@ai-ecoverse/slicc-kernel 1.151.1 → 1.152.1

package/dist/kernel-worker.js

@@ -1569,9 +1569,10 @@ var OpfsFs = class {
   }
   async fileId(path) {
     const found = await this.locate(path, true);
-    const [entry] = await this.meta.get([found.path]);
+    const [entry] = await (this.meta.fresh ?? this.meta.get).call(this.meta, [found.path]);
     if (entry?.fid !== void 0) return entry.fid;
     const fid = crypto.randomUUID();
+    this.idWrites++;
     await this.meta.update(found.path, (now) => ({
       ...occupied(now),
       path: found.path,
@@ -1842,6 +1843,10 @@ var OpfsFs = class {
   opfsCalls() {
     return this.calls;
   }
+  idWrites = 0;
+  fileIdWrites() {
+    return this.idWrites;
+  }
   opfsOps() {
     return this.calls + this.others;
   }
@@ -2301,7 +2306,7 @@ var OpfsFs = class {
       return new Uint8Array(await file.slice(offset, offset + length2).arrayBuffer());
     });
   }
-  async pwrite(path, offset, bytes) {
+  async pwrite(path, offset, bytes, _transfer, options) {
     const at = normalizePath(path);
     const movedAway = this.renamesInFlight() ? await this.writeWaits(at) : false;
     this.fileWrites.set(at, (this.fileWrites.get(at) ?? 0) + 1);
@@ -2316,7 +2321,10 @@ var OpfsFs = class {
           this.files.delete(target);
         }
       }
-      const [handle] = await this.fileFor(path, !existed && !movedAway);
+      const [handle] = await this.fileFor(
+        path,
+        !existed && !movedAway && options?.create !== false
+      );
       await this.writeAt(handle, target, path, offset, bytes);
     } finally {
       this.writeEnded(at);
@@ -4155,14 +4163,14 @@ var WsReader = class {
   }
 };
 function switchingHead(accept2, protocol = "") {
-  const chosen2 = protocol ? `Sec-WebSocket-Protocol: ${protocol}\r
+  const chosen3 = protocol ? `Sec-WebSocket-Protocol: ${protocol}\r
 ` : "";
   return latin1Bytes(
     `HTTP/1.1 101 Switching Protocols\r
 Upgrade: websocket\r
 Connection: Upgrade\r
 Sec-WebSocket-Accept: ${accept2}\r
-${chosen2}\r
+${chosen3}\r
 `
   );
 }
@@ -6155,6 +6163,7 @@ var KernelSocket = class _KernelSocket {
     return this.dial(addr, route2, secure2);
   }
   serving;
+  pending;
   served = false;
   get loopbackLinked() {
     return this.state === "connected" && !this.switch;
@@ -6339,6 +6348,8 @@ var KernelSocket = class _KernelSocket {
     this.boundAt = void 0;
     this.serving?.release();
     this.serving = void 0;
+    this.pending?.();
+    this.pending = void 0;
     this.changes.wake();
   }
   static pair(net, domain, cred) {
@@ -7915,7 +7926,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.151.1" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.152.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -10696,9 +10707,9 @@ function withEtcFiles(fs, files) {
     readFileBuffer: (path) => fs.readFileBuffer(path).catch(fallback(path, (b) => b)),
     ...ranged2 ? {
       pread: (path, offset, length2, version) => ranged2.pread(path, offset, length2, version).catch(fallback(path, (b) => b.slice(offset, offset + length2))),
-      pwrite: async (path, offset, bytes, transfer) => {
+      pwrite: async (path, offset, bytes, transfer, options) => {
         if (files.has(path)) await materialize(path);
-        return ranged2.pwrite(path, offset, bytes, transfer);
+        return ranged2.pwrite(path, offset, bytes, transfer, options);
       },
       truncate: async (path, size) => {
         if (files.has(path)) await materialize(path);
