@ai-ecoverse/slicc-kernel 1.127.1 → 1.128.1

package/dist/kernel-worker.js

@@ -185,8 +185,8 @@ var IndexedDbMeta = class {
       const [transaction, store] = this.transaction("readonly");
       const found = /* @__PURE__ */ new Map();
       for (const path of missing4) {
-        const request2 = store.get(path);
-        request2.onsuccess = () => void found.set(path, request2.result ?? null);
+        const request3 = store.get(path);
+        request3.onsuccess = () => void found.set(path, request3.result ?? null);
       }
       await settle(transaction, () => void 0);
       if (generation === this.generation)
@@ -202,16 +202,16 @@ var IndexedDbMeta = class {
     const requests = paths.map((path) => store.get(path));
     return settle(
       transaction,
-      () => requests.map((request2) => request2.result ?? void 0)
+      () => requests.map((request3) => request3.result ?? void 0)
     );
   }
   async update(path, change) {
     this.settleRemoves();
     const [transaction, store] = this.transaction("readwrite");
-    const request2 = store.get(path);
+    const request3 = store.get(path);
     let next3;
-    request2.onsuccess = () => {
-      next3 = change(request2.result);
+    request3.onsuccess = () => {
+      next3 = change(request3.result);
       if (next3) store.put(next3);
       else store.delete(path);
     };
@@ -225,9 +225,9 @@ var IndexedDbMeta = class {
     const [transaction, store] = this.transaction("readwrite");
     const next3 = /* @__PURE__ */ new Map();
     for (const { path, change } of changes) {
-      const request2 = store.get(path);
-      request2.onsuccess = () => {
-        const entry = change(request2.result);
+      const request3 = store.get(path);
+      request3.onsuccess = () => {
+        const entry = change(request3.result);
         next3.set(path, entry ?? null);
         if (entry) store.put(entry);
         else store.delete(path);
@@ -301,9 +301,9 @@ var IndexedDbMeta = class {
     this.removing = /* @__PURE__ */ new Map();
     const [transaction, store] = this.transaction("readwrite");
     for (const [path, seen] of batch) {
-      const request2 = store.get(path);
-      request2.onsuccess = () => {
-        if (request2.result && JSON.stringify(request2.result) === seen) store.delete(path);
+      const request3 = store.get(path);
+      request3.onsuccess = () => {
+        if (request3.result && JSON.stringify(request3.result) === seen) store.delete(path);
       };
     }
     const paths = [...batch.keys()];
@@ -312,8 +312,8 @@ var IndexedDbMeta = class {
   async links(dir) {
     this.settleRemoves();
     const [transaction, store] = this.transaction("readonly");
-    const request2 = store.index("dir").getAll(dir);
-    return settle(transaction, () => request2.result);
+    const request3 = store.index("dir").getAll(dir);
+    return settle(transaction, () => request3.result);
   }
   async under(path) {
     this.settleRemoves();
@@ -330,22 +330,25 @@ var IndexedDbMeta = class {
   async all() {
     this.settleRemoves();
     const [transaction, store] = this.transaction("readonly");
-    const request2 = store.getAll();
-    return settle(transaction, () => request2.result);
+    const request3 = store.getAll();
+    return settle(transaction, () => request3.result);
   }
 };
-function openMeta(name2, factory) {
+function openMetaDb(name2, factory) {
   return new Promise((resolve2, reject) => {
-    const request2 = factory.open(name2, META_VERSION);
-    request2.onupgradeneeded = (event) => {
+    const request3 = factory.open(name2, META_VERSION);
+    request3.onupgradeneeded = (event) => {
       if (event.oldVersion < 1) {
-        request2.result.createObjectStore(META_STORE, { keyPath: "path" }).createIndex("dir", "dir");
+        request3.result.createObjectStore(META_STORE, { keyPath: "path" }).createIndex("dir", "dir");
       }
     };
-    request2.onsuccess = () => resolve2(new IndexedDbMeta(request2.result));
-    request2.onerror = () => reject(request2.error);
+    request3.onsuccess = () => resolve2(request3.result);
+    request3.onerror = () => reject(request3.error);
   });
 }
+async function openMeta(name2, factory) {
+  return new IndexedDbMeta(await openMetaDb(name2, factory));
+}
 
 // src/fs/types.ts
 function rangedOps(fs) {
@@ -689,37 +692,37 @@ function missing(err) {
   return code === "ENOENT" || code === "ENOTDIR";
 }
 async function resolved(fs, path, follow2, hops = []) {
-  let done4 = [];
+  let done5 = [];
   let todo = partsOf(path);
   for (let links = 0; todo.length > 0; ) {
     const part = todo.shift();
     if (part === "..") {
-      done4.pop();
+      done5.pop();
       continue;
     }
     if (todo.length === 0 && !follow2) {
-      done4.push(part);
+      done5.push(part);
       break;
     }
-    const at = `/${[...done4, part].join("/")}`;
+    const at = `/${[...done5, part].join("/")}`;
     const st = await fs.lstat(at).catch((err) => {
       if (missing(err)) return void 0;
       throw err;
     });
     if (!st) {
-      return normalizePath([...done4, part, ...todo].join("/"));
+      return normalizePath([...done5, part, ...todo].join("/"));
     }
     if (!st.isSymbolicLink) {
-      done4.push(part);
+      done5.push(part);
       continue;
     }
     if (++links > MAX_LINKS) throw fsError("ELOOP", path);
     hops.push(normalizePath([at, ...todo].join("/")));
     const link2 = await fs.readlink(at);
-    if (link2.startsWith("/")) done4 = [];
+    if (link2.startsWith("/")) done5 = [];
     todo = [...partsOf(link2), ...todo];
   }
-  return `/${done4.join("/")}`;
+  return `/${done5.join("/")}`;
 }
 async function namesOf(fs, path) {
   const lexical2 = normalizePath(path);
@@ -795,6 +798,12 @@ var ProtectedFs = class {
           st && marked(`${dir}/${name2}`, st)
         ]);
       },
+      ...fs.copyFile ? {
+        async copyFile(...args) {
+          await check(args[1], false);
+          return fs.copyFile?.(...args);
+        }
+      } : {},
       ...fs.createExclusive ? {
         async createExclusive(...args) {
           await check(args[0], true);
@@ -1028,16 +1037,16 @@ var RemoteWatch = class {
     this.channel.postMessage({ tab: this.tab, paths: this.mine, seq: seq2 });
     if (this.peers.size === 0) return Promise.resolve();
     return new Promise((resolve2) => {
-      const done4 = () => {
+      const done5 = () => {
         clearTimeout(timer);
         this.waiting.delete(seq2);
         resolve2();
       };
       const timer = setTimeout(() => {
-        done4();
+        done5();
         void this.prune();
       }, ANNOUNCE_WAIT_MS);
-      this.waiting.set(seq2, { left: new Set(this.peers), done: done4 });
+      this.waiting.set(seq2, { left: new Set(this.peers), done: done5 });
     });
   }
   emit(change) {
@@ -1195,11 +1204,11 @@ async function openSync(handle) {
   }
 }
 function writeAll(access2, at, bytes) {
-  for (let done4 = 0; done4 < bytes.length; ) {
-    const n = access2.write(bytes.subarray(done4), { at: at + done4 });
+  for (let done5 = 0; done5 < bytes.length; ) {
+    const n = access2.write(bytes.subarray(done5), { at: at + done5 });
     if (!(n > 0))
       throw Object.assign(new Error("the file system took no more bytes"), { code: "ENOSPC" });
-    done4 += n;
+    done5 += n;
   }
 }
 async function positioned(handle, op) {
@@ -1422,7 +1431,7 @@ var OpfsFs = class {
       return await op();
     } finally {
       this.unlocked--;
-      if (this.unlocked === 0) for (const done4 of this.idle.splice(0)) done4();
+      if (this.unlocked === 0) for (const done5 of this.idle.splice(0)) done5();
     }
   }
   settle;
@@ -1539,9 +1548,9 @@ var OpfsFs = class {
   opfsOps() {
     return this.calls + this.others;
   }
-  io(request2) {
+  io(request3) {
     this.others++;
-    return request2;
+    return request3;
   }
   fresh() {
     this.changes++;
@@ -1697,30 +1706,30 @@ var OpfsFs = class {
     }
     throw fsError("ELOOP", path);
   }
-  async physical(base, path, used, of) {
-    let done4 = [];
+  async physical(base, path, used2, of) {
+    let done5 = [];
     let todo = (path.startsWith("/") ? path : `${base}/${path}`).split("/").filter((p) => p !== "" && p !== ".");
-    let hops = used;
+    let hops = used2;
     while (todo.length > 0) {
       const part = todo.shift();
-      if (part === "..") done4.pop();
-      else if (!todo.includes("..")) done4.push(part);
+      if (part === "..") done5.pop();
+      else if (!todo.includes("..")) done5.push(part);
       else {
-        const at = `/${[...done4, part].join("/")}`;
+        const at = `/${[...done5, part].join("/")}`;
         this.crossing(of, [at, ...todo].join("/"));
         const st = await this.lstat(at);
         if (!st.isSymbolicLink && !st.isDirectory) throw fsError("ENOTDIR", at);
-        if (!st.isSymbolicLink) done4.push(part);
+        if (!st.isSymbolicLink) done5.push(part);
         else if (this.rejectLinks) throw fsError("ELOOP", of);
         else if (++hops > MAX_LINKS2) throw fsError("ELOOP", path);
         else {
           const link2 = await this.readlink(at);
-          if (link2.startsWith("/")) done4 = [];
+          if (link2.startsWith("/")) done5 = [];
           todo = [...link2.split("/").filter((p) => p !== "" && p !== "."), ...todo];
         }
       }
     }
-    return { path: `/${done4.join("/")}`, hops };
+    return { path: `/${done5.join("/")}`, hops };
   }
   mode(path, directory, meta) {
     const fallback = directory || EXECUTABLE.test(path) ? 493 : 420;
@@ -2440,10 +2449,11 @@ var OpfsFs = class {
     return intents.length;
   }
   async settledRename(path) {
-    if (this.renamingDirs.size === 0 || typeof path !== "string") return;
+    if (this.renamingDirs.size === 0 && this.copying.size === 0 || typeof path !== "string")
+      return;
     const at = normalizePath(path);
     for (let real; ; ) {
-      const busy = this.renameAt(at) ?? (real === void 0 ? void 0 : this.renameAt(real));
+      const busy = this.busyAt(at) ?? (real === void 0 ? void 0 : this.busyAt(real));
       if (busy) {
         await busy.done;
         continue;
@@ -2454,6 +2464,62 @@ var OpfsFs = class {
       if (real === at) return;
     }
   }
+  busyAt(at) {
+    return this.renameAt(at) ?? this.copying.get(at);
+  }
+  copying = /* @__PURE__ */ new Map();
+  async copyFile(from, to, options) {
+    const source = await this.locate(from, true);
+    if (source.handle?.kind !== "file") throw fsError("EINVAL", `${from}: not a regular file`);
+    const [entry] = await this.meta.get([source.path]);
+    if (entry?.fifo || entry?.socket) throw fsError("EINVAL", `${from}: not a regular file`);
+    const parent = await this.locate(parentOf3(to), true);
+    if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", to);
+    const destination = resolvePath(parent.path, baseOf(to));
+    if (destination === source.path) throw fsError("EINVAL", `${from}: copied onto itself`);
+    const file = await this.reading(source.path, (handle) => handle.getFile());
+    const { promise, resolve: resolve2 } = Promise.withResolvers();
+    while (this.copying.has(destination)) await this.copying.get(destination)?.done;
+    this.copying.set(destination, { done: promise });
+    try {
+      await this.copyInto(file, destination, to, options);
+    } finally {
+      this.copying.delete(destination);
+      resolve2();
+    }
+  }
+  async copyInto(file, destination, to, options) {
+    let created4 = false;
+    if (options.exclusive) {
