@ai-ecoverse/slicc-kernel 1.177.0 → 1.178.1

package/dist/node.js

@@ -969,9 +969,9 @@ function changeCred(cur, change) {
   }
   const privileged = cur.euid === 0;
   const next3 = copyCred(cur);
-  for (const keys of [UIDS, GIDS]) {
-    const own = keys.map((key) => cur[key]);
-    for (const key of keys) {
+  for (const keys2 of [UIDS, GIDS]) {
+    const own = keys2.map((key) => cur[key]);
+    for (const key of keys2) {
       const value2 = id(change[key]);
       if (value2 === void 0) continue;
       if (!privileged && !own.includes(value2)) throw fsError("EPERM", `${key} ${value2}`);
@@ -3617,12 +3617,12 @@ function next(p) {
 var ANY = [[">=", [0, 0, 0, []]]];
 var NOTHING = [["<", [0, 0, 0, ["0"]]]];
 function plain(op, p) {
-  const exact = !p.parts.includes(void 0);
+  const exact2 = !p.parts.includes(void 0);
   const low = floor(p);
   const high = next(p);
   if (op === ">=") return [[">=", low]];
-  if (op === "<") return [["<", exact ? low : [low[0], low[1], low[2], ["0"]]]];
-  if (exact) return [[op === "" ? "=" : op, low]];
+  if (op === "<") return [["<", exact2 ? low : [low[0], low[1], low[2], ["0"]]]];
+  if (exact2) return [[op === "" ? "=" : op, low]];
   if (op === ">") return high ? [[">=", high]] : NOTHING;
   if (op === "<=") return high ? [["<", high]] : ANY;
   return high ? [
@@ -3709,7 +3709,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.177.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.178.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -4299,7 +4299,7 @@ function intlZone(name2) {
     minute: "numeric",
     second: "numeric"
   });
-  const exact = (at) => {
+  const exact2 = (at) => {
     const parts2 = {};
     for (const part of format.formatToParts(at)) parts2[part.type] = Number(part.value);
     const wall = Date.UTC(
@@ -4319,12 +4319,12 @@ function intlZone(name2) {
       const bucket = Math.floor(at / BUCKET_MS);
       let known = buckets.get(bucket);
       if (known === void 0) {
-        const start2 = exact(bucket * BUCKET_MS);
-        known = start2 === exact(bucket * BUCKET_MS + BUCKET_MS - MINUTE_MS) ? start2 : null;
+        const start2 = exact2(bucket * BUCKET_MS);
+        known = start2 === exact2(bucket * BUCKET_MS + BUCKET_MS - MINUTE_MS) ? start2 : null;
         if (buckets.size >= CACHE_MAX) buckets.clear();
         buckets.set(bucket, known);
       }
-      return known ?? exact(at);
+      return known ?? exact2(at);
     }
   };
 }
@@ -5567,11 +5567,11 @@ var CronService = class {
     const now = this.clock.now();
     const system = this.host.timeZone;
     const due2 = [];
-    const keys = /* @__PURE__ */ new Set();
+    const keys2 = /* @__PURE__ */ new Set();
     let next3 = now + WAKE_MS;
     for (const entry of loaded) {
       const key = keyOf2(entry);
-      keys.add(key);
+      keys2.add(key);
       const { when } = entry.job;
       if (when.reboot) {
         if (this.rebooted || stamp.reboot[key] === this.host.bootId) continue;
@@ -5597,7 +5597,7 @@ var CronService = class {
     }
     this.rebooted = true;
     for (const map of [stamp.jobs, stamp.reboot, stamp.when])
-      for (const key of Object.keys(map)) if (!keys.has(key)) delete map[key];
+      for (const key of Object.keys(map)) if (!keys2.has(key)) delete map[key];
     await this.writeStamp(stamp);
     for (const each of due2) void this.spawn(each);
     return next3;
@@ -6883,16 +6883,16 @@ function missing2(err) {
   return err?.code === "ENOENT";
 }
 function synthetic(directory, path) {
-  const epoch = /* @__PURE__ */ new Date(0);
+  const epoch2 = /* @__PURE__ */ new Date(0);
   return {
     isFile: !directory,