@@ -10807,10 +10818,10 @@ var FreshModules = class {
     };
     const ranged2 = rangedOps(fs);
     if (ranged2) {
-      overrides.pwrite = async (path, at, bytes, transfer) => {
+      overrides.pwrite = async (path, at, bytes, transfer, options) => {
         const touches3 = at < MAGIC.length && this.fresh.has(normalizePath(path));
         const first = at === 0 && bytes.length >= MAGIC.length ? bytes.slice(0, MAGIC.length) : void 0;
-        await ranged2.pwrite(path, at, bytes, transfer);
+        await ranged2.pwrite(path, at, bytes, transfer, options);
         if (touches3) await decide(path, first);
       };
       overrides.truncate = async (path, size) => {
@@ -12088,6 +12099,9 @@ var HeldSet = class extends Set {
       if (over !== void 0) holds2.doubt(over);
     }
   }
+  async bindIds(id2) {
+    for (const holds2 of [...this]) await holds2.bindIds(id2);
+  }
   delete(holds2) {
     const removed = super.delete(holds2);
     for (const path of /* @__PURE__ */ new Set([...holds2.keys(), ...holds2.opens.keys()])) this.idle(path);
@@ -12141,8 +12155,17 @@ var HeldPaths = class extends Map {
   }
   boundIno(handle) {
     const doubt = this.doubted.get(handle);
-    const ino = this.bound.get(handle);
-    return doubt === void 0 || ino === void 0 ? void 0 : { ino, doubt };
+    const bound3 = this.bound.get(handle);
+    return doubt === void 0 || bound3 === void 0 ? void 0 : { ...bound3, doubt };
+  }
+  async bindIds(id2) {
+    for (const [handle, bound3] of [...this.bound]) {
+      const key = this.handles.get(handle);
+      if (bound3.fid !== void 0 || key === void 0) continue;
+      const fid = await id2(key)?.catch(() => void 0);
+      if (fid !== void 0 && this.bound.get(handle) === bound3)
+        this.bound.set(handle, { ...bound3, fid });
+    }
   }
   trust(handle, doubt) {
     if (this.doubted.get(handle) === doubt) this.doubted.delete(handle);
@@ -12183,14 +12206,15 @@ var HeldPaths = class extends Map {
     for (const file of [...this.uses.keys()]) this.letGo(file, true);
     this.keptHandles.clear();
   }
-  hold(path, on, open2 = false, real, handle, ino) {
+  hold(path, on, open2 = false, real, handle, ino, fid) {
     if (open2) {
       const made2 = this.holdOpen(path, on, real, handle);
       if (handle !== void 0) {
         this.bound.delete(handle);
         this.doubted.delete(handle);
       }
-      if (made2 !== void 0 && ino !== void 0) this.bound.set(made2, ino);
+      if (made2 !== void 0 && ino !== void 0)
+        this.bound.set(made2, fid === void 0 ? { ino } : { ino, fid });
       return made2;
     }
     this.holdWrite(path, on);
@@ -12926,7 +12950,7 @@ var MountFs = class _MountFs {
       );
     }
   }
-  async pwrite(path, offset, bytes, transfer = false, redirects = 0) {
+  async pwrite(path, offset, bytes, transfer = false, options, redirects = 0) {
     const real = await this.follow(path, 0, true);
     const found = this.at(real);
     const { pwrite } = this.base;
@@ -12934,8 +12958,8 @@ var MountFs = class _MountFs {
       return this.based(
         [real],
         redirects,
-        () => pwrite.call(this.base, real, offset, bytes),
-        ([to], n) => this.pwrite(to, offset, bytes, transfer, n)
+        () => pwrite.call(this.base, real, offset, bytes, false, options),
+        ([to], n) => this.pwrite(to, offset, bytes, transfer, options, n)
       );
     }
     if (!found)
@@ -12959,7 +12983,7 @@ var MountFs = class _MountFs {
       op: "open",
       path: rel2,
