@ai-ecoverse/slicc-kernel 1.177.0 → 1.178.1

package/dist/kernel-worker.js

@@ -1611,10 +1611,10 @@ var RemoteWatch = class {
 
 // src/fs/view.ts
 function view(target, overrides) {
-  const keys = new Set(Object.keys(overrides));
+  const keys2 = new Set(Object.keys(overrides));
   return new Proxy(target, {
     get(t, prop, receiver) {
-      if (keys.has(prop)) return overrides[prop];
+      if (keys2.has(prop)) return overrides[prop];
       return Reflect.get(t, prop, receiver);
     },
     set(t, prop, value2) {
@@ -3599,8 +3599,8 @@ var OpfsFs = class {
   renamingDirs = /* @__PURE__ */ new Set();
   intents = 0;
   async intend(rename, at = `${RENAMES2}/${crypto.randomUUID()}`) {
-    const record2 = { ...rename, at: Date.now() * 1e3 + this.intents++ % 1e3 };
-    await this.meta.update(at, () => ({ path: at, rename: record2 }));
+    const record3 = { ...rename, at: Date.now() * 1e3 + this.intents++ % 1e3 };
+    await this.meta.update(at, () => ({ path: at, rename: record3 }));
     return at;
   }
   async rollBack(from, to, intents) {
@@ -4145,9 +4145,9 @@ async function same(a, b) {
     return false;
   }
 }
-async function matches(record2, root, at) {
-  if (record2.handle) return same(record2.handle, root);
-  return "path" in at && record2.path !== void 0 && samePath(record2.path, at.path);
+async function matches(record3, root, at) {
+  if (record3.handle) return same(record3.handle, root);
+  return "path" in at && record3.path !== void 0 && samePath(record3.path, at.path);
 }
 var nameOf = (id2) => `${META_DB}:${id2}`;
 function done(tx) {
@@ -4190,7 +4190,7 @@ async function rootId(factory, root, locks = globalThis.navigator?.locks, top) {
       const all = await request(
         db.transaction(ROOTS_STORE, "readonly").objectStore(ROOTS_STORE).getAll()
       );
-      for (const record2 of all) if (await matches(record2, root, at)) return record2.id;
+      for (const record3 of all) if (await matches(record3, root, at)) return record3.id;
       const id2 = crypto.randomUUID();
       if (await used(root)) await seed(factory, nameOf(id2));
       const tx = db.transaction(ROOTS_STORE, "readwrite");
@@ -5673,9 +5673,9 @@ function changeCred(cur, change) {
   }
   const privileged = cur.euid === 0;
   const next3 = copyCred(cur);
-  for (const keys of [UIDS, GIDS]) {
-    const own = keys.map((key) => cur[key]);
-    for (const key of keys) {
+  for (const keys2 of [UIDS, GIDS]) {
+    const own = keys2.map((key) => cur[key]);
+    for (const key of keys2) {
       const value2 = id(change[key]);
       if (value2 === void 0) continue;
       if (!privileged && !own.includes(value2)) throw fsError("EPERM", `${key} ${value2}`);
@@ -7452,6 +7452,9 @@ var KERNEL_SIGINFO = Object.freeze({
 // src/body-idle.ts
 var BODY_IDLE_MS = 5 * 60 * 1e3;
 
+// src/kernel/net/transport.ts
+var FORBIDDEN_HEADER = "forbidden-header";
+
 // src/kernel/net/ws-queue.ts
 var INBOUND_LIMIT = 16 * 1024 * 1024;
 var MESSAGE_LIMIT = 64 * 1024 * 1024;
@@ -7586,7 +7589,7 @@ function serveTransport(peer, transport, {
       message: e instanceof Error ? e.message : String(e),
       ...typeof status === "number" ? { status } : {},
       ...typeof code === "string" ? { code } : {},
-      ...detail === "transport" ? { detail } : {}
+      ...detail === "transport" || detail === FORBIDDEN_HEADER ? { detail } : {}
     });
   };
   const uploads = uploadsFor(peer);
@@ -8682,12 +8685,12 @@ function next(p) {