+      await this.createExclusive(destination, options.owner);
+      created4 = true;
+    }
+    let target = destination;
+    let writable2;
+    let handle;
+    try {
+      const [made2, existed, at] = await this.fileFor(destination);
+      handle = made2;
+      target = at;
+      if (!existed && !created4) {
+        created4 = true;
+        await this.stampNew(target, options.owner, false);
+      }
+      const [entry] = await this.meta.get([target]);
+      if (entry?.fifo || entry?.socket) throw fsError("ENXIO", to);
+      this.wrote(handle);
+      writable2 = await handle.createWritable();
+      await writable2.write(file);
+      await writable2.close();
+    } catch (err) {
+      await writable2?.abort().catch(() => void 0);
+      if (created4) await this.rm(target, { file: true }).catch(() => void 0);
+      throw translate(err, to, "commit", false);
+    } finally {
+      if (handle) this.wrote(handle);
+    }
+    this.committed(target);
+  }
   renameAt(at) {
     for (const m of this.renamingDirs) {
       if (within2(at, m.from) || within2(at, m.to) || at === parentOf3(m.from) || at === parentOf3(m.to))
@@ -2625,7 +2691,7 @@ var OpfsFs = class {
   }
   async present(paths) {
     const listed = /* @__PURE__ */ new Map();
-    const done4 = /* @__PURE__ */ new Map();
+    const done5 = /* @__PURE__ */ new Map();
     const list = (dir) => {
       const known = listed.get(dir);
       if (known !== void 0) return known;
@@ -2644,7 +2710,7 @@ var OpfsFs = class {
         }
         return children3;
       })().then((children3) => {
-        done4.set(dir, children3);
+        done5.set(dir, children3);
         return children3;
       });
       listed.set(dir, listing);
@@ -2658,7 +2724,7 @@ var OpfsFs = class {
     await Promise.all(Array.from({ length: Math.min(RECONCILE_LISTINGS, dirs.length) }, lister));
     return async (path) => {
       if (split(path).length === 0) return true;
-      const listing = done4.get(parentOf3(path));
+      const listing = done5.get(parentOf3(path));
       if (listing === null) return this.real(path);
       return listing?.has(baseOf(path)) === true;
     };
@@ -2701,6 +2767,7 @@ var READS = [
   "readVersioned"
 ];
 var WRITES = [
+  "copyFile",
   "writeFile",
   "pwrite",
   "truncate",
@@ -2733,6 +2800,85 @@ for (const [names2, op] of [
   }
 }
 
+// src/fs/roots.ts
+var ROOTS_DB = "slicc-kernel-roots";
+var ROOTS_STORE = "roots";
+function request(req) {
+  return new Promise((resolve2, reject) => {
+    req.onsuccess = () => resolve2(req.result);
+    req.onerror = () => reject(req.error);
+  });
+}
+function open(factory) {
+  const req = factory.open(ROOTS_DB, 1);
+  req.onupgradeneeded = () => req.result.createObjectStore(ROOTS_STORE, { keyPath: "id" });
+  return request(req);
+}
+async function same(a, b) {
+  try {
+    return await a.isSameEntry(b);
+  } catch {
+    return false;
+  }
+}
+var nameOf = (id2) => `${META_DB}:${id2}`;
+function done(tx) {
+  return new Promise((resolve2, reject) => {
+    tx.oncomplete = () => resolve2();
+    tx.onerror = () => reject(tx.error);
+    tx.onabort = () => reject(tx.error);
+  });
+}
+async function used(root) {
+  for await (const _ of root.keys()) return true;
+  return false;
+}
+async function seed(factory, name2) {
+  const known = await factory.databases?.().catch(() => void 0);
+  if (known && !known.some((db) => db.name === META_DB)) return;
+  const from = await openMetaDb(META_DB, factory);
+  const to = await openMetaDb(name2, factory);
+  try {
+    const rows = await request(
+      from.transaction(META_STORE, "readonly").objectStore(META_STORE).getAll()
+    );
+    const tx = to.transaction(META_STORE, "readwrite");
+    const store = tx.objectStore(META_STORE);
+    for (const row of rows) store.put(row);
+    await done(tx);
+    console.warn(
+      `slicc-kernel: a root not seen before got its own metadata database ${name2}, a copy of ${rows.length} records of ${META_DB} (#1120)`
+    );
+  } finally {
+    from.close();
+    to.close();
+  }
+}
+async function rootId(factory, root, locks = globalThis.navigator?.locks) {
+  const find = async () => {
+    const db = await open(factory);
+    try {
+      const all = await request(
+        db.transaction(ROOTS_STORE, "readonly").objectStore(ROOTS_STORE).getAll()
+      );
+      for (const record of all) if (await same(record.handle, root)) return record.id;
+      const id2 = crypto.randomUUID();
+      if (await used(root)) await seed(factory, nameOf(id2));
+      const tx = db.transaction(ROOTS_STORE, "readwrite");
+      tx.objectStore(ROOTS_STORE).put({ id: id2, handle: root });
+      await done(tx);
+      return id2;
+    } finally {
+      db.close();
+    }
+  };
+  return locks ? locks.request(ROOTS_DB, find) : find();
+}
+async function metadataName(top, root, id2) {
+  if (!top || await same(top, root)) return META_DB;
+  return nameOf(await id2(root));
+}
+
 // src/kernel/net/http1.ts
 var HttpError = class extends Error {
   status;
@@ -3298,8 +3444,8 @@ var CdpFacade = class {
       } catch {
         break;
       }
-      const done4 = this.serve(conn).finally(() => served2.delete(done4));
-      served2.add(done4);
+      const done5 = this.serve(conn).finally(() => served2.delete(done5));
+      served2.add(done5);
     }
     await Promise.allSettled([...served2]);
   }
@@ -3510,12 +3656,12 @@ var CdpHosts = class {
   available(runtime) {
     return this.pick(runtime) !== void 0;
   }
-  async connect(request2) {
-    const entry = this.pick(request2.runtime);
+  async connect(request3) {
+    const entry = this.pick(request3.runtime);
     if (!entry) throw new HttpError(503, NO_CDP_HOST);
     let conn;
     try {
-      conn = await entry.hook(request2.runtime ? { runtime: request2.runtime } : {});
+      conn = await entry.hook(request3.runtime ? { runtime: request3.runtime } : {});
     } catch (e) {
       throw new HttpError(502, `CDP host: ${e instanceof Error ? e.message : String(e)}`);
     }
@@ -3549,7 +3695,7 @@ function fresh(bytes, start2 = 0, end = bytes.length) {
 
 // src/cdp/port.ts
 function portCdpHook(ask, gone) {
-  return (request2) => new Promise((resolve2, reject) => {
+  return (request3) => new Promise((resolve2, reject) => {
     const { port1, port2 } = new MessageChannel();
     let closed = false;
     const conn = {
@@ -3586,7 +3732,7 @@ function portCdpHook(ask, gone) {
       reject(new Error("the CDP host is gone"));
       conn.onclose?.("the CDP host is gone");
     });
-    ask(request2, port2);
+    ask(request3, port2);
   });
 }
 
@@ -4896,10 +5042,10 @@ function uplinkLink(conn, onReset) {
     pipe.openRead();
     pipe.openWrite();
   }
-  let open = true;
+  let open2 = true;
   const close = () => {
-    if (!open) return;
-    open = false;
+    if (!open2) return;
+    open2 = false;
     conn.close();
   };
   void inbound(conn, rx).catch((err) => {
@@ -5724,9 +5870,9 @@ function uploadsFor(peer) {
   return { of, answer: (call) => pulls.get(call.nid)?.(call) };
 }
 function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {}) {
-  const open = /* @__PURE__ */ new Map();
+  const open2 = /* @__PURE__ */ new Map();
   const fail2 = (nid, e) => {
-    open.delete(nid);
+    open2.delete(nid);
     const { status, code } = e;
     peer.postMessage({
       net: "error",
@@ -5740,7 +5886,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
   const start2 = async (call) => {
     const abort = new AbortController();
     const entry = { abort };
-    open.set(call.nid, entry);
+    open2.set(call.nid, entry);
     try {
       const response = await transport.fetch({
         url: call.url,
@@ -5749,11 +5895,11 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
         ...call.streamed ? { bodyStream: uploads.of(call.nid, abort.signal) } : call.body ? { body: call.body } : {},
         signal: abort.signal
       });
-      if (!open.has(call.nid)) {
+      if (!open2.has(call.nid)) {
         await response.cancel();
         return;
       }
-      open.set(call.nid, { abort, body: response.body[Symbol.asyncIterator](), response });
+      open2.set(call.nid, { abort, body: response.body[Symbol.asyncIterator](), response });
       peer.postMessage({
         net: "head",
         nid: call.nid,
@@ -5781,7 +5927,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
   };
   const openSocket = async (call) => {
     const abort = new AbortController();
-    open.set(call.nid, { abort });
+    open2.set(call.nid, { abort });
     try {
       if (!transport.websocket) throw new Error(NO_WEBSOCKET);
       const socket = await transport.websocket({
@@ -5790,7 +5936,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
         headers: call.headers,
         signal: abort.signal
       });
-      if (!open.delete(call.nid)) {
+      if (!open2.delete(call.nid)) {
         socket.close(1e3, "cancelled");
         return;
       }
@@ -5858,12 +6004,12 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
     peer.postMessage({ net: "ws-acked", nid: call.nid, n: payloadSize(call.data) });
   };
   const read = async (nid) => {
-    const body = open.get(nid)?.body;
+    const body = open2.get(nid)?.body;
     if (!body) return;
     try {
       const next3 = await body.next();
       if (next3.done) {
-        open.delete(nid);
+        open2.delete(nid);
         peer.postMessage({ net: "end", nid });
       } else {
         const bytes = fresh(next3.value);
@@ -5876,8 +6022,8 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
   const drop = (nid) => {
     sockets.get(nid)?.close(1e3, "cancelled");
     refill(nid, 0, true);
-    const entry = open.get(nid);
-    open.delete(nid);
+    const entry = open2.get(nid);
+    open2.delete(nid);
     entry?.abort.abort();
     void entry?.response?.cancel().catch(() => void 0);
   };
@@ -5896,7 +6042,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS2 } = {})
       else drop(call.nid);
     },
     close() {
-      for (const nid of [...open.keys(), ...sockets.keys()]) drop(nid);
+      for (const nid of [...open2.keys(), ...sockets.keys()]) drop(nid);
     }
   };
 }
@@ -6385,12 +6531,12 @@ function signalOf(host) {
     throw fsError("EINVAL", `this kernel names no signal ${name2}`);
   });
 }
-function dialFor(l, req, open) {
+function dialFor(l, req, open2) {
   const socket = dialSocket(l.net, req.port, req.host);
   const { port1, port2 } = new MessageChannel();
-  open.set(
+  open2.set(
     req.id,
-    serveSocket(socket, port1, () => open.delete(req.id))
+    serveSocket(socket, port1, () => open2.delete(req.id))
   );
   return { result: port2, transfer: [port2] };
 }
@@ -6469,7 +6615,7 @@ function cdpRegistry(send2, gone) {
   return {
     serve(l, req) {
       const hook = portCdpHook(
-        (request2, cdp) => send2({ cdpOpen: { ...request2, registration: req.id }, port: cdp }, [
+        (request3, cdp) => send2({ cdpOpen: { ...request3, registration: req.id }, port: cdp }, [
           cdp
         ]),
         gone
@@ -6492,7 +6638,7 @@ function facadeRegistry(send2, gone) {
   return {
     serve(l, req) {
       const hook = portFacadeHook(
-        (request2, facade) => send2({ facadeOpen: { ...request2, registration: req.id }, port: facade }, [
+        (request3, facade) => send2({ facadeOpen: { ...request3, registration: req.id }, port: facade }, [
           facade
         ]),
         gone
@@ -6874,7 +7020,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.127.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.128.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -7951,7 +8097,7 @@ var UnlinkedKeeper = class {
