@ai-ecoverse/slicc-kernel 1.170.3 → 1.171.0

package/dist/node.js

@@ -2362,9 +2362,9 @@ var KernelSocket = class _KernelSocket {
         case SO_TYPE:
           return SOCK_STREAM;
         case SO_ERROR: {
-          const failed3 = this.failed;
+          const failed4 = this.failed;
           this.failed = void 0;
-          return failed3 ? wasiErrno(failed3) : 0;
+          return failed4 ? wasiErrno(failed4) : 0;
         }
         case SO_ACCEPTCONN:
           return this.state === "listening" ? 1 : 0;
@@ -3695,7 +3695,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.170.3" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.171.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -3987,10 +3987,10 @@ async function tierPackages(fs, physical, roots, bins, kernel, global) {
       const own = commandsOf(pkg, manifest);
       const named = new Set(own.map((command) => command.name));
       const extra = bins ? await binCommandsOf(physical, pkg, manifest, named) : [];
-      const refused3 = engineRefusal(manifest, kernel);
+      const refused4 = engineRefusal(manifest, kernel);
       const name2 = pkg.slice(root.length + 1);
       const dependency = direct?.has(name2) === false;
-      const marks = { ...refused3 ? { refused: refused3 } : {}, ...dependency ? { dependency } : {} };
+      const marks = { ...refused4 ? { refused: refused4 } : {}, ...dependency ? { dependency } : {} };
       out.push({
         name: name2,
         pkg,
@@ -4022,7 +4022,7 @@ function winners(tier) {
   }
   return out;
 }
-async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY, kernel = KERNEL_VERSION, refused3, global = /* @__PURE__ */ new Set()) {
+async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY, kernel = KERNEL_VERSION, refused4, global = /* @__PURE__ */ new Set()) {
   const found = /* @__PURE__ */ new Map();
   const physical = physicalResolver(fs);
   const tiers = (typeof modules === "string" ? [modules] : modules).map(
@@ -4036,7 +4036,7 @@ async function scanCommands(fs, modules, binsFrom = Number.POSITIVE_INFINITY, ke
   const dependencies = [];
   for (const [index, roots] of tiers.entries()) {
     const tier = await tierPackages(fs, physical, roots, index >= binsFrom, kernel, global);
-    if (refused3) refused3.push(...tier.flatMap((entry) => entry.commands.filter((c) => c.refused)));
+    if (refused4) refused4.push(...tier.flatMap((entry) => entry.commands.filter((c) => c.refused)));
     await take(tier.filter((entry) => !entry.dependency));
     dependencies.push(tier.filter((entry) => entry.dependency));
   }
@@ -5102,12 +5102,12 @@ var UnlinkedKeeper = class {
     return this.locks;
   }
   async undoing(op, peers, sends, heard, shared2 = []) {
-    let failed3;
+    let failed4;
     let out;
     try {
       out = await op();
     } catch (err) {
-      failed3 = err ?? new Error("failed");
+      failed4 = err ?? new Error("failed");
       await this.rollBackAsides(sends, shared2);
     }
     const hiddenShared = new Set(shared2.map((one) => one.hidden));
@@ -5128,7 +5128,7 @@ var UnlinkedKeeper = class {
       const done4 = () => one.release().then(() => this.dropIfLast(one.hidden));
       void Promise.all(waits.map(({ told }) => told)).then(done4, done4);
     }
-    if (failed3 !== void 0) throw failed3;
+    if (failed4 !== void 0) throw failed4;
     return out;
   }
   async rollBackAsides(sends, shared2) {
@@ -5602,6 +5602,78 @@ var CronService = class {
   }
 };
 
+// src/kernel/net/placeholder-floor.ts
+var PLACEHOLDER = /fnox_proxy_[0-9a-f]{24}/;
+var ESCAPE = /%([0-9a-f]{2})/gi;
+var BASIC = /\bbasic\b(.*)/is;
+var PERCENT_LAYERS = 8;
+var BASE64_GROUP = 4;
+var PLACEHOLDER_REFUSED = "refused: this request has a sealed placeholder in its URL, a header or a Basic credential, and nothing fills it, so it was not sent";
+var PlaceholderRefused = class extends Error {
+  status = 403;
+  code = "EACCES";
+  constructor() {
+    super(PLACEHOLDER_REFUSED);
+  }
+};
+function carries(text) {
+  let layer = text;
+  for (let i = 0; i < PERCENT_LAYERS; i++) {
+    if (PLACEHOLDER.test(layer)) return true;
+    const next3 = layer.replace(
+      ESCAPE,
+      (_, hex4) => String.fromCharCode(Number.parseInt(hex4, 16))
+    );
+    if (next3 === layer) return false;
+    layer = next3;
+  }
+  return PLACEHOLDER.test(layer);
+}
+function basicCarries(value2) {
+  const credential = BASIC.exec(value2)?.[1];
+  if (credential === void 0) return false;
+  const letters = credential.replace(/[^A-Za-z0-9+/_-]/g, "").replaceAll("-", "+").replaceAll("_", "/");
+  for (let shift = 0; shift < BASE64_GROUP; shift++) {
+    const part = letters.slice(shift);
+    const whole = part.length % BASE64_GROUP === 1 ? part.slice(0, -1) : part;
+    if (carries(atob(whole))) return true;
+  }
+  return false;
+}
+function headersCarry(headers) {
+  return headers.some(
+    ([name2, value2]) => carries(name2.toLowerCase()) || carries(value2) || basicCarries(value2)
+  );
+}
+function urlCarries(url) {
+  return carries(url) || URL.canParse(url) && carries(new URL(url).href);
+}
+function refuse(request) {
+  if (urlCarries(request.url) || headersCarry(request.headers)) throw new PlaceholderRefused();
+}
+function refuseSocket(request) {
+  refuse(request);
+  if (request.protocols.some(carries)) throw new PlaceholderRefused();
+}
+function placeholderFloor(inner) {
+  const open = inner.websocket?.bind(inner);
+  return {
+    get traits() {
+      return inner.traits;
+    },
+    ...open ? {
+      websocket: async (request) => {
+        refuseSocket(request);
+        return open(request);
+      }
+    } : {},
+    async fetch(request, owner) {
+      refuse(request);
+      return inner.fetch(request, owner);
+    }
+  };
+}
+
 // src/kernel/net/ws-queue.ts
 var INBOUND_LIMIT = 16 * 1024 * 1024;
 var MESSAGE_LIMIT = 64 * 1024 * 1024;
@@ -6118,8 +6190,8 @@ var RealmProxy = class {
   }
   async connect(conn, incoming, req, idle2) {
     const target = tunnelTarget(req);
