@impz/testing 6.8.1 → 6.9.0

package/dist/index.js

@@ -18924,7 +18924,7 @@ var BACKUP_TREE = {
 };
 
 // packages/daemon/src/test-utils/start-test-impd.ts
-import { copyFileSync as copyFileSync5, mkdirSync as mkdirSync31, mkdtempSync, writeFileSync as writeFileSync16 } from "fs";
+import { copyFileSync as copyFileSync5, mkdirSync as mkdirSync31, mkdtempSync, writeFileSync as writeFileSync17 } from "fs";
 import { rm as rm2 } from "fs/promises";
 import { tmpdir } from "os";
 
@@ -18994,7 +18994,7 @@ function readBusyPorts() {
 // packages/daemon/src/test-utils/start-test-impd.ts
 import { createORPCClient as createORPCClient2 } from "@orpc/client";
 import { RPCLink } from "@orpc/client/fetch";
-import invariant7 from "tiny-invariant";
+import invariant8 from "tiny-invariant";
 
 // packages/daemon/src/config.ts
 import { join as join4 } from "path";
@@ -21739,6 +21739,7 @@ var EnvSchema = z53.object({
   IMP_KSM_HEADROOM_PERCENT: z53.string().default("100"),
   IMP_HUGE_PAGES: z53.enum(["off", "2M"]).default("off"),
   IMP_UFFD_HANDLER: z53.string().default("uffd-handler"),
+  IMP_WARM_CAP_MIB: CountSchema3.default(256),
   IMP_DNS: z53.string().default("1.1.1.1,8.8.8.8").transform(splitList).pipe(DnsServersSchema),
   IMP_SUBNET: z53.cidrv4().default("10.66.0.0/16"),
   IMP_SUBNET6: z53.string().default("auto"),
@@ -21908,7 +21909,7 @@ function loadConfig(env) {
     jailerBin: parsed.IMP_JAILER === "true" ? parsed.IMP_JAILER_BIN : null,
     jailDir: join4(parsed.IMP_DATA_DIR, "jail"),
     ksm: parseKsmConfig(parsed),
-    hugePages: parsed.IMP_HUGE_PAGES === "2M" ? { handlerBin: parsed.IMP_UFFD_HANDLER } : null,
+    hugePages: parsed.IMP_HUGE_PAGES === "2M" ? { handlerBin: parsed.IMP_UFFD_HANDLER, warmCapMib: parsed.IMP_WARM_CAP_MIB } : null,
     kernelPath: join4(parsed.IMP_DATA_DIR, "system", "vmlinux"),
     kernelSource: parsed.IMP_KERNEL ?? null,
     systemDriveSource: parsed.IMP_SYSTEM_DRIVE ?? join4(parsed.IMP_DATA_DIR, "system", "imp-system.squashfs"),
@@ -21991,7 +21992,7 @@ import { join as join48 } from "path";
 // packages/daemon/package.json
 var package_default = {
   name: "@impz/daemon",
-  version: "6.8.1",
+  version: "6.9.0",
   private: true,
   description: "impd: the imp host daemon",
   type: "module",
@@ -38658,6 +38659,7 @@ function createImpCommands(parts) {
   const leases = parts.leases;
   const removeLockedImp = async (imp) => {
     const paths = context.findPaths(imp.id);
+    await context.memoryWarm?.stop(imp.id, "destroyed");
     if (imp.pid !== null) {
       await context.vms.stopVm(imp.pid, paths, false);
     }
@@ -39701,6 +39703,113 @@ function splitRun(run) {
   });
 }
 
+// packages/daemon/src/vm/vmm/create-memory-warm.ts
+import invariant5 from "tiny-invariant";
+import { match as match11 } from "ts-pattern";
+import * as z76 from "zod";
+var BLOCK_MIB2 = 2;
+var WARM_CONCURRENCY = 2;
+var WarmReportSchema = z76.object({ blocks: z76.int().nonnegative() });
+function createMemoryWarm(deps) {
+  const running = new Map;
+  const lifetime = { isStopped: false };
+  const slots = createSemaphore(WARM_CONCURRENCY);
+  const readBlocks = async (mode, memFile, signal) => {
+    signal.throwIfAborted();
+    const argv = [deps.handlerBin, mode, memFile];
+    const stdout = await runChecked(argv, { signal }, deps.run);
+    return WarmReportSchema.parse(JSON.parse(stdout)).blocks;
+  };
+  const runWarm = async (memFile, signal) => {
+    const startedMs = performance.now();
+    try {
+      const blocks = await readBlocks("--count-data", memFile, signal);
+      if (blocks * BLOCK_MIB2 > deps.capMib) {
+        return { kind: "overCap", blocks };
+      }
+      const read = await readBlocks("--warm", memFile, signal);
+      return { kind: "warmed", blocks: read, warmMs: Math.round(performance.now() - startedMs) };
+    } catch (error) {
+      return { kind: "failed", error: getErrorMessage(error) };
+    }
+  };
+  const stop = async (impID, end) => {
+    const warm = running.get(impID);
+    if (warm === undefined) {
+      return;
+    }
+    warm.state.end = end;
+    warm.controller.abort();
+    if (warm.state.phase === "running") {
+      await warm.done;
+      return;
+    }
+    running.delete(impID);
+    const warmMs = Math.round(performance.now() - warm.startedMs);
+    logWarm(warm.target, { kind: "ended", end, warmMs }, deps.capMib);
+  };
+  return {
+    start: (target) => {
+      if (lifetime.isStopped) {
+        logWarm(target, { kind: "closed" }, deps.capMib);
+        return;
+      }
+      invariant5(!running.has(target.impID), `imp ${target.impID} slept with its warm running`);
+      const controller = new AbortController;
+      const state = { phase: "queued", end: null };
+      const startedMs = performance.now();
+      const runInSlot = () => {
+        if (controller.signal.aborted) {
+          return Promise.resolve(null);
+        }
+        state.phase = "running";
+        return runWarm(target.memFile, controller.signal);
+      };
+      const runAndLog = async () => {
+        const outcome = await slots.run(runInSlot);
+        if (outcome === null) {
+          return;
+        }
+        running.delete(target.impID);
+        const end = state.end;
+        const warmMs = Math.round(performance.now() - startedMs);
+        const isEnded = outcome.kind === "failed" && end !== null;
+        const logged = isEnded ? { kind: "ended", end, warmMs } : outcome;
+        logWarm(target, logged, deps.capMib);
+      };
+      running.set(target.impID, { target, controller, state, startedMs, done: runAndLog() });
+    },
+    stop,
+    stopAll: async () => {
+      lifetime.isStopped = true;
+      await Promise.all([...running.keys()].map((impID) => stop(impID, "impdStopped")));
+    }
+  };
+}
+function logWarm(target, outcome, capMib) {
+  const logger = getImpdLogger("imps").with({ imp: target.name });
+  match11(outcome).with({ kind: "warmed" }, (warmed) => {
+    logger.info("warmed the memory file in {warmMs}ms: {blocks} blocks of 2 MiB", {
+      warmMs: String(warmed.warmMs),
+      blocks: String(warmed.blocks)
+    });
+  }).with({ kind: "overCap" }, (over) => {
+    logger.info("left the memory file cold: its {dataMib} MiB of data pass the warm cap of {capMib} MiB", { dataMib: String(over.blocks * BLOCK_MIB2), capMib: String(capMib) });
+  }).with({ kind: "ended" }, (ended) => {
+    logger.info("stopped the memory file's warm after {warmMs}ms: {reason}", {
+      warmMs: String(ended.warmMs),
+      reason: formatWarmEnd(ended.end)
+    });
+  }).with({ kind: "closed" }, () => {
+    logger.info("left the memory file cold: impd is stopping");
+  }).with({ kind: "failed" }, (failed) => {
+    logger.warning("the memory file's warm failed: {error}", { error: failed.error });
+  }).exhaustive();
+}
+function formatWarmEnd(end) {
+  return match11(end).with("woke", () => "the imp woke").with("stopped", () => "the imp stopped").with("destroyed", () => "the imp is destroyed").with("impdStopped", () => "impd stopped").exhaustive();
+}
+
 // packages/daemon/src/vm/vmm/vm-stats.ts
 import { readFileSync as readFileSync19, readdirSync as readdirSync4 } from "fs";
 import { readFile as readFile3 } from "fs/promises";
@@ -40017,7 +40126,7 @@ function readStep(last, current) {
 }
 