 var ANY = [[">=", [0, 0, 0, []]]];
 var NOTHING = [["<", [0, 0, 0, ["0"]]]];
 function plain(op, p) {
-  const exact = !p.parts.includes(void 0);
+  const exact2 = !p.parts.includes(void 0);
   const low = floor(p);
   const high = next(p);
   if (op === ">=") return [[">=", low]];
-  if (op === "<") return [["<", exact ? low : [low[0], low[1], low[2], ["0"]]]];
-  if (exact) return [[op === "" ? "=" : op, low]];
+  if (op === "<") return [["<", exact2 ? low : [low[0], low[1], low[2], ["0"]]]];
+  if (exact2) return [[op === "" ? "=" : op, low]];
   if (op === ">") return high ? [[">=", high]] : NOTHING;
   if (op === "<=") return high ? [["<", high]] : ANY;
   return high ? [
@@ -8774,7 +8777,7 @@ function satisfies(version, range2) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.177.0" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.178.1" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -9364,7 +9367,7 @@ function intlZone(name2) {
     minute: "numeric",
     second: "numeric"
   });
-  const exact = (at) => {
+  const exact2 = (at) => {
     const parts2 = {};
     for (const part of format.formatToParts(at)) parts2[part.type] = Number(part.value);
     const wall = Date.UTC(
@@ -9384,12 +9387,12 @@ function intlZone(name2) {
       const bucket = Math.floor(at / BUCKET_MS);
       let known = buckets.get(bucket);
       if (known === void 0) {
-        const start2 = exact(bucket * BUCKET_MS);
-        known = start2 === exact(bucket * BUCKET_MS + BUCKET_MS - MINUTE_MS) ? start2 : null;
+        const start2 = exact2(bucket * BUCKET_MS);
+        known = start2 === exact2(bucket * BUCKET_MS + BUCKET_MS - MINUTE_MS) ? start2 : null;
         if (buckets.size >= CACHE_MAX) buckets.clear();
         buckets.set(bucket, known);
       }
-      return known ?? exact(at);
+      return known ?? exact2(at);
     }
   };
 }
@@ -10619,11 +10622,11 @@ var CronService = class {
     const now = this.clock.now();
     const system = this.host.timeZone;
     const due2 = [];
-    const keys = /* @__PURE__ */ new Set();
+    const keys2 = /* @__PURE__ */ new Set();
     let next3 = now + WAKE_MS;
     for (const entry of loaded) {
       const key = keyOf2(entry);
-      keys.add(key);
+      keys2.add(key);
       const { when } = entry.job;
       if (when.reboot) {
         if (this.rebooted || stamp.reboot[key] === this.host.bootId) continue;
@@ -10649,7 +10652,7 @@ var CronService = class {
     }
     this.rebooted = true;
     for (const map of [stamp.jobs, stamp.reboot, stamp.when])
-      for (const key of Object.keys(map)) if (!keys.has(key)) delete map[key];
+      for (const key of Object.keys(map)) if (!keys2.has(key)) delete map[key];
     await this.writeStamp(stamp);
     for (const each of due2) void this.spawn(each);
     return next3;
@@ -11755,16 +11758,16 @@ function missing4(err) {
   return err?.code === "ENOENT";
 }
 function synthetic(directory, path) {
-  const epoch = /* @__PURE__ */ new Date(0);
+  const epoch2 = /* @__PURE__ */ new Date(0);
   return {
     isFile: !directory,
     isDirectory: directory,
     isSymbolicLink: false,
     size: 0,
     mode: (directory ? S_IFDIR2 : S_IFREG2) | 493,
-    mtime: epoch,
-    atime: epoch,
-    ctime: epoch,
+    mtime: epoch2,
+    atime: epoch2,
+    ctime: epoch2,
     ino: inodeOf(path)
   };
 }
@@ -11983,16 +11986,16 @@ function missing5(err) {
   return err?.code === "ENOENT";
 }
 function statOf(path, bytes) {
