@impz/testing 6.4.2 → 6.6.0

package/dist/index.js

@@ -18834,7 +18834,11 @@ import { createImpClient as createImpClient2, watchEvents } from "@impz/client";
 // packages/daemon/src/vm/storage/data-layout.ts
 import { mkdirSync } from "fs";
 import { join } from "path";
-var UFFD_RUN_FILES = { socket: "uffd.sock", pidFile: "uffd.pid" };
+var UFFD_RUN_FILES = {
+  socket: "uffd.sock",
+  pidFile: "uffd.pid",
+  statsFile: "uffd.stats"
+};
 var DATA_DIRS = ["db", "system", "images", "imps"];
 function createDataDirs(dataDir) {
   for (const name of DATA_DIRS) {
@@ -18864,6 +18868,7 @@ function buildImpPaths(dataDir, impId) {
     pidFile: join(runDir, "pid"),
     uffdSocket: join(runDir, UFFD_RUN_FILES.socket),
     uffdPidFile: join(runDir, UFFD_RUN_FILES.pidFile),
+    uffdStatsFile: join(runDir, UFFD_RUN_FILES.statsFile),
     ...buildSnapshotPaths(join(directory, "snapshot")),
     vmIdentity: join(directory, "vm.json"),
     checkpointsDir: join(directory, "checkpoints"),
@@ -21961,18 +21966,19 @@ function parseKsmConfig(parsed) {
 }
 
 // packages/daemon/src/create-impd.ts
-import { readFileSync as readFileSync36 } from "fs";
+import { readFileSync as readFileSync38 } from "fs";
 import { release as release2 } from "os";
-import { join as join47 } from "path";
+import { join as join48 } from "path";
 // packages/daemon/package.json
 var package_default = {
   name: "@impz/daemon",
-  version: "6.4.2",
+  version: "6.6.0",
   private: true,
   description: "impd: the imp host daemon",
   type: "module",
   exports: {
     ".": "./src/index.ts",
+    "./read-text": "./src/platform/process/read-text.ts",
     "./real-clock": "./src/platform/process/real-clock.ts",
     "./testing": "./testing/index.ts",
     "./testing/build-stub-clock": "./testing/platform/build-stub-clock.ts",
@@ -24140,6 +24146,12 @@ function writeRegularFile(path, text) {
     closeSync2(fd);
   }
 }
+function createZeroedFile(path, sizeBytes) {
+  const fd = openRegularFile(path, constants.O_RDWR, 420);
+  ftruncateSync(fd, 0);
+  ftruncateSync(fd, sizeBytes);
+  return fd;
+}
 function readRegularFile(path) {
   const fd = openSync2(path, constants.O_RDONLY | SAFE_FLAGS);
   try {
@@ -37525,6 +37537,7 @@ async function createImpdFirewall(config, deps, secretFiles, plan) {
 }
 
 // packages/daemon/src/create-impd-imps.ts
+import { readFileSync as readFileSync25 } from "fs";
 import { availableParallelism } from "os";
 
 // packages/daemon/src/host-net/net/tap-bytes.ts
@@ -41112,7 +41125,8 @@ function createImpContext(deps) {
   const records = {
     config: deps.config,
     db: deps.db,
-    identity: deps.identity
+    identity: deps.identity,
+    readHostLoad: deps.readHostLoad
   };
   const clock = {
     now,
@@ -42545,6 +42559,11 @@ function readDiskMib(path) {
   }
 }
 
+// packages/daemon/src/imps/imps/format-page-handler.ts
+function formatPageHandler(stats) {
+  return stats === undefined ? "" : `; page handler faults=${String(stats.faults)} blocks=${String(stats.blocks)} serve=${String(stats.serveMs)}ms`;
+}
+
 // packages/daemon/src/imps/imps/pick-huge-pages.ts
 function pickHugePages(isOn, imp) {
   return isOn && imp.maxMemoryMib <= imp.memoryMib && imp.memoryMib % 2 === 0 ? "2M" : "None";
@@ -42626,10 +42645,11 @@ function makeWakeImpVm(deps) {
       return startAfterFailedWake(imp, paths, wrong);
     }
     const wakeMs = Math.round(performance.now() - started);
-    getImpdLogger("imps").with({ imp: imp.name }).info("woke pid {pid} in {wakeMs}ms {timings}", {
+    getImpdLogger("imps").with({ imp: imp.name }).info("woke pid {pid} in {wakeMs}ms {timings}{pageHandler}", {
       pid: String(woken.pid),
       wakeMs: String(wakeMs),
-      timings: formatTimings(woken.timings)
+      timings: formatTimings(woken.timings),
+      pageHandler: formatPageHandler(woken.pageHandler)
     });
     if (hugePages === "None") {
       writeHostPagesIdentity(imp, paths);
@@ -43204,10 +43224,11 @@ function probeSealedEntry(paths, path) {
   const entry = lstatSync3(path);
   const uffdSocket = join21(paths.runDir, UFFD_RUN_FILES.socket);
   const uffdPidFile = join21(paths.runDir, UFFD_RUN_FILES.pidFile);
+  const uffdStatsFile = join21(paths.runDir, UFFD_RUN_FILES.statsFile);
   if (path === paths.apiSocket || path === paths.vsockSocket || path === uffdSocket) {
     return entry.isSocket();
   }
-  return (path === paths.logFile || path === paths.pidFile || path === uffdPidFile) && entry.isFile() && entry.uid === IMPD_USER.uid && entry.nlink === 1;
+  return (path === paths.logFile || path === paths.pidFile || path === uffdPidFile || path === uffdStatsFile) && entry.isFile() && entry.uid === IMPD_USER.uid && entry.nlink === 1;
 }
 function setupImpdDir(directory) {
   setupRealDir(directory);
@@ -43252,6 +43273,16 @@ function readOwnerUid(path) {
 
 // packages/daemon/src/vm/vmm/uffd-handler.ts
 import { closeSync as closeSync10, existsSync as existsSync13, openSync as openSync8, rmSync as rmSync20 } from "fs";
+
+// packages/daemon/src/vm/vmm/uffd-stats-layout.ts
+var UFFD_STATS_OFFSETS = {
+  faults: 0,
+  blocks: 8,
+  serveNs: 16
+};
+var UFFD_STATS_BYTES = 24;
+
+// packages/daemon/src/vm/vmm/uffd-handler.ts
 var MEM_FILE_FD = 3;
 var SOCKET_WAIT_MS2 = 3000;
 async function startUffdHandler(plan) {
@@ -43264,11 +43295,13 @@ async function startUffdHandler(plan) {
     ...plan.jail === null ? [] : ["--uid", String(plan.jail.uid), "--gid", String(plan.jail.gid)]
   ];
   const memFd = openSync8(plan.memFile, "r");
+  const statsFd = createZeroedFile(paths.uffdStatsFile, UFFD_STATS_BYTES);
   const log = setupLogFile(paths.logFile);
   const child = Bun.spawn(buildSpawnArgv(command, plan.cgroup?.procsPath ?? null, null), {
-    stdio: ["ignore", log, log, memFd]
+    stdio: ["ignore", log, log, memFd, statsFd]
   });
   closeSync10(memFd);
+  closeSync10(statsFd);
   closeSync10(log);
   child.unref();
   writeRegularFile(paths.uffdPidFile, `${String(child.pid)}
@@ -43287,6 +43320,15 @@ function removeUffdFiles(paths) {
   rmSync20(paths.uffdSocket, { force: true });
   rmSync20(`${paths.uffdSocket}.new`, { force: true });
   rmSync20(paths.uffdPidFile, { force: true });
+  rmSync20(paths.uffdStatsFile, { force: true });
+}
+function readUffdStats(paths, readFile) {
+  const raw = readFile(paths.uffdStatsFile);
+  return {
+    faults: Number(raw.readBigUInt64LE(UFFD_STATS_OFFSETS.faults)),
+    blocks: Number(raw.readBigUInt64LE(UFFD_STATS_OFFSETS.blocks)),
+    serveMs: Math.round(Number(raw.readBigUInt64LE(UFFD_STATS_OFFSETS.serveNs)) / 1e6)
+  };
 }
 function readHandlerState(paths, procRoot = "/proc") {
   if (!existsSync13(paths.uffdPidFile)) {
@@ -43497,6 +43539,22 @@ ${readLogTail(plan.paths.logFile, 5)}`, step.fault, error);
   }
 }
 
