@ai-ecoverse/slicc-kernel 1.123.1 → 1.124.0

package/dist/kernel-worker.js

@@ -2372,6 +2372,7 @@ var OpfsFs = class {
     }));
   }
   async reconcile() {
+    if (this.remote && await this.remote.peered()) return 0;
     let removed = 0;
     const entries = await this.meta.all();
     const carried = new Set(entries.filter((e) => !e.vacated).map((e) => e.ino));
@@ -2380,7 +2381,11 @@ var OpfsFs = class {
       const real = await this.real(entry.path);
       const stale = entry.link === void 0 ? !real : real || !await this.real(parentOf3(entry.path));
       if (!stale) continue;
-      await this.meta.update(entry.path, () => void 0);
+      const seen = JSON.stringify(entry);
+      await this.meta.update(
+        entry.path,
+        (now) => now === void 0 || JSON.stringify(now) === seen ? void 0 : now
+      );
       removed++;
     }
     return removed;
@@ -4437,6 +4442,111 @@ var Routes = class {
   }
 };
 
+// src/kernel/net/switch-conn.ts
+var SwitchConn = class {
+  raw;
+  box = [];
+  pulling = false;
+  waiters = [];
+  switching = false;
+  secure;
+  failed;
+  constructor(raw) {
+    this.raw = raw;
+  }
+  get localAddr() {
+    return this.raw.localAddr;
+  }
+  get remoteAddr() {
+    return this.raw.remoteAddr;
+  }
+  get upgraded() {
+    return this.switching || this.secure !== void 0;
+  }
+  wake() {
+    for (const wake of this.waiters.splice(0)) wake();
+  }
+  changed() {
+    return new Promise((resolve2) => this.waiters.push(resolve2));
+  }
+  pull() {
+    if (this.pulling || this.box.length > 0) return;
+    this.pulling = true;
+    this.raw.read().then(
+      (bytes) => this.box.push(bytes),
+      (err) => this.box.push(err instanceof Error ? err : new Error(String(err)))
+    ).finally(() => {
+      this.pulling = false;
+      this.wake();
+    });
+  }
+  take() {
+    const next3 = this.box.shift();
+    if (next3 instanceof Error) throw next3;
+    return next3;
+  }
+  async rawRead() {
+    while (this.box.length === 0) {
+      this.pull();
+      await this.changed();
+    }
+    return this.take();
+  }
+  async read() {
+    for (; ; ) {
+      if (this.failed) throw this.failed;
+      if (this.secure) return this.secure.read();
+      if (!this.switching && this.box.length > 0) return this.take();
+      if (!this.switching) this.pull();
+      await this.changed();
+    }
+  }
+  async settled() {
+    while (this.switching) await this.changed();
+    if (this.failed) throw this.failed;
+    return this.secure ?? this.raw;
+  }
+  async write(bytes) {
+    return (await this.settled()).write(bytes);
+  }
+  closeWrite() {
+    void this.settled().then(
+      (conn) => conn.closeWrite(),
+      () => void 0
+    );
+  }
+  close() {
+    this.failed ??= new Error("closed");
+    this.secure?.close();
+    this.raw.close();
+    this.wake();
+  }
+  async upgrade(make) {
+    if (this.upgraded) throw new Error("already upgraded");
+    this.switching = true;
+    this.wake();
+    const view2 = {
+      localAddr: this.raw.localAddr,
+      remoteAddr: this.raw.remoteAddr,
+      read: () => this.rawRead(),
+      write: (bytes) => this.raw.write(bytes),
+      closeWrite: () => this.raw.closeWrite(),
+      close: () => this.raw.close()
+    };
+    try {
+      const { conn, info } = await make(view2);
+      this.secure = conn;
+      return info;
+    } catch (err) {
+      this.failed = err instanceof Error ? err : new Error(String(err));
+      throw err;
+    } finally {
+      this.switching = false;
+      this.wake();
+    }
+  }
+};
+
 // src/kernel/net/uplink-socket.ts
 var CHUNK = 64 * 1024;
 function hostPort(text) {
@@ -4761,7 +4871,18 @@ var KernelSocket = class _KernelSocket {
       clearTimeout(timer);
     }
   }
-  dial(addr, route) {
+  switch;
+  connectSecure(addr, route, secure2) {
+    if (this.state !== "open") throw new KernelError("EISCONN");
+    return this.dial(addr, route, secure2);
+  }
+  upgradeSecure(make) {
+    if (this.state !== "connected") throw new KernelError("ENOTCONN");
+    if (!this.switch) throw new KernelError("EOPNOTSUPP");
+    if (this.switch.upgraded || this.writeShut || this.readShut) throw new KernelError("EINVAL");
+    return this.switch.upgrade(make);
+  }
+  dial(addr, route, secure2) {
     this.state = "connecting";
     const abort = new AbortController();
     this.dialing = abort;
@@ -4782,11 +4903,25 @@ var KernelSocket = class _KernelSocket {
       () => void 0
     );
     return Promise.race([dialled, abandoned]).then(
-      (conn) => {
+      async (raw) => {
         if (abort.signal.aborted) throw dialError(abort.signal.reason, timedOut, true);
+        const conn = new SwitchConn(raw);
+        if (secure2) {
+          clearTimeout(timer);
+          try {
+            await Promise.race([secure2(conn), abandoned]);
+          } catch (e) {
+            conn.close();
+            throw this.dialFailed(
+              abort,
+              e instanceof KernelError ? e : new KernelError("ENOTSUP", e instanceof Error ? e.message : String(e))
+            );
+          }
+        }
         this.local = { family: "inet", host: "0.0.0.0", port: 0, ...hostPort(conn.localAddr) };