-  const epoch = /* @__PURE__ */ new Date(0);
+  const epoch2 = /* @__PURE__ */ new Date(0);
   return {
     isFile: true,
     isDirectory: false,
     isSymbolicLink: false,
     size: bytes.length,
     mode: S_IFREG3 | 420,
-    mtime: epoch,
-    atime: epoch,
-    ctime: epoch,
+    mtime: epoch2,
+    atime: epoch2,
+    ctime: epoch2,
     ino: inodeOf(path),
     nlink: 1,
     uid: 0,
@@ -14048,11 +14051,11 @@ var HeldPaths = class extends Map {
   handlesAt(path) {
     return [...this.handles].filter(([, key]) => key === path).map(([id2]) => id2);
   }
-  doubt(over, exact = false) {
+  doubt(over, exact2 = false) {
     if (this.bound.size === 0) return;
     for (const [handle, key] of this.handles) {
       if (!this.bound.has(handle) || this.keptHandles.has(handle)) continue;
-      if (exact ? key === over : within7(key, over)) this.doubted.set(handle, ++this.doubts);
+      if (exact2 ? key === over : within7(key, over)) this.doubted.set(handle, ++this.doubts);
     }
   }
   boundIno(handle) {
@@ -17907,8 +17910,8 @@ function refused2(engine, session, err, opening2) {
   const code = verifyCode(flags2);
   if (code && flags2 !== -1)
     return new KernelError("EPROTO", `${code}: ${engine.verifyInfo(flags2).trim()}`);
-  const record2 = recordRefusal(opening2);
-  if (record2) return record2;
+  const record3 = recordRefusal(opening2);
+  if (record3) return record3;
   const text = err instanceof TlsError ? err.message : String(err);
   return new KernelError("EPROTO", `ERR_SSL_HANDSHAKE_FAILURE: ${text}${alertOf(session)}`);
 }
@@ -19023,6 +19026,120 @@ var SessionScrubs = class {
   }
 };
 
+// src/kernel/sealed-oauth.ts
+var SEALED_OAUTH_TIMEOUT_MS = 45e3;
+var SEALED_OAUTH_OPS = /* @__PURE__ */ new Set([
+  "oauthGrant",
+  "oauthStatus",
+  "oauthRefresh",
+  "oauthRemove"
+]);
+var MESSAGES = {
+  EINVAL: "Invalid OAuth request",
+  ENOENT: "OAuth credential not found",
+  EEXIST: "OAuth credential identity conflicts",
+  EACCES: "OAuth operation refused",
+  EAGAIN: "OAuth credential changed; try again",
+  ENOTSUP: "OAuth operation is not supported",
+  ENOTCONN: "Vault is unavailable",
+  ETIMEDOUT: "Vault request timed out",
+  EIO: "Invalid vault reply"
+};
+var CAUSES = {
+  "vault-locked": "Vault is locked",
+  "oauth-reauth-required": "OAuth sign-in is required",
+  "oauth-refresh-failed": "OAuth refresh failed"
+};
+var COMMON = ["v", "op", "caller"];
+var IDENTITY = [...COMMON, "name", "provider", "account"];
+var GRANT = [...IDENTITY, "accessToken", "refreshToken", "tokenType", "expiresAt", "oauth"];
+var CONFIG = ["tokenUrl", "clientId", "authMethod", "scope", "resource"];
+var UNSUPPORTED = ["auth", "clientSecret", "fields"];
+var STATES2 = /* @__PURE__ */ new Set([
+  "ready",
+  "refreshing",
+  "expired",
+  "reauth-required",
+  "removed",
+  "locked"
+]);
+var NAME3 = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+var PROVIDER = /^[a-z0-9][a-z0-9-]{0,127}$/;
+var PLACEHOLDER2 = /^fnox_proxy_[0-9a-f]{24}$/;
+var CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+function record(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function keys(value2, allowed) {
+  return Object.keys(value2).every((key) => allowed.includes(key));
+}
+function exact(value2, fields) {
+  return Object.keys(value2).length === fields.length && keys(value2, fields);
+}
+function nonempty(value2) {
+  return typeof value2 === "string" && value2.length > 0;
+}
+function epoch(value2) {