 // packages/daemon/src/imps/imps/session-logs/session-log-service.ts
-import * as z77 from "zod";
+import * as z78 from "zod";
 
 // packages/daemon/src/imps/imps/session-logs/build-log-key.ts
 function buildLogKey(impId, generation) {
@@ -40036,7 +40145,7 @@ import { basename as basename2, dirname as dirname8, join as join20, resolve as
 import { existsSync as existsSync10, readFileSync as readFileSync20, readdirSync as readdirSync5, rmSync as rmSync16 } from "fs";
 import { mkdir, open as open4, stat, truncate, unlink } from "fs/promises";
 import { join as join19 } from "path";
-import * as z76 from "zod";
+import * as z77 from "zod";
 
 // packages/daemon/src/imps/imps/session-logs/plan-log-read.ts
 function getLogBounds(segments, origin) {
@@ -40081,20 +40190,20 @@ function planLogRead(segments, origin, from, limit) {
 var META_FILE = "meta.json";
 var SEGMENT_SUFFIX = ".seg";
 var COMMIT_DELAY_MS = 1000;
-var OffsetSchema2 = z76.int().nonnegative();
-var GenerationMetaSchema = z76.object({
-  version: z76.literal(1),
+var OffsetSchema2 = z77.int().nonnegative();
+var GenerationMetaSchema = z77.object({
+  version: z77.literal(1),
   session: AgentSessionNameSchema,
   executionGeneration: AgentGenerationSchema,
   bootId: AgentBootIdSchema,
-  startedAt: z76.int(),
+  startedAt: z77.int(),
   origin: OffsetSchema2,
-  segments: z76.array(z76.object({ start: OffsetSchema2, length: OffsetSchema2 })),
-  state: z76.enum(["live", "ended"]),
-  endedAt: z76.int().optional(),
+  segments: z77.array(z77.object({ start: OffsetSchema2, length: OffsetSchema2 })),
+  state: z77.enum(["live", "ended"]),
+  endedAt: z77.int().optional(),
   end: OffsetSchema2.optional(),
-  exitCode: z76.int().nullable().optional(),
-  stopped: z76.enum(["disk_full", "imp_limit"]).optional()
+  exitCode: z77.int().nullable().optional(),
+  stopped: z77.enum(["disk_full", "imp_limit"]).optional()
 });
 function getSegmentPath(directory, start) {
   return join19(directory, `${String(start)}${SEGMENT_SUFFIX}`);
@@ -40874,7 +40983,7 @@ function toExitCode(code, signal) {
 }
 
 // packages/daemon/src/imps/imps/session-logs/session-log-service.ts
-var NoSessionPreviousSchema = z77.object({ previous: PreviousGenerationSchema.optional() });
+var NoSessionPreviousSchema = z78.object({ previous: PreviousGenerationSchema.optional() });
 function createSessionLogs(deps) {
   const openTap = deps.openTap ?? openTapStream;
   const createLog = deps.createLog ?? createGenerationLog;
@@ -41266,6 +41375,11 @@ function createImpContext(deps) {
       readNetBytes: deps.readNetBytes,
       readMemory: deps.readVmMemory,
       readThreadIds: deps.readThreadIds
+    }),
+    memoryWarm: deps.config.hugePages === null ? null : createMemoryWarm({
+      handlerBin: deps.config.hugePages.handlerBin,
+      capMib: deps.config.hugePages.warmCapMib,
+      run: deps.runCommand
     })
   };
   const guest = {
@@ -42344,6 +42458,7 @@ function createImpRuntime(parts) {
     },
     tracker: context.tracker,
     bootTemplates: context.templates,
+    memoryWarm: context.memoryWarm,
     readDiskFullError: () => lastDiskFull.error
   };
 }
@@ -42568,13 +42683,17 @@ function makeSleepImpVm(deps) {
     const sessions = await readSessionsForSleep(imp, paths);
     const services = await sendServicesList(paths.vsockSocket, SERVICES_FOR_SLEEP_MS).catch(() => null);
     const started = context.sleepTiming.now();
-    const slept = { detail: { trigger: reason } };
+    const slept = {
+      detail: { trigger: reason },
+      isOnHugePages: false
+    };
     removeSnapshotMeta(paths);
     const hasOomKill = startOomWatch(context.cgroups, imp.id);
     try {
       const cgroup = context.cgroups.setup(imp.id, imp.cpu, imp.memoryMib);
       const timings = await deps.withSleepSlot(() => context.vms.sleepVm(pid, paths, cgroup, paths));
       const booted = readVmIdentity(paths);
+      slept.isOnHugePages = booted?.hugePages === "2M";
       writeSnapshotMeta(paths, {
         ...buildSnapshotIdentity(booted, context.identity),
         createdAt: Date.now(),
@@ -42627,13 +42746,17 @@ function makeSleepImpVm(deps) {
       throw isOomKill ? new Error(`sleep failed: ${OOM_KILL_TRIGGER}`, { cause: error }) : error;
     }
     context.admission.release(imp.id);
-    return updateState(imp, {
+    const sleeping = await updateState(imp, {
       reason: "slept",
       detail: slept.detail,
       state: "sleeping",
       pid: null,
       sleptAt: new Date
     });
+    if (slept.isOnHugePages) {
+      context.memoryWarm?.start({ impID: imp.id, name: imp.name, memFile: paths.memFile });
+    }
+    return sleeping;
   };
   const sleepImpVm = async (imp, reason, youngGuest = ALWAYS_WAIT) => {
     requireTransition(imp.state, "sleeping", "sleep");
@@ -42710,6 +42833,7 @@ function makeWakeImpVm(deps) {
       throw buildStoppingError();
     }
     requireNoOopsHold(context, imp);
+    await context.memoryWarm?.stop(imp.id, "woke");
     const paths = context.findPaths(imp.id);
     const meta = readSnapshotMeta(paths);
     const mismatch = meta === null ? "no snapshot it can load" : readColdBootReason(meta, context.identity);
@@ -42907,18 +43031,18 @@ async function waitForAgent(vsockPath, options) {
 }
 
