@ai-ecoverse/slicc-kernel 1.114.0 → 1.116.0

package/dist/kernel-worker.js

@@ -988,6 +988,7 @@ var S_IFDIR = 16384;
 var S_IFREG = 32768;
 var S_IFLNK = 40960;
 var S_IFSOCK = 49152;
+var S_IFIFO = 4096;
 var PERM_MASK = 4095;
 var S_ISGID2 = 1024;
 var READ_ATTEMPTS = 3;
@@ -1271,7 +1272,10 @@ var OpfsFs = class {
   }
   async stampNew(path, owner, directory) {
     const owned4 = await this.newFields(path, owner, directory);
-    const fields = owner?.socket && !directory ? { ...owned4, socket: true } : owned4;
+    if (owner?.socket && owner.fifo) throw new Error("a new node is a socket or a FIFO, not both");
+    const kind = directory ? void 0 : owner?.socket ? "socket" : owner?.fifo ? "fifo" : void 0;
+    const unique = kind === "fifo" ? { ino: inodeOf(`${path}\0${crypto.randomUUID()}`) } : {};
+    const fields = kind ? { ...owned4, ...unique, [kind]: true } : owned4;
     if (fields) await this.meta.update(path, (entry) => ({ ...entry, path, ...fields }));
   }
   guarded = [];
@@ -1513,7 +1517,7 @@ var OpfsFs = class {
   }
   mode(path, directory, meta) {
     const fallback = directory || EXECUTABLE.test(path) ? 493 : 420;
-    const type = directory ? S_IFDIR : meta?.socket ? S_IFSOCK : S_IFREG;
+    const type = directory ? S_IFDIR : meta?.socket ? S_IFSOCK : meta?.fifo ? S_IFIFO : S_IFREG;
     return type | (meta?.mode ?? fallback);
   }
   id = crypto.randomUUID();
@@ -1614,11 +1618,13 @@ var OpfsFs = class {
     const kept = meta?.mtimeMs !== void 0 && meta.mtimeFor === modified ? meta.mtimeMs : modified;
     const mtime = touched ?? kept;
     const socket = !directory && meta?.socket === true;
+    const fifo = !directory && meta?.fifo === true;
     return {
-      isFile: !directory && !socket,
+      isFile: !directory && !socket && !fifo,
       isDirectory: directory,
       isSymbolicLink: false,
       ...socket ? { isSocket: true } : {},
+      ...fifo ? { isFifo: true } : {},
       size: file?.size ?? 0,
       mode: this.mode(path, directory, meta),
       mtime: new Date(mtime),
@@ -2299,6 +2305,12 @@ var Incoming = class {
     this.buf = this.buf.subarray(n);
     return out;
   }
+  async firstLine(max, signal) {
+    while (this.buf.length < max && !this.buf.includes(10) && await this.fill(signal)) ;
+    const end = this.buf.indexOf(10);
+    const bytes = this.buf.subarray(0, end >= 0 ? end + 1 : Math.min(max, this.buf.length));
+    return String.fromCharCode(...bytes);
+  }
   async peek(signal) {
     if (this.buf.length === 0) await this.fill(signal);
     return this.buf[0];
@@ -3310,8 +3322,8 @@ async function access(fs, cred, path, want, options = {}) {
   if (await present(fs, walked.path, false)) return { ...walked, denied: walked.path };
   return { ...walked, missing: true };
 }
-function refused(path, errno2 = "EACCES") {
-  return fsError(errno2, path);
+function refused(path, errno3 = "EACCES") {
+  return fsError(errno3, path);
 }
 
 // src/fs/dac.ts
@@ -3371,9 +3383,9 @@ var Created = class {
 function linked(g, options) {
   return g.links === void 0 ? options : { ...options, links: g.links };
 }
-function deny(g, op, path, errno2 = "EACCES") {
+function deny(g, op, path, errno3 = "EACCES") {
   const tag = g.tag === void 0 ? {} : { tag: g.tag };
-  g.dac.denied({ pid: g.pid, uid: g.cred.euid, op, path, errno: errno2, ...tag });
+  g.dac.denied({ pid: g.pid, uid: g.cred.euid, op, path, errno: errno3, ...tag });
 }
 var TTY_MODE = 400;
 function ttyOpenable(g, tty) {
@@ -4086,7 +4098,7 @@ var WASI_SIGNAL_TO_POSIX = Object.fromEntries(
 
 // src/process/wasi-errno.ts
 var WASI_ERRNO = {
-  ...Object.fromEntries(Object.entries(E).map(([name2, errno2]) => [`E${name2}`, errno2])),