     isDirectory: directory,
     isSymbolicLink: false,
     size: 0,
     mode: (directory ? S_IFDIR : S_IFREG) | 493,
-    mtime: epoch,
-    atime: epoch,
-    ctime: epoch,
+    mtime: epoch2,
+    atime: epoch2,
+    ctime: epoch2,
     ino: inodeOf(path)
   };
 }
@@ -7111,16 +7111,16 @@ function missing3(err) {
   return err?.code === "ENOENT";
 }
 function statOf(path, bytes) {
-  const epoch = /* @__PURE__ */ new Date(0);
+  const epoch2 = /* @__PURE__ */ new Date(0);
   return {
     isFile: true,
     isDirectory: false,
     isSymbolicLink: false,
     size: bytes.length,
     mode: S_IFREG2 | 420,
-    mtime: epoch,
-    atime: epoch,
-    ctime: epoch,
+    mtime: epoch2,
+    atime: epoch2,
+    ctime: epoch2,
     ino: inodeOf(path),
     nlink: 1,
     uid: 0,
@@ -9476,10 +9476,10 @@ async function copyByBytes(fs, from, to, options) {
 
 // src/fs/view.ts
 function view(target, overrides) {
-  const keys = new Set(Object.keys(overrides));
+  const keys2 = new Set(Object.keys(overrides));
   return new Proxy(target, {
     get(t, prop, receiver) {
-      if (keys.has(prop)) return overrides[prop];
+      if (keys2.has(prop)) return overrides[prop];
       return Reflect.get(t, prop, receiver);
     },
     set(t, prop, value2) {
@@ -9735,11 +9735,11 @@ var HeldPaths = class extends Map {
   handlesAt(path) {
     return [...this.handles].filter(([, key]) => key === path).map(([id2]) => id2);
   }
-  doubt(over, exact = false) {
+  doubt(over, exact2 = false) {
     if (this.bound.size === 0) return;
     for (const [handle, key] of this.handles) {
       if (!this.bound.has(handle) || this.keptHandles.has(handle)) continue;
-      if (exact ? key === over : within5(key, over)) this.doubted.set(handle, ++this.doubts);
+      if (exact2 ? key === over : within5(key, over)) this.doubted.set(handle, ++this.doubts);
     }
   }
   boundIno(handle) {
@@ -13594,8 +13594,8 @@ function refused2(engine, session, err, opening2) {
   const code = verifyCode(flags2);
   if (code && flags2 !== -1)
     return new KernelError("EPROTO", `${code}: ${engine.verifyInfo(flags2).trim()}`);
-  const record2 = recordRefusal(opening2);
-  if (record2) return record2;
+  const record3 = recordRefusal(opening2);
+  if (record3) return record3;
   const text = err instanceof TlsError ? err.message : String(err);
   return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
 }
@@ -14710,6 +14710,120 @@ var SessionScrubs = class {
   }
 };
 
+// src/kernel/sealed-oauth.ts
+var SEALED_OAUTH_TIMEOUT_MS = 45e3;
+var SEALED_OAUTH_OPS = /* @__PURE__ */ new Set([
+  "oauthGrant",
+  "oauthStatus",
+  "oauthRefresh",
+  "oauthRemove"
+]);
+var MESSAGES = {
+  EINVAL: "Invalid OAuth request",
+  ENOENT: "OAuth credential not found",
+  EEXIST: "OAuth credential identity conflicts",
+  EACCES: "OAuth operation refused",
+  EAGAIN: "OAuth credential changed; try again",
+  ENOTSUP: "OAuth operation is not supported",
+  ENOTCONN: "Vault is unavailable",
+  ETIMEDOUT: "Vault request timed out",
+  EIO: "Invalid vault reply"
+};
+var CAUSES = {
+  "vault-locked": "Vault is locked",
+  "oauth-reauth-required": "OAuth sign-in is required",
+  "oauth-refresh-failed": "OAuth refresh failed"
+};
+var COMMON = ["v", "op", "caller"];
+var IDENTITY = [...COMMON, "name", "provider", "account"];
+var GRANT = [...IDENTITY, "accessToken", "refreshToken", "tokenType", "expiresAt", "oauth"];
+var CONFIG = ["tokenUrl", "clientId", "authMethod", "scope", "resource"];
+var UNSUPPORTED = ["auth", "clientSecret", "fields"];
+var STATES2 = /* @__PURE__ */ new Set([
+  "ready",
+  "refreshing",
+  "expired",
+  "reauth-required",
+  "removed",
+  "locked"
