@ai-ecoverse/slicc-kernel 1.19.0 → 1.20.1

package/dist/kernel-worker.js

@@ -225,7 +225,7 @@ function pinScript(url) {
 }
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 3];
+var PROTOCOL = [1, 4];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -280,1232 +280,1638 @@ function inodeOf(path) {
   return 4294967296 * (2097151 & h2) + (h1 >>> 0) || 1;
 }
 
-// src/kernel/signals.ts
-var SIG = {
-  HUP: 1,
-  INT: 2,
-  QUIT: 3,
-  ILL: 4,
-  TRAP: 5,
-  ABRT: 6,
-  BUS: 7,
-  FPE: 8,
-  KILL: 9,
-  USR1: 10,
-  SEGV: 11,
-  USR2: 12,
-  PIPE: 13,
-  ALRM: 14,
-  TERM: 15,
-  STKFLT: 16,
-  CHLD: 17,
-  CONT: 18,
-  STOP: 19,
-  TSTP: 20,
-  TTIN: 21,
-  TTOU: 22,
-  URG: 23,
-  XCPU: 24,
-  XFSZ: 25,
-  VTALRM: 26,
-  PROF: 27,
-  WINCH: 28,
-  POLL: 29,
-  PWR: 30,
-  SYS: 31
-};
-var IGNORED_BY_DEFAULT = /* @__PURE__ */ new Set([SIG.CHLD, SIG.URG, SIG.WINCH]);
-var STOPPING = /* @__PURE__ */ new Set([SIG.STOP, SIG.TSTP, SIG.TTIN, SIG.TTOU]);
-function defaultAction(sig) {
-  if (sig === SIG.CONT) return "continue";
-  if (STOPPING.has(sig)) return "stop";
-  return IGNORED_BY_DEFAULT.has(sig) ? "ignore" : "terminate";
-}
-function isSignal(sig) {
-  return Number.isInteger(sig) && sig >= 1 && sig <= 31;
-}
-function sigbit(sig) {
-  return 1 << sig;
-}
-var SIGNAL_BY_NAME = {
-  SIGINT: SIG.INT,
-  SIGTERM: SIG.TERM,
-  SIGKILL: SIG.KILL,
-  SIGSTOP: SIG.STOP,
-  SIGCONT: SIG.CONT
+// src/kernel/pipe.ts
+var PIPE_CAPACITY = 64 * 1024;
+var PipeError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
 };
-
-// src/body-idle.ts
-var BODY_IDLE_MS = 5 * 60 * 1e3;
-
-// src/transport.ts
-var MAX_REQUEST_BODY = 64 * 1024 * 1024;
-function serveTransport(peer, transport) {
-  const open = /* @__PURE__ */ new Map();
-  const fail = (nid, e) => {
-    open.delete(nid);
-    const { status, code } = e;
-    peer.postMessage({
-      net: "error",
-      nid,
-      message: e instanceof Error ? e.message : String(e),
-      ...typeof status === "number" ? { status } : {},
-      ...typeof code === "string" ? { code } : {}
-    });
-  };
-  const start = async (call) => {
-    const abort = new AbortController();
-    const entry = { abort };
-    open.set(call.nid, entry);
-    try {
-      const response = await transport.fetch({
-        url: call.url,
-        method: call.method,
-        headers: call.headers,
-        ...call.body ? { body: call.body } : {},
-        signal: abort.signal
-      });
-      if (!open.has(call.nid)) {
-        await response.cancel();
-        return;
-      }
-      open.set(call.nid, { abort, body: response.body[Symbol.asyncIterator](), response });
-      peer.postMessage({
-        net: "head",
-        nid: call.nid,
-        status: response.status,
-        statusText: response.statusText,
-        headers: response.headers
-      });
-    } catch (e) {
-      fail(call.nid, e);
-    }
-  };
-  const read = async (nid) => {
-    const body = open.get(nid)?.body;
-    if (!body) return;
-    try {
-      const next = await body.next();
-      if (next.done) {
-        open.delete(nid);
-        peer.postMessage({ net: "end", nid });
-      } else {
-        const bytes = next.value.slice();
-        peer.postMessage({ net: "chunk", nid, bytes }, [bytes.buffer]);
-      }
-    } catch (e) {
-      fail(nid, e);
-    }
-  };
-  const drop = (nid) => {
-    const entry = open.get(nid);
-    open.delete(nid);
-    entry?.abort.abort();
-    void entry?.response?.cancel().catch(() => void 0);
-  };
-  return {
-    answer(call) {
-      if (call.net === "fetch") void start(call);
-      else if (call.net === "read") void read(call.nid);
-      else drop(call.nid);
-    },
-    close() {
-      for (const nid of [...open.keys()]) drop(nid);
-    }
-  };
-}
-
-// src/client/serve-client.ts
-var MAX_LINKS = 40;
-function act(session, req, signal) {
-  if (req.action === "write") session.write(req.bytes);
-  else if (req.action === "resize") session.resize(req.cols, req.rows);
-  else if (req.action === "signal") session.signal(signal(req.signal));
-  else session.close();
-}
-async function realpath(fs, path) {
-  let parts = fs.resolvePath("/", path).split("/").filter(Boolean);
-  let resolved = "";
-  for (let hops = 0; parts.length > 0; ) {
-    const [name2, ...rest] = parts;
-    const next = `${resolved}/${name2}`;
-    if (!(await fs.lstat(next)).isSymbolicLink) {
-      resolved = next;
-      parts = rest;
-      continue;
-    }
-    if (++hops > MAX_LINKS) throw fsError("ELOOP", path);
-    const target = await fs.readlink(next);
-    const base = target.startsWith("/") ? "/" : resolved || "/";
-    parts = [...fs.resolvePath(base, target).split("/").filter(Boolean), ...rest];
-    resolved = "";
+var KernelPipe = class {
+  chunks = [];
+  size = 0;
+  readers = 0;
+  writers = 0;
+  waiters = [];
+  capacity;
+  constructor(capacity = PIPE_CAPACITY) {
+    this.capacity = capacity;
   }
-  return resolved || "/";
-}
-async function fsCall(fs, method, args) {
-  const path = (i) => fs.resolvePath("/", String(args[i]));
-  switch (method) {
-    case "readFile": {
-      const bytes = (await fs.readFileBuffer(path(0))).slice();
-      return { result: bytes, transfer: [bytes.buffer] };
+  get buffered() {
+    return this.size;
+  }
+  get readReady() {
+    return this.size > 0 || this.writers === 0;
+  }
+  get writeReady() {
+    return this.size < this.capacity || this.readers === 0;
+  }
+  get writersGone() {
+    return this.writers === 0;
+  }
+  get readersGone() {
+    return this.readers === 0;
+  }
+  openRead() {
+    this.readers += 1;
+  }
+  openWrite() {
+    this.writers += 1;
+  }
+  closeRead() {
+    if (this.readers > 0) this.readers -= 1;
+    if (this.readers === 0) {
+      this.chunks = [];
+      this.size = 0;
     }
-    case "writeFile":
-      await fs.writeFile(path(0), args[1]);
-      return { result: true };
-    case "stat":
-      return { result: await fs.stat(path(0)) };
-    case "lstat":
-      return { result: await fs.lstat(path(0)) };
-    case "readdir":
-      return { result: await fs.readdir(path(0)) };
-    case "mkdir":
-      await fs.mkdir(path(0), { recursive: true });
-      return { result: true };
-    case "rm":
-      await fs.rm(path(0), { recursive: true, force: args[1] === true });
-      return { result: true };
-    case "rename":
-      await fs.rename(path(0), path(1));
-      return { result: true };
-    case "realpath":
-      return { result: await realpath(fs, String(args[0])) };
-    case "symlink":
-      await fs.symlink(String(args[0]), path(1));
-      return { result: true };
-    case "readlink":
-      return { result: await fs.readlink(path(0)) };
-    default:
-      return { result: await fs.exists(path(0)) };
+    this.wake();
   }
-}
-function signalOf(host) {
-  return host.signal ?? ((name2) => {
-    throw fsError("EINVAL", `this kernel names no signal ${name2}`);
-  });
-}
-function killGroups(host, pgids) {
-  if (pgids.length === 0) return;
-  void host.launcher().then((launcher) => {
-    for (const pgid of pgids) launcher.kill(-pgid, SIG.KILL);
-  });
-}
-function joinable(l, pgid, ours) {
-  const sid = l.groupSession(pgid);
-  if (sid === void 0) throw fsError("ESRCH", `no process group ${pgid}`);
-  if (!ours(sid)) throw fsError("EPERM", `process group ${pgid} is in another session`);
-}
-function serveClient(port, host) {
-  let state = "new";
-  const terminals = /* @__PURE__ */ new Map();
-  const groups = /* @__PURE__ */ new Set();
-  const sessions = /* @__PURE__ */ new Set();
-  const watches = /* @__PURE__ */ new Map();
-  let net;
-  const ended = Promise.withResolvers();
-  const send = (message2, transfer = []) => {
-    if (state !== "closed") port.postMessage(message2, transfer);
-  };
-  const reply = (id, body, transfer) => send({ id, ...body }, transfer);
-  function detach(kill = false, bye = "the slicc-kernel detached this client") {
-    if (state === "closed") return;
-    send({ bye });
-    state = "closed";
-    net?.close();
-    for (const unwatch of watches.values()) unwatch();
-    watches.clear();
-    for (const session of terminals.values()) session.close();
-    terminals.clear();
-    if (kill) killGroups(host, [...groups]);
-    groups.clear();
-    port.close?.();
-    ended.resolve();
+  closeWrite() {
+    if (this.writers > 0) this.writers -= 1;
+    this.wake();
   }
-  async function hello(message2) {
-    const refused = versionError(message2.protocol);
-    if (refused) {
-      send({ hello: { protocol: PROTOCOL, error: refused } });
-      detach();
-      return;
+  async read(max, signal) {
+    while (this.size === 0) {
+      if (this.writers === 0) return new Uint8Array(0);
+      await this.changed(signal);
     }
-    const launcher = await host.launcher();
-    const transport = host.transport?.() ?? launcher.transport;
-    net = serveTransport({ postMessage: (m, t) => send(m, t) }, transport);
-    state = "open";
-    if (message2.lock && host.locks) void host.locks.request(message2.lock, () => detach());
-    send({
-      hello: {
-        protocol: PROTOCOL,
-        traits: transport.traits,
-        ...host.lock ? { lock: host.lock } : {}
-      }
-    });
+    const out = this.take(Math.min(max, this.size));
+    this.wake();
+    return out;
   }
-  async function terminal(req, l) {
-    const session = await l.openTerminal(req.argv, {
-      ...req.options,
-      onData: (bytes) => reply(req.id, { fd: 1, bytes: bytes.slice() })
-    });
-    if (state === "closed") {
-      session.close();
-    } else {
-      terminals.set(req.id, session);
-      sessions.add(session.pid);
-      reply(req.id, { started: session.pid });
+  async peek(max, signal) {
+    while (this.size === 0) {
+      if (this.writers === 0) return new Uint8Array(0);
+      await this.changed(signal);
     }
-    try {
-      return { result: await session.exited };
-    } finally {
-      terminals.delete(req.id);
+    const out = new Uint8Array(Math.min(max, this.size));
+    let filled = 0;
+    for (const chunk2 of this.chunks) {
+      if (filled === out.length) break;
+      const count = Math.min(chunk2.length, out.length - filled);
+      out.set(chunk2.subarray(0, count), filled);
+      filled += count;
     }
+    return out;
   }
-  async function spawn(req, l) {
-    const out = (fd) => (bytes) => reply(req.id, { fd, bytes: bytes.slice() });
-    if (req.options.pgid !== void 0) joinable(l, req.options.pgid, (sid) => sessions.has(sid));
-    let leader;
-    const result = await l.run(req.argv, {
-      ...req.options,
-      collect: false,
-      onStdout: out(1),
-      onStderr: out(2),
-      onStarted: (pid) => {
-        leader = pid;
-        if (state === "closed") return;
-        groups.add(req.options.pgid ?? pid);
-        if (req.options.pgid === void 0) sessions.add(pid);
-        reply(req.id, { started: pid });
-      }
-    });
-    if (leader === void 0) throw fsError("ENOENT", `${req.argv[0] ?? ""}: command not found`);
-    if (!l.list().some((p) => p.pgid === leader)) groups.delete(leader);
-    return { result: result.status };
-  }
-  async function handle(req) {
-    if (host.scope === "transport" && req.op !== "detach") {
-      throw fsError("EPERM", `${req.op}: this client may only use the network transport`);
-    }
-    const l = await host.launcher();
-    switch (req.op) {
-      case "spawn":
-        return spawn(req, l);
-      case "open-terminal":
-        return terminal(req, l);
-      case "terminal": {
-        const session = terminals.get(req.terminal);
-        if (!session) throw new Error(`no terminal ${req.terminal}`);
-        act(session, req, signalOf(host));
-        return { result: true };
-      }
-      case "kill":
-        if (!l.kill(req.pid, signalOf(host)(req.signal))) throw fsError("ESRCH", `pid ${req.pid}`);
