@ai-ecoverse/slicc-kernel 1.124.12 → 1.125.0

package/dist/kernel-worker.js

@@ -4028,7 +4028,12 @@ function openPipe(capacity) {
         }
       },
       close: () => pipe.closeRead(),
-      poll: () => ({ readable: pipe.readReady, writable: false, hangup: pipe.writersGone }),
+      poll: () => ({
+        readable: pipe.readReady,
+        writable: false,
+        hangup: pipe.writersGone,
+        nread: pipe.buffered
+      }),
       changed: (signal) => pipe.changed(signal),
       identity: pipe
     }),
@@ -4655,8 +4660,8 @@ function uplinkLink(conn, onReset) {
     open = false;
     conn.close();
   };
-  void inbound(conn, rx).catch(() => {
-    onReset();
+  void inbound(conn, rx).catch((err) => {
+    onReset(err);
     close();
     tx.closeRead();
   }).finally(() => rx.closeWrite());
@@ -4747,7 +4752,7 @@ var KernelSocket = class _KernelSocket {
   state = "open";
   dialing;
   failed;
-  reset = false;
+  reset;
   local;
   peer;
   peerCred;
@@ -4786,19 +4791,20 @@ var KernelSocket = class _KernelSocket {
     const { rx } = this.connection();
     if (this.readShut || max <= 0) return new Uint8Array(0);
     const bytes = await pipeCall(() => rx.read(max, signal));
-    if (bytes.length === 0 && this.reset) throw new KernelError("ECONNRESET");
+    if (bytes.length === 0 && this.reset) throw this.reset;
     return bytes;
   }
   async peek(max, signal) {
     const { rx } = this.connection();
     if (this.readShut || max <= 0) return new Uint8Array(0);
     const bytes = await pipeCall(() => rx.peek(max, signal));
-    if (bytes.length === 0 && this.reset) throw new KernelError("ECONNRESET");
+    if (bytes.length === 0 && this.reset) throw this.reset;
     return bytes;
   }
   async write(bytes, signal) {
     const { tx } = this.connection();
     if (this.writeShut) throw new KernelError("EPIPE");
+    if (this.reset?.code === "EPROTO") throw this.reset;
     return pipeCall(() => tx.write(bytes, signal));
   }
   poll() {
@@ -4815,7 +4821,8 @@ var KernelSocket = class _KernelSocket {
       readable: this.readShut || rx.readReady,
       writable: this.writeShut || tx.writeReady,
       hangup: rx.writersGone && tx.readersGone,
-      rdhup: rx.writersGone
+      rdhup: rx.writersGone,
+      nread: this.readShut ? 0 : rx.buffered
     };
   }
   changed(signal) {
@@ -4875,8 +4882,8 @@ var KernelSocket = class _KernelSocket {
     if (this.state !== "open") throw new KernelError("EINVAL");
     if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
     this.failed = void 0;
-    const route = viaUplink && addr.family === "inet" ? this.net.uplinkFor(addr.host) : void 0;
-    if (route) return this.dial(addr, route);
+    const route2 = viaUplink && addr.family === "inet" ? this.net.uplinkFor(addr.host) : void 0;
+    if (route2) return this.dial(addr, route2);
     const target = this.net.target(addr, name2);
     if (!this.local) {
       if (addr.family === "inet") {
@@ -4932,9 +4939,9 @@ var KernelSocket = class _KernelSocket {
     }
   }
   switch;
-  connectSecure(addr, route, secure2) {
+  connectSecure(addr, route2, secure2) {
     if (this.state !== "open") throw new KernelError("EISCONN");
-    return this.dial(addr, route, secure2);
+    return this.dial(addr, route2, secure2);
   }
   upgradeSecure(make) {
     if (this.state !== "connected") throw new KernelError("ENOTCONN");
@@ -4942,7 +4949,7 @@ var KernelSocket = class _KernelSocket {
     if (this.switch.upgraded || this.writeShut || this.readShut) throw new KernelError("EINVAL");
     return this.switch.upgrade(make);
   }
-  dial(addr, route, secure2) {
+  dial(addr, route2, secure2) {
     this.state = "connecting";
     const abort = new AbortController();
     this.dialing = abort;
@@ -4950,13 +4957,13 @@ var KernelSocket = class _KernelSocket {
     const timer = setTimeout(() => {
       timedOut = true;
       abort.abort(new KernelError("ETIMEDOUT"));
-    }, route.timeoutMs ?? DIAL_TIMEOUT_MS);
+    }, route2.timeoutMs ?? DIAL_TIMEOUT_MS);
     const abandoned = new Promise((_, reject) => {
       abort.signal.addEventListener("abort", () => reject(abort.signal.reason), { once: true });
     });
     const { host, port } = addr;
     const dialled = new Promise(
-      (resolve2) => resolve2(route.uplink.dial({ network: "tcp", host, port, signal: abort.signal }))
+      (resolve2) => resolve2(route2.uplink.dial({ network: "tcp", host, port, signal: abort.signal }))
     );
     dialled.then(
       (conn) => abort.signal.aborted && conn.close(),
@@ -4983,8 +4990,8 @@ var KernelSocket = class _KernelSocket {
         this.dialing = void 0;
         this.switch = conn;
         this.attach(
-          uplinkLink(conn, () => {
-            this.reset = true;
+          uplinkLink(conn, (err) => {
+            this.reset = err instanceof KernelError && err.code === "EPROTO" ? err : new KernelError("ECONNRESET");
             this.changes.wake();
           })
         );
@@ -5105,14 +5112,14 @@ var LoopbackNet = class {
     if (!this.origins) throw new KernelError("ENETUNREACH");
     void this.origins(conn, origin).catch(() => conn.close());
   }
-  useUplink(route) {
-    this.route = route;
+  useUplink(route2) {
+    this.route = route2;
   }
   tlsClient;
   uplinkFor(host) {
