@ai-ecoverse/slicc-kernel 1.106.2 → 1.107.0

package/dist/node.js

@@ -699,12 +699,12 @@ function userCred(uid, gid, groups = [gid]) {
 function copyCred(cred) {
   return { ...cred, groups: [...cred.groups] };
 }
-function id(value) {
-  if (value === void 0 || value === -1 || value === 4294967295) return void 0;
-  if (!Number.isInteger(value) || value < 0 || value > MAX_ID) {
-    throw fsError("EINVAL", `not a user or group id: ${String(value)}`);
+function id(value2) {
+  if (value2 === void 0 || value2 === -1 || value2 === 4294967295) return void 0;
+  if (!Number.isInteger(value2) || value2 < 0 || value2 > MAX_ID) {
+    throw fsError("EINVAL", `not a user or group id: ${String(value2)}`);
   }
-  return value;
+  return value2;
 }
 function changeCred(cur, change) {
   if (typeof change !== "object" || change === null || Array.isArray(change)) {
@@ -715,10 +715,10 @@ function changeCred(cur, change) {
   for (const keys of [UIDS, GIDS]) {
     const own = keys.map((key) => cur[key]);
     for (const key of keys) {
-      const value = id(change[key]);
-      if (value === void 0) continue;
-      if (!privileged && !own.includes(value)) throw fsError("EPERM", `${key} ${value}`);
-      next3[key] = value;
+      const value2 = id(change[key]);
+      if (value2 === void 0) continue;
+      if (!privileged && !own.includes(value2)) throw fsError("EPERM", `${key} ${value2}`);
+      next3[key] = value2;
     }
   }
   if (change.groups !== void 0) {
@@ -1329,11 +1329,11 @@ function ipv6Groups(text) {
   } catch {
     return void 0;
   }
-  const [head, tail] = canonical.split("::");
+  const [head, tail2] = canonical.split("::");
   const part = (s) => s ? s.split(":").map((h) => Number.parseInt(h, 16)) : [];
   const front = part(head);
-  const back = part(tail);
-  return tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
+  const back = part(tail2);
+  return tail2 === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
 }
 function toBits(values, width) {
   return values.reduce((acc, v) => acc << BigInt(width) | BigInt(v), 0n);
@@ -1815,8 +1815,8 @@ var KernelSocket = class _KernelSocket {
     }
     return this.options.get(`${level}:${name2}`) ?? 0;
   }
-  setOption(level, name2, value) {
-    this.options.set(`${level}:${name2}`, value);
+  setOption(level, name2, value2) {
+    this.options.set(`${level}:${name2}`, value2);
   }
   close() {
     const was = this.state;
@@ -2214,8 +2214,8 @@ var SENT_HEADERS_DROP = /* @__PURE__ */ new Set([
 ]);
 function headerRecord(headers) {
   const out = {};
-  for (const [name2, value] of headers) {
-    if (!SENT_HEADERS_DROP.has(name2.toLowerCase())) out[name2] = value;
+  for (const [name2, value2] of headers) {
+    if (!SENT_HEADERS_DROP.has(name2.toLowerCase())) out[name2] = value2;
   }
   return out;
 }
@@ -2306,9 +2306,9 @@ var NO_WEBSOCKET = "WebSocket not supported by this transport (fetchTransport ne
 var MAX_REQUEST_BODY = 64 * 1024 * 1024;
 function joinHeaders(headers) {
   const out = new Headers();
-  for (const [name2, value] of headers) {
+  for (const [name2, value2] of headers) {
     try {
-      out.append(name2, value);
+      out.append(name2, value2);
     } catch {
     }
   }
@@ -2387,8 +2387,8 @@ function fetchTransport(options = {}) {
         );
       }
       const headers2 = [];
-      response.headers.forEach((value, name2) => {
-        headers2.push([name2, value]);
+      response.headers.forEach((value2, name2) => {
+        headers2.push([name2, value2]);
       });
       const body = chunks(response.body, options.bodyIdleMs ?? BODY_IDLE_MS);
       return {
@@ -3449,9 +3449,9 @@ var PathMap = class {
   keys() {
     return this.values.keys();
   }
-  set(path, value) {
+  set(path, value2) {
     if (!this.values.has(path)) this.link(path);
-    this.values.set(path, value);
+    this.values.set(path, value2);
     return this;
   }
   delete(path) {
@@ -3933,8 +3933,8 @@ var ProtectedFs = class {
     for (let at = fs; at && at !== Object.prototype; at = Object.getPrototypeOf(at)) {
       for (const name2 of Object.getOwnPropertyNames(at)) {
         if (name2 === "constructor" || Object.hasOwn(view2, name2)) continue;
-        const value = fs[name2];
-        view2[name2] = typeof value === "function" ? value.bind(fs) : value;
+        const value2 = fs[name2];
+        view2[name2] = typeof value2 === "function" ? value2.bind(fs) : value2;
       }
     }
     return Object.assign(view2, own);
@@ -4064,8 +4064,8 @@ function view(target, overrides) {
       if (keys.has(prop)) return overrides[prop];
       return Reflect.get(t, prop, receiver);
     },
-    set(t, prop, value) {
-      return Reflect.set(t, prop, value);
+    set(t, prop, value2) {
+      return Reflect.set(t, prop, value2);
     },
     getPrototypeOf(t) {
       return Reflect.getPrototypeOf(t);
@@ -5273,12 +5273,12 @@ var PathGate = class {
   async acquire(path) {
     const prev = this.tails.get(path) ?? Promise.resolve();
     const { promise, resolve: resolve2 } = Promise.withResolvers();
-    const tail = prev.then(() => promise);
-    this.tails.set(path, tail);
+    const tail2 = prev.then(() => promise);
+    this.tails.set(path, tail2);
     await prev;
     return () => {
       resolve2();
-      if (this.tails.get(path) === tail) this.tails.delete(path);
+      if (this.tails.get(path) === tail2) this.tails.delete(path);
     };
   }
   async run(path, op) {
@@ -5726,15 +5726,15 @@ function concat(chunks2, total = chunks2.reduce((n, c) => n + c.length, 0)) {
   }
   return out;
 }
-function safeValue(value) {
-  return !/[\r\n\0]/.test(value);
+function safeValue(value2) {
+  return !/[\r\n\0]/.test(value2);
 }
 function responseHead(status, reason, headers) {
   const phrase = /^[\t\x20-\x7e\x80-\xff]*$/.test(reason) ? reason : "";
   let head = `HTTP/1.1 ${status} ${phrase}\r
 `;
-  for (const [name2, value] of headers) {
-    if (TOKEN.test(name2) && safeValue(value)) head += `${name2}: ${value}\r
+  for (const [name2, value2] of headers) {
+    if (TOKEN.test(name2) && safeValue(value2)) head += `${name2}: ${value2}\r
 `;
   }
   return latin1Bytes(`${head}\r
@@ -6006,8 +6006,8 @@ Connection: close\r
   out.set(bytes, head.length);
   return out;
 }
-function json(value) {
-  return respond(200, `${JSON.stringify(value, null, 2)}
+function json(value2) {
+  return respond(200, `${JSON.stringify(value2, null, 2)}
 `, "application/json; charset=UTF-8");
 }
 var CdpFacade = class {
@@ -6405,9 +6405,9 @@ function comparator(token) {
 function set(text) {
   const trimmed = text.trim().replace(/(<=|>=|<|>|=|\^|~>?)\s+/g, "$1");
   if (trimmed === "") return ANY;
-  const range = /^(\S+)\s+-\s+(\S+)$/.exec(trimmed);
-  if (range) {
-    const [from, to] = [partial(range[1]), partial(range[2])];
+  const range2 = /^(\S+)\s+-\s+(\S+)$/.exec(trimmed);
+  if (range2) {
+    const [from, to] = [partial(range2[1]), partial(range2[2])];
     return from && to ? hyphen(from, to) : void 0;
   }
   const out = [];
@@ -6426,16 +6426,16 @@ function holds(v, [op, w]) {
   if (op === ">=") return c >= 0;
   return c === 0;
 }
-function satisfies(version, range) {
+function satisfies(version, range2) {
   const v = parseVersion(version);
   if (!v) return void 0;
-  const sets = range.split("||").map(set);
+  const sets = range2.split("||").map(set);
   if (sets.some((s) => s === void 0)) return void 0;
   return sets.some((s) => s.every((c) => holds(v, c)));
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.106.2" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.107.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -6459,19 +6459,19 @@ function inside(pkg, rel2) {
 function envOf(pkg, raw) {
   const env = {};
   if (!raw || typeof raw !== "object") return env;
-  for (const [key, value] of Object.entries(raw)) {
+  for (const [key, value2] of Object.entries(raw)) {
     if (!ENV_KEY.test(key)) continue;
-    if (typeof value === "string") env[key] = value.replace(PACKAGE, pkg);
-    else if (value === null) env[key] = null;
+    if (typeof value2 === "string") env[key] = value2.replace(PACKAGE, pkg);
+    else if (value2 === null) env[key] = null;
   }
   return env;
 }
 function envFields(merged2) {
   const env = {};
   const unset = [];
-  for (const [key, value] of Object.entries(merged2)) {
-    if (value === null) unset.push(key);
-    else env[key] = value;
+  for (const [key, value2] of Object.entries(merged2)) {
+    if (value2 === null) unset.push(key);
+    else env[key] = value2;
   }
   return {
     ...Object.keys(env).length > 0 ? { env } : {},
@@ -6550,9 +6550,9 @@ function commandsOf(pkg, manifest) {
 async function withPackagePaths(fs, pkg, command) {
   if (!command.env) return command;
   const env = {};
-  for (const [key, value] of Object.entries(command.env)) {
-    const path = !value.startsWith("/") && value.includes("/") && inside(pkg, value);
-    env[key] = path && await fs.exists(path) ? path : value;
+  for (const [key, value2] of Object.entries(command.env)) {
+    const path = !value2.startsWith("/") && value2.includes("/") && inside(pkg, value2);
+    env[key] = path && await fs.exists(path) ? path : value2;
   }
   return { ...command, env };
 }
@@ -6603,7 +6603,7 @@ function physicalResolver(fs) {
   const known = /* @__PURE__ */ new Map();
   const pending = /* @__PURE__ */ new Set();
   let hops = 0;
-  const step = async (path) => {
+  const step2 = async (path) => {
     if (path === "/") return { path, file: false };
     const slash = path.lastIndexOf("/");
     const parent = await resolve2(path.slice(0, slash) || "/");
@@ -6620,7 +6620,7 @@ function physicalResolver(fs) {
     let found = known.get(path);
     if (!found) {
       pending.add(path);
-      found = step(path).finally(() => pending.delete(path));
+      found = step2(path).finally(() => pending.delete(path));
       known.set(path, found);
     }
     return found;
@@ -6655,15 +6655,15 @@ async function binCommandsOf(physical, pkg, manifest, taken) {
 }
 function engineRefusal(manifest, kernel) {
   const engines = manifest.engines;
-  const range = engines && typeof engines === "object" ? engines["slicc-kernel"] : void 0;