-        return { result: true };
-      case "ps":
-        return {
-          result: l.list().map(({ tid: _, ...entry }) => entry)
-        };
-      case "fs":
-        if (!FS_METHODS.includes(req.method)) {
-          throw new Error(`unknown file system call ${req.method}`);
+  async write(bytes, signal) {
+    let offset = 0;
+    while (offset < bytes.length) {
+      if (this.readers === 0) throw new PipeError("EPIPE");
+      const room = this.capacity - this.size;
+      if (room === 0) {
+        try {
+          await this.changed(signal);
+        } catch (e) {
+          if (offset > 0) return offset;
+          throw e;
         }
-        return fsCall(l.fs, req.method, req.args);
-      case "watch": {
-        const unwatch = l.watchers.watch(
-          req.paths,
-          { recursive: req.recursive },
-          (change) => send({ watch: req.id, change })
-        );
-        watches.set(req.id, unwatch);
-        return { result: req.id };
+        continue;
       }
-      case "unwatch":
-        watches.get(req.watch)?.();
-        watches.delete(req.watch);
-        return { result: true };
-      case "mount":
-        return { result: await l.mount(req.spec) };
-      case "umount":
-        l.umount(req.target);
-        return { result: true };
-      case "mounts":
-        return { result: l.mounts.list() };
-      case "detach":
-        return { result: true };
-      default:
-        throw new Error(`unknown op ${req.op}`);
+      const n = Math.min(room, bytes.length - offset);
+      this.chunks.push(bytes.slice(offset, offset + n));
+      this.size += n;
+      offset += n;
+      this.wake();
     }
+    return bytes.length;
   }
-  port.addEventListener("message", (event) => {
-    const data = event.data;
-    if (state === "closed") return;
-    if (data.hello) {
-      if (state === "new") {
-        hello(data.hello).catch((err) => {
-          send({ hello: { protocol: PROTOCOL, error: String(err?.message ?? err) } });
-          detach();
-        });
-      }
-      return;
-    }
-    if (state !== "open") return;
-    if (data.net !== void 0) {
-      net?.answer(data);
-      return;
-    }
-    const req = data;
-    handle(req).then(
-      ({ result, transfer }) => {
-        reply(req.id, { result }, transfer);
-        if (req.op === "detach") detach(req.kill === true);
-      },
-      (err) => {
-        const code = err?.code;
-        reply(req.id, {
-          error: err instanceof Error ? err.message : String(err),
-          ...typeof code === "string" ? { code } : {}
-        });
-      }
-    );
-  });
-  port.addEventListener("close", () => detach());
-  port.start?.();
-  return { detach, closed: ended.promise };
-}
+  take(n) {
+    const out = new Uint8Array(n);
+    let filled = 0;
+    while (filled < n) {
+      const head = this.chunks[0];
+      const count = Math.min(head.length, n - filled);
+      out.set(head.subarray(0, count), filled);
+      filled += count;
+      if (count === head.length) this.chunks.shift();
+      else this.chunks[0] = head.subarray(count);
+    }
+    this.size -= n;
+    return out;
+  }
+  changed(signal) {
+    if (signal?.aborted) return Promise.reject(new PipeError("EINTR"));
+    return new Promise((resolve, reject) => {
+      const onAbort = () => {
+        this.waiters = this.waiters.filter((w) => w !== waiter);
+        reject(new PipeError("EINTR"));
+      };
+      const waiter = () => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve();
+      };
+      this.waiters.push(waiter);
+      signal?.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  wake() {
+    const waiters = this.waiters;
+    this.waiters = [];
+    for (const resolve of waiters) resolve();
+  }
+};
 
-// src/fs/opfs.ts
-var S_IFDIR = 16384;
-var S_IFREG = 32768;
-var S_IFLNK = 40960;
-var PERM_MASK = 4095;
-var READ_ATTEMPTS = 3;
-var MAX_LINKS2 = 40;
-var CHECK_MS = 1e3;
-var EXECUTABLE = /\/node_modules\/(?:@[^/]+\/)?[^/]+\/bin\//;
-var ERRNO_BY_DOM_ERROR = {
-  NotFoundError: "ENOENT",
-  TypeMismatchError: "ENOTDIR",
-  InvalidModificationError: "ENOTEMPTY",
-  NoModificationAllowedError: "EBUSY",
-  TypeError: "EINVAL",
-  NotAllowedError: "EACCES"
+// src/kernel/fd-table.ts
+var KernelError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
 };
-function translate(err, path) {
-  if (typeof err?.code === "string") return err;
-  const name2 = err?.name;
-  return fsError(typeof name2 === "string" && ERRNO_BY_DOM_ERROR[name2] || "EIO", path);
+function pollFile(file) {
+  return file.poll?.() ?? { readable: !!file.read, writable: !!file.write, hangup: false };
 }
-function missing(err) {
-  const code = err?.code;
-  return code === "ENOENT" || code === "ENOTDIR";
+var OpenFile = class {
+  refs = 1;
+  file;
+  constructor(file) {
+    this.file = file;
+  }
+  retain() {
+    this.refs += 1;
+    return this;
+  }
+  release() {
+    this.refs -= 1;
+    if (this.refs === 0) return this.file.close();
+  }
+};
+function openPipe(capacity) {
+  const pipe = new KernelPipe(capacity);
+  pipe.openRead();
+  pipe.openWrite();
+  return {
+    read: new OpenFile({
+      read: async (max, signal) => {
+        try {
+          return await pipe.read(max, signal);
+        } catch (e) {
+          throw new KernelError(e.code);
+        }
+      },
+      close: () => pipe.closeRead(),
+      poll: () => ({ readable: pipe.readReady, writable: false, hangup: pipe.writersGone }),
+      changed: (signal) => pipe.changed(signal)
+    }),
+    write: new OpenFile({
+      write: async (bytes, signal) => {
+        try {
+          return await pipe.write(bytes, signal);
+        } catch (e) {
+          throw new KernelError(e.code);
+        }
+      },
+      close: () => pipe.closeWrite(),
+      poll: () => ({ readable: false, writable: pipe.writeReady, hangup: pipe.readersGone }),
+      changed: (signal) => pipe.changed(signal)
+    })
+  };
 }
-function split(path) {
-  return path.split("/").filter(Boolean);
+function bytesSource(data) {
+  let offset = 0;
+  return new OpenFile({
+    read: async (max) => {
+      const out = data.subarray(offset, offset + max);
+      offset += out.length;
+      return out;
+    },
+    close: () => {
+    }
+  });
 }
-function parentOf2(path) {
-  return path.slice(0, path.lastIndexOf("/")) || "/";
+function sinkFile(onData) {
+  return new OpenFile({
+    write: async (bytes) => {
+      onData(bytes.slice());
+      return bytes.length;
+    },
+    close: () => {
+    }
+  });
 }
-function baseOf(path) {
-  return path.slice(path.lastIndexOf("/") + 1);
+function nullFile() {
+  return new OpenFile({
+    read: async () => new Uint8Array(0),
+    write: async (bytes) => bytes.length,
+    close: () => {
+    }
+  });
 }
-function prefixes(path) {
-  const parts = split(path);
-  return parts.map((_, i) => `/${parts.slice(0, i + 1).join("/")}`);
+function deviceFile(device, access) {
+  const read = async (max) => {
+    if (device === "null") return new Uint8Array(0);
+    const out = new Uint8Array(max);
+    if (device === "urandom") {
+      for (let at = 0; at < max; at += 65536) {
+        crypto.getRandomValues(out.subarray(at, Math.min(max, at + 65536)));
+      }
+    }
+    return out;
+  };
+  return new OpenFile({
+    ...access !== "write" ? { read } : {},
+    ...access !== "read" ? { write: async (bytes) => bytes.length } : {},
+    seek: async () => 0,
+    heldMeta: { device, ...access ? { access } : {} },
+    close: () => {
+    }
+  });
 }
-function within(path, root) {
-  return path === root || path.startsWith(`${root}/`);
+function heldFile(meta) {
+  return new OpenFile({ held: true, ...meta ? { heldMeta: meta } : {}, close: () => {
+  } });
 }
-function isHandle(child) {
-  return "kind" in child;
+function kernelFdKind(file) {
+  if (file.held) return "held";
+  if (file.heldMeta && "device" in file.heldMeta) return "device";
+  if (file.tty) return "tty";
+  return file.seek ? "file" : "stream";
 }
-var OpfsFs = class {
-  root;
-  meta;
-  dirs = /* @__PURE__ */ new Map();
-  checked = /* @__PURE__ */ new WeakMap();
-  channel;
-  constructor(root, meta = new MemoryMeta(), channel) {
-    this.root = root;
-    this.meta = meta;
-    this.channel = channel === void 0 ? void 0 : new BroadcastChannel(channel);
-    if (this.channel) {
-      this.channel.onmessage = ({ data }) => {
-        for (const path of data) this.forget(path);
-      };
-      this.channel.unref?.();
+var FdTable = class _FdTable {
+  static MAX_FDS = 1024;
+  fds = /* @__PURE__ */ new Map();
+  cloexec = /* @__PURE__ */ new Set();
+  status = /* @__PURE__ */ new Map();
+  get(fd) {
+    const file = this.fds.get(fd);
+    if (!file) throw new KernelError("EBADF");
+    return file;
+  }
+  stdioTerminal() {
+    for (const fd of [0, 1, 2]) {
+      const tty = this.fds.get(fd)?.file.tty;
+      if (tty) return tty;
+    }
+    return void 0;
+  }
+  numbers() {
+    return [...this.fds.keys()].sort((a, b) => a - b);
+  }
+  has(fd) {
+    return this.fds.has(fd);
+  }
+  setCloseOnExec(fd) {
+    this.get(fd);
+    this.cloexec.add(fd);
+  }
+  clearCloseOnExec(fd) {
+    this.get(fd);
+    this.cloexec.delete(fd);
+  }
+  closesOnExec(fd) {
+    return this.cloexec.has(fd);
+  }
+  setStatusFlags(fd, flags) {
+    this.get(fd);
+    this.status.set(fd, flags);
+  }
+  statusFlags(fd) {
+    return this.status.get(fd);
+  }
+  install(file, min = 0) {
+    for (let fd = min; fd < _FdTable.MAX_FDS; fd++) {
+      if (!this.fds.has(fd)) {
+        this.fds.set(fd, file);
+        return fd;
+      }
+    }
+    void Promise.resolve(file.release()).catch(() => void 0);
+    throw new KernelError("EMFILE");
+  }
+  installAt(fd, file) {
+    if (fd < 0 || fd >= _FdTable.MAX_FDS) {
+      void Promise.resolve(file.release()).catch(() => void 0);
+      throw new KernelError("EBADF");
     }
+    const previous = this.fds.get(fd);
+    this.fds.set(fd, file);
+    this.cloexec.delete(fd);
+    this.status.delete(fd);
+    void Promise.resolve(previous?.release()).catch(() => void 0);
+  }
+  dup(fd, min = 0) {
+    return this.install(this.get(fd).retain(), min);
+  }
+  dup2(oldFd, newFd) {
+    const file = this.get(oldFd);
+    if (oldFd !== newFd) this.installAt(newFd, file.retain());
+    return newFd;
   }
-  changed(...paths) {
-    for (const path of paths) this.forget(path);
-    this.channel?.postMessage(paths);
+  close(fd) {
+    const file = this.get(fd);
+    this.fds.delete(fd);
+    this.cloexec.delete(fd);
+    this.status.delete(fd);
+    return file.release();
   }
-  resolvePath(base, path) {
-    return resolvePath(base, path);
+  fork() {
+    const child = new _FdTable();
+    for (const [fd, file] of this.fds) child.fds.set(fd, file.retain());
+    for (const fd of this.cloexec) child.cloexec.add(fd);
+    for (const [fd, flags] of this.status) child.status.set(fd, flags);
+    return child;
   }
-  async walk(parts, from, start) {
-    let dir = start;
-    for (let at = from; at < parts.length; at++) {
-      dir = await dir.getDirectoryHandle(parts[at]);
-      this.dirs.set(`/${parts.slice(0, at + 1).join("/")}`, dir);
-      this.checked.set(dir, performance.now());
-    }
-    return dir;
+  async closeAll() {
+    const files = [...this.fds.values()];
+    this.fds.clear();
+    this.cloexec.clear();
+    this.status.clear();
+    await Promise.allSettled(files.map((file) => Promise.resolve().then(() => file.release())));
   }
-  async dir(path) {
-    const parts = split(path);
-    let from = parts.length;
-    let cached;
-    for (; from > 0 && !cached; from--)
-      cached = this.dirs.get(`/${parts.slice(0, from).join("/")}`);
-    if (cached) from++;
-    const at = `/${parts.slice(0, from).join("/")}`;
-    if (cached && !await this.current(at, cached)) {