-    const route = this.route;
-    if (!route) return void 0;
-    return this.destination(host) === "uplink" ? route : void 0;
+    const route2 = this.route;
+    if (!route2) return void 0;
+    return this.destination(host) === "uplink" ? route2 : void 0;
   }
   destination(host) {
     return (this.route?.routes ?? LOCAL_ONLY).classify(host);
@@ -6625,7 +6632,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.124.12" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.125.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -7682,16 +7689,24 @@ var UnlinkedKeeper = class {
     gated();
     const held = /* @__PURE__ */ new Map();
     const hidden = /* @__PURE__ */ new Map();
-    for (; ; ) {
-      await take();
-      const now = this.heldWithin(target);
-      const next3 = paths.filter((path) => now.has(path) && !held.has(path));
-      if (next3.length === 0) break;
-      for (const path of next3) {
-        held.set(path, now.get(path));
-        const at = await this.hide(path);
-        if (at !== void 0) hidden.set(path, at);
+    const moved2 = [];
+    try {
+      for (; ; ) {
+        await take();
+        const now = this.heldWithin(target);
+        const next3 = paths.filter((path) => now.has(path) && !held.has(path));
+        if (next3.length === 0) break;
+        for (const path of next3) {
+          const holders = now.get(path);
+          held.set(path, holders);
+          for (const holder of holders) moved2.push(holder.moving?.(path) ?? (() => void 0));
+          const at = await this.hide(path);
+          if (at !== void 0) hidden.set(path, at);
+        }
       }
+    } catch (err) {
+      for (const settle3 of moved2) settle3();
+      throw err;
     }
     sealed();
     const done4 = () => {
@@ -7704,6 +7719,7 @@ var UnlinkedKeeper = class {
       files.set(path, file);
       for (const holder of holders) holder.keep(path, file);
     }
+    for (const settle3 of moved2) settle3();
     return {
       moved: new Set(hidden.keys()),
       commit: () => {
@@ -9409,6 +9425,8 @@ async function physicalPathAsync(fs, path) {
 }
 
 // src/fs/watch.ts
+var WATCH_NOTES_LIMIT = 1e3;
+var baseOf2 = (path) => path.slice(path.lastIndexOf("/") + 1);
 var WATCH_BATCH_LIMIT = 1e3;
 var under3 = (path, dir) => dir === "/" || path.startsWith(`${dir}/`);
 var parentOf6 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
@@ -9418,8 +9436,39 @@ function touches(watcher, changed) {
   );
 }
 var REALS_KEPT = 4096;
+function noted(watch, note) {
+  if (watch.ended) return;
+  if ("ended" in note) {
+    watch.notes.push(note);
+    watch.ended = true;
+    watch.wake?.();
+    return;
+  }
+  if (watch.overflowed) return;
+  if (watch.notes.length >= WATCH_NOTES_LIMIT) {
+    watch.overflowed = true;
+    watch.notes.push({ overflow: true });
+  } else watch.notes.push(note);
+  watch.wake?.();
+}
+function route(watch, type, path) {
+  for (const root of watch.roots) if (routed(watch, root, type, path)) return;
+}
+function routed(watch, root, type, path) {
+  if (path === root || type === "rename" && root !== "/" && under3(root, path)) {
+    noted(watch, { type, filename: baseOf2(root) });
+    if (type === "rename") noted(watch, { ended: true });
+    return true;
+  }
+  if (parentOf6(path) === root) noted(watch, { type, filename: baseOf2(path) });
+  else if (watch.recursive && under3(path, root)) {
+    noted(watch, { type, filename: path.slice(root === "/" ? 1 : root.length + 1) });
+  } else return false;
+  return true;
+}
 var FsWatchers = class {
   watchers = /* @__PURE__ */ new Set();
+  typed = /* @__PURE__ */ new Set();
   taps = [];
   reals = /* @__PURE__ */ new Map();
   reshapes = [];
@@ -9446,7 +9495,65 @@ var FsWatchers = class {
       this.watchers.delete(watcher);
     };
   }
+  typedWatch(root, recursive, alias) {
+    const main = normalizePath(root);
+    const other = alias === void 0 ? main : normalizePath(alias);
+    const watch = {
+      roots: other === main ? [main] : [main, other],
+      recursive,
+      notes: [],
+      overflowed: false,
+      ended: false,
+      wake: void 0
+    };
+    this.typed.add(watch);
+    const close = () => {
+      this.typed.delete(watch);
+      watch.ended = true;
+      watch.wake?.();
+    };
+    return {
+      close,
+      next: async (signal) => {
+        while (watch.notes.length === 0 && !watch.ended && !signal.aborted) {
+          await new Promise((resolve2) => {
+            const done4 = () => {
+              watch.wake = void 0;
+              signal.removeEventListener("abort", done4);
+              resolve2();
+            };
+            watch.wake = done4;
+            signal.addEventListener("abort", done4, { once: true });
+          });
+        }
+        const notes = watch.notes.splice(0);
+        watch.overflowed = false;
+        if (watch.ended) this.typed.delete(watch);
+        return notes.length === 0 && watch.ended ? [{ ended: true }] : notes;
+      }
+    };
+  }
+  covers(path) {
+    for (const watch of this.typed) {
+      for (const root of watch.roots) {
+        if (path === root || parentOf6(path) === root || watch.recursive && under3(path, root))
+          return true;
+      }
+    }
+    return false;
+  }
+  emit(type, paths) {