+]);
+var NAME2 = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+var PROVIDER = /^[a-z0-9][a-z0-9-]{0,127}$/;
+var PLACEHOLDER2 = /^fnox_proxy_[0-9a-f]{24}$/;
+var CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+function record(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function keys(value2, allowed) {
+  return Object.keys(value2).every((key) => allowed.includes(key));
+}
+function exact(value2, fields) {
+  return Object.keys(value2).length === fields.length && keys(value2, fields);
+}
+function nonempty(value2) {
+  return typeof value2 === "string" && value2.length > 0;
+}
+function epoch(value2) {
+  return typeof value2 === "number" && Number.isSafeInteger(value2) && value2 >= 0;
+}
+function sealedOAuthOperation(op) {
+  return op === "capabilities" || SEALED_OAUTH_OPS.has(op);
+}
+function validateSealedOAuth(req) {
+  const config = req.oauth;
+  if (UNSUPPORTED.some((key) => Object.hasOwn(req, key)) || record(config) && UNSUPPORTED.some((key) => Object.hasOwn(config, key)))
+    throw new KernelError("ENOTSUP");
+  const allowed = req.op === "capabilities" ? COMMON : req.op === "oauthGrant" ? GRANT : IDENTITY;
+  if (!keys(req, allowed)) throw new KernelError("EINVAL");
+  if (req.op === "capabilities") return;
+  if (typeof req.name !== "string" || !NAME2.test(req.name) || typeof req.provider !== "string" || !PROVIDER.test(req.provider) || !nonempty(req.account) || req.account.length > 256 || CONTROL.test(req.account))
+    throw new KernelError("EINVAL");
+  if (req.op !== "oauthGrant") return;
+  if (!nonempty(req.accessToken) || req.refreshToken !== void 0 && !nonempty(req.refreshToken) || req.tokenType !== void 0 && typeof req.tokenType !== "string" || req.expiresAt !== void 0 && !epoch(req.expiresAt) || !record(config) || !keys(config, CONFIG) || !nonempty(config.tokenUrl) || !nonempty(config.clientId) || typeof config.authMethod !== "string" || config.scope !== void 0 && typeof config.scope !== "string" || config.resource !== void 0 && !nonempty(config.resource))
+    throw new KernelError("EINVAL");
+  if (config.authMethod !== "none" || typeof req.tokenType === "string" && req.tokenType.toLowerCase() !== "bearer")
+    throw new KernelError("ENOTSUP");
+}
+function sealedOAuthError(code = "EIO", cause) {
+  return {
+    v: 1,
+    error: { code, ...cause ? { cause } : {}, message: cause ? CAUSES[cause] : MESSAGES[code] }
+  };
+}
+function sealedOAuthReply(op, value2) {
+  try {
+    return checkedReply(op, value2) ?? sealedOAuthError();
+  } catch {
+    return sealedOAuthError();
+  }
+}
+function checkedError(value2) {
+  const error = value2.error;
+  if (!exact(value2, ["v", "error"]) || !record(error) || !Object.hasOwn(error, "code") || !Object.hasOwn(error, "message"))
+    return void 0;
+  const { code, cause, message: message3 } = error;
+  if (!keys(error, ["code", "cause", "message"]) || typeof code !== "string" || !Object.hasOwn(MESSAGES, code) || typeof message3 !== "string" || cause !== void 0 && (typeof cause !== "string" || !Object.hasOwn(CAUSES, cause)))
+    return void 0;
+  return sealedOAuthError(code, cause);
+}
+function checkedReply(op, value2) {
+  if (!record(value2) || !Object.hasOwn(value2, "v") || value2.v !== 1) return void 0;
+  if (Object.hasOwn(value2, "error")) return checkedError(value2);
+  if (op === "capabilities") {
+    const caps = value2.capabilities;
+    if (!exact(value2, ["v", "capabilities"]) || !record(caps) || !keys(caps, ["kernelOAuth"]))
+      return void 0;
+    if (Object.hasOwn(caps, "kernelOAuth") && caps.kernelOAuth !== 1) return void 0;
+    return { v: 1, capabilities: Object.hasOwn(caps, "kernelOAuth") ? { kernelOAuth: 1 } : {} };
