@ai-ecoverse/slicc-kernel 1.128.1 → 1.129.0

package/dist/kernel-worker.js

@@ -544,14 +544,14 @@ var Integrity = class {
     if (!this.root.version) return void 0;
     return `${real}\0${await this.root.version(real)}`;
   }
-  async read(path, caller, plain2, asked) {
-    return (await this.readKeyed(path, caller, plain2, asked)).bytes;
+  async read(path, caller, plain3, asked) {
+    return (await this.readKeyed(path, caller, plain3, asked)).bytes;
   }
-  async readKeyed(path, caller, plain2, asked) {
+  async readKeyed(path, caller, plain3, asked) {
     const found = await this.real(path, asked);
-    if (found === void 0) return { bytes: await plain2() };
+    if (found === void 0) return { bytes: await plain3() };
     const { real, name: name2 } = found;
-    const read = name2 !== real ? { bytes: await plain2(), version: void 0 } : this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
+    const read = name2 !== real ? { bytes: await plain3(), version: void 0 } : this.root.readVersioned ? await this.root.readVersioned(real) : { bytes: await this.root.readFileBuffer(real), version: void 0 };
     const { bytes } = read;
     const keyed = read.version === void 0 ? { bytes } : { bytes, key: `${real}\0${read.version}` };
     await this.verify(name2, bytes, caller, EXEC_OPS);
@@ -560,9 +560,9 @@ var Integrity = class {
   get readsChecked() {
     return this.sources.length > 0;
   }
-  async readSource(path, caller, plain2) {
+  async readSource(path, caller, plain3) {
     const found = await this.source(path);
-    return found === void 0 ? plain2() : this.checked(found, caller, plain2);
+    return found === void 0 ? plain3() : this.checked(found, caller, plain3);
   }
   async openSource(path, caller, real) {
     const found = await this.source(path, real);
@@ -572,10 +572,10 @@ var Integrity = class {
     }
     await this.checked(found, caller, () => this.root.readFileBuffer(found.real));
   }
-  async checked(found, caller, plain2) {
+  async checked(found, caller, plain3) {
     const { real, name: name2 } = found;
     if (name2 !== real || !this.root.readVersioned) {
-      const bytes2 = await plain2();
+      const bytes2 = await plain3();
       await this.verify(name2, bytes2, caller, READ_OPS);
       return bytes2;
     }
@@ -3232,11 +3232,11 @@ function frame(opcode, payload) {
   return out;
 }
 function clientFrame(opcode, payload) {
-  const plain2 = frame(opcode, payload);
-  const head = plain2.length - payload.length;
+  const plain3 = frame(opcode, payload);
+  const head = plain3.length - payload.length;
   const mask = crypto.getRandomValues(new Uint8Array(4));
-  const out = new Uint8Array(plain2.length + 4);
-  out.set(plain2.subarray(0, head));
+  const out = new Uint8Array(plain3.length + 4);
+  out.set(plain3.subarray(0, head));
   out[1] = out[1] | 128;
   out.set(mask, head);
   for (let i = 0; i < payload.length; i++) {
@@ -7020,7 +7020,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.128.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.129.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -9772,8 +9772,9 @@ var FreshModules = class {
     if (ranged2) {
       overrides.pwrite = async (path, at, bytes, transfer) => {
         const touches2 = at < MAGIC.length && this.fresh.has(normalizePath(path));
+        const first = at === 0 && bytes.length >= MAGIC.length ? bytes.slice(0, MAGIC.length) : void 0;
         await ranged2.pwrite(path, at, bytes, transfer);
-        if (touches2) await decide(path);
+        if (touches2) await decide(path, first);
       };
       overrides.truncate = async (path, size) => {
         await ranged2.truncate(path, size);
@@ -12377,13 +12378,13 @@ async function chown(entry, path, req) {