+    if (this.typed.size === 0) return;
+    for (const path of paths) {
+      const at = normalizePath(path);
+      for (const watch of [...this.typed]) route(watch, type, at);
+    }
+  }
   changed(...paths) {
+    this.report(paths);
+    this.emit("change", paths);
+  }
+  report(paths) {
     for (const tap of this.taps) tap(paths);
     for (const watcher of this.watchers) {
       for (const path of paths) {
@@ -9466,11 +9573,15 @@ var FsWatchers = class {
     watcher.notify(paths.length > WATCH_BATCH_LIMIT ? { overflow: true } : { paths });
   }
   wrap(fs) {
-    const after = (run2, changed) => async (...args) => {
+    const after = (run2, changed, type) => async (...args) => {
+      let done4 = false;
       try {
         await run2(...args);
+        done4 = true;
       } finally {
-        this.changed(...changed(...args));
+        const paths = changed(...args);
+        this.report(paths);
+        if (done4) this.emit(type, paths);
       }
     };
     const reals = this.reals;
@@ -9489,15 +9600,21 @@ var FsWatchers = class {
       reals.set(at, real);
       return real;
     };
-    const content = (run2) => async (...args) => {
+    const content = (run2, types) => async (...args) => {
+      const at = normalizePath(args[0]);
+      const fresh2 = this.covers(at) && !await fs.exists(at).catch(() => true);
+      let done4 = false;
       try {
         await run2(...args);
+        done4 = true;
       } finally {
-        const at = normalizePath(args[0]);
         const real = await realOf(at);
-        this.changed(...real === at ? [at] : [at, real]);
+        const paths = real === at ? [at] : [at, real];
+        this.report(paths);
+        if (done4) for (const type of types(fresh2)) this.emit(type, paths);
       }
     };
+    const written2 = (fresh2) => fresh2 ? ["rename", "change"] : ["change"];
     const reshaping = (run2) => async (...args) => {
       this.reshaped();
       try {
@@ -9507,8 +9624,8 @@ var FsWatchers = class {
       }
     };
     const overrides = {
-      writeFile: content(fs.writeFile.bind(fs)),
-      ...fs.createExclusive ? { createExclusive: content(fs.createExclusive.bind(fs)) } : {},
+      writeFile: content(fs.writeFile.bind(fs), written2),
+      ...fs.createExclusive ? { createExclusive: content(fs.createExclusive.bind(fs), () => ["rename"]) } : {},
       mkdir: async (path, options) => {
         const created3 = [];
         if (options?.recursive) {
@@ -9518,33 +9635,39 @@ var FsWatchers = class {
             if (created3.length > 0 || !await fs.exists(ancestor)) created3.push(ancestor);
           }
         }
+        const fresh2 = !options?.recursive || !(this.covers(path) && await fs.exists(path));
+        let done4 = false;
         try {
           await fs.mkdir(path, options);
+          done4 = true;
         } finally {
-          this.changed(...created3, path);
+          this.report([...created3, path]);
+          if (done4) this.emit("rename", fresh2 ? [...created3, path] : created3);
         }
       },
-      rm: reshaping(after(fs.rm.bind(fs), (path) => [path])),
-      rename: reshaping(after(fs.rename.bind(fs), (from, to) => [from, to])),
+      rm: reshaping(after(fs.rm.bind(fs), (path) => [path], "rename")),
+      rename: reshaping(after(fs.rename.bind(fs), (from, to) => [from, to], "rename")),
       link: reshaping(
         after(
           (from, to, follow2) => fs.link(from, to, follow2),
-          (_from, to) => [to]
+          (_from, to) => [to],
+          "rename"
         )
       ),
-      symlink: reshaping(after(fs.symlink.bind(fs), (_target, path) => [path])),
-      chmod: after(fs.chmod.bind(fs), (path) => [path]),
-      ...fs.chown ? { chown: after(fs.chown.bind(fs), (path) => [path]) } : {},
-      utimes: after(fs.utimes.bind(fs), (path) => [path]),
+      symlink: reshaping(after(fs.symlink.bind(fs), (_target, path) => [path], "rename")),
+      chmod: after(fs.chmod.bind(fs), (path) => [path], "change"),
+      ...fs.chown ? { chown: after(fs.chown.bind(fs), (path) => [path], "change") } : {},
+      utimes: after(fs.utimes.bind(fs), (path) => [path], "change"),
       lutimes: after(
         (path, atime, mtime) => lutimesOf(fs, path, atime, mtime),
-        (path) => [path]
+        (path) => [path],
+        "change"
       )
     };
     const ranged2 = rangedOps(fs);
     if (ranged2) {
-      overrides.pwrite = content(ranged2.pwrite);
-      overrides.truncate = content(ranged2.truncate);
+      overrides.pwrite = content(ranged2.pwrite, () => ["change"]);
+      overrides.truncate = content(ranged2.truncate, () => ["change"]);
     }
     return new Proxy(fs, {
       get(target, key, receiver) {
@@ -10152,7 +10275,8 @@ var FifoTable = class {
       poll: () => ({
         readable: reads && pipe.readReady,
         writable: writes && pipe.writeReady,
-        hangup: reads ? pipe.writersGone : pipe.readersGone
+        hangup: reads ? pipe.writersGone : pipe.readersGone,
+        ...reads ? { nread: pipe.buffered } : {}
       }),
       changed: (signal) => pipe.changed(signal)
     });
@@ -10551,8 +10675,8 @@ var MountTable = class {
         ...error ? { error } : {}
       })
     );
-    const noted = [...this.notes.values()].filter((note) => !this.mounts.has(note.target));
