@ai-ecoverse/slicc-kernel 1.176.2 → 1.178.0

package/dist/node.js

@@ -969,9 +969,9 @@ function changeCred(cur, change) {
   }
   const privileged = cur.euid === 0;
   const next3 = copyCred(cur);
-  for (const keys of [UIDS, GIDS]) {
-    const own = keys.map((key) => cur[key]);
-    for (const key of keys) {
+  for (const keys2 of [UIDS, GIDS]) {
+    const own = keys2.map((key) => cur[key]);
+    for (const key of keys2) {
       const value2 = id(change[key]);
       if (value2 === void 0) continue;
       if (!privileged && !own.includes(value2)) throw fsError("EPERM", `${key} ${value2}`);
@@ -3617,12 +3617,12 @@ function next(p) {
 var ANY = [[">=", [0, 0, 0, []]]];
 var NOTHING = [["<", [0, 0, 0, ["0"]]]];
 function plain(op, p) {
-  const exact = !p.parts.includes(void 0);
+  const exact2 = !p.parts.includes(void 0);
   const low = floor(p);
   const high = next(p);
   if (op === ">=") return [[">=", low]];
-  if (op === "<") return [["<", exact ? low : [low[0], low[1], low[2], ["0"]]]];
-  if (exact) return [[op === "" ? "=" : op, low]];
+  if (op === "<") return [["<", exact2 ? low : [low[0], low[1], low[2], ["0"]]]];
+  if (exact2) return [[op === "" ? "=" : op, low]];
   if (op === ">") return high ? [[">=", high]] : NOTHING;
   if (op === "<=") return high ? [["<", high]] : ANY;
   return high ? [
@@ -3709,7 +3709,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.176.2" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.178.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -4299,7 +4299,7 @@ function intlZone(name2) {
     minute: "numeric",
     second: "numeric"
   });
-  const exact = (at) => {
+  const exact2 = (at) => {
     const parts2 = {};
     for (const part of format.formatToParts(at)) parts2[part.type] = Number(part.value);
     const wall = Date.UTC(
@@ -4319,12 +4319,12 @@ function intlZone(name2) {
       const bucket = Math.floor(at / BUCKET_MS);
       let known = buckets.get(bucket);
       if (known === void 0) {
-        const start2 = exact(bucket * BUCKET_MS);
-        known = start2 === exact(bucket * BUCKET_MS + BUCKET_MS - MINUTE_MS) ? start2 : null;
+        const start2 = exact2(bucket * BUCKET_MS);
+        known = start2 === exact2(bucket * BUCKET_MS + BUCKET_MS - MINUTE_MS) ? start2 : null;
         if (buckets.size >= CACHE_MAX) buckets.clear();
         buckets.set(bucket, known);
       }
-      return known ?? exact(at);
+      return known ?? exact2(at);
     }
   };
 }
@@ -5567,11 +5567,11 @@ var CronService = class {
     const now = this.clock.now();
     const system = this.host.timeZone;
     const due2 = [];
-    const keys = /* @__PURE__ */ new Set();
+    const keys2 = /* @__PURE__ */ new Set();
     let next3 = now + WAKE_MS;
     for (const entry of loaded) {
       const key = keyOf2(entry);
-      keys.add(key);
+      keys2.add(key);
       const { when } = entry.job;
       if (when.reboot) {
         if (this.rebooted || stamp.reboot[key] === this.host.bootId) continue;
@@ -5597,7 +5597,7 @@ var CronService = class {
     }
     this.rebooted = true;
     for (const map of [stamp.jobs, stamp.reboot, stamp.when])
-      for (const key of Object.keys(map)) if (!keys.has(key)) delete map[key];
+      for (const key of Object.keys(map)) if (!keys2.has(key)) delete map[key];
     await this.writeStamp(stamp);
     for (const each of due2) void this.spawn(each);
     return next3;
@@ -6883,16 +6883,16 @@ function missing2(err) {
   return err?.code === "ENOENT";
 }
 function synthetic(directory, path) {
-  const epoch = /* @__PURE__ */ new Date(0);
+  const epoch2 = /* @__PURE__ */ new Date(0);
   return {
     isFile: !directory,
     isDirectory: directory,
     isSymbolicLink: false,
     size: 0,
     mode: (directory ? S_IFDIR : S_IFREG) | 493,
-    mtime: epoch,
-    atime: epoch,
-    ctime: epoch,
+    mtime: epoch2,
+    atime: epoch2,
+    ctime: epoch2,
     ino: inodeOf(path)
   };
 }
@@ -7111,16 +7111,16 @@ function missing3(err) {
   return err?.code === "ENOENT";
 }
 function statOf(path, bytes) {
-  const epoch = /* @__PURE__ */ new Date(0);
+  const epoch2 = /* @__PURE__ */ new Date(0);
   return {
     isFile: true,
     isDirectory: false,
     isSymbolicLink: false,
     size: bytes.length,
     mode: S_IFREG2 | 420,
-    mtime: epoch,
-    atime: epoch,
-    ctime: epoch,
+    mtime: epoch2,
+    atime: epoch2,
+    ctime: epoch2,
     ino: inodeOf(path),
     nlink: 1,
     uid: 0,
@@ -9476,10 +9476,10 @@ async function copyByBytes(fs, from, to, options) {
 
 // src/fs/view.ts
 function view(target, overrides) {
-  const keys = new Set(Object.keys(overrides));
+  const keys2 = new Set(Object.keys(overrides));
   return new Proxy(target, {
     get(t, prop, receiver) {
-      if (keys.has(prop)) return overrides[prop];
+      if (keys2.has(prop)) return overrides[prop];
       return Reflect.get(t, prop, receiver);
     },
     set(t, prop, value2) {
@@ -9735,11 +9735,11 @@ var HeldPaths = class extends Map {
   handlesAt(path) {
     return [...this.handles].filter(([, key]) => key === path).map(([id2]) => id2);
   }
-  doubt(over, exact = false) {
+  doubt(over, exact2 = false) {
     if (this.bound.size === 0) return;
     for (const [handle, key] of this.handles) {
       if (!this.bound.has(handle) || this.keptHandles.has(handle)) continue;
-      if (exact ? key === over : within5(key, over)) this.doubted.set(handle, ++this.doubts);
+      if (exact2 ? key === over : within5(key, over)) this.doubted.set(handle, ++this.doubts);
     }
   }
   boundIno(handle) {
@@ -13594,8 +13594,8 @@ function refused2(engine, session, err, opening2) {
   const code = verifyCode(flags2);
   if (code && flags2 !== -1)
     return new KernelError("EPROTO", `${code}: ${engine.verifyInfo(flags2).trim()}`);
-  const record2 = recordRefusal(opening2);
-  if (record2) return record2;
+  const record3 = recordRefusal(opening2);
+  if (record3) return record3;
   const text = err instanceof TlsError ? err.message : String(err);
   return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
 }
@@ -14488,8 +14488,8 @@ var SCRUB_IDLE_MS = 50;
 var SCRUB_NONBLOCK_MAX = 64 * 1024;
 var encoder5 = new TextEncoder();
 function scrubberOf(secrets, sameLength = false) {
-  const usable2 = secrets.filter((s) => encoder5.encode(s.value).length >= MIN_VALUE);
-  return usable2.length > 0 ? compile(usable2, { idleMs: SCRUB_IDLE_MS, sameLength }) : void 0;
+  const usable3 = secrets.filter((s) => encoder5.encode(s.value).length >= MIN_VALUE);
+  return usable3.length > 0 ? compile(usable3, { idleMs: SCRUB_IDLE_MS, sameLength }) : void 0;
 }
 async function writeAll(file, bytes) {