 }
 async function runMkdir(entry, path, req) {
   const { fs } = entry;
-  const plain2 = plainDirMode(entry, req.mode);
+  const plain3 = plainDirMode(entry, req.mode);
   const parentsMode = !req.exclusive ? plainParentsMode(entry) : void 0;
   const fixParents = parentsMode !== void 0 ? await missingParents(fs, path, parentsMode) : void 0;
-  const fresh2 = plain2 !== void 0 && !await fs.exists(path);
+  const fresh2 = plain3 !== void 0 && !await fs.exists(path);
   await (req.exclusive ? mkdirExclusive(entry, path, req.mode) : fs.mkdir(path, mkdirOptions(entry, req.mode)));
   await fixParents?.();
-  if (fresh2) await fs.chmod(path, plain2);
+  if (fresh2) await fs.chmod(path, plain3);
   return done2;
 }
 async function shownAs(entry, path, st) {
@@ -12391,8 +12392,8 @@ async function shownAs(entry, path, st) {
   return callerStat(guardOf(entry), await real?.catch(() => path) ?? path, st);
 }
 function readSource(entry, path) {
-  const plain2 = () => entry.fs.readFileBuffer(path);
-  return entry.source ? entry.source.read(path, plain2) : plain2();
+  const plain3 = () => entry.fs.readFileBuffer(path);
+  return entry.source ? entry.source.read(path, plain3) : plain3();
 }
 async function run(entry, path, req) {
   const { fs, cwd } = entry;
@@ -18489,6 +18490,95 @@ async function substituteHead(head, ask) {
 `, values };
 }
 
+// src/kernel/net/sealed-smtp.ts
+var SMTP_LINE_MAX = 4096;
+var GREETING = ["EHLO ", "HELO "];
+function sniffSmtp(start2) {
+  const upper = start2.toUpperCase();
+  for (const word of GREETING) {
+    if (upper.startsWith(word)) return "yes";
+    if (word.startsWith(upper)) return "more";
+  }
+  return "no";
+}
+function decoded(b64) {
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(b64)) return void 0;
+  try {
+    return atob(b64);
+  } catch {
+    return void 0;
+  }
+}
+async function swapped2(text, position, ask) {
+  const placeholders = placeholdersIn(text);
+  if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS) return void 0;
+  const values = usable(await ask(position, placeholders));
+  if (Object.keys(values).length === 0) return void 0;
+  return { text: replaced(text, values), values };
+}
+async function plain2(b64, ask) {
+  const text = decoded(b64);
+  const fields = text?.split("\0");
+  if (fields?.length !== 3) return { line: b64 };
+  const [authz, user, pass2] = fields;
+  if (placeholdersIn(authz + user).length > 0) return { line: b64 };
+  const done5 = await swapped2(pass2, "auth-plain", ask);
+  if (!done5) return { line: b64 };
+  return { line: btoa(`${authz}\0${user}\0${done5.text}`), values: done5.values };
+}
+async function login(b64, ask) {
+  const text = decoded(b64);
+  const done5 = text === void 0 ? void 0 : await swapped2(text, "auth-login", ask);
+  return done5 ? { line: btoa(done5.text), values: done5.values } : { line: b64 };
+}
+var SmtpClient = class {
+  state = "command";
+  ask;
+  constructor(ask) {
+    this.ask = ask;
+  }
+  get done() {
+    return this.state === "done";
+  }
+  async line(text) {
+    const state = this.state;
+    if (state === "done") return { line: text };
+    if (state === "plain" || state === "password") {
+      this.state = "done";
+      if (text === "*") return { line: text };
+      return state === "plain" ? plain2(text, this.ask) : login(text, this.ask);
+    }
+    if (state === "user") {
+      this.state = text === "*" ? "done" : "password";
+      return { line: text };
+    }
+    return this.command(text);
+  }
+  async command(text) {
+    const m = /^AUTH[ \t]+(PLAIN|LOGIN)(?:[ \t]+(\S+))?$/i.exec(text);
+    if (!m) {
+      if (/^(MAIL|RCPT|DATA|BDAT|AUTH)\b/i.test(text)) this.state = "done";
+      return { line: text };
+    }