 // packages/daemon/src/vm/vmm/firecracker-client.ts
-import * as z78 from "zod";
-var InstanceInfoSchema = z78.object({ state: z78.enum(["Not started", "Running", "Paused"]) });
-var MachineConfigSchema = z78.object({
-  track_dirty_pages: z78.boolean().optional(),
-  huge_pages: z78.string().optional()
+import * as z79 from "zod";
+var InstanceInfoSchema = z79.object({ state: z79.enum(["Not started", "Running", "Paused"]) });
+var MachineConfigSchema = z79.object({
+  track_dirty_pages: z79.boolean().optional(),
+  huge_pages: z79.string().optional()
 });
-var BalloonStatsSchema = z78.object({ total_memory: z78.number(), available_memory: z78.number() });
-var HotplugMemorySchema = z78.object({
-  plugged_size_mib: z78.number(),
-  requested_size_mib: z78.number()
+var BalloonStatsSchema = z79.object({ total_memory: z79.number(), available_memory: z79.number() });
+var HotplugMemorySchema = z79.object({
+  plugged_size_mib: z79.number(),
+  requested_size_mib: z79.number()
 });
-var VersionSchema = z78.object({ firecracker_version: z78.string() });
+var VersionSchema = z79.object({ firecracker_version: z79.string() });
 var DEFAULT_TIMEOUTS = { requestMs: 1e4, snapshotMs: 120000 };
 
 class FirecrackerApiError extends Error {
@@ -43909,6 +44033,7 @@ function createImpVmOps(host) {
   const startNewImpVm = (imp, diskReady) => startColdImpVm(imp, "start", null, diskReady);
   const stopImpVm = async (imp, graceful = true) => {
     const paths = context.findPaths(imp.id);
+    await context.memoryWarm?.stop(imp.id, "stopped");
     if (imp.pid !== null) {
       await context.vms.stopVm(imp.pid, paths, graceful);
     }
@@ -44016,7 +44141,7 @@ function countStepsMs(timings) {
 }
 
 // packages/daemon/src/imps/imps/services/service-api.ts
-import { match as match11 } from "ts-pattern";
+import { match as match12 } from "ts-pattern";
 
 // packages/daemon/src/imps/imps/services/create-log-decoders.ts
 function createLogDecoders() {
@@ -44240,7 +44365,7 @@ function handleAgentError(service) {
     if (!(error instanceof AgentError)) {
       throw error;
     }
-    throw match11(error.code).with("NO_SERVICE", () => buildNotFoundError("service", service)).with("SERVICE_EXISTS", () => buildConflictError("service", service)).with("BAD_REQUEST", () => new ImpdError("BAD_REQUEST", { message: error.detail })).with("AGENT_OUTDATED", () => buildAgentOutdatedApiError(error.message)).otherwise(() => error);
+    throw match12(error.code).with("NO_SERVICE", () => buildNotFoundError("service", service)).with("SERVICE_EXISTS", () => buildConflictError("service", service)).with("BAD_REQUEST", () => new ImpdError("BAD_REQUEST", { message: error.detail })).with("AGENT_OUTDATED", () => buildAgentOutdatedApiError(error.message)).otherwise(() => error);
   };
 }
 function stopStreams(streams) {
@@ -45676,6 +45801,7 @@ function createImpdImps(config, deps, parts) {
     cgroups,
     memoryLimit,
     readExecEnv: parts.broker.readExecEnv,
+    runCommand: deps.runCommand ?? runCommand,
     storageGate: parts.storage.storageGate,
     diskBudget: parts.storage.diskBudget,
     readDiskUsage: parts.storage.diskUsage.read,
@@ -45876,79 +46002,79 @@ function buildOfferedDigests(digest, receivedDigest) {
 var COMMIT_WINDOW_MS = 24 * 60 * 60 * 1000;
 
 // packages/daemon/src/imp-ops/moves/move-header.ts
-import * as z79 from "zod";
-var CpuSchema = z79.object({ limit: z79.number().positive().nullable(), weight: z79.int() }).readonly();
-var EgressSchema = z79.object({ mode: z79.string(), allow: z79.array(z79.string()).readonly() }).readonly();
-var CheckpointSchema3 = z79.object({
-  label: z79.string().nullable(),
-  createdAt: z79.coerce.date(),
-  diskBytes: z79.int().positive()
+import * as z80 from "zod";
+var CpuSchema = z80.object({ limit: z80.number().positive().nullable(), weight: z80.int() }).readonly();
+var EgressSchema = z80.object({ mode: z80.string(), allow: z80.array(z80.string()).readonly() }).readonly();
+var CheckpointSchema3 = z80.object({
+  label: z80.string().nullable(),
+  createdAt: z80.coerce.date(),
+  diskBytes: z80.int().positive()
 }).readonly();
-var MovedBootSchema = z79.object({ bootId: z79.uuid(), cause: ColdBootCauseSchema, at: z79.iso.datetime() }).readonly();
+var MovedBootSchema = z80.object({ bootId: z80.uuid(), cause: ColdBootCauseSchema, at: z80.iso.datetime() }).readonly();
 var MAX_MOVED_LEASES = 1024;
 var MAX_LEASE_REMAINING_MS = 100 * 365 * 24 * 60 * 60 * 1000;
-var LeaseOwnerTextSchema = z79.string().min(1).max(256);
-var MovedLeaseOwnerSchema = z79.object({
+var LeaseOwnerTextSchema = z80.string().min(1).max(256);
+var MovedLeaseOwnerSchema = z80.object({
   principal: LeaseOwnerTextSchema,
   label: LeaseLabelSchema,
   display: LeaseOwnerTextSchema
 });
 var MovedLeaseSchema = MovedLeaseOwnerSchema.extend({
-  remainingMs: z79.int().nonnegative().max(MAX_LEASE_REMAINING_MS).nullable(),
-  createdAt: z79.coerce.date()
+  remainingMs: z80.int().nonnegative().max(MAX_LEASE_REMAINING_MS).nullable(),
+  createdAt: z80.coerce.date()
 }).readonly();
-var FilteredGrantSchema2 = z79.object({ secret: z79.string(), filter: GrantFilterSchema }).readonly();
-var ImpSchema2 = z79.object({
-  id: z79.uuid(),
-  name: z79.string(),
-  clonedDigest: z79.string().optional(),
-  vcpus: z79.int().positive(),
-  memoryMib: z79.int().positive(),
-  maxMemoryMib: z79.int().positive().optional(),
-  httpPort: z79.int().positive(),
-  diskBytes: z79.int().positive(),
+var FilteredGrantSchema2 = z80.object({ secret: z80.string(), filter: GrantFilterSchema }).readonly();
+var ImpSchema2 = z80.object({
+  id: z80.uuid(),
+  name: z80.string(),
+  clonedDigest: z80.string().optional(),
+  vcpus: z80.int().positive(),
+  memoryMib: z80.int().positive(),
+  maxMemoryMib: z80.int().positive().optional(),
+  httpPort: z80.int().positive(),
+  diskBytes: z80.int().positive(),
   cpu: CpuSchema,
   egress: EgressSchema,
-  grants: z79.array(z79.string()).readonly(),
-  filteredGrants: z79.array(FilteredGrantSchema2).readonly().default([]),
-  isIdentityResetPending: z79.boolean(),
-  isDiskGrowPending: z79.boolean().default(false),
-  isBackedUp: z79.boolean().default(true),
-  coldBoots: z79.array(MovedBootSchema).max(4).readonly().default([]),
-  leases: z79.array(MovedLeaseSchema).max(MAX_MOVED_LEASES).readonly().optional()
+  grants: z80.array(z80.string()).readonly(),
+  filteredGrants: z80.array(FilteredGrantSchema2).readonly().default([]),
+  isIdentityResetPending: z80.boolean(),
+  isDiskGrowPending: z80.boolean().default(false),
+  isBackedUp: z80.boolean().default(true),
+  coldBoots: z80.array(MovedBootSchema).max(4).readonly().default([]),
+  leases: z80.array(MovedLeaseSchema).max(MAX_MOVED_LEASES).readonly().optional()
 }).readonly();
-var StreamStepSchema = z79.object({
-  checkpoint: z79.int().nonnegative().nullable(),
-  dataset: z79.int().nonnegative(),
-  base: z79.int().nonnegative().nullable()
+var StreamStepSchema = z80.object({
+  checkpoint: z80.int().nonnegative().nullable(),
+  dataset: z80.int().nonnegative(),
+  base: z80.int().nonnegative().nullable()
 }).readonly();
-var HeldAnswerSchema = z79.object({
-  names: z79.array(z79.string()).readonly(),
-  address: z79.string(),
-  ttlS: z79.int().positive()
+var HeldAnswerSchema = z80.object({
+  names: z80.array(z80.string()).readonly(),
+  address: z80.string(),
+  ttlS: z80.int().positive()
 }).readonly();
-var WarmSchema = z79.object({
+var WarmSchema = z80.object({
   move: WarmMoveSchema,
   meta: SnapshotMetaSchema.extend({ systemDrive: SystemDriveSchema }),
   vm: VmIdentitySchema.nullable(),
-  isDriveIncluded: z79.boolean(),
-  answers: z79.array(HeldAnswerSchema).readonly()
+  isDriveIncluded: z80.boolean(),
+  answers: z80.array(HeldAnswerSchema).readonly()
 }).readonly();
-var MoveHeaderSchema = z79.object({
-  version: z79.literal(1),
+var MoveHeaderSchema = z80.object({
+  version: z80.literal(1),
   imp: ImpSchema2,
-  image: z79.object({
-    name: z79.string(),
-    ref: z79.string(),
-    digest: z79.string(),
-    receivedDigest: z79.string().nullable().default(null),
-    sizeBytes: z79.int().nonnegative(),
+  image: z80.object({
+    name: z80.string(),
+    ref: z80.string(),
+    digest: z80.string(),
+    receivedDigest: z80.string().nullable().default(null),
+    sizeBytes: z80.int().nonnegative(),
     source: ImageSourceSchema,
-    sourceImp: z79.string().nullable(),
-    isIncluded: z79.boolean()
+    sourceImp: z80.string().nullable(),
+    isIncluded: z80.boolean()
   }),
-  checkpoints: z79.array(CheckpointSchema3).readonly(),
-  streams: z79.array(StreamStepSchema).readonly().nullable(),
+  checkpoints: z80.array(CheckpointSchema3).readonly(),
+  streams: z80.array(StreamStepSchema).readonly().nullable(),
   warm: WarmSchema.nullable().default(null)
 }).readonly();
 var MOVE_PART_HEADER = "x-imp-move-part";
@@ -46110,7 +46236,7 @@ class MoveRequestError extends ImpdError {
 }
 