+  const range2 = engines && typeof engines === "object" ? engines["slicc-kernel"] : void 0;
   const running = parseVersion(kernel);
-  if (typeof range !== "string" || !running || running.slice(0, 3).every((n) => n === 0)) {
+  if (typeof range2 !== "string" || !running || running.slice(0, 3).every((n) => n === 0)) {
     return void 0;
   }
-  const fits = satisfies(kernel, range);
+  const fits = satisfies(kernel, range2);
   if (fits) return void 0;
   const who = `${String(manifest.name ?? "?")}@${String(manifest.version ?? "?")}`;
-  return fits === false ? `${who} needs slicc-kernel ${range}; this kernel is ${kernel}` : `${who} has an engines.slicc-kernel range this kernel can't read: ${JSON.stringify(range)}`;
+  return fits === false ? `${who} needs slicc-kernel ${range2}; this kernel is ${kernel}` : `${who} has an engines.slicc-kernel range this kernel can't read: ${JSON.stringify(range2)}`;
 }
 var PACKAGE_NAME = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
 function replacesOf(manifest) {
@@ -6794,6 +6794,573 @@ function binfmtOf(binfmts, path) {
   return best === void 0 ? void 0 : binfmts.get(best);
 }
 
+// src/cron/clock.ts
+var systemCronClock = {
+  now: () => Date.now(),
+  sleep(until, signal) {
+    if (signal.aborted) return Promise.resolve();
+    return new Promise((resolve2) => {
+      const done4 = () => {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", done4);
+        resolve2();
+      };
+      const timer = setTimeout(done4, Math.max(0, until - Date.now()));
+      timer.unref?.();
+      signal.addEventListener("abort", done4, { once: true });
+    });
+  }
+};
+
+// src/cron/schedule.ts
+var MISSED_CAP = 1e5;
+var MACROS = {
+  "@yearly": "0 0 1 1 *",
+  "@annually": "0 0 1 1 *",
+  "@monthly": "0 0 1 * *",
+  "@weekly": "0 0 * * 0",
+  "@daily": "0 0 * * *",
+  "@midnight": "0 0 * * *",
+  "@hourly": "0 * * * *"
+};
+var MONTHS = ["jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec"];
+var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
+var FIELDS = [
+  { name: "minute", min: 0, max: 59 },
+  { name: "hour", min: 0, max: 23 },
+  { name: "day of month", min: 1, max: 31 },
+  { name: "month", min: 1, max: 12, names: MONTHS, offset: 1 },
+  { name: "day of week", min: 0, max: 7, names: WEEKDAYS }
+];
+function value(text, field4) {
+  const named = field4.names?.indexOf(text.toLowerCase()) ?? -1;
+  if (named >= 0) return named + (field4.offset ?? 0);
+  if (!/^\d+$/.test(text)) throw new Error(`${field4.name}: "${text}" is not a number`);
+  const number = Number(text);
+  if (number < field4.min || number > field4.max)
+    throw new Error(`${field4.name}: ${number} is outside ${field4.min}-${field4.max}`);
+  return number;
+}
+function range(part, field4) {
+  if (part === "*") return [field4.min, field4.max];
+  const [from, to, extra] = part.split("-");
+  if (extra !== void 0) throw new Error(`${field4.name}: "${part}" is not a range`);
+  const start2 = value(from, field4);
+  const end = to === void 0 ? start2 : value(to, field4);
+  if (end < start2) throw new Error(`${field4.name}: range ${part} runs backwards`);
+  return [start2, end];
+}
+function step(text, field4) {
+  if (text === void 0) return 1;
+  if (!/^\d+$/.test(text) || Number(text) === 0)
+    throw new Error(`${field4.name}: step "${text}" must be a positive number`);
+  return Number(text);
+}
+function field2(text, spec) {
+  const out = /* @__PURE__ */ new Set();
+  for (const part of text.split(",")) {
+    if (part === "") throw new Error(`${spec.name}: empty list item`);
+    const [base, every, extra] = part.split("/");
+    if (extra !== void 0) throw new Error(`${spec.name}: "${part}" has two steps`);
+    const [start2, end] = range(base, spec);
+    const stride = step(every, spec);
+    const last = every !== void 0 && !base.includes("-") ? spec.max : end;
+    for (let n = start2; n <= last; n += stride) out.add(n);
+  }
+  return out;
+}
+function parseSchedule(expression) {
+  const trimmed = expression.trim();
+  const text = MACROS[trimmed.toLowerCase()] ?? trimmed;
+  if (text.startsWith("@")) throw new Error(`unknown schedule ${trimmed}`);
+  const parts2 = text.split(/\s+/);
+  if (parts2.length !== 5)
+    throw new Error(
+      `"${trimmed}" needs 5 fields (minute hour day month weekday), not ${parts2.length}`
+    );
+  const [minutes, hours, days, months, weekdays] = parts2.map(
+    (part, at) => field2(part, FIELDS[at])
+  );
+  if (weekdays.delete(7)) weekdays.add(0);
+  return {
+    minutes,
+    hours,
+    days,
+    months,
+    weekdays,
+    anyDay: parts2[2].startsWith("*"),
+    anyWeekday: parts2[4].startsWith("*")
+  };
+}
+function parseWhen(expression) {
+  if (expression.trim().toLowerCase() === "@reboot") return { reboot: true };
+  return { reboot: false, schedule: parseSchedule(expression) };
+}
+var LOCAL = {
+  year: (d) => d.getFullYear(),
+  month: (d) => d.getMonth(),
+  date: (d) => d.getDate(),
+  day: (d) => d.getDay(),
+  hours: (d) => d.getHours(),
+  minutes: (d) => d.getMinutes(),
+  setMonth: (d, month) => d.setMonth(month, 1),
+  setDate: (d, date) => d.setDate(date),
+  setHours: (d, hours) => d.setHours(hours, 0, 0, 0),
+  setMinutes: (d, minutes) => d.setMinutes(minutes, 0, 0)
+};
+var UTC = {
+  year: (d) => d.getUTCFullYear(),
+  month: (d) => d.getUTCMonth(),
+  date: (d) => d.getUTCDate(),
+  day: (d) => d.getUTCDay(),
+  hours: (d) => d.getUTCHours(),
+  minutes: (d) => d.getUTCMinutes(),
+  setMonth: (d, month) => d.setUTCMonth(month, 1),
+  setDate: (d, date) => d.setUTCDate(date),
+  setHours: (d, hours) => d.setUTCHours(hours, 0, 0, 0),
+  setMinutes: (d, minutes) => d.setUTCMinutes(minutes, 0, 0)
+};
+function dayMatches(schedule, cal, date) {
+  const day = schedule.days.has(cal.date(date));
+  const weekday = schedule.weekdays.has(cal.day(date));
+  if (schedule.anyDay || schedule.anyWeekday) return day && weekday;
+  return day || weekday;
+}
+var LIMIT_YEARS = 8;
+function nextFire(schedule, after, utc = false) {
+  const cal = utc ? UTC : LOCAL;
+  const date = new Date(Math.floor(after / 6e4) * 6e4 + 6e4);
+  const limit = cal.year(date) + LIMIT_YEARS;
+  while (cal.year(date) <= limit) {
+    if (!schedule.months.has(cal.month(date) + 1)) {
+      cal.setMonth(date, cal.month(date) + 1);
+      cal.setHours(date, 0);
+    } else if (!dayMatches(schedule, cal, date)) {
+      cal.setDate(date, cal.date(date) + 1);
+      cal.setHours(date, 0);
+    } else if (!schedule.hours.has(cal.hours(date))) {
+      cal.setHours(date, cal.hours(date) + 1);
+    } else if (!schedule.minutes.has(cal.minutes(date))) {
+      cal.setMinutes(date, cal.minutes(date) + 1);
+    } else return date.getTime();
+  }
+  return null;
+}
+function missedFires(schedule, from, until, utc = false, cap = MISSED_CAP) {
+  let count2 = 0;
+  let last = null;
+  let at = from;
+  while (count2 < cap) {
+    at = nextFire(schedule, at, utc);
+    if (at === null || at > until) return { count: count2, last, more: false };
+    last = at;
+    count2++;
+  }
+  const next3 = nextFire(schedule, last, utc);
+  return { count: count2, last, more: next3 !== null && next3 <= until };
+}
+
+// src/cron/table.ts
+var SYSTEM_CRONTAB = "/etc/crontab";
+var SPOOL_DIR = "/var/spool/cron/crontabs";
+var ENV_LINE = /^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/;
+var NAME_LINE = /^#\s*name:\s*(.*?)\s*$/;
+var JOB_NAME = /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/;
+var USER_NAME = /^[a-z_][a-z0-9_.-]*$/;
+function unquote(text) {
+  const trimmed = text.trim();
+  const quote = trimmed[0];
+  if ((quote === '"' || quote === "'") && trimmed.length > 1 && trimmed.endsWith(quote))
+    return trimmed.slice(1, -1);
+  return trimmed;
+}
+function hashId(text) {
+  let a = 2166136261;
+  let b = 16777619;
+  for (let i = 0; i < text.length; i++) {
+    const c = text.charCodeAt(i);
+    a = Math.imul(a ^ c, 16777619);
+    b = Math.imul(b ^ c, 1540483477);
+  }
+  const hex3 = (n) => (n >>> 0).toString(16).padStart(8, "0");
+  return hex3(a) + hex3(b);
+}
+function split2(text, count2) {
+  const words2 = [];
+  let rest2 = text;
+  for (let i = 0; i < count2; i++) {
+    const match = /^(\S+)\s+/.exec(rest2);
+    if (!match) return void 0;
+    words2.push(match[1]);
+    rest2 = rest2.slice(match[0].length);
+  }
+  return [words2, rest2.trim()];
+}
+function jobOf(content, pending, ctx) {
+  const fields = content.startsWith("@") ? 1 : 5;
+  const parts2 = split2(content, fields + (ctx.system ? 1 : 0));
+  if (!parts2 || parts2[1] === "") throw new Error("no command");
+  const [words2, command] = parts2;
+  const schedule = words2.slice(0, fields).join(" ");
+  const when = parseWhen(schedule);
+  const user = ctx.system ? words2[fields] : void 0;
+  if (user !== void 0 && !USER_NAME.test(user)) throw new Error(`bad user name ${user}`);
+  if (pending !== void 0 && !JOB_NAME.test(pending))
+    throw new Error(`bad job name "${pending}"`);
+  if (pending !== void 0 && ctx.names.has(pending))
+    throw new Error(`job name ${pending} is taken`);
+  const hashed = hashId(`${ctx.path}
+${user ?? ""}
+${schedule}
+${command}`);
+  let id2 = pending ?? hashed;
+  for (let n = 2; pending === void 0 && ctx.names.has(id2); n++) id2 = `${hashed}.${n}`;
+  ctx.names.add(id2);
+  return {
+    id: id2,
+    ...pending !== void 0 ? { name: pending } : {},
+    schedule,
+    when,
+    ...user !== void 0 ? { user } : {},
+    command
+  };
+}
+function parseCrontab(text, path, system = false) {
+  const jobs = [];
+  const errors = [];
+  const env = {};
+  const ctx = { path, system, names: /* @__PURE__ */ new Set() };
+  let name2;
+  for (const [index, raw] of text.split("\n").entries()) {
+    const line = index + 1;
+    const content = raw.trim();
+    const named = NAME_LINE.exec(content);
+    if (named) {
+      name2 = named[1];
+      continue;
+    }
+    const pending = name2;
+    name2 = void 0;
+    if (content === "" || content.startsWith("#")) continue;
+    const assign = ENV_LINE.exec(content);
+    if (assign) {
+      env[assign[1]] = unquote(assign[2]);
+      continue;
+    }
+    try {