+  ...Object.fromEntries(Object.entries(E).map(([name2, errno3]) => [`E${name2}`, errno3])),
   EWOULDBLOCK: E.AGAIN,
   ENOTSUP: 138,
   EOPNOTSUPP: 138,
@@ -4326,7 +4338,7 @@ function dialError(e, timedOut, closed) {
   if (timedOut) return new KernelError("ETIMEDOUT");
   if (closed) return new KernelError("ECONNABORTED");
   const code = e?.code;
-  const known = DIAL_ERRORS.find((errno2) => errno2 === code);
+  const known = DIAL_ERRORS.find((errno3) => errno3 === code);
   return new KernelError(known ?? "EHOSTUNREACH");
 }
 function isLoopback(host) {
@@ -4702,6 +4714,14 @@ var LoopbackNet = class {
   facades = /* @__PURE__ */ new Map();
   nextEphemeral = EPHEMERAL_FIRST;
   route;
+  origins;
+  useOrigins(serve) {
+    this.origins = serve;
+  }
+  serveOrigin(conn, origin) {
+    if (!this.origins) throw new KernelError("ENETUNREACH");
+    void this.origins(conn, origin).catch(() => conn.close());
+  }
   useUplink(route) {
     this.route = route;
   }
@@ -6221,7 +6241,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.114.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.116.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -7581,6 +7601,9 @@ var TLS_HANDSHAKE = 22;
 var TOKEN2 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 var NO_WEBSOCKET2 = "WebSocket not supported by this transport (fetchTransport needs { webSocket: true })";
 var REALM_PROXY_PORT = 3128;
+var REQUEST_LINE_MAX = 8192;
+var REQUEST_LINE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+ \S+ HTTP\/1\.[01]\r?\n$/;
+var NOT_HTTP = "not HTTP/1.1: TLS through the transport carries only HTTP/1.1 and WebSocket";
 var DEFAULT_LIMITS = {
   maxConnections: 64,
   maxHead: 64 * 1024,
@@ -7869,6 +7892,26 @@ var RealmProxy = class {
       conn.close();
     }
   }
+  async serveOrigin(conn, origin) {
+    if (this.stop.signal.aborted) {
+      conn.close();
+      return;
+    }
+    this.connections.add(conn);
+    const idle = { ms: this.limits.idleMs };
+    const incoming = new Incoming(timedSource(conn, idle, this.stop.signal));
+    try {
+      const line = await incoming.firstLine(REQUEST_LINE_MAX).catch(() => "");
+      if (line !== "" && !REQUEST_LINE.test(line)) {
+        await this.refuse(conn, new HttpError(400, NOT_HTTP));
+        return;
+      }
+      await this.requests({ sink: conn, incoming, origin, socket: conn, idle });
+    } finally {
+      this.connections.delete(conn);
+      conn.close();
+    }
+  }
   async requests(ctx) {
     try {
       for (; ; ) {
@@ -9446,6 +9489,139 @@ var TicketBook = class {
   }
 };
 
+// src/kernel/fifo.ts
+function errno(e) {
+  return e instanceof KernelError ? e : new KernelError(e.code ?? "EIO");
+}
+var FifoTable = class {
+  fifos = /* @__PURE__ */ new Map();
+  size() {
+    return this.fifos.size;
+  }
+  async open(key, path, access2, nonblock, signal) {
+    const fifo = this.entry(key);
+    if (access2 === "write" && nonblock && fifo.readers === 0) {
+      this.drop(key, fifo);
+      throw new KernelError("ENXIO");
+    }
+    const reads = access2 !== "write";
+    const writes = access2 !== "read";
+    const seen = { readOpens: fifo.readOpens, writeOpens: fifo.writeOpens };
+    if (reads) this.count(fifo, "readers", 1);
+    if (writes) this.count(fifo, "writers", 1);
+    this.notify(fifo);
+    try {
+      if (!nonblock && access2 === "read") {
+        while (fifo.writers === 0 && fifo.writeOpens === seen.writeOpens) {
+          await this.changed(fifo, signal);
+        }
+      }
+      if (!nonblock && access2 === "write") {
+        while (fifo.readers === 0 && fifo.readOpens === seen.readOpens) {
+          await this.changed(fifo, signal);