       write: true,
-      create: true,
+      create: options?.create !== false,
       truncate: false,
       exclusive: false
     });
@@ -13727,7 +13751,7 @@ async function run(entry, path, req) {
     case "truncate":
       return ranged(fs, path, req);
     case "append":
-      return json2(await appended(fs, path, req.body ?? new Uint8Array(0)));
+      return json2(await appended(fs, path, req.body ?? new Uint8Array(0), req.handle));
     default:
       return { ok: false, errno: "EINVAL", message: `sync-fs: unknown op '${req.op}'` };
   }
@@ -13871,13 +13895,17 @@ async function holdOp(entry, path, req) {
       await entry.source?.open(path, real);
       await stillThere(entry, path, req);
       if (req.nofollow && !await ownEntry(entry, path, real ?? path)) continue;
+      const fid = req.ino === void 0 ? void 0 : await idOf(entry, real ?? path);
       if (!r || !r.missed(path) && !r.changedSince(path, gen) && !r.inFlight?.(path))
-        return json2(entry.hold?.(path, on, open2, real, void 0, req.ino) ?? null);
+        return json2(entry.hold?.(path, on, open2, real, void 0, req.ino, fid) ?? null);
     }
   }
   entry.hold?.(path, on, open2, void 0, req.handle);
   return done2;
 }
+async function idOf(entry, path) {
+  return await entry.fileId?.(path)?.catch(() => void 0) ?? void 0;
+}
 async function ownEntry(entry, path, real) {
   const own = await entry.fs.realpath?.(path, false).catch((err) => {
     if (err.code !== "ENOENT") throw err;
@@ -13972,14 +14000,14 @@ async function createExclusive(fs, path, owner) {
   await fs.writeFile(path, new Uint8Array(0), owner);
 }
 var appending = /* @__PURE__ */ new Map();
-async function appended(fs, path, body) {
+async function appended(fs, path, body, handle) {
   const key = await fs.realpath?.(path, true).catch(() => void 0) ?? path;
   const before = appending.get(key) ?? Promise.resolve();
   const run2 = before.then(async () => {
     if (fs.append) return fs.append(path, body);
     const size = (await fs.stat(path)).size;
     const ops = rangedOps(fs);
-    if (ops) await ops.pwrite(path, size, body, true);
+    if (ops) await ops.pwrite(path, size, body, true, noCreate(handle));
     else {
       const whole = new Uint8Array(size + body.length);
       whole.set(await fs.readFileBuffer(path));
@@ -13995,6 +14023,9 @@ async function appended(fs, path, body) {
   });
   return run2;
 }
+function noCreate(handle) {
+  return handle === void 0 ? void 0 : { create: false };
+}
 async function ranged(fs, path, req) {
   const ops = rangedOps(fs);
   if (!ops) throw syncError("ENOSYS", path);
@@ -14005,7 +14036,8 @@ async function ranged(fs, path, req) {
       kind: "bytes",
       bytes: await ops.pread(path, offset, req.length ?? 0, req.version)
     };
-  if (req.op === "pwrite") await ops.pwrite(path, offset, req.body ?? new Uint8Array(0), true);
+  if (req.op === "pwrite")
+    await ops.pwrite(path, offset, req.body ?? new Uint8Array(0), true, noCreate(req.handle));
   else await ops.truncate(path, req.length ?? 0);
   return done2;
 }
@@ -14035,7 +14067,10 @@ async function bound(entry, path, handle) {
   const bound3 = entry.boundIno?.(handle);
   if (bound3 === void 0) return;
   const now = await entry.fs.stat(path).catch(() => void 0);
-  if (now?.ino === bound3.ino) {
+  if (now === void 0 && bound3.fid !== void 0 && !await entry.fs.lstat(path).catch(() => void 0))
+    throw syncError("ENOENT", path);