+  }
+  if (op === "oauthRemove")
+    return exact(value2, ["v", "removed"]) && value2.removed === true ? { v: 1, removed: true } : void 0;
+  const { placeholder, state, expiresAt, refreshable } = value2;
+  if (!exact(value2, ["v", "placeholder", "state", "expiresAt", "refreshable"]) || typeof placeholder !== "string" || !PLACEHOLDER2.test(placeholder) || typeof state !== "string" || !STATES2.has(state) || expiresAt !== null && !epoch(expiresAt) || typeof refreshable !== "boolean")
+    return void 0;
+  return { v: 1, placeholder, state, expiresAt, refreshable };
+}
+
 // src/kernel/sealed-session.ts
 var SESSION_WINDOW_MS = 6e4;
 var SESSION_PLACEHOLDERS = 16;
@@ -14820,8 +14934,8 @@ function sessionValues(reply, asked) {
   const { error, values } = reply;
   if (error !== void 0 || typeof values !== "object" || values === null) return void 0;
   const out = {};
-  const keys = Object.keys(values);
-  const wanted = asked ?? (keys.length === 1 && SESSION_PLACEHOLDER.test(keys[0]) ? keys : []);
+  const keys2 = Object.keys(values);
+  const wanted = asked ?? (keys2.length === 1 && SESSION_PLACEHOLDER.test(keys2[0]) ? keys2 : []);
   for (const ph of wanted) {
     const value2 = values[ph];
     if (typeof value2 === "string" && value2.length > 0 && !UNSAFE.test(value2)) out[ph] = value2;
@@ -14845,7 +14959,9 @@ var SEALED_OPS = /* @__PURE__ */ new Set([
   "request",
   "status",
   "cancel",
-  "materialize"
+  "materialize",
+  "capabilities",
+  ...SEALED_OAUTH_OPS
 ]);
 function tagFields(tags) {
   const [tag] = tags ?? [];
@@ -14880,6 +14996,7 @@ function parseSealed(bytes) {
       throw new KernelError("EINVAL");
     if (req.op === "materialize" && !materializable(req)) throw new KernelError("EINVAL");
     if (req.op === "ask" && !askable(req)) throw new KernelError("EINVAL");
+    if (sealedOAuthOperation(req.op)) validateSealedOAuth(req);
     return req;
   } finally {
     bytes.fill(0);
@@ -14958,7 +15075,7 @@ var SealedChannel = class {
     const ask = fields.op === "ask";
     const timer = setTimeout(
       () => control.abort(ask ? "expired" : "timeout"),
-      ask ? this.broker.askTimeoutMs : this.broker.timeoutMs
+      ask ? this.broker.askTimeoutMs : SEALED_OAUTH_OPS.has(fields.op) ? this.broker.oauthTimeoutMs : this.broker.timeoutMs
     );
     const req = { ...fields, v: 1, op: fields.op, caller };
     const asked = ask ? this.asking(fields, caller, requester, control.signal) : void 0;
@@ -14981,24 +15098,26 @@ var SealedChannel = class {
     if (!facts) return errorReply("EIO", "the kernel has no record of this process");
     return this.answer(askRequest(fields, caller, facts), signal);
   }
-  stopped(signal) {
+  stopped(signal, oauth = false) {
     if (signal.reason === "timeout")
-      return errorReply("ETIMEDOUT", "the vault did not answer within 10 s");
+      return oauth ? sealedOAuthError("ETIMEDOUT") : errorReply("ETIMEDOUT", "the vault did not answer within 10 s");
     return signal.reason === "expired" ? { v: 1, state: "expired" } : void 0;
   }
   async answer(req, signal) {
     const hook = this.broker.hook;
-    if (!hook) return errorReply("ENOTCONN", "no vault is connected");
+    const oauth = sealedOAuthOperation(req.op);
+    if (!hook)
+      return oauth ? sealedOAuthError("ENOTCONN") : errorReply("ENOTCONN", "no vault is connected");
     const stopped = new Promise((resolve2) => {
       signal.addEventListener("abort", () => resolve2(void 0), { once: true });
     });
     if (signal.aborted) return void 0;
     const asked = Promise.resolve().then(() => hook(req, { signal })).then(