   const write = file.write;
@@ -14710,6 +14710,120 @@ var SessionScrubs = class {
   }
 };
 
+// src/kernel/sealed-oauth.ts
+var SEALED_OAUTH_TIMEOUT_MS = 45e3;
+var SEALED_OAUTH_OPS = /* @__PURE__ */ new Set([
+  "oauthGrant",
+  "oauthStatus",
+  "oauthRefresh",
+  "oauthRemove"
+]);
+var MESSAGES = {
+  EINVAL: "Invalid OAuth request",
+  ENOENT: "OAuth credential not found",
+  EEXIST: "OAuth credential identity conflicts",
+  EACCES: "OAuth operation refused",
+  EAGAIN: "OAuth credential changed; try again",
+  ENOTSUP: "OAuth operation is not supported",
+  ENOTCONN: "Vault is unavailable",
+  ETIMEDOUT: "Vault request timed out",
+  EIO: "Invalid vault reply"
+};
+var CAUSES = {
+  "vault-locked": "Vault is locked",
+  "oauth-reauth-required": "OAuth sign-in is required",
+  "oauth-refresh-failed": "OAuth refresh failed"
+};
+var COMMON = ["v", "op", "caller"];
+var IDENTITY = [...COMMON, "name", "provider", "account"];
+var GRANT = [...IDENTITY, "accessToken", "refreshToken", "tokenType", "expiresAt", "oauth"];
+var CONFIG = ["tokenUrl", "clientId", "authMethod", "scope", "resource"];
+var UNSUPPORTED = ["auth", "clientSecret", "fields"];
+var STATES2 = /* @__PURE__ */ new Set([
+  "ready",
+  "refreshing",
+  "expired",
+  "reauth-required",
+  "removed",
+  "locked"
+]);
+var NAME2 = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+var PROVIDER = /^[a-z0-9][a-z0-9-]{0,127}$/;
+var PLACEHOLDER2 = /^fnox_proxy_[0-9a-f]{24}$/;
+var CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+function record(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function keys(value2, allowed) {
+  return Object.keys(value2).every((key) => allowed.includes(key));
+}
+function exact(value2, fields) {
+  return Object.keys(value2).length === fields.length && keys(value2, fields);
+}
+function nonempty(value2) {
+  return typeof value2 === "string" && value2.length > 0;
+}
+function epoch(value2) {
+  return typeof value2 === "number" && Number.isSafeInteger(value2) && value2 >= 0;
+}
+function sealedOAuthOperation(op) {
+  return op === "capabilities" || SEALED_OAUTH_OPS.has(op);
+}
+function validateSealedOAuth(req) {
+  const config = req.oauth;
+  if (UNSUPPORTED.some((key) => Object.hasOwn(req, key)) || record(config) && UNSUPPORTED.some((key) => Object.hasOwn(config, key)))
+    throw new KernelError("ENOTSUP");
+  const allowed = req.op === "capabilities" ? COMMON : req.op === "oauthGrant" ? GRANT : IDENTITY;
+  if (!keys(req, allowed)) throw new KernelError("EINVAL");
+  if (req.op === "capabilities") return;
+  if (typeof req.name !== "string" || !NAME2.test(req.name) || typeof req.provider !== "string" || !PROVIDER.test(req.provider) || !nonempty(req.account) || req.account.length > 256 || CONTROL.test(req.account))
+    throw new KernelError("EINVAL");
+  if (req.op !== "oauthGrant") return;
+  if (!nonempty(req.accessToken) || req.refreshToken !== void 0 && !nonempty(req.refreshToken) || req.tokenType !== void 0 && typeof req.tokenType !== "string" || req.expiresAt !== void 0 && !epoch(req.expiresAt) || !record(config) || !keys(config, CONFIG) || !nonempty(config.tokenUrl) || !nonempty(config.clientId) || typeof config.authMethod !== "string" || config.scope !== void 0 && typeof config.scope !== "string" || config.resource !== void 0 && !nonempty(config.resource))
+    throw new KernelError("EINVAL");
+  if (config.authMethod !== "none" || typeof req.tokenType === "string" && req.tokenType.toLowerCase() !== "bearer")
+    throw new KernelError("ENOTSUP");
+}
+function sealedOAuthError(code = "EIO", cause) {
+  return {
+    v: 1,
+    error: { code, ...cause ? { cause } : {}, message: cause ? CAUSES[cause] : MESSAGES[code] }
+  };
+}
+function sealedOAuthReply(op, value2) {
+  try {
+    return checkedReply(op, value2) ?? sealedOAuthError();
+  } catch {
+    return sealedOAuthError();
+  }
+}
+function checkedError(value2) {
+  const error = value2.error;
+  if (!exact(value2, ["v", "error"]) || !record(error) || !Object.hasOwn(error, "code") || !Object.hasOwn(error, "message"))
+    return void 0;
+  const { code, cause, message: message3 } = error;
+  if (!keys(error, ["code", "cause", "message"]) || typeof code !== "string" || !Object.hasOwn(MESSAGES, code) || typeof message3 !== "string" || cause !== void 0 && (typeof cause !== "string" || !Object.hasOwn(CAUSES, cause)))
+    return void 0;
+  return sealedOAuthError(code, cause);
+}
+function checkedReply(op, value2) {
+  if (!record(value2) || !Object.hasOwn(value2, "v") || value2.v !== 1) return void 0;
+  if (Object.hasOwn(value2, "error")) return checkedError(value2);
+  if (op === "capabilities") {
+    const caps = value2.capabilities;
+    if (!exact(value2, ["v", "capabilities"]) || !record(caps) || !keys(caps, ["kernelOAuth"]))
+      return void 0;
+    if (Object.hasOwn(caps, "kernelOAuth") && caps.kernelOAuth !== 1) return void 0;
+    return { v: 1, capabilities: Object.hasOwn(caps, "kernelOAuth") ? { kernelOAuth: 1 } : {} };
+  }
+  if (op === "oauthRemove")
+    return exact(value2, ["v", "removed"]) && value2.removed === true ? { v: 1, removed: true } : void 0;
+  const { placeholder, state, expiresAt, refreshable } = value2;
+  if (!exact(value2, ["v", "placeholder", "state", "expiresAt", "refreshable"]) || typeof placeholder !== "string" || !PLACEHOLDER2.test(placeholder) || typeof state !== "string" || !STATES2.has(state) || expiresAt !== null && !epoch(expiresAt) || typeof refreshable !== "boolean")
+    return void 0;
+  return { v: 1, placeholder, state, expiresAt, refreshable };
+}
+
 // src/kernel/sealed-session.ts
 var SESSION_WINDOW_MS = 6e4;
 var SESSION_PLACEHOLDERS = 16;
@@ -14820,8 +14934,8 @@ function sessionValues(reply, asked) {
   const { error, values } = reply;
   if (error !== void 0 || typeof values !== "object" || values === null) return void 0;
   const out = {};
-  const keys = Object.keys(values);
-  const wanted = asked ?? (keys.length === 1 && SESSION_PLACEHOLDER.test(keys[0]) ? keys : []);
+  const keys2 = Object.keys(values);
+  const wanted = asked ?? (keys2.length === 1 && SESSION_PLACEHOLDER.test(keys2[0]) ? keys2 : []);
   for (const ph of wanted) {
     const value2 = values[ph];
     if (typeof value2 === "string" && value2.length > 0 && !UNSAFE.test(value2)) out[ph] = value2;
@@ -14845,7 +14959,9 @@ var SEALED_OPS = /* @__PURE__ */ new Set([
   "request",
   "status",
   "cancel",
-  "materialize"
+  "materialize",
+  "capabilities",
+  ...SEALED_OAUTH_OPS
 ]);
 function tagFields(tags) {
   const [tag] = tags ?? [];
@@ -14880,6 +14996,7 @@ function parseSealed(bytes) {