       throw err;
     }
     sealed();
-    const done4 = () => {
+    const done5 = () => {
       for (const release of releases) release();
     };
     const files = /* @__PURE__ */ new Map();
@@ -7966,7 +8112,7 @@ var UnlinkedKeeper = class {
       moved: new Set(hidden.keys()),
       commit: () => {
         for (const file of files.values()) file.release();
-        done4();
+        done5();
       },
       rollback: async () => {
         for (const [path, file] of files) {
@@ -7977,7 +8123,7 @@ var UnlinkedKeeper = class {
             await this.tidy(parentOf5(file.hidden));
           });
         }
-        done4();
+        done5();
       }
     };
   }
@@ -8063,14 +8209,14 @@ var systemCronClock = {
   sleep(until, signal) {
     if (signal.aborted) return Promise.resolve();
     return new Promise((resolve2) => {
-      const done4 = () => {
+      const done5 = () => {
         clearTimeout(timer);
-        signal.removeEventListener("abort", done4);
+        signal.removeEventListener("abort", done5);
         resolve2();
       };
-      const timer = setTimeout(done4, Math.max(0, until - Date.now()));
+      const timer = setTimeout(done5, Math.max(0, until - Date.now()));
       timer.unref?.();
-      signal.addEventListener("abort", done4, { once: true });
+      signal.addEventListener("abort", done5, { once: true });
     });
   }
 };
@@ -8421,12 +8567,12 @@ var Budget = class {
     while (this.free < n) {
       signal.throwIfAborted();
       await new Promise((resolve2) => {
-        const done4 = () => {
-          signal.removeEventListener("abort", done4);
+        const done5 = () => {
+          signal.removeEventListener("abort", done5);
           resolve2();
         };
-        this.waiters.push(done4);
-        signal.addEventListener("abort", done4, { once: true });
+        this.waiters.push(done5);
+        signal.addEventListener("abort", done5, { once: true });
       });
     }
     this.free -= n;
@@ -8565,9 +8711,9 @@ async function watchHangup(conn, abort, until) {
   }
 }
 var BODILESS_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
-async function* drain(body, done4) {
+async function* drain(body, done5) {
   yield* body;
-  done4();
+  done5();
 }
 function untilAborted(response, signal) {
   return new Promise((resolve2, reject) => {
@@ -8659,11 +8805,11 @@ var RealmProxy = class {
           this.slots.release(1);
           break;
         }
-        const done4 = this.serve(conn).finally(() => {
+        const done5 = this.serve(conn).finally(() => {
           this.slots.release(1);
-          served2.delete(done4);
+          served2.delete(done5);
         });
-        served2.add(done4);
+        served2.add(done5);
       }
     } catch {
     }
@@ -8913,8 +9059,8 @@ var RealmProxy = class {
       chain2 = chain2.then(() => ctx.sink.write(bytes, stop));
       return chain2;
     };
-    const done4 = new AbortController();
-    const reading = AbortSignal.any([stop, done4.signal, hangup]);
+    const done5 = new AbortController();
+    const reading = AbortSignal.any([stop, done5.signal, hangup]);
     const stopping = () => socket.close(1001, "the proxy is stopping");
     stop.addEventListener("abort", stopping, { once: true });
     let guestDone = false;
@@ -8931,10 +9077,10 @@ var RealmProxy = class {
       if (guestDone) return;
       closeSent = true;
       await toGuest(closeFrame(wireCode(closed.code), closed.reason));
-      AbortSignal.timeout(this.limits.closeWaitMs).addEventListener("abort", () => done4.abort(), {
+      AbortSignal.timeout(this.limits.closeWaitMs).addEventListener("abort", () => done5.abort(), {
         once: true
       });
-    })().catch(() => done4.abort());
+    })().catch(() => done5.abort());
     const reader = new WsReader(ctx.incoming, MESSAGE_LIMIT, true);
     try {
       for (; ; ) {
@@ -9498,6 +9644,7 @@ function withCommandDirs(fs, names2, userDir = async () => void 0, owners = fals
     ...fs.realpath ? { realpath: fs.realpath.bind(fs) } : {},
     ...fs.chown ? { chown: fs.chown.bind(fs) } : {},
     ...fs.createExclusive ? { createExclusive: fs.createExclusive.bind(fs) } : {},
+    ...fs.copyFile ? { copyFile: fs.copyFile.bind(fs) } : {},
     ...fs.ancestry ? { ancestry: fs.ancestry.bind(fs) } : {},
     ...fs.hasOwner ? { hasOwner: fs.hasOwner.bind(fs) } : {},
     chmod: (path, mode) => fs.chmod(path, mode),
@@ -9790,13 +9937,13 @@ var FsWatchers = class {
       next: async (signal) => {
         while (watch.notes.length === 0 && !watch.ended && !signal.aborted) {
           await new Promise((resolve2) => {
-            const done4 = () => {
+            const done5 = () => {
               watch.wake = void 0;
-              signal.removeEventListener("abort", done4);
+              signal.removeEventListener("abort", done5);
               resolve2();
             };
-            watch.wake = done4;
-            signal.addEventListener("abort", done4, { once: true });
+            watch.wake = done5;
+            signal.addEventListener("abort", done5, { once: true });
           });
         }
         const notes = watch.notes.splice(0);
@@ -9847,14 +9994,14 @@ var FsWatchers = class {
   }
   wrap(fs) {
     const after = (run2, changed, type) => async (...args) => {
-      let done4 = false;
+      let done5 = false;
       try {
         await run2(...args);
-        done4 = true;
+        done5 = true;
       } finally {
         const paths = changed(...args);
         this.report(paths);
-        if (done4) this.emit(type, paths);
+        if (done5) this.emit(type, paths);
       }
     };
     const reals = this.reals;
@@ -9876,15 +10023,15 @@ var FsWatchers = class {
     const content = (run2, types) => async (...args) => {
       const at = normalizePath(args[0]);
       const fresh2 = this.covers(at) && !await fs.exists(at).catch(() => true);
-      let done4 = false;
+      let done5 = false;
       try {
         await run2(...args);
-        done4 = true;
+        done5 = true;
       } finally {
         const real = await realOf(at);
         const paths = real === at ? [at] : [at, real];
         this.report(paths);
-        if (done4) for (const type of types(fresh2)) this.emit(type, paths);
+        if (done5) for (const type of types(fresh2)) this.emit(type, paths);
       }
     };
     const written2 = (fresh2) => fresh2 ? ["rename", "change"] : ["change"];
@@ -9899,6 +10046,12 @@ var FsWatchers = class {
     const overrides = {
       writeFile: content(fs.writeFile.bind(fs), written2),
       ...fs.createExclusive ? { createExclusive: content(fs.createExclusive.bind(fs), () => ["rename"]) } : {},
+      ...fs.copyFile ? {
+        copyFile: (from, to, options) => content(
+          (_to) => fs.copyFile?.(from, to, options),
+          written2
+        )(to)
+      } : {},
       mkdir: async (path, options) => {
         const created4 = [];
         if (options?.recursive) {
@@ -9909,13 +10062,13 @@ var FsWatchers = class {
           }
         }
         const fresh2 = !options?.recursive || this.typed.size > 0 && !await fs.exists(path);
-        let done4 = false;
+        let done5 = false;
         try {
           await fs.mkdir(path, options);
-          done4 = true;
+          done5 = true;
         } finally {
           this.report([...created4, path]);
-          if (done4) this.emit("rename", fresh2 ? [...created4, path] : created4);
+          if (done5) this.emit("rename", fresh2 ? [...created4, path] : created4);
         }
       },
       rm: reshaping(after(fs.rm.bind(fs), (path) => [path], "rename")),
@@ -10121,8 +10274,8 @@ var ChildTable = class {
       for (; ; ) {
         const candidates = this.candidates(pid, flags2);
         if (candidates.length === 0) throw new KernelError("ECHILD");
-        const done4 = candidates.find(([, child]) => child.code !== void 0);
-        if (done4) return this.reap(done4[0], done4[1].code);
+        const done5 = candidates.find(([, child]) => child.code !== void 0);
+        if (done5) return this.reap(done5[0], done5[1].code);
         const changed = this.stateReport(candidates, flags2);
         if (changed) return changed;
         if (nohang) return [0, 0];
@@ -10518,7 +10671,7 @@ var FifoTable = class {
   }
   end(key, path, fifo, reads, writes) {
     const { pipe } = fifo;
-    let open = true;
+    let open2 = true;
     return new OpenFile({
       fifo: path,
       identity: fifo,
@@ -10541,8 +10694,8 @@ var FifoTable = class {
         }
       } : {},
       close: () => {
-        if (!open) return;
-        open = false;
+        if (!open2) return;
+        open2 = false;
         this.release(key, fifo, reads, writes);
       },
       poll: () => ({
@@ -10556,6 +10709,33 @@ var FifoTable = class {
   }
 };
 
+// src/fs/copy.ts
+async function present2(fs, path) {
+  return fs.lstat(path).then(
+    () => true,
+    (err) => {
+      if (err?.code === "ENOENT") return false;
+      throw err;
+    }
+  );
+}
+async function copyByBytes(fs, from, to, options) {
+  if (!(await fs.stat(from)).isFile) throw fsError("EINVAL", `${from}: not a regular file`);
+  const bytes = await fs.readFileBuffer(from);
+  let created4 = false;
+  if (options.exclusive) {
+    if (fs.createExclusive) await fs.createExclusive(to, options.owner);
+    else if (await present2(fs, to)) throw fsError("EEXIST", to);
+    created4 = true;
+  } else created4 = !await present2(fs, to);
+  try {
+    await fs.writeFile(to, bytes, options.owner);
+  } catch (err) {
+    if (created4) await fs.rm(to, { file: true }).catch(() => void 0);
+    throw err;
+  }
+}
+
 // src/mount/protocol.ts
 var DRIVER_PROTOCOL = [1, 3];
 function driverVersionError(theirs) {
@@ -10789,8 +10969,8 @@ var HeldPaths = class extends Map {
     for (const file of [...this.uses.keys()]) this.letGo(file, true);
     this.keptHandles.clear();
   }
-  hold(path, on, open = false, real, handle) {
-    if (open) return this.holdOpen(path, on, real, handle);
+  hold(path, on, open2 = false, real, handle) {
+    if (open2) return this.holdOpen(path, on, real, handle);
     this.holdWrite(path, on);
     return void 0;
   }
@@ -10939,12 +11119,12 @@ var MountTable = class {
   }
   list() {
     const mounted = [...this.mounts.values()].map(
-      ({ type, source, target, options, state, error, present: present3 }) => ({
+      ({ type, source, target, options, state, error, present: present4 }) => ({
         type,
         source,
         target,
         options: { ...options },
-        state: state === "ok" && present3?.() === false ? "nomedium" : state,
+        state: state === "ok" && present4?.() === false ? "nomedium" : state,
         ...error ? { error } : {}
       })
     );
@@ -11081,7 +11261,7 @@ var MountTable = class {
   session(mount, real, rel2) {
     let session = this.sessions.get(real);
     if (!session) {
-      const open = () => mount.conn.call({
+      const open2 = () => mount.conn.call({
         op: "open",
         path: rel2,
         write: true,
@@ -11090,7 +11270,7 @@ var MountTable = class {
         exclusive: false
       });
       const before = this.committing.get(real)?.done ?? Promise.resolve();
-      const fh = before.then(open, open);
+      const fh = before.then(open2, open2);
       session = { mount, fh, extents: [], truncated: false };
       this.sessions.set(real, session);
       fh.catch(() => this.sessions.delete(real));
@@ -11105,20 +11285,20 @@ var MountTable = class {