 // packages/daemon/src/imp-ops/moves/move-tickets.ts
-import * as z80 from "zod";
+import * as z81 from "zod";
 var MOVE_AUTH_SCHEME = "ImpMove";
 var MOVE_TICKET_PREFIX = "";
 function isSameHash(leftItem, rightItem) {
@@ -46124,19 +46250,19 @@ function readTicketHeader(request) {
 function buildTicketHeader(ticket) {
   return { authorization: `${MOVE_AUTH_SCHEME} ${ticket}` };
 }
-var ReceiptFileSchema = z80.object({
-  kind: z80.string(),
-  index: z80.int().nonnegative().optional(),
-  sha256: z80.string(),
-  bytes: z80.int().nonnegative()
+var ReceiptFileSchema = z81.object({
+  kind: z81.string(),
+  index: z81.int().nonnegative().optional(),
+  sha256: z81.string(),
+  bytes: z81.int().nonnegative()
 });
-var ReceiptBodySchema = z80.object({
-  ticketId: z80.string(),
-  name: z80.string(),
-  impId: z80.string(),
-  files: z80.array(ReceiptFileSchema)
+var ReceiptBodySchema = z81.object({
+  ticketId: z81.string(),
+  name: z81.string(),
+  impId: z81.string(),
+  files: z81.array(ReceiptFileSchema)
 });
-var ReceiptSchema = z80.object({ body: z80.string(), mac: z80.string() });
+var ReceiptSchema = z81.object({ body: z81.string(), mac: z81.string() });
 function buildReceipt(body, secret) {
   const text = JSON.stringify(body);
   return { body: text, mac: sign(secret, text).toString("hex") };
@@ -46152,7 +46278,7 @@ function readReceipt(receipt, secret) {
 import { mkdirSync as mkdirSync19, rmSync as rmSync23 } from "fs";
 import { open as open7 } from "fs/promises";
 import { join as join25 } from "path";
-import invariant5 from "tiny-invariant";
+import invariant6 from "tiny-invariant";
 
 // packages/daemon/src/imp-ops/moves/build-received-digest.ts
 import { createHash as createHash5 } from "crypto";
@@ -46361,7 +46487,7 @@ function createByteCounter(limit) {
 // packages/daemon/src/imp-ops/moves/move-frames.ts
 import { createHash as createHash8 } from "crypto";
 import { open as open6 } from "fs/promises";
-import * as z81 from "zod";
+import * as z82 from "zod";
 
 // packages/daemon/src/imp-ops/moves/create-content-hash.ts
 import { createHash as createHash7 } from "crypto";
@@ -46399,8 +46525,8 @@ var MOVE_BLOCK_BYTES = 1024 * 1024;
 var OFFSET_BYTES = 8;
 var HEADER_BYTES3 = 5;
 var MAX_PAYLOAD_BYTES = MOVE_BLOCK_BYTES + OFFSET_BYTES;
-var MoveFileSchema = z81.object({
-  kind: z81.enum([
+var MoveFileSchema = z82.object({
+  kind: z82.enum([
     "image-rootfs",
     "image-config",
     "checkpoint",
@@ -46410,13 +46536,13 @@ var MoveFileSchema = z81.object({
     "vmstate",
     "mem"
   ]),
-  index: z81.int().nonnegative().optional(),
-  sizeBytes: z81.int().nonnegative()
+  index: z82.int().nonnegative().optional(),
+  sizeBytes: z82.int().nonnegative()
 });
 function createFileContentHash(file) {
   return file.kind === "image-rootfs" || file.kind === "image-config" ? createContentHash(file.sizeBytes) : null;
 }
-var FileEndSchema = z81.object({ sha256: z81.string() });
+var FileEndSchema = z82.object({ sha256: z82.string() });
 function encodeFrame2(type, payload) {
   const frame = new Uint8Array(HEADER_BYTES3 + payload.length);
   const view = new DataView(frame.buffer);
@@ -46943,7 +47069,7 @@ async function requireImage(deps, options) {
       { kind: "image-rootfs", sha256: rootfs.sha256, bytes: rootfs.bytes },
       { kind: "image-config", sha256: config.sha256, bytes: config.bytes }
     ];
-    invariant5(rootfs.contentSha256 !== null && config.contentSha256 !== null);
+    invariant6(rootfs.contentSha256 !== null && config.contentSha256 !== null);
     const digest = buildReceivedDigest(rootfs.contentSha256, config.contentSha256);
     const known = await readImageInUse(deps.db, [digest], deps.now());
     if (known !== undefined) {
@@ -47252,8 +47378,8 @@ function readSettled2(row, imp) {
 }
 
