@impz/testing 6.4.1 → 6.5.0

package/dist/index.js

@@ -21961,18 +21961,19 @@ function parseKsmConfig(parsed) {
 }
 
 // packages/daemon/src/create-impd.ts
-import { readFileSync as readFileSync36 } from "fs";
+import { readFileSync as readFileSync37 } from "fs";
 import { release as release2 } from "os";
-import { join as join47 } from "path";
+import { join as join48 } from "path";
 // packages/daemon/package.json
 var package_default = {
   name: "@impz/daemon",
-  version: "6.4.1",
+  version: "6.5.0",
   private: true,
   description: "impd: the imp host daemon",
   type: "module",
   exports: {
     ".": "./src/index.ts",
+    "./read-text": "./src/platform/process/read-text.ts",
     "./real-clock": "./src/platform/process/real-clock.ts",
     "./testing": "./testing/index.ts",
     "./testing/build-stub-clock": "./testing/platform/build-stub-clock.ts",
@@ -22487,9 +22488,9 @@ async function updateImpCommitted(db, id, committedAt, isWarm = false) {
   db.writes.publish({ kind: "changed", imp, reason: "updated" });
   return imp;
 }
-async function claimTrustPending(db, id) {
-  const taken = await db.updateTable("imps").set({ trust_pending: 0 }).where("id", "=", id).where("trust_pending", "=", 1).returning("id").executeTakeFirst();
-  return taken !== undefined;
+async function removeTrustPending(db, id) {
+  const row = await db.updateTable("imps").set({ trust_pending: 0 }).where("id", "=", id).returningAll().executeTakeFirstOrThrow();
+  return toImpRecord(row);
 }
 async function updateImpMove(db, id, moveState) {
   const row = await db.transaction().execute(async (trx) => {
@@ -41112,7 +41113,8 @@ function createImpContext(deps) {
   const records = {
     config: deps.config,
     db: deps.db,
-    identity: deps.identity
+    identity: deps.identity,
+    readHostLoad: deps.readHostLoad
   };
   const clock = {
     now,
@@ -42658,14 +42660,17 @@ function makeWakeImpVm(deps) {
   };
   const applyPendingTrust = async (imp, paths) => {
     try {
-      if (!await claimTrustPending(context.db, imp.id)) {
+      const env = await context.readExecEnv(imp, paths.vsockSocket);
+      if (env.kind === "untrusted") {
+        logTrustFailure(imp, env.detail);
         return imp;
       }
-      await context.readExecEnv(imp, paths.vsockSocket);
+      const trusted = await removeTrustPending(context.db, imp.id);
+      return toLockedImp(imp, trusted);
     } catch (error) {
-      getImpdLogger("imps").with({ imp: imp.name }).warning("broker CA after the wake: {error}", { error: getErrorMessage(error) });
+      logTrustFailure(imp, getErrorMessage(error));
+      return imp;
     }
-    return toLockedImp(imp, { ...imp, isTrustPending: false });
   };
   const canBootOnPool = (imp) => pickHugePages(context.config.hugePages !== null, imp) === "2M";
   const writeHostPagesIdentity = (imp, paths) => {
@@ -42727,6 +42732,9 @@ ${failure.message}`, { cause: failure }) : failure;
   };
   return wakeImpVm;
 }
+function logTrustFailure(imp, error) {
+  getImpdLogger("imps").with({ imp: imp.name }).warning("broker CA after the wake: {error}", { error });
+}
 
 // packages/daemon/src/imps/imps/start-cold-vm.ts
 import { randomBytes as randomBytes9 } from "crypto";
@@ -43491,6 +43499,22 @@ ${readLogTail(plan.paths.logFile, 5)}`, step.fault, error);
   }
 }
 
+// packages/daemon/src/imps/imps/format-host-stall.ts
+var STALL_FIGURES = [
+  ["cpu", "cpuStallUs"],
+  ["io", "ioStallUs"],
+  ["memory", "memoryStallUs"],
+  ["steal", "stealUs"]
+];
+function formatHostStall(before, after) {
+  const figures = STALL_FIGURES.flatMap(([name, field]) => {
+    const startUs = before[field];
+    const endUs = after[field];
+    return startUs === null || endUs === null ? [] : [`${name}=${String(Math.round((endUs - startUs) / 1000))}ms`];
+  });
+  return figures.length === 0 ? "" : `; host stall ${figures.join(" ")}`;
+}
+
 // packages/daemon/src/imps/imps/start-cold-vm.ts
 var CLAIM_SEED_BYTES = 64;
 async function startColdVm(context, start) {
@@ -43546,11 +43570,12 @@ async function startColdVm(context, start) {
         }
       });
       context.templates?.reportRestored(template);
-      getImpdLogger("imps").with({ imp: imp.name }).info("restored boot template {key} as pid {pid} {timings}{guestSteps}", {
+      getImpdLogger("imps").with({ imp: imp.name }).info("restored boot template {key} as pid {pid} {timings}{guestSteps}{hostStall}", {
         key: template.key.slice(0, 12),
         pid: String(vm.pid),
         timings: formatTimings({ ...hostSteps, ...vm.timings }),
-        guestSteps: formatGuestSteps(vm.guestSteps)
+        guestSteps: formatGuestSteps(vm.guestSteps),
+        hostStall: formatHostStall(start.loadBefore, context.readHostLoad())
       });
       return vm;
     } catch (error) {
@@ -43583,10 +43608,11 @@ async function startColdVm(context, start) {
     isIdentityReset: imp.isIdentityResetPending,
     jail: context.findJailUser(imp)
   });
-  getImpdLogger("imps").with({ imp: imp.name }).info("booted pid {pid} {timings}{guestSteps}", {
+  getImpdLogger("imps").with({ imp: imp.name }).info("booted pid {pid} {timings}{guestSteps}{hostStall}", {
     pid: String(vm.pid),
     timings: formatTimings({ ...hostSteps, ...vm.timings }),
-    guestSteps: formatGuestSteps(vm.guestSteps)
+    guestSteps: formatGuestSteps(vm.guestSteps),
+    hostStall: formatHostStall(start.loadBefore, context.readHostLoad())
   });
   return vm;
 }
@@ -43667,6 +43693,7 @@ function createImpVmOps(host) {
       hugePagesMib: hugePages === "2M" ? imp.memoryMib : 0
     });
     const setupStarted = performance.now();
+    const loadBefore = context.readHostLoad();
     try {
       removeSnapshot(paths);
       await context.egress.requireImp(imp.id);
@@ -43684,6 +43711,7 @@ function createImpVmOps(host) {
         cgroup,
         hugePages,
         hostSteps,
+        loadBefore,
         diskReady
       });
       startCounting(context, imp, vm.pid);
@@ -44388,6 +44416,56 @@ function createImpService(deps, createWatchdog) {
   };
 }
 