     if (!session) return this.committing.get(real)?.done;
     this.sessions.delete(real);
     session.mount.epoch++;
-    const done4 = (async () => {
+    const done5 = (async () => {
       try {
         await session.mount.conn.call({ op: "release", fh: await session.fh });
       } finally {
         this.forget(session.mount, real);
       }
     })();
-    const entry = { mount: session.mount, done: done4 };
+    const entry = { mount: session.mount, done: done5 };
     this.committing.set(real, entry);
     const settle3 = () => {
       if (this.committing.get(real) === entry) this.committing.delete(real);
     };
-    done4.then(settle3, settle3);
-    return done4;
+    done5.then(settle3, settle3);
+    return done5;
   }
   async commitUnder(prefix) {
     const at = normalizePath(prefix);
@@ -11292,8 +11472,8 @@ var MountFs = class _MountFs {
   }
   async across(from, to, redirects) {
     const moved2 = [await this.through(from), await this.through(to)];
-    const same = moved2[0] === normalizePath(from) && moved2[1] === normalizePath(to);
-    if (same || redirects >= MAX_LINKS7) throw errnoError("EXDEV", `${from} -> ${to}`);
+    const same2 = moved2[0] === normalizePath(from) && moved2[1] === normalizePath(to);
+    if (same2 || redirects >= MAX_LINKS7) throw errnoError("EXDEV", `${from} -> ${to}`);
     return moved2;
   }
   async based(paths, redirects, run2, again) {
@@ -11619,6 +11799,23 @@ var MountFs = class _MountFs {
       throw err;
     }
   }
+  async copyFile(from, to, options, redirects = 0) {
+    const source = await realTarget(this, normalizePath(from));
+    const a = this.at(source);
+    const b = this.at(to);
+    const copy = this.base.copyFile?.bind(this.base);
+    if (!a && !b && copy) {
+      return this.based(
+        [source, to],
+        redirects,
+        () => copy(source, to, options),
+        ([f, t], n) => this.copyFile(f, t, options, n)
+      );
+    }
+    if (a?.mount !== b?.mount) throw errnoError("EXDEV", `${from} -> ${to}`);
+    if (a) this.writable(a.mount, normalizePath(to));
+    return copyByBytes(this, source, to, options);
+  }
   async createExclusive(path, owner, redirects = 0) {
     const exclusive = this.base.createExclusive?.bind(this.base);
     if (!this.at(path) && exclusive) {
@@ -12046,6 +12243,7 @@ var SYNC_FS_OPS = [
   "rm",
   "rename",
   "link",
+  "copy",
   "unlink",
   "rmdir",
   "symlink",
@@ -12123,7 +12321,7 @@ async function storageUsage() {
   return { quota: estimate.quota, usage: estimate.usage ?? 0 };
 }
 var PLAIN_DIR_MODE = 493;
-var done = { ok: true, kind: "void" };
+var done2 = { ok: true, kind: "void" };
 function json2(value2) {
   return { ok: true, kind: "json", json: value2 };
 }
@@ -12168,14 +12366,14 @@ async function chown(entry, path, req) {
   const cred = entry.cred?.();
   if (!cred) {
     await (req.op === "chown" ? entry.fs.stat(real) : entry.fs.lstat(real));
-    return done;
+    return done2;
   }
   await chownAs(entry.fs, cred, real, {
     ...req.uid !== void 0 ? { uid: req.uid } : {},
     ...req.gid !== void 0 ? { gid: req.gid } : {},
     follow: req.op === "chown"
   });
-  return done;
+  return done2;
 }
 async function runMkdir(entry, path, req) {
   const { fs } = entry;
@@ -12186,7 +12384,7 @@ async function runMkdir(entry, path, req) {
   await (req.exclusive ? mkdirExclusive(entry, path, req.mode) : fs.mkdir(path, mkdirOptions(entry, req.mode)));
   await fixParents?.();
   if (fresh2) await fs.chmod(path, plain2);
-  return done;
+  return done2;
 }
 async function shownAs(entry, path, st) {
   const real = st.isFile && st.size === 0 ? entry.fs.realpath?.(path, true) : void 0;
@@ -12203,7 +12401,7 @@ async function run(entry, path, req) {
       return { ok: true, kind: "bytes", bytes: await readSource(entry, path) };
     case "write":
       await fs.writeFile(path, req.body ?? new Uint8Array(0), ownerFor2(entry, 438));
-      return done;
+      return done2;
     case "exists":
       return json2(await fs.exists(path));
     case "stat": {
@@ -12224,51 +12422,53 @@ async function run(entry, path, req) {
       return runMkdir(entry, path, req);
     case "rm":
       await fs.rm(path, { recursive: true });
-      return done;
+      return done2;
     case "rename": {
       const to = fs.resolvePath(cwd, req.arg2 ?? "");
       await fs.rename(path, to);
       entry.renamed?.(path, to);
-      return done;
+      return done2;
     }
     case "link":
       await fs.link(path, fs.resolvePath(cwd, req.arg2 ?? ""), req.mode === 1);
-      return done;
+      return done2;
     case "unlink":
       await fs.rm(path, { file: true });
-      return done;
+      return done2;
     case "rmdir":
       if (!(await fs.lstat(path)).isDirectory) throw syncError("ENOTDIR", path);
       if ((await fs.readdir(path)).length > 0) throw syncError("ENOTEMPTY", path);
       await fs.rm(path, { recursive: true });
-      return done;
+      return done2;
     case "symlink":
       await fs.symlink(req.arg2 ?? "", path, ownerFor2(entry));
-      return done;
+      return done2;
+    case "copy":
+      return copyOp(entry, path, req);
     case "mkfifo": {
       const owner = ownerFor2(entry, req.mode ?? 438) ?? { uid: 0, gid: 0 };
       await createExclusive(fs, path, { ...owner, fifo: true });
       entry.fresh?.(path);
-      return done;
+      return done2;
     }
     case "create":
       await createExclusive(fs, path, ownerFor2(entry, req.mode ?? 438));
       if (req.opening) entry.created?.add(path);
       entry.fresh?.(path);
-      return done;
+      return done2;
     case "readlink":
       return json2(await fs.readlink(path));
     case "chmod": {
       const g = guardOf(entry);
       await fs.chmod(path, g ? await chmodMode(g, path, req.mode ?? 0) : req.mode ?? 0);
-      return done;
+      return done2;
     }
     case "utimes":
       await fs.utimes(path, ...await timesOf(entry, path, req));
-      return done;
+      return done2;
     case "lutimes":
       await lutimesOf(fs, path, ...await timesOf(entry, path, req));
-      return done;
+      return done2;
     case "chown":
     case "lchown":
       return chown(entry, path, req);
@@ -12351,6 +12551,16 @@ async function guard(g, path, req, cwd) {
       const toWalked = await walkSafe(g, to, false);
       return { path: fromWalked, arg2: toWalked };
     }
+    case "copy": {
+      const to = other();
+      await readable(g, op, path);
+      const there = !req.exclusive && await g.fs.lstat(to).then(
+        () => true,
+        () => false
+      );
+      await (there ? writable(g, op, to) : inParent(g, op, to));
+      return { path: await walkSafe(g, path, true), arg2: await walkSafe(g, to, false) };
+    }
     case "link": {
       const to = other();
       const follow2 = req.mode === 1;
@@ -12397,8 +12607,8 @@ async function stillThere(entry, path, req) {
 }
 async function holdOp(entry, path, req) {
   const mode = req.mode ?? 0;
-  const [on, open] = [(mode & 1) === 1, (mode & 2) === 2];
-  if (on && open) {
+  const [on, open2] = [(mode & 1) === 1, (mode & 2) === 2];
+  if (on && open2) {
     for (; ; ) {
       const r = entry.replacements;
       await r?.settled(path);
@@ -12408,26 +12618,26 @@ async function holdOp(entry, path, req) {
       await entry.source?.open(path, real);
       await stillThere(entry, path, req);
       if (!r || !r.missed(path) && !r.changedSince(path, gen))
-        return json2(entry.hold?.(path, on, open, real) ?? null);
+        return json2(entry.hold?.(path, on, open2, real) ?? null);
     }
   }
-  entry.hold?.(path, on, open, void 0, req.handle);
-  return done;
+  entry.hold?.(path, on, open2, void 0, req.handle);
+  return done2;
 }
 async function followed(g, path) {
   const st = await g.fs.lstat(path).catch(() => void 0);
   if (st?.isSymbolicLink && !trustedLink(permOf(st), g.links)) deny(g, "follow", path);
-  return done;
+  return done2;
 }
 async function accessOp(entry, path, req) {
   const g = guardOf(entry);
-  if (!g) return done;
+  if (!g) return done2;
   if (req.arg2 === "follow") return followed(g, path);
-  const open = req.arg2 === "open";
-  const cred = open || req.arg2 === "eaccess" ? g.cred : realIds(g.cred);
-  const options = { follow: req.nofollow !== true, ...open ? { directory: false } : {} };
-  await need({ ...g, cred }, open ? "open" : "access", path, req.mode ?? 0, options);
-  return done;
+  const open2 = req.arg2 === "open";
+  const cred = open2 || req.arg2 === "eaccess" ? g.cred : realIds(g.cred);
+  const options = { follow: req.nofollow !== true, ...open2 ? { directory: false } : {} };
+  await need({ ...g, cred }, open2 ? "open" : "access", path, req.mode ?? 0, options);
+  return done2;
 }
 var CHANGING = /* @__PURE__ */ new Set([
   "mkdir",
@@ -12451,6 +12661,9 @@ async function mayChange(entry, path, req) {
   const { mayChange: mayChange2 } = entry.fs;
   if (!mayChange2) return;
   const { op } = req;
+  if (op === "copy") {
+    return mayChange2.call(entry.fs, entry.fs.resolvePath(entry.cwd, req.arg2 ?? ""), false);
+  }
   if (CONTENT.has(op) && req.handle === void 0) return mayChange2.call(entry.fs, path, true);
   if (!CHANGING.has(op)) return;
   const follow2 = op === "utimes" || op === "chmod" || op === "chown";
@@ -12474,6 +12687,17 @@ async function guarded(entry, path, req) {
     return { refused: refused3 };
   }
 }
+async function copyOp(entry, path, req) {
+  const { fs, cwd } = entry;
+  const to = fs.resolvePath(cwd, req.arg2 ?? "");
+  const mode = (req.mode ?? 438) & 4095 & ~(entry.umask?.() ?? 18);
+  const owner = ownerFor2(entry, mode);
+  const options = { exclusive: req.exclusive === true, ...owner ? { owner } : {} };
+  await (fs.copyFile ? fs.copyFile(path, to, options) : copyByBytes(fs, path, to, options));
+  if (!owner) await fs.chmod(to, mode);
+  entry.fresh?.(to);
+  return done2;
+}
 async function createExclusive(fs, path, owner) {
   if (fs.createExclusive) return fs.createExclusive(path, owner);
   if (await fs.lstat(path).then(
@@ -12519,7 +12743,7 @@ async function ranged(fs, path, req) {
     };
   if (req.op === "pwrite") await ops.pwrite(path, offset, req.body ?? new Uint8Array(0), true);
   else await ops.truncate(path, req.length ?? 0);
-  return done;
+  return done2;
 }
 var CHOWN_OPS = /* @__PURE__ */ new Set(["chown", "lchown"]);
 var UNLINKED_OPS = /* @__PURE__ */ new Set(["read", "pread", "pwrite", "append", "truncate"]);
@@ -12648,7 +12872,7 @@ var CREATIONS = /* @__PURE__ */ new Set([
   "create",
   "mkfifo"
 ]);
-var NAMING = /* @__PURE__ */ new Set(["link", "rename"]);
+var NAMING = /* @__PURE__ */ new Set(["link", "rename", "copy"]);
 async function newDevName(entry, path, req) {
   const named = NAMING.has(req.op);
   if (!named && !CREATIONS.has(req.op)) return void 0;
@@ -12960,10 +13184,10 @@ var CpuClock = class {
   }
   times() {
     const now = this.frozen ?? this.now();
-    const open = this.since === 0 ? 0 : Math.max(0, now - this.since);
-    const busy = this.kind === "sys" ? Math.min(open, SYS_CAP_US) : 0;
+    const open2 = this.since === 0 ? 0 : Math.max(0, now - this.since);
+    const busy = this.kind === "sys" ? Math.min(open2, SYS_CAP_US) : 0;
     const sys = this.sys + busy;
-    const idle2 = this.idle + (open - busy) + localIdle(this.sab, now).idle;
+    const idle2 = this.idle + (open2 - busy) + localIdle(this.sab, now).idle;
     const user = Math.max(0, now - this.start - sys - idle2);
     this.last = {
       utime: Math.max(this.last.utime, Math.floor(user / 1e3)),