 // packages/daemon/src/imp-ops/moves/move-sender.ts
-import invariant6 from "tiny-invariant";
-import { match as match12 } from "ts-pattern";
+import invariant7 from "tiny-invariant";
+import { match as match13 } from "ts-pattern";
 
 // packages/daemon/src/platform/db/move-send-steps.ts
 var MOVE_SEND_STEPS = [
@@ -47816,7 +47942,7 @@ function createMoveSender(deps) {
   };
   const recoverSend = async (imp, row) => {
     const log = getImpdLogger("move").with({ imp: imp.name });
-    await match12(pickSendRecovery(imp.moveState, row?.step)).with("unmark", () => removeMark(imp)).with("wait", () => {
+    await match13(pickSendRecovery(imp.moveState, row?.step)).with("unmark", () => removeMark(imp)).with("wait", () => {
       log.info("a prepared send waits for its send after a restart");
     }).with("abort", async () => {
       const isUndone = await resetSend(imp, row?.peer_url ?? null, row?.ticket ?? null);
@@ -47824,7 +47950,7 @@ function createMoveSender(deps) {
         log.info("a send cut short by a restart was undone");
       }
     }).with("commit", async () => {
-      invariant6(row !== undefined && row.peer_url !== null && row.ticket !== null);
+      invariant7(row !== undefined && row.peer_url !== null && row.ticket !== null);
       const moved = imp.moveState === "moved" ? imp : await updateImpMove(deps.db, imp.id, "moved");
       await runCommitAfterRestart(moved, row.peer_url, row.ticket);
     }).with("none", () => {}).exhaustive();
@@ -47938,7 +48064,7 @@ function buildPublicError(name) {
 }
 function pickSendRecovery(moveState, step) {
   if (moveState === "sending") {
-    return match12(step).with(undefined, () => "unmark").with("prepared", () => "wait").with("streaming", () => "abort").with("sent", () => "commit").exhaustive();
+    return match13(step).with(undefined, () => "unmark").with("prepared", () => "wait").with("streaming", () => "abort").with("sent", () => "commit").exhaustive();
   }
   return moveState === "moved" && step === "sent" ? "commit" : "none";
 }
@@ -47990,7 +48116,7 @@ function createMoveService(deps) {
 // packages/daemon/src/surface/moves/create-move-peer-handler.ts
 import { OpenAPIHandler } from "@orpc/openapi/fetch";
 import { ORPCError as ORPCError7, implement as implement3, onError as onError3 } from "@orpc/server";
-import { match as match13 } from "ts-pattern";
+import { match as match14 } from "ts-pattern";
 function createMovePeerHandler(deps) {
   const withTicket = async (step, context, call) => {
     const startedAt = deps.now();
@@ -48041,7 +48167,7 @@ function createMovePeerHandler(deps) {
   const respondReceive = async (context) => {
     try {
       const received = await withTicket("receive", context, (checked) => deps.calls.receive(checked, context.request));
-      return match13(received).with({ kind: "part" }, (sent) => Response.json({ part: sent.part }, { status: 202 })).with({ kind: "receipt" }, (sent) => Response.json(sent.receipt)).exhaustive();
+      return match14(received).with({ kind: "part" }, (sent) => Response.json({ part: sent.part }, { status: 202 })).with({ kind: "receipt" }, (sent) => Response.json(sent.receipt)).exhaustive();
     } catch (error) {
       const failure = toPeerError(error);
       return Response.json(encodePeerError(failure), { status: failure.status });
@@ -48085,7 +48211,7 @@ import {
 } from "@orpc/client";
 import { ResponseValidationPlugin } from "@orpc/contract/plugins";
 import { OpenAPILink } from "@orpc/openapi-client/fetch";
-import * as z82 from "zod";
+import * as z83 from "zod";
 function makeConnectMovePeer(deps) {
   return (target) => {
     const sendLinkRequest = async (request) => {
@@ -48131,7 +48257,7 @@ function makeConnectMovePeer(deps) {
     };
   };
 }
-var PeerErrorBodySchema = z82.looseObject({ error: z82.string().optional() });
+var PeerErrorBodySchema = z83.looseObject({ error: z83.string().optional() });
 function decodePeerError(body, response) {
   const parsed = PeerErrorBodySchema.safeParse(body);
   if (!parsed.success) {
@@ -48891,7 +49017,7 @@ import { join as join30, posix as posix3 } from "path";
 
 // packages/local-tar/src/extract-local.ts
 import tar from "tar-stream";
-import * as z83 from "zod";
+import * as z84 from "zod";
 // packages/local-tar/src/pack-build-context.ts
 import { existsSync as existsSync18 } from "fs";
 import { lstat, readFile as readFile4, readdir } from "fs/promises";
@@ -50021,14 +50147,14 @@ function renderPinnedDockerfile(dockerfile, pins, platform) {
 }
 
 // packages/daemon/src/imps/images/pull/image-pin.ts
-import * as z84 from "zod";
+import * as z85 from "zod";
 var PIN_INSPECT_FORMAT = '{"Id":{{json .Id}},"RepoDigests":{{json .RepoDigests}},"Os":{{json .Os}},"Architecture":{{json .Architecture}},"Config":{{json .Config}}}';
-var ConfigSchema = z84.object({ OnBuild: z84.array(z84.unknown()).readonly().nullish() }).nullable();
-var PinInspectSchema = z84.object({
-  Id: z84.string(),
-  RepoDigests: z84.array(z84.string()).readonly().nullable(),
-  Os: z84.string(),
-  Architecture: z84.string(),
+var ConfigSchema = z85.object({ OnBuild: z85.array(z85.unknown()).readonly().nullish() }).nullable();
+var PinInspectSchema = z85.object({
+  Id: z85.string(),
+  RepoDigests: z85.array(z85.string()).readonly().nullable(),
+  Os: z85.string(),
+  Architecture: z85.string(),
   Config: ConfigSchema
 }).transform((inspect) => ({
   Id: inspect.Id,
@@ -50090,7 +50216,7 @@ impd pinned ${pinned}. On the containerd image store a retag of a multi-platform
 }
 
 // packages/daemon/src/imps/images/build/build-engine.ts
-import * as z85 from "zod";
+import * as z86 from "zod";
 
