation: Int32) throws -> Bool {
-    let ret = flock(fd, operation)
-    if ret != 0 {
-      let details = Errno(rawValue: CInt(errno))
-
-      if (operation & LOCK_NB) != 0 && details == .wouldBlock {
-        return false
-      }
-
-      throw FileLockError.Failed("failed to lock \(url): \(details)")
-    }
-
-    return true
-  }
-}
@@ -1,47 +0,0 @@
-import ArgumentParser
-import Foundation
-import TextTable
-
-enum Format: String, ExpressibleByArgument, CaseIterable {
-  case text, json
-
-  private(set) static var allValueStrings: [String] = Format.allCases.map { "\($0)"}
-
-  func renderSingle<T>(_ data: T) -> String where T: Encodable {
-    switch self {
-    case .text:
-      return renderList([data])
-    case .json:
-      let encoder = JSONEncoder()
-      encoder.outputFormatting = .prettyPrinted
-      return try! encoder.encode(data).asText()
-    }
-  }
-
-  func renderList<T>(_ data: Array<T>) -> String where T: Encodable {
-    switch self {
-    case .text:
-      if (data.count == 0) {
-        return ""
-      }
-      let table = TextTable<T> { (item: T) in
-        let mirroredObject = Mirror(reflecting: item)
-        return mirroredObject.children.enumerated()
-          .filter {(_, element) in
-            // Deprecate the "Running" field: only make it available
-            // from JSON for backwards-compatibility
-            element.label! != "Running"
-          }
-          .map { (_, element) in
-            let fieldName = element.label!
-            return Column(title: fieldName, value: element.value)
-          }
-      }
-      return table.string(for: data, style: Style.plain)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? ""
-    case .json:
-      let encoder = JSONEncoder()
-      encoder.outputFormatting = .prettyPrinted
-      return try! encoder.encode(data).asText()
-    }
-  }
-}
@@ -1,30 +0,0 @@
-import Foundation
-
-struct HumanReadableByteCount: Encodable, CustomStringConvertible {
-  private let byteCount: Int?
-  private let jsonValue: any Encodable
-
-  init<JSONValue: Encodable>(_ byteCount: Int?, encodedAs: (Int) -> JSONValue) {
-    self.byteCount = byteCount
-    self.jsonValue = byteCount.map(encodedAs)
-  }
-
-  var description: String {
-    guard let byteCount else {
-      return "-"
-    }
-
-    let formatter = MeasurementFormatter()
-    formatter.unitOptions = .naturalScale
-    formatter.unitStyle = .medium
-    formatter.numberFormatter.maximumFractionDigits = 0
-
-    return formatter.string(
-      from: Measurement(value: Double(byteCount), unit: UnitInformationStorage.bytes)
-    )
-  }
-
-  func encode(to encoder: Encoder) throws {
-    try jsonValue.encode(to: encoder)
-  }
-}
@@ -1,28 +0,0 @@
-import GRPC
-import NIOPosix
-
-/// Connects to a guest agent's gRPC endpoint over a VM's control socket, runs
-/// `body` with the resulting channel, and closes the channel afterwards on both
-/// the success and error paths.
-///
-/// The connection uses the process-wide singleton event loop group, which must
-/// not be shut down, so there is no group lifecycle to manage here.
-func withGuestAgentChannel<T>(
-  unixDomainSocketPath socketPath: String,
-  _ body: (GRPCChannel) async throws -> T
-) async throws -> T {
-  let channel = try GRPCChannelPool.with(
-    target: .unixDomainSocket(socketPath),
-    transportSecurity: .plaintext,
-    eventLoopGroup: .singletonMultiThreadedEventLoopGroup,
-  )
-
-  do {
-    let result = try await body(channel)
-    try await channel.close().get()
-    return result
-  } catch {
-    try? await channel.close().get()
-    throw error
-  }
-}
@@ -1,20 +0,0 @@
-import Foundation
-import Virtualization
-
-class IPSWCache: PrunableStorage {
-  let baseURL: URL
-
-  init() throws {
-    baseURL = try Config().tartCacheDir.appendingPathComponent("IPSWs", isDirectory: true)
-    try FileManager.default.createDirectory(at: baseURL, withIntermediateDirectories: true)
-  }
-
-  func locationFor(fileName: String) -> URL {
-    baseURL.appendingPathComponent(fileName, isDirectory: false)
-  }
-
-  func prunables() throws -> [Prunable] {
-    try FileManager.default.contentsOfDirectory(at: baseURL, includingPropertiesForKeys: nil)
-      .filter { $0.lastPathComponent.hasSuffix(".ipsw")}
-  }
-}
@@ -1,57 +0,0 @@
-import Foundation
-
-struct LocalLayerCache {
-  struct DigestInfo {
-    let range: Range<Data.Index>
-    let compressedDigest: String
-    let uncompressedContentDigest: String?
