@ai-ecoverse/slicc-kernel 1.135.6 → 1.136.0

package/dist/node.js

@@ -7486,7 +7486,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.135.6" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.136.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -11665,8 +11665,8 @@ var MountFs = class _MountFs {
   }
   async across(from, to, redirects) {
     const moved2 = [await this.through(from), await this.through(to)];
-    const same = moved2[0] === normalizePath(from) && moved2[1] === normalizePath(to);
-    if (same || redirects >= MAX_LINKS7) throw errnoError("EXDEV", `${from} -> ${to}`);
+    const same2 = moved2[0] === normalizePath(from) && moved2[1] === normalizePath(to);
+    if (same2 || redirects >= MAX_LINKS7) throw errnoError("EXDEV", `${from} -> ${to}`);
     return moved2;
   }
   async based(paths, redirects, run2, again) {
@@ -15366,27 +15366,27 @@ function name(dn) {
 function extension(id2, critical, value2) {
   return critical ? seq(oid(id2), TRUE, octets(value2)) : seq(oid(id2), octets(value2));
 }
-function children(der) {
+function children(der2) {
   const out = [];
-  const [, bodyStart, bodyEnd] = header(der, 0);
+  const [, bodyStart, bodyEnd] = header(der2, 0);
   for (let at = bodyStart; at < bodyEnd; ) {
-    const [, , end] = header(der, at);
-    out.push(der.subarray(at, end));
+    const [, , end] = header(der2, at);
+    out.push(der2.subarray(at, end));
     at = end;
   }
   return out;
 }
-function header(der, at) {
-  const tag = der[at];
-  let len = der[at + 1];
+function header(der2, at) {
+  const tag = der2[at];
+  let len = der2[at + 1];
   let start2 = at + 2;
   if (len & 128) {
     const count2 = len & 127;
     len = 0;
-    for (let i = 0; i < count2; i++) len = len * 256 + der[start2 + i];
+    for (let i = 0; i < count2; i++) len = len * 256 + der2[start2 + i];
     start2 += count2;
   }
-  if (start2 + len > der.length) throw new Error("truncated DER");
+  if (start2 + len > der2.length) throw new Error("truncated DER");
   return [tag, start2, start2 + len];
 }
 function contents(element) {
@@ -15475,12 +15475,12 @@ async function certificate(req) {
   const signature = ecdsaDer(await req.sign(tbs));
   return seq(tbs, ECDSA_SHA256, bits(signature));
 }
-function pem(der) {
-  let b64 = "";
-  for (let i = 0; i < der.length; i += 32768) {
-    b64 += String.fromCharCode(...der.subarray(i, i + 32768));
+function pem(der2) {
+  let b642 = "";
+  for (let i = 0; i < der2.length; i += 32768) {
+    b642 += String.fromCharCode(...der2.subarray(i, i + 32768));
   }
-  const lines2 = btoa(b64).match(/.{1,64}/g) ?? [];
+  const lines2 = btoa(b642).match(/.{1,64}/g) ?? [];
   return `-----BEGIN CERTIFICATE-----
 ${lines2.join("\n")}
 -----END CERTIFICATE-----
@@ -15685,6 +15685,32 @@ var TlsEngine = class {
       this.m._free(name2);
     }
   }
+  get chainVerify() {
+    return typeof this.m._tls_chain_verify === "function";
+  }
+  chainFlags(store, chain2, hostname) {
+    const verify = this.m._tls_chain_verify;
+    if (!verify || chain2.length === 0) return void 0;
+    const joined4 = new Uint8Array(chain2.reduce((n, c) => n + c.length, 0));
+    let at = 0;
+    for (const der2 of chain2) {
+      joined4.set(der2, at);
+      at += der2.length;
+    }
+    const name2 = this.put(new TextEncoder().encode(hostname));
+    try {
+      return this.withBytes(joined4, (p) => {
+        const out = this.scratch;
+        this.m.HEAPU8.fill(255, out, out + 4);
+        const ret = verify(store.ptr, p, joined4.length, name2, out);
+        const flags2 = new DataView(this.m.HEAPU8.buffer, out, 4).getUint32(0, true);
+        if (ret === 0) return flags2 === 0 ? 0 : void 0;
+        return ret === 1 && flags2 !== 0 ? flags2 : void 0;
+      });
+    } finally {
+      this.m._free(name2);
+    }
+  }
   verifyInfo(flags2) {
     const m = this.clientModule();
     const n = m._tls_verify_info(flags2, this.scratch, SCRATCH);
@@ -15713,8 +15739,8 @@ var TlsStore = class {
     this.m = m;
     this.ptr = ptr;
   }
-  add(der) {
-    const ret = this.engine.withBytes(der, (p) => this.m._tls_ca_add_der(this.ptr, p, der.length));
+  add(der2) {
+    const ret = this.engine.withBytes(der2, (p) => this.m._tls_ca_add_der(this.ptr, p, der2.length));
     if (ret !== 0) throw this.engine.error(ret, "trust store certificate");
   }
   addBundle(bytes) {
@@ -15743,10 +15769,10 @@ var TlsLeaf = class {
     if (typeof out === "number") throw this.engine.error(out, "leaf public key");
     return out;
   }
-  addCert(der) {
+  addCert(der2) {
     const ret = this.engine.withBytes(
-      der,
-      (ptr) => this.m._tls_leaf_add_cert(this.ptr, ptr, der.length)
+      der2,
+      (ptr) => this.m._tls_leaf_add_cert(this.ptr, ptr, der2.length)
     );
     if (ret !== 0) throw this.engine.error(ret, "leaf certificate");
   }
@@ -15839,8 +15865,8 @@ var TlsSession = class {
     const chain2 = [];
     const count2 = this.c._tls_peer_count(this.ptr);
     for (let i = 0; i < count2; i++) {
-      const der = this.engine.intoScratch((p, max) => this.c._tls_peer_der(this.ptr, i, p, max));
-      if (der instanceof Uint8Array) chain2.push(der);
+      const der2 = this.engine.intoScratch((p, max) => this.c._tls_peer_der(this.ptr, i, p, max));
+      if (der2 instanceof Uint8Array) chain2.push(der2);
     }
     return chain2;
   }
@@ -17781,6 +17807,30 @@ var TARGET = /^[\x21-\x7e]+$/;
 var SESSION_EXIT = /^(tailscale|device:[A-Za-z0-9._:-]+)$/;
 var HOST = /^[a-z0-9.:-]+$/;
 var UNSAFE = /[\r\n\0]/;
+var ANCHOR_ID = /^[A-Za-z0-9+/]{43}=$/;
+function verifiedByOk(f) {
+  if (f.verifiedBy === void 0 || f.verifiedBy === "roots") return f.anchor === void 0;
+  return f.verifiedBy === "anchored" && typeof f.anchor === "string" && ANCHOR_ID.test(f.anchor);
+}
+function anchorsAskable(f) {
+  if (!Object.hasOwn(POSITIONS, f.protocol)) return false;
+  if (typeof f.session !== "string" || !SESSION_ID.test(f.session) || !hostOk(f.host)) return false;
+  if (!Number.isInteger(f.port) || f.port < 1 || f.port > 65535) return false;
+  return typeof f.exit === "string" && SESSION_EXIT.test(f.exit);
+}
+function anchorsRequest(f) {
+  return {
+    v: 1,
+    op: "sessionAnchors",
+    caller: f.stamp,
+    stamp: f.stamp,
+    session: f.session,
+    host: f.host,
+    port: f.port,
+    protocol: f.protocol,
+    exit: f.exit
+  };
+}
 var POSITIONS = {
   http1: (position) => HEADER.test(position),
   smtp: (position) => position === "auth-plain" || position === "auth-login",
@@ -17819,7 +17869,8 @@ function sessionAskable(f, now) {
   if (!Number.isInteger(f.port) || f.port < 1 || f.port > 65535) return false;
   const age = now - f.handshakeAt;
   if (!Number.isFinite(age) || age < 0 || age > SESSION_WINDOW_MS) return false;
-  return typeof f.exit === "string" && SESSION_EXIT.test(f.exit) && scramOk(f) && headOk(f);
+  const exitOk = typeof f.exit === "string" && SESSION_EXIT.test(f.exit);
+  return exitOk && scramOk(f) && verifiedByOk(f) && headOk(f);
 }
 function sessionRequest(f) {
   return {
@@ -17833,6 +17884,8 @@ function sessionRequest(f) {
     protocol: f.protocol,
     position: f.position,
     verified: true,
+    verifiedBy: f.verifiedBy ?? "roots",
+    ...f.verifiedBy === "anchored" ? { anchor: f.anchor } : {},
     handshakeAt: f.handshakeAt,
     exit: f.exit,
     ...f.placeholders ? { placeholders: [...f.placeholders] } : {},
@@ -17861,1852 +17914,1951 @@ function sessionValues(reply, asked) {
   return Object.keys(out).length > 0 ? out : void 0;
 }
 
-// node_modules/@ai-ecoverse/slicc-scrub/dist/index.js
-var FRAGMENT = 16;
-var MIN_VALUE = 8;
-var MIN_BASE64 = 8;
-var encoder5 = new TextEncoder();
-var STD = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-function utf82(text) {
-  return encoder5.encode(text);
+// src/kernel/net/tls-ciphers.ts
+var SUITES = [
+  [4865, "TLS_AES_128_GCM_SHA256", "TLS_AES_128_GCM_SHA256", "TLSv1.3"],
+  [4866, "TLS_AES_256_GCM_SHA384", "TLS_AES_256_GCM_SHA384", "TLSv1.3"],
+  [4867, "TLS_CHACHA20_POLY1305_SHA256", "TLS_CHACHA20_POLY1305_SHA256", "TLSv1.3"],
+  [4868, "TLS_AES_128_CCM_SHA256", "TLS_AES_128_CCM_SHA256", "TLSv1.3"],
+  [4869, "TLS_AES_128_CCM_8_SHA256", "TLS_AES_128_CCM_8_SHA256", "TLSv1.3"],
+  [49195, "ECDHE-ECDSA-AES128-GCM-SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
+  [49196, "ECDHE-ECDSA-AES256-GCM-SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"],
+  [49199, "ECDHE-RSA-AES128-GCM-SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
+  [49200, "ECDHE-RSA-AES256-GCM-SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"],
+  [52392, "ECDHE-RSA-CHACHA20-POLY1305", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLSv1.2"],
+  [
+    52393,
+    "ECDHE-ECDSA-CHACHA20-POLY1305",
+    "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+    "TLSv1.2"
+  ],
+  [49187, "ECDHE-ECDSA-AES128-SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLSv1.2"],
+  [49188, "ECDHE-ECDSA-AES256-SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLSv1.2"],
+  [49191, "ECDHE-RSA-AES128-SHA256", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLSv1.2"],
+  [49192, "ECDHE-RSA-AES256-SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLSv1.2"],
+  [49161, "ECDHE-ECDSA-AES128-SHA", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLSv1.0"],
+  [49162, "ECDHE-ECDSA-AES256-SHA", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLSv1.0"],
+  [49171, "ECDHE-RSA-AES128-SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLSv1.0"],
+  [49172, "ECDHE-RSA-AES256-SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLSv1.0"],
+  [156, "AES128-GCM-SHA256", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
+  [157, "AES256-GCM-SHA384", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"],
+  [158, "DHE-RSA-AES128-GCM-SHA256", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
+  [159, "DHE-RSA-AES256-GCM-SHA384", "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"]
+];
+function cipherOf(id2, protocol) {
+  const known = SUITES.find(([n]) => n === id2);
+  const hex4 = `0x${id2.toString(16).padStart(4, "0").toUpperCase()}`;
+  return {
+    name: known?.[1] ?? hex4,
+    standardName: known?.[2] ?? hex4,
+    version: known?.[3] ?? protocol
+  };
 }
-function base642(bytes, padded = true) {
-  let out = "";
-  for (let i = 0; i < bytes.length; i += 3) {
-    const a = bytes[i];
-    const b = i + 1 < bytes.length ? bytes[i + 1] : 0;
-    const c = i + 2 < bytes.length ? bytes[i + 2] : 0;
-    const triple = a << 16 | b << 8 | c;
-    const left = bytes.length - i;
-    out += STD[triple >> 18 & 63] + STD[triple >> 12 & 63];
-    out += left > 1 ? STD[triple >> 6 & 63] : padded ? "=" : "";
-    out += left > 2 ? STD[triple & 63] : padded ? "=" : "";
-  }
-  return out;
+
+// src/kernel/net/tls-client.ts
+var WRITE_CHUNK = 16 * 1024;
+var BADCERT = [
+  [8, "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"],
+  [1, "CERT_HAS_EXPIRED"],
+  [512, "CERT_NOT_YET_VALID"],
+  [2, "CERT_REVOKED"],
+  [4, "ERR_TLS_CERT_ALTNAME_INVALID"],
+  [2048, "INVALID_PURPOSE"],
+  [4096, "INVALID_PURPOSE"]
+];
+function verifyCode(flags2) {
+  if (flags2 === 0) return void 0;
+  if (flags2 === -1) return "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
+  return BADCERT.find(([bit]) => (flags2 & bit) !== 0)?.[1] ?? "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
 }
-function urlSafe(text) {
-  return text.replace(/\+/g, "-").replace(/\//g, "_");
+function isIP(name2) {
+  return ipv4Bytes(name2) !== void 0 || name2.includes(":") && ipv6Groups(name2) !== void 0;
 }
-function hex2(bytes) {
-  let out = "";
-  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
-  return out;
+function clientFlags(o) {
+  return (o.insecure ? TLS_CLIENT_INSECURE_SKIP_VERIFY : 0) | (o.sni === false ? TLS_CLIENT_NO_SNI : 0) | (o.checkHostname === false ? TLS_CLIENT_VERIFY_CHAIN_ONLY : 0);
 }
-function embedded(bytes, offset) {
-  const shifted = new Uint8Array(offset + bytes.length);
-  shifted.set(bytes, offset);
-  const encoded = base642(shifted);
-  const first = Math.ceil(8 * offset / 6);
-  const last = Math.floor(8 * (offset + bytes.length) / 6);
-  return encoded.slice(first, last);
+function openSession(o) {
+  return o.engine.clientSession(o.store, o.servername, o.alpn, clientFlags(o));
 }
-function unicode(value2, upper) {
-  let out = "";
-  for (let i = 0; i < value2.length; i++) {
-    const unit = value2.charCodeAt(i);
-    if (unit === 34) out += '\\"';
-    else if (unit === 92) out += "\\\\";
-    else if (unit < 32 || unit > 126) {
-      const code = unit.toString(16).padStart(4, "0");
-      out += `\\u${upper ? code.toUpperCase() : code}`;
-    } else out += value2[i];
+var Ciphertext = class {
+  queue = [];
+  ended = false;
+  conn;
+  session;
+  constructor(conn, session) {
+    this.conn = conn;
+    this.session = session;
   }
-  return out;
-}
-function percent(value2) {
-  let component;
-  try {
-    component = encodeURIComponent(value2);
-  } catch {
-    return [];
+  hand(bytes) {
+    if (bytes.length > 0) this.queue.push(bytes);
   }
-  const lower = component.replace(/%[0-9A-F]{2}/g, (escape) => escape.toLowerCase());
-  const plus = component.replace(/%20/g, "+");
-  let form = "";
-  for (const byte of utf82(value2)) {
-    const char = String.fromCharCode(byte);
-    if (/[A-Za-z0-9*\-._]/.test(char)) form += char;
-    else if (byte === 32) form += "+";
-    else form += `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+  async more() {
+    if (this.queue.length === 0 && !this.ended) {
+      const bytes = await this.conn.read();
+      if (bytes) this.queue.push(bytes);
+      else this.ended = true;
+    }
+    if (this.queue.length === 0) {
+      this.session.feedEnd();
+      return false;
+    }
+    while (this.queue.length > 0) {
+      const head = this.queue[0];
+      const n = this.session.feed(head);
+      if (n < head.length) {
+        this.queue[0] = head.subarray(n);
+        break;
+      }
+      this.queue.shift();
+    }
+    return true;
+  }
+};
+async function send(conn, session) {
+  for (; ; ) {
+    const out = session.take();
+    if (out.length === 0) return;
+    for (let at = 0; at < out.length; ) {
+      const n = await conn.write(out.subarray(at));
+      if (!(n > 0)) throw new KernelError("EPIPE");
+      at += n;
+    }
   }
-  return [component, lower, plus, form];
 }
-function html(value2, apostrophe) {
-  return value2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, apostrophe);
+function refused2(engine, session, err) {
+  const flags2 = session.verifyResult;
+  const code = verifyCode(flags2);
+  if (code && flags2 !== -1)
+    return new KernelError("EPROTO", `${code}: ${engine.verifyInfo(flags2).trim()}`);
+  const text = err instanceof TlsError ? err.message : String(err);
+  return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
 }
-function encodings(bytes) {
-  const standard = [base642(bytes), base642(bytes, false)];
-  for (const offset of [0, 1, 2]) {
-    const run2 = embedded(bytes, offset);
-    if (run2.length >= MIN_BASE64) standard.push(run2);
-  }
-  return [...standard, ...standard.map(urlSafe)];
+function alertOf(session) {
+  const alert = session.lastAlert;
+  return alert >= 0 ? ` (alert ${alert})` : "";
 }
-function shapes(value2) {
-  const raw2 = utf82(value2);
-  const seen = /* @__PURE__ */ new Set([value2]);
-  const out = [];
-  if (raw2.length < FRAGMENT) out.push({ bytes: raw2, form: "raw" });
-  for (let offset = 0; raw2.length >= FRAGMENT && offset + FRAGMENT <= raw2.length; offset++) {
-    out.push({ bytes: raw2.subarray(offset, offset + FRAGMENT), form: "fragment", offset });
-  }
-  const add = (text, form) => {
-    if (seen.has(text)) return;
-    seen.add(text);
-    out.push({ bytes: utf82(text), form });
-  };
-  const json5 = JSON.stringify(value2).slice(1, -1);
-  for (const text of [
-    json5,
-    json5.replace(/\//g, "\\/"),
-    unicode(value2, false),
-    unicode(value2, true)
-  ]) {
-    add(text, "json");
+async function handshake(conn, o, session, inbox) {
+  for (; ; ) {
+    let done4;
+    try {
+      done4 = session.handshake();
+    } catch (err) {
+      await send(conn, session).catch(() => void 0);
+      throw refused2(o.engine, session, err);
+    }
+    await send(conn, session);
+    if (done4) return;
+    if (!await inbox.more()) {
+      throw new KernelError(
+        "ECONNRESET",
+        "the server closed the connection during the TLS handshake"
+      );
+    }
   }
-  for (const text of percent(value2)) add(text, "percent");
-  for (const text of [html(value2, "&#39;"), html(value2, "&#x27;")]) add(text, "html");
-  for (const text of encodings(raw2)) add(text, "base64");
-  add(hex2(raw2), "hex");
-  add(hex2(raw2).toUpperCase(), "hex");
-  return out;
 }
-function wrappable(form) {
-  return form === "base64" || form === "hex";
+function insecureOf(session, chain2, shape) {
+  const flags2 = session.verifyResult;
+  const error = chainError(flags2, chain2, shape);
+  return { hostnameMatches: nameMatches(flags2), ...error ? { chainError: error } : {} };
 }
-var Automaton = class {
-  edges = /* @__PURE__ */ new Map();
-  fail = [0];
-  depth = [0];
-  children = [0];
-  out = [[]];
-  dict = [-1];
-  lengths = [];
-  add(bytes) {
-    let node = 0;
-    for (const byte of bytes) {
-      const key = node * 256 + byte;
-      let next3 = this.edges.get(key);
-      if (next3 === void 0) {
-        next3 = this.depth.length;
-        this.edges.set(key, next3);
-        this.fail.push(0);
-        this.depth.push(this.depth[node] + 1);
-        this.children.push(0);
-        this.children[node] += 1;
-        this.out.push([]);
-        this.dict.push(-1);
-      }
-      node = next3;
-    }
-    const id2 = this.lengths.length;
-    this.lengths.push(bytes.length);
-    this.out[node].push(id2);
-    return id2;
-  }
-  build() {
-    const queue = [];
-    const byNode = /* @__PURE__ */ new Map();
-    for (const [key, child] of this.edges) {
-      const parent = Math.floor(key / 256);
-      const list = byNode.get(parent) ?? [];
-      list.push([key % 256, child]);
-      byNode.set(parent, list);
-    }
-    for (const [, child] of byNode.get(0) ?? []) queue.push(child);
-    for (let head = 0; head < queue.length; head++) {
-      const node = queue[head];
-      const fallback = this.fail[node];
-      this.dict[node] = this.out[fallback].length > 0 ? fallback : this.dict[fallback];
-      for (const [byte, child] of byNode.get(node) ?? []) {
-        let state = fallback;
-        let target = this.edges.get(state * 256 + byte);
-        while (target === void 0 && state > 0) {
-          state = this.fail[state];
-          target = this.edges.get(state * 256 + byte);
+function controlsOf(o, session, protocol, chain2, shape) {
+  if (!o.engine.sessionControls) return {};
+  const checked = o.checkHostname !== false && !o.insecure;
+  return {
+    cipher: cipherOf(session.ciphersuite, protocol),