-    const refused3 = target.port === 443 ? await this.tunnelReady(target) : void 0;
-    if (refused3) throw refused3;
+    const refused4 = target.port === 443 ? await this.tunnelReady(target) : void 0;
+    if (refused4) throw refused4;
     await conn.write(latin1Bytes("HTTP/1.1 200 Connection Established\r\n\r\n"), this.stop.signal);
     try {
       const first = await incoming.peek(this.stop.signal);
@@ -6176,7 +6248,8 @@ var RealmProxy = class {
       });
     } catch (e) {
       waiting.abort();
-      throw new HttpError(502, e instanceof Error ? e.message : String(e));
+      const status = e instanceof PlaceholderRefused ? e.status : 502;
+      throw new HttpError(status, e instanceof Error ? e.message : String(e));
     }
     ctx.idle.ms = Number.POSITIVE_INFINITY;
     try {
@@ -6390,7 +6463,7 @@ async function relay(socket, conn) {
 // src/fs/attest.ts
 var ATTEST_MAX = 1024 * 1024;
 var UNOWNED = 1e3;
-function refuse(code, path, why) {
+function refuse2(code, path, why) {
   throw Object.assign(new Error(`attest ${path}: ${why}`), { code });
 }
 function chainOf(path) {
@@ -6432,11 +6505,11 @@ async function trustedParents(fs, path, o) {
   const parents = [];
   for (const dir of chainOf(path).slice(0, -1)) {
     const st = await fs.lstat(dir);
-    if (st.isSymbolicLink) refuse("EACCES", path, `${dir} is a symlink`);
-    if (!st.isDirectory) refuse("ENOTDIR", path, `${dir} is not a directory`);
+    if (st.isSymbolicLink) refuse2("EACCES", path, `${dir} is a symlink`);
+    if (!st.isDirectory) refuse2("ENOTDIR", path, `${dir} is not a directory`);
     const perm = owned(dir, st);
     if (o.users !== "off" && (perm.uid !== 0 || (perm.mode & 18) !== 0)) {
-      refuse("EACCES", path, `${dir} is not root-owned or is writable by group or others`);
+      refuse2("EACCES", path, `${dir} is not root-owned or is writable by group or others`);
     }
     parents.push(perm);
   }
@@ -6444,27 +6517,27 @@ async function trustedParents(fs, path, o) {
 }
 async function attest(fs, asked, o) {
   if (typeof asked !== "string" || !asked.startsWith("/")) {
-    refuse("EINVAL", String(asked), "not an absolute path");
+    refuse2("EINVAL", String(asked), "not an absolute path");
   }
   const path = normalizePath(asked);
   const mount = o.mounts.find((target) => {
     const at = normalizePath(target);
     return at === "/" || under(path, at);
   });
-  if (mount !== void 0) refuse("EACCES", path, `under the mount ${mount}`);
+  if (mount !== void 0) refuse2("EACCES", path, `under the mount ${mount}`);
   const parents = await trustedParents(fs, path, o);
   for (let tries = 0; ; tries++) {
     const before = await fs.lstat(path);
-    if (before.isSymbolicLink) refuse("EACCES", path, "is a symlink");
+    if (before.isSymbolicLink) refuse2("EACCES", path, "is a symlink");
     if (!before.isFile)
-      refuse(before.isDirectory ? "EISDIR" : "EINVAL", path, "is not a regular file");
-    if (before.size > ATTEST_MAX) refuse("EFBIG", path, `is over ${ATTEST_MAX} bytes`);
+      refuse2(before.isDirectory ? "EISDIR" : "EINVAL", path, "is not a regular file");
+    if (before.size > ATTEST_MAX) refuse2("EFBIG", path, `is over ${ATTEST_MAX} bytes`);
     const bytes = (await fs.readFileBuffer(path)).slice();
     const after = await fs.lstat(path);
     if (unchanged(before, after, bytes)) {
       return attested(path, after, bytes, await sha256(bytes), o, parents);
     }
-    if (tries >= 1) refuse("EAGAIN", path, "changed while it was read");
+    if (tries >= 1) refuse2("EAGAIN", path, "changed while it was read");
   }
 }
 var WATCH_DEBOUNCE_MS = 50;
@@ -9293,8 +9366,8 @@ var DriverConnection = class _DriverConnection {
     } finally {
       clearTimeout(timer);
     }
-    const refused3 = driverVersionError(hello.protocol);
-    if (refused3) throw errnoError("EPROTO", refused3);
+    const refused4 = driverVersionError(hello.protocol);
+    if (refused4) throw errnoError("EPROTO", refused4);
     if (hello.error) throw errnoError(hello.errno ?? "EIO", hello.error);
     return new _DriverConnection(port, hello.capabilities ?? {}, waiting, timeoutMs, options);
   }
@@ -11318,8 +11391,8 @@ async function guarded(entry, path, req) {
     return { paths };
   } catch (err) {
     const refusal3 = err.code === "EACCES";
-    const refused3 = req.op === "exists" && refusal3 ? json2(false) : toErrno(err);
-    return { refused: refused3 };
+    const refused4 = req.op === "exists" && refusal3 ? json2(false) : toErrno(err);
+    return { refused: refused4 };
   }
 }
 async function copyOp(entry, path, req) {
@@ -11515,13 +11588,13 @@ async function created(entry, req) {
   return seen === void 0 ? looked : json2({ ...looked.json, seen });
 }
 var DENIED = /* @__PURE__ */ new Set(["EACCES", "EPERM"]);
-async function rmPermitted(entry, path, req, refused3) {
+async function rmPermitted(entry, path, req, refused4) {
   const st = await entry.fs.lstat(path).catch(() => void 0);
-  if (!st?.isDirectory) return refused3;
+  if (!st?.isDirectory) return refused4;
   const unlisted = await guarded(entry, path, { ...req, op: "readdir" });
   if ("refused" in unlisted) return unlisted.refused;
   const names2 = await entry.fs.readdir(path).catch(() => void 0);
-  if (!names2) return refused3;
+  if (!names2) return refused4;
   let first;
   for (const name2 of names2) {
     const child = await dispatchOne(entry, {
@@ -11572,14 +11645,14 @@ async function newDevName(entry, path, req) {
   const named = NAMING.has(req.op);
   if (!named && !CREATIONS.has(req.op)) return void 0;
   const target = named ? entry.fs.resolvePath(entry.cwd, req.arg2 ?? "") : path;
-  const refused3 = devCreation(target, entry.cred?.());
-  if (!refused3) return void 0;
+  const refused4 = devCreation(target, entry.cred?.());
+  if (!refused4) return void 0;
   const there = await entry.fs.lstat(target).then(
     () => true,
     () => false
   );
   if (there) return void 0;