+  return typeof value2 === "number" && Number.isSafeInteger(value2) && value2 >= 0;
+}
+function sealedOAuthOperation(op) {
+  return op === "capabilities" || SEALED_OAUTH_OPS.has(op);
+}
+function validateSealedOAuth(req) {
+  const config = req.oauth;
+  if (UNSUPPORTED.some((key) => Object.hasOwn(req, key)) || record(config) && UNSUPPORTED.some((key) => Object.hasOwn(config, key)))
+    throw new KernelError("ENOTSUP");
+  const allowed = req.op === "capabilities" ? COMMON : req.op === "oauthGrant" ? GRANT : IDENTITY;
+  if (!keys(req, allowed)) throw new KernelError("EINVAL");
+  if (req.op === "capabilities") return;
+  if (typeof req.name !== "string" || !NAME3.test(req.name) || typeof req.provider !== "string" || !PROVIDER.test(req.provider) || !nonempty(req.account) || req.account.length > 256 || CONTROL.test(req.account))
+    throw new KernelError("EINVAL");
+  if (req.op !== "oauthGrant") return;
+  if (!nonempty(req.accessToken) || req.refreshToken !== void 0 && !nonempty(req.refreshToken) || req.tokenType !== void 0 && typeof req.tokenType !== "string" || req.expiresAt !== void 0 && !epoch(req.expiresAt) || !record(config) || !keys(config, CONFIG) || !nonempty(config.tokenUrl) || !nonempty(config.clientId) || typeof config.authMethod !== "string" || config.scope !== void 0 && typeof config.scope !== "string" || config.resource !== void 0 && !nonempty(config.resource))
+    throw new KernelError("EINVAL");
+  if (config.authMethod !== "none" || typeof req.tokenType === "string" && req.tokenType.toLowerCase() !== "bearer")
+    throw new KernelError("ENOTSUP");
+}
+function sealedOAuthError(code = "EIO", cause) {
+  return {
+    v: 1,
+    error: { code, ...cause ? { cause } : {}, message: cause ? CAUSES[cause] : MESSAGES[code] }
+  };
+}
+function sealedOAuthReply(op, value2) {
+  try {
+    return checkedReply(op, value2) ?? sealedOAuthError();
+  } catch {
+    return sealedOAuthError();
+  }
+}
+function checkedError(value2) {
+  const error = value2.error;
+  if (!exact(value2, ["v", "error"]) || !record(error) || !Object.hasOwn(error, "code") || !Object.hasOwn(error, "message"))
+    return void 0;
+  const { code, cause, message: message3 } = error;
+  if (!keys(error, ["code", "cause", "message"]) || typeof code !== "string" || !Object.hasOwn(MESSAGES, code) || typeof message3 !== "string" || cause !== void 0 && (typeof cause !== "string" || !Object.hasOwn(CAUSES, cause)))
+    return void 0;
+  return sealedOAuthError(code, cause);
+}
+function checkedReply(op, value2) {
+  if (!record(value2) || !Object.hasOwn(value2, "v") || value2.v !== 1) return void 0;
+  if (Object.hasOwn(value2, "error")) return checkedError(value2);
+  if (op === "capabilities") {
+    const caps = value2.capabilities;
+    if (!exact(value2, ["v", "capabilities"]) || !record(caps) || !keys(caps, ["kernelOAuth"]))
+      return void 0;
+    if (Object.hasOwn(caps, "kernelOAuth") && caps.kernelOAuth !== 1) return void 0;
+    return { v: 1, capabilities: Object.hasOwn(caps, "kernelOAuth") ? { kernelOAuth: 1 } : {} };
+  }
+  if (op === "oauthRemove")
+    return exact(value2, ["v", "removed"]) && value2.removed === true ? { v: 1, removed: true } : void 0;
+  const { placeholder, state, expiresAt, refreshable } = value2;
+  if (!exact(value2, ["v", "placeholder", "state", "expiresAt", "refreshable"]) || typeof placeholder !== "string" || !PLACEHOLDER2.test(placeholder) || typeof state !== "string" || !STATES2.has(state) || expiresAt !== null && !epoch(expiresAt) || typeof refreshable !== "boolean")