 // packages/daemon/src/imps/docker-contract/dockerfile-frontend.ts
 var DOCKERFILE_FRONTEND = "docker/dockerfile:1.28@sha256:bb22d9815c728170f72750f4e5b0d672e06176142e1d602c7e66c050100b7e5b";
@@ -50124,7 +50250,7 @@ function createBuildEngine(run) {
       if (version.exitCode !== 0) {
         throw new Error(`docker version: ${version.stderr.trim()}`);
       }
-      const [os, arch] = z85.tuple([z85.string(), z85.string()]).parse(version.stdout.trim().split(" ").map((part) => JSON.parse(part)));
+      const [os, arch] = z86.tuple([z86.string(), z86.string()]).parse(version.stdout.trim().split(" ").map((part) => JSON.parse(part)));
       return normalizePlatform(os, arch);
     },
     loadImage: async (image, signal) => {
@@ -50226,7 +50352,7 @@ class DockerBuildError extends Error {
 }
 
 // packages/daemon/src/imps/images/build/guest-build.ts
-import * as z86 from "zod";
+import * as z87 from "zod";
 
 // packages/daemon/src/imps/images/build/image-limit-error.ts
 class ImageLimitError extends ImpdError {
@@ -50498,8 +50624,8 @@ function createPlainLines(output) {
 // packages/daemon/src/imps/images/build/guest-build.ts
 var GUEST_BUILD_TAG = "imp-build:latest";
 var LOG_MAX_CHARS = 8000;
-var ContainerIdSchema = z86.string().regex(/^[a-f0-9]{64}$/v);
-var OciConfigSchema = z86.record(z86.string(), z86.unknown()).nullable();
+var ContainerIdSchema = z87.string().regex(/^[a-f0-9]{64}$/v);
+var OciConfigSchema = z87.record(z87.string(), z87.unknown()).nullable();
 async function runGuestBuild(exec, options) {
   const lines = options.output === undefined ? null : createPlainLines(options.output);
   const result = await exec([
@@ -50854,7 +50980,7 @@ function normalizeDockerfilePath(path) {
 }
 
 // packages/daemon/src/imps/images/image-naming.ts
-import * as z87 from "zod";
+import * as z88 from "zod";
 var MAX_NAME_LENGTH2 = 31;
 function deriveImageName(ref) {
   const lastSegment = parseImageReference(ref).path.split("/").at(-1) ?? "";
@@ -50864,10 +50990,10 @@ function deriveImageName(ref) {
   }
   return name;
 }
-var OciConfigSchema2 = z87.object({
-  Env: z87.array(z87.string()).nullish(),
-  WorkingDir: z87.string().nullish(),
-  User: z87.string().nullish()
+var OciConfigSchema2 = z88.object({
+  Env: z88.array(z88.string()).nullish(),
+  WorkingDir: z88.string().nullish(),
+  User: z88.string().nullish()
 }).nullish();
 function buildImageRuntimeConfig(ociConfig) {
   const parsed = OciConfigSchema2.parse(ociConfig);
@@ -50883,10 +51009,10 @@ import { existsSync as existsSync20, mkdirSync as mkdirSync22, rmSync as rmSync2
 import { join as join32 } from "path";
 
 // packages/daemon/src/imps/images/rootfs/read-oci-config.ts
-import * as z88 from "zod";
-var OciConfigSchema3 = z88.object({
-  digest: z88.string().regex(/^sha256:[a-f0-9]{64}$/v),
-  config: z88.record(z88.string(), z88.unknown()).nullable()
+import * as z89 from "zod";
+var OciConfigSchema3 = z89.object({
+  digest: z89.string().regex(/^sha256:[a-f0-9]{64}$/v),
+  config: z89.record(z89.string(), z89.unknown()).nullable()
 });
 async function readOciConfig(ref, signal, run) {
   const argv = ["oci-fetch", "config", ref];
@@ -51710,11 +51836,11 @@ function createImpdStorage(config, deps) {
 }
 
 // packages/daemon/src/host-net/net/tailscale-status.ts
-import * as z89 from "zod";
-var IpListSchema = z89.array(z89.string()).nullable().optional();
-var StatusSchema = z89.object({
-  BackendState: z89.string(),
-  Self: z89.object({ HostName: z89.string(), DNSName: z89.string().optional(), TailscaleIPs: IpListSchema }).optional()
+import * as z90 from "zod";
+var IpListSchema = z90.array(z90.string()).nullable().optional();
+var StatusSchema = z90.object({
+  BackendState: z90.string(),
+  Self: z90.object({ HostName: z90.string(), DNSName: z90.string().optional(), TailscaleIPs: IpListSchema }).optional()
 });
 var UNKNOWN = { state: null, hostname: null, dnsName: null, ip: null, ips: [] };
 var STATUS_TTL_MS = 30000;
@@ -51997,18 +52123,18 @@ import { getOAuthProviderApi } from "@better-auth/oauth-provider";
 import { createAuthEndpoint } from "better-auth/api";
 import { setSessionCookie } from "better-auth/cookies";
 import { generateRandomString } from "better-auth/crypto";
-import * as z90 from "zod";
+import * as z91 from "zod";
 var CLIENT_SCOPES = [...ScopeSchema.options, "offline_access"];
 var APPROVAL_EMAIL_DOMAIN = "approval.imp.invalid";
-var SignInBodySchema = z90.object({
-  oauth_query: z90.string(),
-  tokenID: z90.string().min(1),
-  tokenName: z90.string().min(1),
-  imps: z90.array(z90.string()).nullable()
+var SignInBodySchema = z91.object({
+  oauth_query: z91.string(),
+  tokenID: z91.string().min(1),
+  tokenName: z91.string().min(1),
+  imps: z91.array(z91.string()).nullable()
 });
-var FixedClientBodySchema = z90.object({
-  name: z90.string().min(1),
-  redirectURIs: z90.array(z90.string()).min(1)
+var FixedClientBodySchema = z91.object({
+  name: z91.string().min(1),
+  redirectURIs: z91.array(z91.string()).min(1)
 });
 function createApproverPlugin() {
   return {
@@ -52034,7 +52160,7 @@ function createApproverPlugin() {
       }),
       verifyMCPAccessToken: createAuthEndpoint("/imp/verify-access-token", {
         method: "POST",
-        body: z90.object({ token: z90.string() }),
+        body: z91.object({ token: z91.string() }),
         metadata: { SERVER_ONLY: true }
       }, async (ctx) => {
         const provider = ctx.context.getPlugin("oauth-provider");
@@ -52078,7 +52204,7 @@ function createApproverPlugin() {
 
 // packages/daemon/src/identity/oauth/create-oauth-handlers.ts
 import { verifyOAuthQueryParams } from "@better-auth/oauth-provider";
-import * as z91 from "zod";
+import * as z92 from "zod";
 
 // packages/daemon/src/identity/oauth/build-bad-token-request.ts
 function buildBadTokenRequest() {
@@ -52306,14 +52432,14 @@ function expandScopes(asked) {
 }
 