-      this.forget(at);
-      cached = void 0;
-      from = 0;
-    }
-    try {
-      return await this.walk(parts, from, cached ?? this.root);
-    } catch (err) {
-      throw translate(err, path);
-    }
+};
+
+// src/kernel/socket.ts
+var SOMAXCONN = 4096;
+var EPHEMERAL_FIRST = 32768;
+var EPHEMERAL_LAST = 60999;
+var SOL_SOCKET = 1;
+var SO_TYPE = 3;
+var SO_ERROR = 4;
+var SO_SNDBUF = 7;
+var SO_RCVBUF = 8;
+var SO_ACCEPTCONN = 30;
+var SO_DOMAIN = 39;
+var SOCK_STREAM = 1;
+var AF_UNIX = 1;
+var AF_INET = 2;
+var SHUT_RD = 0;
+var SHUT_WR = 1;
+var SHUT_RDWR = 2;
+function isLoopback(host) {
+  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+async function pipeCall(op) {
+  try {
+    return await op();
+  } catch (e) {
+    if (e instanceof PipeError) throw new KernelError(e.code);
+    throw e;
   }
-  async current(path, dir) {
-    if (performance.now() - (this.checked.get(dir) ?? -CHECK_MS) < CHECK_MS) return true;
-    const where = await this.root.resolve(dir).catch(() => null);
-    if (where === null || `/${where.join("/")}` !== path) return false;
-    this.checked.set(dir, performance.now());
-    return true;
+}
+var Changes = class {
+  waiters = [];
+  wait(signal) {
+    if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
+    return new Promise((resolve, reject) => {
+      const onAbort = () => {
+        this.waiters = this.waiters.filter((w) => w !== waiter);
+        reject(new KernelError("EINTR"));
+      };
+      const waiter = () => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve();
+      };
+      this.waiters.push(waiter);
+      signal?.addEventListener("abort", onAbort, { once: true });
+    });
   }
-  forget(path) {
-    for (const key of [...this.dirs.keys()]) if (within(key, path)) this.dirs.delete(key);
+  wake() {
+    const waiters = this.waiters;
+    this.waiters = [];
+    for (const resolve of waiters) resolve();
   }
-  async inDir(path, op) {
-    const dir = await this.dir(path);
-    try {
-      return await op(dir);
-    } catch (err) {
-      if (err?.name !== "NotFoundError" || await this.current(path, dir))
-        throw err;
-      this.forget(path);
-      return op(await this.dir(path));
-    }
+};
+function link(a, b) {
+  const ab = new KernelPipe();
+  const ba = new KernelPipe();
+  for (const pipe of [ab, ba]) {
+    pipe.openRead();
+    pipe.openWrite();
   }
-  async child(parent, name2, kind) {
-    return kind === "file" ? parent.getFileHandle(name2) : parent.getDirectoryHandle(name2);
+  a.attach({ rx: ba, tx: ab });
+  b.attach({ rx: ab, tx: ba });
+}
+var KernelSocket = class _KernelSocket {
+  net;
+  domain;
+  state = "open";
+  local;
+  peer;
+  link;
+  readShut = false;
+  writeShut = false;
+  queue = [];
+  backlog = 0;
+  bound = false;
+  changes = new Changes();
+  options = /* @__PURE__ */ new Map();
+  constructor(net, domain) {
+    this.net = net;
+    this.domain = domain;
   }
-  async parent(path) {
-    const parts = split(path);
-    const name2 = parts.pop();
-    if (name2 === void 0) throw fsError("EBUSY", path);
-    return [`/${parts.join("/")}`, name2];
+  attach(link2) {
+    this.link = link2;
+    this.state = "connected";
+    this.changes.wake();
   }
-  async handle(path) {
-    if (split(path).length === 0) return this.root;
-    const [dir, name2] = await this.parent(path);
-    const known = this.dirs.has(path);
-    return this.inDir(dir, async (parent) => {
-      const [first, second] = known ? ["directory", "file"] : ["file", "directory"];
-      try {
-        return await this.child(parent, name2, first);
-      } catch (err) {
-        if (err?.name !== "TypeMismatchError") throw err;
-      }
-      return this.child(parent, name2, second);
-    }).catch((err) => {
-      throw translate(err, path);
-    });
+  get listening() {
+    return this.state === "listening";
   }
-  real(path) {
-    return this.handle(path).then(
-      () => true,
-      () => false
-    );
+  connection() {
+    if (!this.link || this.state !== "connected") throw new KernelError("ENOTCONN");
+    return this.link;
   }
-  async linkAlong(path) {
-    for (const entry of await this.meta.get(prefixes(path))) {
-      if (entry?.link === void 0) continue;
-      if (!await this.real(entry.path) && await this.real(parentOf2(entry.path))) return entry;
-    }
-    return void 0;
+  async read(max, signal) {
+    const { rx } = this.connection();
+    if (this.readShut || max <= 0) return new Uint8Array(0);
+    return pipeCall(() => rx.read(max, signal));
   }
-  async locate(path, follow) {
-    let current = path;
-    for (let hops = 0; hops <= MAX_LINKS2; hops++) {
-      try {
-        return { path: current, handle: await this.handle(current) };
-      } catch (err) {
-        if (!missing(err)) throw err;
-        const link2 = await this.linkAlong(current);
-        if (!link2) throw err;
-        if (link2.path === current && !follow) return { path: current, link: link2 };
-        const rest = current.slice(link2.path.length);
-        current = resolvePath(parentOf2(link2.path), `${link2.link}${rest}`);
-      }
-    }
-    throw fsError("ELOOP", path);
+  async peek(max, signal) {
+    const { rx } = this.connection();
+    if (this.readShut || max <= 0) return new Uint8Array(0);
+    return pipeCall(() => rx.peek(max, signal));
   }
-  mode(path, directory, meta) {
-    const fallback = directory || EXECUTABLE.test(path) ? 493 : 420;
-    return (directory ? S_IFDIR : S_IFREG) | (meta?.mode ?? fallback);
+  async write(bytes, signal) {
+    const { tx } = this.connection();
+    if (this.writeShut) throw new KernelError("EPIPE");
+    return pipeCall(() => tx.write(bytes, signal));
   }
-  async statOf(path, handle, meta) {
-    const directory = handle.kind === "directory";
-    const file = directory ? void 0 : await handle.getFile();
-    const modified = file?.lastModified ?? 0;
-    const mtime = meta?.mtimeMs !== void 0 && meta.mtimeFor === modified ? meta.mtimeMs : modified;
+  poll() {
+    if (this.state === "listening") {
+      return { readable: this.queue.length > 0, writable: false, hangup: false };
+    }
+    if (this.state !== "connected" || !this.link) {
+      return { readable: false, writable: false, hangup: true };
+    }
+    const { rx, tx } = this.link;
     return {
-      isFile: !directory,
-      isDirectory: directory,
-      isSymbolicLink: false,
-      size: file?.size ?? 0,
-      mode: this.mode(path, directory, meta),
-      mtime: new Date(mtime),
-      atime: new Date(meta?.atimeMs ?? mtime),
-      ctime: new Date(Math.max(meta?.ctimeMs ?? mtime, modified)),
-      ino: meta?.ino ?? inodeOf(path)
+      readable: this.readShut || rx.readReady,
+      writable: this.writeShut || tx.writeReady,
+      hangup: rx.writersGone && tx.readersGone
     };
   }
-  linkStat(entry) {
-    const time2 = new Date(entry.mtimeMs ?? 0);
-    return {
-      isFile: false,
-      isDirectory: false,
-      isSymbolicLink: true,
-      size: new TextEncoder().encode(entry.link).length,
-      mode: S_IFLNK | 511,
-      mtime: time2,
-      atime: time2,
-      ctime: new Date(entry.ctimeMs ?? 0),
-      ino: entry.ino ?? inodeOf(entry.path)
-    };
+  changed(signal) {
+    const own = this.changes.wait(signal);
+    if (this.state !== "connected" || !this.link) return own;
+    const waits = [own, this.link.rx.changed(signal), this.link.tx.changed(signal)];
+    for (const wait of waits) wait.catch(() => void 0);
+    return pipeCall(() => Promise.race(waits));
   }
-  async describe(found) {
-    if (found.link) return this.linkStat(found.link);
-    const [meta] = await this.meta.get([found.path]);
-    return this.statOf(found.path, found.handle, meta);
+  bind(addr) {
+    if (this.state !== "open" || this.local) throw new KernelError("EINVAL");
+    if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
+    this.local = this.net.bind(this, addr);
+    this.bound = true;
   }
-  async stat(path) {
-    return this.describe(await this.locate(path, true));
+  listen(backlog) {
+    if (this.state === "connected") throw new KernelError("EISCONN");
+    if (this.state !== "open" && this.state !== "listening") throw new KernelError("EINVAL");
+    if (!this.local) {
+      if (this.domain === "unix") throw new KernelError("EINVAL");
+      this.bind({ family: "inet", host: "0.0.0.0", port: 0 });
+    }
+    this.backlog = Math.min(Math.max(backlog, 1), SOMAXCONN);
+    this.state = "listening";
   }
-  async lstat(path) {
-    return this.describe(await this.locate(path, false));
+  async accept(signal, nonblock = false) {
+    for (; ; ) {
+      if (this.state !== "listening") throw new KernelError("EINVAL");
+      const next = this.queue.shift();
+      if (next) return next;
+      if (nonblock) throw new KernelError("EAGAIN");
+      await this.changes.wait(signal);
+    }
   }
-  async exists(path) {
-    return this.locate(path, true).then(
-      () => true,
-      () => false
-    );
+  offer(server) {
+    if (this.state !== "listening" || this.queue.length >= this.backlog) return false;
+    this.queue.push(server);
+    this.changes.wake();
+    return true;
   }
-  async readFileBuffer(path) {
-    const handle = (await this.locate(path, true)).handle;
-    if (handle.kind === "directory") throw fsError("EISDIR", path);
-    for (let attempt = 1; ; attempt++) {
-      try {
-        return new Uint8Array(await (await handle.getFile()).arrayBuffer());
-      } catch (err) {
-        if (err?.name !== "NotReadableError" || attempt >= READ_ATTEMPTS) {
-          throw translate(err, path);
-        }
-        await new Promise((resolve) => setTimeout(resolve, attempt * 10));
-      }
+  connect(addr) {
+    if (this.state === "connected") throw new KernelError("EISCONN");
+    if (this.state !== "open") throw new KernelError("EINVAL");
+    if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
+    const target = this.net.target(addr);
+    if (!this.local) {
+      if (addr.family === "inet") {
+        this.local = this.net.bind(this, { family: "inet", host: "127.0.0.1", port: 0 });
+        this.bound = true;
+      } else this.local = { family: "unix", path: "" };
+    }
+    const server = new _KernelSocket(this.net, this.domain);
+    server.local = addr.family === "inet" ? { ...addr, host: canonicalHost(addr.host) } : addr;
+    server.peer = this.local;
+    this.peer = server.local;
+    link(this, server);
+    if (!target.offer(server)) {
+      this.unlink();
+      server.close();
+      throw new KernelError("ECONNREFUSED");
     }
   }
-  async readFile(path) {
-    return new TextDecoder().decode(await this.readFileBuffer(path));
+  unlink() {
+    const link2 = this.link;
+    if (link2) {
+      link2.rx.closeRead();
+      link2.tx.closeWrite();
+    }
+    this.link = void 0;
+    this.peer = void 0;
+    this.state = "open";
   }
-  async writeTarget(path) {
-    try {
-      return [(await this.locate(path, true)).path, true];
-    } catch (err) {
-      if (!missing(err)) throw err;
+  shutdown(how) {
+    const { rx, tx } = this.connection();
+    if (how !== SHUT_RD && how !== SHUT_WR && how !== SHUT_RDWR) throw new KernelError("EINVAL");
+    if (how !== SHUT_WR && !this.readShut) {
+      this.readShut = true;
+      rx.closeRead();
     }
-    const [entry] = await this.meta.get([path]);
-    const wanted = entry?.link === void 0 ? path : resolvePath(parentOf2(path), entry.link);
-    return [resolvePath((await this.locate(parentOf2(wanted), true)).path, baseOf(wanted)), false];
+    if (how !== SHUT_RD && !this.writeShut) {
+      this.writeShut = true;
+      tx.closeWrite();
+    }
+    this.changes.wake();
   }
-  async writeFile(path, content) {
-    const [target, existed] = await this.writeTarget(path);
-    const [dir, name2] = await this.parent(target);