+// packages/daemon/src/imps/imps/format-host-stall.ts
+var STALL_FIGURES = [
+  ["cpu", "cpuStallUs"],
+  ["io", "ioStallUs"],
+  ["memory", "memoryStallUs"],
+  ["steal", "stealUs"]
+];
+function formatHostStall(before, after) {
+  const figures = STALL_FIGURES.flatMap(([name, field]) => {
+    const startUs = before[field];
+    const endUs = after[field];
+    return startUs === null || endUs === null ? [] : [`${name}=${String(Math.round((endUs - startUs) / 1000))}ms`];
+  });
+  return figures.length === 0 ? "" : `; host stall ${figures.join(" ")}`;
+}
+
 // packages/daemon/src/imps/imps/start-cold-vm.ts
 var CLAIM_SEED_BYTES = 64;
 async function startColdVm(context, start) {
@@ -43552,11 +43610,12 @@ async function startColdVm(context, start) {
         }
       });
       context.templates?.reportRestored(template);
-      getImpdLogger("imps").with({ imp: imp.name }).info("restored boot template {key} as pid {pid} {timings}{guestSteps}", {
+      getImpdLogger("imps").with({ imp: imp.name }).info("restored boot template {key} as pid {pid} {timings}{guestSteps}{hostStall}", {
         key: template.key.slice(0, 12),
         pid: String(vm.pid),
         timings: formatTimings({ ...hostSteps, ...vm.timings }),
-        guestSteps: formatGuestSteps(vm.guestSteps)
+        guestSteps: formatGuestSteps(vm.guestSteps),
+        hostStall: formatHostStall(start.loadBefore, context.readHostLoad())
       });
       return vm;
     } catch (error) {
@@ -43589,10 +43648,11 @@ async function startColdVm(context, start) {
     isIdentityReset: imp.isIdentityResetPending,
     jail: context.findJailUser(imp)
   });
-  getImpdLogger("imps").with({ imp: imp.name }).info("booted pid {pid} {timings}{guestSteps}", {
+  getImpdLogger("imps").with({ imp: imp.name }).info("booted pid {pid} {timings}{guestSteps}{hostStall}", {
     pid: String(vm.pid),
     timings: formatTimings({ ...hostSteps, ...vm.timings }),
-    guestSteps: formatGuestSteps(vm.guestSteps)
+    guestSteps: formatGuestSteps(vm.guestSteps),
+    hostStall: formatHostStall(start.loadBefore, context.readHostLoad())
   });
   return vm;
 }
@@ -43673,6 +43733,7 @@ function createImpVmOps(host) {
       hugePagesMib: hugePages === "2M" ? imp.memoryMib : 0
     });
     const setupStarted = performance.now();
+    const loadBefore = context.readHostLoad();
     try {
       removeSnapshot(paths);
       await context.egress.requireImp(imp.id);
@@ -43690,6 +43751,7 @@ function createImpVmOps(host) {
         cgroup,
         hugePages,
         hostSteps,
+        loadBefore,
         diskReady
       });
       startCounting(context, imp, vm.pid);
@@ -44394,6 +44456,56 @@ function createImpService(deps, createWatchdog) {
   };
 }
 
+// packages/daemon/src/platform/process/read-host-load.ts
+import { join as join22 } from "path";
+
+// packages/daemon/src/platform/process/find-unexpected-read-code.ts
+var UNSUPPORTED_CODES = new Set(["ENOENT", "EOPNOTSUPP"]);
+function findUnexpectedReadCode(error) {
+  const code = error instanceof Error && "code" in error ? String(error.code) : "unknown";
+  return UNSUPPORTED_CODES.has(code) ? null : code;
+}
+
+// packages/daemon/src/platform/process/read-host-load.ts
+function readHostLoad(sources) {
+  const readProc = (...names) => readProcFile(sources, join22(sources.procRoot, ...names));
+  return {
+    cpuStallUs: parsePressureTotal(readProc("pressure", "cpu")),
+    ioStallUs: parsePressureTotal(readProc("pressure", "io")),
+    memoryStallUs: parsePressureTotal(readProc("pressure", "memory")),
+    stealUs: parseStealUs(readProc("stat"))
+  };
+}
+function readProcFile(sources, path) {
+  try {
+    return sources.readFile(path);
+  } catch (error) {
+    const code = findUnexpectedReadCode(error);
+    if (code !== null) {
+      sources.logger.warning("cannot read {path} for the host stall: {code}", { path, code });
+    }
+    return null;
+  }
+}
+function parsePressureTotal(pressure) {
+  const total = pressure === null ? undefined : /^some .*total=(?<us>\d+)$/mv.exec(pressure);
+  return total?.groups?.["us"] === undefined ? null : Number(total.groups["us"]);
+}
+var STEAL_FIELD = 8;
+var US_PER_TICK = 1e4;
+function parseStealUs(stat) {
+  const fields = stat?.split(`
+`).find((line) => line.startsWith("cpu "))?.split(/\s+/v);
+  const steal = fields?.[STEAL_FIELD];
+  return steal === undefined ? null : Number(steal) * US_PER_TICK;
+}
+
+// packages/daemon/src/platform/process/read-text.ts
+import { readFileSync as readFileSync22 } from "fs";
+function readText(path) {
+  return readFileSync22(path, "utf8");
+}
+
 // packages/daemon/src/platform/telemetry/imp-telemetry.ts
 import { ROOT_CONTEXT, metrics as metrics2, trace } from "@opentelemetry/api";
 var SPAN_NAMES = {
@@ -44770,12 +44882,12 @@ function createMemoryController(deps) {
 import {
   existsSync as existsSync14,
   mkdirSync as mkdirSync16,
-  readFileSync as readFileSync22,
+  readFileSync as readFileSync23,
   readdirSync as readdirSync8,
   rmdirSync as rmdirSync2,
   writeFileSync as writeFileSync5
 } from "fs";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 var PERIOD_US = 1e5;
 var MEMORY_MIN_OVERHEAD_MIB = 256;
 var MEMORY_OVERHEAD_DIVISOR = 8;
@@ -44803,18 +44915,18 @@ function parseOomKills(text) {
   return match?.groups === undefined ? null : Number(match.groups["count"]);
 }
 function createCpuCgroups(options) {
-  const imps = join22(options.root, "imps");
+  const imps = join23(options.root, "imps");
   const procRoot = options.procRoot ?? "/proc";
   const rmdir = options.rmdir ?? rmdirSync2;
   const sleep = options.sleep ?? Bun.sleep;
   const isEnforced = probeControllerDelegated(imps, "cpu");
   const isMemoryEnforced = isEnforced && probeControllerDelegated(imps, "memory");
-  const getDir = (impId) => join22(imps, impId);
+  const getDir = (impId) => join23(imps, impId);
   const guestMibs = new Map;
   const oomBaselines = new Map;
   const readOomKills = (impId) => {
     try {
-      const events = readFileSync22(join22(getDir(impId), "memory.events"), "utf8");
+      const events = readFileSync23(join23(getDir(impId), "memory.events"), "utf8");
       return parseOomKills(events);
     } catch {
       return null;
@@ -44824,8 +44936,8 @@ function createCpuCgroups(options) {
     oomBaselines.set(impId, readOomKills(impId) ?? 0);
   };
   const writeSettings = (impId, cpu, limit) => {
-    writeFileSync5(join22(getDir(impId), "cpu.weight"), String(cpu.weight));
-    writeFileSync5(join22(getDir(impId), "cpu.max"), formatCpuMax(limit));
+    writeFileSync5(join23(getDir(impId), "cpu.weight"), String(cpu.weight));
+    writeFileSync5(join23(getDir(impId), "cpu.max"), formatCpuMax(limit));
   };
   const writeMemory = (impId) => {
     const guestMib = guestMibs.get(impId);
@@ -44833,10 +44945,10 @@ function createCpuCgroups(options) {
       return;
     }
     const directory = getDir(impId);
-    writeFileSync5(join22(directory, "memory.max"), buildMemoryMax(guestMib));
-    writeFileSync5(join22(directory, "memory.high"), "max");
-    writeFileSync5(join22(directory, "memory.swap.max"), "0");
-    writeFileSync5(join22(directory, "memory.oom.group"), "1");
+    writeFileSync5(join23(directory, "memory.max"), buildMemoryMax(guestMib));
+    writeFileSync5(join23(directory, "memory.high"), "max");
+    writeFileSync5(join23(directory, "memory.swap.max"), "0");
+    writeFileSync5(join23(directory, "memory.oom.group"), "1");
   };
   const setup = (impId, cpu, memoryMib) => {
     if (!isEnforced) {
@@ -44858,7 +44970,7 @@ function createCpuCgroups(options) {
       return null;
     }
     return {
-      procsPath: join22(getDir(impId), "cgroup.procs"),
+      procsPath: join23(getDir(impId), "cgroup.procs"),
       liftLimit: () => {
         tryWrite(impId, "lift the limit", () => {
           writeSettings(impId, cpu, null);
@@ -44942,7 +45054,7 @@ function createCpuCgroups(options) {
     kill: (impId) => {
       if (isEnforced && existsSync14(getDir(impId))) {
         tryWrite(impId, "kill", () => {
-          writeFileSync5(join22(getDir(impId), "cgroup.kill"), "1");
+          writeFileSync5(join23(getDir(impId), "cgroup.kill"), "1");
         });
       }
     },
@@ -44953,7 +45065,7 @@ function createCpuCgroups(options) {
     },
     readCpuStat: (impId) => {
       try {
-        const stat = readFileSync22(join22(getDir(impId), "cpu.stat"), "utf8");
+        const stat = readFileSync23(join23(getDir(impId), "cpu.stat"), "utf8");
         return parseCpuStat(stat);
       } catch {
         return null;
@@ -44963,7 +45075,7 @@ function createCpuCgroups(options) {
 }
 function probeControllerDelegated(imps, controller) {
   try {
-    const delegated = readFileSync22(join22(imps, "cgroup.subtree_control"), "utf8");
+    const delegated = readFileSync23(join23(imps, "cgroup.subtree_control"), "utf8");
     return delegated.split(/\s+/u).includes(controller);
   } catch {
     return false;
@@ -44996,13 +45108,13 @@ function probeUffdDevice(path = "/dev/userfaultfd") {
 }
 