+        }
+      }
+    } catch (e) {
+      this.release(key, fifo, reads, writes);
+      throw errno(e);
+    }
+    return this.end(key, path, fifo, reads, writes);
+  }
+  entry(key) {
+    let fifo = this.fifos.get(key);
+    if (!fifo) {
+      fifo = {
+        pipe: new KernelPipe(),
+        readers: 0,
+        writers: 0,
+        readOpens: 0,
+        writeOpens: 0,
+        waiters: []
+      };
+      this.fifos.set(key, fifo);
+    }
+    return fifo;
+  }
+  count(fifo, side, by) {
+    fifo[side] += by;
+    if (side === "readers") {
+      if (by > 0) {
+        fifo.readOpens += 1;
+        fifo.pipe.openRead();
+      } else fifo.pipe.closeRead();
+    } else if (by > 0) {
+      fifo.writeOpens += 1;
+      fifo.pipe.openWrite();
+    } else fifo.pipe.closeWrite();
+  }
+  notify(fifo) {
+    const waiters = fifo.waiters;
+    fifo.waiters = [];
+    for (const wake of waiters) wake();
+  }
+  changed(fifo, signal) {
+    if (signal.aborted) return Promise.reject(new KernelError("EINTR"));
+    return new Promise((resolve2, reject) => {
+      const onAbort = () => {
+        fifo.waiters = fifo.waiters.filter((w) => w !== wake);
+        reject(new KernelError("EINTR"));
+      };
+      const wake = () => {
+        signal.removeEventListener("abort", onAbort);
+        resolve2();
+      };
+      fifo.waiters.push(wake);
+      signal.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  release(key, fifo, reads, writes) {
+    if (reads) this.count(fifo, "readers", -1);
+    if (writes) this.count(fifo, "writers", -1);
+    this.notify(fifo);
+    this.drop(key, fifo);
+  }
+  drop(key, fifo) {
+    const idle = fifo.readers === 0 && fifo.writers === 0 && fifo.waiters.length === 0;
+    if (idle && this.fifos.get(key) === fifo) this.fifos.delete(key);
+  }
+  end(key, path, fifo, reads, writes) {
+    const { pipe } = fifo;
+    let open = true;
+    return new OpenFile({
+      fifo: path,
+      ...reads ? {
+        read: async (max, signal) => {
+          try {
+            return await pipe.read(max, signal);
+          } catch (e) {
+            throw errno(e);
+          }
+        }
+      } : {},
+      ...writes ? {
+        write: async (bytes, signal) => {
+          try {
+            return await pipe.write(bytes, signal);
+          } catch (e) {
+            throw errno(e);
+          }
+        }
+      } : {},
+      close: () => {
+        if (!open) return;
+        open = false;
+        this.release(key, fifo, reads, writes);
+      },
+      poll: () => ({
+        readable: reads && pipe.readReady,
+        writable: writes && pipe.writeReady,
+        hangup: reads ? pipe.writersGone : pipe.readersGone
+      }),
+      changed: (signal) => pipe.changed(signal)
+    });
+  }
+};
+
 // src/mount/protocol.ts
 var DRIVER_PROTOCOL = [1, 2];
 function driverVersionError(theirs) {
@@ -10306,6 +10482,7 @@ var MountFs = class _MountFs {
     }
     const { mount, rel: rel2 } = found;
     this.writable(mount, real);
+    if (owner?.fifo) throw errnoError("EPERM", `${real}: this mount has no FIFOs`);
     const bytes = typeof content === "string" ? new TextEncoder().encode(content) : content;
     if (mount.maxFile > 0 && bytes.length > mount.maxFile) {
       throw errnoError(
@@ -10911,6 +11088,7 @@ var SYNC_FS_OPS = [
   "statfs",
   "hold",
   "create",
+  "mkfifo",
   "kept",
   "pread",
   "pwrite",
@@ -10943,6 +11121,7 @@ function statJson(s) {
     isFile: s.isFile,
     isSymbolicLink: s.isSymbolicLink,
     ...s.isSocket ? { isSocket: true } : {},
+    ...s.isFifo ? { isFifo: true } : {},
     size: s.size,
     mode: s.mode,