+    clientCertificate: o.clientCertificate === true,
+    sni: o.sni !== false && !isIP(o.servername),
+    hostnameChecked: checked,
+    ...o.insecure ? insecureOf(session, chain2, shape) : { hostnameMatches: checked || !session.nameMismatch }
+  };
+}
+function verdictOf(o, session) {
+  if (o.bundled !== true || isIP(o.servername) || session.verifyResult !== 0) return false;
+  return o.checkHostname !== false || !session.nameMismatch;
+}
+async function infoOf(o, session) {
+  const flags2 = session.verifyResult;
+  const code = verifyCode(flags2);
+  const protocol = session.version === 772 ? "TLSv1.3" : "TLSv1.2";
+  const chain2 = session.peerChain();
+  const shape = await chainShape(o.insecure ? chain2 : []);
+  return {
+    protocol,
+    alpnProtocol: session.alpn ?? false,
+    authorized: code === void 0,
+    ...code ? { authorizationError: code, authorizationText: o.engine.verifyInfo(flags2).trim() } : {},
+    peerCertificates: chain2,
+    ...controlsOf(o, session, protocol, chain2, shape),
+    verified: verdictOf(o, session),
+    handshakeAt: Date.now()
+  };
+}
+var FATAL_ALERT = -30592;
+function alerted(err, session) {
+  if (err.code === FATAL_ALERT)
+    return new KernelError(
+      "EPROTO",
+      `ERR_SSL_FATAL_ALERT: the server ended the session: ${err.message}${alertOf(session)}`
+    );
+  return new KernelError("EPROTO", `ERR_SSL_PROTOCOL_ERROR: ${err.message}`);
+}
+function plaintext(conn, session, inbox) {
+  let freed = false;
+  let writeClosed = false;
+  const free = () => {
+    if (freed) return;
+    freed = true;
+    session.free();
+  };
+  return {
+    localAddr: conn.localAddr,
+    remoteAddr: conn.remoteAddr,
+    async read() {
+      for (; ; ) {
+        if (freed) return null;
+        let got;
+        try {
+          got = session.read();
+        } catch (err) {
+          throw alerted(err, session);
         }
-        this.fail[child] = target ?? 0;
-        queue.push(child);
+        await send(conn, session);
+        if (got instanceof Uint8Array) return got;
+        if (got === "eof") return null;
+        await inbox.more();
       }
+    },
+    async write(bytes) {
+      if (freed) throw new KernelError("EPIPE");
+      for (; ; ) {
+        const n = session.write(bytes.subarray(0, WRITE_CHUNK));
+        await send(conn, session);
+        if (n > 0) return n;
+      }
+    },
+    closeWrite() {
+      if (writeClosed || freed) return;
+      writeClosed = true;
+      session.close();
+      void send(conn, session).catch(() => void 0).finally(() => conn.closeWrite());
+    },
+    close() {
+      free();
+      conn.close();
     }
+  };
+}
+async function tlsClient(conn, o, taken = new Uint8Array(0)) {
+  const session = o.session ?? openSession(o);
+  const inbox = new Ciphertext(conn, session);
+  inbox.hand(taken);
+  try {
+    await handshake(conn, o, session, inbox);
+    const info = await infoOf(o, session);
+    return { conn: plaintext(conn, session, inbox), info };
+  } catch (err) {
+    session.free();
+    throw err;
   }
-  step(state, byte) {
-    let current = state;
-    for (; ; ) {
-      const next3 = this.edges.get(current * 256 + byte);
-      if (next3 !== void 0) return next3;
-      if (current === 0) return 0;
-      current = this.fail[current];
-    }
-  }
-  matches(state, visit) {
-    for (let node = state; node > 0; node = this.dict[node]) {
-      for (const id2 of this.out[node]) visit(id2);
-    }
+}
+
+// src/kernel/net/tls-chain.ts
+var CN_MISMATCH = 4;
+var NOT_TRUSTED = 8;
+function tlv2(der2, at) {
+  if (at + 2 > der2.length) return void 0;
+  const first = der2[at + 1];
+  let body = at + 2;
+  let length2 = first;
+  if (first & 128) {
+    const n = first & 127;
+    if (n === 0 || n > 4 || body + n > der2.length) return void 0;
+    length2 = 0;
+    for (let i = 0; i < n; i++) length2 = length2 * 256 + der2[body + i];
+    body += n;
   }
-  partials(state, length2, visit) {
-    for (let node = state; node > 0; node = this.fail[node]) {
-      if (this.children[node] > 0) visit(length2 - this.depth[node]);
-    }
+  const end = body + length2;
+  return end > der2.length ? void 0 : { start: at, body, end };
+}
+function children2(der2, outer, max) {
+  const fields = [];
+  for (let at = outer.body; at < outer.end && fields.length < max; ) {
+    const field4 = tlv2(der2, at);
+    if (!field4) return void 0;
+    fields.push(field4);
+    at = field4.end;
   }
+  return fields;
+}
+function tbsFields(der2) {
+  const outer = tlv2(der2, 0);
+  const cert = outer && children2(der2, outer, 3);
+  const tbs = cert?.[0] && children2(der2, cert[0], 8);
+  if (!cert || !tbs) return void 0;
+  return { cert, tbs: der2[tbs[0]?.start ?? 0] === 160 ? tbs.slice(1) : tbs };
+}
+var raw = (der2, t) => der2.subarray(t.start, t.end);
+function spkiOf(der2) {
+  const spki = tbsFields(der2)?.tbs[5];
+  return spki ? raw(der2, spki) : void 0;
+}
+function names(der2) {
+  const fields = tbsFields(der2)?.tbs;
+  const [, , issuer, , subject] = fields ?? [];
+  if (!issuer || !subject) return void 0;
+  return [raw(der2, issuer), raw(der2, subject)];
+}
+var hex2 = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+var HASHES = {
+  "2a864886f70d01010b": ["RSASSA-PKCS1-v1_5", "SHA-256"],
+  "2a864886f70d01010c": ["RSASSA-PKCS1-v1_5", "SHA-384"],
+  "2a864886f70d01010d": ["RSASSA-PKCS1-v1_5", "SHA-512"],
+  "2a8648ce3d040302": ["ECDSA", "SHA-256"],
+  "2a8648ce3d040303": ["ECDSA", "SHA-384"],
+  "2a8648ce3d040304": ["ECDSA", "SHA-512"],
+  "2b6570": ["Ed25519", ""],
+  "2a864886f70d01010a": ["RSA-PSS", "SHA-1"]
 };
-var RANK = {
-  raw: 0,
-  fragment: 1,
-  json: 2,
-  percent: 3,
-  html: 4,
-  base64: 5,
-  hex: 6,
-  wrapped: 7
+var PSS_HASHES = {
+  "2b0e03021a": "SHA-1",
+  "608648016503040201": "SHA-256",
+  "608648016503040202": "SHA-384",
+  "608648016503040203": "SHA-512"
 };
-var CR2 = 13;
-var LF2 = 10;
-var EMPTY3 = new Uint8Array(0);
-function register(automaton, sources, ids, bytes, source) {
-  const key = Array.from(bytes).join(",");
-  let id2 = ids.get(key);
-  if (id2 === void 0) {
-    id2 = automaton.add(bytes);
-    ids.set(key, id2);
-    sources[id2] = [];
+function pssOf(der2, algorithm) {
+  const params = children2(der2, algorithm, 2)?.[1];
+  let hash = "SHA-1";
+  let salt = 20;
+  for (const field4 of params && der2[params.start] === 48 ? children2(der2, params, 3) ?? [] : []) {
+    const inner = tlv2(der2, field4.body);
+    if (!inner) return void 0;
+    if (der2[field4.start] === 160) {
+      const known = PSS_HASHES[oidOf(der2, inner) ?? ""];
+      if (!known) return void 0;
+      hash = known;
+    } else if (der2[field4.start] === 162) {
+      salt = der2.subarray(inner.body, inner.end).reduce((n, b) => n * 256 + b, 0);
+    }
   }
-  sources[id2].push(source);
+  return { hash, salt };
 }
-function prepare(secrets) {
-  const main = new Automaton();
-  const wrap = new Automaton();
-  const sources = [];
-  const wrapSources = [];
-  const ids = /* @__PURE__ */ new Map();
-  const wrapIds = /* @__PURE__ */ new Map();
-  const values = secrets.map((secret) => utf82(secret.value));
-  secrets.forEach((secret, index) => {
-    if (typeof secret.value !== "string" || values[index].length < MIN_VALUE) {
-      throw new RangeError(`the value of ${secret.name} is shorter than ${MIN_VALUE} bytes`);
-    }
-    for (const shape of shapes(secret.value)) {
-      const source = { secret: index, form: shape.form, offset: shape.offset };
-      register(main, sources, ids, shape.bytes, source);
-      if (wrappable(shape.form)) register(wrap, wrapSources, wrapIds, shape.bytes, source);
-    }
-  });
-  main.build();
-  wrap.build();
-  const replacements = secrets.map((secret) => [
-    utf82(secret.placeholder),
-    utf82(`[redacted:${secret.name}]`)
-  ]);
-  return { secrets, values, main, wrap, sources, wrapSources, replacements };
+var CURVES = {
+  "2a8648ce3d030107": ["P-256", 32],
+  "2b81040022": ["P-384", 48],
+  "2b81040023": ["P-521", 66]
+};
+function oidOf(der2, algorithm, index = 0) {
+  const parts2 = children2(der2, algorithm, 2);
+  const oid2 = parts2?.[index];
+  return oid2 && der2[oid2.start] === 6 ? hex2(der2.subarray(oid2.body, oid2.end)) : void 0;
 }
-function better(a, b) {
-  if (!b) return true;
-  if (a.end !== b.end) return a.end > b.end;
-  if (a.rank !== b.rank) return a.rank < b.rank;
-  return a.secret < b.secret;
+function curveOf(der2, spki) {
+  const algorithm = children2(der2, spki, 1)?.[0];
+  const curve = algorithm && oidOf(der2, algorithm, 1);
+  return curve ? CURVES[curve] : void 0;
 }
-function resolve(c, input, start2, end, source) {
-  if (source.form !== "fragment") {
-    return {
-      start: start2,
-      end,
-      secret: source.secret,
-      form: source.form,
-      rank: RANK[source.form],
-      growing: false
-    };
-  }
-  const value2 = c.values[source.secret];
-  let stop = end;
-  let at = source.offset + FRAGMENT;
-  while (stop < input.length && at < value2.length && input[stop] === value2[at]) {
-    stop++;
-    at++;
+function fixedEcdsa(sig, size) {
+  const outer = tlv2(sig, 0);
+  const ints = outer && children2(sig, outer, 2);
+  if (ints?.length !== 2) return void 0;
+  const out = new Uint8Array(size * 2);
+  for (const [i, int] of ints.entries()) {
+    let value2 = sig.subarray(int.body, int.end);
+    while (value2.length > size && value2[0] === 0) value2 = value2.subarray(1);
+    if (value2.length > size) return void 0;
+    out.set(value2, (i + 1) * size - value2.length);
   }
-  const form = source.offset === 0 && at === value2.length ? "raw" : "fragment";
-  const growing = stop === input.length && at < value2.length;
-  return { start: start2, end: stop, secret: source.secret, form, rank: RANK[form], growing };
+  return out;
 }
-function keep(best, candidate) {
-  if (better(candidate, best.get(candidate.start))) best.set(candidate.start, candidate);
+function signedOf(der2) {
+  const parts2 = tbsFields(der2);
+  const [tbs, algorithm, value2] = parts2?.cert ?? [];
+  const spki = parts2?.tbs[5];
+  if (!tbs || !algorithm || !value2 || !spki || der2[value2.start] !== 3) return void 0;
+  const known = HASHES[oidOf(der2, algorithm) ?? ""];
+  if (!known) return void 0;
+  const [scheme] = known;
+  const pss = scheme === "RSA-PSS" ? pssOf(der2, algorithm) : void 0;
+  if (scheme === "RSA-PSS" && !pss) return void 0;
+  const hash = pss?.hash ?? known[1];
+  const curve = scheme === "ECDSA" ? curveOf(der2, spki) : void 0;
+  if (scheme === "ECDSA" && !curve) return void 0;
+  const signature = der2.subarray(value2.body + 1, value2.end);
+  return {
+    tbs: raw(der2, tbs),
+    spki: raw(der2, spki),
+    signature,
+    scheme,
+    hash,
+    ...curve ? { curve } : {},
+    ...pss ? { salt: pss.salt } : {}
+  };
 }
-function scanMain(c, input, best, partials) {
-  let state = 0;
-  for (let i = 0; i < input.length; i++) {
-    state = c.main.step(state, input[i]);
-    c.main.matches(state, (id2) => {
-      const start2 = i + 1 - c.main.lengths[id2];
-      for (const source of c.sources[id2]) {
-        const candidate = resolve(c, input, start2, i + 1, source);
-        if (candidate.growing) partials.push(candidate.start);
-        keep(best, candidate);
-      }
-    });
-  }
-  c.main.partials(state, input.length, (start2) => partials.push(start2));
+async function verifiesItself(s) {
+  const name2 = s.curve?.[0];
+  const algorithm = s.scheme === "ECDSA" ? { name: "ECDSA", namedCurve: name2 } : s.hash ? { name: s.scheme, hash: s.hash } : { name: s.scheme };
+  const key = await crypto.subtle.importKey("spki", new Uint8Array(s.spki), algorithm, false, [
+    "verify"
+  ]);
+  const signature = s.curve ? fixedEcdsa(s.signature, s.curve[1]) : s.signature;
+  if (!signature) return false;
+  const params = s.scheme === "ECDSA" ? { name: "ECDSA", hash: s.hash } : s.salt === void 0 ? { name: s.scheme } : { name: s.scheme, saltLength: s.salt };
+  return crypto.subtle.verify(params, key, new Uint8Array(signature), new Uint8Array(s.tbs));
 }
-function scanWrapped(c, input, best, partials) {
-  const map = [];
-  for (let i = 0; i < input.length; i++) if (input[i] !== CR2 && input[i] !== LF2) map.push(i);
-  if (map.length === input.length) return;
-  let state = 0;
-  for (let v = 0; v < map.length; v++) {
-    state = c.wrap.step(state, input[map[v]]);
-    c.wrap.matches(state, (id2) => {
-      const first = v + 1 - c.wrap.lengths[id2];
-      const start2 = map[first];
-      const end = map[v] + 1;
-      const wrapped = end - start2 !== c.wrap.lengths[id2];
-      for (const source of c.wrapSources[id2]) {
-        const form = wrapped ? "wrapped" : source.form;
-        keep(best, { start: start2, end, secret: source.secret, form, rank: RANK[form], growing: false });
-      }
-    });
-  }
-  c.wrap.partials(state, map.length, (start2) => partials.push(map[start2]));
+async function selfSigned(der2) {
+  if (!selfIssued(der2)) return false;
+  const signed = signedOf(der2);
+  if (!signed) return false;
+  return verifiesItself(signed).catch(() => false);
 }
-function count(c, hits, candidate) {
-  const name2 = c.secrets[candidate.secret].name;
-  const key = `${name2}\0${candidate.form}`;
-  const hit = hits.get(key) ?? { name: name2, form: candidate.form, count: 0 };
-  hit.count += 1;
-  hits.set(key, hit);
+async function chainShape(chain2) {
+  return {
+    leafSelfSigned: chain2.length === 1 && await selfSigned(chain2[0]),
+    topSelfSigned: chain2.length > 1 && await selfSigned(chain2.at(-1))
+  };
 }
-function concat6(parts2) {
-  let length2 = 0;
-  for (const part of parts2) length2 += part.length;
-  const out = new Uint8Array(length2);
-  let at = 0;
-  for (const part of parts2) {
-    out.set(part, at);
-    at += part.length;
-  }
-  return out;
+function selfIssued(der2) {
+  const pair = der2 && names(der2);
+  if (!pair) return false;
+  const [issuer, subject] = pair;
+  return issuer.length === subject.length && issuer.every((b, i) => b === subject[i]);
 }
-function pass(c, input, final) {
-  const best = /* @__PURE__ */ new Map();
-  const partials = [];
-  scanMain(c, input, best, partials);
-  scanWrapped(c, input, best, partials);
-  const holds2 = final ? [] : [...new Set(partials)].sort((a, b) => a - b);
-  const starts = [...best.keys()].sort((a, b) => a - b);
-  const parts2 = [];
-  const hits = /* @__PURE__ */ new Map();
-  let pos = 0;
-  let cut = input.length;
-  let s = 0;
-  let h = 0;
-  for (; ; ) {
-    while (s < starts.length && starts[s] < pos) s++;
-    while (h < holds2.length && holds2[h] < pos) h++;
-    const hold = h < holds2.length ? holds2[h] : Infinity;
-    const next3 = s < starts.length ? starts[s] : Infinity;
-    if (hold <= next3) {
-      cut = Math.min(hold, input.length);
-      break;
-    }
-    const candidate = best.get(next3);
-    parts2.push(
-      input.subarray(pos, next3),
-      c.replacements[candidate.secret][candidate.form === "raw" ? 0 : 1]
-    );
-    count(c, hits, candidate);
-    pos = candidate.end;
+function untrusted(chain2, shape) {
+  if (chain2.length === 1) {
+    return shape.leafSelfSigned ? "DEPTH_ZERO_SELF_SIGNED_CERT" : "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
   }
-  parts2.push(input.subarray(pos, cut));
-  return { output: concat6(parts2), cut, hits };
+  return shape.topSelfSigned ? "SELF_SIGNED_CERT_IN_CHAIN" : "UNABLE_TO_GET_ISSUER_CERT_LOCALLY";
 }
-function merge(into, from) {
-  for (const [key, hit] of from) {
-    const known = into.get(key);
-    if (known) known.count += hit.count;
-    else into.set(key, { ...hit });
-  }
+function chainError(flags2, chain2, shape) {
+  if (flags2 === -1) return "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
+  const rest2 = flags2 & ~CN_MISMATCH;
+  if (rest2 === 0) return void 0;
+  if (rest2 & NOT_TRUSTED) return untrusted(chain2, shape);
+  return verifyCode(rest2);
 }
-function compile(secrets, options = {}) {
-  const c = prepare(secrets.map((secret) => ({ ...secret })));
-  const decoder4 = new TextDecoder();
-  const idleMs = options.idleMs ?? 250;
-  const scrubBytes = (input) => {
-    if (c.secrets.length === 0) return { bytes: input.slice(), hits: [] };
-    const result = pass(c, input, true);
-    return { bytes: result.output, hits: [...result.hits.values()] };
-  };
-  return {
-    version: options.version ?? 0,
-    idleMs,
-    size: c.main.lengths.length,
-    bytes: scrubBytes,
-    text(input) {
-      const { bytes, hits } = scrubBytes(utf82(input));
-      return { text: decoder4.decode(bytes), hits };
-    },
-    stream() {
-      let pending = EMPTY3;
-      const hits = /* @__PURE__ */ new Map();
-      const run2 = (final) => {
-        if (c.secrets.length === 0 || pending.length === 0) {
-          const out = pending;
-          pending = EMPTY3;
-          return out;
-        }
-        const result = pass(c, pending, final);
-        merge(hits, result.hits);
-        pending = pending.slice(result.cut);
-        return result.output;
-      };
-      return {
-        push(chunk2) {
-          pending = concat6([pending, chunk2]);
-          return run2(false);
-        },
-        idle() {
-          return pending.length < FRAGMENT ? run2(true) : EMPTY3;
-        },
-        end() {
-          return run2(true);
-        },
-        get hits() {
-          return [...hits.values()];
-        }
-      };
-    }
-  };
+function nameMatches(flags2) {
+  return flags2 !== -1 && (flags2 & CN_MISMATCH) === 0;
 }
 
-// src/kernel/scrub-file.ts
-var SCRUB_IDLE_MS = 50;
-var SCRUB_NONBLOCK_MAX = 64 * 1024;
-var encoder6 = new TextEncoder();
-function scrubberOf(secrets) {
-  const usable2 = secrets.filter((s) => encoder6.encode(s.value).length >= MIN_VALUE);
-  return usable2.length > 0 ? compile(usable2, { idleMs: SCRUB_IDLE_MS }) : void 0;
+// src/kernel/net/sealed-anchor.ts
+var ANCHORS_MAX = 64;
+var ANCHOR_BYTES_MAX = 8 * 1024;
+var NOT_TRUSTED2 = 8;
+var PIN = /^[A-Za-z0-9+/]{43}=$/;
+function b64(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
 }
-async function writeAll3(file, bytes) {
-  const write = file.write;
-  for (let at = 0; at < bytes.length; ) at += await write.call(file, bytes.subarray(at));
+function der(text) {
+  if (typeof text !== "string" || text.length === 0 || text.length > ANCHOR_BYTES_MAX * 4 / 3 + 4)
+    return void 0;
+  try {
+    return Uint8Array.from(atob(text), (c) => c.charCodeAt(0));
+  } catch {
+    return void 0;
+  }
 }
-function bound(file, key) {
-  const method = file[key];
-  return typeof method === "function" ? { [key]: method.bind(file) } : {};
+function anchorsOf(reply) {
+  if (typeof reply !== "object" || reply === null || Array.isArray(reply)) return void 0;
+  const r = reply;
+  if (r.error !== void 0 || !Array.isArray(r.anchors) || !Array.isArray(r.pins))
+    return void 0;
+  if (r.anchors.length + r.pins.length > ANCHORS_MAX) return void 0;
+  const anchors = r.anchors.map(der);
+  if (anchors.some((a) => a === void 0)) return void 0;