@@ -13120,19 +13344,19 @@ var Pages = class {
     return Math.max(0, end - at);
   }
   write(at, bytes) {
-    for (let done4 = 0; done4 < bytes.length; ) {
-      const pos = at + done4;
+    for (let done5 = 0; done5 < bytes.length; ) {
+      const pos = at + done5;
       const page = Math.floor(pos / PAGE);
       const from = pos - page * PAGE;
-      const n = Math.min(PAGE - from, bytes.length - done4);
+      const n = Math.min(PAGE - from, bytes.length - done5);
       let target = this.pages.get(page);
       if (!target) {
         target = this.take(0);
         this.pages.set(page, target);
       }
-      target.set(bytes.subarray(done4, done4 + n), from);
+      target.set(bytes.subarray(done5, done5 + n), from);
       this.dirty.add(page);
-      done4 += n;
+      done5 += n;
     }
     this.length = Math.max(this.length, at + bytes.length);
   }
@@ -13209,10 +13433,10 @@ var Pages = class {
       clean -= PAGE;
     }
   }
-  take(used) {
+  take(used2) {
     const page = this.free.pop();
     if (!page) return new Uint8Array(PAGE);
-    page.fill(0, used);
+    page.fill(0, used2);
     return page;
   }
   drop(page) {
@@ -13454,9 +13678,9 @@ function pidFile(name2, info, boot) {
   }
   return pidStatus(info);
 }
-function memoryInfo(source, used = 0) {
+function memoryInfo(source, used2 = 0) {
   const total = source.deviceMemory ? source.deviceMemory * KIB * KIB * KIB : FALLBACK_MEMORY;
-  const free = Math.max(0, total - used - (source.usedHeap ?? 0));
+  const free = Math.max(0, total - used2 - (source.usedHeap ?? 0));
   const kb = (bytes) => `${Math.floor(bytes / KIB)} kB`;
   return [
     ["MemTotal", kb(total)],
@@ -13509,10 +13733,10 @@ function memorySource(scope = globalThis) {
   const nav = scope.navigator;
   const perf = scope.performance;
   const deviceMemory = nav?.deviceMemory;
-  const used = perf?.memory?.usedJSHeapSize;
+  const used2 = perf?.memory?.usedJSHeapSize;
   return {
     ...typeof deviceMemory === "number" && deviceMemory > 0 ? { deviceMemory } : {},
-    ...typeof used === "number" ? { usedHeap: used } : {}
+    ...typeof used2 === "number" ? { usedHeap: used2 } : {}
   };
 }
 
@@ -13681,7 +13905,7 @@ var ProcTree = class {
 };
 var MAX_HOPS3 = 40;
 function* procWalk(path, follow2) {
-  let done4 = [];
+  let done5 = [];
   let todo = path.split("/").filter((part) => part !== "");
   let hops = 0;
   let broken;
@@ -13689,20 +13913,20 @@ function* procWalk(path, follow2) {
     const part = todo.shift();
     if (part === ".") continue;
     if (part === "..") {
-      done4.pop();
+      done5.pop();
       continue;
     }
-    const at = `/${[...done4, part].join("/")}`;
-    const whole = normalize(`/${[...done4, part, ...todo].join("/")}`);
+    const at = `/${[...done5, part].join("/")}`;
+    const whole = normalize(`/${[...done5, part, ...todo].join("/")}`);
     if (inProc(at) && inProc(whole)) return broken ?? whole;
     if (!follow2 && todo.length === 0) return void 0;
     const target = yield { at, check: todo.find((next3) => next3 !== ".") === ".." };
     if (typeof target === "string") {
       if (++hops > MAX_HOPS3) return void 0;
-      [done4, todo] = throughLink(target, done4, todo);
+      [done5, todo] = throughLink(target, done5, todo);
     } else {
       broken ??= refusalOf(target);
-      done4.push(part);
+      done5.push(part);
     }
   }
   return void 0;
@@ -13715,9 +13939,9 @@ function refusalOf(found) {
   if (found === true) return void 0;
   return found === false ? { refused: "ENOTDIR" } : found;
 }
-function throughLink(target, done4, todo) {
+function throughLink(target, done5, todo) {
   const parts2 = target.split("/").filter((part) => part !== "");
-  return [target.startsWith("/") ? [] : done4, [...parts2, ...todo]];
+  return [target.startsWith("/") ? [] : done5, [...parts2, ...todo]];
 }
 async function procAlias(fs, path, follow2) {
   const { readlink, lstat } = fs;
@@ -13914,16 +14138,16 @@ var EpollFile = class _EpollFile {
   changes = new Notifier();
   cursor = 0;
   ctl(fds, how, fd, events, data) {
-    const open = fds.get(fd);
-    if (open.file === this) throw new KernelError("EINVAL");
+    const open2 = fds.get(fd);
+    if (open2.file === this) throw new KernelError("EINVAL");
     const known = this.regs.get(fd);
-    const current = known?.open === open ? known : void 0;
+    const current = known?.open === open2 ? known : void 0;
     if (how === "add" || how === "set" && !current) {
       if (current) throw new KernelError("EEXIST");
-      if (UNPOLLABLE.has(kernelFdKind(open.file))) throw new KernelError("EPERM");
-      if (open.file instanceof _EpollFile && open.file.reaches(this)) throw new KernelError("ELOOP");
+      if (UNPOLLABLE.has(kernelFdKind(open2.file))) throw new KernelError("EPERM");
+      if (open2.file instanceof _EpollFile && open2.file.reaches(this)) throw new KernelError("ELOOP");
       if (known) this.drop(known);
-      this.register(fd, open, events, data);
+      this.register(fd, open2, events, data);
     } else if (!current) {
       throw new KernelError("ENOENT");
     } else if (how === "del") {
@@ -13990,15 +14214,15 @@ var EpollFile = class _EpollFile {
     for (const reg of [...this.regs.values()]) this.drop(reg);
     this.changes.wake();
   }
-  register(fd, open, events, data) {
+  register(fd, open2, events, data) {
     const stop = new AbortController();
-    const unhook = open.onClose(() => {
+    const unhook = open2.onClose(() => {
       this.drop(reg);
       this.changes.wake();
     });
     const reg = {
       fd,
-      open,
+      open: open2,
       events,
       data,
       gen: 1,
@@ -14079,17 +14303,17 @@ function changedAt(wakers, key, signal) {
   return new Promise((resolve2, reject) => {
     const set3 = wakers.get(key) ?? /* @__PURE__ */ new Set();
     wakers.set(key, set3);
-    const done4 = () => {
+    const done5 = () => {
       set3.delete(wake);
       if (set3.size === 0 && wakers.get(key) === set3) wakers.delete(key);
       signal.removeEventListener("abort", abort);
     };
     const wake = () => {
-      done4();
+      done5();
       resolve2();
     };
     const abort = () => {
-      done4();
+      done5();
       reject(new KernelError("EINTR"));
     };
     set3.add(wake);
@@ -14297,7 +14521,7 @@ var HOST_OPS = [
   "async-close"
 ];
 var json3 = (value2) => ({ ok: true, kind: "json", json: value2 });
-var done2 = { ok: true, kind: "void" };
+var done3 = { ok: true, kind: "void" };
 var KEPT_OPS = /* @__PURE__ */ new Set(["fd-write"]);
 var unknownSettled = false;
 var AsyncOps = class {
@@ -14434,7 +14658,7 @@ async function hostSyscall(req, ctx) {
       if (req.fd !== void 0 && ctx.locks?.shared?.() && ctx.flockOf) {
         return flock({ op: "flock", fd: req.fd, kind: "unlock" }, ctx);
       }
-      return done2;
+      return done3;
     case "lk-set":
     case "lk-get":
     case "lk-close":
@@ -14455,12 +14679,12 @@ async function hostSyscall(req, ctx) {
       return json3(ctx.ops.hold());
     case "async-cancel":
       ctx.ops.cancel(req.id);
-      return done2;
+      return done3;
     case "async-settle":
       return json3(await ctx.ops.settle(req.ids));
     case "async-close":
       ctx.ops.close();
-      return done2;
+      return done3;
   }
 }
 async function wholeLock(req, ctx) {
@@ -14478,7 +14702,7 @@ async function wholeLock(req, ctx) {
     if (!locks.flockFree(key, owner, kind)) throw new KernelError("EAGAIN");
   }
   if (!locks.lock(ctx.pid, req.path, req.exclusive, req.fd)) throw new KernelError("EAGAIN");
-  return done2;
+  return done3;
 }
 var FLOCK_KINDS = /* @__PURE__ */ new Set(["shared", "exclusive", "unlock"]);
 async function flock(req, ctx) {
@@ -14493,7 +14717,7 @@ async function flock(req, ctx) {
     await locks.flocks.wait(key, owner, req.kind, ctx.blocking);
   else if (!await locks.flocks.set(key, owner, req.kind)) throw new KernelError("EAGAIN");
   if (shared && granted2) await grantedAcross(ctx, req.fd);
-  return shared ? json3(true) : done2;
+  return shared ? json3(true) : done3;
 }
 async function grantedAcross(ctx, fd) {
   ctx.locks?.fresh?.();
@@ -14510,7 +14734,7 @@ async function recordLock2(req, ctx) {
   if (req.op === "lk-close") {
     if (req.fd !== void 0 && locks.shared?.()) await ctx.settle?.(req.fd, false);
     locks.dropFile(await fileKey(target, "close"), owner);
-    return done2;
+    return done3;
   }
   const range2 = lockRange(req.start, req.len);
   const key = await fileKey(target, req.kind, req.op === "lk-set" && req.fd !== void 0);
@@ -14529,7 +14753,7 @@ async function recordLock2(req, ctx) {
   else if (!await locks.set(key, owner, req.kind, range2.start, range2.end))
     throw new KernelError("EAGAIN");
   if (granted2 && shared) await grantedAcross(ctx, fd);
-  return shared ? json3(true) : done2;
+  return shared ? json3(true) : done3;
 }
 
 // src/kernel/net/loopback-transport.ts
@@ -15081,7 +15305,7 @@ var CA_RENEW_BEFORE = 30 * DAY;
 var LEAF_LIFETIME = 7 * DAY;
 var ECDSA = { name: "ECDSA", namedCurve: "P-256" };
 var SIGN = { name: "ECDSA", hash: "SHA-256" };
-function request(req) {
+function request2(req) {
   return new Promise((resolve2, reject) => {
     req.onsuccess = () => resolve2(req.result);
     req.onerror = () => reject(req.error);
@@ -15089,7 +15313,7 @@ function request(req) {
 }
 function indexedDbCaStore(dbName = "slicc-realm-ca") {
   let db;
-  const open = () => {
+  const open2 = () => {
     db ??= new Promise((resolve2, reject) => {
       const req = indexedDB.open(dbName, 1);
       req.onupgradeneeded = () => req.result.createObjectStore("ca");
@@ -15103,11 +15327,11 @@ function indexedDbCaStore(dbName = "slicc-realm-ca") {
   };
   return {
     async get(owner) {
-      const store = (await open()).transaction("ca").objectStore("ca");
-      return await request(store.get(owner));
+      const store = (await open2()).transaction("ca").objectStore("ca");
+      return await request2(store.get(owner));
     },
     async swap(owner, expected, record) {
-      const tx = (await open()).transaction("ca", "readwrite");
+      const tx = (await open2()).transaction("ca", "readwrite");
       const store = tx.objectStore("ca");
       let stored = record;
       const read = store.get(owner);
@@ -15810,7 +16034,7 @@ var WsHandles = class {
   async connect(handle, req, entry) {
     const { transport, local } = this;
     const port = local?.port(req.url);
-    const open = { protocols: req.protocols, headers: req.headers, signal: entry.abort.signal };
+    const open2 = { protocols: req.protocols, headers: req.headers, signal: entry.abort.signal };
     if (port === void 0 && (!transport.traits.websocket || !transport.websocket)) {
       return fail("ENOTSUP", NO_WEBSOCKET2);
     }
@@ -15818,8 +16042,8 @@ var WsHandles = class {
     try {
       socket = port === void 0 ? await transport.websocket({
         url: toHostLoopback(req.url),
-        ...open
-      }) : await local.websocket({ url: req.url, ...open }, port);
+        ...open2
+      }) : await local.websocket({ url: req.url, ...open2 }, port);
     } catch (e) {
       return fail(errnoOf(e), message(e));
     }
@@ -16022,14 +16246,14 @@ var HttpHandles = class {
     const port = this.local?.port(req.url);
     try {
       const target = port === void 0 ? toHostLoopback(req.url) : req.url;
-      const request2 = {
+      const request3 = {
         url: target,
         method: req.method,
         headers: req.headers,