     mtimeMs: s.mtime.getTime(),
@@ -11092,6 +11271,12 @@ async function run(entry, path, req) {
     case "symlink":
       await fs.symlink(req.arg2 ?? "", path, ownerFor2(entry));
       return done;
+    case "mkfifo": {
+      const owner = ownerFor2(entry, req.mode ?? 438) ?? { uid: 0, gid: 0 };
+      await createExclusive(fs, path, { ...owner, fifo: true });
+      entry.fresh?.(path);
+      return done;
+    }
     case "create":
       await createExclusive(fs, path, ownerFor2(entry, req.mode ?? 438));
       if (req.opening) entry.created?.add(path);
@@ -11170,9 +11355,10 @@ async function guard(g, path, req, cwd) {
       return { path: await walkSafe(g, path, false) };
     }
     case "create":
+    case "mkfifo":
     case "symlink":
       await inParent(g, op, path);
-      return { path: await walkSafe(g, path, op === "create") };
+      return { path: await walkSafe(g, path, op !== "symlink") };
     case "unlink":
     case "rmdir": {
       await inParent(g, op, path, true);
@@ -11260,6 +11446,7 @@ async function accessOp(entry, path, req) {
 var CHANGING = /* @__PURE__ */ new Set([
   "mkdir",
   "create",
+  "mkfifo",
   "symlink",
   "unlink",
   "rmdir",
@@ -11454,7 +11641,13 @@ async function guardAndResolve(entry, path, req) {
   };
 }
 var REMOVALS = /* @__PURE__ */ new Set(["unlink", "rmdir", "rm"]);
-var CREATIONS = /* @__PURE__ */ new Set(["write", "mkdir", "symlink", "create"]);
+var CREATIONS = /* @__PURE__ */ new Set([
+  "write",
+  "mkdir",
+  "symlink",
+  "create",
+  "mkfifo"
+]);
 var NAMING = /* @__PURE__ */ new Set(["link", "rename"]);
 async function newDevName(entry, path, req) {
   const named = NAMING.has(req.op);
@@ -13201,16 +13394,16 @@ var TOKEN3 = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 var SAFE_VALUE = /^[^\r\n\0]*$/;
 var CLOSE_WAIT_MS3 = 5e3;
 var MAX_UNREAD = 16 * 1024 * 1024;
-function errno(code, message3) {
+function errno2(code, message3) {
   return Object.assign(new Error(`${code}: ${message3}`), { code });
 }
 function requestHead(method, url, headers, extra, first = []) {
-  if (!TOKEN3.test(method)) throw errno("EINVAL", `method ${method}`);
+  if (!TOKEN3.test(method)) throw errno2("EINVAL", `method ${method}`);
   const lines2 = [`${method} ${url.pathname}${url.search} HTTP/1.1`, `host: ${url.host}`];
   for (const [name2, value2] of first) lines2.push(`${name2}: ${value2}`);
   for (const [name2, value2] of headers) {
     if (OWN_HEADERS.has(name2.toLowerCase())) continue;
-    if (!TOKEN3.test(name2) || !SAFE_VALUE.test(value2)) throw errno("EINVAL", `header ${name2}`);
+    if (!TOKEN3.test(name2) || !SAFE_VALUE.test(value2)) throw errno2("EINVAL", `header ${name2}`);
     lines2.push(`${name2}: ${value2}`);
   }
   for (const [name2, value2] of extra) lines2.push(`${name2}: ${value2}`);
@@ -13221,7 +13414,7 @@ function requestHead(method, url, headers, extra, first = []) {
 function parseHead(bytes) {
   const [statusLine = "", ...lines2] = latin1(bytes).split(/\r?\n/);
   const match = /^HTTP\/1\.[01] (\d{3})(?: (.*))?$/.exec(statusLine);
-  if (!match) throw errno("EPROTO", `not an HTTP/1.x response: ${statusLine.slice(0, 80)}`);
+  if (!match) throw errno2("EPROTO", `not an HTTP/1.x response: ${statusLine.slice(0, 80)}`);
   const headers = [];
   for (const line of lines2) {
     const colon = line.indexOf(":");
@@ -13236,9 +13429,9 @@ async function readHead(incoming, signal) {
       raw = await incoming.head(MAX_HEAD2, signal);
     } catch (err) {
       if (err instanceof KernelError) throw err;
-      throw errno("EPROTO", "the response head is malformed or too large");
+      throw errno2("EPROTO", "the response head is malformed or too large");