       throw new KernelError("EINVAL");
     if (req.op === "materialize" && !materializable(req)) throw new KernelError("EINVAL");
     if (req.op === "ask" && !askable(req)) throw new KernelError("EINVAL");
+    if (sealedOAuthOperation(req.op)) validateSealedOAuth(req);
     return req;
   } finally {
     bytes.fill(0);
@@ -14958,7 +15075,7 @@ var SealedChannel = class {
     const ask = fields.op === "ask";
     const timer = setTimeout(
       () => control.abort(ask ? "expired" : "timeout"),
-      ask ? this.broker.askTimeoutMs : this.broker.timeoutMs
+      ask ? this.broker.askTimeoutMs : SEALED_OAUTH_OPS.has(fields.op) ? this.broker.oauthTimeoutMs : this.broker.timeoutMs
     );
     const req = { ...fields, v: 1, op: fields.op, caller };
     const asked = ask ? this.asking(fields, caller, requester, control.signal) : void 0;
@@ -14981,24 +15098,26 @@ var SealedChannel = class {
     if (!facts) return errorReply("EIO", "the kernel has no record of this process");
     return this.answer(askRequest(fields, caller, facts), signal);
   }
-  stopped(signal) {
+  stopped(signal, oauth = false) {
     if (signal.reason === "timeout")
-      return errorReply("ETIMEDOUT", "the vault did not answer within 10 s");
+      return oauth ? sealedOAuthError("ETIMEDOUT") : errorReply("ETIMEDOUT", "the vault did not answer within 10 s");
     return signal.reason === "expired" ? { v: 1, state: "expired" } : void 0;
   }
   async answer(req, signal) {
     const hook = this.broker.hook;
-    if (!hook) return errorReply("ENOTCONN", "no vault is connected");
+    const oauth = sealedOAuthOperation(req.op);
+    if (!hook)
+      return oauth ? sealedOAuthError("ENOTCONN") : errorReply("ENOTCONN", "no vault is connected");
     const stopped = new Promise((resolve2) => {
       signal.addEventListener("abort", () => resolve2(void 0), { once: true });
     });
     if (signal.aborted) return void 0;
     const asked = Promise.resolve().then(() => hook(req, { signal })).then(
-      (reply2) => isRecord(reply2) ? reply2 : errorReply("EIO", "the vault gave no reply"),
-      (err) => errorReply("EIO", lineOf3(err))
+      (reply2) => oauth ? sealedOAuthReply(req.op, reply2) : isRecord(reply2) ? reply2 : errorReply("EIO", "the vault gave no reply"),
+      (err) => oauth ? sealedOAuthError() : errorReply("EIO", lineOf3(err))
     );
     const reply = await Promise.race([asked, stopped]);
-    return signal.aborted ? this.stopped(signal) : reply;
+    return signal.aborted ? this.stopped(signal, oauth) : reply;
   }
   drop() {
     this.reply?.fill(0);
@@ -15061,6 +15180,7 @@ var SealedBroker = class {
   tickets = new TicketBook();
   sessions = new SessionScrubs();
   askTimeoutMs = SEALED_ASK_TIMEOUT_MS;
+  oauthTimeoutMs = SEALED_OAUTH_TIMEOUT_MS;
   userOf = async () => void 0;
   factsOf = async () => void 0;
   constructor(hook, users, timeoutMs = SEALED_TIMEOUT_MS, tagOf = () => void 0) {
@@ -15128,10 +15248,60 @@ var SealedBroker = class {
   }
 };
 
+// src/sudo-timestamp.ts
+var TIMESTAMPS_MAX = 64;
+var MINUTE_MS2 = 6e4;
+function timestampKey(owner, type) {
+  if (type === "global") return "global";
+  const { terminal, parent } = owner;
+  if (type === "tty" && terminal) {
+    return JSON.stringify(["tty", terminal.tty, terminal.sid, terminal.started]);
+  }
+  return parent ? JSON.stringify(["ppid", parent.pid, parent.started]) : void 0;
+}
+var Timestamps = class {
+  users = /* @__PURE__ */ new Map();
+  now;
+  constructor(now) {
+    this.now = now;
+  }
+  current(owner, policy) {
+    if (policy.minutes === 0) return false;
+    const key = timestampKey(owner, policy.type);
+    const at = key === void 0 ? void 0 : this.users.get(owner.uid)?.get(key);
+    if (at === void 0) return false;
+    const now = this.now();
+    return at <= now && (policy.minutes < 0 || now - at < policy.minutes * MINUTE_MS2);
+  }
+  stamp(owner, policy) {
+    const key = policy.minutes === 0 ? void 0 : timestampKey(owner, policy.type);
+    if (key === void 0) return false;
+    const now = this.now();
+    const records = this.users.get(owner.uid) ?? /* @__PURE__ */ new Map();
+    this.users.set(owner.uid, records);
+    records.delete(key);
+    records.set(key, now);
+    for (const [old, at] of records) {
+      const stale = policy.minutes > 0 && (at > now || now - at >= policy.minutes * MINUTE_MS2);
+      if (stale || records.size > TIMESTAMPS_MAX) records.delete(old);
+    }
+    return true;
+  }
+  invalidate(owner, type) {
+    const key = timestampKey(owner, type);
+    const records = this.users.get(owner.uid);
+    if (key !== void 0) records?.delete(key);
+    if (records?.size === 0) this.users.delete(owner.uid);
+  }
+  remove(uid) {
+    this.users.delete(uid);
+  }
+};
+
 // src/sudoers.ts
 var SUDOERS = "/etc/sudoers";
 var SUDOERS_D = "/etc/sudoers.d";
-var NAME2 = /^[a-z_][a-z0-9_.-]*$/;
+var NAME3 = /^[a-z_][a-z0-9_.-]*$/;
 var WORD = String.raw`(?:'[^']*'|"(?:[^"\\]|\\[\s\S])*"|\\[\s\S]|[^\s'"\\])+`;
 var KERNEL_FORM = new RegExp(
   String.raw`^(NOPASSWD\s+)?(\S+)\s+(?:\(([^()]*)\)\s+)?(?:Cwd\s+(${WORD})\s+)?(?:Stdin\s+(\S+)\s+)?Cmnd(?:\s+(.*))?$`
@@ -15141,14 +15311,16 @@ var RUNAS = /^\(([^()]*)\)\s*/;
 var TAG = /^([A-Z_]+)\s*:\s*/;
 var OPTION = /^([A-Z_]+)=/;
 var PLAIN = /^[A-Za-z0-9_@%+=:,./-]+$/;
-var CONTROL = /[\p{Cc}\u2028\u2029]/u;
+var CONTROL2 = /[\p{Cc}\u2028\u2029]/u;
 var CONTROLS = /[\p{Cc}\u2028\u2029]/gu;
 var SHOWN_MAX = 60;
 var KERNEL_SYNTAX = "[NOPASSWD] <user|%group|ALL> [(<target>)] [Cwd <dir>] [Stdin none] Cmnd <command\u2026|*>";
 var SUDOERS_SYNTAX = "<user|%group|ALL> ALL=[(<target>[,<target>\u2026])] [NOPASSWD:] <command\u2026|ALL>";
 var EXPECTED = `expected '${KERNEL_SYNTAX}' or '${SUDOERS_SYNTAX}'`;
+var TIMESTAMP_TIMEOUT = 5;
+var TIMESTAMP_TYPE = "tty";
 function hasControl(text) {
-  return CONTROL.test(text);
+  return CONTROL2.test(text);
 }
 function withoutControl(text) {
   return text.replace(CONTROLS, (ch) => {
@@ -15286,7 +15458,7 @@ function commandText(cmnd) {
 }
 function validWho(who) {
   if (who === "ALL") return true;
-  return NAME2.test(who.startsWith("%") ? who.slice(1) : who);
+  return NAME3.test(who.startsWith("%") ? who.slice(1) : who);
 }
 function whoError(who) {
   if (validWho(who)) return void 0;
@@ -15319,7 +15491,7 @@ function kernelRules(m) {
   const [, nopasswd, who = "", target = "root", dir, stdin, rest2 = ""] = m;
   const bad = whoError(who);
   if (bad !== void 0) return bad;
-  if (target !== "ALL" && !NAME2.test(target)) return targetError(target);
+  if (target !== "ALL" && !NAME3.test(target)) return targetError(target);