+      jobs.push({ line, ...jobOf(content, pending, ctx), env: { ...env } });
+    } catch (err) {
+      errors.push({ line, message: err.message });
+    }
+  }
+  return { jobs, errors };
+}
+
+// src/cron/service.ts
+var CRON_DIR = "/var/spool/cron";
+var STAMP_PATH = `${CRON_DIR}/stamp`;
+var LOG_DIR = "/var/log/cron";
+var ERR_LOG = `${LOG_DIR}/cron.err`;
+var LOG_CAP = 256 * 1024;
+var JOBS_PER_USER = 16;
+var WAKE_MS = 6e4;
+var BACK_JUMP_MS = 12e4;
+var DEFAULT_SHELL = "/bin/bash";
+var encoder = new TextEncoder();
+var EMPTY_STAMP = JSON.stringify({ jobs: {}, reboot: {} });
+var messageOf = (err) => err?.message ?? String(err);
+var keyOf2 = ({ source, job }) => `${source}	${job.id}`;
+function tail(bytes, cap = LOG_CAP) {
+  return bytes.length > cap ? bytes.slice(bytes.length - cap) : bytes;
+}
+function concat2(parts2) {
+  const out = new Uint8Array(parts2.reduce((n, part) => n + part.length, 0));
+  let at = 0;
+  for (const part of parts2) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+}
+var Output = class {
+  parts = [];
+  size = 0;
+  push(bytes) {
+    this.parts.push(bytes.slice());
+    this.size += bytes.length;
+    if (this.size > LOG_CAP * 2) {
+      const kept = tail(concat2(this.parts));
+      this.parts = [kept];
+      this.size = kept.length;
+    }
+  }
+  bytes() {
+    return tail(concat2(this.parts));
+  }
+};
+function readStamp(text) {
+  try {
+    const parsed2 = JSON.parse(text ?? "");
+    const jobs = parsed2.jobs && typeof parsed2.jobs === "object" ? parsed2.jobs : {};
+    const reboot = parsed2.reboot && typeof parsed2.reboot === "object" ? parsed2.reboot : {};
+    return { jobs: { ...jobs }, reboot: { ...reboot } };
+  } catch {
+    return { jobs: {}, reboot: {} };
+  }
+}
+var CronService = class {
+  host;
+  clock;
+  stopping = new AbortController();
+  gate = new PathGate();
+  running = /* @__PURE__ */ new Map();
+  reported = /* @__PURE__ */ new Map();
+  wake = new AbortController();
+  started;
+  rebooted = false;
+  constructor(host) {
+    this.host = host;
+    this.clock = host.clock ?? systemCronClock;
+  }
+  start() {
+    this.started ??= this.begin();
+    return this.started;
+  }
+  stop() {
+    this.stopping.abort();
+    this.wake.abort();
+  }
+  async begin() {
+    await this.host.ready?.().catch(() => void 0);
+    if (this.stopping.signal.aborted) return;
+    const { locks } = this.host;
+    const fire = () => this.fire().catch((err) => {
+      console.warn(`slicc-kernel cron: stopped: ${messageOf(err)}`);
+    });
+    if (!locks) return fire();
+    await locks.request(this.host.lock, { signal: this.stopping.signal }, fire).catch(() => void 0);
+  }
+  poke = () => this.wake.abort();
+  async fire() {
+    await this.provision();
+    const unwatch = await this.host.watch([SYSTEM_CRONTAB, SPOOL_DIR], this.poke);
+    try {
+      while (!this.stopping.signal.aborted) await this.pass();
+    } finally {
+      unwatch();
+    }
+  }
+  async pass() {
+    let until;
+    try {
+      until = await this.tick();
+    } catch (err) {
+      await this.error(`cron: ${messageOf(err)}`);
+      until = this.clock.now() + WAKE_MS;
+    }
+    if (this.stopping.signal.aborted) return;
+    if (this.wake.signal.aborted) this.wake = new AbortController();
+    await this.clock.sleep(until, this.wake.signal);
+  }
+  async provision() {
+    const { fs, owners } = this.host;
+    for (const [dir, mode] of [
+      [CRON_DIR, 493],
+      [SPOOL_DIR, 448],
+      [LOG_DIR, 493]
+    ]) {
+      if (await fs.exists(dir)) continue;
+      await fs.mkdir(dir, { recursive: true });
+      if (owners) await fs.chown?.(dir, { uid: 0, gid: 0, mode, follow: false });
+    }
+  }
+  async tick() {
+    const { fs } = this.host;
+    const loaded = await this.load();
+    const stamp = readStamp(await fs.readFile(STAMP_PATH).catch(() => void 0));
+    const now = this.clock.now();
+    const utc = this.clock.utc === true;
+    const due2 = [];
+    const keys = /* @__PURE__ */ new Set();
+    let next3 = now + WAKE_MS;
+    for (const entry of loaded) {
+      const key = keyOf2(entry);
+      keys.add(key);
+      const { when } = entry.job;
+      if (when.reboot) {
+        if (this.rebooted || stamp.reboot[key] === this.host.bootId) continue;
+        stamp.reboot[key] = this.host.bootId;
+        due2.push({ entry, due: now, missed: 0 });
+        continue;
+      }
+      const last = stamp.jobs[key];
+      if (typeof last !== "number" || last > now + BACK_JUMP_MS) stamp.jobs[key] = now;
+      else {
+        const missed = missedFires(when.schedule, last, now, utc);
+        if (missed.last !== null) {
+          stamp.jobs[key] = now;
+          due2.push({ entry, due: missed.last, missed: missed.count - 1 });
+        }
+      }
+      const coming = nextFire(when.schedule, Math.max(now, stamp.jobs[key]), utc);
+      if (coming !== null && coming < next3) next3 = coming;
+    }
+    this.rebooted = true;
+    for (const map of [stamp.jobs, stamp.reboot])
+      for (const key of Object.keys(map)) if (!keys.has(key)) delete map[key];
+    await this.writeStamp(stamp);
+    for (const each of due2) void this.spawn(each);
+    return next3;
+  }
+  async writeStamp(stamp) {
+    const { fs, owners } = this.host;
+    const text = JSON.stringify(stamp);
+    const old = await fs.readFile(STAMP_PATH).catch(() => void 0);
+    if (old === text || old === void 0 && text === EMPTY_STAMP) return;
+    const fresh2 = `${STAMP_PATH}.new`;
+    const owner = owners ? { uid: 0, gid: 0, mode: 384 } : void 0;
+    await fs.writeFile(fresh2, text, owner);
+    await fs.rename(fresh2, STAMP_PATH);
+  }
+  async load() {
+    const { fs } = this.host;
+    const out = [];
+    const system = await this.table(SYSTEM_CRONTAB, 0, true);
+    for (const job of system?.jobs ?? []) {
+      const account = await this.host.lookup(job.user);
+      if (account) out.push({ source: "system", account, job });
+    }
+    const names = await fs.readdir(SPOOL_DIR).catch(() => []);
+    for (const name2 of names.sort()) {
+      if (name2.startsWith(".") || name2.endsWith("~") || name2.endsWith(".new")) continue;
+      const path = `${SPOOL_DIR}/${name2}`;
+      const account = await this.host.lookup(name2);
+      if (!account) {
+        await this.once(path, "no user", [`${path}: skipped: there is no user ${name2}`]);
+        continue;
+      }
+      const table = await this.table(path, account.uid, false);
+      for (const job of table?.jobs ?? []) out.push({ source: name2, account, job });
+    }
+    return out;
+  }
+  async table(path, uid, system) {
+    const { fs, owners } = this.host;
+    const st = await fs.lstat(path).catch(() => void 0);
+    if (!st) {
+      this.reported.delete(path);
+      return void 0;
+    }
+    const trusted = st.isFile && (!owners || (st.uid === uid || st.uid === 0) && (st.mode & 18) === 0);
+    if (!trusted) {
+      const who = uid === 0 ? "root" : "its user or root";
+      const why = `${path}: skipped: it must be a file of ${who}, writable by its owner only`;
+      await this.once(path, "untrusted", [why]);
+      return void 0;
+    }
+    const text = await fs.readFile(path).catch(() => "");
+    const table = parseCrontab(text, path, system);
+    const errors = table.errors.map(({ line, message: message3 }) => `${path}:${line}: ${message3}`);
+    for (const job of table.jobs) {
+      if (job.user !== void 0 && !await this.host.lookup(job.user))
+        errors.push(`${path}:${job.line}: there is no user ${job.user}`);
+    }
+    await this.once(path, text, errors);
+    return table;
+  }
+  async once(path, version, lines2) {
+    if (this.reported.get(path) === version) return;
+    this.reported.set(path, version);
+    for (const line of lines2) await this.error(line);
+  }
+  async error(line) {
+    if (this.stopping.signal.aborted) return;
+    const stamp = new Date(this.clock.now()).toISOString();
+    await this.append(ERR_LOG, encoder.encode(`${stamp} ${line}
+`), 0, 0).catch(() => void 0);
+  }
+  async append(path, bytes, uid, gid) {
+    const { fs, owners } = this.host;
+    await this.gate.run(path, async () => {
+      const dir = path.slice(0, path.lastIndexOf("/"));
+      if (!await fs.lstat(dir).catch(() => void 0)) {
+        await fs.mkdir(dir, { recursive: true });
+        if (owners) await fs.chown?.(dir, { uid: 0, gid: 0, mode: 493, follow: false });
+      }
+      const st = await fs.lstat(path).catch(() => void 0);
+      if (owners) await this.trustLog(dir, path, st, uid);
+      const old = st ? await fs.readFileBuffer(path) : void 0;
+      const next3 = tail(old ? concat2([old, bytes]) : bytes);
+      const owner = owners ? { uid, gid, mode: 384 } : void 0;
+      await fs.writeFile(path, next3, old === void 0 ? owner : void 0);
+    });
+  }
+  async trustLog(dir, path, st, uid) {
+    const parent = await this.host.fs.lstat(dir);
+    if (!parent.isDirectory || parent.isSymbolicLink || parent.uid !== 0)
+      throw new Error(`${path} not written: ${dir} must be a directory of root`);
+    if (st && (!st.isFile || st.isSymbolicLink || st.uid !== uid && st.uid !== 0))
+      throw new Error(`${path} not written: it must be a file of uid ${uid} or root`);
+  }
+  logOf({ account, job }) {
+    return normalizePath(`${LOG_DIR}/${account.name}/${job.id}.log`);
+  }
+  async spawn({ entry, due: due2, missed }) {
+    const { account, job } = entry;
+    const log = this.logOf(entry);
+    const iso = new Date(due2).toISOString();
+    const count2 = this.running.get(account.uid) ?? 0;
+    if (count2 >= JOBS_PER_USER) {
+      const why = `${JOBS_PER_USER} cron jobs of ${account.name} are running`;
+      await this.append(
+        log,
+        encoder.encode(`--- ${iso} skipped: ${why} ---
+`),
+        account.uid,
+        account.gid
+      ).catch((err) => this.error(messageOf(err)));
+      await this.error(`${account.name}/${job.id}: run due ${iso} skipped: ${why}`);
+      return;
+    }
+    this.running.set(account.uid, count2 + 1);
+    const output = new Output();
+    let ended;
+    try {
+      const cwd = await this.host.fs.exists(account.home) ? account.home : "/";