     }
-    if (!raw) throw errno("ECONNRESET", "the connection closed before a response");
+    if (!raw) throw errno2("ECONNRESET", "the connection closed before a response");
     const head = parseHead(raw);
     if (head.status < 100 || head.status >= 200 || head.status === 101) return head;
   }
@@ -13247,20 +13440,20 @@ async function* chunked(incoming, signal) {
   for (; ; ) {
     const line = await incoming.line(4096, signal);
     const size = /^([0-9A-Fa-f]{1,12})[ \t]*(;.*)?$/.exec(line);
-    if (!size) throw errno("EPROTO", "a malformed chunk size");
+    if (!size) throw errno2("EPROTO", "a malformed chunk size");
     const n = Number.parseInt(size[1], 16);
     if (n === 0) {
       while (await incoming.line(MAX_HEAD2, signal) !== "") ;
       return;
     }
     yield await incoming.exactly(n, signal);
-    if (await incoming.line(2, signal) !== "") throw errno("EPROTO", "a malformed chunk");
+    if (await incoming.line(2, signal) !== "") throw errno2("EPROTO", "a malformed chunk");
   }
 }
 async function* counted(incoming, length2, signal) {
   for (let left = length2; left > 0; ) {
     const data = await incoming.some(Math.min(left, 64 * 1024), signal);
-    if (data.length === 0) throw errno("EPROTO", "the body ended early");
+    if (data.length === 0) throw errno2("EPROTO", "the body ended early");
     left -= data.length;
     yield data;
   }
@@ -13281,7 +13474,7 @@ function bodyOf(incoming, head, method, signal) {
   if (lengths.length === 0) return untilClose(incoming, signal);
   const length2 = lengths[0]?.trim() ?? "";
   if (!/^\d{1,15}$/.test(length2) || lengths.some((l) => l.trim() !== length2)) {
-    throw errno("EPROTO", `a malformed Content-Length: ${lengths.join(", ")}`);
+    throw errno2("EPROTO", `a malformed Content-Length: ${lengths.join(", ")}`);
   }
   return counted(incoming, Number(length2), signal);
 }
@@ -13299,7 +13492,7 @@ var KernelLoopback = class {
   }
   async connect(url, port, signal) {
     if (url.protocol === "https:" || url.protocol === "wss:") {
-      throw errno("ENOTSUP", `TLS to the kernel's loopback is not supported: ${url.origin}`);
+      throw errno2("ENOTSUP", `TLS to the kernel's loopback is not supported: ${url.origin}`);
     }
     signal.throwIfAborted();
     const socket = this.net.socket("inet");
@@ -13314,7 +13507,7 @@ var KernelLoopback = class {
     } catch (err) {
       socket.close();
       const refused2 = err instanceof KernelError && err.code === "ECONNREFUSED";
-      throw refused2 ? errno("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
+      throw refused2 ? errno2("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
     }
     signal.addEventListener("abort", () => socket.close(), { once: true });
     return socket;
@@ -13360,7 +13553,7 @@ var KernelLoopback = class {
       const incoming = new Incoming(socket);
       const head = await readHead(incoming, req.signal);
       if (head.status !== 101) {
-        throw errno(
+        throw errno2(
           "EPROTO",
           `the server answered the upgrade with ${head.status}${head.statusText ? ` ${head.statusText}` : ""}`
         );
@@ -13368,10 +13561,10 @@ var KernelLoopback = class {
       const upgraded = fieldTokens(head.headers, "upgrade").includes("websocket") && fieldTokens(head.headers, "connection").includes("upgrade");
       const accept2 = fieldValues(head.headers, "sec-websocket-accept")[0];
       if (!upgraded || accept2 !== await acceptFor(key)) {
-        throw errno("EPROTO", "the server did not accept the WebSocket key");
+        throw errno2("EPROTO", "the server did not accept the WebSocket key");
       }