+  if (!r.pins.every((p) => typeof p === "string" && PIN.test(p))) return void 0;
+  return { anchors, pins: r.pins };
+}
+async function sha2563(bytes) {
+  return b64(
+    new Uint8Array(await crypto.subtle.digest("SHA-256", bytes))
+  );
 }
-function interrupted2(err) {
-  const code = err?.code;
-  return code === "EINTR" || code === "EAGAIN";
+function same(a, b) {
+  return a.length === b.length && a.every((x, i) => x === b[i]);
 }
-function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
-  const file = inner.file;
-  const stream2 = scrubber.stream();
-  let tail2 = Promise.resolve();
-  let pending = 0;
-  let busy = false;
-  let timer;
-  let failed3;
-  const waiters = /* @__PURE__ */ new Set();
-  const quiet3 = () => !busy && pending === 0;
-  const wake = () => {
-    for (const waiter of [...waiters]) waiter();
-  };
-  const raise = () => {
-    if (failed3 === void 0) return;
-    const err = failed3;
-    failed3 = void 0;
-    throw err;
-  };
-  const later = (bytes) => {
-    if (bytes.length === 0) return;
-    pending += 1;
-    tail2 = tail2.then(() => writeAll3(file, bytes)).catch((err) => {
-      if (failed3 === void 0) failed3 = err;
-    }).finally(() => {
-      pending -= 1;
-      if (quiet3()) wake();
-    });
-  };
-  const settling = (signal) => new Promise((resolve2, reject) => {
-    const done4 = () => {
-      waiters.delete(done4);
-      signal?.removeEventListener("abort", stop);
-      resolve2();
-    };
-    const stop = () => {
-      waiters.delete(done4);
-      reject(new KernelError("EINTR"));
-    };
-    if (signal?.aborted) return stop();
-    waiters.add(done4);
-    signal?.addEventListener("abort", stop, { once: true });
-  });
-  const settled = async () => {
-    while (!quiet3()) await settling();
-  };
-  const changed = async (signal) => {
-    const round = new AbortController();
-    const stop = signal ? AbortSignal.any([signal, round.signal]) : round.signal;
-    try {
-      const own = settling(stop);
-      await Promise.race(file.changed ? [own, file.changed(stop)] : [own]);
-    } catch (err) {
-      throw signal?.aborted ? new KernelError("EINTR") : err;
-    } finally {
-      round.abort();
-    }
-  };
-  const turn = async (signal) => {
-    for (let waited = false; ; waited = true) {
-      if (quiet3() && (pollFile(file).writable || !file.changed)) {
-        busy = true;
-        return;
-      }
-      if (signal?.aborted) throw new KernelError(waited ? "EINTR" : "EAGAIN");
-      await changed(signal);
-    }
-  };
-  const send2 = async (out, signal) => {
-    const write = file.write;
-    for (let at = 0; at < out.length; ) {
-      try {
-        at += await write.call(file, out.subarray(at), signal);
-      } catch (err) {
-        if (!signal?.aborted || !interrupted2(err)) throw err;
-      }
-      if (at < out.length && signal?.aborted) return later(out.subarray(at));
-    }
-  };
-  const release = () => {
-    timer = void 0;
-    later(stream2.idle());
-  };
-  return new OpenFile({
-    ...bound(file, "read"),
-    ...bound(file, "peek"),
-    ...bound(file, "stat"),
-    poll: () => {
-      const state = pollFile(file);
-      return quiet3() ? state : { ...state, writable: false };
-    },
-    changed,
-    ...file.tty ? { tty: file.tty } : {},
-    identity: file.identity ?? file,
-    ...file.clipboard ? { clipboard: file.clipboard } : {},
-    ...file.write ? {
-      write: async (bytes, signal) => {
-        await turn(signal);
-        const taken = signal?.aborted && bytes.length > SCRUB_NONBLOCK_MAX ? bytes.subarray(0, SCRUB_NONBLOCK_MAX) : bytes;
-        try {
-          raise();
-          if (timer !== void 0) clearTimeout(timer);
-          timer = void 0;
-          await send2(stream2.push(taken), signal);
-        } finally {
-          busy = false;
-          if (quiet3()) wake();
-        }
-        timer = setTimeout(release, idleMs);
-        return taken.length;
-      }
-    } : {},
-    flush: async () => {
-      await settled();
-      raise();
-      await file.flush?.();
-    },
-    close: async () => {
-      if (timer !== void 0) clearTimeout(timer);
-      let failure;
-      try {
-        await settled();
-        later(stream2.end());
-        await settled();
-        raise();
-      } catch (err) {
-        failure = { err };
-      }
-      await inner.release();
-      if (failure) throw failure.err;
-    }
-  });
+function flagsWith(engine, anchor, chain2, host) {
+  const store = engine.store();
+  try {
+    if (anchor) store.add(anchor);
+    return engine.chainFlags(store, chain2, host);
+  } catch {
+    return void 0;
+  } finally {
+    store.release();
+  }
 }
-function scrubbedAll(file, scrubbers) {
-  return scrubbers.reduce((inner, scrubber) => scrubbed(inner, scrubber), file);
+function leafPinned(engine, leaf, host) {
+  const flags2 = flagsWith(engine, void 0, [leaf], host);
+  return flags2 !== void 0 && (flags2 & ~NOT_TRUSTED2) === 0;
 }
-function stdioFiles(fds) {
-  const files = /* @__PURE__ */ new Set();
-  for (const fd of [1, 2]) {
-    try {
-      files.add(fds.get(fd));
-    } catch {
-    }
-  }
-  return files;
+function issuedBy(engine, anchor, chain2, host) {
+  return flagsWith(engine, anchor, chain2, host) === 0;
 }
-function scrubStdio(fds, scrubber) {
-  const wrapped = /* @__PURE__ */ new Map();
-  const stdio = stdioFiles(fds);
-  for (const fd of fds.numbers()) {
-    const original = fds.get(fd);
-    if (!stdio.has(original) && !original.file.tty && !original.file.clipboard) continue;
-    const known = wrapped.get(original);
-    const flags2 = fds.statusFlags(fd);
-    const wrapper = known ? known.retain() : scrubbed(original.retain(), scrubber);
-    wrapped.set(original, wrapper);
-    fds.installAt(fd, wrapper);
-    if (flags2 !== void 0) fds.setStatusFlags(fd, flags2);
+async function anchorFor(engine, chain2, host, found) {
+  const leaf = chain2[0];
+  if (!leaf || !engine.chainVerify) return void 0;
+  for (const anchor of found.anchors) {
+    const ok4 = same(anchor, leaf) ? leafPinned(engine, leaf, host) : issuedBy(engine, anchor, chain2, host);
+    if (ok4) return sha2563(anchor);
   }
+  for (const [i, cert] of chain2.entries()) {
+    const spki = spkiOf(cert);
+    if (!spki || !found.pins.includes(await sha2563(spki))) continue;
+    const ok4 = i === 0 ? leafPinned(engine, leaf, host) : issuedBy(engine, cert, chain2, host);
+    if (ok4) return sha2563(spki);
+  }
+  return void 0;
 }
 
-// src/kernel/net/sealed-http1.ts
-var HTTP1_METHODS = [
-  "GET",
-  "HEAD",
-  "POST",
-  "PUT",
-  "DELETE",
-  "PATCH",
-  "OPTIONS",
-  "CONNECT",
-  "TRACE"
-];
-var HEAD_MAX = 16 * 1024;
-var ANY_PLACEHOLDER = /fnox_proxy_[0-9a-f]{24}/g;
-var REQUEST_LINE2 = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+) ([\x21-\x7e]+) HTTP\/1\.[01]$/;
-var HEADER_LINE = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+):[ \t]*(.*?)[ \t]*$/;
-var BASIC = /^(Basic[ \t]+)([A-Za-z0-9+/]+={0,2})$/i;
-var encoder7 = new TextEncoder();
-function binary(text) {
+// node_modules/@ai-ecoverse/slicc-scrub/dist/index.js
+var FRAGMENT = 16;
+var MIN_VALUE = 8;
+var MIN_BASE64 = 8;
+var encoder5 = new TextEncoder();
+var STD = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function utf82(text) {
+  return encoder5.encode(text);
+}
+function base642(bytes, padded = true) {
   let out = "";
-  for (const b of encoder7.encode(text)) out += String.fromCharCode(b);
+  for (let i = 0; i < bytes.length; i += 3) {
+    const a = bytes[i];
+    const b = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const c = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    const triple = a << 16 | b << 8 | c;
+    const left = bytes.length - i;
+    out += STD[triple >> 18 & 63] + STD[triple >> 12 & 63];
+    out += left > 1 ? STD[triple >> 6 & 63] : padded ? "=" : "";
+    out += left > 2 ? STD[triple & 63] : padded ? "=" : "";
+  }
   return out;
 }
-function sniffHttp1(start2) {
-  for (const method of HTTP1_METHODS) {
-    const word = `${method} `;
-    if (start2.startsWith(word)) return "yes";
-    if (word.startsWith(start2)) return "more";
+function urlSafe(text) {
+  return text.replace(/\+/g, "-").replace(/\//g, "_");
+}
+function hex3(bytes) {
+  let out = "";
+  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+  return out;
+}
+function embedded(bytes, offset) {
+  const shifted = new Uint8Array(offset + bytes.length);
+  shifted.set(bytes, offset);
+  const encoded = base642(shifted);
+  const first = Math.ceil(8 * offset / 6);
+  const last = Math.floor(8 * (offset + bytes.length) / 6);
+  return encoded.slice(first, last);
+}
+function unicode(value2, upper) {
+  let out = "";
+  for (let i = 0; i < value2.length; i++) {
+    const unit = value2.charCodeAt(i);
+    if (unit === 34) out += '\\"';
+    else if (unit === 92) out += "\\\\";
+    else if (unit < 32 || unit > 126) {
+      const code = unit.toString(16).padStart(4, "0");
+      out += `\\u${upper ? code.toUpperCase() : code}`;
+    } else out += value2[i];
   }
-  return "no";
+  return out;
 }
-function basicOf(value2) {
-  const m = BASIC.exec(value2);
-  if (!m) return void 0;
+function percent(value2) {
+  let component;
   try {
-    return { scheme: m[1], decoded: atob(m[2]) };
+    component = encodeURIComponent(value2);
   } catch {
-    return void 0;
+    return [];
+  }
+  const lower = component.replace(/%[0-9A-F]{2}/g, (escape) => escape.toLowerCase());
+  const plus = component.replace(/%20/g, "+");
+  let form = "";
+  for (const byte of utf82(value2)) {
+    const char = String.fromCharCode(byte);
+    if (/[A-Za-z0-9*\-._]/.test(char)) form += char;
+    else if (byte === 32) form += "+";
+    else form += `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
   }
+  return [component, lower, plus, form];
 }
-function placeholdersIn(text) {
-  return [...new Set(text.match(ANY_PLACEHOLDER) ?? [])];
+function html(value2, apostrophe) {
+  return value2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, apostrophe);
 }
-function scan(lines2) {
-  const found = [];
-  for (let i = 1; i < lines2.length; i++) {
-    const m = HEADER_LINE.exec(lines2[i]);
-    if (!m) return void 0;
-    const value2 = m[2];
-    const basic = basicOf(value2);
-    const placeholders = placeholdersIn(basic ? basic.decoded : value2);
-    if (placeholders.length > 0)
-      found.push({ line: i, name: m[1].toLowerCase(), value: value2, basic, placeholders });
+function encodings(bytes) {
+  const standard = [base642(bytes), base642(bytes, false)];
+  for (const offset of [0, 1, 2]) {
+    const run2 = embedded(bytes, offset);
+    if (run2.length >= MIN_BASE64) standard.push(run2);
   }
-  return found;
+  return [...standard, ...standard.map(urlSafe)];
 }
-function replaced(text, values) {
-  let out = text;
-  for (const [ph, value2] of Object.entries(values)) out = out.split(ph).join(binary(value2));
+function shapes(value2) {
+  const raw2 = utf82(value2);
+  const seen = /* @__PURE__ */ new Set([value2]);
+  const out = [];
+  if (raw2.length < FRAGMENT) out.push({ bytes: raw2, form: "raw" });
+  for (let offset = 0; raw2.length >= FRAGMENT && offset + FRAGMENT <= raw2.length; offset++) {
+    out.push({ bytes: raw2.subarray(offset, offset + FRAGMENT), form: "fragment", offset });
+  }
+  const add = (text, form) => {
+    if (seen.has(text)) return;
+    seen.add(text);
+    out.push({ bytes: utf82(text), form });
+  };
+  const json5 = JSON.stringify(value2).slice(1, -1);
+  for (const text of [
+    json5,
+    json5.replace(/\//g, "\\/"),
+    unicode(value2, false),
+    unicode(value2, true)
+  ]) {
+    add(text, "json");
+  }
+  for (const text of percent(value2)) add(text, "percent");
+  for (const text of [html(value2, "&#39;"), html(value2, "&#x27;")]) add(text, "html");
+  for (const text of encodings(raw2)) add(text, "base64");
+  add(hex3(raw2), "hex");
+  add(hex3(raw2).toUpperCase(), "hex");
   return out;
 }
-function usable(values) {
-  const out = {};
-  for (const [ph, value2] of Object.entries(values ?? {}))
-    if (encoder7.encode(value2).length >= MIN_VALUE) out[ph] = value2;
-  return out;
+function wrappable(form) {
+  return form === "base64" || form === "hex";
 }
-async function substituteHead(head, ask) {
-  if (!head.endsWith("\r\n\r\n")) return void 0;
-  const lines2 = head.slice(0, -4).split("\r\n");
-  if (lines2.some((l) => l.includes("\n") || l.includes("\r"))) return void 0;
-  const request = REQUEST_LINE2.exec(lines2[0]);
-  const found = request ? scan(lines2) : void 0;
-  if (!request || !found || found.length !== 1) return void 0;
-  const at = found[0];
-  if (at.placeholders.length > SESSION_PLACEHOLDERS) return void 0;
-  const values = usable(
-    await ask(`header:${at.name}`, at.placeholders, {
-      method: request[1],
-      path: request[2]
-    })
-  );
-  if (Object.keys(values).length === 0) return void 0;
-  const value2 = at.basic ? `${at.basic.scheme}${btoa(replaced(at.basic.decoded, values))}` : replaced(at.value, values);
-  const out = [...lines2];
-  out[at.line] = `${lines2[at.line].split(":")[0]}: ${value2}`;
-  return { head: `${out.join("\r\n")}\r
-\r
-`, values };
+var Automaton = class {
+  edges = /* @__PURE__ */ new Map();
+  fail = [0];
+  depth = [0];
+  children = [0];
+  out = [[]];
+  dict = [-1];
+  lengths = [];
+  add(bytes) {
+    let node = 0;
+    for (const byte of bytes) {
+      const key = node * 256 + byte;
+      let next3 = this.edges.get(key);
+      if (next3 === void 0) {
+        next3 = this.depth.length;
+        this.edges.set(key, next3);
+        this.fail.push(0);
+        this.depth.push(this.depth[node] + 1);
+        this.children.push(0);
+        this.children[node] += 1;
+        this.out.push([]);
+        this.dict.push(-1);
+      }
+      node = next3;
+    }
+    const id2 = this.lengths.length;
+    this.lengths.push(bytes.length);
+    this.out[node].push(id2);
+    return id2;
+  }
+  build() {
+    const queue = [];
+    const byNode = /* @__PURE__ */ new Map();
+    for (const [key, child] of this.edges) {
+      const parent = Math.floor(key / 256);
+      const list = byNode.get(parent) ?? [];
+      list.push([key % 256, child]);
+      byNode.set(parent, list);
+    }
+    for (const [, child] of byNode.get(0) ?? []) queue.push(child);
+    for (let head = 0; head < queue.length; head++) {
+      const node = queue[head];
+      const fallback = this.fail[node];
+      this.dict[node] = this.out[fallback].length > 0 ? fallback : this.dict[fallback];
+      for (const [byte, child] of byNode.get(node) ?? []) {
+        let state = fallback;
+        let target = this.edges.get(state * 256 + byte);
+        while (target === void 0 && state > 0) {
+          state = this.fail[state];
+          target = this.edges.get(state * 256 + byte);
+        }
+        this.fail[child] = target ?? 0;
+        queue.push(child);
+      }
+    }
+  }
+  step(state, byte) {
+    let current = state;
+    for (; ; ) {
+      const next3 = this.edges.get(current * 256 + byte);
+      if (next3 !== void 0) return next3;
+      if (current === 0) return 0;
+      current = this.fail[current];
+    }
+  }
+  matches(state, visit) {
+    for (let node = state; node > 0; node = this.dict[node]) {
+      for (const id2 of this.out[node]) visit(id2);
+    }
+  }
+  partials(state, length2, visit) {
+    for (let node = state; node > 0; node = this.fail[node]) {
+      if (this.children[node] > 0) visit(length2 - this.depth[node]);
+    }
+  }
+};
+var RANK = {
+  raw: 0,
+  fragment: 1,
+  json: 2,
+  percent: 3,
+  html: 4,
+  base64: 5,
+  hex: 6,
+  wrapped: 7
+};
+var CR2 = 13;
+var LF2 = 10;
+var EMPTY3 = new Uint8Array(0);
+function register(automaton, sources, ids, bytes, source) {
+  const key = Array.from(bytes).join(",");
+  let id2 = ids.get(key);
+  if (id2 === void 0) {
+    id2 = automaton.add(bytes);
+    ids.set(key, id2);
+    sources[id2] = [];
+  }
+  sources[id2].push(source);
 }
-
-// src/kernel/net/saslprep-tables.ts
-function ranges(text) {
-  return text.split(" ").map((item) => {
-    const [lo = "0", hi = lo] = item.split("-");
-    return [Number.parseInt(lo, 16), Number.parseInt(hi, 16)];
+function prepare(secrets) {
+  const main = new Automaton();
+  const wrap = new Automaton();
+  const sources = [];
+  const wrapSources = [];
+  const ids = /* @__PURE__ */ new Map();
+  const wrapIds = /* @__PURE__ */ new Map();
+  const values = secrets.map((secret) => utf82(secret.value));
+  secrets.forEach((secret, index) => {
+    if (typeof secret.value !== "string" || values[index].length < MIN_VALUE) {
+      throw new RangeError(`the value of ${secret.name} is shorter than ${MIN_VALUE} bytes`);
+    }
+    for (const shape of shapes(secret.value)) {
+      const source = { secret: index, form: shape.form, offset: shape.offset };
+      register(main, sources, ids, shape.bytes, source);
+      if (wrappable(shape.form)) register(wrap, wrapSources, wrapIds, shape.bytes, source);
+    }
   });
+  main.build();
+  wrap.build();
+  const replacements = secrets.map((secret) => [
+    utf82(secret.placeholder),
+    utf82(`[redacted:${secret.name}]`)
+  ]);
+  return { secrets, values, main, wrap, sources, wrapSources, replacements };
 }
-function within7(table, code) {
-  let lo = 0;
-  let hi = table.length - 1;
-  while (lo <= hi) {
-    const mid = lo + hi >> 1;
-    const [from, to] = table[mid];
-    if (code < from) hi = mid - 1;
-    else if (code > to) lo = mid + 1;
-    else return true;
-  }
-  return false;
-}
-var PROHIBITED_TEXT = "0-1F 7F-A0 340-341 6DD 70F 1680 180E 2000-200F 2028-202F 205F-2063 206A-206F 2FF0-2FFB 3000 D800-F8FF FDD0-FDEF FEFF FFF9-FFFF 1D173-1D17A 1FFFE-1FFFF 2FFFE-2FFFF 3FFFE-3FFFF 4FFFE-4FFFF 5FFFE-5FFFF 6FFFE-6FFFF 7FFFE-7FFFF 8FFFE-8FFFF 9FFFE-9FFFF AFFFE-AFFFF BFFFE-BFFFF CFFFE-CFFFF DFFFE-DFFFF E0001 E0020-E007F EFFFE-10FFFF";