   const cwd = dir === void 0 ? void 0 : cwdOf(dir);
   if (cwd === "") return `Cwd expects one absolute directory, not ${shown(dir)}`;
   if (stdin !== void 0 && stdin !== "none") return `Stdin takes none, not ${shown(stdin)}`;
@@ -15343,11 +15515,11 @@ function runasOf(list) {
     return colon < 0 ? "() names no user to run as: name one, or leave the (\u2026) out for root" : `(${list}) runs as the caller with another group, which the kernel's sudo can't do`;
   }
   for (const name2 of names2) {
-    if (name2 === "ALL" || NAME2.test(name2)) continue;
+    if (name2 === "ALL" || NAME3.test(name2)) continue;
     return `expected user names or ALL to run as, not ${shown(name2)} (no %group, #uid or !user)`;
   }
   for (const group of groups) {
-    if (group === "" || group === "ALL" || NAME2.test(group)) continue;
+    if (group === "" || group === "ALL" || NAME3.test(group)) continue;
     return `expected group names or ALL after ':' in (\u2026), not ${shown(group)}`;
   }
   return names2.includes("ALL") ? ["ALL"] : [...new Set(names2)];
@@ -15429,9 +15601,6 @@ function directiveError(text) {
     return /^#-?\d+\s+\S+\s*=/.test(text) ? "a #uid isn't supported: name the user, %group or ALL" : null;
   }
   const first = /^\S+/.exec(text)?.[0] ?? "";
-  if (/^Defaults([:@>!]|$)/.test(first)) {
-    return "Defaults aren't supported: the kernel's sudo has no settings, so this changes nothing";
-  }
   if (/^[A-Z][A-Za-z]*_Alias$/.test(first)) {
     return "aliases aren't supported: name the users, targets and commands in each line";
   }
@@ -15439,7 +15608,7 @@ function directiveError(text) {
 }
 function recordedBare(line, file, rule) {
   if (rule.cmnd === "*" || rule.cmnd.args !== void 0 || !rule.nopasswd) return false;
-  if (file !== `${SUDOERS_D}/${rule.who}` || !NAME2.test(rule.who) || !NAME2.test(rule.target)) {
+  if (file !== `${SUDOERS_D}/${rule.who}` || !NAME3.test(rule.who) || !NAME3.test(rule.target)) {
     return false;
   }
   const head = `NOPASSWD ${rule.who} (${rule.target}) `;
@@ -15457,9 +15626,90 @@ function kernelLine(m, line, file) {
     )
   };
 }
+var DEFAULTS = /^Defaults(?=[:@>!\s]|$)/;
+var DEFAULTS_ONLY = `Defaults aren't supported, except timestamp_timeout and timestamp_type for everyone, a user or a %group: this line changes nothing`;
+var PARAM = /^(!*)([A-Za-z_]+)(?:\s*([-+]?=)\s*(.*))?$/s;
+var MINUTES = /^[-+]?(?:\d+(?:\.\d*)?|\.\d+)$/;
+var TYPES = ["tty", "ppid", "global"];
+function defaultsValue(raw2) {
+  const quoted = /^"(.*)"$/s.exec(raw2);
+  return quoted ? quoted[1] : raw2;
+}
+function timeoutParam({ text, negated, op, value: value2 }) {
+  if (negated && op === void 0) return { timestampTimeout: 0 };
+  if (negated || op !== "=" || !MINUTES.test(value2) || !Number.isFinite(Number(value2))) {
+    return `timestamp_timeout takes minutes, such as =5 or =2.5 (0 always asks, below 0 never expires), not ${shown(text)}`;
+  }
+  return { timestampTimeout: Number(value2) };
+}
+function typeParam({ text, negated, op, value: value2 }) {
+  if (!negated && op === "=" && TYPES.includes(value2)) {
+    return { timestampType: value2 };
+  }
+  if (value2 === "kernel") return "timestamp_type=kernel isn't supported: use tty, ppid or global";
+  return `timestamp_type takes =tty, =ppid or =global, not ${shown(text)}`;
+}
+function defaultsParam(param) {
+  const m = PARAM.exec(param);
+  if (!m) return DEFAULTS_ONLY;
+  const [, bangs = "", name2, op, raw2 = ""] = m;
+  const read = { text: param, negated: bangs !== "", op, value: defaultsValue(raw2.trim()) };
+  const settings = name2 === "timestamp_timeout" ? timeoutParam(read) : name2 === "timestamp_type" ? typeParam(read) : DEFAULTS_ONLY;
+  if (typeof settings === "string") return settings;
+  const value2 = settings.timestampTimeout ?? settings.timestampType;
+  return { settings, text: `${name2}=${value2}` };
+}
+function defaultsWho(binding) {
+  if (binding === "") return null;
+  if (!binding.startsWith(":")) return DEFAULTS_ONLY;
+  const who = binding.slice(1).split(",");
+  for (const name2 of who) {
+    if (!validWho(name2))
+      return `expected users, %groups or ALL after Defaults:, not ${shown(name2)}`;
+  }
+  return who;
+}
+function defaultsLine(text) {
+  const m = /^Defaults(\S*)(?:\s+(.*))?$/s.exec(text);
+  const who = defaultsWho(m?.[1] ?? "");
+  if (typeof who === "string") return { error: who };
+  const list = (m?.[2] ?? "").trim();
+  if (list === "")
+    return {
+      error: "expected timestamp_timeout=<minutes> or timestamp_type=<type> after Defaults"
+    };
+  const settings = {};
+  const params = [];
+  for (const param of list.split(",")) {
+    const read = defaultsParam(param.trim());
+    if (typeof read === "string") return { error: read };
+    Object.assign(settings, read.settings);
+    params.push(read.text);
+  }
+  return { defaults: { who, settings, params } };
+}
+function resolveDefaults(entries, applies) {
+  const everyone = entries.filter((e) => e.who === null);
+  const mine = entries.filter((e) => e.who?.some(applies));
+  const matching = [...everyone, ...mine];
+  const settings = Object.assign({}, ...matching.map((e) => e.settings));
+  return {
+    timestampTimeout: settings.timestampTimeout ?? TIMESTAMP_TIMEOUT,
+    timestampType: settings.timestampType ?? TIMESTAMP_TYPE,
+    matching
+  };
+}
+function defaultsText(entries) {
+  const all = resolveDefaults(entries, () => false);
+  return [
+    `Defaults timestamp_timeout=${all.timestampTimeout}, timestamp_type=${all.timestampType}`,
+    ...entries.filter((e) => e.who !== null).map((e) => `Defaults:${e.who.join(",")} ${e.params.join(", ")}`)
+  ];
+}
 function parseLine(line, file) {
   const text = line.trim();
   if (text === "") return null;
+  if (DEFAULTS.test(text)) return defaultsLine(text);
   const directive = directiveError(text);
   if (directive !== void 0) return directive === null ? null : { error: directive };
   const kernel = KERNEL_FORM.exec(text);
@@ -15471,14 +15721,16 @@ function parseLine(line, file) {
 }
 function parsePolicy(text, file) {
   const rules = [];
+  const defaults2 = [];
   const errors = [];
   for (const [n, line] of text.split("\n").entries()) {
     const parsed2 = parseLine(line, file);
     if (parsed2 === null) continue;
     if ("error" in parsed2) errors.push({ line: n + 1, message: parsed2.error });
+    else if ("defaults" in parsed2) defaults2.push(parsed2.defaults);
     else rules.push(...parsed2.rules);
   }
-  return { rules, errors };
+  return { rules, defaults: defaults2, errors };
 }
 
 // src/users.ts
@@ -15486,7 +15738,7 @@ var PASSWD = "/etc/passwd";