+    return void 0;
+  return { v: 1, placeholder, state, expiresAt, refreshable };
+}
+
 // src/kernel/sealed-session.ts
 var SESSION_WINDOW_MS = 6e4;
 var SESSION_PLACEHOLDERS = 16;
@@ -19133,8 +19250,8 @@ function sessionValues(reply, asked) {
   const { error, values } = reply;
   if (error !== void 0 || typeof values !== "object" || values === null) return void 0;
   const out = {};
-  const keys = Object.keys(values);
-  const wanted = asked ?? (keys.length === 1 && SESSION_PLACEHOLDER.test(keys[0]) ? keys : []);
+  const keys2 = Object.keys(values);
+  const wanted = asked ?? (keys2.length === 1 && SESSION_PLACEHOLDER.test(keys2[0]) ? keys2 : []);
   for (const ph of wanted) {
     const value2 = values[ph];
     if (typeof value2 === "string" && value2.length > 0 && !UNSAFE.test(value2)) out[ph] = value2;
@@ -19158,7 +19275,9 @@ var SEALED_OPS = /* @__PURE__ */ new Set([
   "request",
   "status",
   "cancel",
-  "materialize"
+  "materialize",
+  "capabilities",
+  ...SEALED_OAUTH_OPS
 ]);
 function tagFields(tags) {
   const [tag] = tags ?? [];
@@ -19193,6 +19312,7 @@ function parseSealed(bytes) {
       throw new KernelError("EINVAL");
     if (req.op === "materialize" && !materializable(req)) throw new KernelError("EINVAL");
     if (req.op === "ask" && !askable(req)) throw new KernelError("EINVAL");
+    if (sealedOAuthOperation(req.op)) validateSealedOAuth(req);
     return req;
   } finally {
     bytes.fill(0);
@@ -19271,7 +19391,7 @@ var SealedChannel = class {
     const ask = fields.op === "ask";
     const timer = setTimeout(
       () => control.abort(ask ? "expired" : "timeout"),
-      ask ? this.broker.askTimeoutMs : this.broker.timeoutMs
+      ask ? this.broker.askTimeoutMs : SEALED_OAUTH_OPS.has(fields.op) ? this.broker.oauthTimeoutMs : this.broker.timeoutMs
     );
     const req = { ...fields, v: 1, op: fields.op, caller };
     const asked = ask ? this.asking(fields, caller, requester, control.signal) : void 0;
@@ -19294,24 +19414,26 @@ var SealedChannel = class {
     if (!facts) return errorReply("EIO", "the kernel has no record of this process");
     return this.answer(askRequest(fields, caller, facts), signal);
   }
-  stopped(signal) {
+  stopped(signal, oauth = false) {
     if (signal.reason === "timeout")
-      return errorReply("ETIMEDOUT", "the vault did not answer within 10 s");
+      return oauth ? sealedOAuthError("ETIMEDOUT") : errorReply("ETIMEDOUT", "the vault did not answer within 10 s");
     return signal.reason === "expired" ? { v: 1, state: "expired" } : void 0;
   }
   async answer(req, signal) {
     const hook = this.broker.hook;
-    if (!hook) return errorReply("ENOTCONN", "no vault is connected");
+    const oauth = sealedOAuthOperation(req.op);
+    if (!hook)
+      return oauth ? sealedOAuthError("ENOTCONN") : errorReply("ENOTCONN", "no vault is connected");
     const stopped = new Promise((resolve2) => {
       signal.addEventListener("abort", () => resolve2(void 0), { once: true });
     });
     if (signal.aborted) return void 0;
     const asked = Promise.resolve().then(() => hook(req, { signal })).then(
-      (reply2) => isRecord(reply2) ? reply2 : errorReply("EIO", "the vault gave no reply"),
-      (err) => errorReply("EIO", lineOf3(err))
+      (reply2) => oauth ? sealedOAuthReply(req.op, reply2) : isRecord(reply2) ? reply2 : errorReply("EIO", "the vault gave no reply"),