-var UNASSIGNED_TEXT = "221 234-24F 2AE-2AF 2EF-2FF 350-35F 370-373 376-379 37B-37D 37F-383 38B 38D 3A2 3CF 3F7-3FF 487 4CF 4F6-4F7 4FA-4FF 510-530 557-558 560 588 58B-590 5A2 5BA 5C5-5CF 5EB-5EF 5F5-60B 60D-61A 61C-61E 620 63B-63F 656-65F 6EE-6EF 6FF 70E 72D-72F 74B-77F 7B2-900 904 93A-93B 94E-94F 955-957 971-980 984 98D-98E 991-992 9A9 9B1 9B3-9B5 9BA-9BB 9BD 9C5-9C6 9C9-9CA 9CE-9D6 9D8-9DB 9DE 9E4-9E5 9FB-A01 A03-A04 A0B-A0E A11-A12 A29 A31 A34 A37 A3A-A3B A3D A43-A46 A49-A4A A4E-A58 A5D A5F-A65 A75-A80 A84 A8C A8E A92 AA9 AB1 AB4 ABA-ABB AC6 ACA ACE-ACF AD1-ADF AE1-AE5 AF0-B00 B04 B0D-B0E B11-B12 B29 B31 B34-B35 B3A-B3B B44-B46 B49-B4A B4E-B55 B58-B5B B5E B62-B65 B71-B81 B84 B8B-B8D B91 B96-B98 B9B B9D BA0-BA2 BA5-BA7 BAB-BAD BB6 BBA-BBD BC3-BC5 BC9 BCE-BD6 BD8-BE6 BF3-C00 C04 C0D C11 C29 C34 C3A-C3D C45 C49 C4E-C54 C57-C5F C62-C65 C70-C81 C84 C8D C91 CA9 CB4 CBA-CBD CC5 CC9 CCE-CD4 CD7-CDD CDF CE2-CE5 CF0-D01 D04 D0D D11 D29 D3A-D3D D44-D45 D49 D4E-D56 D58-D5F D62-D65 D70-D81 D84 D97-D99 DB2 DBC DBE-DBF DC7-DC9 DCB-DCE DD5 DD7 DE0-DF1 DF5-E00 E3B-E3E E5C-E80 E83 E85-E86 E89 E8B-E8C E8E-E93 E98 EA0 EA4 EA6 EA8-EA9 EAC EBA EBE-EBF EC5 EC7 ECE-ECF EDA-EDB EDE-EFF F48 F6B-F70 F8C-F8F F98 FBD FCD-FCE FD0-FFF 1022 1028 102B 1033-1035 103A-103F 105A-109F 10C6-10CF 10F9-10FA 10FC-10FF 115A-115E 11A3-11A7 11FA-11FF 1207 1247 1249 124E-124F 1257 1259 125E-125F 1287 1289 128E-128F 12AF 12B1 12B6-12B7 12BF 12C1 12C6-12C7 12CF 12D7 12EF 130F 1311 1316-1317 131F 1347 135B-1360 137D-139F 13F5-1400 1677-167F 169D-169F 16F1-16FF 170D 1715-171F 1737-173F 1754-175F 176D 1771 1774-177F 17DD-17DF 17EA-17FF 180F 181A-181F 1878-187F 18AA-1DFF 1E9C-1E9F 1EFA-1EFF 1F16-1F17 1F1E-1F1F 1F46-1F47 1F4E-1F4F 1F58 1F5A 1F5C 1F5E 1F7E-1F7F 1FB5 1FC5 1FD4-1FD5 1FDC 1FF0-1FF1 1FF5 1FFF 2053-2056 2058-205E 2064-2069 2072-2073 208F-209F 20B2-20CF 20EB-20FF 213B-213C 214C-2152 2184-218F 23CF-23FF 2427-243F 244B-245F 24FF 2614-2615 2618 267E-267F 268A-2700 2705 270A-270B 2728 274C 274E 2753-2755 2757 275F-2760 2795-2797 27B0 27BF-27CF 27EC-27EF 2B00-2E7F 2E9A 2EF4-2EFF 2FD6-2FEF 2FFC-2FFF 3040 3097-3098 3100-3104 312D-3130 318F 31B8-31EF 321D-321F 3244-3250 327C-327E 32CC-32CF 32FF 3377-337A 33DE-33DF 33FF 4DB6-4DFF 9FA6-9FFF A48D-A48F A4C7-ABFF D7A4-D7FF FA2E-FA2F FA6B-FAFF FB07-FB12 FB18-FB1C FB37 FB3D FB3F FB42 FB45 FBB2-FBD2 FD40-FD4F FD90-FD91 FDC8-FDCF FDFD-FDFF FE10-FE1F FE24-FE2F FE47-FE48 FE53 FE67 FE6C-FE6F FE75 FEFD-FEFE FF00 FFBF-FFC1 FFC8-FFC9 FFD0-FFD1 FFD8-FFD9 FFDD-FFDF FFE7 FFEF-FFF8 10000-102FF 1031F 10324-1032F 1034B-103FF 10426-10427 1044E-1CFFF 1D0F6-1D0FF 1D127-1D129 1D1DE-1D3FF 1D455 1D49D 1D4A0-1D4A1 1D4A3-1D4A4 1D4A7-1D4A8 1D4AD 1D4BA 1D4BC 1D4C1 1D4C4 1D506 1D50B-1D50C 1D515 1D51D 1D53A 1D53F 1D545 1D547-1D549 1D551 1D6A4-1D6A7 1D7CA-1D7CD 1D800-1FFFD 2A6D7-2F7FF 2FA1E-2FFFD 30000-3FFFD 40000-4FFFD 50000-5FFFD 60000-6FFFD 70000-7FFFD 80000-8FFFD 90000-9FFFD A0000-AFFFD B0000-BFFFD C0000-CFFFD D0000-DFFFD E0000 E0002-E001F E0080-EFFFD";
-var RANDAL_TEXT = "5BE 5C0 5C3 5D0-5EA 5F0-5F4 61B 61F 621-63A 640-64A 66D-66F 671-6D5 6DD 6E5-6E6 6FA-6FE 700-70D 710 712-72C 780-7A5 7B1 200F FB1D FB1F-FB28 FB2A-FB36 FB38-FB3C FB3E FB40-FB41 FB43-FB44 FB46-FBB1 FBD3-FD3D FD50-FD8F FD92-FDC7 FDF0-FDFC FE70-FE74 FE76-FEFC";
-var LCAT_TEXT = "41-5A 61-7A AA B5 BA C0-D6 D8-F6 F8-220 222-233 250-2AD 2B0-2B8 2BB-2C1 2D0-2D1 2E0-2E4 2EE 37A 386 388-38A 38C 38E-3A1 3A3-3CE 3D0-3F5 400-482 48A-4CE 4D0-4F5 4F8-4F9 500-50F 531-556 559-55F 561-587 589 903 905-939 93D-940 949-94C 950 958-961 964-970 982-983 985-98C 98F-990 993-9A8 9AA-9B0 9B2 9B6-9B9 9BE-9C0 9C7-9C8 9CB-9CC 9D7 9DC-9DD 9DF-9E1 9E6-9F1 9F4-9FA A05-A0A A0F-A10 A13-A28 A2A-A30 A32-A33 A35-A36 A38-A39 A3E-A40 A59-A5C A5E A66-A6F A72-A74 A83 A85-A8B A8D A8F-A91 A93-AA8 AAA-AB0 AB2-AB3 AB5-AB9 ABD-AC0 AC9 ACB-ACC AD0 AE0 AE6-AEF B02-B03 B05-B0C B0F-B10 B13-B28 B2A-B30 B32-B33 B36-B39 B3D-B3E B40 B47-B48 B4B-B4C B57 B5C-B5D B5F-B61 B66-B70 B83 B85-B8A B8E-B90 B92-B95 B99-B9A B9C B9E-B9F BA3-BA4 BA8-BAA BAE-BB5 BB7-BB9 BBE-BBF BC1-BC2 BC6-BC8 BCA-BCC BD7 BE7-BF2 C01-C03 C05-C0C C0E-C10 C12-C28 C2A-C33 C35-C39 C41-C44 C60-C61 C66-C6F C82-C83 C85-C8C C8E-C90 C92-CA8 CAA-CB3 CB5-CB9 CBE CC0-CC4 CC7-CC8 CCA-CCB CD5-CD6 CDE CE0-CE1 CE6-CEF D02-D03 D05-D0C D0E-D10 D12-D28 D2A-D39 D3E-D40 D46-D48 D4A-D4C D57 D60-D61 D66-D6F D82-D83 D85-D96 D9A-DB1 DB3-DBB DBD DC0-DC6 DCF-DD1 DD8-DDF DF2-DF4 E01-E30 E32-E33 E40-E46 E4F-E5B E81-E82 E84 E87-E88 E8A E8D E94-E97 E99-E9F EA1-EA3 EA5 EA7 EAA-EAB EAD-EB0 EB2-EB3 EBD EC0-EC4 EC6 ED0-ED9 EDC-EDD F00-F17 F1A-F34 F36 F38 F3E-F47 F49-F6A F7F F85 F88-F8B FBE-FC5 FC7-FCC FCF 1000-1021 1023-1027 1029-102A 102C 1031 1038 1040-1057 10A0-10C5 10D0-10F8 10FB 1100-1159 115F-11A2 11A8-11F9 1200-1206 1208-1246 1248 124A-124D 1250-1256 1258 125A-125D 1260-1286 1288 128A-128D 1290-12AE 12B0 12B2-12B5 12B8-12BE 12C0 12C2-12C5 12C8-12CE 12D0-12D6 12D8-12EE 12F0-130E 1310 1312-1315 1318-131E 1320-1346 1348-135A 1361-137C 13A0-13F4 1401-1676 1681-169A 16A0-16F0 1700-170C 170E-1711 1720-1731 1735-1736 1740-1751 1760-176C 176E-1770 1780-17B6 17BE-17C5 17C7-17C8 17D4-17DA 17DC 17E0-17E9 1810-1819 1820-1877 1880-18A8 1E00-1E9B 1EA0-1EF9 1F00-1F15 1F18-1F1D 1F20-1F45 1F48-1F4D 1F50-1F57 1F59 1F5B 1F5D 1F5F-1F7D 1F80-1FB4 1FB6-1FBC 1FBE 1FC2-1FC4 1FC6-1FCC 1FD0-1FD3 1FD6-1FDB 1FE0-1FEC 1FF2-1FF4 1FF6-1FFC 200E 2071 207F 2102 2107 210A-2113 2115 2119-211D 2124 2126 2128 212A-212D 212F-2131 2133-2139 213D-213F 2145-2149 2160-2183 2336-237A 2395 249C-24E9 3005-3007 3021-3029 3031-3035 3038-303C 3041-3096 309D-309F 30A1-30FA 30FC-30FF 3105-312C 3131-318E 3190-31B7 31F0-321C 3220-3243 3260-327B 327F-32B0 32C0-32CB 32D0-32FE 3300-3376 337B-33DD 33E0-33FE 3400-4DB5 4E00-9FA5 A000-A48C AC00-D7A3 D800-FA2D FA30-FA6A FB00-FB06 FB13-FB17 FF21-FF3A FF41-FF5A FF66-FFBE FFC2-FFC7 FFCA-FFCF FFD2-FFD7 FFDA-FFDC 10300-1031E 10320-10323 10330-1034A 10400-10425 10428-1044D 1D000-1D0F5 1D100-1D126 1D12A-1D166 1D16A-1D172 1D183-1D184 1D18C-1D1A9 1D1AE-1D1DD 1D400-1D454 1D456-1D49C 1D49E-1D49F 1D4A2 1D4A5-1D4A6 1D4A9-1D4AC 1D4AE-1D4B9 1D4BB 1D4BD-1D4C0 1D4C2-1D4C3 1D4C5-1D505 1D507-1D50A 1D50D-1D514 1D516-1D51C 1D51E-1D539 1D53B-1D53E 1D540-1D544 1D546 1D54A-1D550 1D552-1D6A3 1D6A8-1D7C9 20000-2A6D6 2F800-2FA1D F0000-FFFFD 100000-10FFFD";
-var PROHIBITED = ranges(PROHIBITED_TEXT);
-var UNASSIGNED = ranges(UNASSIGNED_TEXT);
-var RANDAL = ranges(RANDAL_TEXT);
-var LCAT = ranges(LCAT_TEXT);
-function prepFails(prepared) {
-  const codes = Array.from(prepared, (ch) => ch.codePointAt(0) ?? 0);
-  if (codes.length === 0) return true;
-  if (codes.some((c) => within7(PROHIBITED, c) || within7(UNASSIGNED, c))) return true;
-  if (!codes.some((c) => within7(RANDAL, c))) return false;
-  if (codes.some((c) => within7(LCAT, c))) return true;
-  return !within7(RANDAL, codes[0] ?? 0) || !within7(RANDAL, codes.at(-1) ?? 0);
+function better(a, b) {
+  if (!b) return true;
+  if (a.end !== b.end) return a.end > b.end;
+  if (a.rank !== b.rank) return a.rank < b.rank;
+  return a.secret < b.secret;
 }
-
-// src/kernel/net/sealed-scram.ts
-var encoder8 = new TextEncoder();
-function base64Bytes(text) {
-  try {
-    return Uint8Array.from(atob(text), (c) => c.charCodeAt(0));
-  } catch {
-    return void 0;
+function resolve(c, input, start2, end, source) {
+  if (source.form !== "fragment") {
+    return {
+      start: start2,
+      end,
+      secret: source.secret,
+      form: source.form,
+      rank: RANK[source.form],
+      growing: false
+    };
+  }
+  const value2 = c.values[source.secret];
+  let stop = end;
+  let at = source.offset + FRAGMENT;
+  while (stop < input.length && at < value2.length && input[stop] === value2[at]) {
+    stop++;
+    at++;
   }
+  const form = source.offset === 0 && at === value2.length ? "raw" : "fragment";
+  const growing = stop === input.length && at < value2.length;
+  return { start: start2, end: stop, secret: source.secret, form, rank: RANK[form], growing };
 }
-function base64Of(bytes) {
-  let bin = "";
-  for (const b of bytes) bin += String.fromCharCode(b);
-  return btoa(bin);
+function keep(best, candidate) {
+  if (better(candidate, best.get(candidate.start))) best.set(candidate.start, candidate);
 }
-function clientFirstBare(message3) {
-  const m = /^n,,(n=[^,]*,r=[^,]+)$/.exec(message3);
-  return m ? m[1] : void 0;
+function scanMain(c, input, best, partials) {
+  let state = 0;
+  for (let i = 0; i < input.length; i++) {
+    state = c.main.step(state, input[i]);
+    c.main.matches(state, (id2) => {
+      const start2 = i + 1 - c.main.lengths[id2];
+      for (const source of c.sources[id2]) {
+        const candidate = resolve(c, input, start2, i + 1, source);
+        if (candidate.growing) partials.push(candidate.start);
+        keep(best, candidate);
+      }
+    });
+  }
+  c.main.partials(state, input.length, (start2) => partials.push(start2));
 }
-var SERVER_FIRST = /^r=([^,]+),s=([^,]+),i=(\d{1,6})$/;
-var CLIENT_FINAL = /^(c=biws,r=([^,]+)),p=([^,]+)$/;
-var SCRAM_MAX = 1024;
-function exchangeOf(clientFirst, serverFirst, clientFinal) {
-  const bare = clientFirstBare(clientFirst);
-  const sf = SERVER_FIRST.exec(serverFirst);
-  const fin = CLIENT_FINAL.exec(clientFinal);
-  if (!bare || !sf || !fin || [bare, serverFirst, clientFinal].some((t) => t.length > SCRAM_MAX))
-    return void 0;
-  const cnonce = bare.slice(bare.indexOf(",r=") + 3);
-  const nonce = sf[1];
-  const salt = base64Bytes(sf[2]);
-  const iterations = Number(sf[3]);
-  const proof = base64Bytes(fin[3]);
-  const ok4 = fin[2] === nonce && nonce.startsWith(cnonce) && iterations >= 1 && iterations <= 1e5 && salt !== void 0 && proof?.length === 32;
-  if (!ok4) return void 0;
-  return {
-    exchange: {
-      clientFirstBare: bare,
-      serverFirst,
-      clientFinalBare: fin[1],
-      salt,
-      iterations
-    },
-    proof
-  };
+function scanWrapped(c, input, best, partials) {
+  const map = [];
+  for (let i = 0; i < input.length; i++) if (input[i] !== CR2 && input[i] !== LF2) map.push(i);
+  if (map.length === input.length) return;
+  let state = 0;
+  for (let v = 0; v < map.length; v++) {
+    state = c.wrap.step(state, input[map[v]]);
+    c.wrap.matches(state, (id2) => {
+      const first = v + 1 - c.wrap.lengths[id2];
+      const start2 = map[first];
+      const end = map[v] + 1;
+      const wrapped = end - start2 !== c.wrap.lengths[id2];
+      for (const source of c.wrapSources[id2]) {
+        const form = wrapped ? "wrapped" : source.form;
+        keep(best, { start: start2, end, secret: source.secret, form, rank: RANK[form], growing: false });
+      }
+    });
+  }
+  c.wrap.partials(state, map.length, (start2) => partials.push(map[start2]));
 }
-async function hmac(key, data) {
-  const k = await crypto.subtle.importKey(
-    "raw",
-    key,
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  return new Uint8Array(await crypto.subtle.sign("HMAC", k, data));
+function count(c, hits, candidate) {
+  const name2 = c.secrets[candidate.secret].name;
+  const key = `${name2}\0${candidate.form}`;
+  const hit = hits.get(key) ?? { name: name2, form: candidate.form, count: 0 };
+  hit.count += 1;
+  hits.set(key, hit);
 }
-async function scramKeys(password, x) {
-  const base = await crypto.subtle.importKey("raw", encoder8.encode(password), "PBKDF2", false, [
-    "deriveBits"
-  ]);
-  const salted = new Uint8Array(
-    await crypto.subtle.deriveBits(
-      {
-        name: "PBKDF2",
-        hash: "SHA-256",
-        salt: x.salt,
-        iterations: x.iterations
-      },
-      base,
-      256
-    )
-  );
-  const clientKey = await hmac(salted, encoder8.encode("Client Key"));
-  const stored = new Uint8Array(
-    await crypto.subtle.digest("SHA-256", clientKey)
-  );
-  const auth = encoder8.encode(`${x.clientFirstBare},${x.serverFirst},${x.clientFinalBare}`);
-  const signature = await hmac(stored, auth);
-  const proof = clientKey.map((b, i) => b ^ signature[i]);
-  const serverKey = await hmac(salted, encoder8.encode("Server Key"));
-  const serverSignature = await hmac(serverKey, auth);
-  for (const k of [salted, clientKey, stored, signature, serverKey]) k.fill(0);
-  return { proof, serverSignature };
+function concat6(parts2) {
+  let length2 = 0;
+  for (const part of parts2) length2 += part.length;
+  const out = new Uint8Array(length2);
+  let at = 0;
+  for (const part of parts2) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
 }
-var SPACES = /[\u00A0\u1680\u2000-\u200B\u202F\u205F\u3000]/g;
-var NOTHING2 = /\u00AD|\u034F|\u1806|[\u180B-\u180D]|\u200C|\u200D|\u2060|[\uFE00-\uFE0F]|\uFEFF/g;
-function saslprep(password) {
-  if (/^[\x00-\x7f]*$/.test(password)) return password;
-  const mapped = password.replace(SPACES, " ").replace(NOTHING2, "");
-  return prepFails(mapped) ? password : mapped.normalize("NFKC");
+function pass(c, input, final) {
+  const best = /* @__PURE__ */ new Map();
+  const partials = [];
+  scanMain(c, input, best, partials);
+  scanWrapped(c, input, best, partials);
+  const holds2 = final ? [] : [...new Set(partials)].sort((a, b) => a - b);
+  const starts = [...best.keys()].sort((a, b) => a - b);
+  const parts2 = [];
+  const hits = /* @__PURE__ */ new Map();
+  let pos = 0;
+  let cut = input.length;
+  let s = 0;
+  let h = 0;
+  for (; ; ) {
+    while (s < starts.length && starts[s] < pos) s++;
+    while (h < holds2.length && holds2[h] < pos) h++;
+    const hold = h < holds2.length ? holds2[h] : Infinity;
+    const next3 = s < starts.length ? starts[s] : Infinity;
+    if (hold <= next3) {
+      cut = Math.min(hold, input.length);
+      break;
+    }
+    const candidate = best.get(next3);
+    parts2.push(
+      input.subarray(pos, next3),
+      c.replacements[candidate.secret][candidate.form === "raw" ? 0 : 1]
+    );
+    count(c, hits, candidate);
+    pos = candidate.end;
+  }
+  parts2.push(input.subarray(pos, cut));
+  return { output: concat6(parts2), cut, hits };
 }
-function sameBytes(a, b) {
-  if (a.length !== b.length) return false;
-  let d = 0;
-  for (let i = 0; i < a.length; i++) d |= a[i] ^ b[i];
-  return d === 0;
+function merge(into, from) {
+  for (const [key, hit] of from) {
+    const known = into.get(key);
+    if (known) known.count += hit.count;
+    else into.set(key, { ...hit });
+  }
+}
+function compile(secrets, options = {}) {
+  const c = prepare(secrets.map((secret) => ({ ...secret })));
+  const decoder4 = new TextDecoder();
+  const idleMs = options.idleMs ?? 250;
+  const scrubBytes = (input) => {
+    if (c.secrets.length === 0) return { bytes: input.slice(), hits: [] };
+    const result = pass(c, input, true);
+    return { bytes: result.output, hits: [...result.hits.values()] };
+  };
+  return {
+    version: options.version ?? 0,
+    idleMs,
+    size: c.main.lengths.length,
+    bytes: scrubBytes,
+    text(input) {
+      const { bytes, hits } = scrubBytes(utf82(input));
+      return { text: decoder4.decode(bytes), hits };
+    },
+    stream() {
+      let pending = EMPTY3;
+      const hits = /* @__PURE__ */ new Map();
+      const run2 = (final) => {
+        if (c.secrets.length === 0 || pending.length === 0) {
+          const out = pending;
+          pending = EMPTY3;
+          return out;
+        }
+        const result = pass(c, pending, final);
+        merge(hits, result.hits);
+        pending = pending.slice(result.cut);
+        return result.output;
+      };
+      return {
+        push(chunk2) {
+          pending = concat6([pending, chunk2]);
+          return run2(false);
+        },
+        idle() {
+          return pending.length < FRAGMENT ? run2(true) : EMPTY3;
+        },
+        end() {
+          return run2(true);
+        },
+        get hits() {
+          return [...hits.values()];
+        }
+      };
+    }
+  };
 }
 
-// src/kernel/net/sealed-pg.ts
-var PG_MESSAGE_MAX = 16 * 1024;
-var PROTOCOL_3 = 196608;
-var CLEARTEXT = 3;
-function int32(bytes, at) {
-  return bytes[at] << 24 | bytes[at + 1] << 16 | bytes[at + 2] << 8 | bytes[at + 3];
+// src/kernel/scrub-file.ts
+var SCRUB_IDLE_MS = 50;
+var SCRUB_NONBLOCK_MAX = 64 * 1024;
+var encoder6 = new TextEncoder();
+function scrubberOf(secrets) {
+  const usable2 = secrets.filter((s) => encoder6.encode(s.value).length >= MIN_VALUE);
+  return usable2.length > 0 ? compile(usable2, { idleMs: SCRUB_IDLE_MS }) : void 0;
 }
-function sniffPg(start2) {
-  const bytes = Uint8Array.from(start2, (c) => c.charCodeAt(0));
-  if (bytes.length === 0 || bytes[0] !== 0) return bytes.length === 0 ? "more" : "no";
-  if (bytes.length < 8) return "more";
-  const length2 = int32(bytes, 0);
-  return length2 >= 8 && length2 <= PG_MESSAGE_MAX && int32(bytes, 4) === PROTOCOL_3 ? "yes" : "no";
+async function writeAll3(file, bytes) {
+  const write = file.write;
+  for (let at = 0; at < bytes.length; ) at += await write.call(file, bytes.subarray(at));
 }
-var PLUS = "SCRAM-SHA-256-PLUS";
-var SASL = 10;
-var SASL_CONTINUE = 11;
-var SASL_FINAL = 12;
-function latin(bytes) {
-  let out = "";
-  for (const b of bytes) out += String.fromCharCode(b);
-  return out;
+function bound(file, key) {
+  const method = file[key];
+  return typeof method === "function" ? { [key]: method.bind(file) } : {};
 }
-var PgServer = class {
-  buffer = new Uint8Array(0);
-  skip = 0;
-  cleartext = false;
-  sasl = false;
-  serverFirst;
-  expect;
-  failed = false;
-  lost = false;
-  auth(message3) {
-    const code = message3.length >= 9 ? int32(message3, 5) : -1;
-    if (this.expect && code !== SASL_FINAL) this.failed = true;
-    this.cleartext = message3.length === 9 && code === CLEARTEXT;
-    if (code === SASL) return this.mechanisms(message3);
-    else if (code === SASL_CONTINUE) this.serverFirst = latin(message3.subarray(9));
-    else if (code === SASL_FINAL) this.final(message3);
-    return message3;
-  }
-  mechanisms(message3) {
-    this.sasl = true;
-    const names2 = latin(message3.subarray(9)).split("\0").filter((n) => n !== "" && n !== PLUS);
-    return frame3(82, `${latin(message3.subarray(5, 9))}${names2.map((n) => `${n}\0`).join("")}\0`);
-  }
-  final(message3) {
-    const expect = this.expect;
-    if (!expect) return;
-    this.expect = void 0;
-    const data = latin(message3.subarray(9));
-    if (data !== expect.real || expect.fake.length !== expect.real.length) {
-      this.failed = true;
-      return;
+function interrupted2(err) {
+  const code = err?.code;
+  return code === "EINTR" || code === "EAGAIN";
+}
+function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
+  const file = inner.file;
+  const stream2 = scrubber.stream();
+  let tail2 = Promise.resolve();
+  let pending = 0;
+  let busy = false;
+  let timer;
+  let failed3;
+  const waiters = /* @__PURE__ */ new Set();
+  const quiet3 = () => !busy && pending === 0;
+  const wake = () => {
+    for (const waiter of [...waiters]) waiter();
+  };
+  const raise = () => {
+    if (failed3 === void 0) return;
+    const err = failed3;
+    failed3 = void 0;
+    throw err;
+  };
+  const later = (bytes) => {
+    if (bytes.length === 0) return;
+    pending += 1;
+    tail2 = tail2.then(() => writeAll3(file, bytes)).catch((err) => {
+      if (failed3 === void 0) failed3 = err;
+    }).finally(() => {
+      pending -= 1;
+      if (quiet3()) wake();
+    });
+  };
+  const settling = (signal) => new Promise((resolve2, reject) => {
+    const done4 = () => {
+      waiters.delete(done4);
+      signal?.removeEventListener("abort", stop);
+      resolve2();
+    };
+    const stop = () => {
+      waiters.delete(done4);
+      reject(new KernelError("EINTR"));
+    };
+    if (signal?.aborted) return stop();
+    waiters.add(done4);
+    signal?.addEventListener("abort", stop, { once: true });
+  });
+  const settled = async () => {
+    while (!quiet3()) await settling();
+  };
+  const changed = async (signal) => {
+    const round = new AbortController();
+    const stop = signal ? AbortSignal.any([signal, round.signal]) : round.signal;
+    try {
+      const own = settling(stop);
+      await Promise.race(file.changed ? [own, file.changed(stop)] : [own]);