 // packages/daemon/src/platform/http/render-html.ts
-import { P as P4, match as match14 } from "ts-pattern";
+import { P as P4, match as match15 } from "ts-pattern";
 var MARKUP = Symbol("markup");
 function renderHTML(strings, ...parts) {
   const html = parts.reduce((text, part, index) => `${text}${toHTML(part)}${strings[index + 1] ?? ""}`, strings[0] ?? "");
   return { [MARKUP]: true, html };
 }
 function toHTML(part) {
-  return match14(part).with(P4.string, (text) => escapeHTML(text)).with(P4.array(), (list) => list.map((each) => each.html).join("")).with({ html: P4.string }, (markup) => markup.html).exhaustive();
+  return match15(part).with(P4.string, (text) => escapeHTML(text)).with(P4.array(), (list) => list.map((each) => each.html).join("")).with({ html: P4.string }, (markup) => markup.html).exhaustive();
 }
 function escapeHTML(text) {
   return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
@@ -52450,9 +52576,9 @@ var MINUTE_MS2 = 60000;
 var CONSENT_MS = 10 * MINUTE_MS2;
 var MAX_FORM_BYTES = 16 * 1024;
 var METADATA_HEADERS = { "cache-control": "no-store" };
-var PKCEMissSchema = z91.object({
-  error: z91.literal("invalid_request"),
-  error_description: z91.literal("code verification failed")
+var PKCEMissSchema = z92.object({
+  error: z92.literal("invalid_request"),
+  error_description: z92.literal("code verification failed")
 });
 function createOAuthHandlers(deps) {
   const host = new URL(deps.origin).host;
@@ -53144,8 +53270,8 @@ function loadOrCreateHostId(dataDir) {
 
 // packages/daemon/src/network/tailnet-names/oauth-credential.ts
 import { readFileSync as readFileSync29, statSync as statSync14 } from "fs";
-import * as z92 from "zod";
-var CredentialSchema = z92.object({ clientId: z92.string().min(1), clientSecret: z92.string().min(1) });
+import * as z93 from "zod";
+var CredentialSchema = z93.object({ clientId: z93.string().min(1), clientSecret: z93.string().min(1) });
 function readOAuthCredential(path) {
   const mode = statSync14(path).mode & 511;
   if ((mode & 63) !== 0) {
@@ -53166,17 +53292,17 @@ function readJson(path) {
 }
 
 // packages/daemon/src/host-net/net/tailscale-serve.ts
-import * as z93 from "zod";
-var HandlerSchema = z93.object({ Proxy: z93.string().optional() });
-var WebSchema = z93.object({
-  Handlers: z93.record(z93.string(), HandlerSchema).nullable().optional()
+import * as z94 from "zod";
+var HandlerSchema = z94.object({ Proxy: z94.string().optional() });
+var WebSchema = z94.object({
+  Handlers: z94.record(z94.string(), HandlerSchema).nullable().optional()
 });
-var ServiceConfigSchema = z93.object({
-  Web: z93.record(z93.string(), WebSchema).nullable().optional()
+var ServiceConfigSchema = z94.object({
+  Web: z94.record(z94.string(), WebSchema).nullable().optional()
 });
-var ServeStatusSchema = z93.object({
-  TCP: z93.record(z93.string(), z93.unknown()).optional(),
-  Services: z93.record(z93.string(), ServiceConfigSchema).nullable().optional()
+var ServeStatusSchema = z94.object({
+  TCP: z94.record(z94.string(), z94.unknown()).optional(),
+  Services: z94.record(z94.string(), ServiceConfigSchema).nullable().optional()
 });
 function parseServeStatus(json) {
   try {
@@ -53227,17 +53353,17 @@ function createServiceServe(run = runChecked) {
 }
 
 // packages/daemon/src/network/tailnet-names/services-api.ts
-import * as z94 from "zod";
+import * as z95 from "zod";
 var TAILSCALE_API = "https://api.tailscale.com/api/v2";
 var TOKEN_MARGIN_MS = 60000;
-var ServiceSchema2 = z94.object({
-  name: z94.string(),
-  comment: z94.string().optional(),
-  ports: z94.array(z94.string()).readonly().optional(),
-  tags: z94.array(z94.string()).readonly().nullable().optional()
+var ServiceSchema2 = z95.object({
+  name: z95.string(),
+  comment: z95.string().optional(),
+  ports: z95.array(z95.string()).readonly().optional(),
+  tags: z95.array(z95.string()).readonly().nullable().optional()
 }).readonly();
-var ServiceListSchema2 = z94.object({ vipServices: z94.array(ServiceSchema2).nullable().optional() });
-var TokenSchema3 = z94.object({ access_token: z94.string(), expires_in: z94.number().positive() });
+var ServiceListSchema2 = z95.object({ vipServices: z95.array(ServiceSchema2).nullable().optional() });
+var TokenSchema3 = z95.object({ access_token: z95.string(), expires_in: z95.number().positive() });
 
 class TailscaleApiError extends Error {
   status;
@@ -53326,7 +53452,7 @@ function createServicesApi(options) {
     }
   };
 }
-var ErrorSchema = z94.object({ message: z94.string() });
+var ErrorSchema = z95.object({ message: z95.string() });
 function readErrorText(text) {
   try {
     return ErrorSchema.parse(JSON.parse(text)).message;
@@ -53753,14 +53879,14 @@ function formatAcmeError(error) {
 // packages/daemon/src/network/https/acme/cert-store.ts
 import { existsSync as existsSync23, mkdirSync as mkdirSync24, readFileSync as readFileSync30, rmSync as rmSync29 } from "fs";
 import { join as join37 } from "path";
-import * as z95 from "zod";
-var AttemptStateSchema = z95.object({
-  failures: z95.int().nonnegative(),
-  lastAttemptAt: z95.number().nullable(),
-  lastError: z95.string().nullable()
+import * as z96 from "zod";
+var AttemptStateSchema = z96.object({
+  failures: z96.int().nonnegative(),
+  lastAttemptAt: z96.number().nullable(),
+  lastError: z96.string().nullable()
 });
-var AccountSchema = z95.object({ directoryUrl: z95.string(), url: z95.string(), keyPem: z95.string() });
-var LegacyAccountSchema = z95.object({ directoryUrl: z95.string(), url: z95.string() });
+var AccountSchema = z96.object({ directoryUrl: z96.string(), url: z96.string(), keyPem: z96.string() });
+var LegacyAccountSchema = z96.object({ directoryUrl: z96.string(), url: z96.string() });
 var NO_ATTEMPTS = { failures: 0, lastAttemptAt: null, lastError: null };
 function createCertStore(dataDir) {
   const directory = join37(dataDir, "tls");
@@ -53898,7 +54024,7 @@ function createChalltestsrvProvider(apiUrl) {
 }
 
 // packages/daemon/src/network/https/dns/cloudflare-provider.ts
-import * as z96 from "zod";
+import * as z97 from "zod";
 