-  }
-
-  let name: String
-  let deduplicatedBytes: UInt64
-  let diskURL: URL
-
-  private let mappedDisk: Data
-  private var digestToRange: [String: DigestInfo] = [:]
-  private var offsetToRange: [UInt64: DigestInfo] = [:]
-
-  init?(_ name: String, _ deduplicatedBytes: UInt64, _ diskURL: URL, _ manifest: OCIManifest) throws {
-    self.name = name
-    self.deduplicatedBytes = deduplicatedBytes
-    self.diskURL = diskURL
-
-    // mmap(2) the disk that contains the layers from the manifest
-    self.mappedDisk = try Data(contentsOf: diskURL, options: [.alwaysMapped])
-
-    // Record the ranges of the disk layers listed in the manifest
-    var offset: UInt64 = 0
-
-    for layer in manifest.layers.filter({ $0.mediaType == diskV2MediaType }) {
-      guard let uncompressedSize = layer.uncompressedSize() else {
-        return nil
-      }
-
-      let info = DigestInfo(
-        range: Int(offset)..<Int(offset + uncompressedSize),
-        compressedDigest: layer.digest,
-        uncompressedContentDigest: layer.uncompressedContentDigest()!
-      )
-      self.digestToRange[layer.digest] = info
-      self.offsetToRange[offset] = info
-
-      offset += uncompressedSize
-    }
-  }
-
-  func findInfo(digest: String, offsetHint: UInt64) -> DigestInfo? {
-    // Layers can have the same digests, for example, empty ones. Let's use the offset hint to make a better guess.
-    if let info = self.offsetToRange[offsetHint], info.compressedDigest == digest {
-      return info
-    }
-    return self.digestToRange[digest]
-  }
-
-  func subdata(_ range: Range<Data.Index>) -> Data {
-    return self.mappedDisk.subdata(in: range)
-  }
-}
@@ -1,46 +0,0 @@
-import Foundation
-
-public protocol Logger {
-  func appendNewLine(_ line: String) -> Void
-  func updateLastLine(_ line: String) -> Void
-}
-
-var defaultLogger: Logger = {
-  if ProcessInfo.processInfo.environment["CI"] != nil {
-    return SimpleConsoleLogger()
-  } else {
-    return InteractiveConsoleLogger()
-  }
-}()
-
-public class InteractiveConsoleLogger: Logger {
-  private let eraseCursorDown = "\u{001B}[J" // clear entire line
-  private let moveUp = "\u{001B}[1A" // move one line up
-  private let moveBeginningOfLine = "\r" // 
-
-  public init() {
-
-  }
-
-  public func appendNewLine(_ line: String) {
-    print(line, terminator: "\n")
-  }
-
-  public func updateLastLine(_ line: String) {
-    print(moveUp, moveBeginningOfLine, eraseCursorDown, line, separator: "", terminator: "\n")
-  }
-}
-
-public class SimpleConsoleLogger: Logger {
-  public init() {
-
-  }
-
-  public func appendNewLine(_ line: String) {
-    print(line, terminator: "\n")
-  }
-
-  public func updateLastLine(_ line: String) {
-    print(line, terminator: "\n")
-  }
-}
@@ -1,36 +0,0 @@
-import Foundation
-
-public class ProgressObserver: NSObject {
-  @objc var progressToObserve: Progress
-  var observation: NSKeyValueObservation?
-  var lastTimeUpdated = Date.now
-  private var lastRenderedLine: String?
-
-  public init(_ progress: Progress) {
-    progressToObserve = progress
-  }
-
-  func log(_ renderer: Logger) {
-    let initialLine = ProgressObserver.lineToRender(progressToObserve)
-    renderer.appendNewLine(initialLine)
-    lastRenderedLine = initialLine
-    observation = observe(\.progressToObserve.fractionCompleted) { progress, _ in
-      let currentTime = Date.now
-      if self.progressToObserve.isFinished || currentTime.timeIntervalSince(self.lastTimeUpdated) >= 1.0 {
-        self.lastTimeUpdated = currentTime
-        let line = ProgressObserver.lineToRender(self.progressToObserve)
-        // Skip identical renders so non-interactive logs only see new percent values.