-      (reply2) => isRecord(reply2) ? reply2 : errorReply("EIO", "the vault gave no reply"),
-      (err) => errorReply("EIO", lineOf3(err))
+      (reply2) => oauth ? sealedOAuthReply(req.op, reply2) : isRecord(reply2) ? reply2 : errorReply("EIO", "the vault gave no reply"),
+      (err) => oauth ? sealedOAuthError() : errorReply("EIO", lineOf3(err))
     );
     const reply = await Promise.race([asked, stopped]);
-    return signal.aborted ? this.stopped(signal) : reply;
+    return signal.aborted ? this.stopped(signal, oauth) : reply;
   }
   drop() {
     this.reply?.fill(0);
@@ -15061,6 +15180,7 @@ var SealedBroker = class {
   tickets = new TicketBook();
   sessions = new SessionScrubs();
   askTimeoutMs = SEALED_ASK_TIMEOUT_MS;
+  oauthTimeoutMs = SEALED_OAUTH_TIMEOUT_MS;
   userOf = async () => void 0;
   factsOf = async () => void 0;
   constructor(hook, users, timeoutMs = SEALED_TIMEOUT_MS, tagOf = () => void 0) {
@@ -15181,7 +15301,7 @@ var Timestamps = class {
 // src/sudoers.ts
 var SUDOERS = "/etc/sudoers";
 var SUDOERS_D = "/etc/sudoers.d";
-var NAME2 = /^[a-z_][a-z0-9_.-]*$/;
+var NAME3 = /^[a-z_][a-z0-9_.-]*$/;
 var WORD = String.raw`(?:'[^']*'|"(?:[^"\\]|\\[\s\S])*"|\\[\s\S]|[^\s'"\\])+`;
 var KERNEL_FORM = new RegExp(
   String.raw`^(NOPASSWD\s+)?(\S+)\s+(?:\(([^()]*)\)\s+)?(?:Cwd\s+(${WORD})\s+)?(?:Stdin\s+(\S+)\s+)?Cmnd(?:\s+(.*))?$`
@@ -15191,7 +15311,7 @@ var RUNAS = /^\(([^()]*)\)\s*/;
 var TAG = /^([A-Z_]+)\s*:\s*/;
 var OPTION = /^([A-Z_]+)=/;
 var PLAIN = /^[A-Za-z0-9_@%+=:,./-]+$/;
-var CONTROL = /[\p{Cc}\u2028\u2029]/u;
+var CONTROL2 = /[\p{Cc}\u2028\u2029]/u;
 var CONTROLS = /[\p{Cc}\u2028\u2029]/gu;
 var SHOWN_MAX = 60;
 var KERNEL_SYNTAX = "[NOPASSWD] <user|%group|ALL> [(<target>)] [Cwd <dir>] [Stdin none] Cmnd <command\u2026|*>";
@@ -15200,7 +15320,7 @@ var EXPECTED = `expected '${KERNEL_SYNTAX}' or '${SUDOERS_SYNTAX}'`;
 var TIMESTAMP_TIMEOUT = 5;
 var TIMESTAMP_TYPE = "tty";
 function hasControl(text) {
-  return CONTROL.test(text);
+  return CONTROL2.test(text);
 }
 function withoutControl(text) {
   return text.replace(CONTROLS, (ch) => {
@@ -15338,7 +15458,7 @@ function commandText(cmnd) {
 }
 function validWho(who) {
   if (who === "ALL") return true;
-  return NAME2.test(who.startsWith("%") ? who.slice(1) : who);
+  return NAME3.test(who.startsWith("%") ? who.slice(1) : who);
 }
 function whoError(who) {
   if (validWho(who)) return void 0;
@@ -15371,7 +15491,7 @@ function kernelRules(m) {
   const [, nopasswd, who = "", target = "root", dir, stdin, rest2 = ""] = m;
   const bad = whoError(who);
   if (bad !== void 0) return bad;
-  if (target !== "ALL" && !NAME2.test(target)) return targetError(target);
+  if (target !== "ALL" && !NAME3.test(target)) return targetError(target);
   const cwd = dir === void 0 ? void 0 : cwdOf(dir);
   if (cwd === "") return `Cwd expects one absolute directory, not ${shown(dir)}`;
   if (stdin !== void 0 && stdin !== "none") return `Stdin takes none, not ${shown(stdin)}`;
@@ -15395,11 +15515,11 @@ function runasOf(list) {
     return colon < 0 ? "() names no user to run as: name one, or leave the (\u2026) out for root" : `(${list}) runs as the caller with another group, which the kernel's sudo can't do`;
   }
   for (const name2 of names2) {
-    if (name2 === "ALL" || NAME2.test(name2)) continue;
+    if (name2 === "ALL" || NAME3.test(name2)) continue;
     return `expected user names or ALL to run as, not ${shown(name2)} (no %group, #uid or !user)`;
   }
   for (const group of groups) {
-    if (group === "" || group === "ALL" || NAME2.test(group)) continue;
+    if (group === "" || group === "ALL" || NAME3.test(group)) continue;