-  return { ok: false, errno: refused3, message: `${target}: no new names in /dev or /proc` };
+  return { ok: false, errno: refused4, message: `${target}: no new names in /dev or /proc` };
 }
 var MISS_OPS = /* @__PURE__ */ new Set(["stat", "lstat"]);
 async function linkFree(fs, path) {
@@ -11702,7 +11775,7 @@ function encodeSabResult(result) {
           message: result.message,
           ...result.direct ? { direct: true } : {},
           ...result.dev !== void 0 ? { dev: result.dev } : {},
-          ...result.detail === "transport" ? { detail: result.detail } : {}
+          ...result.detail ? { detail: result.detail } : {}
         })
       )
     };
@@ -13034,11 +13107,11 @@ var EpollFile = class _EpollFile {
       const round = new AbortController();
       const stop = () => round.abort();
       signal.addEventListener("abort", stop, { once: true });
-      let failed3 = false;
+      let failed4 = false;
       try {
         await file.changed(round.signal);
       } catch {
-        failed3 = true;
+        failed4 = true;
       } finally {
         round.abort();
         signal.removeEventListener("abort", stop);
@@ -13046,7 +13119,7 @@ var EpollFile = class _EpollFile {
       if (signal.aborted) return;
       reg.gen++;
       this.changes.wake();
-      if (failed3) await pause(RETRY_MS, signal);
+      if (failed4) await pause(RETRY_MS, signal);
     }
   }
 };
@@ -13682,8 +13755,8 @@ var KernelLoopback = class {
       );
     } catch (err) {
       socket.close();
-      const refused3 = err instanceof KernelError && err.code === "ECONNREFUSED";
-      throw refused3 ? errno2("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
+      const refused4 = err instanceof KernelError && err.code === "ECONNREFUSED";
+      throw refused4 ? errno2("ECONNREFUSED", `nothing listens on the kernel's port ${port}`) : err;
     }
     signal.addEventListener("abort", () => socket.close(), { once: true });
     return socket;
@@ -15116,23 +15189,29 @@ var HttpHandles = class {
       return response.redirected ? { ...head, json: { ...head.json, redirected: true } } : head;
     } catch (e) {
       entry.upload?.cancel();
-      const text = message2(e);
-      if (port !== void 0) return { ok: false, errno: codeOf2(e), message: text };
-      const status = e.status;
-      if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
-        const code = codeOf2(e);
-        const errno3 = text === NO_TRANSPORT ? "ENETUNREACH" : code !== "EIO" ? code : "ECONNREFUSED";
-        const failed3 = e.detail === "transport";
-        return { ok: false, errno: errno3, message: text, ...failed3 ? { detail: "transport" } : {} };
-      }
-      entry.body = once(new TextEncoder().encode(text))[Symbol.asyncIterator]();
-      return this.headOf(handle, req.url, {
-        status,
-        statusText: "",
-        headers: [["content-type", "text/plain; charset=utf-8"]]
-      });
+      if (port !== void 0) return { ok: false, errno: codeOf2(e), message: message2(e) };
+      return this.failure(handle, req, e, entry);
     }
   }
+  failure(handle, req, e, entry) {
+    const text = message2(e);
+    if (e instanceof PlaceholderRefused) {
+      return { ok: false, errno: e.code, message: text, detail: "placeholder" };
+    }
+    const status = e.status;
+    if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
+      const code = codeOf2(e);
+      const errno3 = text === NO_TRANSPORT ? "ENETUNREACH" : code !== "EIO" ? code : "ECONNREFUSED";
+      const failed4 = e.detail === "transport";
+      return { ok: false, errno: errno3, message: text, ...failed4 ? { detail: "transport" } : {} };
+    }
+    entry.body = once(new TextEncoder().encode(text))[Symbol.asyncIterator]();
+    return this.headOf(handle, req.url, {
+      status,
+      statusText: "",
+      headers: [["content-type", "text/plain; charset=utf-8"]]
+    });
+  }
   headOf(handle, url, response) {
     const { status, statusText, headers } = response;
     return { ok: true, kind: "json", json: { handle, status, statusText, url, headers } };
@@ -17032,23 +17111,23 @@ function scrubbed(inner, scrubber, idleMs = SCRUB_IDLE_MS) {
   let pending = 0;
   let busy = false;
   let timer;
-  let failed3;
+  let failed4;
   const waiters = /* @__PURE__ */ new Set();
   const quiet3 = () => !busy && pending === 0;
   const wake = () => {
     for (const waiter of [...waiters]) waiter();
   };
   const raise = () => {
-    if (failed3 === void 0) return;
-    const err = failed3;
-    failed3 = void 0;
+    if (failed4 === void 0) return;
+    const err = failed4;
+    failed4 = void 0;
     throw err;
   };
   const later = (bytes) => {
     if (bytes.length === 0) return;
     pending += 1;
     tail2 = tail2.then(() => writeAll2(file, bytes)).catch((err) => {
-      if (failed3 === void 0) failed3 = err;
+      if (failed4 === void 0) failed4 = err;
     }).finally(() => {
       pending -= 1;
       if (quiet3()) wake();
@@ -18230,7 +18309,7 @@ var HEAD_MAX = 16 * 1024;
 var ANY_PLACEHOLDER = /fnox_proxy_[0-9a-f]{24}/g;
 var REQUEST_LINE2 = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+) ([\x21-\x7e]+) HTTP\/1\.[01]$/;
 var HEADER_LINE = /^([!#$%&'*+.^_`|~0-9A-Za-z-]+):[ \t]*(.*?)[ \t]*$/;
-var BASIC = /^(Basic[ \t]+)([A-Za-z0-9+/]+={0,2})$/i;
+var BASIC2 = /^(Basic[ \t]+)([A-Za-z0-9+/]+={0,2})$/i;
 var encoder8 = new TextEncoder();
 function binary(text) {
   let out = "";
@@ -18246,7 +18325,7 @@ function sniffHttp1(start2) {
   return "no";
 }
 function basicOf(value2) {
-  const m = BASIC.exec(value2);
+  const m = BASIC2.exec(value2);
   if (!m) return void 0;
   try {
     return { scheme: m[1], decoded: atob(m[2]) };
@@ -25179,6 +25258,234 @@ function enableDnsStub(net, stub) {
   });
 }
 
+// src/kernel/net/remote-transport.ts
+var TransportError = class extends Error {
+  status;
+  code;
+  detail;
+  constructor(message3, status, code, detail) {
+    super(message3);
+    this.status = status;
+    this.code = code;
+    this.detail = detail === "transport" ? detail : void 0;