       if (fieldValues(head.headers, "sec-websocket-extensions").length > 0) {
-        throw errno("EPROTO", "the server offered an unsolicited extension");
+        throw errno2("EPROTO", "the server offered an unsolicited extension");
       }
       const protocol = fieldValues(head.headers, "sec-websocket-protocol")[0] ?? "";
       return new LoopbackWebSocket(socket, incoming, protocol);
@@ -13389,7 +13582,7 @@ async function* closing(chunks, socket) {
     yield* chunks;
   } catch (err) {
     if (typeof err?.code === "string") throw err;
-    throw errno("EPROTO", err instanceof Error ? err.message : String(err));
+    throw errno2("EPROTO", err instanceof Error ? err.message : String(err));
   } finally {
     socket.close();
   }
@@ -13518,7 +13711,7 @@ var LoopbackWebSocket = class {
     this.write(clientFrame(OP_CLOSE, payload));
   }
   send(data) {
-    if (this.sentClose) throw errno("EPIPE", "the websocket is closing");
+    if (this.sentClose) throw errno2("EPIPE", "the websocket is closing");
     const text = typeof data === "string";
     const payload = text ? new TextEncoder().encode(data) : data;
     this.write(clientFrame(text ? OP_TEXT : OP_BINARY, payload));
@@ -14217,7 +14410,7 @@ async function writeCaFile(fs, ca, locks = globalThis.navigator?.locks) {
 function enableNetwork(net, options) {
   let proxy;
   const transport = options.transport ?? missingTransport();
-  net.activate({ family: "inet", host: "127.0.0.1", port: REALM_PROXY_PORT }, () => {
+  const start2 = () => {
     const tls = new TlsTerminator({
       ca: options.ca,
       engine: options.engine,
@@ -14236,6 +14429,11 @@ function enableNetwork(net, options) {
       if (proxy === started) proxy = void 0;
       await tls.close();
     });
+  };
+  net.activate({ family: "inet", host: "127.0.0.1", port: REALM_PROXY_PORT }, start2);
+  net.useOrigins((conn, origin) => {
+    if (!proxy) start2();
+    return proxy.serveOrigin(conn, origin);
   });
   return () => proxy;
 }
@@ -14258,8 +14456,8 @@ function errnoOf(e) {
   const code = e?.code;
   return typeof code === "string" && ERRNO.test(code) ? code : "ECONNREFUSED";
 }
-function fail(errno2, text) {
-  return { ok: false, errno: errno2, message: text };
+function fail(errno3, text) {
+  return { ok: false, errno: errno3, message: text };
 }
 var WsHandles = class {
   transport;
@@ -14533,8 +14731,8 @@ var HttpHandles = class {
       const status = e.status;
       if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
         const code = codeOf2(e);
-        const errno2 = text === NO_TRANSPORT ? "ENETUNREACH" : code !== "EIO" ? code : "ECONNREFUSED";
-        return { ok: false, errno: errno2, message: text };
+        const errno3 = text === NO_TRANSPORT ? "ENETUNREACH" : code !== "EIO" ? code : "ECONNREFUSED";
+        return { ok: false, errno: errno3, message: text };
       }
       entry.body = once(new TextEncoder().encode(text))[Symbol.asyncIterator]();
       return this.headOf(handle, req.url, {
@@ -15739,7 +15937,7 @@ var UNREACHABLE = ["EACCES", "ENETUNREACH", "EHOSTUNREACH"];
 function sendError(e) {
   if (e instanceof KernelError) return e;
   const code = e?.code;
-  return new KernelError(SEND_ERRORS.find((errno2) => errno2 === code) ?? "EHOSTUNREACH");
+  return new KernelError(SEND_ERRORS.find((errno3) => errno3 === code) ?? "EHOSTUNREACH");
 }
 function sameAddr(a, b) {
   return a.port === b.port && canonicalHost(a.host) === canonicalHost(b.host);
@@ -15868,7 +16066,7 @@ var KernelDgram = class {
   }
   unreachable(error, from) {
     if (!this.peer || !sameAddr(this.peer, from)) return;
-    this.pending = UNREACHABLE.find((errno2) => errno2 === error) ?? "EHOSTUNREACH";