-    return [...mounted, ...noted.map((note) => ({ ...note, options: { ...note.options } }))];
+    const noted2 = [...this.notes.values()].filter((note) => !this.mounts.has(note.target));
+    return [...mounted, ...noted2.map((note) => ({ ...note, options: { ...note.options } }))];
   }
   listed() {
     return this.list().filter((entry) => !this.system.has(entry.target));
@@ -14773,6 +14897,8 @@ function realmCa(owner, store) {
 
 // src/kernel/net/tls-engine.ts
 var TLS_CLIENT_INSECURE_SKIP_VERIFY = 1;
+var TLS_CLIENT_NO_SNI = 2;
+var TLS_CLIENT_VERIFY_CHAIN_ONLY = 4;
 var SCRATCH = 64 * 1024;
 var EOF = -1;
 var TlsError = class extends Error {
@@ -14829,10 +14955,22 @@ var TlsEngine = class {
       this.m._free(ptr);
     }
   }
+  withSecret(bytes, fn) {
+    const ptr = this.put(bytes);
+    try {
+      return fn(ptr);
+    } finally {
+      this.m.HEAPU8.fill(0, ptr, ptr + bytes.length + 1);
+      this.m._free(ptr);
+    }
+  }
   intoScratch(fn) {
     const n = fn(this.scratch, SCRATCH);
     return n > 0 ? this.taken(n) : n;
   }
+  get sessionControls() {
+    return typeof this.m._tls_client_cert === "function";
+  }
   get client() {
     return typeof this.m._tls_client_new === "function" ? this.m : void 0;
   }
@@ -14985,6 +15123,27 @@ var TlsSession = class {
     const out = this.engine.intoScratch((p, max) => this.c._tls_alpn(this.ptr, p, max));
     return out instanceof Uint8Array ? new TextDecoder().decode(out) : void 0;
   }
+  ownCert(chain2, key, pass2) {
+    const set3 = this.m._tls_client_cert;
+    const keyLen = key[0] === 45 ? key.length + 1 : key.length;
+    const ret = this.engine.withBytes(
+      chain2,
+      (c) => this.engine.withSecret(
+        key,
+        (k) => this.engine.withSecret(
+          pass2,
+          (p) => set3(this.ptr, c, chain2.length, k, keyLen, pass2.length > 0 ? p : 0, pass2.length)
+        )
+      )
+    );
+    if (ret !== 0) throw this.engine.error(ret, "client certificate");
+  }
+  get ciphersuite() {
+    return this.m._tls_ciphersuite(this.ptr);
+  }
+  get nameMismatch() {
+    return this.m._tls_name_mismatch(this.ptr) === 1;
+  }
   peerChain() {
     const chain2 = [];
     const count2 = this.c._tls_peer_count(this.ptr);
@@ -15986,7 +16145,8 @@ var KernelTty = class {
       poll: () => ({
         readable: this.readable.length > 0 || this.hungUp,
         writable: true,
-        hangup: this.hungUp
+        hangup: this.hungUp,
+        nread: this.readable.reduce((n, chunk2) => n + (chunk2?.length ?? 0), 0)
       }),
       changed: (signal) => this.changed(signal),
       close: () => {
@@ -16182,7 +16342,8 @@ var PtyPair = class {
       poll: () => ({
         readable: this.queue.length > 0 || this.slaveGone,
         writable: true,
-        hangup: this.slaveGone
+        hangup: this.slaveGone,
+        nread: this.queue.reduce((n, chunk2) => n + chunk2.length, 0)
       }),
       changed: (signal) => this.changed(signal),
       close: () => this.closeMaster(),
@@ -16403,11 +16564,11 @@ async function runChild(req, deps) {
     if (pid !== 0) kill();
     decided.resolve();
   };
-  const controls = [];
+  const controls2 = [];
   const capture = () => {
     const { promise, resolve: resolve2 } = Promise.withResolvers();
     const control = { shut: false, ended: resolve2, eof: promise };
-    controls.push(control);
+    controls2.push(control);
     return { capture: true, max, overflow: () => stop("ENOBUFS"), control };
   };
   const decided = Promise.withResolvers();
@@ -16441,11 +16602,11 @@ async function runChild(req, deps) {
   let status;
   try {
     status = await reaped(deps, pid);
-    const open = controls.filter((c) => c.opened);
+    const open = controls2.filter((c) => c.opened);
     await Promise.race([Promise.all(open.map((c) => c.eof)), decided.promise]);
   } finally {
     cancel?.();
-    for (const control of controls) control.shut = true;
+    for (const control of controls2) control.shut = true;
   }
   const out = deps.children.captured(pid, 1);
   const err = deps.children.captured(pid, 2);
@@ -16464,13 +16625,17 @@ async function runChild(req, deps) {
 // src/kernel/select.ts
 function ready(fds, read, write) {
   const hangup = /* @__PURE__ */ new Set();
+  const nread = {};
   const pick = (list, dir) => list.filter((fd) => {
     const state = pollFile(fds.get(fd).file);
     if (state.hangup) hangup.add(fd);
-    return state[dir] || state.hangup;
+    const picked = state[dir] || state.hangup;
+    if (picked && dir === "readable" && state.nread !== void 0) nread[fd] = state.nread;
+    return picked;
   });
   const out = { read: pick(read, "readable"), write: pick(write, "writable") };
   if (hangup.size > 0) out.hangup = [...hangup];
+  if (Object.keys(nread).length > 0) out.nread = nread;
   return out;
 }
 function interruption(signal) {
@@ -17027,6 +17192,47 @@ function encodeReceived(got) {
   return out;
 }
 
+// src/kernel/net/tls-ciphers.ts
+var SUITES = [
+  [4865, "TLS_AES_128_GCM_SHA256", "TLS_AES_128_GCM_SHA256", "TLSv1.3"],
+  [4866, "TLS_AES_256_GCM_SHA384", "TLS_AES_256_GCM_SHA384", "TLSv1.3"],
+  [4867, "TLS_CHACHA20_POLY1305_SHA256", "TLS_CHACHA20_POLY1305_SHA256", "TLSv1.3"],
+  [4868, "TLS_AES_128_CCM_SHA256", "TLS_AES_128_CCM_SHA256", "TLSv1.3"],