-    let file;
-    try {
-      file = await this.inDir(dir, (parent) => parent.getFileHandle(name2, { create: true }));
-    } catch (err) {
-      const code = err?.name === "TypeMismatchError" ? "EISDIR" : null;
-      throw code ? fsError(code, path) : translate(err, path);
+  getOption(level, name2) {
+    if (level === SOL_SOCKET) {
+      switch (name2) {
+        case SO_TYPE:
+          return SOCK_STREAM;
+        case SO_ERROR:
+          return 0;
+        case SO_ACCEPTCONN:
+          return this.state === "listening" ? 1 : 0;
+        case SO_DOMAIN:
+          return this.domain === "inet" ? AF_INET : AF_UNIX;
+        case SO_SNDBUF:
+        case SO_RCVBUF:
+          return this.options.get(`${level}:${name2}`) ?? PIPE_CAPACITY;
+      }
     }
-    if (!existed && content.length === 0) return;
-    const writable = await file.createWritable();
-    await writable.write(content);
-    await writable.close();
+    return this.options.get(`${level}:${name2}`) ?? 0;
   }
-  async listing(path) {
-    const found = await this.locate(path, true);
-    const handle = found.handle;
-    if (handle.kind !== "directory") throw fsError("ENOTDIR", path);
-    const children2 = /* @__PURE__ */ new Map();
-    for await (const child of handle.values()) children2.set(child.name, child);
-    for (const link2 of await this.meta.links(found.path)) {
-      const name2 = baseOf(link2.path);
-      if (!children2.has(name2)) children2.set(name2, link2);
+  setOption(level, name2, value) {
+    this.options.set(`${level}:${name2}`, value);
+  }
+  close() {
+    const was = this.state;
+    this.state = "closed";
+    if (was === "listening") {
+      for (const pending of this.queue.splice(0)) pending.close();
     }
-    return [found.path, [...children2].sort(([a], [b]) => a < b ? -1 : 1)];
+    if (this.link) {
+      if (!this.readShut) this.link.rx.closeRead();
+      if (!this.writeShut) this.link.tx.closeWrite();
+      this.readShut = true;
+      this.writeShut = true;
+    }
+    if (this.bound && this.local) this.net.release(this.local, this);
+    this.bound = false;
+    this.changes.wake();
   }
-  async readdir(path) {
-    return (await this.listing(path))[1].map(([name2]) => name2);
+  static pair(net, domain) {
+    const a = new _KernelSocket(net, domain);
+    const b = new _KernelSocket(net, domain);
+    const name2 = domain === "inet" ? { family: "inet", host: "127.0.0.1", port: 0 } : { family: "unix", path: "" };
+    a.local = b.local = a.peer = b.peer = name2;
+    link(a, b);
+    return [a, b];
   }
-  async readdirStat(path) {
-    const [dir, children2] = await this.listing(path);
-    const base = dir === "/" ? "" : dir;
-    const metas = await this.meta.get(children2.map(([name2]) => `${base}/${name2}`));
-    return Promise.all(
-      children2.map(async ([name2, child], i) => {
-        if (!isHandle(child)) return [name2, this.linkStat(child)];
-        const stat = await this.statOf(`${base}/${name2}`, child, metas[i]).catch(() => null);
-        return [name2, stat];
-      })
-    );
+};
+function canonicalHost(host) {
+  return host === "0.0.0.0" ? "127.0.0.1" : host;
+}
+function keyOf(addr) {
+  return addr.family === "inet" ? `inet:${addr.port}` : `unix:${addr.path}`;
+}
+var LoopbackNet = class {
+  bound = /* @__PURE__ */ new Map();
+  activators = /* @__PURE__ */ new Map();
+  nextEphemeral = EPHEMERAL_FIRST;
+  activate(addr, start) {
+    this.activators.set(keyOf(addr), start);
   }
-  async mkdir(path, options = {}) {
-    let found;
-    try {
-      found = await this.locate(path, true);
-    } catch (err) {
-      if (!missing(err)) throw err;
+  socket(domain) {
+    return new KernelSocket(this, domain);
+  }
+  listen(addr, backlog = 128) {
+    const socket = this.socket(addr.family);
+    socket.bind(addr);
+    socket.listen(backlog);
+    return socket;
+  }
+  connect(addr) {
+    const socket = this.socket(addr.family);
+    socket.connect(addr);
+    return socket;
+  }
+  bind(socket, addr) {
+    if (addr.family === "unix") {
+      if (addr.path === "") throw new KernelError("EINVAL");
+    } else if (addr.host !== "0.0.0.0" && !isLoopback(addr.host)) {
+      throw new KernelError("EADDRNOTAVAIL");
     }
-    if (found) {
-      const directory = found.handle?.kind === "directory";
-      if (options.recursive && directory) return;
-      throw fsError(options.recursive ? "ENOTDIR" : "EEXIST", path);
+    const named = addr.family === "inet" && addr.port === 0 ? { ...addr, port: this.ephemeral() } : addr;
+    const key = keyOf(named);
+    if (this.bound.has(key)) throw new KernelError("EADDRINUSE");
+    this.bound.set(key, socket);
+    return named;
+  }
+  release(addr, socket) {
+    const key = keyOf(addr);
+    if (this.bound.get(key) === socket) this.bound.delete(key);
+  }
+  target(addr) {
+    if (addr.family === "inet" && !isLoopback(canonicalHost(addr.host))) {
+      throw new KernelError("ENETUNREACH");
     }
-    const [entry] = await this.meta.get([path]);
-    if (entry?.link !== void 0) throw fsError("EEXIST", path);
-    if (options.recursive) await this.mkdir(parentOf2(path), options);
-    const parent = await this.locate(parentOf2(path), true);
-    if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
-    await parent.handle.getDirectoryHandle(baseOf(path), { create: true });
+    const key = keyOf(addr);
+    if (!this.bound.has(key)) this.activators.get(key)?.();
+    const socket = this.bound.get(key);
+    if (!socket?.listening) throw new KernelError("ECONNREFUSED");
+    return socket;
   }
-  async rm(path, options = {}) {
-    let found;
-    try {
-      found = await this.locate(path, false);
-    } catch (err) {
-      const error = translate(err, path);
-      if (options.force && error.code === "ENOENT") return;
-      throw error;
+  ephemeral() {
+    const span = EPHEMERAL_LAST - EPHEMERAL_FIRST + 1;
+    for (let i = 0; i < span; i++) {
+      const port = this.nextEphemeral;
+      this.nextEphemeral = port === EPHEMERAL_LAST ? EPHEMERAL_FIRST : port + 1;
+      if (!this.bound.has(`inet:${port}`)) return port;
     }
-    if (found.handle) {
-      const [dir, name2] = await this.parent(found.path);
+    throw new KernelError("EADDRINUSE");
+  }
+};
+
+// src/kernel/dial.ts
+var CHUNK = 64 * 1024;
+var LOOPBACK_NAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+function dialSocket(net, port, host = "127.0.0.1") {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new KernelError("EINVAL");
+  const target = LOOPBACK_NAMES.has(host.toLowerCase()) ? "127.0.0.1" : host;
+  return net.connect({ family: "inet", host: target, port });
+}
+var codeOf = (err) => {
+  const code = err?.code;
+  return typeof code === "string" ? code : "EIO";
+};
+function serveSocket(socket, port, onClose) {
+  let closed = false;
+  let writes = Promise.resolve();
+  let credit = 0;
+  let granted2;
+  const send = (message2, transfer) => {
+    if (!closed) port.postMessage(message2, transfer);
+  };
+  const close = (reset = false) => {
+    if (closed) return;
+    if (reset) send({ error: "ECONNRESET" });
+    closed = true;
+    granted2?.();
+    socket.close();
+    port.close();
+    onClose?.();
+  };
+  const write = (data) => {
+    writes = writes.then(async () => {
+      if (closed) return;
       try {
-        await this.inDir(
-          dir,
-          (parent) => parent.removeEntry(name2, { recursive: options.recursive === true })
-        );
+        await socket.write(data);
+        send({ ack: true });
       } catch (err) {
-        throw translate(err, path);
+        send({ error: codeOf(err) });
       }
-      this.changed(found.path);
+    });
+  };
+  port.addEventListener("message", ({ data }) => {
+    if (data instanceof Uint8Array) write(data);
+    else if ("more" in data) {
+      credit++;
+      granted2?.();
+    } else if ("end" in data) {
+      writes = writes.then(() => {
+        if (!closed) socket.shutdown(SHUT_WR);
+      });
+    } else if ("close" in data) close();
+  });
+  port.start?.();
+  const turn = () => credit > 0 || closed ? Promise.resolve() : new Promise((r) => granted2 = r);
+  void (async () => {
+    try {
+      for (; ; ) {
+        await turn();
+        if (closed) return;
+        const chunk2 = await socket.read(CHUNK);
+        if (chunk2.length === 0) break;
+        credit--;
+        send(chunk2, [chunk2.buffer]);
+      }
+      send({ end: true });
+    } catch (err) {
+      send({ error: codeOf(err) });
     }
-    await this.meta.remove([found.path]);
-  }
-  async rename(from, to) {
-    if (from === to) return;
-    const source = await this.locate(from, false);
-    this.forget(source.path);
-    const parent = await this.locate(parentOf2(to), true);
-    const destination = resolvePath(parent.path, baseOf(to));
-    const sourceStat = await this.describe(source);
-    if (sourceStat.isDirectory && within(destination, source.path)) throw fsError("EINVAL", to);
-    const target = await this.locate(destination, false).catch((err) => {
-      if (missing(err)) return null;
-      throw err;
+  })();
+  return () => close(true);
+}
+
+// src/kernel/signals.ts
+var SIG = {
+  HUP: 1,
+  INT: 2,
+  QUIT: 3,
+  ILL: 4,
+  TRAP: 5,
+  ABRT: 6,
+  BUS: 7,
+  FPE: 8,
+  KILL: 9,
+  USR1: 10,
+  SEGV: 11,
+  USR2: 12,
+  PIPE: 13,
+  ALRM: 14,
+  TERM: 15,
+  STKFLT: 16,
+  CHLD: 17,
+  CONT: 18,
+  STOP: 19,
+  TSTP: 20,
+  TTIN: 21,
+  TTOU: 22,
+  URG: 23,
+  XCPU: 24,
+  XFSZ: 25,
+  VTALRM: 26,
+  PROF: 27,
+  WINCH: 28,
+  POLL: 29,
+  PWR: 30,
+  SYS: 31
+};
+var IGNORED_BY_DEFAULT = /* @__PURE__ */ new Set([SIG.CHLD, SIG.URG, SIG.WINCH]);
+var STOPPING = /* @__PURE__ */ new Set([SIG.STOP, SIG.TSTP, SIG.TTIN, SIG.TTOU]);
+function defaultAction(sig) {
+  if (sig === SIG.CONT) return "continue";
+  if (STOPPING.has(sig)) return "stop";
+  return IGNORED_BY_DEFAULT.has(sig) ? "ignore" : "terminate";
+}
+function isSignal(sig) {
+  return Number.isInteger(sig) && sig >= 1 && sig <= 31;
+}
+function sigbit(sig) {
+  return 1 << sig;
+}
+var SIGNAL_BY_NAME = {
+  SIGINT: SIG.INT,
+  SIGTERM: SIG.TERM,
+  SIGKILL: SIG.KILL,
+  SIGSTOP: SIG.STOP,
+  SIGCONT: SIG.CONT
+};
+
+// src/body-idle.ts
+var BODY_IDLE_MS = 5 * 60 * 1e3;
+
+// src/transport.ts
+var MAX_REQUEST_BODY = 64 * 1024 * 1024;
+function serveTransport(peer, transport) {
+  const open = /* @__PURE__ */ new Map();
+  const fail = (nid, e) => {
+    open.delete(nid);
+    const { status, code } = e;
+    peer.postMessage({
+      net: "error",
+      nid,
+      message: e instanceof Error ? e.message : String(e),
+      ...typeof status === "number" ? { status } : {},
+      ...typeof code === "string" ? { code } : {}
     });
-    const targetStat = target && await this.describe(target);
-    if (targetStat?.isDirectory && !sourceStat.isDirectory) throw fsError("EISDIR", to);
-    if (targetStat && !targetStat.isDirectory && sourceStat.isDirectory) {
-      throw fsError("ENOTDIR", to);
+  };
+  const start = async (call) => {
+    const abort = new AbortController();
+    const entry = { abort };
+    open.set(call.nid, entry);
+    try {
+      const response = await transport.fetch({
+        url: call.url,
+        method: call.method,
+        headers: call.headers,
+        ...call.body ? { body: call.body } : {},
+        signal: abort.signal
+      });
+      if (!open.has(call.nid)) {
+        await response.cancel();
+        return;
+      }
+      open.set(call.nid, { abort, body: response.body[Symbol.asyncIterator](), response });
+      peer.postMessage({
+        net: "head",
+        nid: call.nid,
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+    } catch (e) {
+      fail(call.nid, e);
     }
-    if (targetStat?.isDirectory && (await this.readdir(destination)).length > 0) {