 var GROUP = "/etc/group";
 var DEFAULT_PASSWD = "root:x:0:0:root:/root:/bin/bash\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n";
 var DEFAULT_GROUP = "root:x:0:\ndialout:x:20:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
-var NAME3 = /^[a-z_][a-z0-9_.-]*$/;
+var NAME4 = /^[a-z_][a-z0-9_.-]*$/;
 var MAX_NAME = 255;
 var FIRST_UID = 1e3;
 var LAST_UID = 6e4;
@@ -15734,7 +15986,7 @@ var UserDb = class {
   add(options) {
     return this.serial(async () => {
       const { name: name2 } = options;
-      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME3.test(name2)) {
+      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME4.test(name2)) {
         throw fsError("EINVAL", `not a user name: ${String(name2)}`);
       }
       const remember = () => {
@@ -15788,7 +16040,7 @@ var UserDb = class {
   }
   addGroup(name2, gid) {
     return this.serial(async () => {
-      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME3.test(name2)) {
+      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME4.test(name2)) {
         throw fsError("EINVAL", `not a group name: ${String(name2)}`);
       }
       if (typeof gid !== "number" || !Number.isInteger(gid) || gid < 0 || gid > MAX_GID) {
@@ -15863,7 +16115,14 @@ var SECURE_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 var DEFAULT_SUDOERS = "%sudo Cmnd *\n";
 var SUDO_TIMEOUT_MS = 3e5;
 var TERM = /^[A-Za-z0-9._+-]+$/;
-var USAGE = "usage: sudo [-n] [-u user] [--] command [args...]\n       sudo -l";
+var USAGE = [
+  "usage: sudo -K | -k",
+  "       sudo -v [-kn] [-u user]",
+  "       sudo -l [-kn]",
+  "       sudo [-kn] [-u user] [--] command [args...]"
+].join("\n");
+var DONE = { done: true };
+var NOT_STAMPED = "sudo: approved, but the approver didn't say a person decided, so no timestamp was recorded";
 var DENIED2 = "sudo: approval denied";
 var DENIAL_MAX = 500;
 var ABORTED = /* @__PURE__ */ Symbol("aborted");
@@ -15937,6 +16196,17 @@ async function answerOf(approve, req, signal) {
     return cut === void 0 ? "deny" : await cut;
   }
 }
+function approvalOf(answer2) {
+  if (answer2 === "once" || answer2 === "always") return { answer: answer2, person: false };
+  if (typeof answer2 !== "object" || answer2 === null) return void 0;
+  try {
+    const { answer: kind, timestamp } = answer2;
+    if (kind !== "once" && kind !== "always" || timestamp !== true) return void 0;
+    return { answer: kind, person: true };
+  } catch {
+    return void 0;
+  }
+}
 function recordedCommand(argv) {
   const [path = "", ...args] = argv;
   return commandText({ path, args: args.map((a) => [a]) });
@@ -15946,6 +16216,9 @@ function flags(parsed2, arg, next3) {
     const flag = arg[j];
     if (flag === "n") parsed2.nonInteractive = true;
     else if (flag === "l") parsed2.list = true;
+    else if (flag === "v") parsed2.validate = true;
+    else if (flag === "k") parsed2.reset = true;
+    else if (flag === "K") parsed2.removeAll = true;
     else if (flag !== "u") return `sudo: invalid option -- '${flag}'
 ${USAGE}`;
     else {
@@ -15959,7 +16232,15 @@ ${USAGE}`;
   return 0;
 }
 function parseArgs(args) {
-  const parsed2 = { list: false, nonInteractive: false, user: "root", command: [] };
+  const parsed2 = {
+    list: false,
+    nonInteractive: false,
+    validate: false,
+    reset: false,
+    removeAll: false,
+    user: "root",
+    command: []
+  };
   let i = 0;
   for (; i < args.length; i++) {
     const arg = args[i];
@@ -15973,8 +16254,17 @@ function parseArgs(args) {
     i += used;
   }
   parsed2.command = args.slice(i);
-  if (parsed2.list ? parsed2.command.length > 0 : parsed2.command.length === 0) return USAGE;
-  return parsed2;
+  return usable(parsed2) ? parsed2 : USAGE;
+}
+function usable(parsed2) {
+  const command = parsed2.command.length > 0;
+  const modes = [parsed2.list, parsed2.validate, parsed2.removeAll].filter(Boolean).length;
+  if (modes > 1 || parsed2.removeAll && parsed2.reset) return false;
+  if (modes === 1) return !command;
+  return command || parsed2.reset;
+}
+function policyOf(settings) {
+  return { type: settings.timestampType, minutes: settings.timestampTimeout };
 }
 function described(rule) {
   const cmnd = rule.cmnd === "*" ? "ALL" : commandText(rule.cmnd);
@@ -15986,9 +16276,11 @@ var Sudo = class {
   o;
   warned = /* @__PURE__ */ new Set();
   pending = /* @__PURE__ */ new Set();
+  timestamps;
   next = 0;
   constructor(options) {
     this.o = options;
+    this.timestamps = new Timestamps(options.now ?? (() => performance.now()));
   }
   warn(message3) {
     if (this.warned.has(message3)) return;
@@ -16075,8 +16367,8 @@ var Sudo = class {
       const code = err.code;
       return skipped(`it can't be read (${typeof code === "string" ? code : "error"})`);
     }
-    const { rules, errors } = parsePolicy(text, path);
-    return { path, rules, problems: errors, ok: true };
+    const { rules, defaults: defaults2, errors } = parsePolicy(text, path);
+    return { path, rules, defaults: defaults2, problems: errors, ok: true };
   }
   async policy() {
     const files = [await this.policyFile(SUDOERS)];
@@ -16105,7 +16397,10 @@ var Sudo = class {
       }
     }
     if (!detailed && skipped > 0) await caller.report?.(skippedNotice(skipped));
-    return files.flatMap((f) => f.rules);
+    return {
+      rules: files.flatMap((f) => f.rules),
+      defaults: files.flatMap((f) => f.defaults ?? [])
+    };
   }
   async check(cred, call) {
     const lines2 = [];
@@ -16118,17 +16413,26 @@ var Sudo = class {
       if (read && problems.length === 0) lines2.push([1, `${path}: parsed OK`]);
       if (problems.length > 0) ok4 = false;
     };
+    const values = (defaults2) => {
+      for (const line of defaultsText(defaults2)) lines2.push([1, line]);
+    };
     if (call.files !== void 0) {
+      const defaults2 = [];
       for (const { name: name2, text } of call.files) {
-        report({ path: name2, rules: [], problems: parsePolicy(text).errors, ok: true });
+        const parsed2 = parsePolicy(text);
+        defaults2.push(...parsed2.defaults);
+        report({ path: name2, rules: [], problems: parsed2.errors, ok: true });
       }
+      if (defaults2.length > 0) values(defaults2);
       return { lines: lines2, ok: ok4 };
     }
     if (this.o.mode === "enforce" && cred.euid !== 0) {
       const hint = "check the policy as root (sudo visudo -c), or a file with visudo -c -f <file>";
       return { lines: [[2, `visudo: ${SUDOERS}: Permission denied: ${hint}`]], ok: false };
     }
-    for (const file of await this.policy()) report(file);
+    const files = await this.policy();