+  const same3 = bound3.fid === void 0 ? now?.ino === bound3.ino : now?.fid === bound3.fid || await idOf(entry, path) === bound3.fid;
+  if (same3) {
     entry.trust?.(handle, bound3.doubt);
     return;
   }
@@ -14849,6 +14884,8 @@ var SYS_TREE = {
     slicc_rename_ack_busy: (listing) => `${listing.renameAcks?.busy ?? 0}
 `,
     slicc_stale_fds: (listing) => `${listing.staleFds ?? 0}
+`,
+    slicc_file_ids: (listing) => `${listing.fileIds ?? 0}
 `,
     slicc_rename_acks: (listing) => {
       const samples = [...listing.renameAcks?.ackMs ?? []].sort((a, b) => a - b);
@@ -16779,6 +16816,8 @@ var TLS_CLIENT_NO_SNI = 2;
 var TLS_CLIENT_VERIFY_CHAIN_ONLY = 4;
 var TLS_SERVER_REQUEST_CERT = 1;
 var TLS_SERVER_REQUIRE_CERT = 2;
+var TLS_SERVER_SELECT = 4;
+var TLS_HANDSHAKE_SELECT = 2;
 var SCRATCH = 64 * 1024;
 var EOF = -1;
 var TlsError = class extends Error {
@@ -16846,12 +16885,15 @@ var TlsEngine = class {
     if (!ptr) throw this.error(this.m._tls_last_error(), "server certificate");
     return new TlsLeaf(this, this.m, ptr);
   }
+  get serverSelect() {
+    return typeof this.m._tls_server_select === "function";
+  }
   serverSession(leaf, alpn, clientCa, flags2) {
     const open2 = this.m._tls_server_new;
     const wire = alpnWire(alpn);
     const ptr = this.withBytes(
       wire,
-      (p) => open2(leaf.ptr, wire.length > 0 ? p : 0, wire.length, clientCa?.ptr ?? 0, flags2)
+      (p) => open2(leaf?.ptr ?? 0, wire.length > 0 ? p : 0, wire.length, clientCa?.ptr ?? 0, flags2)
     );
     if (!ptr) throw this.error(this.m._tls_last_error(), "tls server");
     return new TlsSession(this, this.m, ptr);
@@ -17050,9 +17092,35 @@ var TlsSession = class {
     return this.m;
   }
   handshake() {
+    return this.step() === 1;
+  }
+  step() {
     const ret = this.c._tls_handshake(this.ptr);
     if (ret < 0) throw this.engine.error(ret, "tls handshake");
-    return ret === 1;
+    return ret;
+  }
+  clientAlpn() {
+    const list = this.m._tls_client_alpn;
+    const out = this.engine.intoScratch((p, max) => list(this.ptr, p, max));
+    if (!(out instanceof Uint8Array)) return [];
+    const names2 = [];
+    for (let at = 0; at < out.length; at += 1 + out[at]) {
+      names2.push(new TextDecoder().decode(out.subarray(at + 1, at + 1 + out[at])));
+    }
+    return names2;
+  }
+  select(leaf, alpn) {
+    const pick = this.m._tls_server_select;
+    const name2 = new TextEncoder().encode(alpn ?? "");
+    const ret = this.engine.withBytes(
+      name2,
+      (p) => pick(this.ptr, leaf?.ptr ?? 0, name2.length > 0 ? p : 0, name2.length)
+    );
+    if (ret !== 0) throw this.engine.error(ret, "tls select");
+  }
+  refuse(alert) {
+    const ret = this.m._tls_server_refuse(this.ptr, alert);
+    if (ret !== 0) throw this.engine.error(ret, "tls refuse");
   }
   get verifyResult() {
     return this.c._tls_verify_result(this.ptr);
@@ -18890,17 +18958,39 @@ function serverRefusal(err, session, first) {
   const text = err instanceof TlsError ? err.message : String(err);
   return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
 }
-async function serverHandshake(conn, session, inbox, first) {
+async function chosen(conn, session, select) {
+  if (!select) throw new KernelError("EPROTO", "ERR_SSL_HANDSHAKE_FAILURE: no selection");
+  const choice = await select({ servername: session.sni, protocols: session.clientAlpn() });
+  if (choice.refuse === void 0) {
+    try {
+      session.select(choice.leaf, choice.alpn);
+    } finally {
+      choice.done?.();
+    }
+    return;