+  }
+};
+function unfollowed2(redirect) {
+  return redirect !== void 0 && redirect !== "follow";
+}
+function honors(traits, redirect) {
+  if (traits.redirectPolicy === true) return true;
+  const hops = traits.redirectHops;
+  const raw2 = traits.manualRedirects === true && (hops === void 0 || hops === false);
+  return redirect === "manual" && raw2;
+}
+function refused3(message3) {
+  return new TransportError(message3, 502, void 0, "transport");
+}
+var RemoteTransport = class {
+  traits;
+  port;
+  waiting = /* @__PURE__ */ new Map();
+  nextId = 0;
+  sockets = /* @__PURE__ */ new Map();
+  uploads = /* @__PURE__ */ new Map();
+  failure;
+  constructor(port, traits) {
+    this.port = port;
+    this.traits = traits;
+  }
+  receive(reply) {
+    if (reply.net === "body-pull") {
+      void this.pull(reply.nid);
+      return;
+    }
+    const socket = this.sockets.get(reply.nid);
+    if (socket && this.toSocket(reply, socket)) return;
+    const waiter = this.waiting.get(reply.nid);
+    if (!waiter) return;
+    this.waiting.delete(reply.nid);
+    if (reply.net === "error") {
+      waiter.reject(new TransportError(reply.message, reply.status, reply.code, reply.detail));
+    } else waiter.resolve(reply);
+  }
+  toSocket(reply, socket) {
+    if (reply.net === "ws-message") socket.queue.push(reply.data);
+    else if (reply.net === "ws-acked") socket.acked(reply.n);
+    else if (reply.net === "ws-closed") {
+      this.sockets.delete(reply.nid);
+      socket.queue.end({ code: reply.code, reason: reply.reason });
+    } else return false;
+    return true;
+  }
+  async pull(nid) {
+    const upload = this.uploads.get(nid);
+    if (!upload) {
+      this.port.postMessage({ net: "body-error", nid, message: "the request body is gone" });
+      return;
+    }
+    try {
+      const next3 = await upload.next();
+      if (next3.done) {
+        this.uploads.delete(nid);
+        this.port.postMessage({ net: "body-end", nid });
+      } else this.port.postMessage({ net: "body-chunk", nid, bytes: next3.value });
+    } catch (e) {
+      this.uploads.delete(nid);
+      this.port.postMessage({
+        net: "body-error",
+        nid,
+        message: e instanceof Error ? e.message : String(e)
+      });
+    }
+  }
+  dropUpload(nid) {
+    const upload = this.uploads.get(nid);
+    this.uploads.delete(nid);
+    void upload?.return?.().catch(() => void 0);
+  }
+  fail(error) {
+    this.failure = error;
+    for (const nid of [...this.uploads.keys()]) this.dropUpload(nid);
+    for (const waiter of this.waiting.values()) waiter.reject(error);
+    this.waiting.clear();
+    for (const socket of this.sockets.values())
+      socket.queue.end({ code: 1011, reason: error.message });
+    this.sockets.clear();
+  }
+  ask(call) {
+    if (this.failure) return Promise.reject(this.failure);
+    return new Promise((resolve2, reject) => {
+      this.waiting.set(call.nid, { resolve: resolve2, reject });
+      this.port.postMessage(call);
+    });
+  }
+  cancel(nid) {
+    const waiter = this.waiting.get(nid);
+    this.waiting.delete(nid);
+    waiter?.reject(new TransportError("the request was cancelled"));
+    this.port.postMessage({ net: "cancel", nid });
+  }
+  async fetch(request) {
+    const nid = ++this.nextId;
+    const { signal, redirect } = request;
+    signal.throwIfAborted();
+    if (unfollowed2(redirect) && !honors(this.traits, redirect)) {
+      throw refused3(`this transport cannot honor redirect: ${redirect}`);
+    }
+    let finished = false;
+    const abort = () => {
+      finished = true;
+      this.dropUpload(nid);
+      this.cancel(nid);
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    const finish = () => {
+      this.dropUpload(nid);
+      if (finished) return;
+      finished = true;
+      signal.removeEventListener("abort", abort);
+    };
+    if (request.bodyStream) this.uploads.set(nid, request.bodyStream[Symbol.asyncIterator]());
+    let head;
+    try {
+      head = await this.ask({
+        net: "fetch",
+        nid,
+        url: request.url,
+        method: request.method,
+        headers: request.headers,
+        ...request.bodyStream ? { streamed: true } : request.body ? { body: request.body } : {},
+        ...redirect !== void 0 ? { redirect } : {}
+      });
+    } catch (e) {
+      finish();
+      throw e;
+    }
+    const { status, statusText, headers, url, redirected: redirected2, redirects, opaqueRedirect } = head;
+    const read = async () => {
+      if (finished) return void 0;
+      const reply = await this.ask({ net: "read", nid }).catch((e) => {
+        finish();
+        throw e;
+      });
+      if (reply.net === "chunk") return reply.bytes;
+      finish();
+      return void 0;
+    };
+    const cancel = async () => {
+      if (finished) return;
+      finish();
+      this.cancel(nid);
+    };
+    if (unfollowed2(redirect) && (redirected2 || redirects?.length)) {
+      await cancel();
+      throw refused3(`this transport followed a redirect despite redirect: ${redirect}`);
+    }
+    return {
+      ...url !== void 0 ? { url } : {},
+      ...redirected2 !== void 0 ? { redirected: redirected2 } : {},
+      ...redirects ? { redirects } : {},
+      ...opaqueRedirect ? { opaqueRedirect } : {},
+      status,
+      statusText,
+      headers,
+      cancel,
+      body: {
+        [Symbol.asyncIterator]: () => ({
+          next: async () => {
+            const bytes = await read();
+            return bytes ? { value: bytes, done: false } : { value: void 0, done: true };
+          },
+          return: async () => {
+            await cancel();
+            return { value: void 0, done: true };
+          }
+        })
+      }
+    };
+  }
+  async websocket(request) {
+    const nid = ++this.nextId;
+    const { signal } = request;
+    signal.throwIfAborted();
+    const abort = () => this.cancel(nid);
+    signal.addEventListener("abort", abort, { once: true });