 // packages/daemon/src/vm/vmm/read-huge-page-pool.ts
-import { readFileSync as readFileSync23 } from "fs";
-import { join as join23 } from "path";
+import { readFileSync as readFileSync24 } from "fs";
+import { join as join24 } from "path";
 var HUGE_PAGE_MIB = 2;
 function readHugePagePool(sysRoot = "/sys") {
-  const directory = join23(sysRoot, "kernel", "mm", "hugepages", "hugepages-2048kB");
+  const directory = join24(sysRoot, "kernel", "mm", "hugepages", "hugepages-2048kB");
   try {
-    const readCount = (name) => Number(readFileSync23(join23(directory, name), "utf8").trim());
+    const readCount = (name) => Number(readFileSync24(join24(directory, name), "utf8").trim());
     const total = readCount("nr_hugepages");
     const free = readCount("free_hugepages") - readCount("resv_hugepages");
     if (!Number.isSafeInteger(total) || !Number.isSafeInteger(free)) {
@@ -45088,11 +45200,12 @@ var UFFD_WATCH_INTERVAL_MS = 100;
 var WAKE_AGENT_DEADLINE_MS = 1e4;
 var GUEST_MEMORY_TIMEOUTS = { requestMs: 1000, snapshotMs: 1000 };
 var UPTIME_PING_TIMEOUT_MS = 250;
-function createVmRunner(jails, options = {}) {
+function createVmRunner(jails, options) {
   const mergeWrapper = options.mergeWrapper ?? null;
   const sendUptimePing = options.sendUptimePing ?? sendPing;
   const procRoot = options.procRoot ?? "/proc";
   const createClient = options.createClient ?? createFirecrackerClient;
+  const readFile = options.readFile;
   const uffdHandlerBin = options.uffdHandlerBin ?? null;
   const uffdWatch = createUffdWatch({
     probeVmAlive: (pid, paths) => probeProcessAlive(pid, paths.apiSocket, procRoot),
@@ -45323,7 +45436,8 @@ ${readLogTail(plan.paths.logFile)}`, {
           firecrackerVersion,
           agentVersion: ping.version,
           timings: timer.marks,
-          bootId: ping.bootId
+          bootId: ping.bootId,
+          ...isUffd && { pageHandler: readUffdStats(plan.paths, readFile) }
         };
       } catch (error) {
         const reason = explainUffdFailure(plan.paths, procRoot, getErrorMessage(error));
@@ -45422,7 +45536,8 @@ function createImpdImps(config, deps, parts) {
     killCgroup: cgroups.kill
   }), {
     mergeWrapper: config.ksm?.execBin ?? null,
-    uffdHandlerBin: config.hugePages?.handlerBin ?? null
+    uffdHandlerBin: config.hugePages?.handlerBin ?? null,
+    readFile: readFileSync25
   });
   const {
     readVmRam,
@@ -45581,6 +45696,7 @@ function resolveImpBoundaries(boundaries) {
     kernelOops: boundaries.kernelOops ?? createKernelOopsWatch(),
     readThreadIds: boundaries.readThreadIds ?? ((pid) => readThreadIds(pid)),
     readNetBytes: boundaries.readNetBytes ?? ((tap) => readGuestNetBytes(tap)),
+    readHostLoad: boundaries.readHostLoad ?? (() => readHostLoad({ procRoot: "/proc", readFile: readText, logger: getImpdLogger("imps") })),
     ...boundaries.openTap !== undefined && { openTap: boundaries.openTap },
     ...boundaries.now !== undefined && { now: boundaries.now }
   };
@@ -45595,7 +45711,7 @@ function makeStandInVmRam(readRam) {
 
 // packages/daemon/src/imp-ops/moves/move-receiver.ts
 import { existsSync as existsSync16, rmSync as rmSync24 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 
 // packages/daemon/src/platform/db/probe-slot-free.ts
 async function probeSlotFree(db, slot, now) {
@@ -45920,7 +46036,7 @@ function readReceipt(receipt, secret) {
 // packages/daemon/src/imp-ops/moves/read-move-stream.ts
 import { mkdirSync as mkdirSync19, rmSync as rmSync23 } from "fs";
 import { open as open7 } from "fs/promises";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 import invariant5 from "tiny-invariant";
 
 // packages/daemon/src/imp-ops/moves/build-received-digest.ts
@@ -46545,7 +46661,7 @@ async function readMoveStream(deps, options) {
   const count = createByteCounter(row.bytes);
   const files = [];
   mkdirSync19(options.tempDir, { recursive: true, mode: 448 });
-  const temp = join24(options.tempDir, `${row.id}.part`);
+  const temp = join25(options.tempDir, `${row.id}.part`);
   const writeDisk = async (impId) => {
     if (header.streams !== null) {
       await writeMoveStreams(deps, {
@@ -46760,7 +46876,7 @@ async function requireMoveTicket(db, request) {
 // packages/daemon/src/imp-ops/moves/move-receiver.ts
 var STREAM_WINDOW_MS = 10 * 60 * 1000;
 function createMoveReceiver(deps) {
-  const tempDir = join25(deps.dataDir, "moves");
+  const tempDir = join26(deps.dataDir, "moves");
   const sessions = new Map;
   const writeTicketRow = async (name, bytes, fields, write = (row) => writeMoveTicket(deps.db, row)) => {
     const created = mintOpaqueToken(MOVE_TICKET_PREFIX);
@@ -47935,12 +48051,12 @@ function toPeerError2(procedure, error) {
 // packages/daemon/src/vm/storage/write-image-files.ts
 import { writeFileSync as writeFileSync6 } from "fs";
 import { copyFile } from "fs/promises";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 async function writeImageFiles(files, directory) {
-  const rootfs = join26(directory, "rootfs.ext4");
+  const rootfs = join27(directory, "rootfs.ext4");
   writeFileSync6(rootfs, "");
   await writeChangedBlocks(files.rootfsPath, rootfs);
-  await copyFile(files.configPath, join26(directory, "config.json"));
+  await copyFile(files.configPath, join27(directory, "config.json"));
 }
 
 // packages/daemon/src/create-impd-moves.ts
@@ -47980,7 +48096,7 @@ function createImpdMoves(config, deps, parts, hooks) {
 
 // packages/daemon/src/imps/images/template-service.ts
 import { copyFileSync as copyFileSync3, existsSync as existsSync17, statSync as statSync11, writeFileSync as writeFileSync7 } from "fs";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 
 // packages/daemon/src/imps/images/read-held-image.ts
 async function readHeldImage(db, name, at) {
@@ -48268,7 +48384,7 @@ function createTemplateService(deps) {
   });
   const writeConfig = async (imageId, directory) => {
     const image = await readImageById(deps.db, imageId);
-    const target = join27(directory, "config.json");
+    const target = join28(directory, "config.json");
     const config = image === undefined ? undefined : buildImagePaths(deps.config.dataDir, image.digest).config;
     if (config !== undefined && existsSync17(config)) {
       copyFileSync3(config, target);
@@ -48656,7 +48772,7 @@ function createImpdServices(config, deps, parts) {
 
 // packages/daemon/src/imps/images/build/create-image-builds.ts
 import { existsSync as existsSync19, mkdirSync as mkdirSync20, rmSync as rmSync25, statSync as statSync12 } from "fs";
-import { join as join29, posix as posix3 } from "path";
+import { join as join30, posix as posix3 } from "path";
 
 // packages/local-tar/src/extract-local.ts
 import tar from "tar-stream";
@@ -48664,7 +48780,7 @@ import * as z83 from "zod";
 // packages/local-tar/src/pack-build-context.ts
 import { existsSync as existsSync18 } from "fs";
 import { lstat, readFile as readFile4, readdir } from "fs/promises";
-import { join as join28, posix as posix2 } from "path";
+import { join as join29, posix as posix2 } from "path";
 import ignore from "@balena/dockerignore";
 