+  }
+  session.refuse(choice.refuse);
+  await send(conn, session).catch(() => void 0);
+  throw new KernelError(
+    "EPROTO",
+    `ERR_SSL_HANDSHAKE_FAILURE: the program refused the handshake (alert ${choice.refuse})`
+  );
+}
+async function serverHandshake(conn, session, inbox, hooks) {
   for (; ; ) {
-    let done5;
+    let step2;
     try {
-      done5 = session.handshake();
+      step2 = session.step();
     } catch (err) {
       await send(conn, session).catch(() => void 0);
-      throw serverRefusal(err, session, first());
+      throw serverRefusal(err, session, hooks.first());
+    }
+    if (step2 === TLS_HANDSHAKE_SELECT) {
+      await chosen(conn, session, hooks.select);
+      continue;
     }
     await send(conn, session);
-    if (done5) return;
+    if (step2 === 1) return;
     if (!await inbox.more()) {
       throw new KernelError(
         "ECONNRESET",
@@ -18909,7 +18999,7 @@ async function serverHandshake(conn, session, inbox, first) {
     }
   }
 }
-async function tlsServer(conn, session, clientCerts) {
+async function tlsServer(conn, session, clientCerts, select) {
   let first;
   const watched = {
     ...conn,
@@ -18921,7 +19011,7 @@ async function tlsServer(conn, session, clientCerts) {
   };
   const inbox = new Ciphertext(watched, session);
   try {
-    await serverHandshake(conn, session, inbox, () => first);
+    await serverHandshake(conn, session, inbox, { first: () => first, select });
     const chain2 = session.peerChain();
     const code = clientCerts ? verifyCode(session.verifyResult) : void 0;
     const protocol = session.version === 772 ? "TLSv1.3" : "TLSv1.2";
@@ -22126,10 +22216,35 @@ function storeOf(engine, ca) {
     throw new KernelError("EINVAL", `ERR_INVALID_ARG_VALUE: ca: ${err.message}`);
   }
 }
-function flagsOf(req) {
+function certFlags(req) {
   if (!req.requestCert) return 0;
   return req.rejectUnauthorized === false ? TLS_SERVER_REQUEST_CERT : TLS_SERVER_REQUIRE_CERT;
 }
+function flagsOf(req) {
+  if (!req.select) return certFlags(req);
+  if (req.alpn && req.alpn.length > 0)
+    throw new KernelError("EINVAL", "ERR_TLS_ALPN_CALLBACK_WITH_PROTOCOLS: alpn with select");
+  return certFlags(req) | TLS_SERVER_SELECT;
+}
+async function engineOf(proc, select) {
+  const engine = await supportOf(proc.net).engine();
+  if (!engine.serverSessions)
+    throw new KernelError("ENOTSUP", "the installed tls engine has no server sessions");
+  if (select && !engine.serverSelect)
+    throw new KernelError("ENOTSUP", "the installed tls engine has no server selection");
+  return engine;
+}
+async function importedLeaf(proc, own, select) {
+  const cert = certBytes(own);
+  let engine;
+  try {
+    engine = await engineOf(proc, select);
+  } catch (err) {
+    wipe(cert);
+    throw err;
+  }
+  return { engine, leaf: leafOf(engine, cert) };
+}
 function timeoutOf(req) {
   const ms = req.handshakeTimeout ?? HANDSHAKE_TIMEOUT_MS;
   if (!Number.isInteger(ms) || ms <= 0)
@@ -22151,23 +22266,14 @@ function handshakeSignal(proc, ms) {
 async function serverOf(proc, req) {
   const own = req.cert;
   delete req.cert;
-  if (!own) throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: a server needs cert and key");
-  const cert = certBytes(own);
-  let engine;
-  try {
-    engine = await supportOf(proc.net).engine();
-    if (!engine.serverSessions)
-      throw new KernelError("ENOTSUP", "the installed tls engine has no server sessions");
-  } catch (err) {
-    wipe(cert);