+  [4869, "TLS_AES_128_CCM_8_SHA256", "TLS_AES_128_CCM_8_SHA256", "TLSv1.3"],
+  [49195, "ECDHE-ECDSA-AES128-GCM-SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
+  [49196, "ECDHE-ECDSA-AES256-GCM-SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"],
+  [49199, "ECDHE-RSA-AES128-GCM-SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
+  [49200, "ECDHE-RSA-AES256-GCM-SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"],
+  [52392, "ECDHE-RSA-CHACHA20-POLY1305", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLSv1.2"],
+  [
+    52393,
+    "ECDHE-ECDSA-CHACHA20-POLY1305",
+    "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+    "TLSv1.2"
+  ],
+  [49187, "ECDHE-ECDSA-AES128-SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLSv1.2"],
+  [49188, "ECDHE-ECDSA-AES256-SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLSv1.2"],
+  [49191, "ECDHE-RSA-AES128-SHA256", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLSv1.2"],
+  [49192, "ECDHE-RSA-AES256-SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLSv1.2"],
+  [49161, "ECDHE-ECDSA-AES128-SHA", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLSv1.0"],
+  [49162, "ECDHE-ECDSA-AES256-SHA", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLSv1.0"],
+  [49171, "ECDHE-RSA-AES128-SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLSv1.0"],
+  [49172, "ECDHE-RSA-AES256-SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLSv1.0"],
+  [156, "AES128-GCM-SHA256", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
+  [157, "AES256-GCM-SHA384", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"],
+  [158, "DHE-RSA-AES128-GCM-SHA256", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
+  [159, "DHE-RSA-AES256-GCM-SHA384", "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"]
+];
+function cipherOf(id2, protocol) {
+  const known = SUITES.find(([n]) => n === id2);
+  const hex3 = `0x${id2.toString(16).padStart(4, "0").toUpperCase()}`;
+  return {
+    name: known?.[1] ?? hex3,
+    standardName: known?.[2] ?? hex3,
+    version: known?.[3] ?? protocol
+  };
+}
+
 // src/kernel/net/tls-client.ts
 var WRITE_CHUNK = 16 * 1024;
 var BADCERT = [
@@ -17043,6 +17249,15 @@ function verifyCode(flags2) {
   if (flags2 === -1) return "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
   return BADCERT.find(([bit]) => (flags2 & bit) !== 0)?.[1] ?? "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
 }
+function isIP(name2) {
+  return ipv4Bytes(name2) !== void 0 || name2.includes(":") && ipv6Groups(name2) !== void 0;
+}
+function clientFlags(o) {
+  return (o.insecure ? TLS_CLIENT_INSECURE_SKIP_VERIFY : 0) | (o.sni === false ? TLS_CLIENT_NO_SNI : 0) | (o.checkHostname === false ? TLS_CLIENT_VERIFY_CHAIN_ONLY : 0);
+}
+function openSession(o) {
+  return o.engine.clientSession(o.store, o.servername, o.alpn, clientFlags(o));
+}
 var Ciphertext = class {
   queue = [];
   ended = false;
@@ -17115,17 +17330,39 @@ async function handshake(conn, o, session, inbox) {
     }
   }
 }
+function controlsOf(o, session, protocol) {
+  if (!o.engine.sessionControls) return {};
+  const checked = o.checkHostname !== false && !o.insecure;
+  return {
+    cipher: cipherOf(session.ciphersuite, protocol),
+    clientCertificate: o.clientCertificate === true,
+    sni: o.sni !== false && !isIP(o.servername),
+    hostnameChecked: checked,
+    ...o.insecure ? {} : { hostnameMatches: checked || !session.nameMismatch }
+  };
+}
 function infoOf(o, session) {
   const flags2 = session.verifyResult;
   const code = verifyCode(flags2);
+  const protocol = session.version === 772 ? "TLSv1.3" : "TLSv1.2";
   return {
-    protocol: session.version === 772 ? "TLSv1.3" : "TLSv1.2",
+    protocol,
     alpnProtocol: session.alpn ?? false,
     authorized: code === void 0,
     ...code ? { authorizationError: code, authorizationText: o.engine.verifyInfo(flags2).trim() } : {},
-    peerCertificates: session.peerChain()
+    peerCertificates: session.peerChain(),
+    ...controlsOf(o, session, protocol)
   };
 }
+var FATAL_ALERT = -30592;
+function alerted(err) {
+  if (err.code === FATAL_ALERT)
+    return new KernelError(
+      "EPROTO",
+      `ERR_SSL_FATAL_ALERT: the server ended the session: ${err.message}`
+    );
+  return new KernelError("EPROTO", `ERR_SSL_PROTOCOL_ERROR: ${err.message}`);
+}
 function plaintext(conn, session, inbox) {
   let freed = false;
   let writeClosed = false;
@@ -17140,7 +17377,12 @@ function plaintext(conn, session, inbox) {
     async read() {
       for (; ; ) {
         if (freed) return null;
-        const got = session.read();
+        let got;
+        try {
+          got = session.read();
+        } catch (err) {
+          throw alerted(err);
+        }
         await send(conn, session);
         if (got instanceof Uint8Array) return got;
         if (got === "eof") return null;
@@ -17168,8 +17410,7 @@ function plaintext(conn, session, inbox) {
   };
 }
 async function tlsClient(conn, o, taken = new Uint8Array(0)) {
-  const flags2 = o.insecure ? TLS_CLIENT_INSECURE_SKIP_VERIFY : 0;
-  const session = o.engine.clientSession(o.store, o.servername, o.alpn, flags2);
+  const session = o.session ?? openSession(o);
   const inbox = new Ciphertext(conn, session);
   inbox.hand(taken);