 // packages/local-tar/src/write-build-context.ts
@@ -48948,7 +49064,7 @@ class MissingDockerfileError extends Error {
   name = "MissingDockerfileError";
 }
 function listContextEntries(root, dockerfile) {
-  const found = listDockerfileCandidates(posix2.normalize(dockerfile)).find((candidate) => existsSync18(join28(root, candidate)));
+  const found = listDockerfileCandidates(posix2.normalize(dockerfile)).find((candidate) => existsSync18(join29(root, candidate)));
   if (found === undefined) {
     return Promise.reject(new MissingDockerfileError(`there is no ${dockerfile} in ${root}`));
   }
@@ -48960,8 +49076,8 @@ var ENTRY_KINDS = [
   ["file", "isFile"]
 ];
 async function listEntries(root, dockerfile) {
-  const ignoreName = existsSync18(join28(root, `${dockerfile}.dockerignore`)) ? `${dockerfile}.dockerignore` : ".dockerignore";
-  const patterns = existsSync18(join28(root, ignoreName)) ? await readFile4(join28(root, ignoreName), "utf8") : "";
+  const ignoreName = existsSync18(join29(root, `${dockerfile}.dockerignore`)) ? `${dockerfile}.dockerignore` : ".dockerignore";
+  const patterns = existsSync18(join29(root, ignoreName)) ? await readFile4(join29(root, ignoreName), "utf8") : "";
   const matcher = ignore().add(patterns);
   const hasExceptions = patterns.split(`
 `).some((line) => line.trim().startsWith("!"));
@@ -48971,7 +49087,7 @@ async function listEntries(root, dockerfile) {
     const entries = [];
     const children = await readdir(directory);
     for (const child of children.toSorted()) {
-      const path = join28(directory, child);
+      const path = join29(directory, child);
       const name = prefix === "" ? child : `${prefix}/${child}`;
       const stats = await lstat(path);
       const ignored = matcher.ignores(name) && name !== dockerfileName;
@@ -50026,7 +50142,7 @@ function planRootfsOverhead(treeBytes) {
 }
 
 // packages/daemon/src/imps/images/rootfs/unpack-export.ts
-import { readFileSync as readFileSync24 } from "fs";
+import { readFileSync as readFileSync26 } from "fs";
 var CAP_SETFCAP_BIT = 31n;
 var SETFCAP_HELP = "imp-host needs CAP_SETFCAP (docs/architecture/host.md#privileges)";
 var UNPACK_TAR_ARGS = [
@@ -50068,7 +50184,7 @@ function findXattrFailure(stderr) {
   });
   return failures.find((failure) => failure.missingSetfcap) ?? failures[0] ?? null;
 }
-function readSetfcapWarning(status = readFileSync24("/proc/self/status", "utf8")) {
+function readSetfcapWarning(status = readFileSync26("/proc/self/status", "utf8")) {
   const effective = /^CapEff:\s*(?<mask>[0-9a-f]+)$/mu.exec(status)?.groups?.["mask"] ?? "0";
   if (BigInt(`0x${effective}`) >> CAP_SETFCAP_BIT & 1n) {
     return null;
@@ -50492,7 +50608,7 @@ function createImageBuilds(deps, writer) {
       });
     }
     const uploadsDir = buildUploadsDir(deps.config.dataDir);
-    const tarPath = join29(uploadsDir, `${Bun.randomUUIDv7()}.tar`);
+    const tarPath = join30(uploadsDir, `${Bun.randomUUIDv7()}.tar`);
     mkdirSync20(uploadsDir, { recursive: true, mode: 448 });
     return deps.diskBudget.withRoom(tarBytes, async () => {
       try {
@@ -50649,7 +50765,7 @@ function buildImageRuntimeConfig(ociConfig) {
 
 // packages/daemon/src/imps/images/rootfs/create-image-writer.ts
 import { existsSync as existsSync20, mkdirSync as mkdirSync22, rmSync as rmSync27, statSync as statSync13, writeFileSync as writeFileSync8 } from "fs";
-import { join as join31 } from "path";
+import { join as join32 } from "path";
 
 // packages/daemon/src/imps/images/rootfs/read-oci-config.ts
 import * as z88 from "zod";
@@ -50669,13 +50785,13 @@ async function readOciConfig(ref, signal, run) {
 
 // packages/daemon/src/imps/images/rootfs/write-image-config.ts
 import { closeSync as closeSync11, constants as constants6, lstatSync as lstatSync5, mkdirSync as mkdirSync21, openSync as openSync9, rmSync as rmSync26, writeSync as writeSync3 } from "fs";
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 function writeImageConfig(root, contents) {
-  const etc = join30(root, "etc");
-  const directory = join30(etc, "imp");
+  const etc = join31(root, "etc");
+  const directory = join31(etc, "imp");
   createDirectory(etc, "/etc");
   createDirectory(directory, "/etc/imp");
-  const file = join30(directory, "image.json");
+  const file = join31(directory, "image.json");
   rmSync26(file, { recursive: true, force: true });
   const fd = openSync9(file, constants6.O_WRONLY | constants6.O_CREAT | constants6.O_EXCL | constants6.O_NOFOLLOW, 420);
   try {
@@ -50722,8 +50838,8 @@ function createImageWriter(deps) {
   const guestRootfsLock = buildKeyedMutex();
   const makeWorkDir = () => {
     const images = buildImagesDir(deps.config.dataDir);
-    const work = join31(images, `.build-${Bun.randomUUIDv7()}`);
-    const root = join31(work, "root");
+    const work = join32(images, `.build-${Bun.randomUUIDv7()}`);
+    const root = join32(work, "root");
     mkdirSync22(images, { recursive: true });
     mkdirSync22(work, { mode: 448 });
     mkdirSync22(root, { mode: 493 });
@@ -50734,7 +50850,7 @@ function createImageWriter(deps) {
     const usage = await readTreeUsage(root);
     const plan = planRootfs(usage);
     await deps.storage.createImage(digest, async (directory) => {
-      const image = join31(directory, "rootfs.ext4");
+      const image = join32(directory, "rootfs.ext4");
       await runChecked(["truncate", "-s", String(plan.bytes), image]);
       await runChecked([
         "mkfs.ext4",
@@ -50747,7 +50863,7 @@ function createImageWriter(deps) {
         root,
         image
       ]);
-      writeFileSync8(join31(directory, "config.json"), JSON.stringify(ociConfig ?? {}, null, 2));
+      writeFileSync8(join32(directory, "config.json"), JSON.stringify(ociConfig ?? {}, null, 2));
     });
     return readDiskUsage(buildImagePaths(deps.config.dataDir, digest).rootfs);
   };
@@ -51298,7 +51414,7 @@ async function runStreamed(argv, onStdout, signal) {
 
 // packages/daemon/src/vm/storage/count-tree-bytes.ts
 import { lstat as lstat3, readdir as readdir3 } from "fs/promises";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 async function countTreeBytes(root, deps = {}) {
   const readDir = deps.readDir ?? readDirEntries;
   const inodes = new Map;
@@ -51307,11 +51423,11 @@ async function countTreeBytes(root, deps = {}) {
     const entries = await readEntries2(readDir, directory);
     for (const entry of entries) {
       if (entry.isDirectory()) {
-        dirs.push(join32(directory, entry.name));
+        dirs.push(join33(directory, entry.name));
       }
     }
     const files = entries.filter((entry) => entry.isFile());
-    const stats = await Promise.all(files.map((entry) => readFileStats(join32(directory, entry.name))));
+    const stats = await Promise.all(files.map((entry) => readFileStats(join33(directory, entry.name))));
     for (const stat of stats) {
       if (stat !== undefined) {
         inodes.set(`${String(stat.dev)}:${String(stat.ino)}`, Math.max(0, stat.blocks - 1) * 512);
@@ -51554,12 +51670,12 @@ function createTailnetAccess(config, deps, readStatus) {
 }
 
 // packages/daemon/src/identity/token.ts
-import { existsSync as existsSync21, readFileSync as readFileSync25, writeFileSync as writeFileSync9 } from "fs";
-import { join as join33 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync27, writeFileSync as writeFileSync9 } from "fs";
+import { join as join34 } from "path";
 function loadOrCreateToken(dataDir) {
-  const path = join33(dataDir, "token");
+  const path = join34(dataDir, "token");
   if (existsSync21(path)) {
-    return readFileSync25(path, "utf8").trim();
+    return readFileSync27(path, "utf8").trim();
   }
   const token = mintSecret();
   writeFileSync9(path, `${token}
@@ -51681,13 +51797,13 @@ import { basename as basename4 } from "path";
 
 // packages/daemon/src/vm/storage/remove-unused-system-drives.ts
 import { readdirSync as readdirSync9, rmSync as rmSync28 } from "fs";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 function removeUnusedSystemDrives(dataDir, keep) {
   const directory = buildSystemDrivesDir(dataDir);
   const removed = [];
   for (const name of readNames(directory)) {
     if (!keep.has(name)) {
-      rmSync28(join34(directory, name), { force: true });
+      rmSync28(join35(directory, name), { force: true });
       removed.push(name);
     }
   }
@@ -52896,13 +53012,13 @@ function createPublicRecordsLink() {
 