+      (err) => oauth ? sealedOAuthError() : errorReply("EIO", lineOf3(err))
     );
     const reply = await Promise.race([asked, stopped]);
-    return signal.aborted ? this.stopped(signal) : reply;
+    return signal.aborted ? this.stopped(signal, oauth) : reply;
   }
   drop() {
     this.reply?.fill(0);
@@ -19374,6 +19496,7 @@ var SealedBroker = class {
   tickets = new TicketBook();
   sessions = new SessionScrubs();
   askTimeoutMs = SEALED_ASK_TIMEOUT_MS;
+  oauthTimeoutMs = SEALED_OAUTH_TIMEOUT_MS;
   userOf = async () => void 0;
   factsOf = async () => void 0;
   constructor(hook, users, timeoutMs = SEALED_TIMEOUT_MS, tagOf = () => void 0) {
@@ -19494,7 +19617,7 @@ var Timestamps = class {
 // src/sudoers.ts
 var SUDOERS = "/etc/sudoers";
 var SUDOERS_D = "/etc/sudoers.d";
-var NAME3 = /^[a-z_][a-z0-9_.-]*$/;
+var NAME4 = /^[a-z_][a-z0-9_.-]*$/;
 var WORD = String.raw`(?:'[^']*'|"(?:[^"\\]|\\[\s\S])*"|\\[\s\S]|[^\s'"\\])+`;
 var KERNEL_FORM = new RegExp(
   String.raw`^(NOPASSWD\s+)?(\S+)\s+(?:\(([^()]*)\)\s+)?(?:Cwd\s+(${WORD})\s+)?(?:Stdin\s+(\S+)\s+)?Cmnd(?:\s+(.*))?$`
@@ -19504,7 +19627,7 @@ var RUNAS = /^\(([^()]*)\)\s*/;
 var TAG = /^([A-Z_]+)\s*:\s*/;
 var OPTION = /^([A-Z_]+)=/;
 var PLAIN2 = /^[A-Za-z0-9_@%+=:,./-]+$/;
-var CONTROL = /[\p{Cc}\u2028\u2029]/u;
+var CONTROL2 = /[\p{Cc}\u2028\u2029]/u;
 var CONTROLS = /[\p{Cc}\u2028\u2029]/gu;
 var SHOWN_MAX = 60;
 var KERNEL_SYNTAX = "[NOPASSWD] <user|%group|ALL> [(<target>)] [Cwd <dir>] [Stdin none] Cmnd <command\u2026|*>";
@@ -19513,7 +19636,7 @@ var EXPECTED = `expected '${KERNEL_SYNTAX}' or '${SUDOERS_SYNTAX}'`;
 var TIMESTAMP_TIMEOUT = 5;
 var TIMESTAMP_TYPE = "tty";
 function hasControl(text) {
-  return CONTROL.test(text);
+  return CONTROL2.test(text);
 }
 function withoutControl(text) {
   return text.replace(CONTROLS, (ch) => {
@@ -19651,7 +19774,7 @@ function commandText(cmnd) {
 }
 function validWho(who) {
   if (who === "ALL") return true;
-  return NAME3.test(who.startsWith("%") ? who.slice(1) : who);
+  return NAME4.test(who.startsWith("%") ? who.slice(1) : who);
 }
 function whoError(who) {
   if (validWho(who)) return void 0;
@@ -19684,7 +19807,7 @@ function kernelRules(m) {
   const [, nopasswd, who = "", target = "root", dir, stdin, rest2 = ""] = m;
   const bad = whoError(who);
   if (bad !== void 0) return bad;
-  if (target !== "ALL" && !NAME3.test(target)) return targetError(target);
+  if (target !== "ALL" && !NAME4.test(target)) return targetError(target);
   const cwd = dir === void 0 ? void 0 : cwdOf(dir);
   if (cwd === "") return `Cwd expects one absolute directory, not ${shown(dir)}`;
   if (stdin !== void 0 && stdin !== "none") return `Stdin takes none, not ${shown(stdin)}`;
@@ -19708,11 +19831,11 @@ function runasOf(list) {
     return colon < 0 ? "() names no user to run as: name one, or leave the (\u2026) out for root" : `(${list}) runs as the caller with another group, which the kernel's sudo can't do`;
   }
   for (const name2 of names2) {
-    if (name2 === "ALL" || NAME3.test(name2)) continue;
+    if (name2 === "ALL" || NAME4.test(name2)) continue;
     return `expected user names or ALL to run as, not ${shown(name2)} (no %group, #uid or !user)`;
   }
   for (const group of groups) {
-    if (group === "" || group === "ALL" || NAME3.test(group)) continue;
+    if (group === "" || group === "ALL" || NAME4.test(group)) continue;