         ...entry.upload ? { bodyStream: entry.upload } : req.body ? { body: req.body } : {},
         signal: entry.abort.signal
       };
-      const response = port === void 0 ? await this.transport.fetch(request2, this.owner) : await this.local.fetch(request2, port);
+      const response = port === void 0 ? await this.transport.fetch(request3, this.owner) : await this.local.fetch(request3, port);
       entry.body = response.body[Symbol.asyncIterator]();
       entry.cancel = () => response.cancel();
       if (!this.open.has(handle)) await entry.cancel().catch(() => void 0);
@@ -16181,10 +16405,10 @@ var RemoteUplink = class {
       write: async (bytes) => {
         const copy = bytes.slice();
         const call = { uplink: "write", uid: ++this.nextId, cid, bytes: copy };
-        const done4 = await this.ask(call, void 0, [
+        const done5 = await this.ask(call, void 0, [
           copy.buffer
         ]);
-        return done4.n;
+        return done5.n;
       },
       closeWrite: () => this.port.postMessage({ uplink: "close-write", cid }),
       close: () => this.port.postMessage({ uplink: "close", cid })
@@ -16791,7 +17015,7 @@ function terminalOf(ctx, fd) {
   return tty;
 }
 var json4 = (value2) => ({ ok: true, kind: "json", json: value2 });
-var done3 = { ok: true, kind: "void" };
+var done4 = { ok: true, kind: "void" };
 function sizeKey(rows, cols) {
   return `${rows}x${cols}`;
 }
@@ -16814,23 +17038,23 @@ function ptySyscall(req, ctx) {
       return json4(masterOf(ctx, req.fd).index);
     case "pty-lock":
       masterOf(ctx, req.fd).locked = req.lock;
-      return done3;
+      return done4;
     case "pty-ctty": {
       const tty = terminalOf(ctx, req.fd);
       const leader = ctx.jobs?.getsid(ctx.pid, 0) === ctx.pid;
-      if (leader && ctx.jobs?.controllingTerminal(ctx.pid) === tty) return done3;
+      if (leader && ctx.jobs?.controllingTerminal(ctx.pid) === tty) return done4;
       if (!ctx.jobs?.acquireTerminal(ctx.pid, tty)) throw new KernelError("EPERM");
-      return done3;
+      return done4;
     }
     case "pty-list":
       return json4(ctx.ptys?.numbers() ?? []);
     case "pty-packet":
       masterOf(ctx, req.fd).packet = req.on;
-      return done3;
+      return done4;
     case "pty-winsz-set": {
       const tty = terminalOf(ctx, req.fd);
       if (ctx.sizesRead?.get(tty) !== sizeKey(req.rows, req.cols)) tty.resize(req.cols, req.rows);
-      return done3;
+      return done4;
     }
   }
 }
@@ -16917,8 +17141,8 @@ async function runChild(req, deps) {
   let status;
   try {
     status = await reaped(deps, pid);
-    const open = controls2.filter((c) => c.opened);
-    await Promise.race([Promise.all(open.map((c) => c.eof)), decided.promise]);
+    const open2 = controls2.filter((c) => c.opened);
+    await Promise.race([Promise.all(open2.map((c) => c.eof)), decided.promise]);
   } finally {
     cancel?.();
     for (const control of controls2) control.shut = true;
@@ -17196,7 +17420,7 @@ function filePath(addr) {
   if (addr.family !== "unix" || addr.path === "" || addr.path.startsWith("\0")) return void 0;
   return normalizePath(addr.path);
 }
-function nameOf(st) {
+function nameOf2(st) {
   return { key: `${st.dev ?? 0}:${st.ino}`, typed: st.isSocket === true };
 }
 function codeOf3(err) {
@@ -17218,7 +17442,7 @@ function socketNames(deps) {
       const remove = () => fs.rm(path, { file: true }).catch(() => void 0);
       try {
         if (!deps.owners && owner.mode !== void 0) await fs.chmod(path, owner.mode);
-        return { ...nameOf(await fs.lstat(path)), remove };
+        return { ...nameOf2(await fs.lstat(path)), remove };
       } catch (err) {
         await remove();
         throw err;
@@ -17227,7 +17451,7 @@ function socketNames(deps) {
     async find(path) {
       const g = deps.guard();
       if (g) await need(g, "connect", path, W_OK, { directory: false });
-      return nameOf(await fs.stat(path));
+      return nameOf2(await fs.stat(path));
     }
   };
 }
@@ -18043,17 +18267,17 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
     });
   };
   const settling = (signal) => new Promise((resolve2, reject) => {
-    const done4 = () => {
-      waiters.delete(done4);
+    const done5 = () => {
+      waiters.delete(done5);
       signal?.removeEventListener("abort", stop);
       resolve2();
     };
     const stop = () => {
-      waiters.delete(done4);
+      waiters.delete(done5);
       reject(new KernelError("EINTR"));
     };
     if (signal?.aborted) return stop();
-    waiters.add(done4);
+    waiters.add(done5);
     signal?.addEventListener("abort", stop, { once: true });
   });
   const settled = async () => {
@@ -18245,15 +18469,15 @@ async function substituteHead(head, ask) {
   if (!head.endsWith("\r\n\r\n")) return void 0;
   const lines2 = head.slice(0, -4).split("\r\n");
   if (lines2.some((l) => l.includes("\n") || l.includes("\r"))) return void 0;
-  const request2 = REQUEST_LINE2.exec(lines2[0]);
-  const found = request2 ? scan(lines2) : void 0;
-  if (!request2 || !found || found.length !== 1) return void 0;
+  const request3 = REQUEST_LINE2.exec(lines2[0]);
+  const found = request3 ? scan(lines2) : void 0;
+  if (!request3 || !found || found.length !== 1) return void 0;
   const at = found[0];
   if (at.placeholders.length > SESSION_PLACEHOLDERS) return void 0;
   const values = usable(
     await ask(`header:${at.name}`, at.placeholders, {
-      method: request2[1],
-      path: request2[2]
+      method: request3[1],
+      path: request3[2]
     })
   );
   if (Object.keys(values).length === 0) return void 0;
@@ -18356,7 +18580,7 @@ var Http1Writer = class {
     this.buffer = new Uint8Array(0);
     const s = this.s;
     const session = sessionId();
-    const done4 = await substituteHead(
+    const done5 = await substituteHead(
       latin12(all.subarray(0, end)),
       async (position, placeholders, head2) => s.broker.sessionMaterialize({
         stamp: await s.stamp(),
@@ -18372,10 +18596,10 @@ var Http1Writer = class {
         head: head2
       })
     ).catch(() => void 0);
-    const head = done4 ? bytesOf(done4.head) : all.subarray(0, end);
-    if (done4) {
+    const head = done5 ? bytesOf(done5.head) : all.subarray(0, end);
+    if (done5) {
       this.scope.add(
-        Object.entries(done4.values).map(([placeholder, value2]) => ({
+        Object.entries(done5.values).map(([placeholder, value2]) => ({
           name: "sealed",
           value: value2,
           placeholder
@@ -18793,15 +19017,15 @@ function alertOf(session) {
 }
 async function handshake(conn, o, session, inbox) {
   for (; ; ) {
-    let done4;
+    let done5;
     try {
-      done4 = session.handshake();
+      done5 = session.handshake();
     } catch (err) {
       await send(conn, session).catch(() => void 0);
       throw refused2(o.engine, session, err);
     }
     await send(conn, session);
-    if (done4) return;
+    if (done5) return;
     if (!await inbox.more()) {
       throw new KernelError(
         "ECONNRESET",
@@ -19925,7 +20149,7 @@ var VfsNodes = class {
       if (held) throw fsError("EEXIST", path);
       const exclusive = this.fs.createExclusive;
       if (exclusive) return exclusive.call(this.fs, path, owner);
-      if (await present2(this.fs, path)) throw fsError("EEXIST", path);
+      if (await present3(this.fs, path)) throw fsError("EEXIST", path);
       await this.fs.writeFile(path, new Uint8Array(0), owner);
     });
   }
@@ -20031,9 +20255,9 @@ var VfsNodes = class {
   }
   open(path, pin, writable2 = false, id2, ino) {
     const found = this.named(path, id2);
-    const same = !found || ino === void 0 || found.ino === void 0 || found.ino === ino;
-    if (found && !same) this.orphan(found);
-    const node = (same ? found : void 0) ?? this.create(path, id2, new VfsNode(this.fs, path, void 0, false, false, pin));
+    const same2 = !found || ino === void 0 || found.ino === void 0 || found.ino === ino;
+    if (found && !same2) this.orphan(found);
+    const node = (same2 ? found : void 0) ?? this.create(path, id2, new VfsNode(this.fs, path, void 0, false, false, pin));
     node.ino ??= ino;
     node.opens++;
     if (writable2) node.writers++;
@@ -20156,7 +20380,7 @@ var VfsNodes = class {
     }
   }
 };
-async function present2(fs, path, follow2 = false) {
+async function present3(fs, path, follow2 = false) {
   const look = (follow2 ? void 0 : fs.lstat) ?? fs.stat;
   try {
     await (look ? look.call(fs, path) : fs.readFileBuffer(path));
@@ -20216,9 +20440,9 @@ function heldIo(fs, nodes, changed) {
     const held = await node(path);
     if (!held) return fallback();
     const out = await held.serial(async () => {
-      const done4 = await op(held);
+      const done5 = await op(held);
       await held.flush();
-      return done4;
+      return done5;
     });
     changed(fs.resolvePath("/", path));
     if (held.path !== fs.resolvePath("/", path)) changed(held.path);
@@ -20334,7 +20558,18 @@ function keepingOpen(fs, nodes, changed = () => {
       await nodes.onEntry(key, () => fs.link(from, to, follow2));
       await nodes.linked(at, key);
     },
-    mkdir: (path, options) => nodes.onEntry(fs.resolvePath("/", path), () => fs.mkdir(path, options))
+    mkdir: (path, options) => nodes.onEntry(fs.resolvePath("/", path), () => fs.mkdir(path, options)),
+    ...fs.copyFile ? {
+      async copyFile(from, to, options) {
+        const source = await nodes.targetKey(fs.resolvePath("/", from));
+        await nodes.flush(source);
+        await nodes.flushLinked(source);
+        const at = fs.resolvePath("/", to);
+        const key = await nodes.entryKey(at);
+        if (await heldAt(fs, nodes, at)) return copyByBytes(this, from, to, options);
+        await nodes.onEntry(key, () => fs.copyFile?.(from, to, options));
+      }
+    } : {}
   };
 }
 function vfsFile(fs, opts, nodes) {
@@ -21040,30 +21275,30 @@ var WasmProcess = class {
     else await file?.flush?.();
   }
   async flockOf(fd) {
-    const open = this.fds.get(fd);
+    const open2 = this.fds.get(fd);
     const { locks } = this.options;
-    if (locks && !flockHooked.has(open)) {
-      flockHooked.add(open);
-      open.onClose(() => locks.flocks.drop(open));
+    if (locks && !flockHooked.has(open2)) {
+      flockHooked.add(open2);
+      open2.onClose(() => locks.flocks.drop(open2));
     }
-    return { key: await this.objectKeyOf(open), owner: open };
+    return { key: await this.objectKeyOf(open2), owner: open2 };
   }
-  async objectKeyOf(open) {
-    const { file } = open;
+  async objectKeyOf(open2) {
+    const { file } = open2;
     const meta = file.heldMeta;
     if (meta && "device" in meta) return `device:${meta.device}`;
     if (meta && "dir" in meta) {
       const st2 = await this.options.fs.stat?.(meta.dir).catch(() => void 0);
       return st2 ? identityKey(st2, meta.dir) : objectKey(file);
     }
-    const known = fileKeys.get(open);
+    const known = fileKeys.get(open2);
     if (known !== void 0) return known;
     const vfs = await file.stat?.().catch(() => void 0);
     if (!vfs || vfs.orphan) return objectKey(file);
     const st = await this.options.fs.stat?.(vfs.path).catch(() => void 0);
     if (!st) return objectKey(file);
     const key = identityKey(st, vfs.path);
-    fileKeys.set(open, key);
+    fileKeys.set(open2, key);
     return key;
   }
   async dropRecordLocks(fd) {
@@ -21185,17 +21420,17 @@ var WasmProcess = class {
         return fd;
       }
       if (this.writesAt(req) && this.options.readonlyAt?.(path)) throw new KernelError("EROFS");