-    throw err;
-  }
-  const leaf = leafOf(engine, cert);
+  if (!own && !req.select)
+    throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: a server needs cert and key");
+  const { engine, leaf } = own ? await importedLeaf(proc, own, req.select) : { engine: await engineOf(proc, true), leaf: void 0 };
   let mine;
   try {
     mine = req.ca && req.ca.length > 0 ? storeOf(engine, req.ca) : void 0;
     const flags2 = flagsOf(req);
-    const store = mine ?? (flags2 ? await defaultStore(engine, supportOf(proc.net).roots) : void 0);
+    const store = mine ?? (flags2 & ~TLS_SERVER_SELECT ? await defaultStore(engine, supportOf(proc.net).roots) : void 0);
     return {
       engine,
       leaf,
@@ -22176,12 +22282,12 @@ async function serverOf(proc, req) {
       flags: flags2,
       timeoutMs: timeoutOf(req),
       release() {
-        leaf.release();
+        leaf?.release();
         mine?.release();
       }
     };
   } catch (err) {
-    leaf.release();
+    leaf?.release();
     mine?.release();
     throw err;
   }
@@ -22192,30 +22298,133 @@ async function listenSecure(proc, socket, req) {
   socket.serving?.release();
   socket.serving = server;
 }
+function servedOf(info) {
+  return {
+    path: "kernel",
+    protocol: info.protocol,
+    alpnProtocol: info.alpnProtocol,
+    servername: info.servername,
+    authorized: info.authorized,
+    ...info.authorizationError ? { authorizationError: info.authorizationError } : {},
+    peerCertificates: info.peerCertificates.map(encode),
+    cipher: info.cipher
+  };
+}
+var selections = /* @__PURE__ */ new WeakMap();
+function pausing(signal) {
+  let paused;
+  const pausedAt = new Promise((resolve2) => {
+    paused = resolve2;
+  });
+  const select = (offer) => new Promise((choose, fail2) => {
+    if (signal.aborted) fail2(signal.reason);
+    signal.addEventListener("abort", () => fail2(signal.reason), { once: true });
+    paused({ offer, choose, fail: fail2 });
+  });
+  return { pausedAt, select };
+}
 async function serveSecure(proc, socket, req) {
   const shared = req.listener?.serving;
   if (req.listener && !shared) throw new KernelError("EINVAL", "the listener has no tls");
   const server = shared ?? await serverOf(proc, req);
+  const { engine, leaf, alpn, store, flags: flags2 } = server;
+  const limit = handshakeSignal(proc, server.timeoutMs);
+  const { pausedAt, select } = pausing(limit.signal);
+  const certs = (flags2 & ~TLS_SERVER_SELECT) !== 0;
+  const run2 = socket.secureLink(
+    (raw2) => tlsServer(
+      raw2,
+      engine.serverSession(leaf, alpn, store, flags2),
+      certs,
+      flags2 & TLS_SERVER_SELECT ? select : void 0
+    ),
+    limit.signal,
+    (reason) => !shared && reason === timedOut
+  ).finally(() => {
+    limit.done();
+    selections.delete(socket);
+    socket.pending = void 0;
+    if (!shared) server.release();
+  });
+  run2.catch(() => void 0);
+  const first = await Promise.race([run2, pausedAt.then((pause2) => ({ pause: pause2 }))]);
+  if (!("pause" in first)) return servedOf(first);
+  selections.set(socket, { pause: first.pause, run: run2 });
+  socket.pending = () => first.pause.fail(new KernelError("ECONNRESET"));
+  return { select: first.pause.offer };
+}
+var REFUSALS = /* @__PURE__ */ new Set([112, 120, 40, 49, 80]);
+var TlsContext = class {
+  leaf;
+  constructor(leaf) {
+    this.leaf = leaf;
+  }
+  close() {
+    this.leaf.release();
+  }
+};
+var TLS_CONTEXTS_MAX = 64;
+async function contextSecure(proc, cert) {