         this.peer = { ...addr, ...hostPort(conn.remoteAddr) };
         this.dialing = void 0;
+        this.switch = conn;
         this.attach(
           uplinkLink(conn, () => {
             this.reset = true;
@@ -4795,17 +4930,19 @@ var KernelSocket = class _KernelSocket {
         );
       },
       (e) => {
-        const error = dialError(e, timedOut, abort.signal.aborted);
-        if (this.dialing === abort) {
-          this.dialing = void 0;
-          this.failed = error.code;
-          this.state = "open";
-          this.changes.wake();
-        }
-        throw error;
+        throw this.dialFailed(abort, dialError(e, timedOut, abort.signal.aborted));
       }
     ).finally(() => clearTimeout(timer));
   }
+  dialFailed(abort, error) {
+    if (this.dialing === abort) {
+      this.dialing = void 0;
+      this.failed = error.code;
+      this.state = "open";
+      this.changes.wake();
+    }
+    return error;
+  }
   unlink() {
     const link2 = this.link;
     if (link2) {
@@ -4911,6 +5048,7 @@ var LoopbackNet = class {
   useUplink(route) {
     this.route = route;
   }
+  tlsClient;
   uplinkFor(host) {
     const route = this.route;
     if (!route) return void 0;
@@ -5052,12 +5190,12 @@ function serveSocket(socket, port, onClose) {
   let writes = Promise.resolve();
   let credit = 0;
   let granted2;
-  const send = (message3, transfer) => {
+  const send2 = (message3, transfer) => {
     if (!closed) port.postMessage(message3, transfer);
   };
   const close = (reset = false) => {
     if (closed) return;
-    if (reset) send({ error: "ECONNRESET" });
+    if (reset) send2({ error: "ECONNRESET" });
     closed = true;
     granted2?.();
     socket.close();
@@ -5069,9 +5207,9 @@ function serveSocket(socket, port, onClose) {
       if (closed) return;
       try {
         await socket.write(data);
-        send({ ack: true });
+        send2({ ack: true });
       } catch (err) {
-        send({ error: codeOf(err) });
+        send2({ error: codeOf(err) });
       }
     });
   };
@@ -5096,11 +5234,11 @@ function serveSocket(socket, port, onClose) {
         const chunk2 = await socket.read(CHUNK2);
         if (chunk2.length === 0) break;
         credit--;
-        send(chunk2, [chunk2.buffer]);
+        send2(chunk2, [chunk2.buffer]);
       }
-      send({ end: true });
+      send2({ end: true });
     } catch (err) {
-      send({ error: codeOf(err) });
+      send2({ error: codeOf(err) });
     }
   })();
   return () => close(true);
@@ -6013,7 +6151,7 @@ function joinable(l, pgid, ours) {
   if (sid === void 0) throw fsError("ESRCH", `no process group ${pgid}`);
   if (!ours(sid)) throw fsError("EPERM", `process group ${pgid} is in another session`);
 }
-function cdpRegistry(send, gone) {
+function cdpRegistry(send2, gone) {
   const registered = /* @__PURE__ */ new Map();
   const drop = (id2) => {
     registered.get(id2)?.();
@@ -6022,7 +6160,7 @@ function cdpRegistry(send, gone) {
   return {
     serve(l, req) {
       const hook = portCdpHook(
-        (request2, cdp) => send({ cdpOpen: { ...request2, registration: req.id }, port: cdp }, [
+        (request2, cdp) => send2({ cdpOpen: { ...request2, registration: req.id }, port: cdp }, [
           cdp
         ]),
         gone
@@ -6036,7 +6174,7 @@ function cdpRegistry(send, gone) {
     }
   };
 }
-function facadeRegistry(send, gone) {
+function facadeRegistry(send2, gone) {
   const registered = /* @__PURE__ */ new Map();
   const drop = (id2) => {
     registered.get(id2)?.();
@@ -6045,7 +6183,7 @@ function facadeRegistry(send, gone) {
   return {
     serve(l, req) {
       const hook = portFacadeHook(
-        (request2, facade) => send({ facadeOpen: { ...request2, registration: req.id }, port: facade }, [
+        (request2, facade) => send2({ facadeOpen: { ...request2, registration: req.id }, port: facade }, [
           facade
         ]),
         gone
@@ -6059,9 +6197,9 @@ function facadeRegistry(send, gone) {
     }
   };
 }
-function hostRegistries(send, gone) {
-  const cdps = cdpRegistry(send, gone);
-  const facades = facadeRegistry(send, gone);
+function hostRegistries(send2, gone) {
+  const cdps = cdpRegistry(send2, gone);
+  const facades = facadeRegistry(send2, gone);
   return {
     answer(l, req) {
       if (req.op === "serve-cdp") return cdps.serve(l, req);
@@ -6088,21 +6226,21 @@ function visibleTo(g, notify) {
     });
   };
 }
-async function watchOp(l, req, watches, send, g) {
+async function watchOp(l, req, watches, send2, g) {
   if (req.op === "unwatch") {
     watches.get(req.watch)?.();
     watches.delete(req.watch);
     return { result: true };
   }
   if (g) for (const path of req.paths) await readable(g, "watch", l.fs.resolvePath("/", path));
-  const notify = visibleTo(g, (change) => send({ watch: req.id, change }));
+  const notify = visibleTo(g, (change) => send2({ watch: req.id, change }));
   const unwatch = l.watchers.watch(req.paths, { recursive: req.recursive }, notify);
   watches.set(req.id, unwatch);
   return { result: req.id };
 }
 var TRAITS_WATCH = -1;
-function traitsWatch(launcher, transport, send) {
-  return launcher.onTraits(() => send({ traits: transport.traits }));
+function traitsWatch(launcher, transport, send2) {