+    } catch (err) {
+      throw signal?.aborted ? new KernelError("EINTR") : err;
+    } finally {
+      round.abort();
     }
-    for (let i = 0; i < expect.fake.length; i++) message3[9 + i] = expect.fake.charCodeAt(i);
-  }
-  lose() {
-    this.lost = true;
-    this.cleartext = false;
-    this.sasl = false;
-    if (this.expect) this.failed = true;
-    this.expect = void 0;
-  }
-  filter(bytes) {
-    if (this.lost) return bytes;
-    const data = new Uint8Array(this.buffer.length + bytes.length);
-    data.set(this.buffer);
-    data.set(bytes, this.buffer.length);
-    const out = [];
-    let at = 0;
-    for (; ; ) {
-      const left = data.length - at;
-      if (this.skip > 0) {
-        const n = Math.min(this.skip, left);
-        out.push(data.subarray(at, at + n));
-        this.skip -= n;
-        at += n;
-        if (this.skip > 0) break;
-        continue;
+  };
+  const turn = async (signal) => {
+    for (let waited = false; ; waited = true) {
+      if (quiet3() && (pollFile(file).writable || !file.changed)) {
+        busy = true;
+        return;
       }
-      if (left < 5) break;
-      const whole = 1 + int32(data, at + 1);
-      if (whole < 5 || data[at] === 82 && whole > PG_MESSAGE_MAX) {
-        this.lose();
-        out.push(data.subarray(at));
-        at = data.length;
-        break;
+      if (signal?.aborted) throw new KernelError(waited ? "EINTR" : "EAGAIN");
+      await changed(signal);
+    }
+  };
+  const send2 = async (out, signal) => {
+    const write = file.write;
+    for (let at = 0; at < out.length; ) {
+      try {
+        at += await write.call(file, out.subarray(at), signal);
+      } catch (err) {
+        if (!signal?.aborted || !interrupted2(err)) throw err;
       }
-      if (data[at] !== 82) {
-        if (this.expect) {
-          this.failed = true;
-          break;
+      if (at < out.length && signal?.aborted) return later(out.subarray(at));
+    }
+  };
+  const release = () => {
+    timer = void 0;
+    later(stream2.idle());
+  };
+  return new OpenFile({
+    ...bound(file, "read"),
+    ...bound(file, "peek"),
+    ...bound(file, "stat"),
+    poll: () => {
+      const state = pollFile(file);
+      return quiet3() ? state : { ...state, writable: false };
+    },
+    changed,
+    ...file.tty ? { tty: file.tty } : {},
+    identity: file.identity ?? file,
+    ...file.clipboard ? { clipboard: file.clipboard } : {},
+    ...file.write ? {
+      write: async (bytes, signal) => {
+        await turn(signal);
+        const taken = signal?.aborted && bytes.length > SCRUB_NONBLOCK_MAX ? bytes.subarray(0, SCRUB_NONBLOCK_MAX) : bytes;
+        try {
+          raise();
+          if (timer !== void 0) clearTimeout(timer);
+          timer = void 0;
+          await send2(stream2.push(taken), signal);
+        } finally {
+          busy = false;
+          if (quiet3()) wake();
         }
-        this.skip = whole;
-        continue;
+        timer = setTimeout(release, idleMs);
+        return taken.length;
       }
-      if (left < whole) break;
-      out.push(this.auth(data.slice(at, at + whole)));
-      at += whole;
+    } : {},
+    flush: async () => {
+      await settled();
+      raise();
+      await file.flush?.();
+    },
+    close: async () => {
+      if (timer !== void 0) clearTimeout(timer);
+      let failure;
+      try {
+        await settled();
+        later(stream2.end());
+        await settled();
+        raise();
+      } catch (err) {
+        failure = { err };
+      }
+      await inner.release();
+      if (failure) throw failure.err;
     }
-    this.buffer = data.slice(at);
-    const joined4 = new Uint8Array(out.reduce((n, b) => n + b.length, 0));
-    let to = 0;
-    for (const b of out) {
-      joined4.set(b, to);
-      to += b.length;
+  });
+}
+function scrubbedAll(file, scrubbers) {
+  return scrubbers.reduce((inner, scrubber) => scrubbed(inner, scrubber), file);
+}
+function stdioFiles(fds) {
+  const files = /* @__PURE__ */ new Set();
+  for (const fd of [1, 2]) {
+    try {
+      files.add(fds.get(fd));
+    } catch {
     }
-    return joined4;
   }
-};
-function frame3(type, body) {
-  const out = new Uint8Array(5 + body.length);
-  out[0] = type;
-  const length2 = 4 + body.length;
-  out.set([length2 >>> 24 & 255, length2 >>> 16 & 255, length2 >>> 8 & 255, length2 & 255], 1);
-  for (let i = 0; i < body.length; i++) out[5 + i] = body.charCodeAt(i);
-  return out;
-}
-function pgLength(bytes, started) {
-  const header4 = started ? 5 : 4;
-  if (bytes.length < header4) return void 0;
-  const length2 = int32(bytes, started ? 1 : 0);
-  return started ? 1 + length2 : length2;
+  return files;
 }
-var MECHANISMS = /* @__PURE__ */ new Set(["SCRAM-SHA-256"]);
-async function cleartext(message3, asks) {
-  const body = latin(message3.subarray(5));
-  if (!body.endsWith("\0") || body.indexOf("\0") !== body.length - 1)
-    return { bytes: message3, done: true };
-  const password = body.slice(0, -1);
-  const placeholders = placeholdersIn(password);
-  if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS)
-    return { bytes: message3, done: true };
-  const values = usable(await asks.cleartext(placeholders));
-  if (Object.keys(values).length === 0) return { bytes: message3, done: true };
-  return { bytes: frame3(112, `${replaced(password, values)}\0`), values, done: true };
+function scrubStdio(fds, scrubber) {
+  const wrapped = /* @__PURE__ */ new Map();
+  const stdio = stdioFiles(fds);
+  for (const fd of fds.numbers()) {
+    const original = fds.get(fd);
+    if (!stdio.has(original) && !original.file.tty && !original.file.clipboard) continue;
+    const known = wrapped.get(original);
+    const flags2 = fds.statusFlags(fd);
+    const wrapper = known ? known.retain() : scrubbed(original.retain(), scrubber);
+    wrapped.set(original, wrapper);
+    fds.installAt(fd, wrapper);
+    if (flags2 !== void 0) fds.setStatusFlags(fd, flags2);
+  }
 }
-function initial(message3) {
-  const body = latin(message3.subarray(5));
-  const nul = body.indexOf("\0");
-  if (nul < 0 || !MECHANISMS.has(body.slice(0, nul)) || body.length < nul + 5) return void 0;
-  const data = message3.subarray(5 + nul + 5);
-  return int32(message3, 5 + nul + 1) === data.length ? latin(data) : void 0;
-}
-var PgClient = class {
-  clientFirst;
-  server;
-  asks;
-  constructor(server, asks) {
-    this.server = server;
-    this.asks = asks;
-  }
-  async message(message3) {
-    const server = this.server;
-    if (message3[0] !== 112) return { bytes: message3, done: true };
-    if (server.cleartext) {
-      server.cleartext = false;
-      return cleartext(message3, this.asks);
-    }
-    if (server.sasl && this.clientFirst === void 0) {
-      this.clientFirst = initial(message3);
-      return { bytes: message3, done: this.clientFirst === void 0 };
-    }
-    if (this.clientFirst !== void 0 && server.serverFirst !== void 0)
-      return this.final(message3, this.clientFirst, server.serverFirst);
-    return { bytes: message3, done: true };
-  }
-  async final(message3, first, serverFirst) {
-    const got = exchangeOf(first, serverFirst, latin(message3.subarray(5)));
-    if (!got) return { bytes: message3, done: true };
-    const x = got.exchange;
-    const values = usable(
-      await this.asks.scram({
-        clientFirstBare: x.clientFirstBare,
-        serverFirst: x.serverFirst,
-        clientFinalBare: x.clientFinalBare,
-        proof: base64Of(got.proof)
-      })
-    );
-    const [entry, ...more] = Object.entries(values);
-    if (!entry || more.length > 0) return { bytes: message3, done: true };
-    const [placeholder, value2] = entry;
-    const fake = await scramKeys(placeholder, x);
-    if (!sameBytes(fake.proof, got.proof)) return { bytes: message3, done: true };
-    const real = await scramKeys(saslprep(value2), x);
-    this.server.expect = {
-      real: `v=${base64Of(real.serverSignature)}`,
-      fake: `v=${base64Of(fake.serverSignature)}`
-    };
-    const bytes = frame3(112, `${x.clientFinalBare},p=${base64Of(real.proof)}`);
-    for (const k of [real.proof, real.serverSignature, fake.proof, fake.serverSignature]) k.fill(0);
-    return { bytes, values, done: true };
-  }
-};
 
-// src/kernel/net/sealed-smtp.ts
-var SMTP_LINE_MAX = 4096;
-var GREETING = ["EHLO ", "HELO "];
-function sniffSmtp(start2) {
-  const upper = start2.toUpperCase();
-  for (const word of GREETING) {
-    if (upper.startsWith(word)) return "yes";
-    if (word.startsWith(upper)) return "more";
+// src/kernel/net/sealed-http1.ts
+var HTTP1_METHODS = [
+  "GET",
+  "HEAD",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "OPTIONS",
+  "CONNECT",
+  "TRACE"
+];
+var HEAD_MAX = 16 * 1024;
+var ANY_PLACEHOLDER = /fnox_proxy_[0-9a-f]{24}/g;
+var REQUEST_LINE2 = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+) ([\x21-\x7e]+) HTTP\/1\.[01]$/;
+var HEADER_LINE = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+):[ \t]*(.*?)[ \t]*$/;
+var BASIC = /^(Basic[ \t]+)([A-Za-z0-9+/]+={0,2})$/i;
+var encoder7 = new TextEncoder();
+function binary(text) {
+  let out = "";
+  for (const b of encoder7.encode(text)) out += String.fromCharCode(b);
+  return out;
+}
+function sniffHttp1(start2) {
+  for (const method of HTTP1_METHODS) {
+    const word = `${method} `;
+    if (start2.startsWith(word)) return "yes";
+    if (word.startsWith(start2)) return "more";
   }
   return "no";
 }
-function decoded(b64) {
-  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(b64)) return void 0;
+function basicOf(value2) {
+  const m = BASIC.exec(value2);
+  if (!m) return void 0;
   try {
-    return atob(b64);
+    return { scheme: m[1], decoded: atob(m[2]) };
   } catch {
     return void 0;
   }
 }
-async function swapped2(text, position, ask) {
-  const placeholders = placeholdersIn(text);
-  if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS) return void 0;
-  const values = usable(await ask(position, placeholders));
-  if (Object.keys(values).length === 0) return void 0;
-  return { text: replaced(text, values), values };
-}
-async function plain2(b64, ask) {
-  const text = decoded(b64);
-  const fields = text?.split("\0");
-  if (fields?.length !== 3) return { line: b64 };
-  const [authz, user, pass2] = fields;
-  if (placeholdersIn(authz + user).length > 0) return { line: b64 };
-  const done4 = await swapped2(pass2, "auth-plain", ask);
-  if (!done4) return { line: b64 };
-  return { line: btoa(`${authz}\0${user}\0${done4.text}`), values: done4.values };
-}
-async function login(b64, ask) {
-  const text = decoded(b64);
-  const done4 = text === void 0 ? void 0 : await swapped2(text, "auth-login", ask);
-  return done4 ? { line: btoa(done4.text), values: done4.values } : { line: b64 };
+function placeholdersIn(text) {
+  return [...new Set(text.match(ANY_PLACEHOLDER) ?? [])];
 }
-var SmtpClient = class {
-  state = "command";
-  ask;
-  constructor(ask) {
-    this.ask = ask;
-  }
-  get done() {
-    return this.state === "done";
-  }
-  async line(text) {
-    const state = this.state;
-    if (state === "done") return { line: text };
-    if (state === "plain" || state === "password") {
-      this.state = "done";
-      if (text === "*") return { line: text };
-      return state === "plain" ? plain2(text, this.ask) : login(text, this.ask);
-    }
-    if (state === "user") {
-      this.state = text === "*" ? "done" : "password";
-      return { line: text };
-    }
-    return this.command(text);
-  }
-  async command(text) {
-    const m = /^AUTH[ \t]+(PLAIN|LOGIN)(?:[ \t]+(\S+))?$/i.exec(text);
-    if (!m) {
-      if (/^(MAIL|RCPT|DATA|BDAT|AUTH)\b/i.test(text)) this.state = "done";
-      return { line: text };
-    }
-    const mech = m[1].toUpperCase();
-    const arg = m[2];
-    if (mech === "LOGIN") {
-      this.state = arg === void 0 ? "user" : "password";
-      return { line: text };
-    }
-    if (arg === void 0) {
-      this.state = "plain";
-      return { line: text };
-    }
-    this.state = "done";
-    const out = await plain2(arg, this.ask);
-    return {
-      line: `${text.slice(0, text.length - arg.length)}${out.line}`,
-      ...out.values ? { values: out.values } : {}
-    };
+function scan(lines2) {
+  const found = [];
+  for (let i = 1; i < lines2.length; i++) {
+    const m = HEADER_LINE.exec(lines2[i]);
+    if (!m) return void 0;
+    const value2 = m[2];
+    const basic = basicOf(value2);
+    const placeholders = placeholdersIn(basic ? basic.decoded : value2);
+    if (placeholders.length > 0)
+      found.push({ line: i, name: m[1].toLowerCase(), value: value2, basic, placeholders });
   }
-};
-
-// src/kernel/net/sealed-conn.ts
-var HEAD_IDLE_MS = 2e3;
-function substitutes(s) {
-  return s.verified && s.alpn !== "h2" && s.broker.hook !== void 0 && typeof s.exit === "string" && SESSION_EXIT.test(s.exit);
-}
-function sessionId() {
-  const bytes = crypto.getRandomValues(new Uint8Array(24));
-  let bin = "";
-  for (const b of bytes) bin += String.fromCharCode(b);
-  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_");
+  return found;
 }
-function latin12(bytes) {
-  let out = "";
-  for (const b of bytes) out += String.fromCharCode(b);
+function replaced(text, values) {
+  let out = text;
+  for (const [ph, value2] of Object.entries(values)) out = out.split(ph).join(binary(value2));
   return out;
 }
-function bytesOf(text) {
-  const out = new Uint8Array(text.length);
-  for (let i = 0; i < text.length; i++) out[i] = text.charCodeAt(i);
+function usable(values) {
+  const out = {};
+  for (const [ph, value2] of Object.entries(values ?? {}))
+    if (encoder7.encode(value2).length >= MIN_VALUE) out[ph] = value2;
   return out;
 }
-async function writeAll4(conn, bytes) {
-  for (let at = 0; at < bytes.length; ) at += await conn.write(bytes.subarray(at));
-}
-var CRLF2 = [13, 10, 13, 10];
-function headEnd2(bytes) {
-  for (let i = 0; i + 3 < bytes.length; i++) {
-    if (CRLF2.every((b, k) => bytes[i + k] === b)) return i + 4;
-  }
-  return -1;
+async function substituteHead(head, ask) {
+  if (!head.endsWith("\r\n\r\n")) return void 0;
+  const lines2 = head.slice(0, -4).split("\r\n");
+  if (lines2.some((l) => l.includes("\n") || l.includes("\r"))) return void 0;
+  const request = REQUEST_LINE2.exec(lines2[0]);
+  const found = request ? scan(lines2) : void 0;
+  if (!request || !found || found.length !== 1) return void 0;
+  const at = found[0];
+  if (at.placeholders.length > SESSION_PLACEHOLDERS) return void 0;
+  const values = usable(
+    await ask(`header:${at.name}`, at.placeholders, {
+      method: request[1],
+      path: request[2]
+    })
+  );
+  if (Object.keys(values).length === 0) return void 0;
+  const value2 = at.basic ? `${at.basic.scheme}${btoa(replaced(at.basic.decoded, values))}` : replaced(at.value, values);
+  const out = [...lines2];
+  out[at.line] = `${lines2[at.line].split(":")[0]}: ${value2}`;
+  return { head: `${out.join("\r\n")}\r
+\r
+`, values };
 }
-function modeOf(start2) {
-  const sniffs = [
-    ["http1", sniffHttp1(start2)],
-    ["smtp", sniffSmtp(start2)],
-    ["pg", sniffPg(start2)]
-  ];
-  const hit = sniffs.find(([, v]) => v === "yes");
-  if (hit) return hit[0];
-  return sniffs.every(([, v]) => v === "no") ? "pass" : void 0;
+
+// src/kernel/net/saslprep-tables.ts
+function ranges(text) {
+  return text.split(" ").map((item) => {
+    const [lo = "0", hi = lo] = item.split("-");
+    return [Number.parseInt(lo, 16), Number.parseInt(hi, 16)];
+  });
 }
-function crlf(bytes) {
-  for (let i = 0; i + 1 < bytes.length; i++) if (bytes[i] === 13 && bytes[i + 1] === 10) return i;
-  return -1;
+function within7(table, code) {
+  let lo = 0;
+  let hi = table.length - 1;
+  while (lo <= hi) {
+    const mid = lo + hi >> 1;
+    const [from, to] = table[mid];
+    if (code < from) hi = mid - 1;
+    else if (code > to) lo = mid + 1;
+    else return true;
+  }
+  return false;
 }
-var SessionWriter = class {
-  buffer = new Uint8Array(0);
-  mode = "sniff";
-  timer;
-  chain = Promise.resolve();
-  failed;
-  session = sessionId();
-  smtp;
-  pgStarted = false;
-  sawPg = false;
-  conn;
-  s;
-  pgClient;
-  scope;
-  constructor(conn, s, pg, scope) {
-    this.conn = conn;
-    this.s = s;
-    this.scope = scope;
-    this.pgClient = new PgClient(pg, {
-      cleartext: (placeholders) => this.ask("pg", "password-cleartext", { placeholders }),
-      scram: (scram) => this.ask("pg", "scram-sha-256", { scram })
-    });
-    this.smtp = new SmtpClient(
-      (position, placeholders) => this.ask("smtp", position, { placeholders })
-    );
-  }
-  write(bytes) {
-    const run2 = this.chain.then(() => this.take(bytes));
-    this.chain = run2.then(
-      () => void 0,
-      () => void 0
-    );
-    return run2;
-  }
-  async ask(protocol, position, extra) {
-    const s = this.s;
-    const values = await s.broker.sessionMaterialize({
-      stamp: await s.stamp(),
-      session: this.session,
-      host: s.host,
-      port: s.port,
-      protocol,
-      position,
-      verified: s.verified,
-      handshakeAt: s.handshakeAt,
-      exit: s.exit,
-      ...extra
-    });
-    return values;
-  }
-  remember(values) {
-    this.scope.add(
-      Object.entries(values).map(([placeholder, value2]) => ({ name: "sealed", value: value2, placeholder }))
-    );
-  }
-  async take(bytes) {
-    if (this.failed !== void 0) throw this.failed;
-    if (this.mode === "pass") return this.conn.write(bytes);
-    clearTimeout(this.timer);
-    const joined4 = new Uint8Array(this.buffer.length + bytes.length);
-    joined4.set(this.buffer);
-    joined4.set(bytes, this.buffer.length);
-    this.buffer.fill(0);
-    this.buffer = joined4;
-    if (this.mode === "sniff") this.mode = modeOf(latin12(joined4.subarray(0, 8))) ?? "sniff";
-    if (this.mode === "pg") this.sawPg = true;
-    if (this.mode === "pass") await this.release();
-    else if (this.mode === "http1") await this.http1();
-    else if (this.mode === "smtp") await this.lines();
-    else if (this.mode === "pg") await this.messages();
-    if (this.mode !== "pass" && this.buffer.length > 0)
-      this.timer = setTimeout(() => this.idle(), HEAD_IDLE_MS);
-    return bytes.length;
-  }
-  async http1() {
-    const end = headEnd2(this.buffer);
-    if (end > HEAD_MAX || end < 0 && this.buffer.length > HEAD_MAX) await this.release();
-    else if (end >= 0) await this.substitute(end);
-  }
-  async lines() {
-    for (; ; ) {
-      const at = crlf(this.buffer);
-      if (at < 0) break;
-      if (at > SMTP_LINE_MAX) return this.release();
-      const all = this.buffer;
-      this.buffer = all.slice(at + 2);
-      const out = await this.smtp.line(latin12(all.subarray(0, at))).catch(() => ({ line: latin12(all.subarray(0, at)) }));
-      all.fill(0);
-      if ("values" in out && out.values) this.remember(out.values);
-      const line = bytesOf(`${out.line}\r
-`);
-      try {
-        await writeAll4(this.conn, line);