   try {
@@ -17182,10 +17423,10 @@ async function tlsClient(conn, o, taken = new Uint8Array(0)) {
 }
 
 // src/kernel/net/tls-uplink.ts
-var isIP = (text) => ipv4Bytes(text) !== void 0 || text.includes(":") && ipv6Groups(text) !== void 0;
+var isIP2 = (text) => ipv4Bytes(text) !== void 0 || text.includes(":") && ipv6Groups(text) !== void 0;
 var LABEL2 = /^(?!-)[A-Za-z0-9-]{1,63}(?<!-)$/;
 function serverName(name2) {
-  if (isIP(name2.replace(/^\[|\]$/g, ""))) return name2.replace(/^\[|\]$/g, "");
+  if (isIP2(name2.replace(/^\[|\]$/g, ""))) return name2.replace(/^\[|\]$/g, "");
   const bare = name2.endsWith(".") ? name2.slice(0, -1) : name2;
   if (bare.length === 0 || bare.length > 253 || !bare.split(".").every((l) => LABEL2.test(l))) {
     throw new KernelError(
@@ -17235,9 +17476,66 @@ function sessionOf(info, servername) {
       authorizationText: info.authorizationText
     } : {},
     servername,
-    peerCertificates: info.peerCertificates.map(encode)
+    peerCertificates: info.peerCertificates.map(encode),
+    ...controls(info)
   };
 }
+function controls(info) {
+  if (!info.cipher) return {};
+  return {
+    cipher: info.cipher,
+    clientCertificate: info.clientCertificate === true,
+    sni: info.sni !== false,
+    hostnameChecked: info.hostnameChecked === true,
+    ...info.hostnameMatches === void 0 ? {} : { hostnameMatches: info.hostnameMatches }
+  };
+}
+var KEY_ERRORS = [
+  [-3, "ERR_OSSL_X509_KEY_VALUES_MISMATCH"],
+  [-15232, "ERR_OSSL_BAD_DECRYPT"],
+  [-15360, "ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED"]
+];
+function keyRefused(err) {
+  const code = err instanceof TlsError ? err.code : 0;
+  const name2 = KEY_ERRORS.find(([n]) => n === code)?.[1] ?? "ERR_OSSL_UNSUPPORTED";
+  const text = code === -3 ? "the key does not match the certificate" : err.message;
+  return new KernelError("EPROTO", `${name2}: ${text}`);
+}
+function takeCert(req) {
+  const cert = req.clientCert;
+  if (!cert) return void 0;
+  delete req.clientCert;
+  if (!Array.isArray(cert.chain) || cert.chain.length === 0 || typeof cert.key !== "string")
+    throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: cert and key go together");
+  let ders;
+  let key;
+  try {
+    ders = cert.chain.map(base64Der);
+    key = base64Der(cert.key);
+  } catch {
+    throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: cert or key is not base64");
+  }
+  const chain2 = new Uint8Array(ders.reduce((n, d) => n + d.length, 0));
+  let at = 0;
+  for (const der of ders) {
+    chain2.set(der, at);
+    at += der.length;
+  }
+  const pass2 = new TextEncoder().encode(cert.passphrase ?? "");
+  return { chain: chain2, key, pass: pass2 };
+}
+function withCert(session, cert) {
+  if (!cert) return;
+  try {
+    session.ownCert(cert.chain, cert.key, cert.pass);
+  } catch (err) {
+    throw keyRefused(err);
+  }
+}
+function wipe(cert) {
+  cert?.key.fill(0);
+  cert?.pass.fill(0);
+}
 async function setUp(support, req) {
   const engine = await support.engine();
   if (!engine.client)
@@ -17255,21 +17553,66 @@ async function setUp(support, req) {
   }
   return { engine, store: own, own };
 }
-function secure(support, req, servername) {
-  return async (raw) => {
-    const { engine, store, own } = await setUp(support, req);
+async function prepare(support, req, servername) {
+  const cert = takeCert(req);
+  try {
+    return await prepareWith(support, req, servername, cert);
+  } catch (err) {
+    if (err instanceof KernelError) throw err;
+    throw new KernelError("ENOTSUP", err instanceof Error ? err.message : String(err));
+  } finally {
+    wipe(cert);
+  }
+}
+async function prepareWith(support, req, servername, cert) {
+  if (req.checkHostname === false && req.insecure === true) {
+    throw new KernelError(
+      "EINVAL",
+      "ERR_INVALID_ARG_VALUE: checkHostname: false needs rejectUnauthorized"
+    );
+  }
+  const { engine, store, own } = await setUp(support, req);
+  const options = {
+    engine,
+    store,
+    servername,
+    alpn: req.alpn ?? [],
+    insecure: req.insecure === true,
+    ...req.sni === false ? { sni: false } : {},
+    ...req.checkHostname === false ? { checkHostname: false } : {},
+    clientCertificate: cert !== void 0
+  };
+  let session;
+  try {
+    const controls2 = req.sni === false || req.checkHostname === false || cert !== void 0;
+    if (controls2 && !engine.sessionControls) {
+      throw new KernelError("ENOTSUP", "the installed tls engine has no client certificates");
+    }
+    session = openSession(options);
+    withCert(session, cert);
+    return { options: { ...options, session }, own };
+  } catch (err) {
+    session?.free();
+    own?.release();
+    throw err;
+  }
+}
+function secure(prepared) {
+  let ran = false;
+  const make = async (raw) => {
+    ran = true;
     try {
-      return await tlsClient(raw, {
-        engine,
-        store,
-        servername,
-        alpn: req.alpn ?? [],
-        insecure: req.insecure === true
-      });
+      return await tlsClient(raw, prepared.options);
     } finally {
-      own?.release();
+      prepared.own?.release();
     }
   };
+  const abandon = () => {
+    if (ran) return;
+    prepared.options.session.free();
+    prepared.own?.release();
+  };