+    const mech = m[1].toUpperCase();
+    const arg = m[2];
+    if (mech === "LOGIN") {
+      this.state = arg === void 0 ? "user" : "password";
+      return { line: text };
+    }
+    if (arg === void 0) {
+      this.state = "plain";
+      return { line: text };
+    }
+    this.state = "done";
+    const out = await plain2(arg, this.ask);
+    return {
+      line: `${text.slice(0, text.length - arg.length)}${out.line}`,
+      ...out.values ? { values: out.values } : {}
+    };
+  }
+};
+
 // src/kernel/net/sealed-conn.ts
 var HEAD_IDLE_MS = 2e3;
 function substitutes(s) {
@@ -18520,12 +18610,25 @@ function headEnd2(bytes) {
   }
   return -1;
 }
-var Http1Writer = class {
+function modeOf(start2) {
+  const http = sniffHttp1(start2);
+  const smtp = sniffSmtp(start2);
+  if (http === "yes") return "http1";
+  if (smtp === "yes") return "smtp";
+  return http === "no" && smtp === "no" ? "pass" : void 0;
+}
+function crlf(bytes) {
+  for (let i = 0; i + 1 < bytes.length; i++) if (bytes[i] === 13 && bytes[i + 1] === 10) return i;
+  return -1;
+}
+var SessionWriter = class {
   buffer = new Uint8Array(0);
-  passing = false;
+  mode = "sniff";
   timer;
   chain = Promise.resolve();
   failed;
+  session = sessionId();
+  smtp;
   conn;
   s;
   scope;
@@ -18533,6 +18636,9 @@ var Http1Writer = class {
     this.conn = conn;
     this.s = s;
     this.scope = scope;
+    this.smtp = new SmtpClient(
+      (position, placeholders) => this.ask("smtp", position, placeholders)
+    );
   }
   write(bytes) {
     const run2 = this.chain.then(() => this.take(bytes));
@@ -18542,30 +18648,78 @@ var Http1Writer = class {
     );
     return run2;
   }
+  async ask(protocol, position, placeholders, head) {
+    const s = this.s;
+    const values = await s.broker.sessionMaterialize({
+      stamp: await s.stamp(),
+      session: this.session,
+      host: s.host,
+      port: s.port,
+      protocol,
+      position,
+      verified: s.verified,
+      handshakeAt: s.handshakeAt,
+      exit: s.exit,
+      placeholders,
+      ...head ? { head } : {}
+    });
+    return values;
+  }
+  remember(values) {
+    this.scope.add(
+      Object.entries(values).map(([placeholder, value2]) => ({ name: "sealed", value: value2, placeholder }))
+    );
+  }
   async take(bytes) {
     if (this.failed !== void 0) throw this.failed;
-    if (this.passing) return this.conn.write(bytes);
+    if (this.mode === "pass") return this.conn.write(bytes);
     clearTimeout(this.timer);
     const joined4 = new Uint8Array(this.buffer.length + bytes.length);
     joined4.set(this.buffer);
     joined4.set(bytes, this.buffer.length);
     this.buffer.fill(0);
     this.buffer = joined4;
-    const sniff = sniffHttp1(latin12(joined4.subarray(0, 8)));
-    const end = sniff === "yes" ? headEnd2(joined4) : -1;
-    if (sniff === "no" || end > HEAD_MAX || end < 0 && joined4.length > HEAD_MAX)
-      await this.release();
-    else if (end >= 0) await this.substitute(end);
-    else this.timer = setTimeout(() => this.idle(), HEAD_IDLE_MS);
+    if (this.mode === "sniff") this.mode = modeOf(latin12(joined4.subarray(0, 8))) ?? "sniff";
+    if (this.mode === "pass") await this.release();
+    else if (this.mode === "http1") await this.http1();
+    else if (this.mode === "smtp") await this.lines();
+    if (this.mode !== "pass" && this.buffer.length > 0)
+      this.timer = setTimeout(() => this.idle(), HEAD_IDLE_MS);
     return bytes.length;
   }
+  async http1() {
+    const end = headEnd2(this.buffer);
+    if (end > HEAD_MAX || end < 0 && this.buffer.length > HEAD_MAX) await this.release();
+    else if (end >= 0) await this.substitute(end);
+  }
+  async lines() {
+    for (; ; ) {
+      const at = crlf(this.buffer);