+// packages/daemon/src/platform/process/read-host-load.ts
+import { join as join22 } from "path";
+
+// packages/daemon/src/platform/process/find-unexpected-read-code.ts
+var UNSUPPORTED_CODES = new Set(["ENOENT", "EOPNOTSUPP"]);
+function findUnexpectedReadCode(error) {
+  const code = error instanceof Error && "code" in error ? String(error.code) : "unknown";
+  return UNSUPPORTED_CODES.has(code) ? null : code;
+}
+
+// packages/daemon/src/platform/process/read-host-load.ts
+function readHostLoad(sources) {
+  const readProc = (...names) => readProcFile(sources, join22(sources.procRoot, ...names));
+  return {
+    cpuStallUs: parsePressureTotal(readProc("pressure", "cpu")),
+    ioStallUs: parsePressureTotal(readProc("pressure", "io")),
+    memoryStallUs: parsePressureTotal(readProc("pressure", "memory")),
+    stealUs: parseStealUs(readProc("stat"))
+  };
+}
+function readProcFile(sources, path) {
+  try {
+    return sources.readFile(path);
+  } catch (error) {
+    const code = findUnexpectedReadCode(error);
+    if (code !== null) {
+      sources.logger.warning("cannot read {path} for the host stall: {code}", { path, code });
+    }
+    return null;
+  }
+}
+function parsePressureTotal(pressure) {
+  const total = pressure === null ? undefined : /^some .*total=(?<us>\d+)$/mv.exec(pressure);
+  return total?.groups?.["us"] === undefined ? null : Number(total.groups["us"]);
+}
+var STEAL_FIELD = 8;
+var US_PER_TICK = 1e4;
+function parseStealUs(stat) {
+  const fields = stat?.split(`
+`).find((line) => line.startsWith("cpu "))?.split(/\s+/v);
+  const steal = fields?.[STEAL_FIELD];
+  return steal === undefined ? null : Number(steal) * US_PER_TICK;
+}
+
+// packages/daemon/src/platform/process/read-text.ts
+import { readFileSync as readFileSync22 } from "fs";
+function readText(path) {
+  return readFileSync22(path, "utf8");
+}
+
 // packages/daemon/src/platform/telemetry/imp-telemetry.ts
 import { ROOT_CONTEXT, metrics as metrics2, trace } from "@opentelemetry/api";
 var SPAN_NAMES = {
@@ -44764,12 +44842,12 @@ function createMemoryController(deps) {
 import {
   existsSync as existsSync14,
   mkdirSync as mkdirSync16,
-  readFileSync as readFileSync22,
+  readFileSync as readFileSync23,
   readdirSync as readdirSync8,
   rmdirSync as rmdirSync2,
   writeFileSync as writeFileSync5
 } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 var PERIOD_US = 1e5;
 var MEMORY_MIN_OVERHEAD_MIB = 256;
 var MEMORY_OVERHEAD_DIVISOR = 8;
@@ -44797,18 +44875,18 @@ function parseOomKills(text) {
   return match?.groups === undefined ? null : Number(match.groups["count"]);
 }
 function createCpuCgroups(options) {
-  const imps = join22(options.root, "imps");
+  const imps = join23(options.root, "imps");
   const procRoot = options.procRoot ?? "/proc";
   const rmdir = options.rmdir ?? rmdirSync2;
   const sleep = options.sleep ?? Bun.sleep;
   const isEnforced = probeControllerDelegated(imps, "cpu");
   const isMemoryEnforced = isEnforced && probeControllerDelegated(imps, "memory");
-  const getDir = (impId) => join22(imps, impId);
+  const getDir = (impId) => join23(imps, impId);
   const guestMibs = new Map;
   const oomBaselines = new Map;
   const readOomKills = (impId) => {
     try {
-      const events = readFileSync22(join22(getDir(impId), "memory.events"), "utf8");
+      const events = readFileSync23(join23(getDir(impId), "memory.events"), "utf8");
       return parseOomKills(events);
     } catch {
       return null;
@@ -44818,8 +44896,8 @@ function createCpuCgroups(options) {
     oomBaselines.set(impId, readOomKills(impId) ?? 0);
   };
   const writeSettings = (impId, cpu, limit) => {
-    writeFileSync5(join22(getDir(impId), "cpu.weight"), String(cpu.weight));
-    writeFileSync5(join22(getDir(impId), "cpu.max"), formatCpuMax(limit));
+    writeFileSync5(join23(getDir(impId), "cpu.weight"), String(cpu.weight));
+    writeFileSync5(join23(getDir(impId), "cpu.max"), formatCpuMax(limit));
   };
   const writeMemory = (impId) => {
     const guestMib = guestMibs.get(impId);
@@ -44827,10 +44905,10 @@ function createCpuCgroups(options) {
       return;
     }
     const directory = getDir(impId);
-    writeFileSync5(join22(directory, "memory.max"), buildMemoryMax(guestMib));
-    writeFileSync5(join22(directory, "memory.high"), "max");
-    writeFileSync5(join22(directory, "memory.swap.max"), "0");
-    writeFileSync5(join22(directory, "memory.oom.group"), "1");
+    writeFileSync5(join23(directory, "memory.max"), buildMemoryMax(guestMib));
+    writeFileSync5(join23(directory, "memory.high"), "max");
+    writeFileSync5(join23(directory, "memory.swap.max"), "0");
+    writeFileSync5(join23(directory, "memory.oom.group"), "1");
   };
   const setup = (impId, cpu, memoryMib) => {
     if (!isEnforced) {
@@ -44852,7 +44930,7 @@ function createCpuCgroups(options) {
       return null;
     }
     return {
-      procsPath: join22(getDir(impId), "cgroup.procs"),
+      procsPath: join23(getDir(impId), "cgroup.procs"),
       liftLimit: () => {
         tryWrite(impId, "lift the limit", () => {
           writeSettings(impId, cpu, null);
@@ -44936,7 +45014,7 @@ function createCpuCgroups(options) {
     kill: (impId) => {
       if (isEnforced && existsSync14(getDir(impId))) {
         tryWrite(impId, "kill", () => {
-          writeFileSync5(join22(getDir(impId), "cgroup.kill"), "1");
+          writeFileSync5(join23(getDir(impId), "cgroup.kill"), "1");
         });
       }
     },
@@ -44947,7 +45025,7 @@ function createCpuCgroups(options) {
     },
     readCpuStat: (impId) => {
       try {
-        const stat = readFileSync22(join22(getDir(impId), "cpu.stat"), "utf8");
+        const stat = readFileSync23(join23(getDir(impId), "cpu.stat"), "utf8");
         return parseCpuStat(stat);
       } catch {
         return null;
@@ -44957,7 +45035,7 @@ function createCpuCgroups(options) {
 }
 function probeControllerDelegated(imps, controller) {
   try {
-    const delegated = readFileSync22(join22(imps, "cgroup.subtree_control"), "utf8");
+    const delegated = readFileSync23(join23(imps, "cgroup.subtree_control"), "utf8");
     return delegated.split(/\s+/u).includes(controller);
   } catch {
     return false;
@@ -44990,13 +45068,13 @@ function probeUffdDevice(path = "/dev/userfaultfd") {
 }
 
 // packages/daemon/src/vm/vmm/read-huge-page-pool.ts
-import { readFileSync as readFileSync23 } from "fs";
-import { join as join23 } from "path";
+import { readFileSync as readFileSync24 } from "fs";
+import { join as join24 } from "path";
 var HUGE_PAGE_MIB = 2;
 function readHugePagePool(sysRoot = "/sys") {
-  const directory = join23(sysRoot, "kernel", "mm", "hugepages", "hugepages-2048kB");
+  const directory = join24(sysRoot, "kernel", "mm", "hugepages", "hugepages-2048kB");
   try {
-    const readCount = (name) => Number(readFileSync23(join23(directory, name), "utf8").trim());
+    const readCount = (name) => Number(readFileSync24(join24(directory, name), "utf8").trim());
     const total = readCount("nr_hugepages");
     const free = readCount("free_hugepages") - readCount("resv_hugepages");
     if (!Number.isSafeInteger(total) || !Number.isSafeInteger(free)) {
@@ -45575,6 +45653,7 @@ function resolveImpBoundaries(boundaries) {
     kernelOops: boundaries.kernelOops ?? createKernelOopsWatch(),
     readThreadIds: boundaries.readThreadIds ?? ((pid) => readThreadIds(pid)),
     readNetBytes: boundaries.readNetBytes ?? ((tap) => readGuestNetBytes(tap)),
+    readHostLoad: boundaries.readHostLoad ?? (() => readHostLoad({ procRoot: "/proc", readFile: readText, logger: getImpdLogger("imps") })),
     ...boundaries.openTap !== undefined && { openTap: boundaries.openTap },
     ...boundaries.now !== undefined && { now: boundaries.now }
   };
@@ -45589,7 +45668,7 @@ function makeStandInVmRam(readRam) {
 