+  return { make, abandon };
 }
 function supportOf(net) {
   const support = net.tlsClient;
@@ -17278,7 +17621,7 @@ function supportOf(net) {
 }
 async function uplinkAddress(proc, host) {
   const bare = host.replace(/^\[|\]$/g, "");
-  if (isIP(bare)) return bare;
+  if (isIP2(bare)) return bare;
   const [first] = await proc.resolve(host, 0, () => proc.blocking());
   if (!first) throw new KernelError("ENOENT", `ENOTFOUND: ${host}`);
   return first;
@@ -17287,23 +17630,31 @@ async function connectSecure(proc, socket, host, port, req) {
   const servername = serverName(req.servername || host);
   if (isLoopbackHost(servername) || isLoopbackHost(host)) throw new KernelError("ENOTSUP");
   const address = await uplinkAddress(proc, host);
-  const route = proc.net.uplinkFor(address);
-  if (!route)
+  const route2 = proc.net.uplinkFor(address);
+  if (!route2)
     throw new KernelError("ENOTSUP", "TLS in the kernel needs a destination the uplink routes");
   const support = supportOf(proc.net);
   let info;
-  const make = secure(support, req, servername);
-  await socket.connectSecure({ family: "inet", host: address, port }, route, async (conn) => {
-    info = await conn.upgrade(make);
-  });
+  const { make, abandon } = secure(await prepare(support, req, servername));
+  try {
+    await socket.connectSecure({ family: "inet", host: address, port }, route2, async (conn) => {
+      info = await conn.upgrade(make);
+    });
+  } finally {
+    abandon();
+  }
   return sessionOf(info, servername);
 }
 async function upgradeSecure(proc, socket, req) {
   const peer = socket.peer;
   const host = req.servername || (peer?.family === "inet" ? peer.host : "");
   const servername = serverName(host);
-  const info = await socket.upgradeSecure(secure(supportOf(proc.net), req, servername));
-  return sessionOf(info, servername);
+  const { make, abandon } = secure(await prepare(supportOf(proc.net), req, servername));
+  try {
+    return sessionOf(await socket.upgradeSecure(make), servername);
+  } finally {
+    abandon();
+  }
 }
 
 // src/kernel/unix-dgram.ts
@@ -17665,17 +18016,23 @@ var NOT_HTTP_PORTS = /* @__PURE__ */ new Set([
   8883
 ]);
 var HOST_NAME = /^[A-Za-z0-9.-]+$|^\[?[0-9A-Fa-f:.]+\]?$/;
+function sessionControls(req) {
+  return req.sni === false || req.checkHostname === false || req.clientCert !== void 0;
+}
 function wantsKernel(req) {
   if (req.path === "kernel") return true;
   if (req.path === "transport") return false;
-  return Array.isArray(req.ca) || req.alpn !== void 0 && req.alpn.length > 0 && !req.alpn.includes("http/1.1") || NOT_HTTP_PORTS.has(req.port);
+  return Array.isArray(req.ca) || sessionControls(req) || req.alpn !== void 0 && req.alpn.length > 0 && !req.alpn.includes("http/1.1") || NOT_HTTP_PORTS.has(req.port);
 }
 async function secureConnect(req, proc) {
   if (!Number.isInteger(req.port) || req.port < 1 || req.port > 65535)
     throw new KernelError("EINVAL");
   const kernelPath = wantsKernel(req) && await uplinked(proc, req.host);
   if (!kernelPath) {
-    if (req.path === "kernel" || Array.isArray(req.ca)) throw new KernelError("ENOTSUP");
+    if (req.path === "kernel" || Array.isArray(req.ca) || sessionControls(req)) {
+      delete req.clientCert;
+      throw new KernelError("ENOTSUP");
+    }
     return { ...tlsOverTransport(req, proc), path: "transport", substitutes: true };
   }
   const socket = proc.net.socket("inet");
@@ -17809,13 +18166,17 @@ var VfsNode = class {
     const ranged2 = await this.prepare();
     await ranged2?.pin();
   }
+  moving = /* @__PURE__ */ new Set();
   async load() {
     if (this.revoked) throw new KernelError("EIO");
-    if (!this.data) {
+    while (!this.data) {
+      const at = this.path;
       try {
-        this.data = await this.fs.readFileBuffer(this.path);
+        this.data = await this.fs.readFileBuffer(at);
       } catch (err) {
         if (!isMissing(err)) throw err;
+        while (this.moving.size > 0) await Promise.all(this.moving);
+        if (this.path !== at) continue;
         this.data = new Uint8Array(0);
         this.missing = true;
       }
@@ -18169,6 +18530,16 @@ var VfsNodes = class {
     this.byPath.set(file.hidden, node);
     this.kept.set(node, file);
   }
+  moving(path) {
+    const node = this.byPath.get(path);
+    if (!node) return () => void 0;
+    const { promise, resolve: resolve2 } = Promise.withResolvers();
+    node.moving.add(promise);
+    return () => {
+      node.moving.delete(promise);
+      resolve2();
+    };
+  }
   unkeep(path, file) {
     const node = this.byPath.get(file.hidden);
     if (!node) return;
@@ -18477,6 +18848,65 @@ function vfsFile(fs, opts, nodes) {
   });
 }
 
+// src/kernel/watch-ops.ts
+var WATCH_OPS = ["watch-open", "watch-next", "watch-close"];
+var WATCHING = new Set(WATCH_OPS);
+function isWatchSyscall(req) {
+  return WATCHING.has(req.op);
+}
+var WATCHES_MAX = 8192;
+var parentOf8 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
+function visibleTo2(watch, root, visible) {
+  return {
+    close: () => watch.close(),
+    next: async (signal) => {
+      const notes = await watch.next(signal);
+      const seen = /* @__PURE__ */ new Map();
+      const shown = await Promise.all(
+        notes.map(async (note) => {