     return `expected group names or ALL after ':' in (\u2026), not ${shown(group)}`;
   }
   return names2.includes("ALL") ? ["ALL"] : [...new Set(names2)];
@@ -15488,7 +15608,7 @@ function directiveError(text) {
 }
 function recordedBare(line, file, rule) {
   if (rule.cmnd === "*" || rule.cmnd.args !== void 0 || !rule.nopasswd) return false;
-  if (file !== `${SUDOERS_D}/${rule.who}` || !NAME2.test(rule.who) || !NAME2.test(rule.target)) {
+  if (file !== `${SUDOERS_D}/${rule.who}` || !NAME3.test(rule.who) || !NAME3.test(rule.target)) {
     return false;
   }
   const head = `NOPASSWD ${rule.who} (${rule.target}) `;
@@ -15618,7 +15738,7 @@ var PASSWD = "/etc/passwd";
 var GROUP = "/etc/group";
 var DEFAULT_PASSWD = "root:x:0:0:root:/root:/bin/bash\nnobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin\n";
 var DEFAULT_GROUP = "root:x:0:\ndialout:x:20:\nsudo:x:27:\nusers:x:100:\nnogroup:x:65534:\n";
-var NAME3 = /^[a-z_][a-z0-9_.-]*$/;
+var NAME4 = /^[a-z_][a-z0-9_.-]*$/;
 var MAX_NAME = 255;
 var FIRST_UID = 1e3;
 var LAST_UID = 6e4;
@@ -15866,7 +15986,7 @@ var UserDb = class {
   add(options) {
     return this.serial(async () => {
       const { name: name2 } = options;
-      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME3.test(name2)) {
+      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME4.test(name2)) {
         throw fsError("EINVAL", `not a user name: ${String(name2)}`);
       }
       const remember = () => {
@@ -15920,7 +16040,7 @@ var UserDb = class {
   }
   addGroup(name2, gid) {
     return this.serial(async () => {
-      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME3.test(name2)) {
+      if (typeof name2 !== "string" || name2.length > MAX_NAME || !NAME4.test(name2)) {
         throw fsError("EINVAL", `not a group name: ${String(name2)}`);
       }
       if (typeof gid !== "number" || !Number.isInteger(gid) || gid < 0 || gid > MAX_GID) {
@@ -16565,7 +16685,7 @@ ${lines2}
   async remember(self, target, cwd, argv) {
     const { fs } = this.o;
     const path = `${SUDOERS_D}/${self.name}`;
-    if (!NAME2.test(self.name)) return false;
+    if (!NAME3.test(self.name)) return false;
     try {
       await this.provision();
       if (!await this.trusted(SUDOERS_D)) return false;
@@ -17934,8 +18054,8 @@ function sameCert(a, b) {
   if (!a || !b) return a === b;
   return a.cert.length === b.cert.length && a.cert.every((byte, i) => byte === b.cert[i]);
 }
-function winner(current, expected, record2) {
-  return sameCert(current, expected) ? record2 : current;
+function winner(current, expected, record3) {
+  return sameCert(current, expected) ? record3 : current;
 }
 var DAY = 24 * 60 * 60 * 1e3;
 var CA_LIFETIME = 3650 * DAY;
@@ -17952,14 +18072,14 @@ function validLeafName(host) {
 }
 var RealmCa = class _RealmCa {
   record;
-  constructor(record2) {
-    this.record = record2;
+  constructor(record3) {
+    this.record = record3;
   }
   static async open(owner, store, now = Date.now()) {
     const stored = await store.get(owner).catch(() => void 0);
     if (stored && stored.notAfter - now > CA_RENEW_BEFORE) return new _RealmCa(stored);
-    const record2 = await _RealmCa.create(owner, now);
-    return new _RealmCa(await store.swap(owner, stored, record2));
+    const record3 = await _RealmCa.create(owner, now);
+    return new _RealmCa(await store.swap(owner, stored, record3));
   }
   static async create(owner, now) {
     const pair = await crypto.subtle.generateKey(ECDSA, false, ["sign", "verify"]);
@@ -18185,8 +18305,8 @@ function memoryCaStore() {
   const records = /* @__PURE__ */ new Map();
   return {
     get: async (owner) => records.get(owner),