 // packages/daemon/src/imp-ops/moves/move-receiver.ts
 import { existsSync as existsSync16, rmSync as rmSync24 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 
 // packages/daemon/src/platform/db/probe-slot-free.ts
 async function probeSlotFree(db, slot, now) {
@@ -45914,7 +45993,7 @@ function readReceipt(receipt, secret) {
 // packages/daemon/src/imp-ops/moves/read-move-stream.ts
 import { mkdirSync as mkdirSync19, rmSync as rmSync23 } from "fs";
 import { open as open7 } from "fs/promises";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 import invariant5 from "tiny-invariant";
 
 // packages/daemon/src/imp-ops/moves/build-received-digest.ts
@@ -46539,7 +46618,7 @@ async function readMoveStream(deps, options) {
   const count = createByteCounter(row.bytes);
   const files = [];
   mkdirSync19(options.tempDir, { recursive: true, mode: 448 });
-  const temp = join24(options.tempDir, `${row.id}.part`);
+  const temp = join25(options.tempDir, `${row.id}.part`);
   const writeDisk = async (impId) => {
     if (header.streams !== null) {
       await writeMoveStreams(deps, {
@@ -46754,7 +46833,7 @@ async function requireMoveTicket(db, request) {
 // packages/daemon/src/imp-ops/moves/move-receiver.ts
 var STREAM_WINDOW_MS = 10 * 60 * 1000;
 function createMoveReceiver(deps) {
-  const tempDir = join25(deps.dataDir, "moves");
+  const tempDir = join26(deps.dataDir, "moves");
   const sessions = new Map;
   const writeTicketRow = async (name, bytes, fields, write = (row) => writeMoveTicket(deps.db, row)) => {
     const created = mintOpaqueToken(MOVE_TICKET_PREFIX);
@@ -47929,12 +48008,12 @@ function toPeerError2(procedure, error) {
 // packages/daemon/src/vm/storage/write-image-files.ts
 import { writeFileSync as writeFileSync6 } from "fs";
 import { copyFile } from "fs/promises";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 async function writeImageFiles(files, directory) {
-  const rootfs = join26(directory, "rootfs.ext4");
+  const rootfs = join27(directory, "rootfs.ext4");
   writeFileSync6(rootfs, "");
   await writeChangedBlocks(files.rootfsPath, rootfs);
-  await copyFile(files.configPath, join26(directory, "config.json"));
+  await copyFile(files.configPath, join27(directory, "config.json"));
 }
 
 // packages/daemon/src/create-impd-moves.ts
@@ -47974,7 +48053,7 @@ function createImpdMoves(config, deps, parts, hooks) {
 
 // packages/daemon/src/imps/images/template-service.ts
 import { copyFileSync as copyFileSync3, existsSync as existsSync17, statSync as statSync11, writeFileSync as writeFileSync7 } from "fs";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 
 // packages/daemon/src/imps/images/read-held-image.ts
 async function readHeldImage(db, name, at) {
@@ -48262,7 +48341,7 @@ function createTemplateService(deps) {
   });
   const writeConfig = async (imageId, directory) => {
     const image = await readImageById(deps.db, imageId);
-    const target = join27(directory, "config.json");
+    const target = join28(directory, "config.json");
     const config = image === undefined ? undefined : buildImagePaths(deps.config.dataDir, image.digest).config;
     if (config !== undefined && existsSync17(config)) {
       copyFileSync3(config, target);
@@ -48650,7 +48729,7 @@ function createImpdServices(config, deps, parts) {
 
 // packages/daemon/src/imps/images/build/create-image-builds.ts
 import { existsSync as existsSync19, mkdirSync as mkdirSync20, rmSync as rmSync25, statSync as statSync12 } from "fs";
-import { join as join29, posix as posix3 } from "path";
+import { join as join30, posix as posix3 } from "path";
 
 // packages/local-tar/src/extract-local.ts
 import tar from "tar-stream";
@@ -48658,7 +48737,7 @@ import * as z83 from "zod";
 // packages/local-tar/src/pack-build-context.ts
 import { existsSync as existsSync18 } from "fs";
 import { lstat, readFile as readFile4, readdir } from "fs/promises";
-import { join as join28, posix as posix2 } from "path";
+import { join as join29, posix as posix2 } from "path";
 import ignore from "@balena/dockerignore";
 
 // packages/local-tar/src/write-build-context.ts
@@ -48942,7 +49021,7 @@ class MissingDockerfileError extends Error {
   name = "MissingDockerfileError";
 }
 function listContextEntries(root, dockerfile) {
-  const found = listDockerfileCandidates(posix2.normalize(dockerfile)).find((candidate) => existsSync18(join28(root, candidate)));
+  const found = listDockerfileCandidates(posix2.normalize(dockerfile)).find((candidate) => existsSync18(join29(root, candidate)));
   if (found === undefined) {
     return Promise.reject(new MissingDockerfileError(`there is no ${dockerfile} in ${root}`));
   }
@@ -48954,8 +49033,8 @@ var ENTRY_KINDS = [
   ["file", "isFile"]
 ];
 async function listEntries(root, dockerfile) {
-  const ignoreName = existsSync18(join28(root, `${dockerfile}.dockerignore`)) ? `${dockerfile}.dockerignore` : ".dockerignore";
-  const patterns = existsSync18(join28(root, ignoreName)) ? await readFile4(join28(root, ignoreName), "utf8") : "";
+  const ignoreName = existsSync18(join29(root, `${dockerfile}.dockerignore`)) ? `${dockerfile}.dockerignore` : ".dockerignore";
+  const patterns = existsSync18(join29(root, ignoreName)) ? await readFile4(join29(root, ignoreName), "utf8") : "";
   const matcher = ignore().add(patterns);
   const hasExceptions = patterns.split(`
 `).some((line) => line.trim().startsWith("!"));
@@ -48965,7 +49044,7 @@ async function listEntries(root, dockerfile) {
     const entries = [];
     const children = await readdir(directory);
     for (const child of children.toSorted()) {
-      const path = join28(directory, child);
+      const path = join29(directory, child);
       const name = prefix === "" ? child : `${prefix}/${child}`;
       const stats = await lstat(path);
       const ignored = matcher.ignores(name) && name !== dockerfileName;
@@ -50020,7 +50099,7 @@ function planRootfsOverhead(treeBytes) {
 }
 
 // packages/daemon/src/imps/images/rootfs/unpack-export.ts
-import { readFileSync as readFileSync24 } from "fs";
+import { readFileSync as readFileSync25 } from "fs";
 var CAP_SETFCAP_BIT = 31n;
 var SETFCAP_HELP = "imp-host needs CAP_SETFCAP (docs/architecture/host.md#privileges)";
 var UNPACK_TAR_ARGS = [
@@ -50062,7 +50141,7 @@ function findXattrFailure(stderr) {
   });
   return failures.find((failure) => failure.missingSetfcap) ?? failures[0] ?? null;
 }
-function readSetfcapWarning(status = readFileSync24("/proc/self/status", "utf8")) {
+function readSetfcapWarning(status = readFileSync25("/proc/self/status", "utf8")) {
   const effective = /^CapEff:\s*(?<mask>[0-9a-f]+)$/mu.exec(status)?.groups?.["mask"] ?? "0";
   if (BigInt(`0x${effective}`) >> CAP_SETFCAP_BIT & 1n) {
     return null;
@@ -50486,7 +50565,7 @@ function createImageBuilds(deps, writer) {
       });
     }
     const uploadsDir = buildUploadsDir(deps.config.dataDir);
-    const tarPath = join29(uploadsDir, `${Bun.randomUUIDv7()}.tar`);
+    const tarPath = join30(uploadsDir, `${Bun.randomUUIDv7()}.tar`);
     mkdirSync20(uploadsDir, { recursive: true, mode: 448 });
     return deps.diskBudget.withRoom(tarBytes, async () => {
       try {
@@ -50643,7 +50722,7 @@ function buildImageRuntimeConfig(ociConfig) {
 
 // packages/daemon/src/imps/images/rootfs/create-image-writer.ts
 import { existsSync as existsSync20, mkdirSync as mkdirSync22, rmSync as rmSync27, statSync as statSync13, writeFileSync as writeFileSync8 } from "fs";
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 
 // packages/daemon/src/imps/images/rootfs/read-oci-config.ts
 import * as z88 from "zod";
@@ -50663,13 +50742,13 @@ async function readOciConfig(ref, signal, run) {
 