+  return launcher.onTraits(() => send2({ traits: transport.traits }));
 }
 function serveClient(port, host) {
   let state = "new";
@@ -6114,14 +6252,14 @@ function serveClient(port, host) {
   const watches = /* @__PURE__ */ new Map();
   let net;
   const ended = Promise.withResolvers();
-  const send = (message3, transfer = []) => {
+  const send2 = (message3, transfer = []) => {
     if (state !== "closed") port.postMessage(message3, transfer);
   };
-  const reply = (id2, body, transfer) => send({ id: id2, ...body }, transfer);
-  const hosts = hostRegistries(send, ended.promise);
+  const reply = (id2, body, transfer) => send2({ id: id2, ...body }, transfer);
+  const hosts = hostRegistries(send2, ended.promise);
   function detach(kill = false, bye = "the slicc-kernel detached this client") {
     if (state === "closed") return;
-    send({ bye });
+    send2({ bye });
     state = "closed";
     net?.close();
     for (const unwatch of watches.values()) unwatch();
@@ -6135,19 +6273,19 @@ function serveClient(port, host) {
     ended.resolve();
   }
   async function hello(message3) {
-    const refused2 = versionError(message3.protocol);
-    if (refused2) {
-      send({ hello: { protocol: PROTOCOL, error: refused2 } });
+    const refused3 = versionError(message3.protocol);
+    if (refused3) {
+      send2({ hello: { protocol: PROTOCOL, error: refused3 } });
       detach();
       return;
     }
     const launcher = await host.launcher();
     if (host.scope !== "transport") self = await accountOf(launcher, host.user ?? 0);
     const transport = host.transport?.() ?? launcher.transport;
-    net = serveTransport({ postMessage: (m, t) => send(m, t) }, transport);
+    net = serveTransport({ postMessage: (m, t) => send2(m, t) }, transport);
     state = "open";
     if (message3.lock && host.locks) void host.locks.request(message3.lock, () => detach());
-    send({
+    send2({
       hello: {
         protocol: PROTOCOL,
         traits: transport.traits,
@@ -6155,7 +6293,7 @@ function serveClient(port, host) {
         ...host.lock ? { lock: host.lock } : {}
       }
     });
-    watches.set(TRAITS_WATCH, traitsWatch(launcher, transport, send));
+    watches.set(TRAITS_WATCH, traitsWatch(launcher, transport, send2));
   }
   async function terminal(req, l) {
     const session = await l.openTerminal(req.argv, {
@@ -6219,7 +6357,7 @@ function serveClient(port, host) {
         return clientFs(l, host.tag, self, req);
       case "watch":
       case "unwatch":
-        return watchOp(l, req, watches, send, guard2(l));
+        return watchOp(l, req, watches, send2, guard2(l));
       case "mount":
         return { result: await l.mountAs(clientCred(self), req.spec) };
       case "umount":
@@ -6245,7 +6383,7 @@ function serveClient(port, host) {
     if (data.hello) {
       if (state === "new") {
         hello(data.hello).catch((err) => {
-          send({ hello: { protocol: PROTOCOL, error: String(err?.message ?? err) } });
+          send2({ hello: { protocol: PROTOCOL, error: String(err?.message ?? err) } });
           detach();
         });
       }
@@ -6427,7 +6565,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.123.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.124.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -6709,13 +6847,13 @@ async function tierPackages(fs, physical, roots, bins, kernel) {
       const own = commandsOf(pkg, manifest);
       const named = new Set(own.map((command) => command.name));
       const extra = bins ? await binCommandsOf(physical, pkg, manifest, named) : [];
-      const refused2 = engineRefusal(manifest, kernel);
+      const refused3 = engineRefusal(manifest, kernel);
       const commands = [...own, ...extra];
       out.push({
         name: pkg.slice(root.length + 1),
         pkg,
         replaces: replacesOf(manifest),
-        commands: refused2 ? commands.map((command) => ({ ...command, refused: refused2 })) : commands
+        commands: refused3 ? commands.map((command) => ({ ...command, refused: refused3 })) : commands
       });
     }
   }
@@ -8300,8 +8438,8 @@ var RealmProxy = class {
   }
   async connect(conn, incoming, req, idle) {
     const target = tunnelTarget(req);
-    const refused2 = target.port === 443 ? await this.tunnelReady(target) : void 0;
-    if (refused2) throw refused2;
+    const refused3 = target.port === 443 ? await this.tunnelReady(target) : void 0;
+    if (refused3) throw refused3;
     await conn.write(latin1Bytes("HTTP/1.1 200 Connection Established\r\n\r\n"), this.stop.signal);
     try {
       const first = await incoming.peek(this.stop.signal);
@@ -9955,8 +10093,8 @@ var DriverConnection = class _DriverConnection {
     } finally {
       clearTimeout(timer);
     }
-    const refused2 = driverVersionError(hello.protocol);
-    if (refused2) throw errnoError("EPROTO", refused2);
+    const refused3 = driverVersionError(hello.protocol);
+    if (refused3) throw errnoError("EPROTO", refused3);
     if (hello.error) throw errnoError(hello.errno ?? "EIO", hello.error);
     return new _DriverConnection(port, hello.capabilities ?? {}, waiting, timeoutMs, options);
   }