-      throw fsError("ENOTEMPTY", to);
+  };
+  const read = async (nid) => {
+    const body = open.get(nid)?.body;
+    if (!body) return;
+    try {
+      const next = await body.next();
+      if (next.done) {
+        open.delete(nid);
+        peer.postMessage({ net: "end", nid });
+      } else {
+        const bytes = next.value.slice();
+        peer.postMessage({ net: "chunk", nid, bytes }, [bytes.buffer]);
+      }
+    } catch (e) {
+      fail(nid, e);
     }
-    const now = Date.now();
-    const carry = (entry) => ({
-      ino: inodeOf(source.path),
-      ...entry,
-      path: destination,
-      ctimeMs: now
-    });
-    if (source.link) {
-      if (target?.handle) await this.rm(destination);
-      await this.meta.move(source.path, destination, carry);
-      return;
+  };
+  const drop = (nid) => {
+    const entry = open.get(nid);
+    open.delete(nid);
+    entry?.abort.abort();
+    void entry?.response?.cancel().catch(() => void 0);
+  };
+  return {
+    answer(call) {
+      if (call.net === "fetch") void start(call);
+      else if (call.net === "read") void read(call.nid);
+      else drop(call.nid);
+    },
+    close() {
+      for (const nid of [...open.keys()]) drop(nid);
     }
-    const dir = parent.handle;
-    const name2 = baseOf(destination);
-    const swap = targetStat?.isDirectory === true;
-    const staging = swap ? `.${name2}.${crypto.randomUUID()}` : name2;
-    this.forget(destination);
-    const timed = await this.explicitTimes(source.path);
-    const moved2 = await this.place(source.handle, dir, staging);
-    if (swap) await this.rm(destination, { recursive: true });
-    await this.meta.move(source.path, destination, carry);
-    if (!moved2) await this.rm(source.path, { recursive: true });
-    let copied = !moved2;
-    if (swap) {
-      const staged = await dir.getDirectoryHandle(staging);
-      const placed = await this.place(staged, dir, name2);
-      if (!placed) await dir.removeEntry(staging, { recursive: true });
-      copied ||= !placed;
+  };
+}
+
+// src/client/serve-client.ts
+var MAX_LINKS = 40;
+function act(session, req, signal) {
+  if (req.action === "write") session.write(req.bytes);
+  else if (req.action === "resize") session.resize(req.cols, req.rows);
+  else if (req.action === "signal") session.signal(signal(req.signal));
+  else session.close();
+}
+async function realpath(fs, path) {
+  let parts = fs.resolvePath("/", path).split("/").filter(Boolean);
+  let resolved = "";
+  for (let hops = 0; parts.length > 0; ) {
+    const [name2, ...rest] = parts;
+    const next = `${resolved}/${name2}`;
+    if (!(await fs.lstat(next)).isSymbolicLink) {
+      resolved = next;
+      parts = rest;
+      continue;
     }
-    if (copied) await this.restamp(destination, timed);
-    this.changed(source.path, destination);
+    if (++hops > MAX_LINKS) throw fsError("ELOOP", path);
+    const target = await fs.readlink(next);
+    const base = target.startsWith("/") ? "/" : resolved || "/";
+    parts = [...fs.resolvePath(base, target).split("/").filter(Boolean), ...rest];
+    resolved = "";
+  }
+  return resolved || "/";
+}
+async function fsCall(fs, method, args) {
+  const path = (i) => fs.resolvePath("/", String(args[i]));
+  switch (method) {
+    case "readFile": {
+      const bytes = (await fs.readFileBuffer(path(0))).slice();
+      return { result: bytes, transfer: [bytes.buffer] };
+    }
+    case "writeFile":
+      await fs.writeFile(path(0), args[1]);
+      return { result: true };
+    case "stat":
+      return { result: await fs.stat(path(0)) };
+    case "lstat":
+      return { result: await fs.lstat(path(0)) };
+    case "readdir":
+      return { result: await fs.readdir(path(0)) };
+    case "mkdir":
+      await fs.mkdir(path(0), { recursive: true });
+      return { result: true };
+    case "rm":
+      await fs.rm(path(0), { recursive: true, force: args[1] === true });
+      return { result: true };
+    case "rename":
+      await fs.rename(path(0), path(1));
+      return { result: true };
+    case "realpath":
+      return { result: await realpath(fs, String(args[0])) };
+    case "symlink":
+      await fs.symlink(String(args[0]), path(1));
+      return { result: true };
+    case "readlink":
+      return { result: await fs.readlink(path(0)) };
+    default:
+      return { result: await fs.exists(path(0)) };
   }
-  async modified(path) {
-    const handle = await this.handle(path);
-    return handle.kind === "file" ? (await handle.getFile()).lastModified : 0;
+}
+function signalOf(host) {
+  return host.signal ?? ((name2) => {
+    throw fsError("EINVAL", `this kernel names no signal ${name2}`);
+  });
+}
+function dialFor(l, req, open) {
+  const socket = dialSocket(l.net, req.port, req.host);
+  const { port1, port2 } = new MessageChannel();
+  open.set(
+    req.id,
+    serveSocket(socket, port1, () => open.delete(req.id))
+  );
+  return { result: port2, transfer: [port2] };
+}
+function killGroups(host, pgids) {
+  if (pgids.length === 0) return;
+  void host.launcher().then((launcher) => {
+    for (const pgid of pgids) launcher.kill(-pgid, SIG.KILL);
+  });
+}
+function joinable(l, pgid, ours) {
+  const sid = l.groupSession(pgid);
+  if (sid === void 0) throw fsError("ESRCH", `no process group ${pgid}`);
+  if (!ours(sid)) throw fsError("EPERM", `process group ${pgid} is in another session`);
+}
+function serveClient(port, host) {
+  let state = "new";
+  const terminals = /* @__PURE__ */ new Map();
+  const groups = /* @__PURE__ */ new Set();
+  const sessions = /* @__PURE__ */ new Set();
+  const watches = /* @__PURE__ */ new Map();
+  let net;
+  const ended = Promise.withResolvers();
+  const send = (message2, transfer = []) => {
+    if (state !== "closed") port.postMessage(message2, transfer);
+  };
+  const reply = (id, body, transfer) => send({ id, ...body }, transfer);
+  function detach(kill = false, bye = "the slicc-kernel detached this client") {
+    if (state === "closed") return;
+    send({ bye });
+    state = "closed";
+    net?.close();
+    for (const unwatch of watches.values()) unwatch();
+    watches.clear();
+    for (const session of terminals.values()) session.close();
+    terminals.clear();
+    if (kill) killGroups(host, [...groups]);
+    groups.clear();
+    port.close?.();
+    ended.resolve();
   }
-  async explicitTimes(path) {
-    const timed = [];
-    for (const entry of await this.meta.under(path)) {
-      if (entry.mtimeFor === void 0 || entry.link !== void 0) continue;
-      const current = await this.modified(entry.path).catch(() => void 0);
-      if (current === entry.mtimeFor) timed.push(entry.path.slice(path.length));
+  async function hello(message2) {
+    const refused = versionError(message2.protocol);
+    if (refused) {
+      send({ hello: { protocol: PROTOCOL, error: refused } });
+      detach();
+      return;
     }
-    return timed;
+    const launcher = await host.launcher();
+    const transport = host.transport?.() ?? launcher.transport;
+    net = serveTransport({ postMessage: (m, t) => send(m, t) }, transport);
+    state = "open";
+    if (message2.lock && host.locks) void host.locks.request(message2.lock, () => detach());
+    send({
+      hello: {
+        protocol: PROTOCOL,
+        traits: transport.traits,
+        ...host.lock ? { lock: host.lock } : {}
+      }
+    });
   }
-  async restamp(path, timed) {
-    for (const rest of timed) {
-      const mtimeFor = await this.modified(path + rest);
-      await this.meta.update(path + rest, (entry) => entry && { ...entry, mtimeFor });
+  async function terminal(req, l) {
+    const session = await l.openTerminal(req.argv, {
+      ...req.options,
+      onData: (bytes) => reply(req.id, { fd: 1, bytes: bytes.slice() })
+    });
+    if (state === "closed") {
+      session.close();
+    } else {
+      terminals.set(req.id, session);
+      sessions.add(session.pid);
+      reply(req.id, { started: session.pid });
     }
-  }
-  async place(handle, dir, name2) {
-    const moved2 = await handle.move?.(dir, name2).then(
-      () => true,
-      () => false
-    );
-    if (moved2) return true;
     try {
-      await this.copy(handle, dir, name2);
-    } catch (err) {
-      if (handle.kind === "directory") await dir.removeEntry(name2, { recursive: true });
-      throw translate(err, name2);
+      return { result: await session.exited };
+    } finally {
+      terminals.delete(req.id);
     }
-    return false;
   }
-  async copy(handle, dir, name2) {
-    if (handle.kind === "file") {
-      const writable = await (await dir.getFileHandle(name2, { create: true })).createWritable();
-      await writable.write(await handle.getFile());
-      await writable.close();
-      return;
-    }
-    const target = await dir.getDirectoryHandle(name2, { create: true });
-    for await (const child of handle.values()) await this.copy(child, target, child.name);
+  async function spawn(req, l) {
+    const out = (fd) => (bytes) => reply(req.id, { fd, bytes: bytes.slice() });
+    if (req.options.pgid !== void 0) joinable(l, req.options.pgid, (sid) => sessions.has(sid));
+    let leader;
+    const result = await l.run(req.argv, {
+      ...req.options,
+      collect: false,
+      onStdout: out(1),
+      onStderr: out(2),
+      onStarted: (pid) => {
+        leader = pid;
+        if (state === "closed") return;
+        groups.add(req.options.pgid ?? pid);
+        if (req.options.pgid === void 0) sessions.add(pid);
+        reply(req.id, { started: pid });
+      }
+    });
+    if (leader === void 0) throw fsError("ENOENT", `${req.argv[0] ?? ""}: command not found`);
+    if (!l.list().some((p) => p.pgid === leader)) groups.delete(leader);
+    return { result: result.status };
   }
-  async symlink(target, path) {
-    const parent = await this.locate(parentOf2(path), true);
-    if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
-    const at = resolvePath(parent.path, baseOf(path));
-    if (await this.locate(at, false).then(
-      () => true,
-      (err) => !missing(err)
-    )) {
-      throw fsError("EEXIST", path);
+  async function handle(req) {
+    if (host.scope === "transport" && req.op !== "detach") {
+      throw fsError("EPERM", `${req.op}: this client may only use the network transport`);
     }
-    const now = Date.now();
-    await this.meta.update(at, () => ({
-      path: at,
-      link: target,
-      dir: parent.path,
-      ino: inodeOf(at),
-      mtimeMs: now,
-      ctimeMs: now
-    }));
-  }
-  async readlink(path) {
-    const found = await this.locate(path, false);
-    if (found.link) return found.link.link;
-    throw fsError("EINVAL", path);
-  }
-  async chmod(path, mode) {
-    const found = await this.locate(path, true);
-    const ctimeMs = Date.now();
-    await this.meta.update(found.path, (entry) => ({
-      ...entry,
-      path: found.path,
-      mode: mode & PERM_MASK,
-      ctimeMs
-    }));
-  }
-  async utimes(path, atime, mtime) {
-    const found = await this.locate(path, true);
-    const handle = found.handle;
-    const file = handle.kind === "file" ? await handle.getFile() : void 0;
-    const ctimeMs = Date.now();
-    await this.meta.update(found.path, (entry) => ({
-      ...entry,
-      path: found.path,
-      atimeMs: atime.getTime(),
-      mtimeMs: mtime.getTime(),
-      mtimeFor: file?.lastModified ?? 0,
-      ctimeMs
-    }));
-  }
-  async reconcile() {
-    let removed = 0;
-    for (const entry of await this.meta.all()) {
-      const real = await this.real(entry.path);
-      const stale = entry.link === void 0 ? !real : real || !await this.real(parentOf2(entry.path));
-      if (!stale) continue;
-      await this.meta.update(entry.path, () => void 0);
-      removed++;
+    const l = await host.launcher();
+    switch (req.op) {
+      case "spawn":