-    swap: async (owner, expected, record2) => {
-      const kept = winner(records.get(owner), expected, record2);
+    swap: async (owner, expected, record3) => {
+      const kept = winner(records.get(owner), expected, record3);
       records.set(owner, kept);
       return kept;
     }
@@ -18287,6 +18407,9 @@ function enableNetwork(net, options) {
   return () => proxy;
 }
 
+// src/kernel/net/transport.ts
+var FORBIDDEN_HEADER = "forbidden-header";
+
 // src/kernel/net/ws-syscalls.ts
 var WS_OPS = [
   "net-ws-open",
@@ -18586,6 +18709,9 @@ var HttpHandles = class {
     if (e instanceof PlaceholderRefused) {
       return { ok: false, errno: e.code, message: text, detail: "placeholder" };
     }
+    if (e.detail === FORBIDDEN_HEADER) {
+      return { ok: false, errno: "ENOTSUP", message: text, detail: FORBIDDEN_HEADER };
+    }
     const status = e.status;
     if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
       const code = codeOf2(e);
@@ -26755,7 +26881,7 @@ function header2(id2, flags2, counts) {
 function opt() {
   return [0, 0, TYPE_OPT, UDP_EDNS >> 8, UDP_EDNS & 255, 0, 0, 0, 0, 0, 0];
 }
-function record(type, rdata) {
+function record2(type, rdata) {
   const ttl = DNS_STUB_TTL;
   return [
     192,
@@ -26863,14 +26989,14 @@ var DnsStub = class {
       const address = reverseAddress(q.name);
       const name2 = address !== void 0 ? await this.reverse(address) : void 0;
       if (name2 !== void 0)
-        return answerReply(query, q, NOERROR, [record(TYPE_PTR, encodeName(name2))], true);
+        return answerReply(query, q, NOERROR, [record2(TYPE_PTR, encodeName(name2))], true);
       return this.forward(query, q);
     }
     if (q.type === TYPE_A || q.type === TYPE_AAAA) {
       const addresses = q.name === "" ? [] : await this.lookup(q.name);
       const answers2 = addresses.flatMap((a) => {
         const data = addressData(a, q.type);
-        return data ? [record(q.type, data)] : [];
+        return data ? [record2(q.type, data)] : [];
       });
       if (answers2.length > 0 || local(q.name) || await this.known(q.name)) {
         const rcode = addresses.length > 0 ? NOERROR : NXDOMAIN;
@@ -27059,7 +27185,7 @@ var TransportError = class extends Error {
     super(message3);
     this.status = status;
     this.code = code;
-    this.detail = detail === "transport" ? detail : void 0;
+    this.detail = detail === "transport" || detail === FORBIDDEN_HEADER ? detail : void 0;
   }
 };
 function unfollowed2(redirect) {
@@ -30001,8 +30127,8 @@ var OpfsFs = class {
   renamingDirs = /* @__PURE__ */ new Set();
   intents = 0;
   async intend(rename, at = `${RENAMES2}/${crypto.randomUUID()}`) {
-    const record2 = { ...rename, at: Date.now() * 1e3 + this.intents++ % 1e3 };
-    await this.meta.update(at, () => ({ path: at, rename: record2 }));
+    const record3 = { ...rename, at: Date.now() * 1e3 + this.intents++ % 1e3 };
+    await this.meta.update(at, () => ({ path: at, rename: record3 }));
     return at;
   }
   async rollBack(from, to, intents) {
@@ -33413,8 +33539,8 @@ var Launcher = class {
     const caller = this.jobs.shown(ppid);
     const named = typeof req.argv0 === "string" && !planned.script && !planned.target.fixed;
     const argv = named ? [req.argv0, ...req.argv.slice(1)] : req.argv;
-    const exact = booked?.pid === caller && req.file === booked.path && await physicalPathAsync(this.base, req.cwd) === booked.cwd && await argvDigest(argv) === booked.argv;
-    if (!exact) throw new SpawnError("EACCES");
+    const exact2 = booked?.pid === caller && req.file === booked.path && await physicalPathAsync(this.base, req.cwd) === booked.cwd && await argvDigest(argv) === booked.argv;