-      } finally {
-        line.fill(0);
-      }
-      if (this.smtp.done) return this.release();
-    }
-    if (this.buffer.length > SMTP_LINE_MAX) await this.release();
-  }
-  async messages() {
-    for (; ; ) {
-      const whole = pgLength(this.buffer, this.pgStarted);
-      if (whole === void 0 || whole < 4 || whole > PG_MESSAGE_MAX) {
-        if (whole !== void 0) await this.release();
-        return;
-      }
-      if (this.buffer.length < whole) return;
-      const message3 = this.buffer.slice(0, whole);
-      this.buffer = this.buffer.slice(whole);
-      const started = this.pgStarted;
-      this.pgStarted = true;
-      const out = started ? await this.pgClient.message(message3).catch(() => ({ bytes: message3, done: true })) : { bytes: message3, done: false };
-      if ("values" in out && out.values) this.remember(out.values);
-      try {
-        await writeAll4(this.conn, out.bytes);
-      } finally {
-        out.bytes.fill(0);
-        message3.fill(0);
-      }
-      if (out.done) return this.release();
-    }
+var PROHIBITED_TEXT = "0-1F 7F-A0 340-341 6DD 70F 1680 180E 2000-200F 2028-202F 205F-2063 206A-206F 2FF0-2FFB 3000 D800-F8FF FDD0-FDEF FEFF FFF9-FFFF 1D173-1D17A 1FFFE-1FFFF 2FFFE-2FFFF 3FFFE-3FFFF 4FFFE-4FFFF 5FFFE-5FFFF 6FFFE-6FFFF 7FFFE-7FFFF 8FFFE-8FFFF 9FFFE-9FFFF AFFFE-AFFFF BFFFE-BFFFF CFFFE-CFFFF DFFFE-DFFFF E0001 E0020-E007F EFFFE-10FFFF";
+var UNASSIGNED_TEXT = "221 234-24F 2AE-2AF 2EF-2FF 350-35F 370-373 376-379 37B-37D 37F-383 38B 38D 3A2 3CF 3F7-3FF 487 4CF 4F6-4F7 4FA-4FF 510-530 557-558 560 588 58B-590 5A2 5BA 5C5-5CF 5EB-5EF 5F5-60B 60D-61A 61C-61E 620 63B-63F 656-65F 6EE-6EF 6FF 70E 72D-72F 74B-77F 7B2-900 904 93A-93B 94E-94F 955-957 971-980 984 98D-98E 991-992 9A9 9B1 9B3-9B5 9BA-9BB 9BD 9C5-9C6 9C9-9CA 9CE-9D6 9D8-9DB 9DE 9E4-9E5 9FB-A01 A03-A04 A0B-A0E A11-A12 A29 A31 A34 A37 A3A-A3B A3D A43-A46 A49-A4A A4E-A58 A5D A5F-A65 A75-A80 A84 A8C A8E A92 AA9 AB1 AB4 ABA-ABB AC6 ACA ACE-ACF AD1-ADF AE1-AE5 AF0-B00 B04 B0D-B0E B11-B12 B29 B31 B34-B35 B3A-B3B B44-B46 B49-B4A B4E-B55 B58-B5B B5E B62-B65 B71-B81 B84 B8B-B8D B91 B96-B98 B9B B9D BA0-BA2 BA5-BA7 BAB-BAD BB6 BBA-BBD BC3-BC5 BC9 BCE-BD6 BD8-BE6 BF3-C00 C04 C0D C11 C29 C34 C3A-C3D C45 C49 C4E-C54 C57-C5F C62-C65 C70-C81 C84 C8D C91 CA9 CB4 CBA-CBD CC5 CC9 CCE-CD4 CD7-CDD CDF CE2-CE5 CF0-D01 D04 D0D D11 D29 D3A-D3D D44-D45 D49 D4E-D56 D58-D5F D62-D65 D70-D81 D84 D97-D99 DB2 DBC DBE-DBF DC7-DC9 DCB-DCE DD5 DD7 DE0-DF1 DF5-E00 E3B-E3E E5C-E80 E83 E85-E86 E89 E8B-E8C E8E-E93 E98 EA0 EA4 EA6 EA8-EA9 EAC EBA EBE-EBF EC5 EC7 ECE-ECF EDA-EDB EDE-EFF F48 F6B-F70 F8C-F8F F98 FBD FCD-FCE FD0-FFF 1022 1028 102B 1033-1035 103A-103F 105A-109F 10C6-10CF 10F9-10FA 10FC-10FF 115A-115E 11A3-11A7 11FA-11FF 1207 1247 1249 124E-124F 1257 1259 125E-125F 1287 1289 128E-128F 12AF 12B1 12B6-12B7 12BF 12C1 12C6-12C7 12CF 12D7 12EF 130F 1311 1316-1317 131F 1347 135B-1360 137D-139F 13F5-1400 1677-167F 169D-169F 16F1-16FF 170D 1715-171F 1737-173F 1754-175F 176D 1771 1774-177F 17DD-17DF 17EA-17FF 180F 181A-181F 1878-187F 18AA-1DFF 1E9C-1E9F 1EFA-1EFF 1F16-1F17 1F1E-1F1F 1F46-1F47 1F4E-1F4F 1F58 1F5A 1F5C 1F5E 1F7E-1F7F 1FB5 1FC5 1FD4-1FD5 1FDC 1FF0-1FF1 1FF5 1FFF 2053-2056 2058-205E 2064-2069 2072-2073 208F-209F 20B2-20CF 20EB-20FF 213B-213C 214C-2152 2184-218F 23CF-23FF 2427-243F 244B-245F 24FF 2614-2615 2618 267E-267F 268A-2700 2705 270A-270B 2728 274C 274E 2753-2755 2757 275F-2760 2795-2797 27B0 27BF-27CF 27EC-27EF 2B00-2E7F 2E9A 2EF4-2EFF 2FD6-2FEF 2FFC-2FFF 3040 3097-3098 3100-3104 312D-3130 318F 31B8-31EF 321D-321F 3244-3250 327C-327E 32CC-32CF 32FF 3377-337A 33DE-33DF 33FF 4DB6-4DFF 9FA6-9FFF A48D-A48F A4C7-ABFF D7A4-D7FF FA2E-FA2F FA6B-FAFF FB07-FB12 FB18-FB1C FB37 FB3D FB3F FB42 FB45 FBB2-FBD2 FD40-FD4F FD90-FD91 FDC8-FDCF FDFD-FDFF FE10-FE1F FE24-FE2F FE47-FE48 FE53 FE67 FE6C-FE6F FE75 FEFD-FEFE FF00 FFBF-FFC1 FFC8-FFC9 FFD0-FFD1 FFD8-FFD9 FFDD-FFDF FFE7 FFEF-FFF8 10000-102FF 1031F 10324-1032F 1034B-103FF 10426-10427 1044E-1CFFF 1D0F6-1D0FF 1D127-1D129 1D1DE-1D3FF 1D455 1D49D 1D4A0-1D4A1 1D4A3-1D4A4 1D4A7-1D4A8 1D4AD 1D4BA 1D4BC 1D4C1 1D4C4 1D506 1D50B-1D50C 1D515 1D51D 1D53A 1D53F 1D545 1D547-1D549 1D551 1D6A4-1D6A7 1D7CA-1D7CD 1D800-1FFFD 2A6D7-2F7FF 2FA1E-2FFFD 30000-3FFFD 40000-4FFFD 50000-5FFFD 60000-6FFFD 70000-7FFFD 80000-8FFFD 90000-9FFFD A0000-AFFFD B0000-BFFFD C0000-CFFFD D0000-DFFFD E0000 E0002-E001F E0080-EFFFD";
+var RANDAL_TEXT = "5BE 5C0 5C3 5D0-5EA 5F0-5F4 61B 61F 621-63A 640-64A 66D-66F 671-6D5 6DD 6E5-6E6 6FA-6FE 700-70D 710 712-72C 780-7A5 7B1 200F FB1D FB1F-FB28 FB2A-FB36 FB38-FB3C FB3E FB40-FB41 FB43-FB44 FB46-FBB1 FBD3-FD3D FD50-FD8F FD92-FDC7 FDF0-FDFC FE70-FE74 FE76-FEFC";
+var LCAT_TEXT = "41-5A 61-7A AA B5 BA C0-D6 D8-F6 F8-220 222-233 250-2AD 2B0-2B8 2BB-2C1 2D0-2D1 2E0-2E4 2EE 37A 386 388-38A 38C 38E-3A1 3A3-3CE 3D0-3F5 400-482 48A-4CE 4D0-4F5 4F8-4F9 500-50F 531-556 559-55F 561-587 589 903 905-939 93D-940 949-94C 950 958-961 964-970 982-983 985-98C 98F-990 993-9A8 9AA-9B0 9B2 9B6-9B9 9BE-9C0 9C7-9C8 9CB-9CC 9D7 9DC-9DD 9DF-9E1 9E6-9F1 9F4-9FA A05-A0A A0F-A10 A13-A28 A2A-A30 A32-A33 A35-A36 A38-A39 A3E-A40 A59-A5C A5E A66-A6F A72-A74 A83 A85-A8B A8D A8F-A91 A93-AA8 AAA-AB0 AB2-AB3 AB5-AB9 ABD-AC0 AC9 ACB-ACC AD0 AE0 AE6-AEF B02-B03 B05-B0C B0F-B10 B13-B28 B2A-B30 B32-B33 B36-B39 B3D-B3E B40 B47-B48 B4B-B4C B57 B5C-B5D B5F-B61 B66-B70 B83 B85-B8A B8E-B90 B92-B95 B99-B9A B9C B9E-B9F BA3-BA4 BA8-BAA BAE-BB5 BB7-BB9 BBE-BBF BC1-BC2 BC6-BC8 BCA-BCC BD7 BE7-BF2 C01-C03 C05-C0C C0E-C10 C12-C28 C2A-C33 C35-C39 C41-C44 C60-C61 C66-C6F C82-C83 C85-C8C C8E-C90 C92-CA8 CAA-CB3 CB5-CB9 CBE CC0-CC4 CC7-CC8 CCA-CCB CD5-CD6 CDE CE0-CE1 CE6-CEF D02-D03 D05-D0C D0E-D10 D12-D28 D2A-D39 D3E-D40 D46-D48 D4A-D4C D57 D60-D61 D66-D6F D82-D83 D85-D96 D9A-DB1 DB3-DBB DBD DC0-DC6 DCF-DD1 DD8-DDF DF2-DF4 E01-E30 E32-E33 E40-E46 E4F-E5B E81-E82 E84 E87-E88 E8A E8D E94-E97 E99-E9F EA1-EA3 EA5 EA7 EAA-EAB EAD-EB0 EB2-EB3 EBD EC0-EC4 EC6 ED0-ED9 EDC-EDD F00-F17 F1A-F34 F36 F38 F3E-F47 F49-F6A F7F F85 F88-F8B FBE-FC5 FC7-FCC FCF 1000-1021 1023-1027 1029-102A 102C 1031 1038 1040-1057 10A0-10C5 10D0-10F8 10FB 1100-1159 115F-11A2 11A8-11F9 1200-1206 1208-1246 1248 124A-124D 1250-1256 1258 125A-125D 1260-1286 1288 128A-128D 1290-12AE 12B0 12B2-12B5 12B8-12BE 12C0 12C2-12C5 12C8-12CE 12D0-12D6 12D8-12EE 12F0-130E 1310 1312-1315 1318-131E 1320-1346 1348-135A 1361-137C 13A0-13F4 1401-1676 1681-169A 16A0-16F0 1700-170C 170E-1711 1720-1731 1735-1736 1740-1751 1760-176C 176E-1770 1780-17B6 17BE-17C5 17C7-17C8 17D4-17DA 17DC 17E0-17E9 1810-1819 1820-1877 1880-18A8 1E00-1E9B 1EA0-1EF9 1F00-1F15 1F18-1F1D 1F20-1F45 1F48-1F4D 1F50-1F57 1F59 1F5B 1F5D 1F5F-1F7D 1F80-1FB4 1FB6-1FBC 1FBE 1FC2-1FC4 1FC6-1FCC 1FD0-1FD3 1FD6-1FDB 1FE0-1FEC 1FF2-1FF4 1FF6-1FFC 200E 2071 207F 2102 2107 210A-2113 2115 2119-211D 2124 2126 2128 212A-212D 212F-2131 2133-2139 213D-213F 2145-2149 2160-2183 2336-237A 2395 249C-24E9 3005-3007 3021-3029 3031-3035 3038-303C 3041-3096 309D-309F 30A1-30FA 30FC-30FF 3105-312C 3131-318E 3190-31B7 31F0-321C 3220-3243 3260-327B 327F-32B0 32C0-32CB 32D0-32FE 3300-3376 337B-33DD 33E0-33FE 3400-4DB5 4E00-9FA5 A000-A48C AC00-D7A3 D800-FA2D FA30-FA6A FB00-FB06 FB13-FB17 FF21-FF3A FF41-FF5A FF66-FFBE FFC2-FFC7 FFCA-FFCF FFD2-FFD7 FFDA-FFDC 10300-1031E 10320-10323 10330-1034A 10400-10425 10428-1044D 1D000-1D0F5 1D100-1D126 1D12A-1D166 1D16A-1D172 1D183-1D184 1D18C-1D1A9 1D1AE-1D1DD 1D400-1D454 1D456-1D49C 1D49E-1D49F 1D4A2 1D4A5-1D4A6 1D4A9-1D4AC 1D4AE-1D4B9 1D4BB 1D4BD-1D4C0 1D4C2-1D4C3 1D4C5-1D505 1D507-1D50A 1D50D-1D514 1D516-1D51C 1D51E-1D539 1D53B-1D53E 1D540-1D544 1D546 1D54A-1D550 1D552-1D6A3 1D6A8-1D7C9 20000-2A6D6 2F800-2FA1D F0000-FFFFD 100000-10FFFD";
+var PROHIBITED = ranges(PROHIBITED_TEXT);
+var UNASSIGNED = ranges(UNASSIGNED_TEXT);
+var RANDAL = ranges(RANDAL_TEXT);
+var LCAT = ranges(LCAT_TEXT);
+function prepFails(prepared) {
+  const codes = Array.from(prepared, (ch) => ch.codePointAt(0) ?? 0);
+  if (codes.length === 0) return true;
+  if (codes.some((c) => within7(PROHIBITED, c) || within7(UNASSIGNED, c))) return true;
+  if (!codes.some((c) => within7(RANDAL, c))) return false;
+  if (codes.some((c) => within7(LCAT, c))) return true;
+  return !within7(RANDAL, codes[0] ?? 0) || !within7(RANDAL, codes.at(-1) ?? 0);
+}
+
+// src/kernel/net/sealed-scram.ts
+var encoder8 = new TextEncoder();
+function base64Bytes(text) {
+  try {
+    return Uint8Array.from(atob(text), (c) => c.charCodeAt(0));
+  } catch {
+    return void 0;
   }
-  idle() {
-    this.chain = this.chain.then(() => this.release()).catch((err) => {
-      this.failed ??= err;
-    });
+}
+function base64Of(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin);
+}
+function clientFirstBare(message3) {
+  const m = /^n,,(n=[^,]*,r=[^,]+)$/.exec(message3);
+  return m ? m[1] : void 0;
+}
+var SERVER_FIRST = /^r=([^,]+),s=([^,]+),i=(\d{1,6})$/;
+var CLIENT_FINAL = /^(c=biws,r=([^,]+)),p=([^,]+)$/;
+var SCRAM_MAX = 1024;
+function exchangeOf(clientFirst, serverFirst, clientFinal) {
+  const bare = clientFirstBare(clientFirst);
+  const sf = SERVER_FIRST.exec(serverFirst);
+  const fin = CLIENT_FINAL.exec(clientFinal);
+  if (!bare || !sf || !fin || [bare, serverFirst, clientFinal].some((t) => t.length > SCRAM_MAX))
+    return void 0;
+  const cnonce = bare.slice(bare.indexOf(",r=") + 3);
+  const nonce = sf[1];
+  const salt = base64Bytes(sf[2]);
+  const iterations = Number(sf[3]);
+  const proof = base64Bytes(fin[3]);
+  const ok4 = fin[2] === nonce && nonce.startsWith(cnonce) && iterations >= 1 && iterations <= 1e5 && salt !== void 0 && proof?.length === 32;
+  if (!ok4) return void 0;
+  return {
+    exchange: {
+      clientFirstBare: bare,
+      serverFirst,
+      clientFinalBare: fin[1],
+      salt,
+      iterations
+    },
+    proof
+  };
+}
+async function hmac(key, data) {
+  const k = await crypto.subtle.importKey(
+    "raw",
+    key,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return new Uint8Array(await crypto.subtle.sign("HMAC", k, data));
+}
+async function scramKeys(password, x) {
+  const base = await crypto.subtle.importKey("raw", encoder8.encode(password), "PBKDF2", false, [
+    "deriveBits"
+  ]);
+  const salted = new Uint8Array(
+    await crypto.subtle.deriveBits(
+      {
+        name: "PBKDF2",
+        hash: "SHA-256",
+        salt: x.salt,
+        iterations: x.iterations
+      },
+      base,
+      256
+    )
+  );
+  const clientKey = await hmac(salted, encoder8.encode("Client Key"));
+  const stored = new Uint8Array(
+    await crypto.subtle.digest("SHA-256", clientKey)
+  );
+  const auth = encoder8.encode(`${x.clientFirstBare},${x.serverFirst},${x.clientFinalBare}`);
+  const signature = await hmac(stored, auth);
+  const proof = clientKey.map((b, i) => b ^ signature[i]);
+  const serverKey = await hmac(salted, encoder8.encode("Server Key"));
+  const serverSignature = await hmac(serverKey, auth);
+  for (const k of [salted, clientKey, stored, signature, serverKey]) k.fill(0);
+  return { proof, serverSignature };
+}
+var SPACES = /[\u00A0\u1680\u2000-\u200B\u202F\u205F\u3000]/g;
+var NOTHING2 = /\u00AD|\u034F|\u1806|[\u180B-\u180D]|\u200C|\u200D|\u2060|[\uFE00-\uFE0F]|\uFEFF/g;
+function saslprep(password) {
+  if (/^[\x00-\x7f]*$/.test(password)) return password;
+  const mapped = password.replace(SPACES, " ").replace(NOTHING2, "");
+  return prepFails(mapped) ? password : mapped.normalize("NFKC");
+}
+function sameBytes(a, b) {
+  if (a.length !== b.length) return false;
+  let d = 0;
+  for (let i = 0; i < a.length; i++) d |= a[i] ^ b[i];
+  return d === 0;
+}
+
+// src/kernel/net/sealed-pg.ts
+var PG_MESSAGE_MAX = 16 * 1024;
+var PROTOCOL_3 = 196608;
+var CLEARTEXT = 3;
+function int32(bytes, at) {
+  return bytes[at] << 24 | bytes[at + 1] << 16 | bytes[at + 2] << 8 | bytes[at + 3];
+}
+function sniffPg(start2) {
+  const bytes = Uint8Array.from(start2, (c) => c.charCodeAt(0));
+  if (bytes.length === 0 || bytes[0] !== 0) return bytes.length === 0 ? "more" : "no";
+  if (bytes.length < 8) return "more";
+  const length2 = int32(bytes, 0);
+  return length2 >= 8 && length2 <= PG_MESSAGE_MAX && int32(bytes, 4) === PROTOCOL_3 ? "yes" : "no";
+}
+var PLUS = "SCRAM-SHA-256-PLUS";
+var SASL = 10;
+var SASL_CONTINUE = 11;
+var SASL_FINAL = 12;
+function latin(bytes) {
+  let out = "";
+  for (const b of bytes) out += String.fromCharCode(b);
+  return out;
+}
+var PgServer = class {
+  buffer = new Uint8Array(0);
+  skip = 0;
+  cleartext = false;
+  sasl = false;
+  serverFirst;
+  expect;
+  failed = false;
+  lost = false;
+  auth(message3) {
+    const code = message3.length >= 9 ? int32(message3, 5) : -1;
+    if (this.expect && code !== SASL_FINAL) this.failed = true;
+    this.cleartext = message3.length === 9 && code === CLEARTEXT;
+    if (code === SASL) return this.mechanisms(message3);
+    else if (code === SASL_CONTINUE) this.serverFirst = latin(message3.subarray(9));
+    else if (code === SASL_FINAL) this.final(message3);
+    return message3;
   }
-  async release() {
-    this.mode = "pass";
-    const out = this.buffer;
-    this.buffer = new Uint8Array(0);
-    try {
-      await writeAll4(this.conn, out);
-    } finally {
-      out.fill(0);
-    }
+  mechanisms(message3) {
+    this.sasl = true;
+    const names2 = latin(message3.subarray(9)).split("\0").filter((n) => n !== "" && n !== PLUS);
+    return frame3(82, `${latin(message3.subarray(5, 9))}${names2.map((n) => `${n}\0`).join("")}\0`);
   }
-  async substitute(end) {
-    this.mode = "pass";
-    const all = this.buffer;
-    this.buffer = new Uint8Array(0);
-    const done4 = await substituteHead(
-      latin12(all.subarray(0, end)),
-      (position, placeholders, head2) => this.ask("http1", position, { placeholders, head: head2 })
-    ).catch(() => void 0);
-    const head = done4 ? bytesOf(done4.head) : all.subarray(0, end);
-    if (done4) this.remember(done4.values);
-    try {
-      await writeAll4(this.conn, head);
-      await writeAll4(this.conn, all.subarray(end));
-    } finally {
-      head.fill(0);
-      all.fill(0);
+  final(message3) {
+    const expect = this.expect;
+    if (!expect) return;
+    this.expect = void 0;
+    const data = latin(message3.subarray(9));
+    if (data !== expect.real || expect.fake.length !== expect.real.length) {
+      this.failed = true;
+      return;
     }
+    for (let i = 0; i < expect.fake.length; i++) message3[9 + i] = expect.fake.charCodeAt(i);
   }
-  flushed() {
-    clearTimeout(this.timer);
-    this.chain = this.chain.then(() => this.mode === "pass" ? void 0 : this.release());
-    return this.chain;
-  }
-  drop() {
-    clearTimeout(this.timer);
-    this.buffer.fill(0);
-    this.buffer = new Uint8Array(0);
-    this.mode = "pass";
-  }
-};
-var IDLE2 = /* @__PURE__ */ Symbol("idle");
-var ScrubReader = class {
-  stream;
-  version = 0;
-  next;
-  held = false;
-  ended = false;
-  conn;
-  scope;
-  constructor(conn, scope) {
-    this.conn = conn;
-    this.scope = scope;
-  }
-  current() {
-    const scrub = this.scope.of();
-    if (!scrub || scrub.version === this.version) return new Uint8Array(0);
-    const tail2 = this.stream?.end() ?? new Uint8Array(0);
-    const stream2 = scrub.scrubber.stream();
-    this.stream = stream2;
-    this.version = scrub.version;
-    this.held = tail2.length > 0;
-    return tail2.length > 0 ? stream2.push(tail2) : tail2;
+  lose() {
+    this.lost = true;
+    this.cleartext = false;
+    this.sasl = false;
+    if (this.expect) this.failed = true;
+    this.expect = void 0;
   }
-  async read() {
+  filter(bytes) {
+    if (this.lost) return bytes;
+    const data = new Uint8Array(this.buffer.length + bytes.length);
+    data.set(this.buffer);
+    data.set(bytes, this.buffer.length);
+    const out = [];
+    let at = 0;
     for (; ; ) {
-      if (this.ended) return null;
-      const tail2 = this.current();
-      if (tail2.length > 0) return tail2;
-      const next3 = this.next ?? this.conn.read();
-      this.next = void 0;
-      const got = this.held ? await Promise.race([next3, idle()]) : await next3;
-      if (got === IDLE2) {
-        this.next = next3;
-        this.held = false;
-        const out2 = this.stream.idle();
-        if (out2.length > 0) return out2;
+      const left = data.length - at;
+      if (this.skip > 0) {
+        const n = Math.min(this.skip, left);
+        out.push(data.subarray(at, at + n));
+        this.skip -= n;
+        at += n;
+        if (this.skip > 0) break;
         continue;
       }
-      const before = this.current();
-      const out = this.through(got);
-      if (before.length === 0 && out !== void 0) return out;
-      if (before.length > 0) return joined3(before, out);
-    }
-  }
-  through(got) {
-    const stream2 = this.stream;
-    if (!stream2) return got;
-    if (got === null) {
-      this.ended = true;
-      const out2 = stream2.end();
-      return out2.length > 0 ? out2 : null;
-    }
-    const out = stream2.push(got);
-    this.held = true;
-    return out.length > 0 ? out : void 0;
-  }
-};
-function joined3(a, b) {
-  if (!b) return a;
-  const out = new Uint8Array(a.length + b.length);
-  out.set(a);
-  out.set(b, a.length);
-  return out;
-}
-function idle() {
-  return new Promise((resolve2) => setTimeout(() => resolve2(IDLE2), SCRUB_IDLE_MS));
-}
-function sealedConn(conn, s) {
-  const pg = new PgServer();
-  const scope = s.broker.sessions.scope(s.pid, s.host);
-  const writer = substitutes(s) ? new SessionWriter(conn, s, pg, scope) : void 0;
-  const observed = {
-    ...conn,
-    read: async () => {
-      for (; ; ) {
-        const bytes = await conn.read();
-        if (!bytes) return bytes;
-        const out = writer?.sawPg ? pg.filter(bytes) : bytes;
-        if (pg.failed) {
-          conn.close();
-          throw new KernelError(
-            "EPROTO",
-            "ERR_SSL_PROTOCOL_ERROR: the pg server failed the SCRAM proof"
-          );
+      if (left < 5) break;
+      const whole = 1 + int32(data, at + 1);
+      if (whole < 5 || data[at] === 82 && whole > PG_MESSAGE_MAX) {
+        this.lose();
+        out.push(data.subarray(at));
+        at = data.length;
+        break;
+      }
+      if (data[at] !== 82) {
+        if (this.expect) {
+          this.failed = true;
+          break;
         }
-        if (out.length > 0) return out;
+        this.skip = whole;
+        continue;
       }
+      if (left < whole) break;
+      out.push(this.auth(data.slice(at, at + whole)));
+      at += whole;
     }
-  };
-  const reader = new ScrubReader(writer ? observed : conn, scope);
-  return {
-    localAddr: conn.localAddr,
-    remoteAddr: conn.remoteAddr,
-    read: () => reader.read(),
-    write: (bytes) => writer ? writer.write(bytes) : conn.write(bytes),
-    closeWrite() {
-      if (!writer) return conn.closeWrite();
-      void writer.flushed().then(
-        () => conn.closeWrite(),
-        () => conn.closeWrite()
-      );
-    },
-    close() {
-      writer?.drop();
-      conn.close();
-    }
-  };