+    let opened2;
+    try {
+      opened2 = await this.ask({
+        net: "ws-open",
+        nid,
+        url: request.url,
+        protocols: request.protocols,
+        headers: request.headers
+      });
+    } finally {
+      signal.removeEventListener("abort", abort);
+    }
+    const close = (code, reason) => this.port.postMessage({ net: "ws-close", nid, code, reason });
+    const queue = new MessageQueue(
+      () => close(1e3, "a message is too big"),
+      Number.POSITIVE_INFINITY,
+      (n) => this.port.postMessage({ net: "ws-consumed", nid, n })
+    );
+    let unacked = 0;
+    this.sockets.set(nid, { queue, acked: (n) => void (unacked -= n) });
+    return {
+      protocol: opened2.protocol,
+      get buffered() {
+        return unacked;
+      },
+      send: (data) => {
+        unacked += payloadSize(data);
+        this.port.postMessage({ net: "ws-send", nid, data });
+      },
+      messages: queue,
+      close,
+      closed: queue.closed
+    };
+  }
+};
+
 // src/kernel/net/redirect-hops.ts
 var HELD_MS = 3e4;
 var HELD_MAX2 = 64;
@@ -25254,7 +25561,10 @@ function replayingHops(inner, heldMs = HELD_MS) {
       return { ...inner.traits, manualRedirects: true };
     },
     ...inner.websocket ? { websocket: inner.websocket.bind(inner) } : {},
-    async fetch(request, owner = KERNEL) {
+    async fetch(request, ...rest2) {
+      if (unfollowed2(request.redirect)) return inner.fetch(request, ...rest2);
+      const [caller] = rest2;
+      const owner = caller ?? KERNEL;
       const key = keyOf3(owner, request.method, request.url);
       const waiting = held.get(key);
       if (waiting && waiting.fingerprint === fingerprint(request.headers)) {
@@ -25263,7 +25573,7 @@ function replayingHops(inner, heldMs = HELD_MS) {
         return replay(waiting);
       }
       if (waiting) drop(key);
-      const response = await inner.fetch(request);
+      const response = await inner.fetch(request, ...rest2);
       if (!response.redirects?.length) return response;
       return replay({
         owner,
@@ -25448,11 +25758,11 @@ var PackageLocks = class {
     if (!locks) return Promise.resolve(() => {
     });
     const { promise: held, resolve: release } = Promise.withResolvers();
-    return new Promise((granted2, failed3) => {
+    return new Promise((granted2, failed4) => {
       locks.request(replacingLock(this.metadata, root), { mode: "exclusive" }, () => {
         granted2(() => release());
         return held;
-      }).catch(failed3);
+      }).catch(failed4);
     });
   }
 };
@@ -25702,9 +26012,9 @@ function serveFilesystem(port, handlers, capabilities = {}, options = {}) {
   let open = false;
   const reply = (message3, transfer = []) => port.postMessage(message3, transfer);
   async function hello(message3) {
-    const refused3 = driverVersionError(message3.protocol);
-    if (refused3) {
-      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused3, errno: "EPROTO" } });
+    const refused4 = driverVersionError(message3.protocol);
+    if (refused4) {
+      reply({ hello: { protocol: DRIVER_PROTOCOL, error: refused4, errno: "EPROTO" } });
       return;
     }
     try {
@@ -27946,12 +28256,12 @@ var OpfsFs = class {
     if (!move) return false;
     for (let attempt = 0; ; attempt++) {
       this.others++;
-      const failed3 = await move.call(handle, dir, name2).then(
+      const failed4 = await move.call(handle, dir, name2).then(
         () => void 0,
         (err) => ({ err })
       );
-      if (!failed3) return true;
-      const error = failed3.err?.name;
+      if (!failed4) return true;
+      const error = failed4.err?.name;
       if (handle.kind !== "file" || !LOCKED.has(error)) return false;
       const delay2 = SYNC_BACKOFF_MS[attempt];
       if (delay2 === void 0) throw fsError("EBUSY", name2);
@@ -28514,22 +28824,22 @@ async function mountFstab(lines2, mount, signal, retries = FSTAB_RETRIES, discar
   );
 }
 async function mountLine({ line, spec, invalid }, mount, signal, retries, discard) {
-  let failed3 = invalid;
+  let failed4 = invalid;
   for (let attempt = 0; !invalid && attempt <= retries.length && !signal.aborted; attempt++) {
     try {
       const entry = await mount(spec);
       if (!signal.aborted) return { line, target: spec.target, entry };
       discard(entry);
-      failed3 = Object.assign(new Error("the kernel stopped"), { code: "ECANCELED" });
+      failed4 = Object.assign(new Error("the kernel stopped"), { code: "ECANCELED" });
       break;
     } catch (err) {
-      failed3 = err;
+      failed4 = err;
       if (FINAL.has(codeOf6(err)) || attempt === retries.length) break;
       await wait(retries[attempt], signal);
     }
   }
-  const code = codeOf6(failed3);
-  return { line, target: spec.target, code, error: String(failed3?.message ?? code) };
+  const code = codeOf6(failed4);
+  return { line, target: spec.target, code, error: String(failed4?.message ?? code) };
 }
 
 // src/mount/hostfs.ts
@@ -30990,7 +31300,7 @@ var Launcher = class {
       ...options.env
     };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
-    this.transport = replayingHops(options.transport ?? missingTransport());
+    this.transport = placeholderFloor(replayingHops(options.transport ?? missingTransport()));
     this.announcedTraits = JSON.stringify(this.transport.traits);
     this.uplink = options.uplink;
     this.routes = new Routes(options.uplink?.traits.ipv6 === true);
@@ -31145,16 +31455,16 @@ var Launcher = class {
     if (!found) {
       found = this.swaps.settled().then(() => this.trustedAppended()).then(async (appended2) => {
         const tiers = await this.tiers(scope, appended2);
-        const refused3 = [];
+        const refused4 = [];
         const commands = await scanCommands(
           this.scanned,
           tiers,
           tiers.length - appended2.length,
           void 0,
-          refused3,
+          refused4,
           await this.globalRoots(scope)
         );