+  if (!cert) throw new KernelError("EINVAL", "ERR_INVALID_ARG_VALUE: a context needs cert and key");
+  const held = proc.fds.numbers().filter((fd) => proc.fds.get(fd).file instanceof TlsContext);
+  if (held.length >= TLS_CONTEXTS_MAX) {
+    wipe(certBytes(cert));
+    throw new KernelError("EMFILE", `at most ${TLS_CONTEXTS_MAX} tls contexts per process`);
+  }
+  const { leaf } = await importedLeaf(proc, cert);
+  const file = new OpenFile(new TlsContext(leaf));
   try {
-    const { engine, leaf, alpn, store, flags: flags2 } = server;
-    const limit = handshakeSignal(proc, server.timeoutMs);
-    const info = await socket.secureLink(
-      (raw2) => tlsServer(raw2, engine.serverSession(leaf, alpn, store, flags2), flags2 !== 0),
-      limit.signal,
-      (reason) => !shared && reason === timedOut
-    ).finally(limit.done);
-    return {
-      path: "kernel",
-      protocol: info.protocol,
-      alpnProtocol: info.alpnProtocol,
-      servername: info.servername,
-      authorized: info.authorized,
-      ...info.authorizationError ? { authorizationError: info.authorizationError } : {},
-      peerCertificates: info.peerCertificates.map(encode),
-      cipher: info.cipher
-    };
+    const fd = proc.fds.install(file, 3);
+    proc.fds.setCloseOnExec(fd);
+    return fd;
+  } catch (err) {
+    leaf.release();
+    throw err;
+  }
+}
+function contextAt(fds, fd) {
+  const open2 = fds.get(fd);
+  const file = open2.file;
+  if (!(file instanceof TlsContext)) throw new KernelError("EBADF", "not a tls context");
+  const held = open2.retain();
+  let released2 = false;
+  return {
+    leaf: file.leaf,
+    done: () => {
+      if (released2) return;
+      released2 = true;
+      void held.release();
+    }
+  };
+}
+function choiceOf(fds, pause2, req) {
+  if (req.refuse !== void 0) {
+    if (!REFUSALS.has(req.refuse)) throw new KernelError("EINVAL", "not a refusal alert");
+    return { refuse: req.refuse };
+  }
+  if (req.alpn !== void 0 && !pause2.offer.protocols.includes(req.alpn))
+    throw new KernelError("EINVAL", "ERR_TLS_ALPN_CALLBACK_INVALID_RESULT: not offered");
+  return {
+    ...req.context === void 0 ? {} : contextAt(fds, req.context),
+    ...req.alpn === void 0 ? {} : { alpn: req.alpn }
+  };
+}
+async function selectSecure(fds, socket, req) {
+  const selecting = selections.get(socket);
+  if (!selecting) throw new KernelError("EINVAL", "no handshake waits for a selection");
+  selections.delete(socket);
+  let choice;
+  try {
+    choice = choiceOf(fds, selecting.pause, req);
+  } catch (err) {
+    selecting.pause.choose({ refuse: 40 });
+    throw err;
+  }
+  selecting.pause.choose(choice);
+  try {
+    return servedOf(await selecting.run);
   } finally {
-    if (!shared) server.release();
+    choice.done?.();
   }
 }
 
@@ -22383,7 +22592,9 @@ var SOCKET_OPS = [
   "sock-tls",
   "sock-tls-upgrade",
   "sock-tls-serve",
-  "sock-tls-listen"
+  "sock-tls-listen",
+  "sock-tls-context",
+  "sock-tls-select"
 ];
 function socketAt(fds, fd) {
   const file = anySocketAt(fds, fd);
@@ -22464,6 +22675,12 @@ async function socketSyscall(req, proc) {
       const listener = from === void 0 ? {} : { listener: socketAt(fds, from) };
       return ok3(await serveSecure(proc, socketAt(fds, req.fd), { ...rest2, ...listener }));
     }
+    case "sock-tls-context":
+      return ok3(await contextSecure(proc, req.cert));
+    case "sock-tls-select": {
+      const { fd, ...choice } = req;