+      const shell = job.env.SHELL ?? DEFAULT_SHELL;
+      ended = await this.host.run({
+        account,
+        argv: [shell, "-c", job.command],
+        cwd,
+        env: {
+          SHELL: shell,
+          ...job.env,
+          SLICC_CRON: "1",
+          SLICC_CRON_JOB: job.id,
+          SLICC_CRON_DUE: iso,
+          SLICC_CRON_MISSED: String(missed)
+        },
+        output: (bytes) => output.push(bytes)
+      });
+    } catch (err) {
+      output.push(encoder.encode(`cron: ${messageOf(err)}
+`));
+      ended = { status: 127 };
+    } finally {
+      this.running.set(account.uid, (this.running.get(account.uid) ?? 1) - 1);
+    }
+    if (this.stopping.signal.aborted) return;
+    const exit = ended.signal ? `signal=${ended.signal}` : `exit=${ended.status}`;
+    const header4 = encoder.encode(`--- ${iso} ${exit} missed=${missed} ---
+`);
+    const body = output.bytes();
+    const newline = body.length > 0 && body[body.length - 1] !== 10 ? encoder.encode("\n") : new Uint8Array();
+    await this.append(log, concat2([header4, body, newline]), account.uid, account.gid).catch(
+      (err) => this.error(messageOf(err))
+    );
+  }
+};
+
 // src/kernel/net/proxy-service.ts
 var SEND_BUFFER2 = 1024 * 1024;
 var TLS_HANDSHAKE = 22;
@@ -6858,12 +7425,12 @@ function localV4(a, b) {
   return a === 127 || a === 0 || a === 169 && b === 254;
 }
 function hextets(address) {
-  const [head, tail, extra] = address.split("::");
+  const [head, tail2, extra] = address.split("::");
   if (extra !== void 0) return void 0;
   const part = (text) => text ? text.split(":").map((h) => Number.parseInt(h, 16)) : [];
   const front = part(head);
-  const back = part(tail);
-  const groups = tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
+  const back = part(tail2);
+  const groups = tail2 === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
   return groups.length === 8 && groups.every((g) => g >= 0 && g <= 65535) ? groups : void 0;
 }
 function localV6(address) {
@@ -7989,12 +8556,12 @@ var FreshModules = class {
     return new Proxy(fs, {
       get(target, key, receiver) {
         if (Object.hasOwn(overrides, key)) return overrides[key];
-        const value = Reflect.get(target, key, receiver);
-        if (typeof value !== "function") return value;
-        let method = bound2.get(value);
+        const value2 = Reflect.get(target, key, receiver);
+        if (typeof value2 !== "function") return value2;
+        let method = bound2.get(value2);
         if (method === void 0) {
-          method = value.bind(target);
-          bound2.set(value, method);
+          method = value2.bind(target);
+          bound2.set(value2, method);
         }
         return method;
       }
@@ -8189,8 +8756,8 @@ var FsWatchers = class {
     return new Proxy(fs, {
       get(target, key, receiver) {
         if (Object.hasOwn(overrides, key)) return overrides[key];
-        const value = Reflect.get(target, key, receiver);
-        return typeof value === "function" ? value.bind(target) : value;
+        const value2 = Reflect.get(target, key, receiver);
+        return typeof value2 === "function" ? value2.bind(target) : value2;
       }
     });
   }
@@ -8247,7 +8814,7 @@ function captureFile(onData, control) {
     close: () => control.ended()
   });
 }
-function concat2(chunks2) {
+function concat3(chunks2) {
   const out = new Uint8Array(chunks2.reduce((n, c) => n + c.length, 0));
   let offset = 0;
   for (const chunk2 of chunks2) {
@@ -8417,14 +8984,14 @@ var ChildTable = class {
     if (!slots2 || !chunks2) return new Uint8Array(0);
     slots2.delete(slot2);
     if (slots2.size === 0) this.leftovers.delete(pid);
-    return concat2(chunks2);
+    return concat3(chunks2);
   }
 };
 
 // src/kernel/clipboard.ts
 var CLIPBOARD_MAX_BYTES = 1024 * 1024;
 var CLIPBOARD_TIMEOUT_MS = 1e4;
-var encoder = new TextEncoder();
+var encoder2 = new TextEncoder();
 var decoder = new TextDecoder("utf-8", { fatal: true });
 var READY = { readable: true, writable: true, hangup: false };
 function lineOf(err) {
@@ -8492,7 +9059,7 @@ var ClipboardChannel = class {
         const asked = this.broker.ask(async (hook) => {
           const text = await hook.read(stamp);
           if (typeof text !== "string") throw new KernelError("EIO", "the clipboard gave no text");
-          return encoder.encode(text);
+          return encoder2.encode(text);
         });
         this.snapshot = asked;
         asked.then(
@@ -8602,12 +9169,12 @@ async function argvDigest(argv) {
   const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
   return [...hash].map((b) => b.toString(16).padStart(2, "0")).join("");
 }
-function isStrings(value) {
-  return Array.isArray(value) && value.every((item) => typeof item === "string");
+function isStrings(value2) {
+  return Array.isArray(value2) && value2.every((item) => typeof item === "string");
 }
-function stringRecord(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
-  const entries = Object.entries(value);
+function stringRecord(value2) {
+  if (typeof value2 !== "object" || value2 === null || Array.isArray(value2)) return void 0;
+  const entries = Object.entries(value2);
   return entries.every(([, v]) => typeof v === "string") ? Object.fromEntries(entries) : void 0;
 }
 var TicketBook = class {
@@ -8767,14 +9334,14 @@ var DriverConnection = class _DriverConnection {
 var S_ISGID4 = 1024;
 var ID = /^\d{1,10}$/;
 var MAX_ID2 = 4294967294;
-function idOption(value) {
-  return value === void 0 ? 0 : Number(value);
+function idOption(value2) {
+  return value2 === void 0 ? 0 : Number(value2);
 }
 function checkIds(options) {
   for (const key of ["uid", "gid"]) {
-    const value = options[key];
-    if (value === void 0) continue;
-    if (!ID.test(value) || Number(value) > MAX_ID2) throw errnoError("EINVAL", `${key}=${value}`);
+    const value2 = options[key];
+    if (value2 === void 0) continue;
+    if (!ID.test(value2) || Number(value2) > MAX_ID2) throw errnoError("EINVAL", `${key}=${value2}`);
   }
 }
 var MAX_LINKS7 = 40;
@@ -8988,7 +9555,7 @@ function statOf(attr2, path, mount) {
     } : {}
   };
 }
-function concat3(chunks2, total) {
+function concat4(chunks2, total) {
   if (chunks2.length === 1 && chunks2[0]?.length === total) return chunks2[0];
   const out = new Uint8Array(total);
   let at = 0;
@@ -9495,7 +10062,7 @@ var MountFs = class _MountFs {
     } finally {
       await mount.conn.call({ op: "release", fh });
     }
-    return concat3(chunks2, total);
+    return concat4(chunks2, total);
   }
   async writeFile(path, content, owner, redirects = 0) {
     const real = await this.follow(path, 0, true);
@@ -9590,7 +10157,7 @@ var MountFs = class _MountFs {
     } finally {
       await mount.conn.call({ op: "release", fh });
     }
-    return concat3(chunks2, total);
+    return concat4(chunks2, total);
   }
   fits(mount, real, end) {
     if (mount.maxFile > 0 && end > mount.maxFile) {
@@ -10003,7 +10570,7 @@ var MountFs = class _MountFs {
     await mount.conn.call({
       op: "setattr",
       path: rel2,
-      ...Object.fromEntries(attrs.filter(([, value]) => value !== void 0))
+      ...Object.fromEntries(attrs.filter(([, value2]) => value2 !== void 0))
     });
   }
   async chmod(path, mode, redirects = 0) {
@@ -10182,8 +10749,8 @@ async function storageUsage() {
 }
 var PLAIN_DIR_MODE = 493;
 var done = { ok: true, kind: "void" };
-function json2(value) {
-  return { ok: true, kind: "json", json: value };
+function json2(value2) {
+  return { ok: true, kind: "json", json: value2 };
 }
 function ownerFor2(entry, mode) {
   const cred = entry.cred?.();
@@ -10742,9 +11309,9 @@ function storeBlocked(header4, [low, high]) {
 }
 var anyBlocked = (mask) => mask !== void 0 && (mask[0] !== 0 || mask[1] !== 0);
 var U32 = 2 ** 32;
-function storeU53(header4, lo, hi, value) {
-  Atomics.store(header4, hi, Math.floor(value / U32));
-  Atomics.store(header4, lo, value % U32 | 0);
+function storeU53(header4, lo, hi, value2) {
+  Atomics.store(header4, hi, Math.floor(value2 / U32));
+  Atomics.store(header4, lo, value2 % U32 | 0);
 }
 var SAB_STATE_READY = 2;
 var SAB_STATUS_BYTES = 1;
@@ -10755,20 +11322,20 @@ var SAB_DEFAULT_WINDOW_BYTES = 1024 * 1024;
 var SAB_MIN_BYTES = SAB_HEADER_BYTES + 4096;
 var SYNC_SAB_REQ_MSG = "sync-sab-req";
 var SYNC_SAB_NEXT_MSG = "sync-sab-next";
-var encoder2 = new TextEncoder();
+var encoder3 = new TextEncoder();
 var decoder2 = new TextDecoder();
 function encodeSabResult(result) {
   if (!result.ok) {
     return {
       status: SAB_STATUS_ERRNO,
-      payload: encoder2.encode(JSON.stringify({ errno: result.errno, message: result.message }))
+      payload: encoder3.encode(JSON.stringify({ errno: result.errno, message: result.message }))
     };
   }
   switch (result.kind) {
     case "bytes":
       return { status: SAB_STATUS_BYTES, payload: result.bytes };
     case "json":
-      return { status: SAB_STATUS_JSON, payload: encoder2.encode(JSON.stringify(result.json)) };
+      return { status: SAB_STATUS_JSON, payload: encoder3.encode(JSON.stringify(result.json)) };
     default:
       return { status: SAB_STATUS_VOID, payload: new Uint8Array(0) };
   }
@@ -10876,14 +11443,14 @@ function attachSyncSabResponder(port, sab, token, opts) {
 
 // src/kernel/cpu-clock.ts
 var SYS_CAP_US = 2e4;
-var LOCAL = SAB_CLOCK_OFFSET;
+var LOCAL2 = SAB_CLOCK_OFFSET;
 var BLOCKED = 0;
 var IDLE = 1;
 function epochMicros() {
   return Math.floor((performance.timeOrigin + performance.now()) * 1e3);
 }
 function slots(sab) {
-  return new BigInt64Array(sab, LOCAL, SAB_CLOCK_I64);
+  return new BigInt64Array(sab, LOCAL2, SAB_CLOCK_I64);
 }
 var rawWait = Atomics.wait.bind(Atomics);
 function localIdle(sab, now) {
@@ -11272,14 +11839,14 @@ var KernelDgram = class {
     }
     return this.options.get(`${level}:${name2}`) ?? 0;
   }
-  setOption(level, name2, value) {
-    if (level === SOL_SOCKET2 && name2 === SO_BROADCAST && value !== 0) {
+  setOption(level, name2, value2) {
+    if (level === SOL_SOCKET2 && name2 === SO_BROADCAST && value2 !== 0) {
       throw new KernelError("EOPNOTSUPP");
     }
     if (level === IPPROTO_IP && name2 >= IP_MULTICAST_FIRST && name2 <= IP_MULTICAST_LAST) {