 // packages/daemon/src/network/tailnet-names/host-id.ts
 import { randomBytes as randomBytes11 } from "crypto";
-import { existsSync as existsSync22, mkdirSync as mkdirSync23, readFileSync as readFileSync26, writeFileSync as writeFileSync10 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync22, mkdirSync as mkdirSync23, readFileSync as readFileSync28, writeFileSync as writeFileSync10 } from "fs";
+import { join as join36 } from "path";
 function loadOrCreateHostId(dataDir) {
-  const directory = join35(dataDir, "tailnet-names");
-  const path = join35(directory, "host-id");
+  const directory = join36(dataDir, "tailnet-names");
+  const path = join36(directory, "host-id");
   if (existsSync22(path)) {
-    return readFileSync26(path, "utf8").trim();
+    return readFileSync28(path, "utf8").trim();
   }
   mkdirSync23(directory, { recursive: true });
   const id = randomBytes11(16).toString("hex");
@@ -52912,7 +53028,7 @@ function loadOrCreateHostId(dataDir) {
 }
 
 // packages/daemon/src/network/tailnet-names/oauth-credential.ts
-import { readFileSync as readFileSync27, statSync as statSync14 } from "fs";
+import { readFileSync as readFileSync29, statSync as statSync14 } from "fs";
 import * as z92 from "zod";
 var CredentialSchema = z92.object({ clientId: z92.string().min(1), clientSecret: z92.string().min(1) });
 function readOAuthCredential(path) {
@@ -52928,7 +53044,7 @@ function readOAuthCredential(path) {
 }
 function readJson(path) {
   try {
-    return JSON.parse(readFileSync27(path, "utf8"));
+    return JSON.parse(readFileSync29(path, "utf8"));
   } catch {
     return null;
   }
@@ -53325,7 +53441,7 @@ async function startOtlpExport(env, version) {
 }
 
 // packages/daemon/src/network/https/wire-https-service.ts
-import { readFileSync as readFileSync29 } from "fs";
+import { readFileSync as readFileSync31 } from "fs";
 
 // packages/daemon/src/platform/db/exposure.ts
 async function readPublicImp(db, name) {
@@ -53520,8 +53636,8 @@ function formatAcmeError(error) {
 }
 
 // packages/daemon/src/network/https/acme/cert-store.ts
-import { existsSync as existsSync23, mkdirSync as mkdirSync24, readFileSync as readFileSync28, rmSync as rmSync29 } from "fs";
-import { join as join36 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync24, readFileSync as readFileSync30, rmSync as rmSync29 } from "fs";
+import { join as join37 } from "path";
 import * as z95 from "zod";
 var AttemptStateSchema = z95.object({
   failures: z95.int().nonnegative(),
@@ -53532,11 +53648,11 @@ var AccountSchema = z95.object({ directoryUrl: z95.string(), url: z95.string(),
 var LegacyAccountSchema = z95.object({ directoryUrl: z95.string(), url: z95.string() });
 var NO_ATTEMPTS = { failures: 0, lastAttemptAt: null, lastError: null };
 function createCertStore(dataDir) {
-  const directory = join36(dataDir, "tls");
-  const certificatePath = join36(directory, "certificate.pem");
-  const attemptsPath = join36(directory, "attempts.json");
-  const accountPath = join36(directory, "account.json");
-  const legacyKeyPath = join36(directory, "account.key");
+  const directory = join37(dataDir, "tls");
+  const certificatePath = join37(directory, "certificate.pem");
+  const attemptsPath = join37(directory, "attempts.json");
+  const accountPath = join37(directory, "account.json");
+  const legacyKeyPath = join37(directory, "account.key");
   const warned = { account: false };
   const write = (path, content) => {
     mkdirSync24(directory, { recursive: true, mode: 448 });
@@ -53602,7 +53718,7 @@ ${certificate.chainPem.trimEnd()}
   };
 }
 function readIfExists(path) {
-  return existsSync23(path) ? readFileSync28(path, "utf8") : null;
+  return existsSync23(path) ? readFileSync30(path, "utf8") : null;
 }
 function parseJson(text) {
   try {
@@ -54408,7 +54524,7 @@ function wireHttpsService(options) {
   const issue = createAcmeIssuer({
     directoryUrl: config.acmeDirectory,
     email: config.acmeEmail,
-    caPem: config.acmeCaFile === null ? null : readFileSync29(config.acmeCaFile, "utf8"),
+    caPem: config.acmeCaFile === null ? null : readFileSync31(config.acmeCaFile, "utf8"),
     store,
     dns
   });
@@ -54995,17 +55111,17 @@ function buildTooMany() {
 
 // packages/daemon/src/surface/ssh/host-key.ts
 var import_ssh22 = __toESM(require_lib2(), 1);
-import { existsSync as existsSync24, mkdirSync as mkdirSync25, readFileSync as readFileSync30, writeFileSync as writeFileSync11 } from "fs";
-import { join as join37 } from "path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync25, readFileSync as readFileSync32, writeFileSync as writeFileSync11 } from "fs";
+import { join as join38 } from "path";
 function setupSshDir(dataDir) {
-  const directory = join37(dataDir, "ssh");
+  const directory = join38(dataDir, "ssh");
   mkdirSync25(directory, { recursive: true, mode: 448 });
   return directory;
 }
 function loadOrCreateHostKey(sshDir) {
-  const path = join37(sshDir, "host_key");
+  const path = join38(sshDir, "host_key");
   if (existsSync24(path)) {
-    return readFileSync30(path, "utf8");
+    return readFileSync32(path, "utf8");
   }
   const pair = generateEd25519Key();
   writeFileSync11(path, pair.private, { mode: 384, flag: "wx" });
@@ -56170,8 +56286,8 @@ async function stopImpd(parts, options) {
 }
 
 // packages/daemon/src/vm/storage/create-storage-backend.ts
-import { existsSync as existsSync31, readFileSync as readFileSync34, readdirSync as readdirSync14, writeFileSync as writeFileSync14 } from "fs";
-import { join as join46 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync36, readdirSync as readdirSync14, writeFileSync as writeFileSync14 } from "fs";
+import { join as join47 } from "path";
 
 // packages/daemon/src/vm/storage/xfs-backend.ts
 import {
@@ -56184,7 +56300,7 @@ import {
   statfsSync as statfsSync2,
   writeFileSync as writeFileSync12
 } from "fs";
-import { basename as basename6, dirname as dirname13, join as join41 } from "path";
+import { basename as basename6, dirname as dirname13, join as join42 } from "path";
 
 // packages/daemon/src/vm/storage/count-owner-bytes.ts
 function countOwnerBytes(files) {
@@ -56241,13 +56357,13 @@ import {
   copyFileSync as copyFileSync4,
   existsSync as existsSync25,
   mkdirSync as mkdirSync26,
-  readFileSync as readFileSync31,
+  readFileSync as readFileSync33,
   readdirSync as readdirSync10,
   renameSync as renameSync6,
   rmSync as rmSync30,
   statSync as statSync15
 } from "fs";
-import { basename as basename5, dirname as dirname11, join as join38 } from "path";
+import { basename as basename5, dirname as dirname11, join as join39 } from "path";
 import * as z97 from "zod";
 var CopiesSchema = z97.record(z97.string(), z97.object({ ino: z97.string(), ctimeNs: z97.string(), size: z97.string() }));
 function createXfsBackups(ctx) {
@@ -56255,7 +56371,7 @@ function createXfsBackups(ctx) {
   const freshCopies = new Set;
   const readCopies = () => {
     try {
-      return CopiesSchema.parse(JSON.parse(readFileSync31(backup.copies, "utf8")));
+      return CopiesSchema.parse(JSON.parse(readFileSync33(backup.copies, "utf8")));
     } catch {
       return {};
     }
@@ -56278,7 +56394,7 @@ function createXfsBackups(ctx) {
   return {
     createBackupCopy: async (impId, _runId, options) => {
       const source = ctx.resolveImpPaths(impId).disk;
-      const target = join38(backup.tree, BACKUP_TREE.buildDisk(impId));
+      const target = join39(backup.tree, BACKUP_TREE.buildDisk(impId));
       const stats = statSync15(source, { bigint: true });
       const record = {
         ino: String(stats.ino),
@@ -56306,34 +56422,34 @@ function createXfsBackups(ctx) {
       const checkpointIds = new Set;
       const imageDigests = new Set;
       for (const imp of request.imps) {
-        if (!existsSync25(join38(backup.tree, BACKUP_TREE.buildDisk(imp.impId)))) {
+        if (!existsSync25(join39(backup.tree, BACKUP_TREE.buildDisk(imp.impId)))) {
           continue;
         }
         impIds.add(imp.impId);
         for (const checkpointId of imp.checkpointIds) {
-          const isCopied = await createTreeClone(ctx.buildCheckpointDisk(imp.impId, checkpointId), join38(backup.tree, BACKUP_TREE.buildCheckpointDisk(imp.impId, checkpointId)));
+          const isCopied = await createTreeClone(ctx.buildCheckpointDisk(imp.impId, checkpointId), join39(backup.tree, BACKUP_TREE.buildCheckpointDisk(imp.impId, checkpointId)));
           if (isCopied) {
             checkpointIds.add(checkpointId);
           }
         }
-        removeUnlisted(join38(backup.tree, BACKUP_TREE.buildImpDir(imp.impId), "checkpoints"), new Set(imp.checkpointIds.filter((id) => checkpointIds.has(id))));
+        removeUnlisted(join39(backup.tree, BACKUP_TREE.buildImpDir(imp.impId), "checkpoints"), new Set(imp.checkpointIds.filter((id) => checkpointIds.has(id))));
       }
       for (const digest of request.imageDigests) {
         const source = buildImagePaths(ctx.dataDir, digest);
-        const directory = join38(backup.tree, BACKUP_TREE.buildImageDir(digest));
-        const isCopied = await createTreeClone(source.rootfs, join38(directory, "rootfs.ext4"));
+        const directory = join39(backup.tree, BACKUP_TREE.buildImageDir(digest));
+        const isCopied = await createTreeClone(source.rootfs, join39(directory, "rootfs.ext4"));
         if (isCopied) {
-          copyFileSync4(source.config, join38(directory, "config.json"));
+          copyFileSync4(source.config, join39(directory, "config.json"));
           imageDigests.add(digest);
         }
       }
-      removeUnlisted(join38(backup.tree, "imps"), impIds);
-      removeUnlisted(join38(backup.tree, "images"), new Set([...imageDigests].map((digest) => basename5(BACKUP_TREE.buildImageDir(digest)))));
+      removeUnlisted(join39(backup.tree, "imps"), impIds);
+      removeUnlisted(join39(backup.tree, "images"), new Set([...imageDigests].map((digest) => basename5(BACKUP_TREE.buildImageDir(digest)))));
       const copies = readCopies();
       writeCopies(Object.fromEntries(Object.entries(copies).filter(([id]) => impIds.has(id))));
       const removeFreshCopies = () => {
         for (const impId of freshCopies) {
-          rmSync30(join38(backup.tree, BACKUP_TREE.buildDisk(impId)), { force: true });
+          rmSync30(join39(backup.tree, BACKUP_TREE.buildDisk(impId)), { force: true });
         }
         freshCopies.clear();
         return Promise.resolve();
@@ -56345,18 +56461,18 @@ function createXfsBackups(ctx) {
 function removeUnlisted(directory, keep) {
   const names = existsSync25(directory) ? readdirSync10(directory) : [];
   for (const name of names.filter((entry) => !keep.has(entry))) {
-    rmSync30(join38(directory, name), { recursive: true, force: true });
+    rmSync30(join39(directory, name), { recursive: true, force: true });
   }
 }
 