-        if line == self.lastRenderedLine {
-          return
-        }
-
-        self.lastRenderedLine = line
-        renderer.updateLastLine(line)
-      }
-    }
-  }
-
-  private static func lineToRender(_ progress: Progress) -> String {
-    String(Int(100 * progress.fractionCompleted)) + "%"
-  }
-}
@@ -1,17 +0,0 @@
-import Foundation
-
-public class URLSessionLogger: NSObject, URLSessionTaskDelegate {
-  let renderer: Logger
-
-  public init(_ renderer: Logger) {
-    self.renderer = renderer
-  }
-
-  public func urlSession(_ session: URLSession, task: URLSessionTask, didSendBodyData bytesSent: Int64, totalBytesSent: Int64, totalBytesExpectedToSend: Int64) {
-    renderer.updateLastLine(URLSessionLogger.lineToRender(task.progress))
-  }
-
-  private static func lineToRender(_ progress: Progress) -> String {
-    String(100 * progress.completedUnitCount / progress.totalUnitCount) + "%"
-  }
-}
@@ -1,122 +0,0 @@
-import Foundation
-import Network
-import Virtualization
-
-struct ARPCommandFailedError: Error, CustomStringConvertible {
-  var terminationReason: Process.TerminationReason
-  var terminationStatus: Int32
-
-  var description: String {
-    var reason: String
-
-    switch terminationReason {
-    case .exit:
-      reason = "exit code \(terminationStatus)"
-    case .uncaughtSignal:
-      reason = "uncaught signal"
-    default:
-      reason = "unknown reason"
-    }
-
-    return "arp command failed: \(reason)"
-  }
-}
-
-struct ARPCommandYieldedInvalidOutputError: Error, CustomStringConvertible {
-  var explanation: String
-
-  var description: String {
-    "arp command yielded invalid output: \(explanation)"
-  }
-}
-
-struct ARPCacheInternalError: Error, CustomStringConvertible {
-  var explanation: String
-
-  var description: String {
-    "ARPCache internal error: \(explanation)"
-  }
-}
-
-struct ARPCache {
-  let arpCommandOutput: Data
-
-  init() throws {
-    let process = Process.init()
-    process.executableURL = URL.init(fileURLWithPath: "/usr/sbin/arp")
-    process.arguments = ["-an"]
-
-    let pipe = Pipe()
-    process.standardOutput = pipe
-    process.standardError = pipe
-    process.standardInput = FileHandle.nullDevice
-
-    try process.run()
-
-    guard let arpCommandOutput = try pipe.fileHandleForReading.readToEnd() else {
-      throw ARPCommandYieldedInvalidOutputError(explanation: "empty output")
-    }
-
-    process.waitUntilExit()
-
-    if !(process.terminationReason == .exit && process.terminationStatus == 0) {
-      throw ARPCommandFailedError(
-        terminationReason: process.terminationReason,
-        terminationStatus: process.terminationStatus)
-    }
-
-    self.arpCommandOutput = arpCommandOutput
-  }
-
-  func ResolveMACAddress(macAddress: MACAddress) throws -> IPv4Address? {
-    let lines = String(decoding: arpCommandOutput, as: UTF8.self)
-      .trimmingCharacters(in: .whitespacesAndNewlines)
-      .components(separatedBy: "\n")
-
-    // Based on https://opensource.apple.com/source/network_cmds/network_cmds-606.40.2/arp.tproj/arp.c.auto.html
-    let regex = try NSRegularExpression(pattern: #"^.* \((?<ip>.*)\) at (?<mac>.*) on (?<interface>.*) .*$"#)
-
-    for line in lines {
-      let nsLineRange = NSRange(line.startIndex..<line.endIndex, in: line)
-
-      guard let match = regex.firstMatch(in: line, range: nsLineRange) else {
-        throw ARPCommandYieldedInvalidOutputError(explanation: "unparseable entry \"\(line)\"")
-      }
-
-      let rawIP = try match.getCaptureGroup(name: "ip", for: line)
-      guard let ip = IPv4Address(rawIP) else {
-        throw ARPCommandYieldedInvalidOutputError(explanation: "failed to parse IPv4 address \(rawIP)")
-      }
-
-      let rawMAC = try match.getCaptureGroup(name: "mac", for: line)
-      if rawMAC == "(incomplete)" {
-        continue
-      }
-      guard let mac = MACAddress(fromString: rawMAC) else {
-        throw ARPCommandYieldedInvalidOutputError(explanation: "failed to parse MAC address \(rawMAC)")
-      }
-
-      if macAddress == mac {
-        return ip
-      }
-    }
-
-    return nil
-  }
-}
-
-extension NSTextCheckingResult {