@@ -11778,8 +11916,8 @@ async function guarded(entry, path, req) {
     return { paths };
   } catch (err) {
     const refusal = err.code === "EACCES";
-    const refused2 = req.op === "exists" && refusal ? json2(false) : toErrno(err);
-    return { refused: refused2 };
+    const refused3 = req.op === "exists" && refusal ? json2(false) : toErrno(err);
+    return { refused: refused3 };
   }
 }
 async function createExclusive(fs, path, owner) {
@@ -11890,13 +12028,13 @@ async function dispatchSyncFs(req) {
   }
 }
 var DENIED = /* @__PURE__ */ new Set(["EACCES", "EPERM"]);
-async function rmPermitted(entry, path, req, refused2) {
+async function rmPermitted(entry, path, req, refused3) {
   const st = await entry.fs.lstat(path).catch(() => void 0);
-  if (!st?.isDirectory) return refused2;
+  if (!st?.isDirectory) return refused3;
   const unlisted = await guarded(entry, path, { ...req, op: "readdir" });
   if ("refused" in unlisted) return unlisted.refused;
   const names = await entry.fs.readdir(path).catch(() => void 0);
-  if (!names) return refused2;
+  if (!names) return refused3;
   let first;
   for (const name2 of names) {
     const child = await dispatchOne(entry, {
@@ -11947,14 +12085,14 @@ async function newDevName(entry, path, req) {
   const named = NAMING.has(req.op);
   if (!named && !CREATIONS.has(req.op)) return void 0;
   const target = named ? entry.fs.resolvePath(entry.cwd, req.arg2 ?? "") : path;
-  const refused2 = devCreation(target, entry.cred?.());
-  if (!refused2) return void 0;
+  const refused3 = devCreation(target, entry.cred?.());
+  if (!refused3) return void 0;
   const there = await entry.fs.lstat(target).then(
     () => true,
     () => false
   );
   if (there) return void 0;
-  return { ok: false, errno: refused2, message: `${target}: no new names in /dev or /proc` };
+  return { ok: false, errno: refused3, message: `${target}: no new names in /dev or /proc` };
 }
 async function dispatchOne(entry, req) {
   const { fs, cwd } = entry;
@@ -13357,6 +13495,9 @@ var FlockTable = class {
   held = /* @__PURE__ */ new Map();
   keys = /* @__PURE__ */ new WeakMap();
   wakers = /* @__PURE__ */ new Map();
+  isFree(key, owner, kind) {
+    return this.free(key, owner, kind);
+  }
   free(key, owner, kind) {
     for (const [other, has] of this.held.get(key) ?? [])
       if (other !== owner && (kind === "exclusive" || has === "exclusive")) return false;
@@ -13483,9 +13624,18 @@ var LockTable = class {
     );
     this.wake(key);
   }
+  wholeFree(pid, path, exclusive) {
+    for (const [other, h] of this.held.get(path) ?? []) {
+      if (other !== pid && (exclusive || h.exclusive)) return false;
+    }
+    return true;
+  }
+  flockFree(key, owner, kind) {
+    return this.flocks.isFree(key, owner, kind);
+  }
   lock(pid, path, exclusive, fd) {
+    if (!this.wholeFree(pid, path, exclusive)) return false;
     const holders = this.held.get(path) ?? /* @__PURE__ */ new Map();
-    for (const [other, h] of holders) if (other !== pid && (exclusive || h.exclusive)) return false;
     const mine = holders.get(pid) ?? { exclusive, fds: /* @__PURE__ */ new Set() };
     mine.exclusive = exclusive;
     mine.fds.add(fd);
@@ -13670,12 +13820,12 @@ var AsyncOps = class {
 async function hostSyscall(req, ctx) {
   switch (req.op) {
     case "lock":
-      if (!ctx.locks) throw new KernelError("ENOSYS");
-      if (!ctx.locks.lock(ctx.pid, req.path, req.exclusive, req.fd))
-        throw new KernelError("EAGAIN");
-      return done2;
+      return wholeLock(req, ctx);
     case "unlock":
       ctx.locks?.unlock(ctx.pid, req.path);
+      if (req.fd !== void 0 && ctx.locks?.shared?.() && ctx.flockOf) {
+        return flock({ op: "flock", fd: req.fd, kind: "unlock" }, ctx);
+      }
       return done2;
     case "lk-set":
     case "lk-get":
@@ -13705,6 +13855,23 @@ async function hostSyscall(req, ctx) {
       return done2;
   }
 }
+async function wholeLock(req, ctx) {
+  const { locks, flockOf } = ctx;
+  if (!locks) throw new KernelError("ENOSYS");
+  const kind = req.exclusive ? "exclusive" : "shared";
+  if (locks.shared?.() && flockOf) {
+    if (locks.wholeFree?.(ctx.pid, req.path, req.exclusive) === false) {
+      throw new KernelError("EAGAIN");
+    }
+    return flock({ op: "flock", fd: req.fd, kind }, ctx);
+  }
+  if (flockOf && locks.flockFree) {
+    const { key, owner } = await flockOf(req.fd);
+    if (!locks.flockFree(key, owner, kind)) throw new KernelError("EAGAIN");
+  }
+  if (!locks.lock(ctx.pid, req.path, req.exclusive, req.fd)) throw new KernelError("EAGAIN");
+  return done2;
+}
 var FLOCK_KINDS = /* @__PURE__ */ new Set(["shared", "exclusive", "unlock"]);
 async function flock(req, ctx) {
   const { locks, flockOf } = ctx;
@@ -13891,8 +14058,8 @@ var KernelLoopback = class {
       );
     } catch (err) {
       socket.close();
-      const refused2 = err instanceof KernelError && err.code === "ECONNREFUSED";
-      throw refused2 ? errno2("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
+      const refused3 = err instanceof KernelError && err.code === "ECONNREFUSED";
+      throw refused3 ? errno2("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
     }