-        this.refusedOf.set(commands, refused3.map(refusing));
+        this.refusedOf.set(commands, refused4.map(refusing));
         return commands;
       }).then(
         (commands) => this.refusals(commands).set(SUDO_COMMAND.name, SUDO_COMMAND).set(CRONTAB_COMMAND.name, CRONTAB_COMMAND)
@@ -31360,14 +31670,14 @@ var Launcher = class {
     return await this.commandAt(path, scope) ?? await this.refusedAt(path, name2, scope);
   }
   async refusedAt(path, name2, scope) {
-    const refused3 = this.refusedOf.get(await this.commands(scope)) ?? [];
-    if (refused3.length === 0) return void 0;
+    const refused4 = this.refusedOf.get(await this.commands(scope)) ?? [];
+    if (refused4.length === 0) return void 0;
     const st = await this.base.stat(path).catch(() => void 0);
     if (!st?.isFile) return void 0;
     const real = await physicalPathAsync(this.base, path).catch(() => path);
     const same2 = async (own) => own === path || await physicalPathAsync(this.base, own).catch(() => own) === real;
     const owners = [];
-    for (const c of refused3) {
+    for (const c of refused4) {
       const origin = c.origin;
       for (const own of [origin.glue, origin.wasm, ...origin.variants ?? []]) {
         if (!await same2(own)) continue;
@@ -31377,11 +31687,11 @@ var Launcher = class {
     }
     const stem = name2.replace(/\.wasm$/, "");
     const named = owners.find((c) => c.name === name2) ?? owners.find((c) => c.name === stem);
-    return named ?? owners[0] ?? await this.refusedCopy(real, name2, refused3);
+    return named ?? owners[0] ?? await this.refusedCopy(real, name2, refused4);
   }
-  async refusedCopy(real, name2, refused3) {
+  async refusedCopy(real, name2, refused4) {
     const dir = real.slice(0, real.lastIndexOf("/"));
-    for (const c of refused3) {
+    for (const c of refused4) {
       const origin = c.origin;
       if (origin.abi !== "emscripten" || origin.script || c.name !== name2) continue;
       const own = await physicalPathAsync(this.base, origin.glue).catch(() => origin.glue);
@@ -31589,12 +31899,12 @@ var Launcher = class {
     return void 0;
   }
   async planOne(req, { ppid, cred, scope }, catalogOnly = false) {
-    const refused3 = (err) => {
+    const refused4 = (err) => {
       throw codeOf8(err) === "EACCES" ? new SpawnError("EACCES") : err;
     };
-    const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused3);
+    const file = await this.execFile(req.file, req.cwd, this.execGuard(cred, ppid)).catch(refused4);
     const planned = await this.plan(file, req.argv, req.cwd, scope, req.argv0, catalogOnly);
-    await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused3);
+    await this.mayExec(cred, { ...req, file, pid: ppid }, planned).catch(refused4);
     if (planned) return planned;
     throw new SpawnError(catalogOnly ? "ENOENT" : await this.unrunnable(file, req.cwd, scope));
   }
@@ -32882,8 +33192,8 @@ var Launcher = class {
       for (const name2 of names2 ?? []) {
         const path = joinName(real, name2);
         if (await this.base.hasOwner(path)) continue;
-        const failed3 = this.inUse(path) ? "busy" : await this.base.rm(path, { recursive: true, force: true }).catch(String);
-        if (failed3 === void 0) removed++;
+        const failed4 = this.inUse(path) ? "busy" : await this.base.rm(path, { recursive: true, force: true }).catch(String);
+        if (failed4 === void 0) removed++;
         else left++;
       }
       if (removed > 0) {
@@ -33676,10 +33986,11 @@ function fetchTransport(options = {}) {
   const send2 = options.fetch ?? globalThis.fetch.bind(globalThis);
   const Socket = options.webSocket === true ? globalThis.WebSocket : options.webSocket || void 0;
   const headers = options.webSocketHeaders === true;
-  const redirect = options.redirect ?? "follow";
+  const instance = options.redirect ?? "follow";
   return {
     traits: {
-      manualRedirects: redirect === "manual",
+      manualRedirects: instance === "manual",
+      redirectPolicy: true,
       encodedBodies: false,
       maxRequestBody: options.maxRequestBody ?? MAX_REQUEST_BODY,
       crossOrigin: "cors",
@@ -33695,7 +34006,7 @@ function fetchTransport(options = {}) {
           headers: joinHeaders(request.headers),
           ...requestBody(request),
           signal: request.signal,
-          redirect,
+          redirect: request.redirect ?? instance,
           credentials: "omit",
           mode: "cors"
         });
@@ -33719,6 +34030,7 @@ function fetchTransport(options = {}) {
       const body = chunks(response.body, options.bodyIdleMs ?? BODY_IDLE_MS);
       return {
         ...response.redirected ? { url: response.url, redirected: true } : {},
+        ...response.type === "opaqueredirect" ? { opaqueRedirect: true } : {},
         status: response.status,
         statusText: response.statusText,
         headers: headers2,
@@ -33754,6 +34066,19 @@ function uploadsFor(peer) {
   });
   return { of, answer: (call) => pulls.get(call.nid)?.(call) };
 }
+function headOf(nid, response) {
+  return {
+    net: "head",
+    nid,
+    ...response.url !== void 0 ? { url: response.url } : {},
+    ...response.redirected !== void 0 ? { redirected: response.redirected } : {},
+    ...response.redirects ? { redirects: response.redirects } : {},
+    ...response.opaqueRedirect ? { opaqueRedirect: true } : {},
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  };
+}
 function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS3 } = {}) {
   const open = /* @__PURE__ */ new Map();
   const fail3 = (nid, e) => {
@@ -33779,6 +34104,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS3 } = {})
         method: call.method,
         headers: call.headers,
         ...call.streamed ? { bodyStream: uploads.of(call.nid, abort.signal) } : call.body ? { body: call.body } : {},
+        ...call.redirect !== void 0 ? { redirect: call.redirect } : {},
         signal: abort.signal
       });
       if (!open.has(call.nid)) {