+        return spawn(req, l);
+      case "open-terminal":
+        return terminal(req, l);
+      case "terminal": {
+        const session = terminals.get(req.terminal);
+        if (!session) throw new Error(`no terminal ${req.terminal}`);
+        act(session, req, signalOf(host));
+        return { result: true };
+      }
+      case "kill":
+        if (!l.kill(req.pid, signalOf(host)(req.signal))) throw fsError("ESRCH", `pid ${req.pid}`);
+        return { result: true };
+      case "ps":
+        return {
+          result: l.list().map(({ tid: _, ...entry }) => entry)
+        };
+      case "fs":
+        if (!FS_METHODS.includes(req.method)) {
+          throw new Error(`unknown file system call ${req.method}`);
+        }
+        return fsCall(l.fs, req.method, req.args);
+      case "watch": {
+        const unwatch = l.watchers.watch(
+          req.paths,
+          { recursive: req.recursive },
+          (change) => send({ watch: req.id, change })
+        );
+        watches.set(req.id, unwatch);
+        return { result: req.id };
+      }
+      case "unwatch":
+        watches.get(req.watch)?.();
+        watches.delete(req.watch);
+        return { result: true };
+      case "mount":
+        return { result: await l.mount(req.spec) };
+      case "umount":
+        l.umount(req.target);
+        return { result: true };
+      case "mounts":
+        return { result: l.mounts.list() };
+      case "dial":
+        return dialFor(l, req, watches);
+      case "detach":
+        return { result: true };
+      default:
+        throw new Error(`unknown op ${req.op}`);
     }
-    return removed;
   }
-};
+  port.addEventListener("message", (event) => {
+    const data = event.data;
+    if (state === "closed") return;
+    if (data.hello) {
+      if (state === "new") {
+        hello(data.hello).catch((err) => {
+          send({ hello: { protocol: PROTOCOL, error: String(err?.message ?? err) } });
+          detach();
+        });
+      }
+      return;
+    }
+    if (state !== "open") return;
+    if (data.net !== void 0) {
+      net?.answer(data);
+      return;
+    }
+    const req = data;
+    handle(req).then(
+      ({ result, transfer }) => {
+        reply(req.id, { result }, transfer);
+        if (req.op === "detach") detach(req.kill === true);
+      },
+      (err) => {
+        const code = err?.code;
+        reply(req.id, {
+          error: err instanceof Error ? err.message : String(err),
+          ...typeof code === "string" ? { code } : {}
+        });
+      }
+    );
+  });
+  port.addEventListener("close", () => detach());
+  port.start?.();
+  return { detach, closed: ended.promise };
+}
 
-// src/kernel/pipe.ts
-var PIPE_CAPACITY = 64 * 1024;
-var PipeError = class extends Error {
-  code;
-  constructor(code) {
-    super(code);
-    this.code = code;
-  }
+// src/fs/opfs.ts
+var S_IFDIR = 16384;
+var S_IFREG = 32768;
+var S_IFLNK = 40960;
+var PERM_MASK = 4095;
+var READ_ATTEMPTS = 3;
+var MAX_LINKS2 = 40;
+var CHECK_MS = 1e3;
+var EXECUTABLE = /\/node_modules\/(?:@[^/]+\/)?[^/]+\/bin\//;
+var ERRNO_BY_DOM_ERROR = {
+  NotFoundError: "ENOENT",
+  TypeMismatchError: "ENOTDIR",
+  InvalidModificationError: "ENOTEMPTY",
+  NoModificationAllowedError: "EBUSY",
+  TypeError: "EINVAL",
+  NotAllowedError: "EACCES"
 };
-var KernelPipe = class {
-  chunks = [];
-  size = 0;
-  readers = 0;
-  writers = 0;
-  waiters = [];
-  capacity;
-  constructor(capacity = PIPE_CAPACITY) {
-    this.capacity = capacity;
-  }
-  get buffered() {
-    return this.size;
+function translate(err, path) {
+  if (typeof err?.code === "string") return err;
+  const name2 = err?.name;
+  return fsError(typeof name2 === "string" && ERRNO_BY_DOM_ERROR[name2] || "EIO", path);
+}
+function missing(err) {
+  const code = err?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+function split(path) {
+  return path.split("/").filter(Boolean);
+}
+function parentOf2(path) {
+  return path.slice(0, path.lastIndexOf("/")) || "/";
+}
+function baseOf(path) {
+  return path.slice(path.lastIndexOf("/") + 1);
+}
+function prefixes(path) {
+  const parts = split(path);
+  return parts.map((_, i) => `/${parts.slice(0, i + 1).join("/")}`);
+}
+function within(path, root) {
+  return path === root || path.startsWith(`${root}/`);
+}
+function isHandle(child) {
+  return "kind" in child;
+}
+var OpfsFs = class {
+  root;
+  meta;
+  dirs = /* @__PURE__ */ new Map();
+  checked = /* @__PURE__ */ new WeakMap();
+  channel;
+  constructor(root, meta = new MemoryMeta(), channel) {
+    this.root = root;
+    this.meta = meta;
+    this.channel = channel === void 0 ? void 0 : new BroadcastChannel(channel);
+    if (this.channel) {
+      this.channel.onmessage = ({ data }) => {
+        for (const path of data) this.forget(path);
+      };
+      this.channel.unref?.();
+    }
   }
-  get readReady() {
-    return this.size > 0 || this.writers === 0;
+  changed(...paths) {
+    for (const path of paths) this.forget(path);
+    this.channel?.postMessage(paths);
   }
-  get writeReady() {
-    return this.size < this.capacity || this.readers === 0;
+  resolvePath(base, path) {
+    return resolvePath(base, path);
   }
-  get writersGone() {
-    return this.writers === 0;
+  async walk(parts, from, start) {
+    let dir = start;
+    for (let at = from; at < parts.length; at++) {
+      dir = await dir.getDirectoryHandle(parts[at]);
+      this.dirs.set(`/${parts.slice(0, at + 1).join("/")}`, dir);
+      this.checked.set(dir, performance.now());
+    }
+    return dir;
   }
-  get readersGone() {
-    return this.readers === 0;
+  async dir(path) {
+    const parts = split(path);
+    let from = parts.length;
+    let cached;
+    for (; from > 0 && !cached; from--)
+      cached = this.dirs.get(`/${parts.slice(0, from).join("/")}`);
+    if (cached) from++;
+    const at = `/${parts.slice(0, from).join("/")}`;
+    if (cached && !await this.current(at, cached)) {
+      this.forget(at);
+      cached = void 0;
+      from = 0;
+    }
+    try {
+      return await this.walk(parts, from, cached ?? this.root);
+    } catch (err) {
+      throw translate(err, path);
+    }
   }
-  openRead() {
-    this.readers += 1;
+  async current(path, dir) {
+    if (performance.now() - (this.checked.get(dir) ?? -CHECK_MS) < CHECK_MS) return true;
+    const where = await this.root.resolve(dir).catch(() => null);
+    if (where === null || `/${where.join("/")}` !== path) return false;
+    this.checked.set(dir, performance.now());
+    return true;
   }
-  openWrite() {
-    this.writers += 1;
+  forget(path) {
+    for (const key of [...this.dirs.keys()]) if (within(key, path)) this.dirs.delete(key);
   }
-  closeRead() {
-    if (this.readers > 0) this.readers -= 1;
-    if (this.readers === 0) {
-      this.chunks = [];
-      this.size = 0;
+  async inDir(path, op) {
+    const dir = await this.dir(path);
+    try {
+      return await op(dir);
+    } catch (err) {
+      if (err?.name !== "NotFoundError" || await this.current(path, dir))
+        throw err;
+      this.forget(path);
+      return op(await this.dir(path));
     }
-    this.wake();
-  }
-  closeWrite() {
-    if (this.writers > 0) this.writers -= 1;
-    this.wake();
   }
-  async read(max, signal) {
-    while (this.size === 0) {
-      if (this.writers === 0) return new Uint8Array(0);
-      await this.changed(signal);
-    }
-    const out = this.take(Math.min(max, this.size));
-    this.wake();
-    return out;
+  async child(parent, name2, kind) {
+    return kind === "file" ? parent.getFileHandle(name2) : parent.getDirectoryHandle(name2);
   }
-  async peek(max, signal) {
-    while (this.size === 0) {
-      if (this.writers === 0) return new Uint8Array(0);
-      await this.changed(signal);
-    }
-    const out = new Uint8Array(Math.min(max, this.size));
-    let filled = 0;
-    for (const chunk2 of this.chunks) {
-      if (filled === out.length) break;
-      const count = Math.min(chunk2.length, out.length - filled);
-      out.set(chunk2.subarray(0, count), filled);
-      filled += count;
-    }
-    return out;
+  async parent(path) {
+    const parts = split(path);
+    const name2 = parts.pop();
+    if (name2 === void 0) throw fsError("EBUSY", path);
+    return [`/${parts.join("/")}`, name2];
   }
-  async write(bytes, signal) {
-    let offset = 0;
-    while (offset < bytes.length) {
-      if (this.readers === 0) throw new PipeError("EPIPE");
-      const room = this.capacity - this.size;
-      if (room === 0) {
-        try {
-          await this.changed(signal);
-        } catch (e) {
-          if (offset > 0) return offset;
-          throw e;
-        }
-        continue;
+  async handle(path) {
+    if (split(path).length === 0) return this.root;
+    const [dir, name2] = await this.parent(path);
+    const known = this.dirs.has(path);
+    return this.inDir(dir, async (parent) => {
+      const [first, second] = known ? ["directory", "file"] : ["file", "directory"];
+      try {
+        return await this.child(parent, name2, first);
+      } catch (err) {
+        if (err?.name !== "TypeMismatchError") throw err;
       }
-      const n = Math.min(room, bytes.length - offset);
-      this.chunks.push(bytes.slice(offset, offset + n));
-      this.size += n;
-      offset += n;
-      this.wake();
+      return this.child(parent, name2, second);
+    }).catch((err) => {
+      throw translate(err, path);
+    });
+  }
+  real(path) {
+    return this.handle(path).then(
+      () => true,
+      () => false
+    );
+  }
+  async linkAlong(path) {
+    for (const entry of await this.meta.get(prefixes(path))) {
+      if (entry?.link === void 0) continue;
+      if (!await this.real(entry.path) && await this.real(parentOf2(entry.path))) return entry;
     }
-    return bytes.length;
+    return void 0;
   }
-  take(n) {
-    const out = new Uint8Array(n);
-    let filled = 0;
-    while (filled < n) {
-      const head = this.chunks[0];
-      const count = Math.min(head.length, n - filled);
-      out.set(head.subarray(0, count), filled);
-      filled += count;
-      if (count === head.length) this.chunks.shift();
-      else this.chunks[0] = head.subarray(count);
+  async locate(path, follow) {
+    let current = path;
+    for (let hops = 0; hops <= MAX_LINKS2; hops++) {
+      try {
+        return { path: current, handle: await this.handle(current) };
+      } catch (err) {
+        if (!missing(err)) throw err;
+        const link2 = await this.linkAlong(current);
+        if (!link2) throw err;
+        if (link2.path === current && !follow) return { path: current, link: link2 };
+        const rest = current.slice(link2.path.length);
+        current = resolvePath(parentOf2(link2.path), `${link2.link}${rest}`);
+      }
     }
-    this.size -= n;
-    return out;
+    throw fsError("ELOOP", path);
   }
-  changed(signal) {
-    if (signal?.aborted) return Promise.reject(new PipeError("EINTR"));
-    return new Promise((resolve, reject) => {
-      const onAbort = () => {
-        this.waiters = this.waiters.filter((w) => w !== waiter);
-        reject(new PipeError("EINTR"));
-      };
-      const waiter = () => {
-        signal?.removeEventListener("abort", onAbort);
-        resolve();
-      };
-      this.waiters.push(waiter);
-      signal?.addEventListener("abort", onAbort, { once: true });
-    });
+  mode(path, directory, meta) {
+    const fallback = directory || EXECUTABLE.test(path) ? 493 : 420;
+    return (directory ? S_IFDIR : S_IFREG) | (meta?.mode ?? fallback);
   }
-  wake() {
-    const waiters = this.waiters;
-    this.waiters = [];
-    for (const resolve of waiters) resolve();
+  async statOf(path, handle, meta) {
+    const directory = handle.kind === "directory";
+    const file = directory ? void 0 : await handle.getFile();