+    if (!exact2) throw new SpawnError("EACCES");
     const { requested: path, requestedCwd: cwd, path: resolved2 } = booked;
     const pid = this.nextPid++;
     const ids = { pid: req.exec ? caller : pid, ppid: caller };
@@ -34777,9 +34903,9 @@ var Launcher = class {
   }
   pnpmReady() {
     if (this.pnpmMade !== void 0) return this.pnpmMade;
-    const epoch = this.pnpmEpoch;
+    const epoch2 = this.pnpmEpoch;
     const made2 = this.base.mkdir(this.pnpmHome, { recursive: true }).then(() => this.owners ? this.stampLayout() : void 0).catch(() => {
-      if (this.pnpmEpoch === epoch) this.pnpmMade = void 0;
+      if (this.pnpmEpoch === epoch2) this.pnpmMade = void 0;
     });
     this.pnpmMade = made2;
     return made2;
@@ -35480,6 +35606,44 @@ function sentHeaders(headers, inPage) {
   if (inPage) out.delete("user-agent");
   return out;
 }
+var TRANSPORT_OWN = /* @__PURE__ */ new Set([
+  "accept-encoding",
+  "connection",
+  "content-length",
+  "expect",
+  "host",
+  "keep-alive",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var PROBE = "http://forbidden-headers.invalid/";
+var filters;
+function platformFilters() {
+  filters ??= !new Request(PROBE, { headers: [["cookie", "probe=1"]] }).headers.has("cookie");
+  return filters;
+}
+function unsendableHeaders(url, names2, hint) {
+  const which = names2.length > 1 ? "headers" : "header";
+  return Object.assign(
+    new Error(
+      `fetch ${url} refused: the page's fetch can't send the request ${which} ${names2.join(", ")}, so it was not sent${hint ? `: ${hint}` : ""}`
+    ),
+    { status: 502, code: "ENOTSUP", detail: FORBIDDEN_HEADER, headers: [...names2] }
+  );
+}
+function refuseUnsendable(url, out, hint) {
+  if (!platformFilters()) return;
+  const kept = new Request(PROBE, { headers: out }).headers;
+  const refused4 = [];
+  for (const name2 of new Set(out.keys())) {
+    if (kept.has(name2)) continue;
+    if (TRANSPORT_OWN.has(name2)) out.delete(name2);
+    else refused4.push(name2);
+  }
+  if (refused4.length > 0) throw unsendableHeaders(url, refused4, hint);
+}
 function streamOf(body) {
   const it = body[Symbol.asyncIterator]();
   return new ReadableStream(
@@ -35508,6 +35672,7 @@ function fetchTransport(options = {}) {
   const headers = options.webSocketHeaders === true;
   const instance = options.redirect ?? "follow";
   const inPage = !options.fetch && "location" in globalThis;
+  const refuse2 = (options.forbiddenHeaders ?? (options.fetch ? "send" : "refuse")) === "refuse";
   return {
     traits: {
       manualRedirects: instance === "manual",
@@ -35520,11 +35685,13 @@ function fetchTransport(options = {}) {
     },
     ...Socket ? { websocket: (request) => openWebSocket(Socket, request, headers) } : {},
     async fetch(request) {
+      const sent = sentHeaders(request.headers, inPage);
+      if (refuse2) refuseUnsendable(request.url, sent, options.hint);
       let response;
       try {
         response = await send2(request.url, {
           method: request.method,
-          headers: sentHeaders(request.headers, inPage),
+          headers: sent,
           ...requestBody(request),
           signal: request.signal,
           redirect: request.redirect ?? instance,
@@ -35625,7 +35792,7 @@ function serveTransport(peer, transport, {
       message: e instanceof Error ? e.message : String(e),
       ...typeof status === "number" ? { status } : {},
       ...typeof code === "string" ? { code } : {},
-      ...detail === "transport" ? { detail } : {}
+      ...detail === "transport" || detail === FORBIDDEN_HEADER ? { detail } : {}
     });
   };
   const uploads = uploadsFor(peer);