-  func getCaptureGroup(name: String, for string: String) throws -> String {
-    let nsRange = self.range(withName: name)
-
-    if nsRange.location == NSNotFound {
-      throw ARPCacheInternalError(explanation: "attempted to retrieve non-existent named capture group \(name)")
-    }
-
-    guard let range = Range.init(nsRange, in: string) else {
-      throw ARPCacheInternalError(explanation: "failed to convert NSRange to Range")
-    }
-
-    return String(string[range])
-  }
-}
@@ -1,28 +0,0 @@
-import Foundation
-import Network
-import GRPC
-import Cirruslabs_TartGuestAgent_Apple_Swift
-import Cirruslabs_TartGuestAgent_Grpc_Swift
-
-class AgentResolver {
-  static func ResolveIP(_ controlSocketPath: String) async throws -> IPv4Address? {
-    do {
-      return try await resolveIP(controlSocketPath)
-    } catch is GRPCConnectionPoolError {
-      return nil
-    }
-  }
-
-  private static func resolveIP(_ controlSocketPath: String) async throws -> IPv4Address? {
-    try await withGuestAgentChannel(unixDomainSocketPath: controlSocketPath) { channel in
-      // Invoke ResolveIP() gRPC method
-      let callOptions = CallOptions(timeLimit: .timeout(.seconds(1)))
-      let agentAsyncClient = AgentAsyncClient(channel: channel)
-      let resolveIPCall = agentAsyncClient.makeResolveIpCall(ResolveIPRequest(), callOptions: callOptions)
-
-      let response = try await resolveIPCall.response
-
-      return IPv4Address(response.ip)
-    }
-  }
-}
@@ -1,42 +0,0 @@
-import Foundation
-import Network
-import SwiftRadix
-
-struct Lease {
-  var mac: MACAddress
-  var ip: IPv4Address
-  var expiresAt: Date
-
-  init?(fromRawLease: [String : String]) {
-    // Retrieve the required fields
-    guard let hwAddress = fromRawLease["hw_address"] else { return nil }
-    guard let ipAddress = fromRawLease["ip_address"] else { return nil }
-    guard let lease = fromRawLease["lease"] else { return nil }
-
-    // Parse MAC address
-    let hwAddressSplits = hwAddress.split(separator: ",")
-    if hwAddressSplits.count != 2 {
-      return nil
-    }
-    if let hwAddressProto = Int(hwAddressSplits[0]), hwAddressProto != ARPHRD_ETHER {
-      return nil
-    }
-    guard let mac = MACAddress(fromString: String(hwAddressSplits[1])) else {
-      return nil
-    }
-
-    // Parse IP address
-    guard let ip = IPv4Address(ipAddress) else {
-      return nil
-    }
-
-    // Parse expiration timestamp
-    guard let leaseTimestamp = lease.hex?.value else {
-      return nil
-    }
-
-    self.ip = ip
-    self.mac = mac
-    self.expiresAt = Date(timeIntervalSince1970: TimeInterval(leaseTimestamp))
-  }
-}
@@ -1,118 +0,0 @@
-import Foundation
-import Network
-
-enum LeasesError: Error {
-  case UnexpectedFormat(name: String = "unexpected DHCPD leases file format", message: String, line: Int)
-  case Truncated(name: String = "truncated DHCPD leases file")
-
-  var description: String {
-    switch self {
-
-    case .UnexpectedFormat(name: let name, message: let message, line: let line):
-      return "\(name) on line \(line): \(message)"
-    case .Truncated(name: let name):
-      return "\(name)"
-    }
-  }
-}
-
-class Leases {
-  private let leases: [MACAddress : Lease]
-
-  convenience init?() throws {
-    try self.init(URL(fileURLWithPath: "/var/db/dhcpd_leases"))
-  }
-
-  convenience init?(_ fromURL: URL) throws {
-    do {
-      let urlContents = try String(contentsOf: fromURL, encoding: .utf8)
-      try self.init(urlContents)
-    } catch {
-      if error.isFileNotFound() {
-        return nil
-      }
-
-      throw error
-    }
-  }
-
-  init(_ fromString: String) throws {
-    let leases = try Self.retrieveRawLeases(fromString).compactMap({ rawLease in
-      Lease(fromRawLease: rawLease)
-    }).filter({ lease in
-      lease.expiresAt.isInFuture
-    }).map({ lease in
-      (lease.mac, lease)
-    })
-
-    self.leases = Dictionary(leases) { (left, right) in
-      // When duplicate lease is found, prefer a newer lease over the older one
-      (left.expiresAt > right.expiresAt) ? left : right
-    }
-  }
-
-  /// Parse leases from the host cache similarly to the PLCache_read() function found in Apple's Open Source releases.