       throw new KernelError("ENOPROTOOPT");
     }
-    this.options.set(`${level}:${name2}`, value);
+    this.options.set(`${level}:${name2}`, value2);
   }
   close() {
     if (this.closed) return;
@@ -11538,7 +12105,7 @@ var PATH_OPS = new Set(SYNC_FS_OPS);
 var EARLY_WHOLE_FILE = 64 * 1024;
 
 // src/process/process-fds.ts
-var field2 = (text) => (text || "none").replace(/[\s\\]/g, (c) => `\\${c.charCodeAt(0).toString(8).padStart(3, "0")}`);
+var field3 = (text) => (text || "none").replace(/[\s\\]/g, (c) => `\\${c.charCodeAt(0).toString(8).padStart(3, "0")}`);
 var pinnedRoot;
 var rootKind = () => globalThis.navigator?.storage ? "opfs" : "memory";
 function mountTable(mounts = []) {
@@ -11549,7 +12116,7 @@ function mountTable(mounts = []) {
     if (m.state !== "ok") options.push(m.state);
     const access2 = options.includes("ro") ? [] : ["rw"];
     lines2.push(
-      `${field2(m.source)} ${field2(m.target)} ${m.type} ${[...access2, ...options].join(",")} 0 0`
+      `${field3(m.source)} ${field3(m.target)} ${m.type} ${[...access2, ...options].join(",")} 0 0`
     );
   }
   return `${lines2.join("\n")}
@@ -11705,7 +12272,7 @@ function memoryInfo(source, used = 0) {
     ["SReclaimable", kb(0)],
     ["SwapTotal", kb(0)],
     ["SwapFree", kb(0)]
-  ].map(([key, value]) => `${`${key}:`.padEnd(16)}${value.padStart(12)}`).concat("").join("\n");
+  ].map(([key, value2]) => `${`${key}:`.padEnd(16)}${value2.padStart(12)}`).concat("").join("\n");
 }
 function systemFile(name2, listing, now, memory) {
   if (name2 === "version") return procVersion();
@@ -11960,15 +12527,15 @@ async function procAlias(fs, path, follow2) {
   );
   if (!physical) return void 0;
   const walk2 = procWalk(path, follow2);
-  let step = walk2.next();
-  while (!step.done) {
-    const { at, check } = step.value;
+  let step2 = walk2.next();
+  while (!step2.done) {
+    const { at, check } = step2.value;
     const link2 = await readlink.call(fs, at).catch(() => void 0);
     const isDir = (st) => st.isDirectory === true;
     const target = link2 ?? (check ? await lstat.call(fs, at).then(isDir, failed) : true);
-    step = walk2.next(target);
+    step2 = walk2.next(target);
   }
-  return step.value;
+  return step2.value;
 }
 
 // src/kernel/eventfd.ts
@@ -12014,23 +12581,23 @@ var EventFd = class _EventFd {
       blocked(signal);
       await this.changes.wait(signal);
     }
-    const value = this.semaphore ? 1n : this.count;
-    this.count -= value;
+    const value2 = this.semaphore ? 1n : this.count;
+    this.count -= value2;
     this.changes.wake();
     const out = new Uint8Array(_EventFd.SIZE);
-    new DataView(out.buffer).setBigUint64(0, value, true);
+    new DataView(out.buffer).setBigUint64(0, value2, true);
     return out;
   }
   async write(bytes, signal) {
     if (bytes.length < _EventFd.SIZE) throw new KernelError("EINVAL");
-    const value = new DataView(bytes.buffer, bytes.byteOffset, _EventFd.SIZE).getBigUint64(0, true);
-    if (value > EVENTFD_MAX) throw new KernelError("EINVAL");
-    while (EVENTFD_MAX - this.count < value) {
+    const value2 = new DataView(bytes.buffer, bytes.byteOffset, _EventFd.SIZE).getBigUint64(0, true);
+    if (value2 > EVENTFD_MAX) throw new KernelError("EINVAL");
+    while (EVENTFD_MAX - this.count < value2) {
       blocked(signal);
       await this.changes.wait(signal);
     }
-    this.count += value;
-    if (value > 0n) this.changes.wake();
+    this.count += value2;
+    if (value2 > 0n) this.changes.wake();
     return _EventFd.SIZE;
   }
   poll() {
@@ -12317,10 +12884,10 @@ var LockTable = class {
   }
   set(key, owner, kind, start2, end) {
     if (kind !== "unlock" && this.holder(key, owner, { key, kind, start: start2, end })) return false;
-    const range = { start: start2, end };
+    const range2 = { start: start2, end };
     const kept = [];
     for (const lock of this.records.get(key) ?? []) {
-      if (lock.owner !== owner || !overlaps(lock, range)) kept.push(lock);
+      if (lock.owner !== owner || !overlaps(lock, range2)) kept.push(lock);
       else {
         if (lock.start < start2) kept.push({ ...lock, end: start2 });
         if (lock.end > end) kept.push({ ...lock, start: end });
@@ -12331,13 +12898,13 @@ var LockTable = class {
     this.wake(key);
     return true;
   }
-  async wait(key, owner, kind, range, blocking) {
-    const want = { key, kind, ...range };
+  async wait(key, owner, kind, range2, blocking) {
+    const want = { key, kind, ...range2 };
     let signal;
     for (; ; ) {
       const holder = this.holder(key, owner, want);
       if (!holder) {
-        this.set(key, owner, kind, range.start, range.end);
+        this.set(key, owner, kind, range2.start, range2.end);
         return;
       }
       if (this.waitsOn(holder.owner, owner)) throw new KernelError("EDEADLK");
@@ -12460,7 +13027,7 @@ var HOST_OPS = [
   "async-settle",
   "async-close"
 ];
-var json3 = (value) => ({ ok: true, kind: "json", json: value });
+var json3 = (value2) => ({ ok: true, kind: "json", json: value2 });
 var done2 = { ok: true, kind: "void" };
 var KEPT_OPS = /* @__PURE__ */ new Set(["fd-write"]);
 var unknownSettled = false;
@@ -12490,9 +13057,9 @@ var AsyncOps = class {
     );
     return id2;
   }
-  resolve(value) {
+  resolve(value2) {
     const id2 = this.hold();
-    this.complete(id2, json3(value));
+    this.complete(id2, json3(value2));
     return id2;
   }
   hold() {
@@ -12637,19 +13204,19 @@ async function recordLock2(req, ctx) {
     locks.dropFile(await fileKey(target, "close"), owner);
     return done2;
   }
-  const range = lockRange(req.start, req.len);
+  const range2 = lockRange(req.start, req.len);
   const key = await fileKey(target, req.kind, req.op === "lk-set" && req.fd !== void 0);
   if (req.op === "lk-get") {
-    const held = locks.holder(key, owner, { key, kind: req.kind, ...range });
+    const held = locks.holder(key, owner, { key, kind: req.kind, ...range2 });
     if (!held) return json3(null);
     const len = held.end === Number.POSITIVE_INFINITY ? 0 : held.end - held.start;
     return json3({ kind: held.kind, pid: held.owner, start: held.start, len });
   }
   if (req.kind !== "unlock" && req.wait) {
-    await locks.wait(key, owner, req.kind, range, ctx.blocking);
+    await locks.wait(key, owner, req.kind, range2, ctx.blocking);
     return done2;
   }
-  if (!locks.set(key, owner, req.kind, range.start, range.end)) throw new KernelError("EAGAIN");
+  if (!locks.set(key, owner, req.kind, range2.start, range2.end)) throw new KernelError("EAGAIN");
   return done2;
 }
 
@@ -12682,15 +13249,16 @@ var MAX_UNREAD = 16 * 1024 * 1024;
 function errno(code, message3) {
   return Object.assign(new Error(`${code}: ${message3}`), { code });
 }
-function requestHead(method, url, headers, extra) {
+function requestHead(method, url, headers, extra, first = []) {
   if (!TOKEN3.test(method)) throw errno("EINVAL", `method ${method}`);
-  const lines2 = [`${method} ${url.pathname}${url.search} HTTP/1.1`, `Host: ${url.host}`];
-  for (const [name2, value] of headers) {
+  const lines2 = [`${method} ${url.pathname}${url.search} HTTP/1.1`, `host: ${url.host}`];
+  for (const [name2, value2] of first) lines2.push(`${name2}: ${value2}`);
+  for (const [name2, value2] of headers) {
     if (OWN_HEADERS.has(name2.toLowerCase())) continue;
-    if (!TOKEN3.test(name2) || !SAFE_VALUE.test(value)) throw errno("EINVAL", `header ${name2}`);
-    lines2.push(`${name2}: ${value}`);
+    if (!TOKEN3.test(name2) || !SAFE_VALUE.test(value2)) throw errno("EINVAL", `header ${name2}`);
+    lines2.push(`${name2}: ${value2}`);
   }
-  for (const [name2, value] of extra) lines2.push(`${name2}: ${value}`);
+  for (const [name2, value2] of extra) lines2.push(`${name2}: ${value2}`);
   return latin1Bytes(`${lines2.join("\r\n")}\r
 \r
 `);
@@ -12799,8 +13367,8 @@ var KernelLoopback = class {
   async fetch(req, port) {
     const url = new URL(req.url);
     const body = req.body ?? (/^(POST|PUT|PATCH)$/i.test(req.method) ? new Uint8Array(0) : void 0);
-    const length2 = body ? [["Content-Length", String(body.length)]] : [];
-    const head = requestHead(req.method, url, req.headers, [...length2, ["Connection", "close"]]);
+    const length2 = body ? [["content-length", String(body.length)]] : [];
+    const head = requestHead(req.method, url, req.headers, length2, [["connection", "close"]]);
     const socket = await this.connect(url, port, req.signal);
     try {
       await writeAll2(socket, body ? concat([head, body]) : head, req.signal);
@@ -12893,7 +13461,7 @@ var LoopbackWebSocket = class {
     const queue = [];
     let wake;
     let ended = false;
-    void this.pump(new WsReader(incoming, void 0, true, true), (message3) => {
+    void this.pump(incoming, (message3) => {
       queue.push(message3);
       this.unread += message3.length;
       wake?.();
@@ -12948,7 +13516,8 @@ var LoopbackWebSocket = class {
       this.pending -= bytes.length;
     })();
   }
-  async pump(reader, deliver) {
+  async pump(incoming, deliver) {
+    const reader = new WsReader(incoming, void 0, true, true);
     let close = { code: 1006, reason: "", wasClean: false };
     try {
       for (; ; ) {
@@ -12970,11 +13539,18 @@ var LoopbackWebSocket = class {
     } finally {
       const late = setTimeout(() => this.stop.abort(), CLOSE_WAIT_MS3);
       await this.writes;
+      if (close.wasClean) await this.serverEnd(incoming);
       clearTimeout(late);
       this.socket.close();
       this.settle(close);
     }
   }
+  async serverEnd(incoming) {
+    try {
+      while ((await incoming.some(64 * 1024, this.stop.signal)).length > 0) ;
+    } catch {
+    }
+  }
   sendClose(code, reason) {
     if (this.sentClose) return;
     this.sentClose = true;
@@ -12998,7 +13574,7 @@ var LoopbackWebSocket = class {
 };
 
 // src/kernel/net/x509.ts
-function concat4(parts2) {
+function concat5(parts2) {
   const out = new Uint8Array(parts2.reduce((n, p) => n + p.length, 0));
   let at = 0;
   for (const p of parts2) {
@@ -13014,8 +13590,8 @@ function length(n) {
   return Uint8Array.of(128 | bytes.length, ...bytes);
 }