+    this.pending = UNREACHABLE.find((errno3) => errno3 === error) ?? "EHOSTUNREACH";
     this.changes.wake();
   }
   deliver(datagram2) {
@@ -16151,7 +16349,8 @@ var SOCKET_OPS = [
   "sock-setopt",
   "sock-resolve",
   "sock-sendto",
-  "sock-recvfrom"
+  "sock-recvfrom",
+  "sock-tls"
 ];
 function socketAt(fds, fd) {
   const file = anySocketAt(fds, fd);
@@ -16223,6 +16422,8 @@ async function socketSyscall(req, proc) {
       if (addresses.length === 0) throw new KernelError("ENOENT");
       return ok3(addresses);
     }
+    case "sock-tls":
+      return ok3(tlsOverTransport(req, proc));
     default:
       return datagram(req, proc);
   }
@@ -16326,6 +16527,48 @@ async function accept(proc, fd, nonblock) {
   const socket = await listener.accept(waits ? proc.blocking() : void 0, nonblock);
   return { fd: proc.fds.install(new OpenFile(socket), 3), peer: socket.peer };
 }
+var NOT_HTTP_PORTS = /* @__PURE__ */ new Set([
+  465,
+  563,
+  585,
+  636,
+  853,
+  989,
+  990,
+  992,
+  993,
+  994,
+  995,
+  5061,
+  5671,
+  6697,
+  8883
+]);
+var HOST_NAME = /^[A-Za-z0-9.-]+$|^\[?[0-9A-Fa-f:.]+\]?$/;
+function tlsOverTransport(req, proc) {
+  if (req.ca) throw new KernelError("ENOTSUP");
+  if (req.alpn && req.alpn.length > 0 && !req.alpn.includes("http/1.1")) {
+    throw new KernelError("EPROTONOSUPPORT");
+  }
+  if (!Number.isInteger(req.port) || req.port < 1 || req.port > 65535)
+    throw new KernelError("EINVAL");
+  if (NOT_HTTP_PORTS.has(req.port)) throw new KernelError("EPROTONOSUPPORT");
+  const servername = req.servername || req.host;
+  if (!HOST_NAME.test(servername)) throw new KernelError("EINVAL");
+  if (isLoopbackHost(servername) || isLoopbackHost(req.host)) throw new KernelError("ENOTSUP");
+  const host = servername.includes(":") && !servername.startsWith("[") ? `[${servername}]` : servername;
+  const origin = req.port === 443 ? `https://${host}` : `https://${host}:${req.port}`;
+  const [mine, theirs] = KernelSocket.pair(proc.net, "inet", proc.cred?.());
+  mine.peer = { family: "inet", host: req.host, port: req.port };
+  try {
+    proc.net.serveOrigin(theirs, origin);
+  } catch (err) {
+    mine.close();
+    theirs.close();
+    throw err;
+  }
+  return { fd: proc.fds.install(new OpenFile(mine), 3), alpnProtocol: "http/1.1", servername };
+}
 
 // src/kernel/vfs-file.ts
 var O_ACCMODE = 3;
@@ -17200,6 +17443,7 @@ function isWasmSyscall(req) {
   return typeof op === "string" && SYSCALL_OPS.has(op);
 }
 var MAX_READ = 1024 * 1024;
+var O_NONBLOCK = 2048;
 var WRITE_ACCESS = 3;
 var KEYBOARD = /* @__PURE__ */ new Set([SIG.INT, SIG.QUIT, SIG.TSTP]);
 var DEFAULT_UMASK2 = 18;
@@ -17697,7 +17941,7 @@ var WasmProcess = class {
       this.options.hasPending?.() ? AbortSignal.abort() : this.cancelSignal(cancelled)
     );
   }
-  async openVfs(req) {
+  async openVfs(req, cancelled) {
     if (inProc(req.path)) return this.openProc(req, req.path);
     const device = req.orphan ? void 0 : deviceAt(req.path);
     if (device) return this.openDevice(req, device);
@@ -17708,6 +17952,10 @@ var WasmProcess = class {
     await refuseReadonly(this.options.fs, req.path, req.flags, req);
     if (this.writesAt(req)) await this.options.fs.mayChange?.(req.path, !req.exclusive);
     await this.mayOpen(req);
+    if (req.fifo && !req.exclusive) {
+      const opened2 = await this.openFifo(req, cancelled);
+      if (opened2 !== void 0) return opened2;
+    }
     const marked = await this.markedPath(req);
     await this.sourceOpen(marked === void 0 ? req : { ...req, path: marked });
     const fs = marked === void 0 ? this.options.fs : this.options.noLinks;