 // packages/daemon/src/imps/images/rootfs/write-image-config.ts
 import { closeSync as closeSync11, constants as constants6, lstatSync as lstatSync5, mkdirSync as mkdirSync21, openSync as openSync9, rmSync as rmSync26, writeSync as writeSync3 } from "fs";
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 function writeImageConfig(root, contents) {
-  const etc = join30(root, "etc");
-  const directory = join30(etc, "imp");
+  const etc = join31(root, "etc");
+  const directory = join31(etc, "imp");
   createDirectory(etc, "/etc");
   createDirectory(directory, "/etc/imp");
-  const file = join30(directory, "image.json");
+  const file = join31(directory, "image.json");
   rmSync26(file, { recursive: true, force: true });
   const fd = openSync9(file, constants6.O_WRONLY | constants6.O_CREAT | constants6.O_EXCL | constants6.O_NOFOLLOW, 420);
   try {
@@ -50716,8 +50795,8 @@ function createImageWriter(deps) {
   const guestRootfsLock = buildKeyedMutex();
   const makeWorkDir = () => {
     const images = buildImagesDir(deps.config.dataDir);
-    const work = join31(images, `.build-${Bun.randomUUIDv7()}`);
-    const root = join31(work, "root");
+    const work = join32(images, `.build-${Bun.randomUUIDv7()}`);
+    const root = join32(work, "root");
     mkdirSync22(images, { recursive: true });
     mkdirSync22(work, { mode: 448 });
     mkdirSync22(root, { mode: 493 });
@@ -50728,7 +50807,7 @@ function createImageWriter(deps) {
     const usage = await readTreeUsage(root);
     const plan = planRootfs(usage);
     await deps.storage.createImage(digest, async (directory) => {
-      const image = join31(directory, "rootfs.ext4");
+      const image = join32(directory, "rootfs.ext4");
       await runChecked(["truncate", "-s", String(plan.bytes), image]);
       await runChecked([
         "mkfs.ext4",
@@ -50741,7 +50820,7 @@ function createImageWriter(deps) {
         root,
         image
       ]);
-      writeFileSync8(join31(directory, "config.json"), JSON.stringify(ociConfig ?? {}, null, 2));
+      writeFileSync8(join32(directory, "config.json"), JSON.stringify(ociConfig ?? {}, null, 2));
     });
     return readDiskUsage(buildImagePaths(deps.config.dataDir, digest).rootfs);
   };
@@ -51292,7 +51371,7 @@ async function runStreamed(argv, onStdout, signal) {
 
 // packages/daemon/src/vm/storage/count-tree-bytes.ts
 import { lstat as lstat3, readdir as readdir3 } from "fs/promises";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 async function countTreeBytes(root, deps = {}) {
   const readDir = deps.readDir ?? readDirEntries;
   const inodes = new Map;
@@ -51301,11 +51380,11 @@ async function countTreeBytes(root, deps = {}) {
     const entries = await readEntries2(readDir, directory);
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        dirs.push(join32(directory, entry.name));
+        dirs.push(join33(directory, entry.name));
       }
     }
     const files = entries.filter((entry) => entry.isFile());
-    const stats = await Promise.all(files.map((entry) => readFileStats(join32(directory, entry.name))));
+    const stats = await Promise.all(files.map((entry) => readFileStats(join33(directory, entry.name))));
     for (const stat of stats) {
       if (stat !== undefined) {
         inodes.set(`${String(stat.dev)}:${String(stat.ino)}`, Math.max(0, stat.blocks - 1) * 512);
@@ -51548,12 +51627,12 @@ function createTailnetAccess(config, deps, readStatus) {
 }
 
 // packages/daemon/src/identity/token.ts
-import { existsSync as existsSync21, readFileSync as readFileSync25, writeFileSync as writeFileSync9 } from "fs";
-import { join as join33 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync26, writeFileSync as writeFileSync9 } from "fs";
+import { join as join34 } from "path";
 function loadOrCreateToken(dataDir) {
-  const path = join33(dataDir, "token");
+  const path = join34(dataDir, "token");
   if (existsSync21(path)) {
-    return readFileSync25(path, "utf8").trim();
+    return readFileSync26(path, "utf8").trim();
   }
   const token = mintSecret();
   writeFileSync9(path, `${token}
@@ -51675,13 +51754,13 @@ import { basename as basename4 } from "path";
 
 // packages/daemon/src/vm/storage/remove-unused-system-drives.ts
 import { readdirSync as readdirSync9, rmSync as rmSync28 } from "fs";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 function removeUnusedSystemDrives(dataDir, keep) {
   const directory = buildSystemDrivesDir(dataDir);
   const removed = [];
   for (const name of readNames(directory)) {
     if (!keep.has(name)) {
-      rmSync28(join34(directory, name), { force: true });
+      rmSync28(join35(directory, name), { force: true });
       removed.push(name);
     }
   }
@@ -52890,13 +52969,13 @@ function createPublicRecordsLink() {
 
 // packages/daemon/src/network/tailnet-names/host-id.ts
 import { randomBytes as randomBytes11 } from "crypto";
-import { existsSync as existsSync22, mkdirSync as mkdirSync23, readFileSync as readFileSync26, writeFileSync as writeFileSync10 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync23, readFileSync as readFileSync27, writeFileSync as writeFileSync10 } from "fs";
+import { join as join36 } from "path";
 function loadOrCreateHostId(dataDir) {
-  const directory = join35(dataDir, "tailnet-names");
-  const path = join35(directory, "host-id");
+  const directory = join36(dataDir, "tailnet-names");
+  const path = join36(directory, "host-id");
   if (existsSync22(path)) {
-    return readFileSync26(path, "utf8").trim();
+    return readFileSync27(path, "utf8").trim();
   }
   mkdirSync23(directory, { recursive: true });
   const id = randomBytes11(16).toString("hex");
@@ -52906,7 +52985,7 @@ function loadOrCreateHostId(dataDir) {
 }
 
 // packages/daemon/src/network/tailnet-names/oauth-credential.ts
-import { readFileSync as readFileSync27, statSync as statSync14 } from "fs";
+import { readFileSync as readFileSync28, statSync as statSync14 } from "fs";
 import * as z92 from "zod";
 var CredentialSchema = z92.object({ clientId: z92.string().min(1), clientSecret: z92.string().min(1) });
 function readOAuthCredential(path) {
@@ -52922,7 +53001,7 @@ function readOAuthCredential(path) {
 }
 function readJson(path) {
   try {
-    return JSON.parse(readFileSync27(path, "utf8"));
+    return JSON.parse(readFileSync28(path, "utf8"));
   } catch {
     return null;
   }
@@ -53319,7 +53398,7 @@ async function startOtlpExport(env, version) {
 }
 
 // packages/daemon/src/network/https/wire-https-service.ts
-import { readFileSync as readFileSync29 } from "fs";
+import { readFileSync as readFileSync30 } from "fs";
 
 // packages/daemon/src/platform/db/exposure.ts
 async function readPublicImp(db, name) {
@@ -53514,8 +53593,8 @@ function formatAcmeError(error) {
 }
 