 function tlv(tag, ...contents2) {
-  const body = concat4(contents2);
-  return concat4([Uint8Array.of(tag), length(body.length), body]);
+  const body = concat5(contents2);
+  return concat5([Uint8Array.of(tag), length(body.length), body]);
 }
 var seq = (...parts2) => tlv(48, ...parts2);
 var set2 = (...parts2) => tlv(49, ...parts2);
@@ -13026,7 +13602,7 @@ function integer(magnitude) {
   let start2 = 0;
   while (start2 < magnitude.length - 1 && magnitude[start2] === 0) start2++;
   const trimmed = magnitude.subarray(start2);
-  return tlv(2, trimmed[0] & 128 ? concat4([Uint8Array.of(0), trimmed]) : trimmed);
+  return tlv(2, trimmed[0] & 128 ? concat5([Uint8Array.of(0), trimmed]) : trimmed);
 }
 function oid(dotted) {
   const [a, b, ...rest2] = dotted.split(".").map(Number);
@@ -13055,8 +13631,8 @@ function name(dn) {
   rdns.push(set2(seq(oid("2.5.4.3"), utf8(dn.commonName))));
   return seq(...rdns);
 }
-function extension(id2, critical, value) {
-  return critical ? seq(oid(id2), TRUE, octets(value)) : seq(oid(id2), octets(value));
+function extension(id2, critical, value2) {
+  return critical ? seq(oid(id2), TRUE, octets(value2)) : seq(oid(id2), octets(value2));
 }
 function children(der) {
   const out = [];
@@ -13113,11 +13689,11 @@ function ipv6(host) {
   if (!host.includes(":") || !/^[0-9A-Fa-f:.]+$/.test(host)) return void 0;
   const v4 = /(\d{1,3}(?:\.\d{1,3}){3})$/.exec(host);
   let text = host;
-  const tail = [];
+  const tail2 = [];
   if (v4) {
     const bytes = ipv4(v4[1]);
     if (!bytes) return void 0;
-    tail.push(bytes[0] << 8 | bytes[1], bytes[2] << 8 | bytes[3]);
+    tail2.push(bytes[0] << 8 | bytes[1], bytes[2] << 8 | bytes[3]);
     text = host.slice(0, -v4[1].length).replace(/:$/, host.endsWith(`::${v4[1]}`) ? ":" : "");
   }
   const halves = text.split("::");
@@ -13127,13 +13703,13 @@ function ipv6(host) {
   const back = halves.length === 2 ? groups(halves[1]) : [];
   if (![...head, ...back].every((g) => /^[0-9A-Fa-f]{1,4}$/.test(g))) return void 0;
   const words2 = [...head, ...back].map((g) => Number.parseInt(g, 16));
-  const missing4 = 8 - words2.length - tail.length;
+  const missing4 = 8 - words2.length - tail2.length;
   if (halves.length === 2 ? missing4 < 1 : missing4 !== 0) return void 0;
   const all = [
     ...head.map((g) => Number.parseInt(g, 16)),
     ...new Array(halves.length === 2 ? missing4 : 0).fill(0),
     ...back.map((g) => Number.parseInt(g, 16)),
-    ...tail
+    ...tail2
   ];
   return Uint8Array.from(all.flatMap((w) => [w >> 8, w & 255]));
 }
@@ -14123,11 +14699,11 @@ function waitFor(lookup4, signal) {
       reject(new KernelError("EINTR"));
     };
     signal?.addEventListener("abort", abort, { once: true });
-    void lookup4.work.then((value) => {
+    void lookup4.work.then((value2) => {
       if (signal?.aborted) return;
       lookup4.waiters--;
       signal?.removeEventListener("abort", abort);
-      resolve2(value);
+      resolve2(value2);
     });
   });
 }
@@ -14164,7 +14740,7 @@ function defaultTermios() {
     c_cc: cCc
   };
 }
-var encoder3 = new TextEncoder();
+var encoder4 = new TextEncoder();
 function isContinuation(byte) {
   return (byte & 192) === 128;
 }
@@ -14287,7 +14863,7 @@ var KernelTty = class {
       this.line.push(byte);
       this.readable.push(Uint8Array.from(this.line));
       this.line = [];
-      if (echo) this.output(encoder3.encode("\n"));
+      if (echo) this.output(encoder4.encode("\n"));
     } else {
       this.line.push(byte);
       if (echo) this.echo(byte);
@@ -14312,7 +14888,7 @@ var KernelTty = class {
     const utf83 = (this.termios.c_iflag & IUTF8) !== 0;
     const cells = utf83 ? dropped2.filter((b) => !isContinuation(b)).length : dropped2.length;
     if (cells > 0 && this.termios.c_lflag & ECHO) {
-      this.output(encoder3.encode("\b \b".repeat(cells)), false);
+      this.output(encoder4.encode("\b \b".repeat(cells)), false);
     }
   }
   echo(byte) {
@@ -14564,7 +15140,7 @@ function terminalOf(ctx, fd) {
   if (!tty) throw new KernelError("ENOTTY");
   return tty;
 }
-var json4 = (value) => ({ ok: true, kind: "json", json: value });
+var json4 = (value2) => ({ ok: true, kind: "json", json: value2 });
 var done3 = { ok: true, kind: "void" };
 function sizeKey(rows, cols) {
   return `${rows}x${cols}`;
@@ -14780,8 +15356,8 @@ var Semaphore = class {
   gid;
   mode;
   waiters = [];
-  constructor(value, uid, gid, mode) {
-    this.value = value;
+  constructor(value2, uid, gid, mode) {
+    this.value = value2;
     this.uid = uid;
     this.gid = gid;
     this.mode = mode;
@@ -15406,10 +15982,10 @@ var VfsNodes = class {
   async onEntry(path, op) {
     const key = await this.entryKey(path);
     const run2 = (this.entries.get(key) ?? Promise.resolve()).then(op);
-    const tail = run2.catch(() => void 0);
-    this.entries.set(key, tail);
-    void tail.then(() => {
-      if (this.entries.get(key) === tail) this.entries.delete(key);
+    const tail2 = run2.catch(() => void 0);
+    this.entries.set(key, tail2);
+    void tail2.then(() => {
+      if (this.entries.get(key) === tail2) this.entries.delete(key);
     });
     return run2;
   }
@@ -16034,11 +16610,11 @@ var MAX_READ = 1024 * 1024;
 var WRITE_ACCESS = 3;
 var KEYBOARD = /* @__PURE__ */ new Set([SIG.INT, SIG.QUIT, SIG.TSTP]);
 var DEFAULT_UMASK2 = 18;
-function words(value) {
-  if (!Array.isArray(value) || !value.every((w) => typeof w === "string")) {
+function words(value2) {
+  if (!Array.isArray(value2) || !value2.every((w) => typeof w === "string")) {
     throw new KernelError("EINVAL");
   }
-  return [...value];
+  return [...value2];
 }
 var ESCAPES = { "	": "\\t", "\n": "\\n", "\r": "\\r" };
 function clipboardLine(text) {
@@ -18011,7 +18587,7 @@ function replayingHops(inner, heldMs = HELD_MS) {
     clearTimeout(entry.timer);
     void entry.final.cancel().catch(() => void 0);
   };
-  const keyOf2 = (owner, method, url) => `${owner} ${method} ${url}`;
+  const keyOf3 = (owner, method, url) => `${owner} ${method} ${url}`;
   const hold = (key, chain2) => {
     drop(key);
     const mine = [...held.keys()].filter((k) => held.get(k)?.owner === chain2.owner);
@@ -18030,7 +18606,7 @@ function replayingHops(inner, heldMs = HELD_MS) {
     const method = followedWith(hop.status, chain2.method);
     const away = target.origin !== new URL(hop.url).origin;
     const print = away ? unauthorized(chain2.fingerprint) : chain2.fingerprint;
-    hold(keyOf2(chain2.owner, method, target.href), {
+    hold(keyOf3(chain2.owner, method, target.href), {
       ...chain2,
       method,
       fingerprint: print,
@@ -18044,7 +18620,7 @@ function replayingHops(inner, heldMs = HELD_MS) {
     },
     ...inner.websocket ? { websocket: inner.websocket.bind(inner) } : {},
     async fetch(request, owner = KERNEL) {
-      const key = keyOf2(owner, request.method, request.url);
+      const key = keyOf3(owner, request.method, request.url);
       const waiting = held.get(key);
       if (waiting && waiting.fingerprint === fingerprint(request.headers)) {
         held.delete(key);
@@ -18069,10 +18645,10 @@ function replayingHops(inner, heldMs = HELD_MS) {
 var FRAGMENT = 16;
 var MIN_VALUE = 8;
 var MIN_BASE64 = 8;
-var encoder4 = new TextEncoder();
+var encoder5 = new TextEncoder();
 var STD = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 function utf82(text) {
-  return encoder4.encode(text);
+  return encoder5.encode(text);
 }
 function base642(bytes, padded = true) {
   let out = "";
@@ -18104,30 +18680,30 @@ function embedded(bytes, offset) {
   const last = Math.floor(8 * (offset + bytes.length) / 6);
   return encoded.slice(first, last);
 }
-function unicode(value, upper) {
+function unicode(value2, upper) {
   let out = "";
-  for (let i = 0; i < value.length; i++) {
-    const unit = value.charCodeAt(i);
+  for (let i = 0; i < value2.length; i++) {
+    const unit = value2.charCodeAt(i);
     if (unit === 34) out += '\\"';
     else if (unit === 92) out += "\\\\";
     else if (unit < 32 || unit > 126) {
       const code = unit.toString(16).padStart(4, "0");
       out += `\\u${upper ? code.toUpperCase() : code}`;
-    } else out += value[i];
+    } else out += value2[i];
   }
   return out;
 }
-function percent(value) {
+function percent(value2) {
   let component;
   try {
-    component = encodeURIComponent(value);
+    component = encodeURIComponent(value2);
   } catch {
     return [];
   }
   const lower = component.replace(/%[0-9A-F]{2}/g, (escape) => escape.toLowerCase());
   const plus = component.replace(/%20/g, "+");
   let form = "";
-  for (const byte of utf82(value)) {
+  for (const byte of utf82(value2)) {
     const char = String.fromCharCode(byte);
     if (/[A-Za-z0-9*\-._]/.test(char)) form += char;
     else if (byte === 32) form += "+";
@@ -18135,8 +18711,8 @@ function percent(value) {
   }
   return [component, lower, plus, form];
 }
-function html(value, apostrophe) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, apostrophe);
+function html(value2, apostrophe) {
+  return value2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, apostrophe);
 }
 function encodings(bytes) {
   const standard = [base642(bytes), base642(bytes, false)];
@@ -18146,9 +18722,9 @@ function encodings(bytes) {
   }
   return [...standard, ...standard.map(urlSafe)];
 }
-function shapes(value) {
-  const raw = utf82(value);
-  const seen = /* @__PURE__ */ new Set([value]);
+function shapes(value2) {
+  const raw = utf82(value2);
+  const seen = /* @__PURE__ */ new Set([value2]);
   const out = [];
   if (raw.length < FRAGMENT) out.push({ bytes: raw, form: "raw" });
   for (let offset = 0; raw.length >= FRAGMENT && offset + FRAGMENT <= raw.length; offset++) {
@@ -18159,17 +18735,17 @@ function shapes(value) {
     seen.add(text);
     out.push({ bytes: utf82(text), form });
   };
-  const json5 = JSON.stringify(value).slice(1, -1);
+  const json5 = JSON.stringify(value2).slice(1, -1);
   for (const text of [
     json5,
     json5.replace(/\//g, "\\/"),
-    unicode(value, false),
-    unicode(value, true)
+    unicode(value2, false),
+    unicode(value2, true)
   ]) {
     add(text, "json");
   }