+          if (!("filename" in note) || !note.filename.includes("/")) return true;
+          const dir = parentOf8(`${root === "/" ? "" : root}/${note.filename}`);
+          if (!seen.has(dir)) seen.set(dir, visible(dir));
+          return seen.get(dir);
+        })
+      );
+      return notes.filter((_note, i) => shown[i]);
+    }
+  };
+}
+var ProcessWatches = class {
+  open = /* @__PURE__ */ new Map();
+  nextId = 1;
+  source;
+  constructor(source) {
+    this.source = source;
+  }
+  async syscall(req, cancelled) {
+    if (req.op === "watch-open") {
+      if (!this.source) throw new KernelError("ENOSYS");
+      if (this.open.size >= WATCHES_MAX) throw new KernelError("ENOSPC");
+      const watch2 = await this.source.open(req.path, req.recursive === true);
+      const id2 = this.nextId++;
+      this.open.set(id2, watch2);
+      return { ok: true, kind: "json", json: id2 };
+    }
+    const watch = this.open.get(req.id);
+    if (req.op === "watch-close") {
+      watch?.close();
+      this.open.delete(req.id);
+      return { ok: true, kind: "void" };
+    }
+    if (!watch) return { ok: true, kind: "json", json: [{ ended: true }] };
+    const notes = await watch.next(cancelled);
+    if (notes.some((note) => "ended" in note)) this.open.delete(req.id);
+    return { ok: true, kind: "json", json: notes };
+  }
+  closeAll() {
+    for (const watch of this.open.values()) watch.close();
+    this.open.clear();
+  }
+};
+
 // src/kernel/process.ts
 function aborted(signal) {
   return new Promise((_, reject) => {
@@ -18603,7 +19033,8 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   ...SEM_OPS,
   ...HTTP_OPS,
   ...PTY_OPS,
-  ...HOST_OPS
+  ...HOST_OPS,
+  ...WATCH_OPS
 ]);
 function isWasmSyscall(req) {
   const op = req.op;
@@ -18655,6 +19086,7 @@ function timeLeft(req, started) {
 }
 var WasmProcess = class {
   exited = false;
+  watches;
   children;
   deathSignals = /* @__PURE__ */ new Map();
   caught = 0;
@@ -18685,6 +19117,7 @@ var WasmProcess = class {
     this.pid = pid;
     this.fds = fds;
     this.options = options;
+    this.watches = new ProcessWatches(options.watches);
     this.inherited = options.ignored ?? 0;
     this.umask = options.umask ?? DEFAULT_UMASK2;
     this.cred = copyCred(options.cred ?? ROOT);
@@ -18942,6 +19375,7 @@ var WasmProcess = class {
         });
       }
       if (isHttpSyscall(req)) return await this.httpSyscall(req);
+      if (isWatchSyscall(req)) return await this.watches.syscall(req, cancelled);
       if (isHostSyscall(req)) {
         return await hostSyscall(req, {
           pid: this.pid,
@@ -20082,6 +20516,7 @@ var WasmProcess = class {
     this.options.locks?.release(this.pid);
     for (const owner of this.lockOwners) this.options.locks?.release(owner);
     this.asyncOps.close();
+    this.watches.closeAll();
     for (const [target, sig] of this.deathSignals) this.sendDeath(target, sig);
     this.deathSignals.clear();
     for (const pid of this.children.pids()) this.options.onReap?.(pid);
@@ -20343,6 +20778,7 @@ function processOptions(opts, header3, hooks, created3) {
     locks: opts.locks,
     fifos: opts.fifos,
     ...opts.sems ? { sems: opts.sems } : {},
+    watches: opts.watches,
     onReap: opts.onReap,
     resolver: opts.resolver,
     ...notifiers(header3),
@@ -21456,7 +21892,7 @@ function register(automaton, sources, ids, bytes, source) {
   }
   sources[id2].push(source);
 }
-function prepare(secrets) {
+function prepare2(secrets) {
   const main = new Automaton();
   const wrap = new Automaton();
   const sources = [];
@@ -21607,7 +22043,7 @@ function merge(into, from) {
   }
 }
 function compile(secrets, options = {}) {
-  const c = prepare(secrets.map((secret) => ({ ...secret })));
+  const c = prepare2(secrets.map((secret) => ({ ...secret })));
   const decoder4 = new TextDecoder();
   const idleMs = options.idleMs ?? 250;
   const scrubBytes = (input) => {
@@ -25560,6 +25996,7 @@ var Launcher = class {
       locks: this.locks,
       fifos: this.fifos,
       sems: this.sems,
+      watches: this.watchSource(pid),
       resolver: this.resolver,
       onReap: (child) => this.reaped(child, pid),
       ...req.fork ? { fork: req.fork } : {},
@@ -26103,6 +26540,23 @@ var Launcher = class {
       mounts: this.mounts.list().map((entry) => entry.target).filter((target) => this.mounts.mounted(target) !== void 0)
     });
   }
+  watchSource(pid) {
+    return {
+      open: async (path, recursive) => {
+        const at = normalizePath(path);
+        const g = this.execGuard(this.credOf(pid), pid);
+        if (g) await readable(g, "watch", at);
+        const st = await this.fs.stat(at);
+        const real = await this.fs.realpath?.(at, true).catch(() => at) ?? at;
+        const watch = this.watchers.typedWatch(real, recursive && st.isDirectory, at);
+        if (!g || g.cred.euid === 0) return watch;
+        return visibleTo2(watch, real, async (dir) => {
+          const walked = await access(g.fs, g.cred, dir, R_OK | X_OK, { directory: true });
+          return walked.denied === void 0 && walked.missing !== true;
+        });
+      }
+    };
+  }
   watchFiles(paths, notify) {
     this.fileWatches ??= new FileWatches(this.watchers, this.rootFs);
     return this.fileWatches.watch(paths, notify);