 // packages/daemon/src/network/https/acme/cert-store.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync24, readFileSync as readFileSync28, rmSync as rmSync29 } from "fs";
-import { join as join36 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync24, readFileSync as readFileSync29, rmSync as rmSync29 } from "fs";
+import { join as join37 } from "path";
 import * as z95 from "zod";
 var AttemptStateSchema = z95.object({
   failures: z95.int().nonnegative(),
@@ -53526,11 +53605,11 @@ var AccountSchema = z95.object({ directoryUrl: z95.string(), url: z95.string(),
 var LegacyAccountSchema = z95.object({ directoryUrl: z95.string(), url: z95.string() });
 var NO_ATTEMPTS = { failures: 0, lastAttemptAt: null, lastError: null };
 function createCertStore(dataDir) {
-  const directory = join36(dataDir, "tls");
-  const certificatePath = join36(directory, "certificate.pem");
-  const attemptsPath = join36(directory, "attempts.json");
-  const accountPath = join36(directory, "account.json");
-  const legacyKeyPath = join36(directory, "account.key");
+  const directory = join37(dataDir, "tls");
+  const certificatePath = join37(directory, "certificate.pem");
+  const attemptsPath = join37(directory, "attempts.json");
+  const accountPath = join37(directory, "account.json");
+  const legacyKeyPath = join37(directory, "account.key");
   const warned = { account: false };
   const write = (path, content) => {
     mkdirSync24(directory, { recursive: true, mode: 448 });
@@ -53596,7 +53675,7 @@ ${certificate.chainPem.trimEnd()}
   };
 }
 function readIfExists(path) {
-  return existsSync23(path) ? readFileSync28(path, "utf8") : null;
+  return existsSync23(path) ? readFileSync29(path, "utf8") : null;
 }
 function parseJson(text) {
   try {
@@ -54402,7 +54481,7 @@ function wireHttpsService(options) {
   const issue = createAcmeIssuer({
     directoryUrl: config.acmeDirectory,
     email: config.acmeEmail,
-    caPem: config.acmeCaFile === null ? null : readFileSync29(config.acmeCaFile, "utf8"),
+    caPem: config.acmeCaFile === null ? null : readFileSync30(config.acmeCaFile, "utf8"),
     store,
     dns
   });
@@ -54989,17 +55068,17 @@ function buildTooMany() {
 
 // packages/daemon/src/surface/ssh/host-key.ts
 var import_ssh22 = __toESM(require_lib2(), 1);
-import { existsSync as existsSync24, mkdirSync as mkdirSync25, readFileSync as readFileSync30, writeFileSync as writeFileSync11 } from "fs";
-import { join as join37 } from "path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync25, readFileSync as readFileSync31, writeFileSync as writeFileSync11 } from "fs";
+import { join as join38 } from "path";
 function setupSshDir(dataDir) {
-  const directory = join37(dataDir, "ssh");
+  const directory = join38(dataDir, "ssh");
   mkdirSync25(directory, { recursive: true, mode: 448 });
   return directory;
 }
 function loadOrCreateHostKey(sshDir) {
-  const path = join37(sshDir, "host_key");
+  const path = join38(sshDir, "host_key");
   if (existsSync24(path)) {
-    return readFileSync30(path, "utf8");
+    return readFileSync31(path, "utf8");
   }
   const pair = generateEd25519Key();
   writeFileSync11(path, pair.private, { mode: 384, flag: "wx" });
@@ -56164,8 +56243,8 @@ async function stopImpd(parts, options) {
 }
 
 // packages/daemon/src/vm/storage/create-storage-backend.ts
-import { existsSync as existsSync31, readFileSync as readFileSync34, readdirSync as readdirSync14, writeFileSync as writeFileSync14 } from "fs";
-import { join as join46 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync35, readdirSync as readdirSync14, writeFileSync as writeFileSync14 } from "fs";
+import { join as join47 } from "path";
 
 // packages/daemon/src/vm/storage/xfs-backend.ts
 import {
@@ -56178,7 +56257,7 @@ import {
   statfsSync as statfsSync2,
   writeFileSync as writeFileSync12
 } from "fs";
-import { basename as basename6, dirname as dirname13, join as join41 } from "path";
+import { basename as basename6, dirname as dirname13, join as join42 } from "path";
 
 // packages/daemon/src/vm/storage/count-owner-bytes.ts
 function countOwnerBytes(files) {
@@ -56235,13 +56314,13 @@ import {
   copyFileSync as copyFileSync4,
   existsSync as existsSync25,
   mkdirSync as mkdirSync26,
-  readFileSync as readFileSync31,
+  readFileSync as readFileSync32,
   readdirSync as readdirSync10,
   renameSync as renameSync6,
   rmSync as rmSync30,
   statSync as statSync15
 } from "fs";
-import { basename as basename5, dirname as dirname11, join as join38 } from "path";
+import { basename as basename5, dirname as dirname11, join as join39 } from "path";
 import * as z97 from "zod";
 var CopiesSchema = z97.record(z97.string(), z97.object({ ino: z97.string(), ctimeNs: z97.string(), size: z97.string() }));
 function createXfsBackups(ctx) {
@@ -56249,7 +56328,7 @@ function createXfsBackups(ctx) {
   const freshCopies = new Set;
   const readCopies = () => {
     try {
-      return CopiesSchema.parse(JSON.parse(readFileSync31(backup.copies, "utf8")));
+      return CopiesSchema.parse(JSON.parse(readFileSync32(backup.copies, "utf8")));
     } catch {
       return {};
     }
@@ -56272,7 +56351,7 @@ function createXfsBackups(ctx) {
   return {
     createBackupCopy: async (impId, _runId, options) => {
       const source = ctx.resolveImpPaths(impId).disk;
-      const target = join38(backup.tree, BACKUP_TREE.buildDisk(impId));
+      const target = join39(backup.tree, BACKUP_TREE.buildDisk(impId));
       const stats = statSync15(source, { bigint: true });
       const record = {
         ino: String(stats.ino),
@@ -56300,34 +56379,34 @@ function createXfsBackups(ctx) {
       const checkpointIds = new Set;
       const imageDigests = new Set;
       for (const imp of request.imps) {
-        if (!existsSync25(join38(backup.tree, BACKUP_TREE.buildDisk(imp.impId)))) {
+        if (!existsSync25(join39(backup.tree, BACKUP_TREE.buildDisk(imp.impId)))) {
           continue;
         }
         impIds.add(imp.impId);
         for (const checkpointId of imp.checkpointIds) {
-          const isCopied = await createTreeClone(ctx.buildCheckpointDisk(imp.impId, checkpointId), join38(backup.tree, BACKUP_TREE.buildCheckpointDisk(imp.impId, checkpointId)));
+          const isCopied = await createTreeClone(ctx.buildCheckpointDisk(imp.impId, checkpointId), join39(backup.tree, BACKUP_TREE.buildCheckpointDisk(imp.impId, checkpointId)));
           if (isCopied) {
             checkpointIds.add(checkpointId);
           }
         }
-        removeUnlisted(join38(backup.tree, BACKUP_TREE.buildImpDir(imp.impId), "checkpoints"), new Set(imp.checkpointIds.filter((id) => checkpointIds.has(id))));
+        removeUnlisted(join39(backup.tree, BACKUP_TREE.buildImpDir(imp.impId), "checkpoints"), new Set(imp.checkpointIds.filter((id) => checkpointIds.has(id))));
       }
       for (const digest of request.imageDigests) {
         const source = buildImagePaths(ctx.dataDir, digest);
-        const directory = join38(backup.tree, BACKUP_TREE.buildImageDir(digest));
-        const isCopied = await createTreeClone(source.rootfs, join38(directory, "rootfs.ext4"));
+        const directory = join39(backup.tree, BACKUP_TREE.buildImageDir(digest));
+        const isCopied = await createTreeClone(source.rootfs, join39(directory, "rootfs.ext4"));
         if (isCopied) {
-          copyFileSync4(source.config, join38(directory, "config.json"));
+          copyFileSync4(source.config, join39(directory, "config.json"));
           imageDigests.add(digest);
         }
       }
-      removeUnlisted(join38(backup.tree, "imps"), impIds);
-      removeUnlisted(join38(backup.tree, "images"), new Set([...imageDigests].map((digest) => basename5(BACKUP_TREE.buildImageDir(digest)))));
+      removeUnlisted(join39(backup.tree, "imps"), impIds);
+      removeUnlisted(join39(backup.tree, "images"), new Set([...imageDigests].map((digest) => basename5(BACKUP_TREE.buildImageDir(digest)))));
       const copies = readCopies();
       writeCopies(Object.fromEntries(Object.entries(copies).filter(([id]) => impIds.has(id))));
       const removeFreshCopies = () => {
         for (const impId of freshCopies) {
-          rmSync30(join38(backup.tree, BACKUP_TREE.buildDisk(impId)), { force: true });
+          rmSync30(join39(backup.tree, BACKUP_TREE.buildDisk(impId)), { force: true });
         }
         freshCopies.clear();
         return Promise.resolve();
@@ -56339,18 +56418,18 @@ function createXfsBackups(ctx) {
 function removeUnlisted(directory, keep) {
   const names = existsSync25(directory) ? readdirSync10(directory) : [];
   for (const name of names.filter((entry) => !keep.has(entry))) {
-    rmSync30(join38(directory, name), { recursive: true, force: true });
+    rmSync30(join39(directory, name), { recursive: true, force: true });
   }
 }
 