+    const modified = file?.lastModified ?? 0;
+    const mtime = meta?.mtimeMs !== void 0 && meta.mtimeFor === modified ? meta.mtimeMs : modified;
+    return {
+      isFile: !directory,
+      isDirectory: directory,
+      isSymbolicLink: false,
+      size: file?.size ?? 0,
+      mode: this.mode(path, directory, meta),
+      mtime: new Date(mtime),
+      atime: new Date(meta?.atimeMs ?? mtime),
+      ctime: new Date(Math.max(meta?.ctimeMs ?? mtime, modified)),
+      ino: meta?.ino ?? inodeOf(path)
+    };
   }
-};
-
-// src/kernel/fd-table.ts
-var KernelError = class extends Error {
-  code;
-  constructor(code) {
-    super(code);
-    this.code = code;
+  linkStat(entry) {
+    const time2 = new Date(entry.mtimeMs ?? 0);
+    return {
+      isFile: false,
+      isDirectory: false,
+      isSymbolicLink: true,
+      size: new TextEncoder().encode(entry.link).length,
+      mode: S_IFLNK | 511,
+      mtime: time2,
+      atime: time2,
+      ctime: new Date(entry.ctimeMs ?? 0),
+      ino: entry.ino ?? inodeOf(entry.path)
+    };
   }
-};
-function pollFile(file) {
-  return file.poll?.() ?? { readable: !!file.read, writable: !!file.write, hangup: false };
-}
-var OpenFile = class {
-  refs = 1;
-  file;
-  constructor(file) {
-    this.file = file;
+  async describe(found) {
+    if (found.link) return this.linkStat(found.link);
+    const [meta] = await this.meta.get([found.path]);
+    return this.statOf(found.path, found.handle, meta);
   }
-  retain() {
-    this.refs += 1;
-    return this;
+  async stat(path) {
+    return this.describe(await this.locate(path, true));
   }
-  release() {
-    this.refs -= 1;
-    if (this.refs === 0) return this.file.close();
+  async lstat(path) {
+    return this.describe(await this.locate(path, false));
   }
-};
-function openPipe(capacity) {
-  const pipe = new KernelPipe(capacity);
-  pipe.openRead();
-  pipe.openWrite();
-  return {
-    read: new OpenFile({
-      read: async (max, signal) => {
-        try {
-          return await pipe.read(max, signal);
-        } catch (e) {
-          throw new KernelError(e.code);
-        }
-      },
-      close: () => pipe.closeRead(),
-      poll: () => ({ readable: pipe.readReady, writable: false, hangup: pipe.writersGone }),
-      changed: (signal) => pipe.changed(signal)
-    }),
-    write: new OpenFile({
-      write: async (bytes, signal) => {
-        try {
-          return await pipe.write(bytes, signal);
-        } catch (e) {
-          throw new KernelError(e.code);
+  async exists(path) {
+    return this.locate(path, true).then(
+      () => true,
+      () => false
+    );
+  }
+  async readFileBuffer(path) {
+    const handle = (await this.locate(path, true)).handle;
+    if (handle.kind === "directory") throw fsError("EISDIR", path);
+    for (let attempt = 1; ; attempt++) {
+      try {
+        return new Uint8Array(await (await handle.getFile()).arrayBuffer());
+      } catch (err) {
+        if (err?.name !== "NotReadableError" || attempt >= READ_ATTEMPTS) {
+          throw translate(err, path);
         }
-      },
-      close: () => pipe.closeWrite(),
-      poll: () => ({ readable: false, writable: pipe.writeReady, hangup: pipe.readersGone }),
-      changed: (signal) => pipe.changed(signal)
-    })
-  };
-}
-function bytesSource(data) {
-  let offset = 0;
-  return new OpenFile({
-    read: async (max) => {
-      const out = data.subarray(offset, offset + max);
-      offset += out.length;
-      return out;
-    },
-    close: () => {
-    }
-  });
-}
-function sinkFile(onData) {
-  return new OpenFile({
-    write: async (bytes) => {
-      onData(bytes.slice());
-      return bytes.length;
-    },
-    close: () => {
-    }
-  });
-}
-function nullFile() {
-  return new OpenFile({
-    read: async () => new Uint8Array(0),
-    write: async (bytes) => bytes.length,
-    close: () => {
-    }
-  });
-}
-function deviceFile(device, access) {
-  const read = async (max) => {
-    if (device === "null") return new Uint8Array(0);
-    const out = new Uint8Array(max);
-    if (device === "urandom") {
-      for (let at = 0; at < max; at += 65536) {
-        crypto.getRandomValues(out.subarray(at, Math.min(max, at + 65536)));
+        await new Promise((resolve) => setTimeout(resolve, attempt * 10));
       }
     }
-    return out;
-  };
-  return new OpenFile({
-    ...access !== "write" ? { read } : {},
-    ...access !== "read" ? { write: async (bytes) => bytes.length } : {},
-    seek: async () => 0,
-    heldMeta: { device, ...access ? { access } : {} },
-    close: () => {
+  }
+  async readFile(path) {
+    return new TextDecoder().decode(await this.readFileBuffer(path));
+  }
+  async writeTarget(path) {
+    try {
+      return [(await this.locate(path, true)).path, true];
+    } catch (err) {
+      if (!missing(err)) throw err;
     }
-  });
-}
-function heldFile(meta) {
-  return new OpenFile({ held: true, ...meta ? { heldMeta: meta } : {}, close: () => {
-  } });
-}
-function kernelFdKind(file) {
-  if (file.held) return "held";
-  if (file.heldMeta && "device" in file.heldMeta) return "device";
-  if (file.tty) return "tty";
-  return file.seek ? "file" : "stream";
-}
-var FdTable = class _FdTable {
-  static MAX_FDS = 1024;
-  fds = /* @__PURE__ */ new Map();
-  cloexec = /* @__PURE__ */ new Set();
-  status = /* @__PURE__ */ new Map();
-  get(fd) {
-    const file = this.fds.get(fd);
-    if (!file) throw new KernelError("EBADF");
-    return file;
+    const [entry] = await this.meta.get([path]);
+    const wanted = entry?.link === void 0 ? path : resolvePath(parentOf2(path), entry.link);
+    return [resolvePath((await this.locate(parentOf2(wanted), true)).path, baseOf(wanted)), false];
   }
-  stdioTerminal() {
-    for (const fd of [0, 1, 2]) {
-      const tty = this.fds.get(fd)?.file.tty;
-      if (tty) return tty;
+  async writeFile(path, content) {
+    const [target, existed] = await this.writeTarget(path);
+    const [dir, name2] = await this.parent(target);
+    let file;
+    try {
+      file = await this.inDir(dir, (parent) => parent.getFileHandle(name2, { create: true }));
+    } catch (err) {
+      const code = err?.name === "TypeMismatchError" ? "EISDIR" : null;
+      throw code ? fsError(code, path) : translate(err, path);
+    }
+    if (!existed && content.length === 0) return;
+    const writable = await file.createWritable();
+    await writable.write(content);
+    await writable.close();
+  }
+  async listing(path) {
+    const found = await this.locate(path, true);
+    const handle = found.handle;
+    if (handle.kind !== "directory") throw fsError("ENOTDIR", path);
+    const children2 = /* @__PURE__ */ new Map();
+    for await (const child of handle.values()) children2.set(child.name, child);
+    for (const link2 of await this.meta.links(found.path)) {
+      const name2 = baseOf(link2.path);
+      if (!children2.has(name2)) children2.set(name2, link2);
     }
-    return void 0;
+    return [found.path, [...children2].sort(([a], [b]) => a < b ? -1 : 1)];
   }
-  numbers() {
-    return [...this.fds.keys()].sort((a, b) => a - b);
+  async readdir(path) {
+    return (await this.listing(path))[1].map(([name2]) => name2);
   }
-  has(fd) {
-    return this.fds.has(fd);
+  async readdirStat(path) {
+    const [dir, children2] = await this.listing(path);
+    const base = dir === "/" ? "" : dir;
+    const metas = await this.meta.get(children2.map(([name2]) => `${base}/${name2}`));
+    return Promise.all(
+      children2.map(async ([name2, child], i) => {
+        if (!isHandle(child)) return [name2, this.linkStat(child)];
+        const stat = await this.statOf(`${base}/${name2}`, child, metas[i]).catch(() => null);
+        return [name2, stat];
+      })
+    );
   }
-  setCloseOnExec(fd) {
-    this.get(fd);
-    this.cloexec.add(fd);
+  async mkdir(path, options = {}) {
+    let found;
+    try {
+      found = await this.locate(path, true);
+    } catch (err) {
+      if (!missing(err)) throw err;
+    }
+    if (found) {
+      const directory = found.handle?.kind === "directory";
+      if (options.recursive && directory) return;
+      throw fsError(options.recursive ? "ENOTDIR" : "EEXIST", path);
+    }
+    const [entry] = await this.meta.get([path]);
+    if (entry?.link !== void 0) throw fsError("EEXIST", path);
+    if (options.recursive) await this.mkdir(parentOf2(path), options);
+    const parent = await this.locate(parentOf2(path), true);
+    if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
+    await parent.handle.getDirectoryHandle(baseOf(path), { create: true });
   }
-  clearCloseOnExec(fd) {
-    this.get(fd);
-    this.cloexec.delete(fd);
+  async rm(path, options = {}) {
+    let found;
+    try {
+      found = await this.locate(path, false);
+    } catch (err) {
+      const error = translate(err, path);
+      if (options.force && error.code === "ENOENT") return;
+      throw error;
+    }
+    if (found.handle) {
+      const [dir, name2] = await this.parent(found.path);
+      try {
+        await this.inDir(
+          dir,
+          (parent) => parent.removeEntry(name2, { recursive: options.recursive === true })
+        );
+      } catch (err) {
+        throw translate(err, path);
+      }
+      this.changed(found.path);
+    }
+    await this.meta.remove([found.path]);
   }
-  closesOnExec(fd) {
-    return this.cloexec.has(fd);
+  async rename(from, to) {
+    if (from === to) return;
+    const source = await this.locate(from, false);
+    this.forget(source.path);
+    const parent = await this.locate(parentOf2(to), true);
+    const destination = resolvePath(parent.path, baseOf(to));
+    const sourceStat = await this.describe(source);
+    if (sourceStat.isDirectory && within(destination, source.path)) throw fsError("EINVAL", to);
+    const target = await this.locate(destination, false).catch((err) => {
+      if (missing(err)) return null;
+      throw err;
+    });
+    const targetStat = target && await this.describe(target);
+    if (targetStat?.isDirectory && !sourceStat.isDirectory) throw fsError("EISDIR", to);
+    if (targetStat && !targetStat.isDirectory && sourceStat.isDirectory) {
+      throw fsError("ENOTDIR", to);
+    }
+    if (targetStat?.isDirectory && (await this.readdir(destination)).length > 0) {
+      throw fsError("ENOTEMPTY", to);
+    }
+    const now = Date.now();
+    const carry = (entry) => ({
+      ino: inodeOf(source.path),
+      ...entry,
+      path: destination,
+      ctimeMs: now
+    });
+    if (source.link) {
+      if (target?.handle) await this.rm(destination);
+      await this.meta.move(source.path, destination, carry);
+      return;
+    }
+    const dir = parent.handle;
+    const name2 = baseOf(destination);
+    const swap = targetStat?.isDirectory === true;
+    const staging = swap ? `.${name2}.${crypto.randomUUID()}` : name2;
+    this.forget(destination);
+    const timed = await this.explicitTimes(source.path);
+    const moved2 = await this.place(source.handle, dir, staging);
+    if (swap) await this.rm(destination, { recursive: true });
+    await this.meta.move(source.path, destination, carry);
+    if (!moved2) await this.rm(source.path, { recursive: true });
+    let copied = !moved2;
+    if (swap) {
+      const staged = await dir.getDirectoryHandle(staging);
+      const placed = await this.place(staged, dir, name2);
+      if (!placed) await dir.removeEntry(staging, { recursive: true });
+      copied ||= !placed;
+    }
+    if (copied) await this.restamp(destination, timed);
+    this.changed(source.path, destination);
   }
-  setStatusFlags(fd, flags) {
-    this.get(fd);
-    this.status.set(fd, flags);
+  async modified(path) {
+    const handle = await this.handle(path);
+    return handle.kind === "file" ? (await handle.getFile()).lastModified : 0;