 // packages/daemon/src/network/https/dns/wait-for-txt.ts
 import { Resolver as Resolver2 } from "dns/promises";
@@ -53960,30 +54086,30 @@ var CLOUDFLARE_API = "https://api.cloudflare.com/client/v4";
 var TXT_TTL_S = 60;
 var A_TTL_S = 300;
 var PAGE_SIZE = 500;
-var ApiErrorSchema = z96.object({ code: z96.number().optional(), message: z96.string() });
-var EnvelopeSchema = z96.object({
-  success: z96.boolean(),
-  errors: z96.array(ApiErrorSchema).default([]),
-  result: z96.unknown().optional(),
-  result_info: z96.object({ page: z96.number(), total_pages: z96.number() }).optional()
+var ApiErrorSchema = z97.object({ code: z97.number().optional(), message: z97.string() });
+var EnvelopeSchema = z97.object({
+  success: z97.boolean(),
+  errors: z97.array(ApiErrorSchema).default([]),
+  result: z97.unknown().optional(),
+  result_info: z97.object({ page: z97.number(), total_pages: z97.number() }).optional()
 });
-var ZoneSchema = z96.object({
-  id: z96.string(),
-  name: z96.string(),
-  name_servers: z96.array(z96.string())
+var ZoneSchema = z97.object({
+  id: z97.string(),
+  name: z97.string(),
+  name_servers: z97.array(z97.string())
 });
-var RecordSchema = z96.object({
-  id: z96.string(),
-  name: z96.string().optional(),
-  type: z96.string().optional(),
-  content: z96.string(),
-  proxied: z96.boolean().optional(),
-  comment: z96.string().nullable().optional()
+var RecordSchema = z97.object({
+  id: z97.string(),
+  name: z97.string().optional(),
+  type: z97.string().optional(),
+  content: z97.string(),
+  proxied: z97.boolean().optional(),
+  comment: z97.string().nullable().optional()
 });
 var MANAGED_COMMENT = "managed by impd";
 var ADDRESS_TYPES = new Set(["A", "AAAA", "CNAME"]);
-var ZoneListSchema = z96.array(ZoneSchema);
-var RecordListSchema = z96.array(RecordSchema);
+var ZoneListSchema = z97.array(ZoneSchema);
+var RecordListSchema = z97.array(RecordSchema);
 function createCloudflareProvider(options) {
   const base = options.apiUrl ?? CLOUDFLARE_API;
   const send = options.fetch ?? fetch;
@@ -56380,6 +56506,7 @@ async function stopImpd(parts, options) {
   if (imps !== undefined) {
     state.settled = options.sleepImps ? await runStep("sleep", readLeftMs(), () => imps.sleepAllImps()) : await runStep("lifecycle", readLeftMs(), () => imps.waitForLifecycle());
     await runStep("templates", readStepMs(), () => imps.bootTemplates?.stop());
+    await runStep("memory-warms", readStepMs(), () => imps.memoryWarm?.stopAll());
     if (options.sleepImps) {
       const sleptMs = Math.round(performance.now() - started);
       getImpdLogger("stop").info("every imp asleep in {sleptMs}ms", { sleptMs: String(sleptMs) });
@@ -56479,8 +56606,8 @@ import {
   statSync as statSync15
 } from "fs";
 import { basename as basename5, dirname as dirname11, join as join39 } from "path";
-import * as z97 from "zod";
-var CopiesSchema = z97.record(z97.string(), z97.object({ ino: z97.string(), ctimeNs: z97.string(), size: z97.string() }));
+import * as z98 from "zod";
+var CopiesSchema = z98.record(z98.string(), z98.object({ ino: z98.string(), ctimeNs: z98.string(), size: z98.string() }));
 function createXfsBackups(ctx) {
   const backup = buildBackupPaths(ctx.dataDir);
   const freshCopies = new Set;
@@ -59156,6 +59283,45 @@ log tail`);
   };
 }
 
+// packages/daemon/src/test-utils/vm/create-stub-uffd-handler.ts
+import { existsSync as existsSync34, readFileSync as readFileSync39, writeFileSync as writeFileSync16 } from "fs";
+import { join as join49 } from "path";
+import * as z99 from "zod";
+var StartSchema = z99.object({
+  options: z99.object({
+    socket: z99.string().optional(),
+    uid: z99.string().optional(),
+    gid: z99.string().optional()
+  }),
+  served: z99.string()
+});
+var WarmRunSchema = z99.object({
+  mode: z99.enum(["--count-data", "--warm"]),
+  memFile: z99.string(),
+  pid: z99.int()
+});
+function createStubUffdHandler(directory, mode = "serve") {
+  const path = join49(directory, `uffd-handler-${mode}`);
+  const recorded = join49(directory, `uffd-handler-${mode}.starts`);
+  const warmAnswer = join49(directory, `uffd-handler-${mode}.warm.json`);
+  const script = join49(import.meta.dir, "run-stub-uffd-handler.ts");
+  writeFileSync16(path, `#!/bin/sh
+exec '${process.execPath}' '${script}' '${mode}' '${recorded}' '${warmAnswer}' "$@"
+`, { mode: 493 });
+  return {
+    path,
+    readStarts: () => readRecords(recorded, StartSchema),
+    readWarmRuns: () => readRecords(`${recorded}.warms`, WarmRunSchema),
+    answerWarm: (answer) => {
+      writeFileSync16(warmAnswer, JSON.stringify(answer));
+    }
+  };
+}
+function readRecords(path, schema) {
+  return existsSync34(path) ? readFileSync39(path, "utf8").trimEnd().split(`
+`).map((line) => schema.parse(JSON.parse(line))) : [];
+}
+
 // packages/daemon/src/test-utils/start-test-impd.ts
 var FAKE_VM_RAM_MIB = 300;
 var FAKE_VM_RSS_MIB = 340;
@@ -59172,6 +59338,9 @@ async function startTestImpd(stack, options = {}) {
   if (options.dataDir === undefined) {
     stack.defer(() => rm2(dataDir, { recursive: true, force: true }));
   }
+  const handlerDir = mkdtempSync(`${tmpdir()}/${formatRunPrefix(readRunOwner())}uffd-handler-`);
+  stack.defer(() => rm2(handlerDir, { recursive: true, force: true }));
+  const uffdHandler = createStubUffdHandler(handlerDir);
   const db = await openMigratedCopy();
   stack.defer(async () => {
     await db.destroy();
@@ -59190,6 +59359,7 @@ async function startTestImpd(stack, options = {}) {
       IMP_BROKER_PORT: String(ports.take()),
       IMP_EGRESS_DNS_PORT: String(ports.take()),
       IMP_SSH_PORT: "0",
+      IMP_UFFD_HANDLER: uffdHandler.path,
       ...options.env
     }),
     defaultDiskBytes: 0
@@ -59224,7 +59394,7 @@ async function startTestImpd(stack, options = {}) {
   const createSystemDrive = (drive) => {
     const identity = buildTestIdentity(dataDir, drive);
     mkdirSync31(buildSystemDrivesDir(dataDir), { recursive: true });
-    writeFileSync16(identity.systemDrivePath, drive);
+    writeFileSync17(identity.systemDrivePath, drive);
     return identity;
   };
   const host = { identity: createSystemDrive(TEST_DRIVE) };
@@ -59398,6 +59568,7 @@ async function startTestImpd(stack, options = {}) {
     db,
     dataDir,
     fake,
+    uffdHandler,
     tickers,
     taps,
     removedTaps,
@@ -59416,7 +59587,7 @@ async function startTestImpd(stack, options = {}) {
       clock.offsetMs += durationMs;
     },
     setClock: (nowMs) => {
-      invariant7(options.frozenClockMs !== undefined, "setClock needs a frozen clock");
+      invariant8(options.frozenClockMs !== undefined, "setClock needs a frozen clock");
       clock.frozenAt = nowMs;
       clock.offsetMs = 0;
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impz/testing",
-  "version": "6.8.1",
+  "version": "6.9.0",
   "description": "A real impd on stand-ins, for Bun tests of code that drives impd through @impz/client",
   "license": "MIT",
   "repository": {
@@ -43,7 +43,7 @@
     "ts-pattern": "^5.9.2",
     "xstate": "^5.33.3",
     "zod": "^4.6.7",
-    "@impz/client": "6.8.1"
+    "@impz/client": "6.9.0"
   },
   "engines": {
     "bun": ">=1.4.3"