+    for (const file of files) report(file);
+    values(files.flatMap((f) => f.defaults ?? []));
     return { lines: lines2, ok: ok4 };
   }
   async groupIds() {
@@ -16137,9 +16441,9 @@ var Sudo = class {
   async applies(caller, cred) {
     const gids = await this.groupIds();
     const mine = /* @__PURE__ */ new Set([cred.rgid, cred.egid, ...cred.groups]);
-    return (rule) => {
-      if (rule.who === "ALL" || rule.who === caller.name) return true;
-      const gid = rule.who.startsWith("%") ? gids.get(rule.who.slice(1)) : void 0;
+    return (who) => {
+      if (who === "ALL" || who === caller.name) return true;
+      const gid = who.startsWith("%") ? gids.get(who.slice(1)) : void 0;
       return gid !== void 0 && mine.has(gid);
     };
   }
@@ -16184,18 +16488,40 @@ var Sudo = class {
       const mode = this.o.mode;
       if (parsed2.list) return { list: `sudo: users are '${mode}': commands run as the caller
 ` };
-      return { run: parsed2.command };
+      return parsed2.command.length > 0 ? { run: parsed2.command } : DONE;
     }
     const { cred } = caller;
     const policy = await this.policyRules(caller);
     const self = await this.o.users.lookup(cred.ruid);
     if (!self) return failed2("EPERM", `sudo: uid ${cred.ruid} is not in the passwd database`);
+    const owner = {
+      uid: cred.ruid,
+      terminal: caller.terminal,
+      parent: caller.parent
+    };
+    const applies = await this.applies(self, cred);
+    const settings = resolveDefaults(policy.defaults, applies);
+    if (parsed2.removeAll) {
+      this.timestamps.remove(owner.uid);
+      return DONE;
+    }
+    if (parsed2.reset && !parsed2.validate && !parsed2.list && parsed2.command.length === 0) {
+      this.timestamps.invalidate(owner, settings.timestampType);
+      return DONE;
+    }
     const target = await this.lookup(parsed2.user);
     if (!target) return failed2("ENOENT", `sudo: unknown user ${parsed2.user}`);
     const root = cred.euid === 0;
-    const rules = root ? [] : policy;
-    const applies = await this.applies(self, cred);
-    if (parsed2.list) return this.listed(self, root, rules.filter(applies));
+    const rules = root ? [] : policy.rules;
+    const mine = rules.filter((rule) => applies(rule.who));
+    if (parsed2.list) return this.listed(self, root, mine, settings.matching);
+    const session = { caller, self, target, owner, policy: policyOf(settings), parsed: parsed2, signal };
+    if (parsed2.validate) return this.validate(session, root, mine, call.cwd);
+    return this.command(session, root, mine, call);
+  }
+  async command(s, root, mine, call) {
+    const { caller, self, target, parsed: parsed2 } = s;
+    const { cred } = caller;
     const [word = "", ...args] = parsed2.command;
     const cwd = await this.canonical(call.cwd);
     if (cwd === void 0 || !await this.reachable(cred, cwd)) {
@@ -16209,8 +16535,8 @@ var Sudo = class {
     const untrusted2 = await this.untrusted(path, cwd, word);
     if (untrusted2) return untrusted2;
     const argv = [path, ...args];
-    const matching = rules.filter(
-      (rule) => applies(rule) && (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === cwd) && stdinMatches(rule, caller.stdin) && commandMatches(rule.cmnd, argv)
+    const matching = mine.filter(
+      (rule) => (rule.target === "ALL" || rule.target === target.name) && (rule.cwd === void 0 || rule.cwd === cwd) && stdinMatches(rule, caller.stdin) && commandMatches(rule.cmnd, argv)
     );
     const grant = () => this.grant(self, target, cred, parsed2.command, path, cwd, call.term);
     if (root || matching.some((rule) => rule.nopasswd)) return grant();
@@ -16221,23 +16547,67 @@ var Sudo = class {
         `sudo: ${self.name} is not allowed to run ${quoted} as ${target.name}`
       );
     }
+    if (!parsed2.reset && this.timestamps.current(s.owner, s.policy)) {
+      this.timestamps.stamp(s.owner, s.policy);
+      this.logged(s, cwd, argv);
+      return grant();
+    }
     if (parsed2.nonInteractive) return failed2("EPERM", "sudo: a password is required");
-    if (this.pending.has(cred.ruid)) return failed2("EBUSY", "sudo: another request is pending");
-    this.pending.add(cred.ruid);
-    try {
-      const answer2 = await this.ask(caller, self, target, parsed2.command, path, cwd, signal);
-      if (typeof answer2 !== "string") return answer2;
+    return this.pendingFor(cred.ruid, async () => {
+      const answer2 = await this.ask(s, { argv: parsed2.command, path, cwd });
+      if ("error" in answer2) return answer2;
       if (await this.canonical(call.cwd) !== cwd || !await this.reachable(cred, cwd)) {
         return failed2("EACCES", `sudo: ${call.cwd} changed while the request waited`);
       }
       const changed = await this.untrusted(path, cwd, word);
       if (changed) return changed;
-      if (answer2 === "once") return grant();
-      return await this.always(self, target, cwd, argv, recordable(cwd, parsed2.command), grant);
+      const result = answer2.answer === "once" ? grant() : await this.always(self, target, cwd, argv, recordable(cwd, parsed2.command), grant);
+      if (!("error" in result)) this.stamped(s, answer2);
+      return result;
+    });
+  }
+  async validate(s, root, mine, dir) {
+    const { self, parsed: parsed2 } = s;
+    if (root) return DONE;
+    if (mine.length === 0) {
+      return failed2("EPERM", `Sorry, user ${self.name} may not run sudo on ${this.o.hostname}.`);
+    }
+    if (mine.every((rule) => rule.nopasswd)) return DONE;
+    if (!parsed2.reset && this.timestamps.current(s.owner, s.policy)) {
+      this.timestamps.stamp(s.owner, s.policy);
+      return DONE;
+    }
+    if (parsed2.nonInteractive) return failed2("EPERM", "sudo: a password is required");
+    const cwd = await this.canonical(dir) ?? normalizePath(dir);
+    return this.pendingFor(s.caller.cred.ruid, async () => {
+      const answer2 = await this.ask(s, { argv: [], path: "", cwd, validate: true });
+      if ("error" in answer2) return answer2;
+      if (!answer2.person) await s.caller.report?.(NOT_STAMPED);
+      this.stamped(s, answer2);
+      return DONE;
+    });
+  }
+  async pendingFor(uid, work) {
+    if (this.pending.has(uid)) return failed2("EBUSY", "sudo: another request is pending");
+    this.pending.add(uid);
+    try {
+      return await work();
     } finally {
-      this.pending.delete(cred.ruid);
+      this.pending.delete(uid);
     }
   }
+  stamped(s, answer2) {
+    if (answer2.person && !s.parsed.reset) this.timestamps.stamp(s.owner, s.policy);
+  }
+  logged(s, cwd, argv) {