-  for (const text of percent(value)) add(text, "percent");
-  for (const text of [html(value, "&#39;"), html(value, "&#x27;")]) add(text, "html");
+  for (const text of percent(value2)) add(text, "percent");
+  for (const text of [html(value2, "&#39;"), html(value2, "&#x27;")]) add(text, "html");
   for (const text of encodings(raw)) add(text, "base64");
   add(hex2(raw), "hex");
   add(hex2(raw).toUpperCase(), "hex");
@@ -18320,15 +18896,15 @@ function resolve(c, input, start2, end, source) {
       growing: false
     };
   }
-  const value = c.values[source.secret];
+  const value2 = c.values[source.secret];
   let stop = end;
   let at = source.offset + FRAGMENT;
-  while (stop < input.length && at < value.length && input[stop] === value[at]) {
+  while (stop < input.length && at < value2.length && input[stop] === value2[at]) {
     stop++;
     at++;
   }
-  const form = source.offset === 0 && at === value.length ? "raw" : "fragment";
-  const growing = stop === input.length && at < value.length;
+  const form = source.offset === 0 && at === value2.length ? "raw" : "fragment";
+  const growing = stop === input.length && at < value2.length;
   return { start: start2, end: stop, secret: source.secret, form, rank: RANK[form], growing };
 }
 function keep(best, candidate) {
@@ -18376,7 +18952,7 @@ function count(c, hits, candidate) {
   hit.count += 1;
   hits.set(key, hit);
 }
-function concat5(parts2) {
+function concat6(parts2) {
   let length2 = 0;
   for (const part of parts2) length2 += part.length;
   const out = new Uint8Array(length2);
@@ -18418,7 +18994,7 @@ function pass(c, input, final) {
     pos = candidate.end;
   }
   parts2.push(input.subarray(pos, cut));
-  return { output: concat5(parts2), cut, hits };
+  return { output: concat6(parts2), cut, hits };
 }
 function merge(into, from) {
   for (const [key, hit] of from) {
@@ -18461,7 +19037,7 @@ function compile(secrets, options = {}) {
       };
       return {
         push(chunk2) {
-          pending = concat5([pending, chunk2]);
+          pending = concat6([pending, chunk2]);
           return run2(false);
         },
         idle() {
@@ -18481,9 +19057,9 @@ function compile(secrets, options = {}) {
 // src/kernel/scrub-file.ts
 var SCRUB_IDLE_MS = 50;
 var SCRUB_NONBLOCK_MAX = 64 * 1024;
-var encoder5 = new TextEncoder();
+var encoder6 = new TextEncoder();
 function scrubberOf(secrets) {
-  const usable = secrets.filter((s) => encoder5.encode(s.value).length >= MIN_VALUE);
+  const usable = secrets.filter((s) => encoder6.encode(s.value).length >= MIN_VALUE);
   return usable.length > 0 ? compile(usable, { idleMs: SCRUB_IDLE_MS }) : void 0;
 }
 async function writeAll3(file, bytes) {
@@ -18501,7 +19077,7 @@ function interrupted2(err) {
 function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
   const file = inner.file;
   const stream2 = scrubber.stream();
-  let tail = Promise.resolve();
+  let tail2 = Promise.resolve();
   let pending = 0;
   let busy = false;
   let timer;
@@ -18520,7 +19096,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
   const later = (bytes) => {
     if (bytes.length === 0) return;
     pending += 1;
-    tail = tail.then(() => writeAll3(file, bytes)).catch((err) => {
+    tail2 = tail2.then(() => writeAll3(file, bytes)).catch((err) => {
       if (failed3 === void 0) failed3 = err;
     }).finally(() => {
       pending -= 1;
@@ -18671,7 +19247,7 @@ var SEALED_OPS = /* @__PURE__ */ new Set([
   "cancel",
   "materialize"
 ]);
-var encoder6 = new TextEncoder();
+var encoder7 = new TextEncoder();
 var decoder3 = new TextDecoder("utf-8", { fatal: true });
 function parseSealed(bytes) {
   try {
@@ -18700,8 +19276,8 @@ function materializable(req) {
 function errorReply(code, message3) {
   return { v: 1, error: { code, message: message3 } };
 }
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
+function isRecord(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function serialized(reply) {
   let plain2;
@@ -18752,7 +19328,7 @@ var SealedChannel = class {
         await this.broker.tickets.record(req, reply, caller.pid);
       if (this.inflight !== flight) return;
       this.inflight = void 0;
-      if (reply) this.reply = encoder6.encode(serialized(reply));
+      if (reply) this.reply = encoder7.encode(serialized(reply));
     });
     this.inflight = flight;
     return length2;
@@ -19344,8 +19920,8 @@ function umountCall(target, flags2) {
 var FSTAB_PATH = "/etc/fstab";
 var FSTAB_RETRIES = [1e3, 4e3, 16e3];
 var FINAL = /* @__PURE__ */ new Set(["EINVAL", "EBUSY", "EPERM", "EACCES"]);
-function unescape(field3) {
-  return field3.replace(
+function unescape(field4) {
+  return field4.replace(
     /\\([0-7]{3})/g,
     (_, octal) => String.fromCharCode(Number.parseInt(octal, 8))
   );
@@ -19541,9 +20117,9 @@ var HostfsClient = class {
     let buffered = "";
     try {
       for (; ; ) {
-        const { done: done4, value } = await reader.read();
+        const { done: done4, value: value2 } = await reader.read();
         if (done4) return;
-        buffered += decoder4.decode(value, { stream: true });
+        buffered += decoder4.decode(value2, { stream: true });
         let end = buffered.indexOf("\n");
         while (end >= 0) {
           const line = buffered.slice(0, end).trim();
@@ -19805,10 +20381,10 @@ function timed(transport, ms) {
       reject(fsError2("ENOTCONN", why));
     }, ms);
     running.then(
-      (value) => {
+      (value2) => {
         clearTimeout(timer);
-        if (expired) late?.(value);
-        resolve2(value);
+        if (expired) late?.(value2);
+        resolve2(value2);
       },
       (err) => {
         clearTimeout(timer);
@@ -20223,9 +20799,9 @@ var ChunkedBytes = class {
     if (size < this.size) {
       const keep2 = Math.ceil(size / CHUNK3);
       this.chunks.length = Math.min(this.chunks.length, keep2);
-      const tail = this.chunks[keep2 - 1];
+      const tail2 = this.chunks[keep2 - 1];
       const from = size - (keep2 - 1) * CHUNK3;
-      if (tail && from < tail.length) tail.fill(0, from);
+      if (tail2 && from < tail2.length) tail2.fill(0, from);
     }
     this.size = size;
   }
@@ -20240,8 +20816,8 @@ var ChunkedBytes = class {
 };
 
 // src/mount/tmpfs.ts
-function idOption2(value) {
-  return value !== void 0 && /^\d+$/.test(value) ? Number(value) : 0;
+function idOption2(value2) {
+  return value2 !== void 0 && /^\d+$/.test(value2) ? Number(value2) : 0;
 }
 function created2(ino, kind, mode, from, owner) {
   const now = Date.now();
@@ -20476,7 +21052,7 @@ function importedMemory(bytes) {
     const count2 = u32();
     for (let i = 0; i < count2; i++) {
       const module = name2();
-      const field3 = name2();
+      const field4 = name2();
       const kind = bytes[at++];
       if (kind === 0) u32();
       else if (kind === 1) {
@@ -20484,7 +21060,7 @@ function importedMemory(bytes) {
         limits();
       } else if (kind === 2) {
         const l = limits();
-        return { module, name: field3, ...l };
+        return { module, name: field4, ...l };
       } else if (kind === 3) at += 2;
       else if (kind === 4) {
         at++;
@@ -20575,12 +21151,12 @@ function readImports(r, types) {
   const foreign = {};
   for (let i = r.u32(); i > 0; i--) {
     const module = r.name();
-    const field3 = r.name();
+    const field4 = r.name();
     const kind = r.byte();
     if (kind !== 0) skipImport(r, kind);
     else {
       const type = types[r.u32()] ?? "other";
-      if (!RESERVED_NAMESPACES.has(module)) (foreign[module] ??= {})[field3] = type;
+      if (!RESERVED_NAMESPACES.has(module)) (foreign[module] ??= {})[field4] = type;
     }
   }
   return foreign;
@@ -21093,7 +21669,7 @@ var LAYOUT = [
 ];
 var LOAD_SAMPLE_MS = 5e3;
 var LOAD_WINDOWS_MS = [6e4, 3e5, 9e5];
-var encoder7 = new TextEncoder();
+var encoder8 = new TextEncoder();
 var USERS_MODES = ["off", "report", "enforce"];
 function usersMode(mode = "off") {
   if (USERS_MODES.includes(mode)) return mode;
@@ -21153,10 +21729,10 @@ function shebangCommand(words2) {
     const arg2 = words2.slice(1).join(" ");
     return { interp: words2[0], args: arg2 ? [arg2] : [] };
   }
-  const split2 = words2[1] === "-S";
-  const [interp, ...rest2] = words2.slice(split2 ? 2 : 1);
+  const split3 = words2[1] === "-S";
+  const [interp, ...rest2] = words2.slice(split3 ? 2 : 1);
   const arg = rest2.join(" ");
-  return { interp, args: split2 ? rest2 : arg ? [arg] : [] };
+  return { interp, args: split3 ? rest2 : arg ? [arg] : [] };
 }
 function interpreter(head) {
   const words2 = shebang(head);
@@ -21167,9 +21743,9 @@ function interpreter(head) {
 }
 function expandDefaults(defaults, env) {
   const out = {};
-  for (const [key, value] of Object.entries(defaults ?? {})) {
+  for (const [key, value2] of Object.entries(defaults ?? {})) {
     let missing4 = false;
-    const expanded = value.replace(ENV_REFERENCE, (_, name2) => {
+    const expanded = value2.replace(ENV_REFERENCE, (_, name2) => {
       const set3 = Object.hasOwn(env, name2) ? env[name2] : void 0;
       if (set3 === void 0) missing4 = true;
       return set3 ?? "";
@@ -21211,7 +21787,7 @@ function childHandle(handle) {
     onState: (listener) => handle.onState(listener)
   };
 }
-function concat6(chunks2) {
+function concat7(chunks2) {
   const out = new Uint8Array(chunks2.reduce((n, chunk2) => n + chunk2.length, 0));
   let offset = 0;
   for (const chunk2 of chunks2) {
@@ -21316,6 +21892,8 @@ var Launcher = class {
   fileWatches;
   nextPid = 1e3;
   boot = Date.now();
+  bootId = crypto.randomUUID();
+  cron;
   terminals = 0;
   constructor(options) {
     this.usersMode = usersMode(options.users);
@@ -21446,6 +22024,7 @@ var Launcher = class {
       approve: options.approve,
       timeoutMs: options.sudoTimeoutMs
     });
+    this.cron = this.cronService(options.cron);
     void this.unlinked.sweep("/");
     this.watchers.watch(
       [this.modulesDir, this.pnpmHome, ...this.appended],
@@ -21457,6 +22036,38 @@ var Launcher = class {
       this.resetCatalogs();
     });
   }
+  cronService(options = {}) {
+    return new CronService({
+      fs: this.fs,
+      owners: this.owners,