     signal.addEventListener("abort", () => socket.close(), { once: true });
     return socket;
@@ -14428,6 +14595,7 @@ function realmCa(owner, store) {
 }
 
 // src/kernel/net/tls-engine.ts
+var TLS_CLIENT_INSECURE_SKIP_VERIFY = 1;
 var SCRATCH = 64 * 1024;
 var EOF = -1;
 var TlsError = class extends Error {
@@ -14488,6 +14656,76 @@ var TlsEngine = class {
     const n = fn(this.scratch, SCRATCH);
     return n > 0 ? this.taken(n) : n;
   }
+  get client() {
+    return typeof this.m._tls_client_new === "function" ? this.m : void 0;
+  }
+  clientModule() {
+    const m = this.client;
+    if (!m) throw new TlsError(0, "tls client: the installed tls engine has no client sessions");
+    return m;
+  }
+  store() {
+    const m = this.clientModule();
+    const ptr = m._tls_ca_new();
+    if (!ptr) throw this.error(m._tls_last_error(), "trust store");
+    return new TlsStore(this, m, ptr);
+  }
+  clientSession(store, servername, alpn, flags2) {
+    const m = this.clientModule();
+    const wire = alpnWire(alpn);
+    const name2 = this.put(new TextEncoder().encode(servername));
+    try {
+      const at = store?.ptr ?? 0;
+      const ptr = this.withBytes(wire, (p) => m._tls_client_new(at, name2, p, wire.length, flags2));
+      if (!ptr) throw this.error(m._tls_last_error(), "tls client");
+      return new TlsSession(this, m, ptr);
+    } finally {
+      this.m._free(name2);
+    }
+  }
+  verifyInfo(flags2) {
+    const m = this.clientModule();
+    const n = m._tls_verify_info(flags2, this.scratch, SCRATCH);
+    const end = this.m.HEAPU8.indexOf(0, this.scratch);
+    const text = new TextDecoder().decode(this.m.HEAPU8.subarray(this.scratch, end));
+    return n < 0 ? `${text}\u2026` : text;
+  }
+};
+function alpnWire(names) {
+  const parts2 = names.map((name2) => new TextEncoder().encode(name2));
+  const out = new Uint8Array(parts2.reduce((n, p) => n + p.length + 1, 0));
+  let at = 0;
+  for (const part of parts2) {
+    out[at++] = part.length;
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+}
+var TlsStore = class {
+  engine;
+  m;
+  ptr;
+  constructor(engine, m, ptr) {
+    this.engine = engine;
+    this.m = m;
+    this.ptr = ptr;
+  }
+  add(der) {
+    const ret = this.engine.withBytes(der, (p) => this.m._tls_ca_add_der(this.ptr, p, der.length));
+    if (ret !== 0) throw this.engine.error(ret, "trust store certificate");
+  }
+  addBundle(bytes) {
+    const n = this.engine.withBytes(
+      bytes,
+      (p) => this.m._tls_ca_add_bundle(this.ptr, p, bytes.length)
+    );
+    if (n < 0) throw this.engine.error(n, "trust store bundle");
+    return n;
+  }
+  release() {
+    this.m._tls_ca_free(this.ptr);
+  }
 };
 var TlsLeaf = class {
   engine;
@@ -14552,6 +14790,33 @@ var TlsSession = class {
   free() {
     this.m._tls_session_free(this.ptr);
   }
+  get c() {
+    return this.m;
+  }
+  handshake() {
+    const ret = this.c._tls_handshake(this.ptr);
+    if (ret < 0) throw this.engine.error(ret, "tls handshake");
+    return ret === 1;
+  }
+  get verifyResult() {
+    return this.c._tls_verify_result(this.ptr);
+  }
+  get version() {
+    return this.c._tls_version(this.ptr);
+  }
+  get alpn() {
+    const out = this.engine.intoScratch((p, max) => this.c._tls_alpn(this.ptr, p, max));
+    return out instanceof Uint8Array ? new TextDecoder().decode(out) : void 0;
+  }
+  peerChain() {
+    const chain2 = [];
+    const count2 = this.c._tls_peer_count(this.ptr);
+    for (let i = 0; i < count2; i++) {
+      const der = this.engine.intoScratch((p, max) => this.c._tls_peer_der(this.ptr, i, p, max));
+      if (der instanceof Uint8Array) chain2.push(der);
+    }
+    return chain2;
+  }
 };
 var loading = /* @__PURE__ */ new WeakMap();
 function loadTlsEngine(load) {
@@ -14764,6 +15029,16 @@ function packageTlsEngine(fs, modules) {
     return factory.default({ wasmBinary, locateFile: (path) => path });
   };
 }
+function packageTlsRoots(fs, modules) {
+  const file = `${modules.replace(/\/+$/, "")}/${TLS_ENGINE_PACKAGE}/dist/roots.der`;
+  return async () => {
+    try {
+      return await fs.readFileBuffer(file);
+    } catch {
+      throw new Error(`TLS client sessions need ${TLS_ENGINE_PACKAGE}'s roots.der in ${modules}`);
+    }
+  };
+}
 function kernelCa(store) {
   return () => realmCa(CA_OWNER, store);
 }
@@ -14795,6 +15070,7 @@ async function writeCaFile(fs, ca, locks = globalThis.navigator?.locks) {
 function enableNetwork(net, options) {
   let proxy;
   const transport = options.transport ?? missingTransport();
+  if (options.roots) net.tlsClient = { engine: options.engine, roots: options.roots };
   const start2 = () => {
     const tls = new TlsTerminator({
       ca: options.ca,
@@ -16574,6 +16850,285 @@ function encodeReceived(got) {
   return out;
 }
 
+// src/kernel/net/tls-client.ts
+var WRITE_CHUNK = 16 * 1024;
+var BADCERT = [
+  [8, "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"],
+  [1, "CERT_HAS_EXPIRED"],
+  [512, "CERT_NOT_YET_VALID"],
+  [2, "CERT_REVOKED"],
+  [4, "ERR_TLS_CERT_ALTNAME_INVALID"],
+  [2048, "INVALID_PURPOSE"],
+  [4096, "INVALID_PURPOSE"]
+];
+function verifyCode(flags2) {
+  if (flags2 === 0) return void 0;
+  if (flags2 === -1) return "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