 // packages/daemon/src/vm/storage/loop-backing-file.ts
-import { readFileSync as readFileSync32, realpathSync, statfsSync } from "fs";
-import { dirname as dirname12, join as join39 } from "path";
+import { readFileSync as readFileSync33, realpathSync, statfsSync } from "fs";
+import { dirname as dirname12, join as join40 } from "path";
 var HOST_DIRS = { procDir: "/proc", sysDir: "/sys" };
 function readLoopBackingFile(directory, hostDirs = HOST_DIRS) {
   try {
     const target = realpathSync(directory);
-    const mountInfo = readFileSync32(join39(hostDirs.procDir, "self", "mountinfo"), "utf8");
+    const mountInfo = readFileSync33(join40(hostDirs.procDir, "self", "mountinfo"), "utf8");
     for (const line of mountInfo.split(`
 `)) {
       const [mounts = "", fields = ""] = line.split(" - ");
@@ -56358,8 +56437,8 @@ function readLoopBackingFile(directory, hostDirs = HOST_DIRS) {
       const [, source = ""] = fields.split(" ");
       const loop = /^\/dev\/(?<name>loop\d+)$/u.exec(source)?.groups?.["name"];
       if (mountPoint === target && loop !== undefined) {
-        const backing = join39(hostDirs.sysDir, "block", loop, "loop", "backing_file");
-        return readFileSync32(backing, "utf8").trim();
+        const backing = join40(hostDirs.sysDir, "block", loop, "loop", "backing_file");
+        return readFileSync33(backing, "utf8").trim();
       }
     }
   } catch {}
@@ -56380,7 +56459,7 @@ function readLoopHostFreeBytes(directory, hostDirs = HOST_DIRS) {
 
 // packages/daemon/src/vm/storage/orphan-files.ts
 import { existsSync as existsSync26, readdirSync as readdirSync11, statSync as statSync16 } from "fs";
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 function probeHoldingFiles(directory) {
   return existsSync26(directory) && readdirSync11(directory, { recursive: true, withFileTypes: true }).some((entry) => !entry.isDirectory());
 }
@@ -56388,7 +56467,7 @@ function listFilesUnder(directory) {
   if (!existsSync26(directory)) {
     return [];
   }
-  return readdirSync11(directory, { recursive: true, withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => join40(entry.parentPath, entry.name));
+  return readdirSync11(directory, { recursive: true, withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => join41(entry.parentPath, entry.name));
 }
 function readDirectoryOrphan(kind, id, directory, snapshots) {
   const birth = statSync16(directory).birthtimeMs;
@@ -56414,7 +56493,7 @@ function createXfsBackend(deps) {
   const cloneFile = deps.cloneFile ?? createReflinkClone;
   const readFileExtents = deps.readFileExtents ?? readExtents;
   const resolveImpPaths = (impId) => buildImpPaths(deps.dataDir, impId);
-  const buildCheckpointDisk = (impId, checkpointId) => join41(resolveImpPaths(impId).checkpointsDir, checkpointId, "disk.ext4");
+  const buildCheckpointDisk = (impId, checkpointId) => join42(resolveImpPaths(impId).checkpointsDir, checkpointId, "disk.ext4");
   const getSourceFile = (source) => {
     if (source.kind === "image") {
       return buildImagePaths(deps.dataDir, source.digest).rootfs;
@@ -56429,7 +56508,7 @@ function createXfsBackend(deps) {
   };
   const createImage = async (digest, write) => {
     const paths = buildImagePaths(deps.dataDir, digest);
-    const staged = join41(buildImagesDir(deps.dataDir), `${STAGING_PREFIX}${Bun.randomUUIDv7()}`);
+    const staged = join42(buildImagesDir(deps.dataDir), `${STAGING_PREFIX}${Bun.randomUUIDv7()}`);
     mkdirSync27(staged, { recursive: true });
     try {
       await write(staged);
@@ -56450,13 +56529,13 @@ function createXfsBackend(deps) {
       return listEntries2(directory).map((id) => ({
         kind: "checkpoint",
         id,
-        directory: join41(directory, id)
+        directory: join42(directory, id)
       }));
     }).filter((checkpoint) => !live.checkpointIds.has(checkpoint.id));
     const unknownImages = listEntries2(buildImagesDir(deps.dataDir)).filter((name) => !name.startsWith(".") && !liveDigests.has(name)).map((name) => ({
       kind: "image",
       id: name,
-      directory: join41(buildImagesDir(deps.dataDir), name)
+      directory: join42(buildImagesDir(deps.dataDir), name)
     }));
     const unknownImps = impIds.filter((impId) => !live.impIds.has(impId)).map((impId) => ({
       kind: "imp",
@@ -56476,14 +56555,14 @@ function createXfsBackend(deps) {
   };
   const removeLeftover = (dropped, live) => {
     if (dropped.kind === "image") {
-      rmSync31(join41(buildImagesDir(deps.dataDir), dropped.id), { recursive: true, force: true });
+      rmSync31(join42(buildImagesDir(deps.dataDir), dropped.id), { recursive: true, force: true });
     }
     if (dropped.kind === "imp") {
       rmSync31(resolveImpPaths(dropped.id).directory, { recursive: true, force: true });
     }
     if (dropped.kind === "checkpoint") {
       for (const impId of live.impIds) {
-        rmSync31(join41(resolveImpPaths(impId).checkpointsDir, dropped.id), {
+        rmSync31(join42(resolveImpPaths(impId).checkpointsDir, dropped.id), {
           recursive: true,
           force: true
         });
@@ -56498,7 +56577,7 @@ function createXfsBackend(deps) {
   const listOtherFiles = () => {
     const images = listEntries2(buildImagesDir(deps.dataDir)).filter((name) => !name.startsWith(".")).map((name) => ({
       owner: `image:${name}`,
-      path: join41(buildImagesDir(deps.dataDir), name, "rootfs.ext4")
+      path: join42(buildImagesDir(deps.dataDir), name, "rootfs.ext4")
     }));
     const tree = listFilesUnder(backup.tree).map((path) => ({ owner: "backup", path }));
     return [...images, ...tree].filter((file) => existsSync27(file.path));
@@ -56506,7 +56585,7 @@ function createXfsBackend(deps) {
   const usageState = { resumeImpId: null };
   const setupReserveFile = async () => {
     const bytes = deps.reserveFileBytes ?? 0;
-    const file = join41(deps.dataDir, "reserve");
+    const file = join42(deps.dataDir, "reserve");
     if (bytes === 0 || existsSync27(file)) {
       return;
     }
@@ -56536,7 +56615,7 @@ function createXfsBackend(deps) {
     start: (live) => {
       const imagesDir = buildImagesDir(deps.dataDir);
       for (const name of listEntries2(imagesDir).filter((entry) => entry.startsWith("."))) {
-        rmSync31(join41(imagesDir, name), { recursive: true, force: true });
+        rmSync31(join42(imagesDir, name), { recursive: true, force: true });
       }
       const swept = removeUnnamed(live, { isDryRun: false, isOrphans: false });
       printSweep(getImpdLogger("storage"), swept, "each");
@@ -56558,7 +56637,7 @@ function createXfsBackend(deps) {
     receiveMoveSnapshots: () => Promise.reject(new Error("xfs: only a ZFS host receives ZFS streams")),
     createImage,
     createImageFromImp: (digest, impId, steps) => createImage(digest, async (directory) => {
-      await steps.hold(() => cloneFile(resolveImpPaths(impId).disk, join41(directory, "rootfs.ext4")));
+      await steps.hold(() => cloneFile(resolveImpPaths(impId).disk, join42(directory, "rootfs.ext4")));
       await steps.write(directory);
     }),
     removeImage: (digest) => {
@@ -56700,8 +56779,8 @@ function isSharedExtent(extent) {
 }
 