+      return ok3(await selectSecure(fds, socketAt(fds, fd), choice));
+    }
     case "sock-tls-listen":
       await listenSecure(proc, socketAt(fds, req.fd), req);
       return ok3({});
@@ -23336,10 +23553,10 @@ function heldIo(fs, nodes, changed) {
         const held = await node(path);
         return held ? held.byName(() => held.pread(n, at)) : ranged2.pread(path, at, n, version);
       },
-      pwrite: (path, at, bytes, transfer) => write(
+      pwrite: (path, at, bytes, transfer, options) => write(
         path,
         async (held) => void await held.pwrite(bytes, at),
-        () => ranged2.pwrite(path, at, bytes, transfer)
+        () => ranged2.pwrite(path, at, bytes, transfer, options)
       ),
       truncate: (path, size) => write(
         path,
@@ -25624,8 +25841,9 @@ function holdingToken(opts, holds2, caller) {
     cwd: opts.cwd,
     ...opts.statfs ? { statfs: opts.statfs } : {},
     ...opts.renames ? { renames: opts.renames } : {},
+    ...opts.fileId ? { fileId: opts.fileId } : {},
     ...opts.renameSeq ? { renameSeq: opts.renameSeq } : {},
-    hold: (path, on, open2, real, handle, ino) => holds2.hold(path, on, open2, real, handle, ino),
+    hold: (path, on, open2, real, handle, ino, fid) => holds2.hold(path, on, open2, real, handle, ino, fid),
     boundIno: holds2.boundIno.bind(holds2),
     trust: holds2.trust.bind(holds2),
     keptFor: (handle) => holds2.keptFor(handle),
@@ -29428,7 +29646,7 @@ function targetOf(command) {
     ...command.variants ? { variants: command.variants } : {}
   };
 }
-function chosen(planned, env) {
+function chosen2(planned, env) {
   const { target } = planned;
   const wasm = variantFor(target.variants, env);
   if (wasm === void 0) return planned;
@@ -30587,7 +30805,7 @@ var Launcher = class {
     delete env[TICKET_ENV];
     const own = env.HOSTNAME;
     if (asked.target.abi === "wasi") env.HOSTNAME = this.hostname;
-    const planned = chosen(asked, env);
+    const planned = chosen2(asked, env);
     const { target, args } = planned;
     let program;
     let exeId;
@@ -30777,7 +30995,8 @@ var Launcher = class {
         opfsOps: this.rootFs.opfsOps?.() ?? 0,
         cwdChecks: this.cwds.checks,
         renameAcks: this.rootFs.renameWaits?.(),
-        staleFds: staleFdCount()
+        staleFds: staleFdCount(),
+        fileIds: this.rootFs.fileIdWrites?.() ?? 0
       }),
       sudo: (call, signal) => this.sudo(pid, call, signal),
       crontab: (call) => this.crontab(pid, call),
@@ -30788,6 +31007,7 @@ var Launcher = class {
       replacements: stack.unlinked,
       statfs: (path) => this.mounts.statfs(path),
       renames: (since, held) => this.renameLog.since(since, held),
+      fileId: (path) => this.locks.shared?.() === true ? this.rootFileId(path) : void 0,
       renameSeq: (from, to) => this.renameLog.seqOf(from, to),
       mounts: () => this.mounts.list(),
       mount: (call, signal) => this.processMount(pid, call, signal),
@@ -31667,12 +31887,16 @@ var Launcher = class {
     this.writers ??= this.writerStack();
     return this.writers;
   }
+  rootFileId(path) {
+    return this.mounts.locate(path) === void 0 ? this.rootFs.fileId?.(path) : void 0;
+  }
   flushingPeers(fs) {
     const peers = fs.peers?.();
     if (!peers) return void 0;
     peers.watch((crowded) => {
       this.changes.flush();
       this.changes.foreign(crowded);
+      if (crowded) void this.held?.bindIds((path) => this.rootFileId(path));
     });
     return {
       ...peers,