+      if (at < 0) break;
+      if (at > SMTP_LINE_MAX) return this.release();
+      const all = this.buffer;
+      this.buffer = all.slice(at + 2);
+      const out = await this.smtp.line(latin12(all.subarray(0, at))).catch(() => ({ line: latin12(all.subarray(0, at)) }));
+      all.fill(0);
+      if ("values" in out && out.values) this.remember(out.values);
+      const line = bytesOf(`${out.line}\r
+`);
+      try {
+        await writeAll4(this.conn, line);
+      } finally {
+        line.fill(0);
+      }
+      if (this.smtp.done) return this.release();
+    }
+    if (this.buffer.length > SMTP_LINE_MAX) await this.release();
+  }
   idle() {
     this.chain = this.chain.then(() => this.release()).catch((err) => {
       this.failed ??= err;
     });
   }
   async release() {
-    this.passing = true;
+    this.mode = "pass";
     const out = this.buffer;
     this.buffer = new Uint8Array(0);
     try {
@@ -18575,37 +18729,15 @@ var Http1Writer = class {
     }
   }
   async substitute(end) {
-    this.passing = true;
+    this.mode = "pass";
     const all = this.buffer;
     this.buffer = new Uint8Array(0);
-    const s = this.s;
-    const session = sessionId();
     const done5 = await substituteHead(
       latin12(all.subarray(0, end)),
-      async (position, placeholders, head2) => s.broker.sessionMaterialize({
-        stamp: await s.stamp(),
-        session,
-        host: s.host,
-        port: s.port,
-        protocol: "http1",
-        position,
-        verified: s.verified,
-        handshakeAt: s.handshakeAt,
-        exit: s.exit,
-        placeholders,
-        head: head2
-      })
+      (position, placeholders, head2) => this.ask("http1", position, placeholders, head2)
     ).catch(() => void 0);
     const head = done5 ? bytesOf(done5.head) : all.subarray(0, end);
-    if (done5) {
-      this.scope.add(
-        Object.entries(done5.values).map(([placeholder, value2]) => ({
-          name: "sealed",
-          value: value2,
-          placeholder
-        }))
-      );
-    }
+    if (done5) this.remember(done5.values);
     try {
       await writeAll4(this.conn, head);
       await writeAll4(this.conn, all.subarray(end));
@@ -18616,14 +18748,14 @@ var Http1Writer = class {
   }
   flushed() {
     clearTimeout(this.timer);
-    this.chain = this.chain.then(() => this.passing ? void 0 : this.release());
+    this.chain = this.chain.then(() => this.mode === "pass" ? void 0 : this.release());
     return this.chain;
   }
   drop() {
     clearTimeout(this.timer);
     this.buffer.fill(0);
     this.buffer = new Uint8Array(0);
-    this.passing = true;
+    this.mode = "pass";
   }
 };
 var IDLE2 = /* @__PURE__ */ Symbol("idle");
@@ -18634,11 +18766,9 @@ var ScrubReader = class {
   held = false;
   ended = false;
   conn;
-  s;
   scope;
-  constructor(conn, s, scope) {
+  constructor(conn, scope) {
     this.conn = conn;
-    this.s = s;
     this.scope = scope;
   }
   current() {
@@ -18697,8 +18827,8 @@ function idle() {
 }
 function sealedConn(conn, s) {
   const scope = s.broker.sessions.scope(s.pid, s.host);
-  const writer = substitutes(s) ? new Http1Writer(conn, s, scope) : void 0;
-  const reader = new ScrubReader(conn, s, scope);
+  const writer = substitutes(s) ? new SessionWriter(conn, s, scope) : void 0;
+  const reader = new ScrubReader(conn, scope);
   return {
     localAddr: conn.localAddr,
     remoteAddr: conn.remoteAddr,
@@ -19824,6 +19954,12 @@ function tlsOverTransport(req, proc) {
   return { fd: proc.fds.install(new OpenFile(mine), 3), alpnProtocol: "http/1.1", servername };
 }
 
+// src/kernel/test-hooks.ts
+var SYSCALL_HOOK = /* @__PURE__ */ Symbol.for("slicc-kernel.test.syscall");
+function testSyscallHook() {