 // packages/daemon/src/vm/storage/loop-backing-file.ts
-import { readFileSync as readFileSync32, realpathSync, statfsSync } from "fs";
-import { dirname as dirname12, join as join39 } from "path";
+import { readFileSync as readFileSync34, realpathSync, statfsSync } from "fs";
+import { dirname as dirname12, join as join40 } from "path";
 var HOST_DIRS = { procDir: "/proc", sysDir: "/sys" };
 function readLoopBackingFile(directory, hostDirs = HOST_DIRS) {
   try {
     const target = realpathSync(directory);
-    const mountInfo = readFileSync32(join39(hostDirs.procDir, "self", "mountinfo"), "utf8");
+    const mountInfo = readFileSync34(join40(hostDirs.procDir, "self", "mountinfo"), "utf8");
     for (const line of mountInfo.split(`
 `)) {
       const [mounts = "", fields = ""] = line.split(" - ");
@@ -56364,8 +56480,8 @@ function readLoopBackingFile(directory, hostDirs = HOST_DIRS) {
       const [, source = ""] = fields.split(" ");
       const loop = /^\/dev\/(?<name>loop\d+)$/u.exec(source)?.groups?.["name"];
       if (mountPoint === target && loop !== undefined) {
-        const backing = join39(hostDirs.sysDir, "block", loop, "loop", "backing_file");
-        return readFileSync32(backing, "utf8").trim();
+        const backing = join40(hostDirs.sysDir, "block", loop, "loop", "backing_file");
+        return readFileSync34(backing, "utf8").trim();
       }
     }
   } catch {}
@@ -56386,7 +56502,7 @@ function readLoopHostFreeBytes(directory, hostDirs = HOST_DIRS) {
 
 // packages/daemon/src/vm/storage/orphan-files.ts
 import { existsSync as existsSync26, readdirSync as readdirSync11, statSync as statSync16 } from "fs";
-import { join as join40 } from "path";
+import { join as join41 } from "path";
 function probeHoldingFiles(directory) {
   return existsSync26(directory) && readdirSync11(directory, { recursive: true, withFileTypes: true }).some((entry) => !entry.isDirectory());
 }
@@ -56394,7 +56510,7 @@ function listFilesUnder(directory) {
   if (!existsSync26(directory)) {
     return [];
   }
-  return readdirSync11(directory, { recursive: true, withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => join40(entry.parentPath, entry.name));
+  return readdirSync11(directory, { recursive: true, withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => join41(entry.parentPath, entry.name));
 }
 function readDirectoryOrphan(kind, id, directory, snapshots) {
   const birth = statSync16(directory).birthtimeMs;
@@ -56420,7 +56536,7 @@ function createXfsBackend(deps) {
   const cloneFile = deps.cloneFile ?? createReflinkClone;
   const readFileExtents = deps.readFileExtents ?? readExtents;
   const resolveImpPaths = (impId) => buildImpPaths(deps.dataDir, impId);
-  const buildCheckpointDisk = (impId, checkpointId) => join41(resolveImpPaths(impId).checkpointsDir, checkpointId, "disk.ext4");
+  const buildCheckpointDisk = (impId, checkpointId) => join42(resolveImpPaths(impId).checkpointsDir, checkpointId, "disk.ext4");
   const getSourceFile = (source) => {
     if (source.kind === "image") {
       return buildImagePaths(deps.dataDir, source.digest).rootfs;
@@ -56435,7 +56551,7 @@ function createXfsBackend(deps) {
   };
   const createImage = async (digest, write) => {
     const paths = buildImagePaths(deps.dataDir, digest);
-    const staged = join41(buildImagesDir(deps.dataDir), `${STAGING_PREFIX}${Bun.randomUUIDv7()}`);
+    const staged = join42(buildImagesDir(deps.dataDir), `${STAGING_PREFIX}${Bun.randomUUIDv7()}`);
     mkdirSync27(staged, { recursive: true });
     try {
       await write(staged);
@@ -56456,13 +56572,13 @@ function createXfsBackend(deps) {
       return listEntries2(directory).map((id) => ({
         kind: "checkpoint",
         id,
-        directory: join41(directory, id)
+        directory: join42(directory, id)
       }));
     }).filter((checkpoint) => !live.checkpointIds.has(checkpoint.id));
     const unknownImages = listEntries2(buildImagesDir(deps.dataDir)).filter((name) => !name.startsWith(".") && !liveDigests.has(name)).map((name) => ({
       kind: "image",
       id: name,
-      directory: join41(buildImagesDir(deps.dataDir), name)
+      directory: join42(buildImagesDir(deps.dataDir), name)
     }));
     const unknownImps = impIds.filter((impId) => !live.impIds.has(impId)).map((impId) => ({
       kind: "imp",
@@ -56482,14 +56598,14 @@ function createXfsBackend(deps) {
   };
   const removeLeftover = (dropped, live) => {
     if (dropped.kind === "image") {
-      rmSync31(join41(buildImagesDir(deps.dataDir), dropped.id), { recursive: true, force: true });
+      rmSync31(join42(buildImagesDir(deps.dataDir), dropped.id), { recursive: true, force: true });
     }
     if (dropped.kind === "imp") {
       rmSync31(resolveImpPaths(dropped.id).directory, { recursive: true, force: true });
     }
     if (dropped.kind === "checkpoint") {
       for (const impId of live.impIds) {
-        rmSync31(join41(resolveImpPaths(impId).checkpointsDir, dropped.id), {
+        rmSync31(join42(resolveImpPaths(impId).checkpointsDir, dropped.id), {
           recursive: true,
           force: true
         });
@@ -56504,7 +56620,7 @@ function createXfsBackend(deps) {
   const listOtherFiles = () => {
     const images = listEntries2(buildImagesDir(deps.dataDir)).filter((name) => !name.startsWith(".")).map((name) => ({
       owner: `image:${name}`,
-      path: join41(buildImagesDir(deps.dataDir), name, "rootfs.ext4")
+      path: join42(buildImagesDir(deps.dataDir), name, "rootfs.ext4")
     }));
     const tree = listFilesUnder(backup.tree).map((path) => ({ owner: "backup", path }));
     return [...images, ...tree].filter((file) => existsSync27(file.path));
@@ -56512,7 +56628,7 @@ function createXfsBackend(deps) {
   const usageState = { resumeImpId: null };
   const setupReserveFile = async () => {
     const bytes = deps.reserveFileBytes ?? 0;
-    const file = join41(deps.dataDir, "reserve");
+    const file = join42(deps.dataDir, "reserve");
     if (bytes === 0 || existsSync27(file)) {
       return;
     }
@@ -56542,7 +56658,7 @@ function createXfsBackend(deps) {
     start: (live) => {
       const imagesDir = buildImagesDir(deps.dataDir);
       for (const name of listEntries2(imagesDir).filter((entry) => entry.startsWith("."))) {
-        rmSync31(join41(imagesDir, name), { recursive: true, force: true });
+        rmSync31(join42(imagesDir, name), { recursive: true, force: true });
       }
       const swept = removeUnnamed(live, { isDryRun: false, isOrphans: false });
       printSweep(getImpdLogger("storage"), swept, "each");
@@ -56564,7 +56680,7 @@ function createXfsBackend(deps) {
     receiveMoveSnapshots: () => Promise.reject(new Error("xfs: only a ZFS host receives ZFS streams")),
     createImage,
     createImageFromImp: (digest, impId, steps) => createImage(digest, async (directory) => {
-      await steps.hold(() => cloneFile(resolveImpPaths(impId).disk, join41(directory, "rootfs.ext4")));
+      await steps.hold(() => cloneFile(resolveImpPaths(impId).disk, join42(directory, "rootfs.ext4")));
       await steps.write(directory);
     }),
     removeImage: (digest) => {
@@ -56706,8 +56822,8 @@ function isSharedExtent(extent) {
 }
 