-}
-
-// src/kernel/net/tls-chain.ts
-var CN_MISMATCH = 4;
-var NOT_TRUSTED = 8;
-function tlv2(der, at) {
-  if (at + 2 > der.length) return void 0;
-  const first = der[at + 1];
-  let body = at + 2;
-  let length2 = first;
-  if (first & 128) {
-    const n = first & 127;
-    if (n === 0 || n > 4 || body + n > der.length) return void 0;
-    length2 = 0;
-    for (let i = 0; i < n; i++) length2 = length2 * 256 + der[body + i];
-    body += n;
+    this.buffer = data.slice(at);
+    const joined4 = new Uint8Array(out.reduce((n, b) => n + b.length, 0));
+    let to = 0;
+    for (const b of out) {
+      joined4.set(b, to);
+      to += b.length;
+    }
+    return joined4;
   }
-  const end = body + length2;
-  return end > der.length ? void 0 : { start: at, body, end };
+};
+function frame3(type, body) {
+  const out = new Uint8Array(5 + body.length);
+  out[0] = type;
+  const length2 = 4 + body.length;
+  out.set([length2 >>> 24 & 255, length2 >>> 16 & 255, length2 >>> 8 & 255, length2 & 255], 1);
+  for (let i = 0; i < body.length; i++) out[5 + i] = body.charCodeAt(i);
+  return out;
 }
-function children2(der, outer, max) {
-  const fields = [];
-  for (let at = outer.body; at < outer.end && fields.length < max; ) {
-    const field4 = tlv2(der, at);
-    if (!field4) return void 0;
-    fields.push(field4);
-    at = field4.end;
-  }
-  return fields;
+function pgLength(bytes, started) {
+  const header4 = started ? 5 : 4;
+  if (bytes.length < header4) return void 0;
+  const length2 = int32(bytes, started ? 1 : 0);
+  return started ? 1 + length2 : length2;
 }
-function tbsFields(der) {
-  const outer = tlv2(der, 0);
-  const cert = outer && children2(der, outer, 3);
-  const tbs = cert?.[0] && children2(der, cert[0], 8);
-  if (!cert || !tbs) return void 0;
-  return { cert, tbs: der[tbs[0]?.start ?? 0] === 160 ? tbs.slice(1) : tbs };
+var MECHANISMS = /* @__PURE__ */ new Set(["SCRAM-SHA-256"]);
+async function cleartext(message3, asks) {
+  const body = latin(message3.subarray(5));
+  if (!body.endsWith("\0") || body.indexOf("\0") !== body.length - 1)
+    return { bytes: message3, done: true };
+  const password = body.slice(0, -1);
+  const placeholders = placeholdersIn(password);
+  if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS)
+    return { bytes: message3, done: true };
+  const values = usable(await asks.cleartext(placeholders));
+  if (Object.keys(values).length === 0) return { bytes: message3, done: true };
+  return { bytes: frame3(112, `${replaced(password, values)}\0`), values, done: true };
 }
-var raw = (der, t) => der.subarray(t.start, t.end);
-function names(der) {
-  const fields = tbsFields(der)?.tbs;
-  const [, , issuer, , subject] = fields ?? [];
-  if (!issuer || !subject) return void 0;
-  return [raw(der, issuer), raw(der, subject)];
+function initial(message3) {
+  const body = latin(message3.subarray(5));
+  const nul = body.indexOf("\0");
+  if (nul < 0 || !MECHANISMS.has(body.slice(0, nul)) || body.length < nul + 5) return void 0;
+  const data = message3.subarray(5 + nul + 5);
+  return int32(message3, 5 + nul + 1) === data.length ? latin(data) : void 0;
 }
-var hex3 = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
-var HASHES = {
-  "2a864886f70d01010b": ["RSASSA-PKCS1-v1_5", "SHA-256"],
-  "2a864886f70d01010c": ["RSASSA-PKCS1-v1_5", "SHA-384"],
-  "2a864886f70d01010d": ["RSASSA-PKCS1-v1_5", "SHA-512"],
-  "2a8648ce3d040302": ["ECDSA", "SHA-256"],
-  "2a8648ce3d040303": ["ECDSA", "SHA-384"],
-  "2a8648ce3d040304": ["ECDSA", "SHA-512"],
-  "2b6570": ["Ed25519", ""],
-  "2a864886f70d01010a": ["RSA-PSS", "SHA-1"]
-};
-var PSS_HASHES = {
-  "2b0e03021a": "SHA-1",
-  "608648016503040201": "SHA-256",
-  "608648016503040202": "SHA-384",
-  "608648016503040203": "SHA-512"
-};
-function pssOf(der, algorithm) {
-  const params = children2(der, algorithm, 2)?.[1];
-  let hash = "SHA-1";
-  let salt = 20;
-  for (const field4 of params && der[params.start] === 48 ? children2(der, params, 3) ?? [] : []) {
-    const inner = tlv2(der, field4.body);
-    if (!inner) return void 0;
-    if (der[field4.start] === 160) {
-      const known = PSS_HASHES[oidOf(der, inner) ?? ""];
-      if (!known) return void 0;
-      hash = known;
-    } else if (der[field4.start] === 162) {
-      salt = der.subarray(inner.body, inner.end).reduce((n, b) => n * 256 + b, 0);
+var PgClient = class {
+  clientFirst;
+  server;
+  asks;
+  constructor(server, asks) {
+    this.server = server;
+    this.asks = asks;
+  }
+  async message(message3) {
+    const server = this.server;
+    if (message3[0] !== 112) return { bytes: message3, done: true };
+    if (server.cleartext) {
+      server.cleartext = false;
+      return cleartext(message3, this.asks);
+    }
+    if (server.sasl && this.clientFirst === void 0) {
+      this.clientFirst = initial(message3);
+      return { bytes: message3, done: this.clientFirst === void 0 };
     }
+    if (this.clientFirst !== void 0 && server.serverFirst !== void 0)
+      return this.final(message3, this.clientFirst, server.serverFirst);
+    return { bytes: message3, done: true };
+  }
+  async final(message3, first, serverFirst) {
+    const got = exchangeOf(first, serverFirst, latin(message3.subarray(5)));
+    if (!got) return { bytes: message3, done: true };
+    const x = got.exchange;
+    const values = usable(
+      await this.asks.scram({
+        clientFirstBare: x.clientFirstBare,
+        serverFirst: x.serverFirst,
+        clientFinalBare: x.clientFinalBare,
+        proof: base64Of(got.proof)
+      })
+    );
+    const [entry, ...more] = Object.entries(values);
+    if (!entry || more.length > 0) return { bytes: message3, done: true };
+    const [placeholder, value2] = entry;
+    const fake = await scramKeys(placeholder, x);
+    if (!sameBytes(fake.proof, got.proof)) return { bytes: message3, done: true };
+    const real = await scramKeys(saslprep(value2), x);
+    this.server.expect = {
+      real: `v=${base64Of(real.serverSignature)}`,
+      fake: `v=${base64Of(fake.serverSignature)}`
+    };
+    const bytes = frame3(112, `${x.clientFinalBare},p=${base64Of(real.proof)}`);
+    for (const k of [real.proof, real.serverSignature, fake.proof, fake.serverSignature]) k.fill(0);
+    return { bytes, values, done: true };
   }
-  return { hash, salt };
-}
-var CURVES = {
-  "2a8648ce3d030107": ["P-256", 32],
-  "2b81040022": ["P-384", 48],
-  "2b81040023": ["P-521", 66]
 };
-function oidOf(der, algorithm, index = 0) {
-  const parts2 = children2(der, algorithm, 2);
-  const oid2 = parts2?.[index];
-  return oid2 && der[oid2.start] === 6 ? hex3(der.subarray(oid2.body, oid2.end)) : void 0;
-}
-function curveOf(der, spki) {
-  const algorithm = children2(der, spki, 1)?.[0];
-  const curve = algorithm && oidOf(der, algorithm, 1);
-  return curve ? CURVES[curve] : void 0;
-}
-function fixedEcdsa(sig, size) {
-  const outer = tlv2(sig, 0);
-  const ints = outer && children2(sig, outer, 2);
-  if (ints?.length !== 2) return void 0;
-  const out = new Uint8Array(size * 2);
-  for (const [i, int] of ints.entries()) {
-    let value2 = sig.subarray(int.body, int.end);
-    while (value2.length > size && value2[0] === 0) value2 = value2.subarray(1);
-    if (value2.length > size) return void 0;
-    out.set(value2, (i + 1) * size - value2.length);
+
+// src/kernel/net/sealed-smtp.ts
+var SMTP_LINE_MAX = 4096;
+var GREETING = ["EHLO ", "HELO "];
+function sniffSmtp(start2) {
+  const upper = start2.toUpperCase();
+  for (const word of GREETING) {
+    if (upper.startsWith(word)) return "yes";
+    if (word.startsWith(upper)) return "more";
   }
-  return out;
-}
-function signedOf(der) {
-  const parts2 = tbsFields(der);
-  const [tbs, algorithm, value2] = parts2?.cert ?? [];
-  const spki = parts2?.tbs[5];
-  if (!tbs || !algorithm || !value2 || !spki || der[value2.start] !== 3) return void 0;
-  const known = HASHES[oidOf(der, algorithm) ?? ""];
-  if (!known) return void 0;
-  const [scheme] = known;
-  const pss = scheme === "RSA-PSS" ? pssOf(der, algorithm) : void 0;
-  if (scheme === "RSA-PSS" && !pss) return void 0;
-  const hash = pss?.hash ?? known[1];
-  const curve = scheme === "ECDSA" ? curveOf(der, spki) : void 0;
-  if (scheme === "ECDSA" && !curve) return void 0;
-  const signature = der.subarray(value2.body + 1, value2.end);
-  return {
-    tbs: raw(der, tbs),
-    spki: raw(der, spki),
-    signature,
-    scheme,
-    hash,
-    ...curve ? { curve } : {},
-    ...pss ? { salt: pss.salt } : {}
-  };
+  return "no";
 }
-async function verifiesItself(s) {
-  const name2 = s.curve?.[0];
-  const algorithm = s.scheme === "ECDSA" ? { name: "ECDSA", namedCurve: name2 } : s.hash ? { name: s.scheme, hash: s.hash } : { name: s.scheme };
-  const key = await crypto.subtle.importKey("spki", new Uint8Array(s.spki), algorithm, false, [
-    "verify"
-  ]);
-  const signature = s.curve ? fixedEcdsa(s.signature, s.curve[1]) : s.signature;
-  if (!signature) return false;
-  const params = s.scheme === "ECDSA" ? { name: "ECDSA", hash: s.hash } : s.salt === void 0 ? { name: s.scheme } : { name: s.scheme, saltLength: s.salt };
-  return crypto.subtle.verify(params, key, new Uint8Array(signature), new Uint8Array(s.tbs));
+function decoded(b642) {
+  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(b642)) return void 0;
+  try {
+    return atob(b642);
+  } catch {
+    return void 0;
+  }
 }
-async function selfSigned(der) {
-  if (!selfIssued(der)) return false;
-  const signed = signedOf(der);
-  if (!signed) return false;
-  return verifiesItself(signed).catch(() => false);
+async function swapped2(text, position, ask) {
+  const placeholders = placeholdersIn(text);
+  if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS) return void 0;
+  const values = usable(await ask(position, placeholders));
+  if (Object.keys(values).length === 0) return void 0;
+  return { text: replaced(text, values), values };
 }
-async function chainShape(chain2) {
-  return {
-    leafSelfSigned: chain2.length === 1 && await selfSigned(chain2[0]),
-    topSelfSigned: chain2.length > 1 && await selfSigned(chain2.at(-1))
-  };
+async function plain2(b642, ask) {
+  const text = decoded(b642);
+  const fields = text?.split("\0");
+  if (fields?.length !== 3) return { line: b642 };
+  const [authz, user, pass2] = fields;
+  if (placeholdersIn(authz + user).length > 0) return { line: b642 };
+  const done4 = await swapped2(pass2, "auth-plain", ask);
+  if (!done4) return { line: b642 };
+  return { line: btoa(`${authz}\0${user}\0${done4.text}`), values: done4.values };
 }
-function selfIssued(der) {
-  const pair = der && names(der);
-  if (!pair) return false;
-  const [issuer, subject] = pair;
-  return issuer.length === subject.length && issuer.every((b, i) => b === subject[i]);
+async function login(b642, ask) {
+  const text = decoded(b642);
+  const done4 = text === void 0 ? void 0 : await swapped2(text, "auth-login", ask);
+  return done4 ? { line: btoa(done4.text), values: done4.values } : { line: b642 };
 }
-function untrusted(chain2, shape) {
-  if (chain2.length === 1) {
-    return shape.leafSelfSigned ? "DEPTH_ZERO_SELF_SIGNED_CERT" : "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
+var SmtpClient = class {
+  state = "command";
+  ask;
+  constructor(ask) {
+    this.ask = ask;
   }
-  return shape.topSelfSigned ? "SELF_SIGNED_CERT_IN_CHAIN" : "UNABLE_TO_GET_ISSUER_CERT_LOCALLY";
+  get done() {
+    return this.state === "done";
+  }
+  async line(text) {
+    const state = this.state;
+    if (state === "done") return { line: text };
+    if (state === "plain" || state === "password") {
+      this.state = "done";
+      if (text === "*") return { line: text };
+      return state === "plain" ? plain2(text, this.ask) : login(text, this.ask);
+    }
+    if (state === "user") {
+      this.state = text === "*" ? "done" : "password";
+      return { line: text };
+    }
+    return this.command(text);
+  }
+  async command(text) {
+    const m = /^AUTH[ \t]+(PLAIN|LOGIN)(?:[ \t]+(\S+))?$/i.exec(text);
+    if (!m) {
+      if (/^(MAIL|RCPT|DATA|BDAT|AUTH)\b/i.test(text)) this.state = "done";
+      return { line: text };
+    }
+    const mech = m[1].toUpperCase();
+    const arg = m[2];
+    if (mech === "LOGIN") {
+      this.state = arg === void 0 ? "user" : "password";
+      return { line: text };
+    }
+    if (arg === void 0) {
+      this.state = "plain";
+      return { line: text };
+    }
+    this.state = "done";
+    const out = await plain2(arg, this.ask);
+    return {
+      line: `${text.slice(0, text.length - arg.length)}${out.line}`,
+      ...out.values ? { values: out.values } : {}
+    };
+  }
+};
+
+// src/kernel/net/sealed-conn.ts
+var HEAD_IDLE_MS = 2e3;
+function substitutes(s) {
+  return (s.verified || s.anchoring !== void 0) && s.alpn !== "h2" && s.broker.hook !== void 0 && typeof s.exit === "string" && SESSION_EXIT.test(s.exit);
 }
-function chainError(flags2, chain2, shape) {
-  if (flags2 === -1) return "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
-  const rest2 = flags2 & ~CN_MISMATCH;
-  if (rest2 === 0) return void 0;
-  if (rest2 & NOT_TRUSTED) return untrusted(chain2, shape);
-  return verifyCode(rest2);
+function sessionId() {
+  const bytes = crypto.getRandomValues(new Uint8Array(24));
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_");
 }
-function nameMatches(flags2) {
-  return flags2 !== -1 && (flags2 & CN_MISMATCH) === 0;
+function latin12(bytes) {
+  let out = "";
+  for (const b of bytes) out += String.fromCharCode(b);
+  return out;
 }
-
-// src/kernel/net/tls-ciphers.ts
-var SUITES = [
-  [4865, "TLS_AES_128_GCM_SHA256", "TLS_AES_128_GCM_SHA256", "TLSv1.3"],
-  [4866, "TLS_AES_256_GCM_SHA384", "TLS_AES_256_GCM_SHA384", "TLSv1.3"],
-  [4867, "TLS_CHACHA20_POLY1305_SHA256", "TLS_CHACHA20_POLY1305_SHA256", "TLSv1.3"],
-  [4868, "TLS_AES_128_CCM_SHA256", "TLS_AES_128_CCM_SHA256", "TLSv1.3"],
-  [4869, "TLS_AES_128_CCM_8_SHA256", "TLS_AES_128_CCM_8_SHA256", "TLSv1.3"],
-  [49195, "ECDHE-ECDSA-AES128-GCM-SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
-  [49196, "ECDHE-ECDSA-AES256-GCM-SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"],
-  [49199, "ECDHE-RSA-AES128-GCM-SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
-  [49200, "ECDHE-RSA-AES256-GCM-SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"],
-  [52392, "ECDHE-RSA-CHACHA20-POLY1305", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLSv1.2"],
-  [
-    52393,
-    "ECDHE-ECDSA-CHACHA20-POLY1305",
-    "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
-    "TLSv1.2"
-  ],
-  [49187, "ECDHE-ECDSA-AES128-SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "TLSv1.2"],
-  [49188, "ECDHE-ECDSA-AES256-SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLSv1.2"],
-  [49191, "ECDHE-RSA-AES128-SHA256", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLSv1.2"],
-  [49192, "ECDHE-RSA-AES256-SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLSv1.2"],
-  [49161, "ECDHE-ECDSA-AES128-SHA", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLSv1.0"],
-  [49162, "ECDHE-ECDSA-AES256-SHA", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLSv1.0"],
-  [49171, "ECDHE-RSA-AES128-SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLSv1.0"],
-  [49172, "ECDHE-RSA-AES256-SHA", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLSv1.0"],
-  [156, "AES128-GCM-SHA256", "TLS_RSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
-  [157, "AES256-GCM-SHA384", "TLS_RSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"],
-  [158, "DHE-RSA-AES128-GCM-SHA256", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "TLSv1.2"],
-  [159, "DHE-RSA-AES256-GCM-SHA384", "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "TLSv1.2"]
-];
-function cipherOf(id2, protocol) {
-  const known = SUITES.find(([n]) => n === id2);
-  const hex4 = `0x${id2.toString(16).padStart(4, "0").toUpperCase()}`;
-  return {
-    name: known?.[1] ?? hex4,
-    standardName: known?.[2] ?? hex4,
-    version: known?.[3] ?? protocol
-  };
+function bytesOf(text) {
+  const out = new Uint8Array(text.length);
+  for (let i = 0; i < text.length; i++) out[i] = text.charCodeAt(i);
+  return out;
 }
-
-// src/kernel/net/tls-client.ts
-var WRITE_CHUNK = 16 * 1024;
-var BADCERT = [
-  [8, "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"],
-  [1, "CERT_HAS_EXPIRED"],
-  [512, "CERT_NOT_YET_VALID"],
-  [2, "CERT_REVOKED"],
-  [4, "ERR_TLS_CERT_ALTNAME_INVALID"],
-  [2048, "INVALID_PURPOSE"],
-  [4096, "INVALID_PURPOSE"]
-];
-function verifyCode(flags2) {
-  if (flags2 === 0) return void 0;
-  if (flags2 === -1) return "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
-  return BADCERT.find(([bit]) => (flags2 & bit) !== 0)?.[1] ?? "UNABLE_TO_VERIFY_LEAF_SIGNATURE";
+async function writeAll4(conn, bytes) {
+  for (let at = 0; at < bytes.length; ) at += await conn.write(bytes.subarray(at));
 }
-function isIP(name2) {
-  return ipv4Bytes(name2) !== void 0 || name2.includes(":") && ipv6Groups(name2) !== void 0;
+var CRLF2 = [13, 10, 13, 10];
+function headEnd2(bytes) {
+  for (let i = 0; i + 3 < bytes.length; i++) {
+    if (CRLF2.every((b, k) => bytes[i + k] === b)) return i + 4;
+  }
+  return -1;
 }
-function clientFlags(o) {
-  return (o.insecure ? TLS_CLIENT_INSECURE_SKIP_VERIFY : 0) | (o.sni === false ? TLS_CLIENT_NO_SNI : 0) | (o.checkHostname === false ? TLS_CLIENT_VERIFY_CHAIN_ONLY : 0);
+function modeOf(start2) {
+  const sniffs = [
+    ["http1", sniffHttp1(start2)],
+    ["smtp", sniffSmtp(start2)],
+    ["pg", sniffPg(start2)]
+  ];
+  const hit = sniffs.find(([, v]) => v === "yes");
+  if (hit) return hit[0];
+  return sniffs.every(([, v]) => v === "no") ? "pass" : void 0;
 }
-function openSession(o) {
-  return o.engine.clientSession(o.store, o.servername, o.alpn, clientFlags(o));
+function crlf(bytes) {
+  for (let i = 0; i + 1 < bytes.length; i++) if (bytes[i] === 13 && bytes[i + 1] === 10) return i;
+  return -1;
 }
-var Ciphertext = class {
-  queue = [];
+var SessionWriter = class {
+  buffer = new Uint8Array(0);
+  mode = "sniff";
+  timer;
+  chain = Promise.resolve();
+  failed;
+  session = sessionId();
+  smtp;
+  pgStarted = false;
+  sawPg = false;
+  conn;
+  s;
+  pgClient;
+  scope;
+  constructor(conn, s, pg, scope) {
+    this.conn = conn;
+    this.s = s;
+    this.scope = scope;
+    this.pgClient = new PgClient(pg, {
+      cleartext: (placeholders) => this.ask("pg", "password-cleartext", { placeholders }),
+      scram: (scram) => this.ask("pg", "scram-sha-256", { scram })
+    });
+    this.smtp = new SmtpClient(
+      (position, placeholders) => this.ask("smtp", position, { placeholders })
+    );
+  }
+  write(bytes) {
+    const run2 = this.chain.then(() => this.take(bytes));
+    this.chain = run2.then(
+      () => void 0,
+      () => void 0
+    );
+    return run2;
+  }
+  proven;
+  proof(protocol) {
+    this.proven ??= this.prove(protocol).catch(() => void 0);
+    return this.proven;