+  return BADCERT.find(([bit]) => (flags2 & bit) !== 0)?.[1] ?? "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
+}
+var Ciphertext = class {
+  queue = [];
+  ended = false;
+  conn;
+  session;
+  constructor(conn, session) {
+    this.conn = conn;
+    this.session = session;
+  }
+  hand(bytes) {
+    if (bytes.length > 0) this.queue.push(bytes);
+  }
+  async more() {
+    if (this.queue.length === 0 && !this.ended) {
+      const bytes = await this.conn.read();
+      if (bytes) this.queue.push(bytes);
+      else this.ended = true;
+    }
+    if (this.queue.length === 0) {
+      this.session.feedEnd();
+      return false;
+    }
+    while (this.queue.length > 0) {
+      const head = this.queue[0];
+      const n = this.session.feed(head);
+      if (n < head.length) {
+        this.queue[0] = head.subarray(n);
+        break;
+      }
+      this.queue.shift();
+    }
+    return true;
+  }
+};
+async function send(conn, session) {
+  for (; ; ) {
+    const out = session.take();
+    if (out.length === 0) return;
+    for (let at = 0; at < out.length; ) {
+      const n = await conn.write(out.subarray(at));
+      if (!(n > 0)) throw new KernelError("EPIPE");
+      at += n;
+    }
+  }
+}
+function refused2(engine, session, err) {
+  const flags2 = session.verifyResult;
+  const code = verifyCode(flags2);
+  if (code && flags2 !== -1)
+    return new KernelError("EPROTO", `${code}: ${engine.verifyInfo(flags2).trim()}`);
+  const text = err instanceof TlsError ? err.message : String(err);
+  return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}`);
+}
+async function handshake(conn, o, session, inbox) {
+  for (; ; ) {
+    let done4;
+    try {
+      done4 = session.handshake();
+    } catch (err) {
+      await send(conn, session).catch(() => void 0);
+      throw refused2(o.engine, session, err);
+    }
+    await send(conn, session);
+    if (done4) return;
+    if (!await inbox.more()) {
+      throw new KernelError(
+        "ECONNRESET",
+        "the server closed the connection during the TLS handshake"
+      );
+    }
+  }
+}
+function infoOf(o, session) {
+  const flags2 = session.verifyResult;
+  const code = verifyCode(flags2);
+  return {
+    protocol: session.version === 772 ? "TLSv1.3" : "TLSv1.2",
+    alpnProtocol: session.alpn ?? false,
+    authorized: code === void 0,
+    ...code ? { authorizationError: code, authorizationText: o.engine.verifyInfo(flags2).trim() } : {},
+    peerCertificates: session.peerChain()
+  };
+}
+function plaintext(conn, session, inbox) {
+  let freed = false;
+  let writeClosed = false;
+  const free = () => {
+    if (freed) return;
+    freed = true;
+    session.free();
+  };
+  return {
+    localAddr: conn.localAddr,
+    remoteAddr: conn.remoteAddr,
+    async read() {
+      for (; ; ) {
+        if (freed) return null;
+        const got = session.read();
+        await send(conn, session);
+        if (got instanceof Uint8Array) return got;
+        if (got === "eof") return null;
+        await inbox.more();
+      }
+    },
+    async write(bytes) {
+      if (freed) throw new KernelError("EPIPE");
+      for (; ; ) {
+        const n = session.write(bytes.subarray(0, WRITE_CHUNK));
+        await send(conn, session);
+        if (n > 0) return n;
+      }
+    },
+    closeWrite() {
+      if (writeClosed || freed) return;
+      writeClosed = true;
+      session.close();
+      void send(conn, session).catch(() => void 0).finally(() => conn.closeWrite());
+    },
+    close() {
+      free();
+      conn.close();
+    }
+  };
+}
+async function tlsClient(conn, o, taken = new Uint8Array(0)) {
+  const flags2 = o.insecure ? TLS_CLIENT_INSECURE_SKIP_VERIFY : 0;
+  const session = o.engine.clientSession(o.store, o.servername, o.alpn, flags2);
+  const inbox = new Ciphertext(conn, session);
+  inbox.hand(taken);
+  try {
+    await handshake(conn, o, session, inbox);
+    return { conn: plaintext(conn, session, inbox), info: infoOf(o, session) };
+  } catch (err) {
+    session.free();
+    throw err;
+  }
+}
+
+// src/kernel/net/tls-uplink.ts
+var isIP = (text) => ipv4Bytes(text) !== void 0 || text.includes(":") && ipv6Groups(text) !== void 0;
+var LABEL2 = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)$/;
+function serverName(name2) {
+  if (isIP(name2.replace(/^\[|\]$/g, ""))) return name2.replace(/^\[|\]$/g, "");
+  const bare = name2.endsWith(".") ? name2.slice(0, -1) : name2;
+  if (bare.length === 0 || bare.length > 253 || !bare.split(".").every((l) => LABEL2.test(l))) {
+    throw new KernelError(
+      "EINVAL",
+      `ERR_INVALID_ARG_VALUE: not a host name: ${JSON.stringify(name2)}`
+    );
+  }
+  return name2;
+}
+var defaults = /* @__PURE__ */ new WeakMap();
+function defaultStore(engine, roots) {
+  let store = defaults.get(engine);
+  if (!store) {
+    const made2 = roots().then((bundle) => {
+      const s = engine.store();
+      s.addBundle(bundle);
+      return s;
+    });
+    store = made2;
+    defaults.set(engine, made2);
+    made2.catch(() => {
+      if (defaults.get(engine) === made2) defaults.delete(engine);
+    });
+  }
+  return store;
+}
+function base64Der(text) {