 // packages/daemon/src/vm/storage/zfs/zfs-backend.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync28, readFileSync as readFileSync33, rmdirSync as rmdirSync3, writeFileSync as writeFileSync13 } from "fs";
-import { join as join45 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync28, readFileSync as readFileSync35, rmdirSync as rmdirSync3, writeFileSync as writeFileSync13 } from "fs";
+import { join as join46 } from "path";
 
 // packages/daemon/src/platform/process/run-stream.ts
 function createStreamRunner() {
@@ -56996,7 +57112,7 @@ function formatUiomoveWarning(version) {
 
 // packages/daemon/src/vm/storage/zfs/create-zfs-backups.ts
 import { rmSync as rmSync32 } from "fs";
-import { dirname as dirname14, join as join42 } from "path";
+import { dirname as dirname14, join as join43 } from "path";
 function createZfsBackups(ctx) {
   return {
     createBackupCopy: (impId, runId) => ctx.runSnapshot(() => ctx.zfs.snapshot(`${ctx.buildDiskName(impId)}@bk-${runId}-${impId}`)),
@@ -57023,7 +57139,7 @@ function createZfsBackups(ctx) {
         ctx.startReclaim();
       };
       const createTreeClone = async (snapshot, name, relativeDir) => {
-        const directory = join42(tree, relativeDir);
+        const directory = join43(tree, relativeDir);
         await ctx.zfs.clone(snapshot, name, { readonly: "on" });
         clones.push({ name, directory });
         await ctx.setupMount(name, directory, true);
@@ -57033,8 +57149,8 @@ function createZfsBackups(ctx) {
         if (mounted !== undefined) {
           throw new Error(`zfs: ${mounted} in the backup tree is still mounted`);
         }
-        rmSync32(join42(tree, "imps"), { recursive: true, force: true });
-        rmSync32(join42(tree, "images"), { recursive: true, force: true });
+        rmSync32(join43(tree, "imps"), { recursive: true, force: true });
+        rmSync32(join43(tree, "images"), { recursive: true, force: true });
         const entries = await ctx.listAll();
         for (const imp of request.imps) {
           const copy = entries.find((entry) => entry.type === "snapshot" && entry.name.endsWith(`@bk-${request.runId}-${imp.impId}`));
@@ -57167,7 +57283,7 @@ function createZfsCheckpoints(ctx) {
 }
 
 // packages/daemon/src/vm/storage/zfs/create-zfs-moves.ts
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 function createZfsMoves(ctx) {
   const openMoveFiles = async (snapshots, removeMoveSnapshot) => {
     const moveId = Bun.randomUUIDv7();
@@ -57196,7 +57312,7 @@ function createZfsMoves(ctx) {
       await removeClones();
       throw error;
     }
-    const paths = clones.map((clone) => join43(clone.directory, ctx.rootfsFile));
+    const paths = clones.map((clone) => join44(clone.directory, ctx.rootfsFile));
     return {
       kind: "files",
       checkpointPaths: paths.slice(0, -1),
@@ -57452,7 +57568,7 @@ function createZfsReclaim(ctx) {
 
 // packages/daemon/src/vm/storage/zfs/create-zfs-sweep.ts
 import { existsSync as existsSync28, readdirSync as readdirSync13, rmSync as rmSync33 } from "fs";
-import { join as join44 } from "path";
+import { join as join45 } from "path";
 var FORK_SNAPSHOT = /@fork-[^@]+$/u;
 var BACKUP_SNAPSHOT = /@bk-[^@]+$/u;
 var MOVE_SNAPSHOT = /@mv-[^@]+$/u;
@@ -57477,10 +57593,10 @@ function createZfsSweep(ctx) {
     const orphanCheckpoints = isOrphans ? [] : unmarked.filter((entry) => !isOnOrphan(entry) && isOrphanCheckpoint(entry));
     const keptDisks = isOrphans ? [] : unknownDisks;
     const keptImpIds = new Set(keptDisks.map((disk) => getChildId(disk.name, ctx.datasets.disks)));
-    const listUnknownDirs = (kind, parent) => (existsSync28(parent) ? readdirSync13(parent).toSorted() : []).filter((id) => !live.impIds.has(id) && !keptImpIds.has(id)).map((id) => ({ kind, id, directory: join44(parent, id) }));
+    const listUnknownDirs = (kind, parent) => (existsSync28(parent) ? readdirSync13(parent).toSorted() : []).filter((id) => !live.impIds.has(id) && !keptImpIds.has(id)).map((id) => ({ kind, id, directory: join45(parent, id) }));
     const unknownDirs = [
       ...listUnknownDirs("imp", buildImpsDir(ctx.dataDir)),
-      ...listUnknownDirs("memory", join44(ctx.dataDir, "mem"))
+      ...listUnknownDirs("memory", join45(ctx.dataDir, "mem"))
     ];
     const probeDirDropped = (entry) => isOrphans || !probeHoldingFiles(entry.directory);
     const droppedDirs = unknownDirs.filter((entry) => probeDirDropped(entry));
@@ -57569,7 +57685,7 @@ function createZfsSweep(ctx) {
       }
     }
     for (const impId of plan.memDirs) {
-      rmSync33(join44(ctx.dataDir, "mem", impId), { recursive: true, force: true });
+      rmSync33(join45(ctx.dataDir, "mem", impId), { recursive: true, force: true });
     }
     return { dropped: toDropped(plan), kept };
   };
@@ -57657,13 +57773,13 @@ function createZfsBackend(deps) {
   const buildDiskName = (impId) => `${datasets.disks}/${impId}`;
   const buildImageName = (digest) => `${datasets.images}/${toDigestHex(digest)}`;
   const buildRestoreName = (impId) => `${datasets.staging}/restore-${impId}`;
-  const buildDiskDir = (impId) => join45(buildImpPaths(deps.dataDir, impId).directory, "disk");
+  const buildDiskDir = (impId) => join46(buildImpPaths(deps.dataDir, impId).directory, "disk");
   const buildImageDir = (digest) => buildImagePaths(deps.dataDir, digest).directory;
-  const buildStagingDir = (name) => join45(deps.dataDir, "staging", name.slice(datasets.staging.length + 1));
+  const buildStagingDir = (name) => join46(deps.dataDir, "staging", name.slice(datasets.staging.length + 1));
   const resolveImpPaths = (impId) => ({
     ...buildImpPaths(deps.dataDir, impId),
-    disk: join45(buildDiskDir(impId), ROOTFS_FILE),
-    ...buildSnapshotPaths(join45(deps.dataDir, "mem", impId))
+    disk: join46(buildDiskDir(impId), ROOTFS_FILE),
+    ...buildSnapshotPaths(join46(deps.dataDir, "mem", impId))
   });
   const listAll = () => zfs.list(deps.root);
   const setupMount = async (name, directory, isReadOnly = false) => {
@@ -57806,7 +57922,7 @@ function createZfsBackend(deps) {
         throw new Error(`zfs: ${deps.root} is not mounted on ${deps.dataDir} (host/scripts/setup-storage.sh mounts it)`);
       }
       await createMissingDatasets();
-      await setupMount(datasets.mem, join45(deps.dataDir, "mem"));
+      await setupMount(datasets.mem, join46(deps.dataDir, "mem"));
       await resolveStaging();
       const swept = await sweep.removeLeftovers(live, { isDryRun: false, isOrphans: false });
       printSweep(getImpdLogger("storage"), swept, "each");
@@ -57891,7 +58007,7 @@ function createZfsBackend(deps) {
           await zfs.create(target);
           await setupMount(target, buildDiskDir(impId));
         });
-        writeFileSync13(join45(buildDiskDir(impId), ROOTFS_FILE), "");
+        writeFileSync13(join46(buildDiskDir(impId), ROOTFS_FILE), "");
         return;
       }
       await runSerial(async () => {
@@ -57968,7 +58084,7 @@ function createZfsBackend(deps) {
 }
 function readZfsModuleVersion() {
   try {
-    return readFileSync33("/sys/module/zfs/version", "utf8").trim();
+    return readFileSync35("/sys/module/zfs/version", "utf8").trim();
   } catch {
     return null;
   }
@@ -58011,14 +58127,14 @@ function createBackend(config, boundaries) {
   });
 }
 function checkStorageMarker(dataDir, kind) {
-  const marker = join46(dataDir, MARKER_FILE);
-  const recorded = existsSync31(marker) ? readFileSync34(marker, "utf8").trim() : readUnmarked(dataDir);
+  const marker = join47(dataDir, MARKER_FILE);
+  const recorded = existsSync31(marker) ? readFileSync36(marker, "utf8").trim() : readUnmarked(dataDir);
   if (recorded !== null && recorded !== kind) {
     throw new Error(`${dataDir} holds ${recorded} storage, but IMP_STORAGE_BACKEND is ${kind}; moving imps between backends is not supported`);
   }
 }
 function writeStorageMarker(dataDir, kind) {
-  const marker = join46(dataDir, MARKER_FILE);
+  const marker = join47(dataDir, MARKER_FILE);
   if (!existsSync31(marker)) {
     writeFileSync14(marker, `${kind}
 `);
@@ -58031,7 +58147,7 @@ function readUnmarked(dataDir) {
 }
 