@@ -33786,15 +34112,7 @@ function serveTransport(peer, transport, { closeWaitMs = CLOSE_WAIT_MS3 } = {})
         return;
       }
       open.set(call.nid, { abort, body: response.body[Symbol.asyncIterator](), response });
-      peer.postMessage({
-        net: "head",
-        nid: call.nid,
-        ...response.redirected ? { url: response.url, redirected: true } : {},
-        ...response.redirects ? { redirects: response.redirects } : {},
-        status: response.status,
-        statusText: response.statusText,
-        headers: response.headers
-      });
+      peer.postMessage(headOf(call.nid, response));
     } catch (e) {
       fail3(call.nid, e);
     }
@@ -34294,9 +34612,9 @@ function serveClient(port, host) {
     ended.resolve();
   }
   async function hello(message3) {
-    const refused3 = versionError(message3.protocol) ?? await hosts.requests.accept(host, message3);
-    if (refused3) {
-      send2({ hello: { protocol: PROTOCOL, error: refused3 } });
+    const refused4 = versionError(message3.protocol) ?? await hosts.requests.accept(host, message3);
+    if (refused4) {
+      send2({ hello: { protocol: PROTOCOL, error: refused4 } });
       detach();
       return;
     }
@@ -34440,6 +34758,60 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { subscribe } from "node:diagnostics_channel";
 import { lookup as lookup2 } from "node:dns/promises";
 import { isIP as isIP3 } from "node:net";
+
+// src/node/follow.ts
+var MAX_REDIRECTS = 20;
+var REDIRECTS = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var BODY_HEADERS = /* @__PURE__ */ new Set([
+  "content-encoding",
+  "content-language",
+  "content-length",
+  "content-location",
+  "content-type"
+]);
+var CREDENTIALS = /* @__PURE__ */ new Set(["authorization", "proxy-authorization", "cookie", "cookie2"]);
+function failed3(message3) {
+  return Object.assign(new Error(message3), { status: 502, detail: "transport" });
+}
+function locationOf(headers) {
+  return headers.find(([name2]) => name2.toLowerCase() === "location")?.[1];
+}
+function nextHop(hop, status, location) {
+  if (!URL.canParse(location, hop.url)) throw failed3(`a bad redirect from ${hop.url}`);
+  const next3 = new URL(location, hop.url);
+  if (next3.protocol !== "http:" && next3.protocol !== "https:") {
+    throw failed3(`a redirect from ${hop.url} to ${next3.protocol}`);
+  }
+  next3.hash = "";
+  const toGet = (status === 301 || status === 302) && hop.method === "POST" || status === 303 && hop.method !== "GET" && hop.method !== "HEAD";
+  if (hop.bodyStream && !toGet) throw failed3(`a ${status} redirect would resend a streamed body`);
+  const crossOrigin = next3.origin !== new URL(hop.url).origin;
+  const { body, bodyStream: bodyStream2, ...rest2 } = hop;
+  return {
+    ...rest2,
+    ...body && !toGet ? { body } : {},
+    url: next3.href,
+    method: toGet ? "GET" : hop.method,
+    headers: hop.headers.filter(
+      ([name2]) => !(toGet && BODY_HEADERS.has(name2.toLowerCase())) && !(crossOrigin && CREDENTIALS.has(name2.toLowerCase()))
+    )
+  };
+}
+async function followRedirects(send2, request) {
+  let hop = { ...request, redirect: "manual" };
+  for (let hops = 0; ; hops++) {
+    const response = await send2(hop);
+    const location = locationOf(response.headers);
+    if (!REDIRECTS.has(response.status) || location === void 0) {
+      return hops > 0 ? { ...response, url: hop.url, redirected: true } : response;
+    }
+    await response.cancel();
+    if (hops >= MAX_REDIRECTS) throw failed3(`too many redirects from ${request.url}`);
+    hop = nextHop(hop, response.status, location);
+  }
+}
+
+// src/node/loopback.ts
 var DEVTOOLS_PORTS = [9222, 9223, 9224, 9225, 9226, 9227, 9228, 9229];
 var METADATA_V6 = [64768, 3778, 0, 0, 0, 0, 0, 596].join(":");
 var resolveHost = async (host) => (await lookup2(host, { all: true, verbatim: true })).map((a) => a.address);
@@ -34604,19 +34976,20 @@ function ensureSubscribed() {
 function guardedLoopback(transport, policy, resolve2) {
   ensureSubscribed();
   const open = transport.websocket?.bind(transport);
+  const send2 = async (request, owner) => {
+    await guarded2(checkDestination(request.url, policy, resolve2), request.signal);
+    const entry = { policy };
+    try {
+      return await loopbackStore.run(entry, () => transport.fetch(request, owner));
+    } catch (err) {
+      throw entry.refused ?? err;
+    }
+  };
   return {
     get traits() {
       return transport.traits;
     },
-    fetch: async (request, owner) => {
-      await guarded2(checkDestination(request.url, policy, resolve2), request.signal);
-      const entry = { policy };
-      try {
-        return await loopbackStore.run(entry, () => transport.fetch(request, owner));
-      } catch (err) {
-        throw entry.refused ?? err;
-      }
-    },
+    fetch: (request, owner) => request.redirect === "follow" ? followRedirects((hop) => send2(hop, owner), request) : send2(request, owner),
     ...open ? {
       websocket: async (request) => {
         await guarded2(checkDestination(request.url, policy, resolve2), request.signal);
@@ -35002,212 +35375,6 @@ function diagnosing(transport, check = byDefault) {
   };
 }
 
-// src/kernel/net/remote-transport.ts
-var TransportError = class extends Error {
-  status;
-  code;
-  detail;
-  constructor(message3, status, code, detail) {
-    super(message3);
-    this.status = status;
-    this.code = code;
-    this.detail = detail === "transport" ? detail : void 0;
-  }
-};
-var RemoteTransport = class {
-  traits;
-  port;
-  waiting = /* @__PURE__ */ new Map();
-  nextId = 0;
-  sockets = /* @__PURE__ */ new Map();
-  uploads = /* @__PURE__ */ new Map();
-  failure;
-  constructor(port, traits) {
-    this.port = port;
-    this.traits = traits;
-  }
-  receive(reply) {
-    if (reply.net === "body-pull") {
-      void this.pull(reply.nid);
-      return;
-    }
-    const socket = this.sockets.get(reply.nid);
-    if (socket && this.toSocket(reply, socket)) return;