+  const bin = atob(text);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function encode(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+function sessionOf(info, servername) {
+  return {
+    path: "kernel",
+    substitutes: false,
+    protocol: info.protocol,
+    alpnProtocol: info.alpnProtocol,
+    authorized: info.authorized,
+    ...info.authorizationError ? {
+      authorizationError: info.authorizationError,
+      authorizationText: info.authorizationText
+    } : {},
+    servername,
+    peerCertificates: info.peerCertificates.map(encode)
+  };
+}
+async function setUp(support, req) {
+  const engine = await support.engine();
+  if (!engine.client)
+    throw new KernelError("ENOTSUP", "the installed tls engine has no client sessions");
+  const custom = Array.isArray(req.ca) ? req.ca : void 0;
+  if (!custom) return { engine, store: await defaultStore(engine, support.roots), own: void 0 };
+  if (custom.length === 0)
+    throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: ca has no certificate");
+  const own = engine.store();
+  try {
+    for (const der of custom) own.add(base64Der(der));
+  } catch (err) {
+    own.release();
+    throw new KernelError("EINVAL", `ERR_INVALID_ARG_VALUE: ca: ${err.message}`);
+  }
+  return { engine, store: own, own };
+}
+function secure(support, req, servername) {
+  return async (raw) => {
+    const { engine, store, own } = await setUp(support, req);
+    try {
+      return await tlsClient(raw, {
+        engine,
+        store,
+        servername,
+        alpn: req.alpn ?? [],
+        insecure: req.insecure === true
+      });
+    } finally {
+      own?.release();
+    }
+  };
+}
+function supportOf(net) {
+  const support = net.tlsClient;
+  if (!support) throw new KernelError("ENOTSUP", "no tls engine for client sessions");
+  return support;
+}
+async function uplinkAddress(proc, host) {
+  const bare = host.replace(/^\[|\]$/g, "");
+  if (isIP(bare)) return bare;
+  const [first] = await proc.resolve(host, 0, () => proc.blocking());
+  if (!first) throw new KernelError("ENOENT", `ENOTFOUND: ${host}`);
+  return first;
+}
+async function connectSecure(proc, socket, host, port, req) {
+  const servername = serverName(req.servername || host);
+  if (isLoopbackHost(servername) || isLoopbackHost(host)) throw new KernelError("ENOTSUP");
+  const address = await uplinkAddress(proc, host);
+  const route = proc.net.uplinkFor(address);
+  if (!route)
+    throw new KernelError("ENOTSUP", "TLS in the kernel needs a destination the uplink routes");
+  const support = supportOf(proc.net);
+  let info;
+  const make = secure(support, req, servername);
+  await socket.connectSecure({ family: "inet", host: address, port }, route, async (conn) => {
+    info = await conn.upgrade(make);
+  });
+  return sessionOf(info, servername);
+}
+async function upgradeSecure(proc, socket, req) {
+  const peer = socket.peer;
+  const host = req.servername || (peer?.family === "inet" ? peer.host : "");
+  const servername = serverName(host);
+  const info = await socket.upgradeSecure(secure(supportOf(proc.net), req, servername));
+  return sessionOf(info, servername);
+}
+
 // src/kernel/unix-dgram.ts
 var SOL_SOCKET3 = 1;
 var SO_TYPE3 = 3;
@@ -16735,7 +17290,8 @@ var SOCKET_OPS = [
   "sock-resolve",
   "sock-sendto",
   "sock-recvfrom",
-  "sock-tls"
+  "sock-tls",
+  "sock-tls-upgrade"
 ];
 function socketAt(fds, fd) {
   const file = anySocketAt(fds, fd);
@@ -16808,7 +17364,9 @@ async function socketSyscall(req, proc) {
       return ok3(addresses);
     }
     case "sock-tls":
-      return ok3(tlsOverTransport(req, proc));
+      return ok3(await secureConnect(req, proc));
+    case "sock-tls-upgrade":
+      return ok3(await upgradeSecure(proc, socketAt(fds, req.fd), req));
     default:
       return datagram(req, proc);
   }
@@ -16930,6 +17488,36 @@ var NOT_HTTP_PORTS = /* @__PURE__ */ new Set([
   8883
 ]);
 var HOST_NAME = /^[A-Za-z0-9.-]+$|^\[?[0-9A-Fa-f:.]+\]?$/;
+function wantsKernel(req) {
+  if (req.path === "kernel") return true;
+  if (req.path === "transport") return false;
+  return Array.isArray(req.ca) || req.alpn !== void 0 && req.alpn.length > 0 && !req.alpn.includes("http/1.1") || NOT_HTTP_PORTS.has(req.port);
+}
+async function secureConnect(req, proc) {
+  if (!Number.isInteger(req.port) || req.port < 1 || req.port > 65535)
+    throw new KernelError("EINVAL");
+  const kernelPath = wantsKernel(req) && await uplinked(proc, req.host);
+  if (!kernelPath) {
+    if (req.path === "kernel" || Array.isArray(req.ca)) throw new KernelError("ENOTSUP");
+    return { ...tlsOverTransport(req, proc), path: "transport", substitutes: true };
+  }
+  const socket = proc.net.socket("inet");
+  const fd = proc.fds.install(new OpenFile(socket), 3);
+  try {
+    return { fd, ...await connectSecure(proc, socket, req.host, req.port, req) };
+  } catch (e) {
+    await Promise.resolve(proc.fds.close(fd));
+    throw e;
+  }
+}
+async function uplinked(proc, host) {
+  if (!proc.net.tlsClient || isLoopbackHost(host)) return false;
+  try {
+    return proc.net.uplinkFor(await uplinkAddress(proc, host)) !== void 0;
+  } catch {
+    return false;
+  }
+}
 function tlsOverTransport(req, proc) {