-  ///
-  /// [1]: https://github.com/apple-opensource/bootp/blob/master/bootplib/NICache.c#L285-L391
-  private static func retrieveRawLeases(_ dhcpdLeasesContents: String) throws -> [[String : String]] {
-    var rawLeases: [[String : String]] = Array()
-
-    enum State {
-      case Nowhere
-      case Start
-      case Body
-      case End
-    }
-    var state = State.Nowhere
-
-    var currentRawLease: [String : String] = Dictionary()
-
-    for (lineNumber, line) in dhcpdLeasesContents.split(separator: "\n").enumerated().map({ ($0 + 1, $1) }) {
-      if line == "{" {
-        // Handle lease block start
-        if state != .Nowhere && state != .End {
-          throw LeasesError.UnexpectedFormat(message: "unexpected lease block start ({)", line: lineNumber)
-        }
-
-        state = .Start
-      } else if line == "}" {
-        // Handle lease block end
-        if state != .Body {
-          throw LeasesError.UnexpectedFormat(message: "unexpected lease block end (})", line: lineNumber)
-        }
-
-        rawLeases.append(currentRawLease)
-        currentRawLease = Dictionary()
-
-        state = .End
-      } else {
-        // Handle lease block contents
-        let lineWithoutTabs = String(line.drop { $0 == " " || $0 == "\t"})
-
-        if lineWithoutTabs.isEmpty {
-          continue
-        }
-
-        let splits = lineWithoutTabs.split(separator: "=", maxSplits: 1)
-        if splits.count != 2 {
-          throw LeasesError.UnexpectedFormat(message: "key-value pair with only a key", line: lineNumber)
-        }
-        let (key, value) = (String(splits[0]), String(splits[1]))
-
-        currentRawLease[key] = value
-
-        state = .Body
-      }
-    }
-
-    if state == .Start || state == .Body {
-      throw LeasesError.Truncated()
-    }
-
-    return rawLeases
-  }
-
-  func ResolveMACAddress(macAddress: MACAddress) -> IPv4Address? {
-    leases[macAddress]?.ip
-  }
-}
@@ -1,21 +0,0 @@
-import Foundation
-
-struct MACAddress: Equatable, Hashable, CustomStringConvertible {
-  var mac: [UInt8] = Array(repeating: 0, count: 6)
-
-  init?(fromString: String) {
-    let components = fromString.components(separatedBy: ":")
-
-    if components.count != 6 {
-      return nil
-    }
-
-    for (index, component) in components.enumerated() {
-      mac[index] = UInt8(component, radix: 16)!
-    }
-  }
-
-  var description: String {
-    String(format: "%02x:%02x:%02x:%02x:%02x:%02x", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5])
-  }
-}
@@ -1,8 +0,0 @@
-import Virtualization
-import Semaphore
-
-protocol Network {
-  func attachments() -> [VZNetworkDeviceAttachment]
-  func run(_ sema: AsyncSemaphore) throws
-  func stop() async throws
-}
@@ -1,23 +0,0 @@
-import Foundation
-import Semaphore
-import Virtualization
-
-class NetworkBridged: Network {
-  let interfaces: [VZBridgedNetworkInterface]
-
-  init(interfaces: [VZBridgedNetworkInterface]) {
-    self.interfaces = interfaces
-  }
-
-  func attachments() -> [VZNetworkDeviceAttachment] {
-    interfaces.map { VZBridgedNetworkDeviceAttachment(interface: $0) }
-  }
-
-  func run(_ sema: AsyncSemaphore) throws {
-    // no-op, only used for Softnet
-  }
-
-  func stop() async throws {
-    // no-op, only used for Softnet
-  }
-}
--- a/Show More
+++ b/Show More