 // packages/daemon/src/vm/storage/zfs/zfs-backend.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync28, readFileSync as readFileSync33, rmdirSync as rmdirSync3, writeFileSync as writeFileSync13 } from "fs";
-import { join as join45 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync28, readFileSync as readFileSync34, rmdirSync as rmdirSync3, writeFileSync as writeFileSync13 } from "fs";
+import { join as join46 } from "path";
 
 // packages/daemon/src/platform/process/run-stream.ts
 function createStreamRunner() {
@@ -56990,7 +57069,7 @@ function formatUiomoveWarning(version) {
 
 // packages/daemon/src/vm/storage/zfs/create-zfs-backups.ts
 import { rmSync as rmSync32 } from "fs";
-import { dirname as dirname14, join as join42 } from "path";
+import { dirname as dirname14, join as join43 } from "path";
 function createZfsBackups(ctx) {
   return {
     createBackupCopy: (impId, runId) => ctx.runSnapshot(() => ctx.zfs.snapshot(`${ctx.buildDiskName(impId)}@bk-${runId}-${impId}`)),
@@ -57017,7 +57096,7 @@ function createZfsBackups(ctx) {
         ctx.startReclaim();
       };
       const createTreeClone = async (snapshot, name, relativeDir) => {
-        const directory = join42(tree, relativeDir);
+        const directory = join43(tree, relativeDir);
         await ctx.zfs.clone(snapshot, name, { readonly: "on" });
         clones.push({ name, directory });
         await ctx.setupMount(name, directory, true);
@@ -57027,8 +57106,8 @@ function createZfsBackups(ctx) {
         if (mounted !== undefined) {
           throw new Error(`zfs: ${mounted} in the backup tree is still mounted`);
         }
-        rmSync32(join42(tree, "imps"), { recursive: true, force: true });
-        rmSync32(join42(tree, "images"), { recursive: true, force: true });
+        rmSync32(join43(tree, "imps"), { recursive: true, force: true });
+        rmSync32(join43(tree, "images"), { recursive: true, force: true });
         const entries = await ctx.listAll();
         for (const imp of request.imps) {
           const copy = entries.find((entry) => entry.type === "snapshot" && entry.name.endsWith(`@bk-${request.runId}-${imp.impId}`));
@@ -57161,7 +57240,7 @@ function createZfsCheckpoints(ctx) {
 }
 
 // packages/daemon/src/vm/storage/zfs/create-zfs-moves.ts
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 function createZfsMoves(ctx) {
   const openMoveFiles = async (snapshots, removeMoveSnapshot) => {
     const moveId = Bun.randomUUIDv7();
@@ -57190,7 +57269,7 @@ function createZfsMoves(ctx) {
       await removeClones();
       throw error;
     }
-    const paths = clones.map((clone) => join43(clone.directory, ctx.rootfsFile));
+    const paths = clones.map((clone) => join44(clone.directory, ctx.rootfsFile));
     return {
       kind: "files",
       checkpointPaths: paths.slice(0, -1),
@@ -57446,7 +57525,7 @@ function createZfsReclaim(ctx) {
 
 // packages/daemon/src/vm/storage/zfs/create-zfs-sweep.ts
 import { existsSync as existsSync28, readdirSync as readdirSync13, rmSync as rmSync33 } from "fs";
-import { join as join44 } from "path";
+import { join as join45 } from "path";
 var FORK_SNAPSHOT = /@fork-[^@]+$/u;
 var BACKUP_SNAPSHOT = /@bk-[^@]+$/u;
 var MOVE_SNAPSHOT = /@mv-[^@]+$/u;
@@ -57471,10 +57550,10 @@ function createZfsSweep(ctx) {
     const orphanCheckpoints = isOrphans ? [] : unmarked.filter((entry) => !isOnOrphan(entry) && isOrphanCheckpoint(entry));
     const keptDisks = isOrphans ? [] : unknownDisks;
     const keptImpIds = new Set(keptDisks.map((disk) => getChildId(disk.name, ctx.datasets.disks)));
-    const listUnknownDirs = (kind, parent) => (existsSync28(parent) ? readdirSync13(parent).toSorted() : []).filter((id) => !live.impIds.has(id) && !keptImpIds.has(id)).map((id) => ({ kind, id, directory: join44(parent, id) }));
+    const listUnknownDirs = (kind, parent) => (existsSync28(parent) ? readdirSync13(parent).toSorted() : []).filter((id) => !live.impIds.has(id) && !keptImpIds.has(id)).map((id) => ({ kind, id, directory: join45(parent, id) }));
     const unknownDirs = [
       ...listUnknownDirs("imp", buildImpsDir(ctx.dataDir)),
-      ...listUnknownDirs("memory", join44(ctx.dataDir, "mem"))
+      ...listUnknownDirs("memory", join45(ctx.dataDir, "mem"))
     ];
     const probeDirDropped = (entry) => isOrphans || !probeHoldingFiles(entry.directory);
     const droppedDirs = unknownDirs.filter((entry) => probeDirDropped(entry));
@@ -57563,7 +57642,7 @@ function createZfsSweep(ctx) {
       }
     }
     for (const impId of plan.memDirs) {
-      rmSync33(join44(ctx.dataDir, "mem", impId), { recursive: true, force: true });
+      rmSync33(join45(ctx.dataDir, "mem", impId), { recursive: true, force: true });
     }
     return { dropped: toDropped(plan), kept };
   };
@@ -57651,13 +57730,13 @@ function createZfsBackend(deps) {
   const buildDiskName = (impId) => `${datasets.disks}/${impId}`;
   const buildImageName = (digest) => `${datasets.images}/${toDigestHex(digest)}`;
   const buildRestoreName = (impId) => `${datasets.staging}/restore-${impId}`;
-  const buildDiskDir = (impId) => join45(buildImpPaths(deps.dataDir, impId).directory, "disk");
+  const buildDiskDir = (impId) => join46(buildImpPaths(deps.dataDir, impId).directory, "disk");
   const buildImageDir = (digest) => buildImagePaths(deps.dataDir, digest).directory;
-  const buildStagingDir = (name) => join45(deps.dataDir, "staging", name.slice(datasets.staging.length + 1));
+  const buildStagingDir = (name) => join46(deps.dataDir, "staging", name.slice(datasets.staging.length + 1));
   const resolveImpPaths = (impId) => ({
     ...buildImpPaths(deps.dataDir, impId),
-    disk: join45(buildDiskDir(impId), ROOTFS_FILE),
-    ...buildSnapshotPaths(join45(deps.dataDir, "mem", impId))
+    disk: join46(buildDiskDir(impId), ROOTFS_FILE),
+    ...buildSnapshotPaths(join46(deps.dataDir, "mem", impId))
   });
   const listAll = () => zfs.list(deps.root);
   const setupMount = async (name, directory, isReadOnly = false) => {
@@ -57800,7 +57879,7 @@ function createZfsBackend(deps) {
         throw new Error(`zfs: ${deps.root} is not mounted on ${deps.dataDir} (host/scripts/setup-storage.sh mounts it)`);
       }
       await createMissingDatasets();
-      await setupMount(datasets.mem, join45(deps.dataDir, "mem"));
+      await setupMount(datasets.mem, join46(deps.dataDir, "mem"));
       await resolveStaging();
       const swept = await sweep.removeLeftovers(live, { isDryRun: false, isOrphans: false });
       printSweep(getImpdLogger("storage"), swept, "each");
@@ -57885,7 +57964,7 @@ function createZfsBackend(deps) {
           await zfs.create(target);
           await setupMount(target, buildDiskDir(impId));
         });
-        writeFileSync13(join45(buildDiskDir(impId), ROOTFS_FILE), "");
+        writeFileSync13(join46(buildDiskDir(impId), ROOTFS_FILE), "");
         return;
       }
       await runSerial(async () => {
@@ -57962,7 +58041,7 @@ function createZfsBackend(deps) {
 }
 function readZfsModuleVersion() {
   try {
-    return readFileSync33("/sys/module/zfs/version", "utf8").trim();
+    return readFileSync34("/sys/module/zfs/version", "utf8").trim();
   } catch {
     return null;
   }
@@ -58005,14 +58084,14 @@ function createBackend(config, boundaries) {
   });
 }
 function checkStorageMarker(dataDir, kind) {
-  const marker = join46(dataDir, MARKER_FILE);
-  const recorded = existsSync31(marker) ? readFileSync34(marker, "utf8").trim() : readUnmarked(dataDir);
+  const marker = join47(dataDir, MARKER_FILE);
+  const recorded = existsSync31(marker) ? readFileSync35(marker, "utf8").trim() : readUnmarked(dataDir);
   if (recorded !== null && recorded !== kind) {
     throw new Error(`${dataDir} holds ${recorded} storage, but IMP_STORAGE_BACKEND is ${kind}; moving imps between backends is not supported`);
   }
 }
 function writeStorageMarker(dataDir, kind) {
-  const marker = join46(dataDir, MARKER_FILE);
+  const marker = join47(dataDir, MARKER_FILE);
   if (!existsSync31(marker)) {
     writeFileSync14(marker, `${kind}
 `);
@@ -58025,7 +58104,7 @@ function readUnmarked(dataDir) {
 }
 