   if (req.ca) throw new KernelError("ENOTSUP");
   if (req.alpn && req.alpn.length > 0 && !req.alpn.includes("http/1.1")) {
@@ -19930,10 +20518,10 @@ var JobTable = class {
   signalForeground(tty, fallback, sig) {
     this.killGroup(this.tcgetpgrp(tty, fallback), sig);
   }
-  fromKeyboard(send) {
+  fromKeyboard(send2) {
     this.keyboard = true;
     try {
-      send();
+      send2();
     } finally {
       this.keyboard = false;
     }
@@ -20244,6 +20832,12 @@ var LockService = class {
   lock(pid, path, exclusive, fd) {
     return this.table.lock(pid, path, exclusive, fd);
   }
+  wholeFree(pid, path, exclusive) {
+    return this.table.wholeFree(pid, path, exclusive);
+  }
+  flockFree(key, owner, kind) {
+    return this.table.flockFree(key, owner, kind);
+  }
   unlock(pid, path) {
     this.table.unlock(pid, path);
   }
@@ -20919,7 +21513,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
       await changed(signal);
     }
   };
-  const send = async (out, signal) => {
+  const send2 = async (out, signal) => {
     const write = file.write;
     for (let at = 0; at < out.length; ) {
       try {
@@ -20954,7 +21548,7 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
           raise();
           if (timer !== void 0) clearTimeout(timer);
           timer = void 0;
-          await send(stream.push(taken), signal);
+          await send2(stream.push(taken), signal);
         } finally {
           busy = false;
           if (quiet2()) wake();
@@ -21300,19 +21894,19 @@ var SettlingChildren = class {
     this.held = this.held.filter((h) => this.blocking(h.pgid));
     for (const h of ready2) h.send();
   }
-  deliver(sig, pgid, send, foreground) {
+  deliver(sig, pgid, send2, foreground) {
     if (!KEY_SIGNALS.has(sig)) {
-      send();
+      send2();
     } else if (this.blocking(pgid)) {
-      this.held.push({ pgid, send });
+      this.held.push({ pgid, send: send2 });
     } else if (foreground) {
-      send();
+      send2();
       const moved2 = () => {
-        if (foreground() !== pgid) send();
+        if (foreground() !== pgid) send2();
       };
       this.parked.push({ pgid, send: moved2 });
     } else {
-      send();
+      send2();
     }
   }
   blocking(pgid) {
@@ -21457,9 +22051,9 @@ function serveFilesystem(port, handlers, capabilities = {}, options = {}) {
   let open = false;
   const reply = (message3, transfer = []) => port.postMessage(message3, transfer);
   async function hello(message3) {
-    const refused2 = driverVersionError(message3.protocol);
-    if (refused2) {
-      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused2, errno: "EPROTO" } });
+    const refused3 = driverVersionError(message3.protocol);
+    if (refused3) {
+      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused3, errno: "EPROTO" } });
       return;
     }
     try {
@@ -23528,9 +24122,9 @@ function interpreter(head) {
   if (words2[0] === "-S") words2.shift();
   return baseName2(words2[0] ?? "");
 }
-function expandDefaults(defaults, env) {
+function expandDefaults(defaults2, env) {
   const out = {};
-  for (const [key, value2] of Object.entries(defaults ?? {})) {
+  for (const [key, value2] of Object.entries(defaults2 ?? {})) {
     let missing4 = false;
     const expanded = value2.replace(ENV_REFERENCE, (_, name2) => {
       const set3 = Object.hasOwn(env, name2) ? env[name2] : void 0;
@@ -23780,6 +24374,7 @@ var Launcher = class {
     enableNetwork(this.net, {
       transport: this.transport,
       engine: kernelTlsEngine(packageTlsEngine(this.verifiedFs(options.fs), this.modulesDir)),
+      roots: packageTlsRoots(this.verifiedFs(options.fs), this.modulesDir),
       ca: this.ca
     });
     enableCdp(this.net, this.cdp);
@@ -24192,13 +24787,13 @@ var Launcher = class {
     if (planned?.target.copy) await need(g, "exec", planned.target.copy, R_OK | X_OK);
   }
   async checkedPlan(req, { ppid, cred, scope }, fds) {
-    const refused2 = async (err) => {
+    const refused3 = async (err) => {
       await fds.closeAll();
       throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
     };
-    const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused2);
+    const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused3);
     const planned = await this.plan(file, req.argv, req.cwd, scope, req.argv0);
-    await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused2);
+    await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused3);
     if (planned) return planned;
     await fds.closeAll();
     throw new SpawnError(await this.unrunnable(file, req.cwd, scope));
@@ -25033,10 +25628,10 @@ var Launcher = class {
       return childHandle(await this.admitted(parent.program.abi !== "js", given, fresh2));
     };
   }
-  keySignal(tty, fallback, sig, send) {
+  keySignal(tty, fallback, sig, send2) {
     const pgid = this.jobs.tcgetpgrp(tty, fallback);
     const foreground = () => this.jobs.tcgetpgrp(tty, fallback);
-    const keyed = () => this.jobs.fromKeyboard(send);
+    const keyed = () => this.jobs.fromKeyboard(send2);
     this.settling.deliver(sig, pgid, keyed, tty.reading ? void 0 : foreground);
   }
   async resolvePrefixes() {