+  return globalThis[SYSCALL_HOOK];
+}
+
 // src/kernel/vfs-file.ts
 var O_ACCMODE = 3;
 var O_WRONLY = 1;
@@ -21038,7 +21174,8 @@ var WasmProcess = class {
       cwd,
       ...moved2,
       ...group,
-      ...exec ? { exec } : {}
+      ...exec ? { exec } : {},
+      search: req.search
     };
     const pid = await this.children.spawn(spawned, stdio, inherit2);
     if (deathSignal !== void 0) this.onDeath(pgid === 0 || session ? -pid : pid, deathSignal);
@@ -21124,6 +21261,8 @@ var WasmProcess = class {
     return void 0;
   }
   async syscall(req, cancelled, block) {
+    const hook = testSyscallHook();
+    if (hook) await hook({ pid: this.pid, op: req.op });
     this.options.onSyscall?.(req);
     this.calls += 1;
     const started = performance.now();
@@ -21421,18 +21560,18 @@ var WasmProcess = class {
       }
       if (this.writesAt(req) && this.options.readonlyAt?.(path)) throw new KernelError("EROFS");
       const open2 = { ...req, path };
-      const plain2 = this.plainMode(req.mode);
+      const plain3 = this.plainMode(req.mode);
       if (req.exclusive) {
         await nodes.createExclusive(path, this.newOwner(req.mode));
-        if (plain2 !== void 0) await fs.chmod?.(path, plain2);
+        if (plain3 !== void 0) await fs.chmod?.(path, plain3);
         this.fds.installAt(fd, this.openVfsFile(open2, void 0, fs));
       } else if (req.create) {
         await nodes.onEntry(path, async () => {
-          const marks = this.options.owners || plain2 !== void 0;
+          const marks = this.options.owners || plain3 !== void 0;
           const fresh2 = marks && !await present3(fs, path, true);
           this.fds.installAt(fd, this.openVfsFile(open2, await nodes.identify(path), fs));
           await this.fds.get(fd).file.stat?.();
-          if (fresh2 && plain2 !== void 0) await fs.chmod?.(path, plain2);
+          if (fresh2 && plain3 !== void 0) await fs.chmod?.(path, plain3);
           else if (fresh2) {
             await fs.chown?.(path, { ...this.newOwner(req.mode), kind: "new" });
           }
@@ -23575,15 +23714,15 @@ function isRecord(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function serialized(reply) {
-  let plain2;
+  let plain3;
   try {
     const text = JSON.stringify(reply);
-    plain2 = text === void 0 ? void 0 : JSON.parse(text);
+    plain3 = text === void 0 ? void 0 : JSON.parse(text);
   } catch (err) {
     return JSON.stringify(errorReply("EIO", lineOf2(err)));
   }
-  if (!isRecord(plain2)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
-  const { v: _, ...rest2 } = plain2;
+  if (!isRecord(plain3)) return JSON.stringify(errorReply("EIO", "the vault gave no reply"));
+  const { v: _, ...rest2 } = plain3;
   return JSON.stringify({ v: 1, ...rest2 });
 }
 function lineOf2(err) {
@@ -25545,13 +25684,13 @@ function splitWords(text) {
   while (piece.lastIndex < text.length) {
     const m = piece.exec(text);
     if (!m) return void 0;
-    const [, single, double, escaped, plain2, space] = m;
+    const [, single, double, escaped, plain3, space] = m;
     if (space !== void 0) {
       if (word !== void 0) words2.push(word);
       word = void 0;
       continue;
     }
-    word = (word ?? "") + (single ?? (double !== void 0 ? unescaped(double) : escaped ?? plain2));
+    word = (word ?? "") + (single ?? (double !== void 0 ? unescaped(double) : escaped ?? plain3));
   }
   if (word !== void 0) words2.push(word);
   return words2;
@@ -26744,16 +26883,52 @@ var Launcher = class {
     for (const bin of planned?.bins ?? []) await need(g, "exec", bin, R_OK | X_OK);
     if (planned?.target.copy) await need(g, "exec", planned.target.copy, R_OK | X_OK);
   }
-  async checkedPlan(req, { ppid, cred, scope }, fds) {
-    const refused3 = async (err) => {