 // packages/daemon/src/vm/storage/setup-system-files.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync29, readFileSync as readFileSync35 } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync29, readFileSync as readFileSync36 } from "fs";
 import { dirname as dirname15 } from "path";
 
 // packages/daemon/src/vm/storage/system-file-info.ts
@@ -58061,7 +58140,7 @@ async function setupSystemFiles(config) {
     const missing = config.kernelSource === null ? " and no source is configured" : "";
     throw new Error(`${kernelSource} does not exist${missing}`);
   }
-  const kernel = readFileSync35(kernelSource);
+  const kernel = readFileSync36(kernelSource);
   const guestKernel = readKernelInfo(kernel);
   if (config.kernelSource !== null && !probeContent(config.kernelPath, kernel)) {
     writeCopy(config.kernelSource, config.kernelPath);
@@ -58081,7 +58160,7 @@ async function setupSystemFiles(config) {
   };
 }
 function probeContent(path, content) {
-  return existsSync32(path) && Buffer.from(content).equals(readFileSync35(path));
+  return existsSync32(path) && Buffer.from(content).equals(readFileSync36(path));
 }
 function writeCopy(source, target) {
   mkdirSync29(dirname15(target), { recursive: true });
@@ -58133,7 +58212,7 @@ async function startImpdParts(config, boundaries, plan) {
     }
     return files;
   });
-  const db = await runStep("database", () => boundaries.db ?? openDatabase(join47(config.dataDir, "db", "imp.sqlite")));
+  const db = await runStep("database", () => boundaries.db ?? openDatabase(join48(config.dataDir, "db", "imp.sqlite")));
   plan.db = boundaries.db === undefined ? db : null;
   const kernelOops = boundaries.imps?.kernelOops ?? createKernelOopsWatch();
   const storage = boundaries.storage ?? createStorageBackend(config, { zfs: { isKernelOopsed: kernelOops.isOopsed } });
@@ -58240,7 +58319,7 @@ async function startImpdParts(config, boundaries, plan) {
     secretFiles
   });
   const state = { ready: false };
-  const authorizedKeys = createAuthorizedKeys(join47(setupSshDir(config.dataDir), "authorized_keys"));
+  const authorizedKeys = createAuthorizedKeys(join48(setupSshDir(config.dataDir), "authorized_keys"));
   const access = await runStep("access", () => loadImpdAccess(config, deps, authorizedKeys.probeListed));
   const backups = config.backup === null ? null : createBackupService({
     dataDir: config.dataDir,
@@ -58306,7 +58385,7 @@ async function startImpdParts(config, boundaries, plan) {
     readTailnetNames: tailnetNames === null ? null : tailnetNames.readStatus,
     hostReaders: {
       readKernel: () => deps.hostKernelRelease ?? release2(),
-      readCpuInfo: deps.readCpuInfo ?? (() => readFileSync36("/proc/cpuinfo", "utf8")),
+      readCpuInfo: deps.readCpuInfo ?? (() => readFileSync37("/proc/cpuinfo", "utf8")),
       readHugePagePool: deps.imps?.readHugePagePool ?? (() => readHugePagePool())
     },
     isReady: () => state.ready,
@@ -58425,6 +58504,11 @@ function buildStubTickerTimer() {
   };
 }
 
+// packages/daemon/testing/platform/format-run-prefix.ts
+function formatRunPrefix(owner) {
+  return `pid${String(owner.pid)}-ns${owner.namespace}-`;
+}
+
 // packages/daemon/testing/platform/open-migrated-copy.ts
 import { Database as Database4 } from "bun:sqlite";
 var TEMPLATE = {};
@@ -58447,6 +58531,15 @@ function pickImpdPort(draw) {
   return FIRST_PORT + Math.floor(draw * PORT_SPAN);
 }
 
+// packages/daemon/testing/platform/read-run-owner.ts
+import { readlinkSync as readlinkSync2 } from "fs";
+function readRunOwner() {
+  return {
+    pid: process.pid,
+    namespace: readlinkSync2("/proc/self/ns/pid").replaceAll(/\D/gu, "")
+  };
+}
+
 // packages/daemon/testing/platform/start-impd-log-capture.ts
 import { resetSync } from "@logtape/logtape";
 
@@ -58912,7 +59005,7 @@ var NO_FREEZER = { freeze: () => Promise.resolve(), thaw: () => Promise.resolve(
 var KSM_KERNEL = "6.12.0";
 var IDLE_KSM = { running: true, sharedMib: 0, profitMib: 0, zeroMib: 0 };
 async function startTestImpd(stack, options = {}) {
-  const dataDir = options.dataDir ?? mkdtempSync(`${tmpdir()}/impd-test-`);
+  const dataDir = options.dataDir ?? mkdtempSync(`${tmpdir()}/${formatRunPrefix(readRunOwner())}impd-test-`);
   if (options.dataDir === undefined) {
     stack.defer(() => rm2(dataDir, { recursive: true, force: true }));
   }
@@ -58983,6 +59076,7 @@ async function startTestImpd(stack, options = {}) {
   });
   const cgroups = options.cgroups ?? createCpuCgroups({ root: "/nonexistent" });
   const extra = options.boundaries ?? {};
+  const procRoot = options.procRoot;
   const buildBoundaries = (identity, runner, storage) => {
     const jails = options.jails;
     return {
@@ -59082,6 +59176,9 @@ async function startTestImpd(stack, options = {}) {
         hostCpus: options.hostCpus ?? 8,
         kernelOops,
         readThreadIds: (pid) => options.procRoot === undefined ? null : readThreadIds(pid, options.procRoot),
+        ...procRoot !== undefined && {
+          readHostLoad: () => readHostLoad({ procRoot, readFile: readText, logger: getImpdLogger("imps") })
+        },
         ...options.readUnsharedRamMib !== undefined && {
           readUnsharedRamMib: options.readUnsharedRamMib
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impz/testing",
-  "version": "6.4.1",
+  "version": "6.5.0",
   "description": "A real impd on stand-ins, for Bun tests of code that drives impd through @impz/client",
   "license": "MIT",
   "repository": {
@@ -43,7 +43,7 @@
     "ts-pattern": "^5.9.2",
     "xstate": "^5.33.3",
     "zod": "^4.6.7",
-    "@impz/client": "6.4.1"
+    "@impz/client": "6.5.0"
   },
   "engines": {
     "bun": ">=1.4.3"