+    const { caller, self, target, owner, policy } = s;
+    const type = policy.type === "tty" && !owner.terminal ? "ppid" : policy.type;
+    const tty = owner.terminal?.tty ?? caller.tty ?? "unknown";
+    const command = argv.map(quoteWord).join(" ");
+    (this.o.warn ?? console.warn)(
+      `sudo: ${self.name} : TTY=${tty} ; PWD=${quoteWord(cwd)} ; USER=${target.name} ; TIMESTAMP=${type} ; COMMAND=${command}`
+    );
+  }
   async always(self, target, cwd, argv, shown2, grant) {
     if (!shown2 || !recordable(cwd, argv)) return { ...grant(), notice: RAN_ONCE };
     if (!await this.remember(self, target, cwd, argv)) {
@@ -16245,7 +16615,7 @@ var Sudo = class {
     }
     return grant();
   }
-  listed(self, root, rules) {
+  listed(self, root, rules, defaults2) {
     const host = this.o.hostname;
     if (root) {
       return {
@@ -16258,11 +16628,20 @@ var Sudo = class {
       return failed2("EPERM", `User ${self.name} is not allowed to run sudo on ${host}.`);
     }
     const lines2 = rules.map(described).join("\n");
-    return { list: `User ${self.name} may run the following commands on ${host}:
+    const params = defaults2.flatMap((d) => d.params).join(", ");
+    const matching = params === "" ? "" : `Matching Defaults entries for ${self.name} on ${host}:
+    ${params}
+
+`;
+    return {
+      list: `${matching}User ${self.name} may run the following commands on ${host}:
 ${lines2}
-` };
+`
+    };
   }
-  async ask(caller, self, target, argv, path, cwd, requester) {
+  async ask(s, asked) {
+    const { caller, self, target, signal: requester } = s;
+    const { argv, path, cwd } = asked;
     const { approve } = this.o;
     if (!approve || requester.aborted) return failed2("EACCES", DENIED2);
     const createdAt = Date.now();
@@ -16281,9 +16660,11 @@ ${lines2}
       ...caller.tty ? { tty: caller.tty } : {},
       createdAt,
       expiresAt: createdAt + timeout,
-      always: recordable(cwd, [path, ...argv]),
+      always: asked.validate ? false : recordable(cwd, [path, ...argv]),
       stdin: caller.stdin,
-      rootOnly: await this.rootOnly(cwd, argv.slice(1))
+      rootOnly: asked.validate ? {} : await this.rootOnly(cwd, argv.slice(1)),
+      ...asked.validate ? { validate: true } : {},
+      timestamp: true
     };
     const control = new AbortController();
     const timer = setTimeout(() => control.abort("expired"), timeout);
@@ -16293,9 +16674,8 @@ ${lines2}
     try {
       const answer2 = await answerOf(approve, req, control.signal);
       if (answer2 === ABORTED) return ended();
-      if (answer2 === "once" || answer2 === "always") {
-        return control.signal.aborted ? ended() : answer2;
-      }
+      const approved = approvalOf(answer2);
+      if (approved) return control.signal.aborted ? ended() : approved;
       return failed2("EACCES", denialText(answer2));
     } finally {
       clearTimeout(timer);
@@ -16305,7 +16685,7 @@ ${lines2}
   async remember(self, target, cwd, argv) {
     const { fs } = this.o;
     const path = `${SUDOERS_D}/${self.name}`;
-    if (!NAME2.test(self.name)) return false;
+    if (!NAME3.test(self.name)) return false;
     try {
       await this.provision();
       if (!await this.trusted(SUDOERS_D)) return false;
@@ -17674,8 +18054,8 @@ function sameCert(a, b) {
   if (!a || !b) return a === b;
   return a.cert.length === b.cert.length && a.cert.every((byte, i) => byte === b.cert[i]);
 }
-function winner(current, expected, record2) {
-  return sameCert(current, expected) ? record2 : current;
+function winner(current, expected, record3) {
+  return sameCert(current, expected) ? record3 : current;
 }
 var DAY = 24 * 60 * 60 * 1e3;
 var CA_LIFETIME = 3650 * DAY;
@@ -17692,14 +18072,14 @@ function validLeafName(host) {
 }
 var RealmCa = class _RealmCa {
   record;
-  constructor(record2) {
-    this.record = record2;
+  constructor(record3) {
+    this.record = record3;
   }
   static async open(owner, store, now = Date.now()) {
     const stored = await store.get(owner).catch(() => void 0);
     if (stored && stored.notAfter - now > CA_RENEW_BEFORE) return new _RealmCa(stored);
-    const record2 = await _RealmCa.create(owner, now);
-    return new _RealmCa(await store.swap(owner, stored, record2));
+    const record3 = await _RealmCa.create(owner, now);
+    return new _RealmCa(await store.swap(owner, stored, record3));
   }
   static async create(owner, now) {
     const pair = await crypto.subtle.generateKey(ECDSA, false, ["sign", "verify"]);
@@ -17925,8 +18305,8 @@ function memoryCaStore() {
   const records = /* @__PURE__ */ new Map();
   return {
     get: async (owner) => records.get(owner),
-    swap: async (owner, expected, record2) => {
-      const kept = winner(records.get(owner), expected, record2);
+    swap: async (owner, expected, record3) => {
+      const kept = winner(records.get(owner), expected, record3);
       records.set(owner, kept);
       return kept;
     }
@@ -19852,7 +20232,7 @@ function replaced(text, values) {
   for (const [ph, value2] of Object.entries(values)) out = out.split(ph).join(binary(value2));
   return out;
 }
-function usable(values) {
+function usable2(values) {
   const out = {};
   for (const [ph, value2] of Object.entries(values ?? {}))
     if (encoder8.encode(value2).length >= MIN_VALUE) out[ph] = value2;
@@ -19867,7 +20247,7 @@ async function substituteHead(head, ask) {
   if (!request || !found || found.length !== 1) return void 0;
   const at = found[0];
   if (at.placeholders.length > SESSION_PLACEHOLDERS) return void 0;
-  const values = usable(
+  const values = usable2(
     await ask(`header:${at.name}`, at.placeholders, {
       method: request[1],
       path: request[2]
@@ -20177,7 +20557,7 @@ async function cleartext(message3, asks) {
   const placeholders = placeholdersIn(password);
   if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS)
     return { bytes: message3, done: true };
-  const values = usable(await asks.cleartext(placeholders));
+  const values = usable2(await asks.cleartext(placeholders));
   if (Object.keys(values).length === 0) return { bytes: message3, done: true };
   return { bytes: frame3(112, `${replaced(password, values)}\0`), values, done: true };
 }
@@ -20242,7 +20622,7 @@ var PgClient = class {
     const x = got.exchange;
     const binding = this.header === END_POINT ? this.server.binding : void 0;
     const serverFinal = `c=${channelOf(this.header, binding)},r=${got.nonce}`;
-    const values = usable(
+    const values = usable2(
       await this.asks.scram({
         clientFirstBare: x.clientFirstBare,
         serverFirst: x.serverFirst,