+  }
+  async prove(protocol) {
+    const s = this.s;
+    if (s.anchoring) {
+      const found = await s.broker.sessionAnchors({
+        stamp: await s.stamp(),
+        session: this.session,
+        host: s.host,
+        port: s.port,
+        protocol,
+        exit: s.exit
+      });
+      const anchor = found ? await s.anchoring(found) : void 0;
+      if (anchor) return { anchor };
+    }
+    return s.verified ? {} : void 0;
+  }
+  async ask(protocol, position, extra) {
+    const s = this.s;
+    const proof = await this.proof(protocol);
+    if (!proof) return void 0;
+    return s.broker.sessionMaterialize({
+      stamp: await s.stamp(),
+      session: this.session,
+      host: s.host,
+      port: s.port,
+      protocol,
+      position,
+      verified: true,
+      ...proof.anchor ? { verifiedBy: "anchored", anchor: proof.anchor } : { verifiedBy: "roots" },
+      handshakeAt: s.handshakeAt,
+      exit: s.exit,
+      ...extra
+    });
+  }
+  remember(values) {
+    this.scope.add(
+      Object.entries(values).map(([placeholder, value2]) => ({ name: "sealed", value: value2, placeholder }))
+    );
+  }
+  async take(bytes) {
+    if (this.failed !== void 0) throw this.failed;
+    if (this.mode === "pass") return this.conn.write(bytes);
+    clearTimeout(this.timer);
+    const joined4 = new Uint8Array(this.buffer.length + bytes.length);
+    joined4.set(this.buffer);
+    joined4.set(bytes, this.buffer.length);
+    this.buffer.fill(0);
+    this.buffer = joined4;
+    if (this.mode === "sniff") this.mode = modeOf(latin12(joined4.subarray(0, 8))) ?? "sniff";
+    if (this.mode === "pg") this.sawPg = true;
+    if (this.mode === "pass") await this.release();
+    else if (this.mode === "http1") await this.http1();
+    else if (this.mode === "smtp") await this.lines();
+    else if (this.mode === "pg") await this.messages();
+    if (this.mode !== "pass" && this.buffer.length > 0)
+      this.timer = setTimeout(() => this.idle(), HEAD_IDLE_MS);
+    return bytes.length;
+  }
+  async http1() {
+    const end = headEnd2(this.buffer);
+    if (end > HEAD_MAX || end < 0 && this.buffer.length > HEAD_MAX) await this.release();
+    else if (end >= 0) await this.substitute(end);
+  }
+  async lines() {
+    for (; ; ) {
+      const at = crlf(this.buffer);
+      if (at < 0) break;
+      if (at > SMTP_LINE_MAX) return this.release();
+      const all = this.buffer;
+      this.buffer = all.slice(at + 2);
+      const out = await this.smtp.line(latin12(all.subarray(0, at))).catch(() => ({ line: latin12(all.subarray(0, at)) }));
+      all.fill(0);
+      if ("values" in out && out.values) this.remember(out.values);
+      const line = bytesOf(`${out.line}\r
+`);
+      try {
+        await writeAll4(this.conn, line);
+      } finally {
+        line.fill(0);
+      }
+      if (this.smtp.done) return this.release();
+    }
+    if (this.buffer.length > SMTP_LINE_MAX) await this.release();
+  }
+  async messages() {
+    for (; ; ) {
+      const whole = pgLength(this.buffer, this.pgStarted);
+      if (whole === void 0 || whole < 4 || whole > PG_MESSAGE_MAX) {
+        if (whole !== void 0) await this.release();
+        return;
+      }
+      if (this.buffer.length < whole) return;
+      const message3 = this.buffer.slice(0, whole);
+      this.buffer = this.buffer.slice(whole);
+      const started = this.pgStarted;
+      this.pgStarted = true;
+      const out = started ? await this.pgClient.message(message3).catch(() => ({ bytes: message3, done: true })) : { bytes: message3, done: false };
+      if ("values" in out && out.values) this.remember(out.values);
+      try {
+        await writeAll4(this.conn, out.bytes);
+      } finally {
+        out.bytes.fill(0);
+        message3.fill(0);
+      }
+      if (out.done) return this.release();
+    }
+  }
+  idle() {
+    this.chain = this.chain.then(() => this.release()).catch((err) => {
+      this.failed ??= err;
+    });
+  }
+  async release() {
+    this.mode = "pass";
+    const out = this.buffer;
+    this.buffer = new Uint8Array(0);
+    try {
+      await writeAll4(this.conn, out);
+    } finally {
+      out.fill(0);
+    }
+  }
+  async substitute(end) {
+    this.mode = "pass";
+    const all = this.buffer;
+    this.buffer = new Uint8Array(0);
+    const done4 = await substituteHead(
+      latin12(all.subarray(0, end)),
+      (position, placeholders, head2) => this.ask("http1", position, { placeholders, head: head2 })
+    ).catch(() => void 0);
+    const head = done4 ? bytesOf(done4.head) : all.subarray(0, end);
+    if (done4) this.remember(done4.values);
+    try {
+      await writeAll4(this.conn, head);
+      await writeAll4(this.conn, all.subarray(end));
+    } finally {
+      head.fill(0);
+      all.fill(0);
+    }
+  }
+  flushed() {
+    clearTimeout(this.timer);
+    this.chain = this.chain.then(() => this.mode === "pass" ? void 0 : this.release());
+    return this.chain;
+  }
+  drop() {
+    clearTimeout(this.timer);
+    this.buffer.fill(0);
+    this.buffer = new Uint8Array(0);
+    this.mode = "pass";
+  }
+};
+var IDLE2 = /* @__PURE__ */ Symbol("idle");
+var ScrubReader = class {
+  stream;
+  version = 0;
+  next;
+  held = false;
   ended = false;
   conn;
-  session;
-  constructor(conn, session) {
+  scope;
+  constructor(conn, scope) {
     this.conn = conn;
-    this.session = session;
+    this.scope = scope;
   }
-  hand(bytes) {
-    if (bytes.length > 0) this.queue.push(bytes);
+  current() {
+    const scrub = this.scope.of();
+    if (!scrub || scrub.version === this.version) return new Uint8Array(0);
+    const tail2 = this.stream?.end() ?? new Uint8Array(0);
+    const stream2 = scrub.scrubber.stream();
+    this.stream = stream2;
+    this.version = scrub.version;
+    this.held = tail2.length > 0;
+    return tail2.length > 0 ? stream2.push(tail2) : tail2;
   }
-  async more() {
-    if (this.queue.length === 0 && !this.ended) {
-      const bytes = await this.conn.read();
-      if (bytes) this.queue.push(bytes);
-      else this.ended = true;
-    }
-    if (this.queue.length === 0) {
-      this.session.feedEnd();
-      return false;
-    }
-    while (this.queue.length > 0) {
-      const head = this.queue[0];
-      const n = this.session.feed(head);
-      if (n < head.length) {
-        this.queue[0] = head.subarray(n);
-        break;
+  async read() {
+    for (; ; ) {
+      if (this.ended) return null;
+      const tail2 = this.current();
+      if (tail2.length > 0) return tail2;
+      const next3 = this.next ?? this.conn.read();
+      this.next = void 0;
+      const got = this.held ? await Promise.race([next3, idle()]) : await next3;
+      if (got === IDLE2) {
+        this.next = next3;
+        this.held = false;
+        const out2 = this.stream.idle();
+        if (out2.length > 0) return out2;
+        continue;
       }
-      this.queue.shift();
+      const before = this.current();
+      const out = this.through(got);
+      if (before.length === 0 && out !== void 0) return out;
+      if (before.length > 0) return joined3(before, out);
     }
-    return true;
   }
-};
-async function send(conn, session) {
-  for (; ; ) {
-    const out = session.take();
-    if (out.length === 0) return;
-    for (let at = 0; at < out.length; ) {
-      const n = await conn.write(out.subarray(at));
-      if (!(n > 0)) throw new KernelError("EPIPE");
-      at += n;
+  through(got) {
+    const stream2 = this.stream;
+    if (!stream2) return got;
+    if (got === null) {
+      this.ended = true;
+      const out2 = stream2.end();
+      return out2.length > 0 ? out2 : null;
     }
+    const out = stream2.push(got);
+    this.held = true;
+    return out.length > 0 ? out : void 0;
   }
+};
+function joined3(a, b) {
+  if (!b) return a;
+  const out = new Uint8Array(a.length + b.length);
+  out.set(a);
+  out.set(b, a.length);
+  return out;
 }
-function refused2(engine, session, err) {
-  const flags2 = session.verifyResult;
-  const code = verifyCode(flags2);
-  if (code && flags2 !== -1)
-    return new KernelError("EPROTO", `${code}: ${engine.verifyInfo(flags2).trim()}`);
-  const text = err instanceof TlsError ? err.message : String(err);
-  return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
-}
-function alertOf(session) {
-  const alert = session.lastAlert;
-  return alert >= 0 ? ` (alert ${alert})` : "";
+function idle() {
+  return new Promise((resolve2) => setTimeout(() => resolve2(IDLE2), SCRUB_IDLE_MS));
 }
-async function handshake(conn, o, session, inbox) {
-  for (; ; ) {
-    let done4;
-    try {
-      done4 = session.handshake();
-    } catch (err) {
-      await send(conn, session).catch(() => void 0);
-      throw refused2(o.engine, session, err);
-    }
-    await send(conn, session);
-    if (done4) return;
-    if (!await inbox.more()) {
-      throw new KernelError(
-        "ECONNRESET",
-        "the server closed the connection during the TLS handshake"
-      );
+function sealedConn(conn, s) {
+  const pg = new PgServer();
+  const scope = s.broker.sessions.scope(s.pid, s.host);
+  const writer = substitutes(s) ? new SessionWriter(conn, s, pg, scope) : void 0;
+  const observed = {
+    ...conn,
+    read: async () => {
+      for (; ; ) {
+        const bytes = await conn.read();
+        if (!bytes) return bytes;
+        const out = writer?.sawPg ? pg.filter(bytes) : bytes;
+        if (pg.failed) {
+          conn.close();
+          throw new KernelError(
+            "EPROTO",
+            "ERR_SSL_PROTOCOL_ERROR: the pg server failed the SCRAM proof"
+          );
+        }
+        if (out.length > 0) return out;
+      }
     }
-  }
-}
-function insecureOf(session, chain2, shape) {
-  const flags2 = session.verifyResult;
-  const error = chainError(flags2, chain2, shape);
-  return { hostnameMatches: nameMatches(flags2), ...error ? { chainError: error } : {} };
-}
-function controlsOf(o, session, protocol, chain2, shape) {
-  if (!o.engine.sessionControls) return {};
-  const checked = o.checkHostname !== false && !o.insecure;
-  return {
-    cipher: cipherOf(session.ciphersuite, protocol),
-    clientCertificate: o.clientCertificate === true,
-    sni: o.sni !== false && !isIP(o.servername),
-    hostnameChecked: checked,
-    ...o.insecure ? insecureOf(session, chain2, shape) : { hostnameMatches: checked || !session.nameMismatch }
-  };
-}
-function verdictOf(o, session) {
-  if (o.bundled !== true || isIP(o.servername) || session.verifyResult !== 0) return false;
-  return o.checkHostname !== false || !session.nameMismatch;
-}
-async function infoOf(o, session) {
-  const flags2 = session.verifyResult;
-  const code = verifyCode(flags2);
-  const protocol = session.version === 772 ? "TLSv1.3" : "TLSv1.2";
-  const chain2 = session.peerChain();
-  const shape = await chainShape(o.insecure ? chain2 : []);
-  return {
-    protocol,
-    alpnProtocol: session.alpn ?? false,
-    authorized: code === void 0,
-    ...code ? { authorizationError: code, authorizationText: o.engine.verifyInfo(flags2).trim() } : {},
-    peerCertificates: chain2,
-    ...controlsOf(o, session, protocol, chain2, shape),
-    verified: verdictOf(o, session),
-    handshakeAt: Date.now()
-  };
-}
-var FATAL_ALERT = -30592;
-function alerted(err, session) {
-  if (err.code === FATAL_ALERT)
-    return new KernelError(
-      "EPROTO",
-      `ERR_SSL_FATAL_ALERT: the server ended the session: ${err.message}${alertOf(session)}`
-    );
-  return new KernelError("EPROTO", `ERR_SSL_PROTOCOL_ERROR: ${err.message}`);
-}
-function plaintext(conn, session, inbox) {
-  let freed = false;
-  let writeClosed = false;
-  const free = () => {
-    if (freed) return;
-    freed = true;
-    session.free();
   };
+  const reader = new ScrubReader(writer ? observed : conn, scope);
   return {
     localAddr: conn.localAddr,
     remoteAddr: conn.remoteAddr,
-    async read() {
-      for (; ; ) {
-        if (freed) return null;
-        let got;
-        try {
-          got = session.read();
-        } catch (err) {
-          throw alerted(err, session);
-        }
-        await send(conn, session);
-        if (got instanceof Uint8Array) return got;
-        if (got === "eof") return null;
-        await inbox.more();
-      }
-    },
-    async write(bytes) {
-      if (freed) throw new KernelError("EPIPE");
-      for (; ; ) {
-        const n = session.write(bytes.subarray(0, WRITE_CHUNK));
-        await send(conn, session);
-        if (n > 0) return n;
-      }
-    },
+    read: () => reader.read(),
+    write: (bytes) => writer ? writer.write(bytes) : conn.write(bytes),
     closeWrite() {
-      if (writeClosed || freed) return;
-      writeClosed = true;
-      session.close();
-      void send(conn, session).catch(() => void 0).finally(() => conn.closeWrite());
+      if (!writer) return conn.closeWrite();
+      void writer.flushed().then(
+        () => conn.closeWrite(),
+        () => conn.closeWrite()
+      );
     },
     close() {
-      free();
+      writer?.drop();
       conn.close();
     }
   };
 }
-async function tlsClient(conn, o, taken = new Uint8Array(0)) {
-  const session = o.session ?? openSession(o);
-  const inbox = new Ciphertext(conn, session);
-  inbox.hand(taken);
-  try {
-    await handshake(conn, o, session, inbox);
-    const info = await infoOf(o, session);
-    return { conn: plaintext(conn, session, inbox), info };
-  } catch (err) {
-    session.free();
-    throw err;
-  }
-}
 
 // src/kernel/net/tls-uplink.ts
 var isIP2 = (text) => ipv4Bytes(text) !== void 0 || text.includes(":") && ipv6Groups(text) !== void 0;
@@ -19755,6 +19907,7 @@ function sessionOf(info, servername) {
     path: "kernel",
     substitutes: info.substitutes === true,
     verified: info.verified,
+    verifiedBy: info.verified ? "bundled" : "none",
     protocol: info.protocol,
     alpnProtocol: info.alpnProtocol,
     authorized: info.authorized,
@@ -19827,9 +19980,9 @@ function takeCert(req) {
   }
   const chain2 = new Uint8Array(ders.reduce((n, d) => n + d.length, 0));
   let at = 0;
-  for (const der of ders) {
-    chain2.set(der, at);
-    at += der.length;
+  for (const der2 of ders) {
+    chain2.set(der2, at);
+    at += der2.length;
   }
   const pass2 = new TextEncoder().encode(cert.passphrase ?? "");
   return { chain: chain2, key, pass: pass2 };
@@ -19856,7 +20009,7 @@ async function setUp(support, req) {
     throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: ca has no certificate");
   const own = engine.store();
   try {
-    for (const der of custom) own.add(base64Der(der));
+    for (const der2 of custom) own.add(base64Der(der2));
   } catch (err) {
     own.release();
     throw new KernelError("EINVAL", `ERR_INVALID_ARG_VALUE: ca: ${err.message}`);
@@ -19908,6 +20061,13 @@ async function prepareWith(support, req, servername, cert) {
     throw err;
   }
 }
+function anchoringOf(seal, info, servername) {
+  const engine = seal.engine;
+  if (!engine?.chainVerify || isIP2(servername) || info.peerCertificates.length === 0) return {};
+  return {
+    anchoring: (found) => anchorFor(engine, info.peerCertificates, servername, found)
+  };
+}
 function sealing(seal, raw2, info, servername) {
   const { proc } = seal;
   const broker = proc.sealed;
@@ -19922,7 +20082,8 @@ function sealing(seal, raw2, info, servername) {
     exit: raw2.exit,
     verified: info.verified,
     handshakeAt: info.handshakeAt,
-    alpn: info.alpnProtocol
+    alpn: info.alpnProtocol,
+    ...anchoringOf(seal, info, servername)
   };
   return session;
 }
@@ -19932,7 +20093,8 @@ function secure(prepared, seal) {
     ran = true;
     try {
       const made2 = await tlsClient(raw2, prepared.options);
-      const session = sealing(seal, raw2, made2.info, prepared.options.servername);
+      const engine = prepared.options.engine;
+      const session = sealing({ ...seal, engine }, raw2, made2.info, prepared.options.servername);
       if (!session) return made2;
       made2.info.substitutes = substitutes(session);
       return { conn: sealedConn(made2.conn, session), info: made2.info };
@@ -20851,9 +21013,9 @@ var VfsNodes = class {
   }
   open(path, pin, writable2 = false, id2, ino) {
     const found = this.named(path, id2);
-    const same = !found || ino === void 0 || found.ino === void 0 || found.ino === ino;
-    if (found && !same) this.orphan(found);
-    const node = (same ? found : void 0) ?? this.create(path, id2, new VfsNode(this.fs, path, void 0, false, false, pin));
+    const same2 = !found || ino === void 0 || found.ino === void 0 || found.ino === ino;
+    if (found && !same2) this.orphan(found);
+    const node = (same2 ? found : void 0) ?? this.create(path, id2, new VfsNode(this.fs, path, void 0, false, false, pin));
     node.ino ??= ino;
     node.opens++;
     if (writable2) node.writers++;
@@ -24568,6 +24730,10 @@ var SealedBroker = class {
     const req = sessionRequest(fields);
     return this.ask(req, (reply) => sessionValues(reply, req.placeholders));
   }
+  async sessionAnchors(fields) {
+    if (!anchorsAskable(fields)) return void 0;
+    return this.ask(anchorsRequest(fields), anchorsOf);
+  }
   async ask(req, parse) {
     const { hook } = this;
     if (!hook) return void 0;
@@ -25377,14 +25543,14 @@ function hostfsHandlers(current, againMs = RESTORE_AGAIN_MS) {
     return fresh2(remote);
   };
   const call = (op, body = {}) => current().call(op, body);
-  const same = (was, mode, seen) => seen?.mode === (mode | 128) && (was.ino !== void 0 && seen.ino !== void 0 ? seen.ino === was.ino : seen.size === was.size && seen.mtime === was.mtime);
+  const same2 = (was, mode, seen) => seen?.mode === (mode | 128) && (was.ino !== void 0 && seen.ino !== void 0 ? seen.ino === was.ino : seen.size === was.size && seen.mtime === was.mtime);
   const settle = (client, { was, ...restore }) => client.call("setattr", restore).catch((err) => {
     if (!client.gone || !client.cleanup) throw err;
     void client.cleanup("setattr", restore).catch(() => {
     });
     const timer = setTimeout(async () => {
       const seen = await client.cleanup?.("stat", { path: restore.path }).catch(() => null);
-      if (same(was, restore.mode, seen))
+      if (same2(was, restore.mode, seen))
         void client.cleanup?.("setattr", restore).catch(() => {
         });
     }, againMs);
@@ -27560,9 +27726,9 @@ var Launcher = class {
     const known = this.sameFiles.get(`${a}|${b}`);
     if (known?.stamp === stamp) return known.same;
     const [p, q] = await Promise.all([this.base.readFileBuffer(a), this.base.readFileBuffer(b)]);
-    const same = p.length === q.length && p.every((byte, i) => byte === q[i]);
-    this.sameFiles.set(`${a}|${b}`, { stamp, same });
-    return same;
+    const same2 = p.length === q.length && p.every((byte, i) => byte === q[i]);
+    this.sameFiles.set(`${a}|${b}`, { stamp, same: same2 });
+    return same2;
   }
   async wasmOwner(wasm, name2, scope) {
     const leaf = baseName2(wasm);