+      lock: options.lock ?? "slicc-kernel-cron",
+      bootId: this.bootId,
+      ...options.clock ? { clock: options.clock } : {},
+      locks: cronLocks(),
+      ready: () => this.fstab,
+      lookup: (name2) => this.users.lookup(name2),
+      watch: async (paths, notify) => {
+        const local = this.watchers.watch(paths, { recursive: true }, () => notify());
+        const remote = await this.watchFiles(paths, notify);
+        return () => {
+          local();
+          remote();
+        };
+      },
+      run: async ({ account, argv, cwd, env, output }) => {
+        const ended = await this.run(argv, {
+          user: account,
+          cwd,
+          env,
+          login: true,
+          collect: false,
+          onStdout: output,
+          onStderr: output
+        });
+        return { status: ended.status, ...signalField(ended.signal) };
+      }
+    });
+  }
   get owners() {
     return this.usersMode !== "off";
   }
@@ -21816,10 +22427,10 @@ var Launcher = class {
     if (!swap) throw new SpawnError("EACCES");
     const secrets = [];
     for (const [name2, placeholder] of Object.entries(swap.placeholders)) {
-      const value = swap.values[name2];
-      if (value === void 0 || env[name2] !== placeholder) continue;
-      env[name2] = value;
-      secrets.push({ name: name2, value, placeholder });
+      const value2 = swap.values[name2];
+      if (value2 === void 0 || env[name2] !== placeholder) continue;
+      env[name2] = value2;
+      secrets.push({ name: name2, value: value2, placeholder });
     }
     const scrub = scrubberOf(secrets);
     return { env, pid, cwd: booked.cwd, ...scrub ? { scrub } : {} };
@@ -21926,7 +22537,7 @@ var Launcher = class {
     if (hit !== void 0) return hit;
     const revocations = this.revocations;
     const loading2 = load();
-    const found = loading2.then(({ value }) => value);
+    const found = loading2.then(({ value: value2 }) => value2);
     cache.set(key, found);
     const drop = () => {
       if (cache.get(key) === found) cache.delete(key);
@@ -22793,6 +23404,7 @@ var Launcher = class {
     for (const holds2 of this.held) holds2.revoke(at);
   }
   unmountAll() {
+    this.cron.stop();
     this.booting.abort();
     const targets = this.mounts.list().map((m) => m.target);
     for (const target of targets.sort((a, b) => b.length - a.length)) this.umount(target, true);
@@ -22859,7 +23471,9 @@ var Launcher = class {
     if (this.owners) await this.stampLayout();
     if (this.owners) await this.sudoer.provision();
     await writeCaFile(this.base, this.ca).catch(() => void 0);
+    await this.cron.provision().catch(() => void 0);
     this.fstab = this.mountFstab();
+    void this.cron.start();
   }
   async mountFstab() {
     const text = await this.base.readFile(FSTAB_PATH).catch(() => "");
@@ -22881,9 +23495,9 @@ var Launcher = class {
       }
     );
   }
-  environment(cwd, extra, account) {
+  environment(cwd, extra, account, login = false) {
     const env = {
-      ...this.env,
+      ...login ? networkEnv(this.hostname) : this.env,
       ...userEnv(account, this.pnpmHome),
       PWD: cwd,
       ...extra
@@ -23035,7 +23649,7 @@ var Launcher = class {
       },
       account
     );
-    const report = (message3) => options.onData(encoder7.encode(`${message3}\r
+    const report = (message3) => options.onData(encoder8.encode(`${message3}\r
 `));
     const handle = await this.launch(planned, {
       env,
@@ -23063,7 +23677,7 @@ var Launcher = class {
     tagOption(options.tag);
     const account = await this.account(options.user);
     const { cwd, file, planned } = await this.starting(argv, options.cwd, account, options.tag);
-    const env = this.environment(cwd, options.env, account);
+    const env = this.environment(cwd, options.env, account, options.login);
     const out = [];
     const err = [];
     const keep2 = options.collect !== false;
@@ -23073,13 +23687,13 @@ var Launcher = class {
     };
     const stdout = collect(out, options.onStdout);
     const stderr = collect(err, options.onStderr);
-    const report = (message3) => stderr(encoder7.encode(`${message3}
+    const report = (message3) => stderr(encoder8.encode(`${message3}
 `));
     if (!planned) {
       const directory = await this.directory(file, this.fs.resolvePath(cwd, file));
       report(`${file}: ${directory ? "Is a directory" : "command not found"}`);
       const status2 = directory ? NOT_EXECUTABLE : NOT_FOUND;
-      return { status: status2, stdout: concat6(out), stderr: concat6(err) };
+      return { status: status2, stdout: concat7(out), stderr: concat7(err) };
     }
     const fds = new FdTable();
     fds.installAt(0, options.stdin ? bytesSource(options.stdin) : deviceFile("null"));
@@ -23097,9 +23711,12 @@ var Launcher = class {
     options.onStarted?.(handle.pid);
     const status = await handle.exited;
     const signal = handle.termsig();
-    return { status, ...signal ? { signal } : {}, stdout: concat6(out), stderr: concat6(err) };
+    return { status, ...signal ? { signal } : {}, stdout: concat7(out), stderr: concat7(err) };
   }
 };
+function cronLocks() {
+  return globalThis.navigator?.locks;
+}
 
 // src/node/loopback.ts
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -23139,10 +23756,10 @@ function hextets2(address) {
     const [a, b, c, d] = dotted.split(".").map(Number);
     text = `${address.slice(0, -dotted.length)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
   }
-  const [head = "", tail] = text.split("::");
+  const [head = "", tail2] = text.split("::");
   const part = (side) => side ? side.split(":").map((w) => Number.parseInt(w, 16)) : [];
   const left = part(head);
-  const right = tail === void 0 ? [] : part(tail);
+  const right = tail2 === void 0 ? [] : part(tail2);
   const gap = Array(8 - left.length - right.length).fill(0);
   return [...left, ...gap, ...right];
 }
@@ -23870,7 +24487,7 @@ function dialStream(port, onClose) {
 
 // src/client/loopback-fetch.ts
 var OWN_HEADERS2 = /* @__PURE__ */ new Set(["host", "connection", "content-length", "transfer-encoding"]);
-var encoder8 = new TextEncoder();
+var encoder9 = new TextEncoder();
 var latin12 = new TextDecoder("latin1");
 var ByteSource = class {
   buffered = new Uint8Array(0);
@@ -23879,16 +24496,16 @@ var ByteSource = class {
     this.reader = reader;
   }
   async more() {
-    const { done: done4, value } = await this.reader.read();
+    const { done: done4, value: value2 } = await this.reader.read();
     if (done4) return false;
-    const joined3 = new Uint8Array(this.buffered.length + value.length);
+    const joined3 = new Uint8Array(this.buffered.length + value2.length);
     joined3.set(this.buffered);
-    joined3.set(value, this.buffered.length);
+    joined3.set(value2, this.buffered.length);
     this.buffered = joined3;
     return true;
   }
   async until(marker) {
-    const needle = encoder8.encode(marker);
+    const needle = encoder9.encode(marker);
     for (; ; ) {
       const at = indexOf(this.buffered, needle);
       if (at >= 0) return this.take(at + needle.length);
@@ -23991,12 +24608,12 @@ async function requestBytes(request) {
   const url = new URL(request.url);
   const body = request.body ? new Uint8Array(await request.arrayBuffer()) : void 0;
   const lines2 = [`${request.method} ${url.pathname}${url.search} HTTP/1.1`, `Host: ${url.host}`];
-  request.headers.forEach((value, name2) => {
-    if (!OWN_HEADERS2.has(name2)) lines2.push(`${name2}: ${value}`);
+  request.headers.forEach((value2, name2) => {
+    if (!OWN_HEADERS2.has(name2)) lines2.push(`${name2}: ${value2}`);
   });
   if (body) lines2.push(`Content-Length: ${body.length}`);
   lines2.push("Connection: close", "", "");
-  const head = encoder8.encode(lines2.join("\r\n"));
+  const head = encoder9.encode(lines2.join("\r\n"));
   const out = new Uint8Array(head.length + (body?.length ?? 0));
   out.set(head);
   if (body) out.set(body, head.length);
@@ -24050,8 +24667,8 @@ var KernelCallError = class extends Error {
     this.code = code;
   }
 };
-var encoder9 = new TextEncoder();
-var bytesOf2 = (data) => typeof data === "string" ? encoder9.encode(data) : data;
+var encoder10 = new TextEncoder();
+var bytesOf2 = (data) => typeof data === "string" ? encoder10.encode(data) : data;
 var UNAVAILABLE = {
   manualRedirects: false,
   encodedBodies: false,
@@ -24071,7 +24688,7 @@ async function holdLock(locks) {
   await granted2.promise;
   return { name: name2, release: () => held.resolve() };
 }
-function concat7(chunks2) {
+function concat8(chunks2) {
   const out = new Uint8Array(chunks2.reduce((n, c) => n + c.length, 0));
   let at = 0;
   for (const chunk2 of chunks2) {
@@ -24298,7 +24915,7 @@ async function runOn(channel, argv, opts) {
     onStderr: tee(2, onStderr)
   });
   const { status, signal } = await child.ended;
-  const text = (fd) => new TextDecoder().decode(concat7(chunks2[fd]));
+  const text = (fd) => new TextDecoder().decode(concat8(chunks2[fd]));
   return {
     pid: child.pid,
     status,
@@ -24547,6 +25164,12 @@ function textOf(on) {
   const decoder4 = new TextDecoder();
   return (bytes) => on(decoder4.decode(bytes, { stream: true }));
 }
+var cronLocks2 = /* @__PURE__ */ new WeakMap();
+function cronLock(root) {
+  let lock = cronLocks2.get(root);
+  if (!lock) cronLocks2.set(root, lock = `slicc-kernel-cron:${crypto.randomUUID()}`);
+  return lock;
+}
 async function createNodeKernel(options = {}) {
   const root = options.root ?? memoryRoot();
   const fs = new OpfsFs(root, void 0, void 0, { ranged: isMemoryRoot(root) });
@@ -24583,7 +25206,8 @@ async function createNodeKernel(options = {}) {
     ...options.protect ? { protect: options.protect } : {},
     ...options.sealed ? { sealed: options.sealed } : {},
     ...options.clipboard ? { clipboard: options.clipboard } : {},
-    ...options.approve ? { approve: options.approve } : {}
+    ...options.approve ? { approve: options.approve } : {},
+    cron: { lock: cronLock(root), ...options.cron?.clock ? { clock: options.cron.clock } : {} }
   });
   await launcher.prepare();
   const guard2 = (work) => new Promise((resolve2, reject) => {