@@ -20291,7 +20671,7 @@ function decoded(b642) {
 async function swapped(text, position, ask) {
   const placeholders = placeholdersIn(text);
   if (placeholders.length === 0 || placeholders.length > SESSION_PLACEHOLDERS) return void 0;
-  const values = usable(await ask(position, placeholders));
+  const values = usable2(await ask(position, placeholders));
   if (Object.keys(values).length === 0) return void 0;
   return { text: replaced(text, values), values };
 }
@@ -26495,7 +26875,7 @@ function header2(id2, flags2, counts) {
 function opt() {
   return [0, 0, TYPE_OPT, UDP_EDNS >> 8, UDP_EDNS & 255, 0, 0, 0, 0, 0, 0];
 }
-function record(type, rdata) {
+function record2(type, rdata) {
   const ttl = DNS_STUB_TTL;
   return [
     192,
@@ -26603,14 +26983,14 @@ var DnsStub = class {
       const address = reverseAddress(q.name);
       const name2 = address !== void 0 ? await this.reverse(address) : void 0;
       if (name2 !== void 0)
-        return answerReply(query, q, NOERROR, [record(TYPE_PTR, encodeName(name2))], true);
+        return answerReply(query, q, NOERROR, [record2(TYPE_PTR, encodeName(name2))], true);
       return this.forward(query, q);
     }
     if (q.type === TYPE_A || q.type === TYPE_AAAA) {
       const addresses = q.name === "" ? [] : await this.lookup(q.name);
       const answers2 = addresses.flatMap((a) => {
         const data = addressData(a, q.type);
-        return data ? [record(q.type, data)] : [];
+        return data ? [record2(q.type, data)] : [];
       });
       if (answers2.length > 0 || local(q.name) || await this.known(q.name)) {
         const rcode = addresses.length > 0 ? NOERROR : NXDOMAIN;
@@ -28938,8 +29318,8 @@ var OpfsFs = class {
     const [entry] = await this.meta.get([target]);
     if (entry?.fifo || entry?.socket) throw fsError("ENXIO", path);
     const kept = fresh3 ? cached : this.files.get(target);
-    const usable2 = kept && performance.now() - (this.found.get(kept) ?? -CHECK_MS) < CHECK_MS;
-    return [usable2 ? kept : void 0, target, true];
+    const usable3 = kept && performance.now() - (this.found.get(kept) ?? -CHECK_MS) < CHECK_MS;
+    return [usable3 ? kept : void 0, target, true];
   }
   async writeAt(handle, target, path, offset, bytes) {
     await this.counting(target);
@@ -29741,8 +30121,8 @@ var OpfsFs = class {
   renamingDirs = /* @__PURE__ */ new Set();
   intents = 0;
   async intend(rename, at = `${RENAMES2}/${crypto.randomUUID()}`) {
-    const record2 = { ...rename, at: Date.now() * 1e3 + this.intents++ % 1e3 };
-    await this.meta.update(at, () => ({ path: at, rename: record2 }));
+    const record3 = { ...rename, at: Date.now() * 1e3 + this.intents++ % 1e3 };
+    await this.meta.update(at, () => ({ path: at, rename: record3 }));
     return at;
   }
   async rollBack(from, to, intents) {
@@ -31935,6 +32315,7 @@ var SUDO_SOURCE = [
   "    await say(1, answer.list);",
   "    return 0;",
   "  }",
+  "  if (answer.done === true) return 0;",
   "  if (answer.run !== undefined) {",
   "    try {",
   "      pid = (await ctx.spawn({ argv: answer.run, pgid: 0 })).pid;",
@@ -32570,6 +32951,7 @@ var Launcher = class {
       );
     }
     this.users = new UserDb(this.fs, this.owners);
+    const { sudoClock } = options;
     this.sudoer = new Sudo({
       fs: this.fs,
       users: this.users,
@@ -32579,7 +32961,8 @@ var Launcher = class {
       pnpmHome: this.pnpmHome,
       backing: (path, cwd) => this.backing(path, cwd),
       approve: options.approve,
-      timeoutMs: options.sudoTimeoutMs
+      timeoutMs: options.sudoTimeoutMs,
+      now: sudoClock ? () => sudoClock.now() : void 0
     });
     this.cron = this.cronService(options.cron);
     void this.unlinked.sweep("/");
@@ -33150,8 +33533,8 @@ var Launcher = class {
     const caller = this.jobs.shown(ppid);
     const named = typeof req.argv0 === "string" && !planned.script && !planned.target.fixed;
     const argv = named ? [req.argv0, ...req.argv.slice(1)] : req.argv;
-    const exact = booked?.pid === caller && req.file === booked.path && await physicalPathAsync(this.base, req.cwd) === booked.cwd && await argvDigest(argv) === booked.argv;
-    if (!exact) throw new SpawnError("EACCES");
+    const exact2 = booked?.pid === caller && req.file === booked.path && await physicalPathAsync(this.base, req.cwd) === booked.cwd && await argvDigest(argv) === booked.argv;
+    if (!exact2) throw new SpawnError("EACCES");
     const { requested: path, requestedCwd: cwd, path: resolved2 } = booked;
     const pid = this.nextPid++;
     const ids = { pid: req.exec ? caller : pid, ppid: caller };
@@ -33985,11 +34368,26 @@ var Launcher = class {
       pid: this.jobs.shown(pid),
       tags: this.tagsOf(pid),
       tty: this.described.get(pid)?.tty,
+      ...this.timestampOwner(pid),
       stdin,
       report
     };
     return this.sudoer.request(caller, call, signal);
   }
+  timestampOwner(pid) {
+    const sid = this.jobs.sidOf(pid);
+    const tty = this.jobs.controllingTerminal(pid)?.name;
+    const leader = sid === void 0 ? void 0 : this.startedOf(sid);
+    const host = this.jobs.shownParent(pid) ?? this.jobs.shown(pid);
+    const started = this.startedOf(host);
+    return {
+      ...tty && sid !== void 0 && leader !== void 0 ? { terminal: { tty, sid, started: leader } } : {},
+      ...started === void 0 ? {} : { parent: { pid: host, started } }
+    };
+  }
+  startedOf(shown2) {
+    return this.running(shown2) ? this.described.get(shown2)?.started : void 0;
+  }
   visudo(pid, call) {
     return this.sudoer.check(this.credOf(pid), call);
   }
@@ -34499,9 +34897,9 @@ var Launcher = class {
   }
   pnpmReady() {
     if (this.pnpmMade !== void 0) return this.pnpmMade;
-    const epoch = this.pnpmEpoch;
+    const epoch2 = this.pnpmEpoch;
     const made2 = this.base.mkdir(this.pnpmHome, { recursive: true }).then(() => this.owners ? this.stampLayout() : void 0).catch(() => {
-      if (this.pnpmEpoch === epoch) this.pnpmMade = void 0;
+      if (this.pnpmEpoch === epoch2) this.pnpmMade = void 0;
     });
     this.pnpmMade = made2;
     return made2;
@@ -37676,6 +38074,7 @@ async function createNodeKernel(options = {}) {
     ...options.clipboard ? { clipboard: options.clipboard } : {},
     ...options.requests ? { embedder: checkedRequests(options.requests) } : {},
     ...options.approve ? { approve: options.approve } : {},
+    ...options.sudo?.clock ? { sudoClock: options.sudo.clock } : {},
     ...options.wasmMemories ? { wasmMemories: options.wasmMemories } : {},
     cron: { lock: cronLock(root), ...options.cron?.clock ? { clock: options.cron.clock } : {} }
   });