-      const open = { ...req, path };
+      const open2 = { ...req, path };
       const plain2 = this.plainMode(req.mode);
       if (req.exclusive) {
         await nodes.createExclusive(path, this.newOwner(req.mode));
         if (plain2 !== void 0) await fs.chmod?.(path, plain2);
-        this.fds.installAt(fd, this.openVfsFile(open, void 0, fs));
+        this.fds.installAt(fd, this.openVfsFile(open2, void 0, fs));
       } else if (req.create) {
         await nodes.onEntry(path, async () => {
           const marks = this.options.owners || plain2 !== void 0;
-          const fresh2 = marks && !await present2(fs, path, true);
-          this.fds.installAt(fd, this.openVfsFile(open, await nodes.identify(path), fs));
+          const fresh2 = marks && !await present3(fs, path, true);
+          this.fds.installAt(fd, this.openVfsFile(open2, await nodes.identify(path), fs));
           await this.fds.get(fd).file.stat?.();
           if (fresh2 && plain2 !== void 0) await fs.chmod?.(path, plain2);
           else if (fresh2) {
@@ -21209,11 +21444,11 @@ var WasmProcess = class {
             await this.stillOpen(at, req.handle);
             return nodes.identify(at);
           },
-          (id2, at) => this.fds.installAt(fd, this.openVfsFile({ ...open, path: at }, id2, fs)),
+          (id2, at) => this.fds.installAt(fd, this.openVfsFile({ ...open2, path: at }, id2, fs)),
           { at: path, gen }
         );
       }
-      if (req.existing && !await present2(fs, path, true)) {
+      if (req.existing && !await present3(fs, path, true)) {
         throw new KernelError("ENOENT");
       }
     } catch (err) {
@@ -21324,11 +21559,11 @@ var WasmProcess = class {
   }
   async stampClipboards() {
     if (!this.options.clipboard) return;
-    const open = this.fds.numbers().filter((fd) => this.fds.get(fd).file.clipboard);
-    if (open.length === 0) return;
+    const open2 = this.fds.numbers().filter((fd) => this.fds.get(fd).file.clipboard);
+    if (open2.length === 0) return;
     const stamp = await this.clipboardStamp().catch(() => void 0);
     if (!stamp) return;
-    for (const fd of open) {
+    for (const fd of open2) {
       const channel = this.fds.get(fd).file.clipboard;
       if (channel) channel.stamp = stamp;
     }
@@ -21581,12 +21816,12 @@ var WasmProcess = class {
   async stillOpen(at, handle) {
     if (handle === void 0 || this.keptHandle?.(handle) !== void 0) return;
     if (this.holdsHandle?.(handle) !== false) return;
-    if (!await present2(this.options.fs, at, true)) throw new KernelError("ENOENT");
+    if (!await present3(this.options.fs, at, true)) throw new KernelError("ENOENT");
   }
   async keptOr(path, handle) {
     if (handle !== void 0) return this.keptHandle?.(handle) ?? path;
     const kept = this.keptPath?.(path);
-    return kept !== void 0 && !await present2(this.options.fs, path, true) ? kept : path;
+    return kept !== void 0 && !await present3(this.options.fs, path, true) ? kept : path;
   }
   async promote(req) {
     if (!this.fds.get(req.fd).file.held) throw new KernelError("EBADF");
@@ -22121,18 +22356,18 @@ function descId(file) {
 }
 function inheritedFds(fds) {
   return fds.numbers().filter((fd) => fd > 2 && !fds.get(fd).file.held).map((fd) => {
-    const open = fds.get(fd);
+    const open2 = fds.get(fd);
     const flags2 = fds.statusFlags(fd);
-    const kind = open.file instanceof KernelSocket || isDatagram(open.file) ? "socket" : kernelFdKind(open.file);
-    const meta = open.file.heldMeta;
+    const kind = open2.file instanceof KernelSocket || isDatagram(open2.file) ? "socket" : kernelFdKind(open2.file);
+    const meta = open2.file.heldMeta;
     return {
       fd,
       kind,
       ...kind === "device" && meta && "device" in meta ? { device: meta } : {},
       ...flags2 !== void 0 ? { flags: flags2 } : {},
       ...fds.closesOnExec(fd) ? { cloexec: true } : {},
-      ...kind === "stream" ? { desc: descId(open) } : {},
-      ...open.file.fifo ? { fifo: open.file.fifo } : {}
+      ...kind === "stream" ? { desc: descId(open2) } : {},
+      ...open2.file.fifo ? { fifo: open2.file.fifo } : {}
     };
   });
 }
@@ -22298,7 +22533,7 @@ function holdingToken(opts, holds2, caller) {
     noLinks: opts.noLinks,
     cwd: opts.cwd,
     ...opts.statfs ? { statfs: opts.statfs } : {},
-    hold: (path, on, open, real, handle) => holds2.hold(path, on, open, real, handle),
+    hold: (path, on, open2, real, handle) => holds2.hold(path, on, open2, real, handle),
     keptFor: (handle) => holds2.keptFor(handle),
     unlinked: (path) => holds2.keptAt(path),
     gate: (path, op) => opts.unlinkGate && holds2.holding(path) ? opts.unlinkGate.run(holds2.keyOf(path), op) : op(),
@@ -22447,11 +22682,11 @@ function spawnWasmProcess(opts) {
   });
   const lane = opts.program.abi === "js" ? openLane(token, dispatch2) : void 0;
   const { promise: exited, resolve: settle3 } = Promise.withResolvers();
-  let done4 = false;
+  let done5 = false;
   let endedBy;
   const finish = (code, sig) => {
-    if (done4) return;
-    done4 = true;
+    if (done5) return;
+    done5 = true;
     started(true);
     clocks.freeze();
     dying.clear();
@@ -22502,7 +22737,7 @@ function spawnWasmProcess(opts) {
   };
   const spawnThread = (thread) => {
     const { program } = opts;
-    if (done4 || program.abi === "js") return;
+    if (done5 || program.abi === "js") return;
     if (threads.size >= WASM_MAX_THREADS - 1) {
       opts.onError?.(`more than ${WASM_MAX_THREADS} threads`);
       finish(CRASHED);
@@ -22538,7 +22773,7 @@ function spawnWasmProcess(opts) {
     transferOf(opts, lane?.lane)
   );
   const terminate = (code, sig) => {
-    if (opts.program.abi !== "wasi" || done4) finish(code, sig);
+    if (opts.program.abi !== "wasi" || done5) finish(code, sig);
     else dying.start(code, sig, header3, process, () => finish(code, sig));
   };
   const signal = (sig, info) => {
@@ -22560,7 +22795,7 @@ function spawnWasmProcess(opts) {
     signalMasks: () => process.signalMasks(),
     umask: () => process.umask,
     cred: () => copyCred(process.cred),
-    writesBack: () => opts.program.abi === "wasi" && !done4,
+    writesBack: () => opts.program.abi === "wasi" && !done5,
     ...clockViews(clocks)
   };
 }
@@ -23228,21 +23463,21 @@ function replayingHops(inner, heldMs = HELD_MS) {
       return { ...inner.traits, manualRedirects: true };
     },
     ...inner.websocket ? { websocket: inner.websocket.bind(inner) } : {},
-    async fetch(request2, owner = KERNEL) {
-      const key = keyOf3(owner, request2.method, request2.url);
+    async fetch(request3, owner = KERNEL) {
+      const key = keyOf3(owner, request3.method, request3.url);
       const waiting = held.get(key);
-      if (waiting && waiting.fingerprint === fingerprint(request2.headers)) {
+      if (waiting && waiting.fingerprint === fingerprint(request3.headers)) {
         held.delete(key);
         clearTimeout(waiting.timer);
         return replay(waiting);
       }
       if (waiting) drop(key);
-      const response = await inner.fetch(request2);
+      const response = await inner.fetch(request3);
       if (!response.redirects?.length) return response;
       return replay({
         owner,
-        method: request2.method,
-        fingerprint: fingerprint(request2.headers),
+        method: request3.method,
+        fingerprint: fingerprint(request3.headers),
         hops: response.redirects,
         final: response
       });
@@ -23768,7 +24003,7 @@ async function dispatch(h, req) {
   }
 }
 function serveFilesystem(port, handlers, capabilities = {}, options = {}) {
-  let open = false;
+  let open2 = false;
   const reply = (message3, transfer = []) => port.postMessage(message3, transfer);
   async function hello(message3) {
     const refused3 = driverVersionError(message3.protocol);
@@ -23778,7 +24013,7 @@ function serveFilesystem(port, handlers, capabilities = {}, options = {}) {
     }
     try {
       const refined = await handlers.mount?.(message3.mount);
-      open = true;
+      open2 = true;
       reply({
         hello: { protocol: DRIVER_PROTOCOL, capabilities: { ...capabilities, ...refined } }
       });
@@ -23799,7 +24034,7 @@ function serveFilesystem(port, handlers, capabilities = {}, options = {}) {
       void hello(data.hello);
       return;
     }
-    if (!open) return;
+    if (!open2) return;
     dispatch(handlers, data).then(
       (result) => {
         if (result instanceof Uint8Array) {
@@ -23948,10 +24183,10 @@ function kernelFsHandlers(fs) {
     readlink: (path) => fs.readlink(path),
     async setattr(path, change) {
       if (change.size !== void 0) {
-        const open = [...handles.values()].find(
+        const open2 = [...handles.values()].find(
           (h) => h.path === path && h.session !== void 0
         )?.session;
-        if (open !== void 0) await (await open).truncate(change.size);
+        if (open2 !== void 0) await (await open2).truncate(change.size);
         else await fs.truncate?.(path, change.size);
       }
       if (change.mode !== void 0) await fs.chmod(path, change.mode);
@@ -23968,7 +24203,7 @@ function granted(handle) {
     () => false
   );
 }
-function removableMedium(onLost, open = (handle) => new OpfsFs(handle)) {
+function removableMedium(onLost, open2 = (handle) => new OpfsFs(handle)) {
   const slot2 = mediumSlot(
     async (err, handle) => denied(err) && !await granted(handle),
     onLost
@@ -23976,7 +24211,7 @@ function removableMedium(onLost, open = (handle) => new OpfsFs(handle)) {
   return {
     handlers: slot2.handlers,
     present: slot2.present,
-    insert: (handle) => slot2.insert(handle, kernelFsHandlers(open(handle))),
+    insert: (handle) => slot2.insert(handle, kernelFsHandlers(open2(handle))),
     eject: slot2.eject
   };
 }
@@ -24102,13 +24337,13 @@ function codeOf5(err) {
 function wait(ms, signal) {
   if (signal.aborted) return Promise.resolve();
   return new Promise((resolve2) => {
-    const done4 = () => {
+    const done5 = () => {
       clearTimeout(timer);
-      signal.removeEventListener("abort", done4);
+      signal.removeEventListener("abort", done5);
       resolve2();
     };
-    const timer = setTimeout(done4, ms);
-    signal.addEventListener("abort", done4, { once: true });
+    const timer = setTimeout(done5, ms);
+    signal.addEventListener("abort", done5, { once: true });
   });
 }
 async function mountFstab(lines2, mount, signal, retries = FSTAB_RETRIES, discard = () => {
@@ -24269,8 +24504,8 @@ var HostfsClient = class {
     let buffered = "";
     try {
       for (; ; ) {
-        const { done: done4, value: value2 } = await reader.read();
-        if (done4) return;
+        const { done: done5, value: value2 } = await reader.read();
+        if (done5) return;
         buffered += decoder4.decode(value2, { stream: true });
         let end = buffered.indexOf("\n");
         while (end >= 0) {
@@ -24302,14 +24537,14 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
     return fresh2(remote);
   };
   const call = (op, body = {}) => current().call(op, body);
-  const same = (was, mode, seen) => seen?.mode === (mode | 128) && (was.ino !== void 0 && seen.ino !== void 0 ? seen.ino === was.ino : seen.size === was.size && seen.mtime === was.mtime);
+  const same2 = (was, mode, seen) => seen?.mode === (mode | 128) && (was.ino !== void 0 && seen.ino !== void 0 ? seen.ino === was.ino : seen.size === was.size && seen.mtime === was.mtime);
   const settle3 = (client, { was, ...restore }) => client.call("setattr", restore).catch((err) => {