@@ -17749,6 +17997,19 @@ var WasmProcess = class {
     }
     return fd;
   }
+  async openFifo(req, cancelled) {
+    const fifos = this.options.fifos;
+    const path = await this.nodes.targetKey(req.path);
+    const st = await this.heldFs().stat(path);
+    if (!st.isFifo) return void 0;
+    if (!fifos) throw new KernelError("ENXIO");
+    const access2 = openAccess(req.flags);
+    const nonblock = (req.flags & O_NONBLOCK) !== 0;
+    const blocks = !nonblock && access2 !== "both";
+    const signal = blocks ? this.blockingSignal(cancelled) : cancelled;
+    const end = await fifos.open(`${st.dev ?? 0}:${st.ino}`, path, access2, nonblock, signal);
+    return this.fds.install(end, 3);
+  }
   openDevice(req, device) {
     if (req.exclusive) throw Object.assign(new Error(req.path), { code: "EEXIST" });
     const access2 = req.flags & WRITE_ACCESS;
@@ -17948,7 +18209,7 @@ var WasmProcess = class {
       case "fd-poll":
         return { ok: true, kind: "json", json: pollFile(this.fds.get(req.fd).file) };
       case "fd-open-vfs":
-        return { ok: true, kind: "json", json: await this.openVfs(req) };
+        return { ok: true, kind: "json", json: await this.openVfs(req, cancelled) };
       case "fd-info":
         return { ok: true, kind: "json", json: this.fdInfo(req.fd) };
       case "fd-list":
@@ -18608,7 +18869,8 @@ function inheritedFds(fds) {
       ...kind === "device" && meta && "device" in meta ? { device: meta } : {},
       ...flags2 !== void 0 ? { flags: flags2 } : {},
       ...fds.closesOnExec(fd) ? { cloexec: true } : {},
-      ...kind === "stream" ? { desc: descId(open) } : {}
+      ...kind === "stream" ? { desc: descId(open) } : {},
+      ...open.file.fifo ? { fifo: open.file.fifo } : {}
     };
   });
 }
@@ -18814,6 +19076,7 @@ function processOptions(opts, header3, hooks, created3) {
     net: opts.net,
     http: opts.http,
     locks: opts.locks,
+    fifos: opts.fifos,
     ...opts.sems ? { sems: opts.sems } : {},
     onReap: opts.onReap,
     resolver: opts.resolver,
@@ -20752,9 +21015,9 @@ var HostfsClient = class {
         throw fsError2("ESTALE", "the folder was granted again, so its open files are gone");
       return this.send(path, init, false, true);
     }
-    const errno2 = response.headers.get("X-Hostfs-Errno") ?? "EIO";
+    const errno3 = response.headers.get("X-Hostfs-Errno") ?? "EIO";
     const body = await response.json().catch(() => ({}));
-    throw fsError2(errno2, typeof body.message === "string" ? body.message : errno2);
+    throw fsError2(errno3, typeof body.message === "string" ? body.message : errno3);
   }
   async call(op, body = {}, handle = false) {
     const response = await this.send(
@@ -21839,8 +22102,8 @@ var RULE = new RegExp(
 var TERM = /^[A-Za-z0-9._+-]+$/;
 var PLAIN = /^[A-Za-z0-9_@%+=:,./-]+$/;
 var USAGE = "usage: sudo [-n] [-u user] [--] command [args...]\n       sudo -l";
-function failed2(errno2, error) {
-  return { error, errno: errno2 };
+function failed2(errno3, error) {
+  return { error, errno: errno3 };
 }
 function unescaped(double) {
   return double.replace(/\\(["\\$`])/g, "$1");
@@ -22501,6 +22764,7 @@ var Launcher = class {
   sudoer;
   jobs = new JobTable();
   locks = new LockTable();
+  fifos = new FifoTable();
   sems = new SemTable();
   settling = new SettlingChildren((pid) => this.jobs.pgidOf(pid));
   ptys = new PtyTable(
@@ -23498,6 +23762,7 @@ var Launcher = class {
       net: this.net,
       http: new HttpHandles(this.transport, pid, this.loopbackFor(pid)),
       locks: this.locks,
+      fifos: this.fifos,
       sems: this.sems,
       resolver: this.resolver,
       onReap: (child) => this.reaped(child, pid),