     return `expected group names or ALL after ':' in (\u2026), not ${shown(group)}`;
   }
   return names2.includes("ALL") ? ["ALL"] : [...new Set(names2)];
@@ -19801,7 +19924,7 @@ function directiveError(text) {
 }
 function recordedBare(line, file, rule) {
   if (rule.cmnd === "*" || rule.cmnd.args !== void 0 || !rule.nopasswd) return false;
-  if (file !== `${SUDOERS_D}/${rule.who}` || !NAME3.test(rule.who) || !NAME3.test(rule.target)) {
+  if (file !== `${SUDOERS_D}/${rule.who}` || !NAME4.test(rule.who) || !NAME4.test(rule.target)) {
     return false;
   }
   const head = `NOPASSWD ${rule.who} (${rule.target}) `;
@@ -20501,7 +20624,7 @@ ${lines2}
   async remember(self, target, cwd, argv) {
     const { fs } = this.o;
     const path = `${SUDOERS_D}/${self.name}`;
-    if (!NAME3.test(self.name)) return false;
+    if (!NAME4.test(self.name)) return false;
     try {
       await this.provision();
       if (!await this.trusted(SUDOERS_D)) return false;
@@ -21870,8 +21993,8 @@ function sameCert(a, b) {
   if (!a || !b) return a === b;
   return a.cert.length === b.cert.length && a.cert.every((byte, i) => byte === b.cert[i]);
 }
-function winner(current, expected, record2) {
-  return sameCert(current, expected) ? record2 : current;
+function winner(current, expected, record3) {
+  return sameCert(current, expected) ? record3 : current;
 }
 var DAY = 24 * 60 * 60 * 1e3;
 var CA_LIFETIME = 3650 * DAY;
@@ -21904,15 +22027,15 @@ function indexedDbCaStore(dbName = "slicc-realm-ca") {
       const store = (await open2()).transaction("ca").objectStore("ca");
       return await request2(store.get(owner));
     },
-    async swap(owner, expected, record2) {
+    async swap(owner, expected, record3) {
       const tx = (await open2()).transaction("ca", "readwrite");
       const store = tx.objectStore("ca");
-      let stored2 = record2;
+      let stored2 = record3;
       const read = store.get(owner);
       read.onsuccess = () => {
         const current = read.result;
-        const kept = winner(current, expected, record2);
-        if (kept === record2) store.put(record2, owner);
+        const kept = winner(current, expected, record3);
+        if (kept === record3) store.put(record3, owner);
         else stored2 = kept;
       };
       await new Promise((resolve2, reject) => {
@@ -21932,14 +22055,14 @@ function validLeafName(host) {
 }
 var RealmCa = class _RealmCa {
   record;
-  constructor(record2) {
-    this.record = record2;
+  constructor(record3) {
+    this.record = record3;
   }
   static async open(owner, store, now = Date.now()) {
     const stored2 = await store.get(owner).catch(() => void 0);
     if (stored2 && stored2.notAfter - now > CA_RENEW_BEFORE) return new _RealmCa(stored2);
-    const record2 = await _RealmCa.create(owner, now);
-    return new _RealmCa(await store.swap(owner, stored2, record2));
+    const record3 = await _RealmCa.create(owner, now);
+    return new _RealmCa(await store.swap(owner, stored2, record3));
   }
   static async create(owner, now) {
     const pair = await crypto.subtle.generateKey(ECDSA, false, ["sign", "verify"]);
@@ -22166,8 +22289,8 @@ function memoryCaStore() {
   const records = /* @__PURE__ */ new Map();
   return {
     get: async (owner) => records.get(owner),
-    swap: async (owner, expected, record2) => {
-      const kept = winner(records.get(owner), expected, record2);
+    swap: async (owner, expected, record3) => {
+      const kept = winner(records.get(owner), expected, record3);