     if (!client.gone || !client.cleanup) throw err;
     void client.cleanup("setattr", restore).catch(() => {
     });
     const timer = setTimeout(async () => {
       const seen = await client.cleanup?.("stat", { path: restore.path }).catch(() => null);
-      if (same(was, restore.mode, seen))
+      if (same2(was, restore.mode, seen))
         void client.cleanup?.("setattr", restore).catch(() => {
         });
     }, againMs);
@@ -24433,13 +24668,13 @@ async function resize(h, path, size) {
 }
 function sleep(ms, signal) {
   return new Promise((resolve2) => {
-    const done4 = () => {
+    const done5 = () => {
       clearTimeout(timer);
-      signal.removeEventListener("abort", done4);
+      signal.removeEventListener("abort", done5);
       resolve2();
     };
-    const timer = setTimeout(done4, ms);
-    signal.addEventListener("abort", done4);
+    const timer = setTimeout(done5, ms);
+    signal.addEventListener("abort", done5);
   });
 }
 function keepWatching(loop, signal) {
@@ -24523,8 +24758,8 @@ function timed(transport, ms) {
     let expired = false;
     const running = run2();
     inflight.add(running);
-    const done4 = () => inflight.delete(running);
-    running.then(done4, done4);
+    const done5 = () => inflight.delete(running);
+    running.then(done5, done5);
     const timer = setTimeout(() => {
       expired = true;
       const why = `the host folder did not answer ${name2} within ${ms} ms`;
@@ -24821,17 +25056,17 @@ function memoryMedia() {
     put: async (id2, handle) => void handles.set(id2, handle)
   };
 }
-function settle2(request2, value2) {
+function settle2(request3, value2) {
   return new Promise((resolve2, reject) => {
-    request2.onsuccess = () => resolve2(value2());
-    request2.onerror = () => reject(request2.error);
+    request3.onsuccess = () => resolve2(value2());
+    request3.onerror = () => reject(request3.error);
   });
 }
 function openMedia(name2, factory) {
-  const request2 = factory.open(name2, 1);
-  request2.onupgradeneeded = () => request2.result.createObjectStore(MEDIA_STORE);
-  return settle2(request2, () => {
-    const db = request2.result;
+  const request3 = factory.open(name2, 1);
+  request3.onupgradeneeded = () => request3.result.createObjectStore(MEDIA_STORE);
+  return settle2(request3, () => {
+    const db = request3.result;
     const store = (mode) => db.transaction(MEDIA_STORE, mode).objectStore(MEDIA_STORE);
     return {
       get: (id2) => {
@@ -24864,14 +25099,14 @@ var ChunkedBytes = class {
   }
   write(offset, bytes, owned4 = false) {
     const whole = owned4 && bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength;
-    for (let done4 = 0; done4 < bytes.length; ) {
-      const at = offset + done4;
+    for (let done5 = 0; done5 < bytes.length; ) {
+      const at = offset + done5;
       const index = Math.floor(at / CHUNK3);
       const from = at - index * CHUNK3;
-      const n = Math.min(CHUNK3 - from, bytes.length - done4);
+      const n = Math.min(CHUNK3 - from, bytes.length - done5);
       if (whole && n === CHUNK3 && bytes.length === CHUNK3) this.chunks[index] = bytes;
-      else this.room(index, from + n).set(bytes.subarray(done4, done4 + n), from);
-      done4 += n;
+      else this.room(index, from + n).set(bytes.subarray(done5, done5 + n), from);
+      done5 += n;
     }
     this.size = Math.max(this.size, offset + bytes.length);
   }
@@ -25375,9 +25610,9 @@ function parseArgs(args) {
       break;
     }
     if (!arg.startsWith("-") || arg === "-") break;
-    const used = flags(parsed2, arg, args[i + 1]);
-    if (typeof used === "string") return used;
-    i += used;
+    const used2 = flags(parsed2, arg, args[i + 1]);
+    if (typeof used2 === "string") return used2;
+    i += used2;
   }
   parsed2.command = args.slice(i);
   if (parsed2.list ? parsed2.command.length > 0 : parsed2.command.length === 0) return USAGE;
@@ -26407,9 +26642,9 @@ var Launcher = class {
     const known = this.sameFiles.get(`${a}|${b}`);
     if (known?.stamp === stamp) return known.same;
     const [p, q] = await Promise.all([this.base.readFileBuffer(a), this.base.readFileBuffer(b)]);
-    const same = p.length === q.length && p.every((byte, i) => byte === q[i]);
-    this.sameFiles.set(`${a}|${b}`, { stamp, same });
-    return same;
+    const same2 = p.length === q.length && p.every((byte, i) => byte === q[i]);
+    this.sameFiles.set(`${a}|${b}`, { stamp, same: same2 });
+    return same2;
   }
   async wasmOwner(wasm, name2, scope) {
     const leaf = baseName2(wasm);
@@ -26702,10 +26937,10 @@ var Launcher = class {
     const drop = () => {
       if (cache.get(key) === found) cache.delete(key);
     };
-    loading2.then((done4) => {
-      if (done4.key === key || done4.key === void 0 && !key.includes("\0")) return;
+    loading2.then((done5) => {
+      if (done5.key === key || done5.key === void 0 && !key.includes("\0")) return;
       drop();
-      if (done4.key !== void 0 && revocations === this.revocations) cache.set(done4.key, found);
+      if (done5.key !== void 0 && revocations === this.revocations) cache.set(done5.key, found);
     }, drop);
     return found;
   }
@@ -26850,17 +27085,17 @@ var Launcher = class {
       await req.fds.closeAll();
       throw err;
     }
-    const done4 = this.heldUrl(program);
+    const done5 = this.heldUrl(program);
     try {
       const handle = await this.admitted(
         program.abi !== "js",
         req.fds,
         (fds, quietOom) => this.start({ ...req, fds, quietOom, cwd, program, argv0: target.argv0, args, env })
       );
-      void handle.exited.finally(done4);
+      void handle.exited.finally(done5);
       return handle;
     } catch (err) {
-      done4();
+      done5();
       throw err;
     }
   }
@@ -27403,8 +27638,8 @@ var Launcher = class {
     const at = normalizePath(path);
     this.unlinked.closed(at);
     this.writers?.unlinked.closed(at);
-    const open = [...this.openFiles].some((nodes) => nodes.writes(at)) || heldUnder(this.held, at);
-    if (!open) void this.mounts.commit(at).catch(() => void 0);
+    const open2 = [...this.openFiles].some((nodes) => nodes.writes(at)) || heldUnder(this.held, at);
+    if (!open2) void this.mounts.commit(at).catch(() => void 0);
   }
   signalMasksOf(pid) {
     const masks = this.processes.get(pid)?.signalMasks?.();
@@ -27860,7 +28095,7 @@ var Launcher = class {
       (path) => this.mountRoot(path),
       {
         locks: webLocks(),
-        busy: (path) => [...this.openFiles].some((open) => open.holds(path)),
+        busy: (path) => [...this.openFiles].some((open2) => open2.holds(path)),
         owner: this.unlinkOwnerOption,
         ...this.owners ? { dirOwner: { uid: 0, gid: 0, mode: 448 } } : {}
       }
@@ -28027,11 +28262,11 @@ function cronLocks() {
 // src/pin.ts
 function pinScript(url) {
   try {
-    const request2 = new XMLHttpRequest();
-    request2.open("GET", url.href, false);
-    request2.send();
-    if (request2.status !== 200) return url.href;
-    const source = `${request2.responseText}
+    const request3 = new XMLHttpRequest();
+    request3.open("GET", url.href, false);
+    request3.send();
+    if (request3.status !== 200) return url.href;
+    const source = `${request3.responseText}
 //# sourceURL=${url.href}
 `;
     return URL.createObjectURL(new Blob([source], { type: "text/javascript" }));
@@ -28184,9 +28419,9 @@ var RemoteTransport = class {
     waiter?.reject(new TransportError("the request was cancelled"));
     this.port.postMessage({ net: "cancel", nid });
   }
-  async fetch(request2) {
+  async fetch(request3) {
     const nid = ++this.nextId;
-    const { signal } = request2;
+    const { signal } = request3;
     signal.throwIfAborted();
     let finished = false;
     const abort = () => {
@@ -28201,16 +28436,16 @@ var RemoteTransport = class {
       finished = true;
       signal.removeEventListener("abort", abort);
     };
-    if (request2.bodyStream) this.uploads.set(nid, request2.bodyStream[Symbol.asyncIterator]());
+    if (request3.bodyStream) this.uploads.set(nid, request3.bodyStream[Symbol.asyncIterator]());
     let head;
     try {
       head = await this.ask({
         net: "fetch",
         nid,
-        url: request2.url,
-        method: request2.method,
-        headers: request2.headers,
-        ...request2.bodyStream ? { streamed: true } : request2.body ? { body: request2.body } : {}
+        url: request3.url,
+        method: request3.method,
+        headers: request3.headers,
+        ...request3.bodyStream ? { streamed: true } : request3.body ? { body: request3.body } : {}
       });
     } catch (e) {
       finish();
@@ -28253,9 +28488,9 @@ var RemoteTransport = class {
       }
     };
   }
-  async websocket(request2) {
+  async websocket(request3) {
     const nid = ++this.nextId;
-    const { signal } = request2;
+    const { signal } = request3;
     signal.throwIfAborted();
     const abort = () => this.cancel(nid);
     signal.addEventListener("abort", abort, { once: true });
@@ -28264,9 +28499,9 @@ var RemoteTransport = class {
       opened2 = await this.ask({
         net: "ws-open",
         nid,
-        url: request2.url,
-        protocols: request2.protocols,
-        headers: request2.headers
+        url: request3.url,
+        protocols: request3.protocols,
+        headers: request3.headers
       });
     } finally {
       signal.removeEventListener("abort", abort);
@@ -28336,6 +28571,12 @@ async function inOpfs(deps, root) {
   const opfs = await deps.storage().catch(() => void 0);
   return await opfs?.resolve(root).catch(() => null) != null;
 }
+async function rootNamed(deps, req, root) {
+  if (req.metadata !== void 0 || !req.root || !deps.rootId) return req;
+  const top = await deps.storage().catch(() => void 0);
+  const name2 = await metadataName(top, root, deps.rootId);
+  return name2 === META_DB ? req : { ...req, metadata: name2 };
+}
 function workers(deps) {
   return {
     createWorker: deps.createWorker,
@@ -28380,7 +28621,7 @@ function cdpOption(req, port) {
   if (!req.cdp) return {};
   return {
     cdp: portCdpHook(
-      (request2, cdp) => port.postMessage({ cdpOpen: request2, port: cdp }, [cdp])
+      (request3, cdp) => port.postMessage({ cdpOpen: request3, port: cdp }, [cdp])
     )
   };
 }
@@ -28390,7 +28631,7 @@ function pageHooks(req, port) {
 function facadesOption(req, port) {
   if (!req.facades) return {};
   const hook = portFacadeHook(
-    (request2, facade) => port.postMessage({ facadeOpen: request2, port: facade }, [facade])
+    (request3, facade) => port.postMessage({ facadeOpen: request3, port: facade }, [facade])
   );
   const facades = {};
   for (const [name2, spec] of Object.entries(req.facades)) {
@@ -28592,6 +28833,7 @@ function serveKernel(port, deps) {
   }
   async function init(req) {
     launcher = (req.root ? Promise.resolve(req.root) : deps.storage()).then(async (root) => {
+      req = await rootNamed(deps, req, root);
       const name2 = req.metadata ?? META_DB;
       const { meta, media } = await stores(deps, name2, req.media);
       const net = remotes(port, req);
@@ -28699,6 +28941,7 @@ serveKernel(globalThis, {
   createDriverWorker: () => new Worker(driverWorker, { type: "module" }),
   moduleUrl: blobModuleUrl,
   metadata: (name2) => openMeta(name2, indexedDB),
-  media: (name2) => openMedia(name2, indexedDB)
+  media: (name2) => openMedia(name2, indexedDB),
+  rootId: (root) => rootId(indexedDB, root)
 });
 //# sourceMappingURL=kernel-worker.js.map