+  async checkedPlan(req, ctx, fds) {
+    try {
+      return await this.planOrSearch(req, ctx);
+    } catch (err) {
       await fds.closeAll();
-      throw err.code === "EACCES" ? new SpawnError("EACCES") : err;
+      throw err;
+    }
+  }
+  async planOrSearch(req, ctx) {
+    const bare = !req.file.includes("/") && !COMMAND2.test(req.file);
+    try {
+      return await this.planOne(req, ctx);
+    } catch (err) {
+      const code = codeOf7(err);
+      const searched = bare && req.search !== false && (code === "ENOENT" || code === "ENOEXEC");
+      if (!searched || await this.commandAt(req.file, ctx.scope)) throw err;
+      const found = await this.onPath(req, ctx);
+      if (found) return found;
+      throw err;
+    }
+  }
+  async onPath(req, ctx) {
+    const path = req.env.PATH;
+    if (typeof path !== "string") return void 0;
+    let denied2 = false;
+    for (const dir of path.split(":")) {
+      const file = dir === "" ? `./${req.file}` : `${dir.replace(/\/+$/, "")}/${req.file}`;
+      try {
+        return await this.planOne({ ...req, file }, ctx);
+      } catch (err) {
+        const code = codeOf7(err);
+        if (code === "EACCES") denied2 = true;
+        else if (code !== "ENOENT" && code !== "ENOTDIR") throw err;
+      }
+    }
+    if (denied2) throw new SpawnError("EACCES");
+    return void 0;
+  }
+  async planOne(req, { ppid, cred, scope }) {
+    const refused3 = (err) => {
+      throw codeOf7(err) === "EACCES" ? new SpawnError("EACCES") : err;
     };
     const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused3);
     const planned = await this.plan(file, req.argv, req.cwd, scope, req.argv0);
     await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused3);
     if (planned) return planned;
-    await fds.closeAll();
     throw new SpawnError(await this.unrunnable(file, req.cwd, scope));
   }
   async enterable(g, cwd) {
@@ -26920,12 +27095,12 @@ var Launcher = class {
     return `${path}:${st.size}:${st.mtime.getTime()}`;
   }
   verified(path, caller, fs = this.base) {
-    const plain2 = () => fs.readFileBuffer(path);
-    return this.integrity ? this.integrity.read(path, caller, plain2) : plain2();
+    const plain3 = () => fs.readFileBuffer(path);
+    return this.integrity ? this.integrity.read(path, caller, plain3) : plain3();
   }
   keyed(path, caller, asked) {
-    const plain2 = async () => this.base.readFileBuffer(path);
-    return this.integrity ? this.integrity.readKeyed(path, caller, plain2, asked) : plain2().then((bytes) => ({ bytes }));
+    const plain3 = async () => this.base.readFileBuffer(path);
+    return this.integrity ? this.integrity.readKeyed(path, caller, plain3, asked) : plain3().then((bytes) => ({ bytes }));
   }
   cached(cache, key, load) {
     const hit = cache.get(key);
@@ -27122,7 +27297,7 @@ var Launcher = class {
     });
     return {
       source: {
-        read: (path, plain2) => integrity.readSource(path, caller(), plain2),
+        read: (path, plain3) => integrity.readSource(path, caller(), plain3),
         open: (path, real) => integrity.openSource(path, caller(), real)
       }
     };
@@ -28029,9 +28204,9 @@ var Launcher = class {
       }
     );
   }
-  environment(cwd, extra, account, login = false) {
+  environment(cwd, extra, account, login2 = false) {
     const env = {
-      ...login ? networkEnv(this.hostname) : this.env,
+      ...login2 ? networkEnv(this.hostname) : this.env,
       ...userEnv(account, this.pnpmHome),
       PWD: cwd,
       ...extra
@@ -28258,6 +28433,9 @@ var Launcher = class {
 function cronLocks() {
   return globalThis.navigator?.locks;
 }
+function codeOf7(err) {
+  return err?.code;
+}
 
 // src/pin.ts
 function pinScript(url) {