 // packages/daemon/src/vm/storage/setup-system-files.ts
-import { existsSync as existsSync32, mkdirSync as mkdirSync29, readFileSync as readFileSync35 } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync29, readFileSync as readFileSync37 } from "fs";
 import { dirname as dirname15 } from "path";
 
 // packages/daemon/src/vm/storage/system-file-info.ts
@@ -58067,7 +58183,7 @@ async function setupSystemFiles(config) {
     const missing = config.kernelSource === null ? " and no source is configured" : "";
     throw new Error(`${kernelSource} does not exist${missing}`);
   }
-  const kernel = readFileSync35(kernelSource);
+  const kernel = readFileSync37(kernelSource);
   const guestKernel = readKernelInfo(kernel);
   if (config.kernelSource !== null && !probeContent(config.kernelPath, kernel)) {
     writeCopy(config.kernelSource, config.kernelPath);
@@ -58087,7 +58203,7 @@ async function setupSystemFiles(config) {
   };
 }
 function probeContent(path, content) {
-  return existsSync32(path) && Buffer.from(content).equals(readFileSync35(path));
+  return existsSync32(path) && Buffer.from(content).equals(readFileSync37(path));
 }
 function writeCopy(source, target) {
   mkdirSync29(dirname15(target), { recursive: true });
@@ -58139,7 +58255,7 @@ async function startImpdParts(config, boundaries, plan) {
     }
     return files;
   });
-  const db = await runStep("database", () => boundaries.db ?? openDatabase(join47(config.dataDir, "db", "imp.sqlite")));
+  const db = await runStep("database", () => boundaries.db ?? openDatabase(join48(config.dataDir, "db", "imp.sqlite")));
   plan.db = boundaries.db === undefined ? db : null;
   const kernelOops = boundaries.imps?.kernelOops ?? createKernelOopsWatch();
   const storage = boundaries.storage ?? createStorageBackend(config, { zfs: { isKernelOopsed: kernelOops.isOopsed } });
@@ -58246,7 +58362,7 @@ async function startImpdParts(config, boundaries, plan) {
     secretFiles
   });
   const state = { ready: false };
-  const authorizedKeys = createAuthorizedKeys(join47(setupSshDir(config.dataDir), "authorized_keys"));
+  const authorizedKeys = createAuthorizedKeys(join48(setupSshDir(config.dataDir), "authorized_keys"));
   const access = await runStep("access", () => loadImpdAccess(config, deps, authorizedKeys.probeListed));
   const backups = config.backup === null ? null : createBackupService({
     dataDir: config.dataDir,
@@ -58312,7 +58428,7 @@ async function startImpdParts(config, boundaries, plan) {
     readTailnetNames: tailnetNames === null ? null : tailnetNames.readStatus,
     hostReaders: {
       readKernel: () => deps.hostKernelRelease ?? release2(),
-      readCpuInfo: deps.readCpuInfo ?? (() => readFileSync36("/proc/cpuinfo", "utf8")),
+      readCpuInfo: deps.readCpuInfo ?? (() => readFileSync38("/proc/cpuinfo", "utf8")),
       readHugePagePool: deps.imps?.readHugePagePool ?? (() => readHugePagePool())
     },
     isReady: () => state.ready,
@@ -58431,6 +58547,11 @@ function buildStubTickerTimer() {
   };
 }
 
+// packages/daemon/testing/platform/format-run-prefix.ts
+function formatRunPrefix(owner) {
+  return `pid${String(owner.pid)}-ns${owner.namespace}-`;
+}
+
 // packages/daemon/testing/platform/open-migrated-copy.ts
 import { Database as Database4 } from "bun:sqlite";
 var TEMPLATE = {};
@@ -58453,6 +58574,15 @@ function pickImpdPort(draw) {
   return FIRST_PORT + Math.floor(draw * PORT_SPAN);
 }
 
+// packages/daemon/testing/platform/read-run-owner.ts
+import { readlinkSync as readlinkSync2 } from "fs";
+function readRunOwner() {
+  return {
+    pid: process.pid,
+    namespace: readlinkSync2("/proc/self/ns/pid").replaceAll(/\D/gu, "")
+  };
+}
+
 // packages/daemon/testing/platform/start-impd-log-capture.ts
 import { resetSync } from "@logtape/logtape";
 
@@ -58547,7 +58677,8 @@ function buildStubVmm() {
     uptimeMs: 60000,
     identityReset: "ok",
     hasBootId: true,
-    bootSteps: {}
+    bootSteps: {},
+    pageHandler: undefined
   };
   const guestMemory = new Map;
   const readFakeGuestMemory = (directory) => {
@@ -58669,7 +58800,8 @@ log tail`);
           return {
             ...vm,
             hugePages: plan.hugePages ?? "None",
-            bootId: bootIds.get(plan.paths.apiSocket)
+            bootId: bootIds.get(plan.paths.apiSocket),
+            ...plan.hugePages === "2M" && { pageHandler: guest.pageHandler }
           };
         } finally {
           usedSnapshots.add(plan.paths.snapshotDir);
@@ -58879,6 +59011,9 @@ log tail`);
     setGuestBootSteps: (steps) => {
       guest.bootSteps = steps;
     },
+    setPageHandlerStats: (stats) => {
+      guest.pageHandler = stats;
+    },
     setIdentityReset: (result) => {
       guest.identityReset = result;
     },
@@ -58918,7 +59053,7 @@ var NO_FREEZER = { freeze: () => Promise.resolve(), thaw: () => Promise.resolve(
 var KSM_KERNEL = "6.12.0";
 var IDLE_KSM = { running: true, sharedMib: 0, profitMib: 0, zeroMib: 0 };
 async function startTestImpd(stack, options = {}) {
-  const dataDir = options.dataDir ?? mkdtempSync(`${tmpdir()}/impd-test-`);
+  const dataDir = options.dataDir ?? mkdtempSync(`${tmpdir()}/${formatRunPrefix(readRunOwner())}impd-test-`);
   if (options.dataDir === undefined) {
     stack.defer(() => rm2(dataDir, { recursive: true, force: true }));
   }
@@ -58989,6 +59124,7 @@ async function startTestImpd(stack, options = {}) {
   });
   const cgroups = options.cgroups ?? createCpuCgroups({ root: "/nonexistent" });
   const extra = options.boundaries ?? {};
+  const procRoot = options.procRoot;
   const buildBoundaries = (identity, runner, storage) => {
     const jails = options.jails;
     return {
@@ -59088,6 +59224,9 @@ async function startTestImpd(stack, options = {}) {
         hostCpus: options.hostCpus ?? 8,
         kernelOops,
         readThreadIds: (pid) => options.procRoot === undefined ? null : readThreadIds(pid, options.procRoot),
+        ...procRoot !== undefined && {
+          readHostLoad: () => readHostLoad({ procRoot, readFile: readText, logger: getImpdLogger("imps") })
+        },
         ...options.readUnsharedRamMib !== undefined && {
           readUnsharedRamMib: options.readUnsharedRamMib
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impz/testing",
-  "version": "6.4.2",
+  "version": "6.6.0",
   "description": "A real impd on stand-ins, for Bun tests of code that drives impd through @impz/client",
   "license": "MIT",
   "repository": {
@@ -43,7 +43,7 @@
     "ts-pattern": "^5.9.2",
     "xstate": "^5.33.3",
     "zod": "^4.6.7",
-    "@impz/client": "6.4.2"
+    "@impz/client": "6.6.0"
   },
   "engines": {
     "bun": ">=1.4.3"