       records.set(owner, kept);
       return kept;
     }
@@ -22570,6 +22693,9 @@ var HttpHandles = class {
     if (e instanceof PlaceholderRefused) {
       return { ok: false, errno: e.code, message: text, detail: "placeholder" };
     }
+    if (e.detail === FORBIDDEN_HEADER) {
+      return { ok: false, errno: "ENOTSUP", message: text, detail: FORBIDDEN_HEADER };
+    }
     const status = e.status;
     if (text === NO_TRANSPORT || typeof status !== "number" || status === 502) {
       const code = codeOf2(e);
@@ -30416,7 +30542,7 @@ function header2(id2, flags2, counts) {
 function opt() {
   return [0, 0, TYPE_OPT, UDP_EDNS >> 8, UDP_EDNS & 255, 0, 0, 0, 0, 0, 0];
 }
-function record(type, rdata) {
+function record2(type, rdata) {
   const ttl = DNS_STUB_TTL;
   return [
     192,
@@ -30524,14 +30650,14 @@ var DnsStub = class {
       const address = reverseAddress(q.name);
       const name2 = address !== void 0 ? await this.reverse(address) : void 0;
       if (name2 !== void 0)
-        return answerReply(query, q, NOERROR, [record(TYPE_PTR, encodeName(name2))], true);
+        return answerReply(query, q, NOERROR, [record2(TYPE_PTR, encodeName(name2))], true);
       return this.forward(query, q);
     }
     if (q.type === TYPE_A || q.type === TYPE_AAAA) {
       const addresses = q.name === "" ? [] : await this.lookup(q.name);
       const answers2 = addresses.flatMap((a) => {
         const data = addressData(a, q.type);
-        return data ? [record(q.type, data)] : [];
+        return data ? [record2(q.type, data)] : [];
       });
       if (answers2.length > 0 || local(q.name) || await this.known(q.name)) {
         const rcode = addresses.length > 0 ? NOERROR : NXDOMAIN;
@@ -30720,7 +30846,7 @@ var TransportError = class extends Error {
     super(message3);
     this.status = status;
     this.code = code;
-    this.detail = detail === "transport" ? detail : void 0;
+    this.detail = detail === "transport" || detail === FORBIDDEN_HEADER ? detail : void 0;
   }
 };
 function unfollowed2(redirect) {
@@ -34516,8 +34642,8 @@ var Launcher = class {
     const caller = this.jobs.shown(ppid);
     const named = typeof req.argv0 === "string" && !planned.script && !planned.target.fixed;
     const argv = named ? [req.argv0, ...req.argv.slice(1)] : req.argv;
-    const exact = booked?.pid === caller && req.file === booked.path && await physicalPathAsync(this.base, req.cwd) === booked.cwd && await argvDigest(argv) === booked.argv;
-    if (!exact) throw new SpawnError("EACCES");
+    const exact2 = booked?.pid === caller && req.file === booked.path && await physicalPathAsync(this.base, req.cwd) === booked.cwd && await argvDigest(argv) === booked.argv;
+    if (!exact2) throw new SpawnError("EACCES");
     const { requested: path, requestedCwd: cwd, path: resolved2 } = booked;
     const pid = this.nextPid++;
     const ids = { pid: req.exec ? caller : pid, ppid: caller };
@@ -35880,9 +36006,9 @@ var Launcher = class {
   }
   pnpmReady() {
     if (this.pnpmMade !== void 0) return this.pnpmMade;
-    const epoch = this.pnpmEpoch;
+    const epoch2 = this.pnpmEpoch;
     const made2 = this.base.mkdir(this.pnpmHome, { recursive: true }).then(() => this.owners ? this.stampLayout() : void 0).catch(() => {
-      if (this.pnpmEpoch === epoch) this.pnpmMade = void 0;
+      if (this.pnpmEpoch === epoch2) this.pnpmMade = void 0;
     });
     this.pnpmMade = made2;
     return made2;