-    const waiter = this.waiting.get(reply.nid);
-    if (!waiter) return;
-    this.waiting.delete(reply.nid);
-    if (reply.net === "error") {
-      waiter.reject(new TransportError(reply.message, reply.status, reply.code, reply.detail));
-    } else waiter.resolve(reply);
-  }
-  toSocket(reply, socket) {
-    if (reply.net === "ws-message") socket.queue.push(reply.data);
-    else if (reply.net === "ws-acked") socket.acked(reply.n);
-    else if (reply.net === "ws-closed") {
-      this.sockets.delete(reply.nid);
-      socket.queue.end({ code: reply.code, reason: reply.reason });
-    } else return false;
-    return true;
-  }
-  async pull(nid) {
-    const upload = this.uploads.get(nid);
-    if (!upload) {
-      this.port.postMessage({ net: "body-error", nid, message: "the request body is gone" });
-      return;
-    }
-    try {
-      const next3 = await upload.next();
-      if (next3.done) {
-        this.uploads.delete(nid);
-        this.port.postMessage({ net: "body-end", nid });
-      } else this.port.postMessage({ net: "body-chunk", nid, bytes: next3.value });
-    } catch (e) {
-      this.uploads.delete(nid);
-      this.port.postMessage({
-        net: "body-error",
-        nid,
-        message: e instanceof Error ? e.message : String(e)
-      });
-    }
-  }
-  dropUpload(nid) {
-    const upload = this.uploads.get(nid);
-    this.uploads.delete(nid);
-    void upload?.return?.().catch(() => void 0);
-  }
-  fail(error) {
-    this.failure = error;
-    for (const nid of [...this.uploads.keys()]) this.dropUpload(nid);
-    for (const waiter of this.waiting.values()) waiter.reject(error);
-    this.waiting.clear();
-    for (const socket of this.sockets.values())
-      socket.queue.end({ code: 1011, reason: error.message });
-    this.sockets.clear();
-  }
-  ask(call) {
-    if (this.failure) return Promise.reject(this.failure);
-    return new Promise((resolve2, reject) => {
-      this.waiting.set(call.nid, { resolve: resolve2, reject });
-      this.port.postMessage(call);
-    });
-  }
-  cancel(nid) {
-    const waiter = this.waiting.get(nid);
-    this.waiting.delete(nid);
-    waiter?.reject(new TransportError("the request was cancelled"));
-    this.port.postMessage({ net: "cancel", nid });
-  }
-  async fetch(request) {
-    const nid = ++this.nextId;
-    const { signal } = request;
-    signal.throwIfAborted();
-    let finished = false;
-    const abort = () => {
-      finished = true;
-      this.dropUpload(nid);
-      this.cancel(nid);
-    };
-    signal.addEventListener("abort", abort, { once: true });
-    const finish = () => {
-      this.dropUpload(nid);
-      if (finished) return;
-      finished = true;
-      signal.removeEventListener("abort", abort);
-    };
-    if (request.bodyStream) this.uploads.set(nid, request.bodyStream[Symbol.asyncIterator]());
-    let head;
-    try {
-      head = await this.ask({
-        net: "fetch",
-        nid,
-        url: request.url,
-        method: request.method,
-        headers: request.headers,
-        ...request.bodyStream ? { streamed: true } : request.body ? { body: request.body } : {}
-      });
-    } catch (e) {
-      finish();
-      throw e;
-    }
-    const { status, statusText, headers, url, redirected: redirected2, redirects } = head;
-    const read = async () => {
-      if (finished) return void 0;
-      const reply = await this.ask({ net: "read", nid }).catch((e) => {
-        finish();
-        throw e;
-      });
-      if (reply.net === "chunk") return reply.bytes;
-      finish();
-      return void 0;
-    };
-    const cancel = async () => {
-      if (finished) return;
-      finish();
-      this.cancel(nid);
-    };
-    return {
-      ...redirected2 ? { url, redirected: redirected2 } : {},
-      ...redirects ? { redirects } : {},
-      status,
-      statusText,
-      headers,
-      cancel,
-      body: {
-        [Symbol.asyncIterator]: () => ({
-          next: async () => {
-            const bytes = await read();
-            return bytes ? { value: bytes, done: false } : { value: void 0, done: true };
-          },
-          return: async () => {
-            await cancel();
-            return { value: void 0, done: true };
-          }
-        })
-      }
-    };
-  }
-  async websocket(request) {
-    const nid = ++this.nextId;
-    const { signal } = request;
-    signal.throwIfAborted();
-    const abort = () => this.cancel(nid);
-    signal.addEventListener("abort", abort, { once: true });
-    let opened2;
-    try {
-      opened2 = await this.ask({
-        net: "ws-open",
-        nid,
-        url: request.url,
-        protocols: request.protocols,
-        headers: request.headers
-      });
-    } finally {
-      signal.removeEventListener("abort", abort);
-    }
-    const close = (code, reason) => this.port.postMessage({ net: "ws-close", nid, code, reason });
-    const queue = new MessageQueue(
-      () => close(1e3, "a message is too big"),
-      Number.POSITIVE_INFINITY,
-      (n) => this.port.postMessage({ net: "ws-consumed", nid, n })
-    );
-    let unacked = 0;
-    this.sockets.set(nid, { queue, acked: (n) => void (unacked -= n) });
-    return {
-      protocol: opened2.protocol,
-      get buffered() {
-        return unacked;
-      },
-      send: (data) => {
-        unacked += payloadSize(data);
-        this.port.postMessage({ net: "ws-send", nid, data });
-      },
-      messages: queue,
-      close,
-      closed: queue.closed
-    };
-  }
-};
-
 // src/serve.ts
 function signalNumber(name2) {
   const key = name2.slice(3);
@@ -35841,9 +36008,9 @@ async function greet(channel, lock, timeoutMs, requests) {
   } finally {
     clearTimeout(timer);
   }
-  const refused3 = hello.error ?? versionError(hello.protocol);
-  if (refused3) {
-    const error = new Error(refused3);
+  const refused4 = hello.error ?? versionError(hello.protocol);
+  if (refused4) {
+    const error = new Error(refused4);
     channel.end(error);
     throw error;
   }