   }
-  statusFlags(fd) {
-    return this.status.get(fd);
+  async explicitTimes(path) {
+    const timed = [];
+    for (const entry of await this.meta.under(path)) {
+      if (entry.mtimeFor === void 0 || entry.link !== void 0) continue;
+      const current = await this.modified(entry.path).catch(() => void 0);
+      if (current === entry.mtimeFor) timed.push(entry.path.slice(path.length));
+    }
+    return timed;
   }
-  install(file, min = 0) {
-    for (let fd = min; fd < _FdTable.MAX_FDS; fd++) {
-      if (!this.fds.has(fd)) {
-        this.fds.set(fd, file);
-        return fd;
-      }
+  async restamp(path, timed) {
+    for (const rest of timed) {
+      const mtimeFor = await this.modified(path + rest);
+      await this.meta.update(path + rest, (entry) => entry && { ...entry, mtimeFor });
     }
-    void Promise.resolve(file.release()).catch(() => void 0);
-    throw new KernelError("EMFILE");
   }
-  installAt(fd, file) {
-    if (fd < 0 || fd >= _FdTable.MAX_FDS) {
-      void Promise.resolve(file.release()).catch(() => void 0);
-      throw new KernelError("EBADF");
+  async place(handle, dir, name2) {
+    const moved2 = await handle.move?.(dir, name2).then(
+      () => true,
+      () => false
+    );
+    if (moved2) return true;
+    try {
+      await this.copy(handle, dir, name2);
+    } catch (err) {
+      if (handle.kind === "directory") await dir.removeEntry(name2, { recursive: true });
+      throw translate(err, name2);
     }
-    const previous = this.fds.get(fd);
-    this.fds.set(fd, file);
-    this.cloexec.delete(fd);
-    this.status.delete(fd);
-    void Promise.resolve(previous?.release()).catch(() => void 0);
+    return false;
   }
-  dup(fd, min = 0) {
-    return this.install(this.get(fd).retain(), min);
+  async copy(handle, dir, name2) {
+    if (handle.kind === "file") {
+      const writable = await (await dir.getFileHandle(name2, { create: true })).createWritable();
+      await writable.write(await handle.getFile());
+      await writable.close();
+      return;
+    }
+    const target = await dir.getDirectoryHandle(name2, { create: true });
+    for await (const child of handle.values()) await this.copy(child, target, child.name);
   }
-  dup2(oldFd, newFd) {
-    const file = this.get(oldFd);
-    if (oldFd !== newFd) this.installAt(newFd, file.retain());
-    return newFd;
+  async symlink(target, path) {
+    const parent = await this.locate(parentOf2(path), true);
+    if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
+    const at = resolvePath(parent.path, baseOf(path));
+    if (await this.locate(at, false).then(
+      () => true,
+      (err) => !missing(err)
+    )) {
+      throw fsError("EEXIST", path);
+    }
+    const now = Date.now();
+    await this.meta.update(at, () => ({
+      path: at,
+      link: target,
+      dir: parent.path,
+      ino: inodeOf(at),
+      mtimeMs: now,
+      ctimeMs: now
+    }));
   }
-  close(fd) {
-    const file = this.get(fd);
-    this.fds.delete(fd);
-    this.cloexec.delete(fd);
-    this.status.delete(fd);
-    return file.release();
+  async readlink(path) {
+    const found = await this.locate(path, false);
+    if (found.link) return found.link.link;
+    throw fsError("EINVAL", path);
   }
-  fork() {
-    const child = new _FdTable();
-    for (const [fd, file] of this.fds) child.fds.set(fd, file.retain());
-    for (const fd of this.cloexec) child.cloexec.add(fd);
-    for (const [fd, flags] of this.status) child.status.set(fd, flags);
-    return child;
+  async chmod(path, mode) {
+    const found = await this.locate(path, true);
+    const ctimeMs = Date.now();
+    await this.meta.update(found.path, (entry) => ({
+      ...entry,
+      path: found.path,
+      mode: mode & PERM_MASK,
+      ctimeMs
+    }));
   }
-  async closeAll() {
-    const files = [...this.fds.values()];
-    this.fds.clear();
-    this.cloexec.clear();
-    this.status.clear();
-    await Promise.allSettled(files.map((file) => Promise.resolve().then(() => file.release())));
+  async utimes(path, atime, mtime) {
+    const found = await this.locate(path, true);
+    const handle = found.handle;
+    const file = handle.kind === "file" ? await handle.getFile() : void 0;
+    const ctimeMs = Date.now();
+    await this.meta.update(found.path, (entry) => ({
+      ...entry,
+      path: found.path,
+      atimeMs: atime.getTime(),
+      mtimeMs: mtime.getTime(),
+      mtimeFor: file?.lastModified ?? 0,
+      ctimeMs
+    }));
+  }
+  async reconcile() {
+    let removed = 0;
+    for (const entry of await this.meta.all()) {
+      const real = await this.real(entry.path);
+      const stale = entry.link === void 0 ? !real : real || !await this.real(parentOf2(entry.path));
+      if (!stale) continue;
+      await this.meta.update(entry.path, () => void 0);
+      removed++;
+    }
+    return removed;
   }
 };
 
+// src/kernel/net/loopback-names.ts
+var HOST_LOOPBACK = "host.slicc.internal";
+var PAGE_LOOPBACK = "kernel.localhost";
+var PAGE_LOOPBACK_URL = `http://{port}.${PAGE_LOOPBACK}`;
+function toHostLoopback(href) {
+  const url = new URL(href);
+  if (url.hostname.replace(/\.$/, "").toLowerCase() !== HOST_LOOPBACK) return href;
+  url.hostname = "127.0.0.1";
+  return url.href;
+}
+
 // src/kernel/net/http1.ts
 var HttpError = class extends Error {
   status;
@@ -1790,7 +2196,7 @@ var Budget = class {
     for (const wake of waiters) wake();
   }
 };
-function canonicalHost(host) {
+function canonicalHost2(host) {
   const bare = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
   try {
     return new URL(`http://${bare}/`).hostname;
@@ -1820,7 +2226,7 @@ function localV6(address) {
   return g[5] === 0 && g[6] === 0;
 }
 function isLoopbackHost(hostname) {
-  const canonical = canonicalHost(hostname);
+  const canonical = canonicalHost2(hostname);
   if (canonical === void 0) return false;
   const host = canonical.replace(/\.+$/, "");
   if (host === "localhost" || host.endsWith(".localhost")) return true;
@@ -1893,7 +2299,7 @@ function tunnelTarget(req) {
   if (!match || port < 1 || port > 65535) {
     throw new HttpError(400, "CONNECT needs host:port");
   }
-  const host = canonicalHost(match[1]);
+  const host = canonicalHost2(match[1]);
   if (host === void 0) throw new HttpError(400, "CONNECT needs host:port");
   if (isLoopbackHost(host)) {
     throw new HttpError(
@@ -2079,7 +2485,7 @@ var RealmProxy = class {
   async upstream(req, url, body, signal) {
     try {
       const fetching = this.options.transport.fetch({
-        url,
+        url: toHostLoopback(url),
         method: req.method.toUpperCase(),
         headers: forwardRequestHeaders(req.headers),
         body: req.method === "GET" || req.method === "HEAD" ? void 0 : body,
@@ -2749,6 +3155,7 @@ var CA_PATH = "/etc/ssl/certs/slicc-kernel-ca.pem";
 var PROXY_URL = `http://127.0.0.1:${REALM_PROXY_PORT}`;
 var NO_PROXY = "localhost,.localhost,127.0.0.1,127.0.0.0/8";
 var CA_OWNER = "slicc-kernel";
+var CA_DB = "slicc-kernel-ca";
 function networkEnv() {
   return {
     http_proxy: PROXY_URL,
@@ -2759,7 +3166,10 @@ function networkEnv() {
     NO_PROXY,
     SSL_CERT_FILE: CA_PATH,
     CURL_CA_BUNDLE: CA_PATH,
-    GIT_SSL_CAINFO: CA_PATH
+    GIT_SSL_CAINFO: CA_PATH,
+    SLICC_HOST_LOOPBACK: HOST_LOOPBACK,
+    SLICC_PAGE_LOOPBACK: PAGE_LOOPBACK,
+    SLICC_PAGE_LOOPBACK_URL: PAGE_LOOPBACK_URL
   };
 }
 function missingTransport() {
@@ -2779,8 +3189,8 @@ function memoryCaStore() {
     }
   };
 }
-function caStore(metadata) {
-  return metadata === false ? memoryCaStore() : indexedDbCaStore(`${metadata}-ca`);
+function caStore(name2) {
+  return name2 === false ? memoryCaStore() : indexedDbCaStore(name2);
 }
 function base64(bytes) {
   let text = "";
@@ -2813,12 +3223,27 @@ function kernelCa(store) {
 function kernelTlsEngine(load) {
   return () => loadTlsEngine(load);
 }
-async function writeCaFile(fs, ca) {
-  const { pem: pem2 } = await ca();
-  const current = await fs.exists(CA_PATH) ? await fs.readFile(CA_PATH) : void 0;
-  if (current === pem2) return;
+var CERTIFICATE = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+var CA_BUNDLE_MAX = 16;
+var CA_FILE_LOCK = "slicc-kernel-ca-file";
+var CA_FILE_TRIES = 3;
+async function addToBundle(fs, own) {
+  const current = await fs.exists(CA_PATH) ? await fs.readFile(CA_PATH) : "";
+  const all = current.match(CERTIFICATE) ?? [];
+  const others = all.filter((cert) => cert !== own);
+  if (others.length < all.length) return true;
+  const bundle = [...others, own].slice(-CA_BUNDLE_MAX);
   await fs.mkdir(CA_PATH.slice(0, CA_PATH.lastIndexOf("/")), { recursive: true });
-  await fs.writeFile(CA_PATH, pem2);
+  await fs.writeFile(CA_PATH, `${bundle.join("\n")}
+`);
+  return false;
+}
+async function writeCaFile(fs, ca, locks = globalThis.navigator?.locks) {
+  const own = (await ca()).pem.trim();
+  const update = async () => {
+    for (let i = 0; i < CA_FILE_TRIES && !await addToBundle(fs, own); i++) ;
+  };
+  await (locks ? locks.request(CA_FILE_LOCK, update) : update());
 }
 function enableNetwork(net, options) {
   let proxy;
@@ -4592,586 +5017,290 @@ var HttpHandles = class {
         statusText: response.statusText,
         url: req.url,
         headers: response.headers
-      };
-      return { ok: true, kind: "json", json: head };
-    } catch (e) {
-      const text = message(e);
-      if (text === NO_TRANSPORT) return { ok: false, errno: "ENETUNREACH", message: text };
-      const status = e.status;
-      if (typeof status !== "number" || status === 502) {
-        return { ok: false, errno: "ECONNREFUSED", message: text };
-      }
-      const body = new TextEncoder().encode(text);
-      const handle = this.add(abort, once(body), async () => void 0);
-      const head = {
-        handle,
-        status,
-        statusText: "",
-        url: req.url,
-        headers: [["content-type", "text/plain; charset=utf-8"]]
-      };
-      return { ok: true, kind: "json", json: head };
-    }
-  }
-  async read(handle, max) {
-    const entry = this.open.get(handle);
-    if (!entry) return { ok: false, errno: "EBADF", message: `no request ${handle}` };
-    const turn = entry.reading.then(() => this.take(entry, max));
-    entry.reading = turn.then(() => void 0);
-    return turn;
-  }
-  async take(entry, max) {
-    if (entry.left.length === 0 && !entry.done) {
-      try {
-        const next = await entry.body.next();
-        if (next.done) entry.done = true;
-        else entry.left = next.value;
-      } catch (e) {
-        entry.done = true;
-        const timedOut = e?.code === "ETIMEDOUT";
-        return { ok: false, errno: timedOut ? "ETIMEDOUT" : "EIO", message: message(e) };
-      }
-    }
-    const bytes = entry.left.subarray(0, Math.max(0, max));
-    entry.left = entry.left.subarray(bytes.length);
-    return { ok: true, kind: "bytes", bytes };
-  }
-  async close(handle) {
-    const entry = this.open.get(handle);
-    if (!entry) return { ok: false, errno: "EBADF", message: `no request ${handle}` };
-    this.open.delete(handle);
-    entry.abort.abort();
-    await entry.cancel().catch(() => void 0);
-    return { ok: true, kind: "void" };
-  }
-  async closeAll() {
-    await Promise.all([...this.open.keys()].map((handle) => this.close(handle)));
-  }
-};
-
-// src/kernel/tty.ts
-var ICRNL = 256;
-var IUTF8 = 16384;
-var OPOST = 1;
-var ONLCR = 4;
-var ISIG = 1;
-var ICANON = 2;
-var ECHO = 8;
-var ECHOE = 16;
-var ECHOCTL = 512;
-var NOFLSH = 128;
-var IEXTEN = 32768;
-var VINTR = 0;
-var VQUIT = 1;
-var VERASE = 2;
-var VKILL = 3;
-var VEOF = 4;
-var VSUSP = 10;
-var VWERASE = 14;
-function defaultTermios() {
-  const cCc = new Array(32).fill(0);
-  Object.assign(cCc, { [VINTR]: 3, [VQUIT]: 28, [VERASE]: 127, [VKILL]: 21 });
-  Object.assign(cCc, { [VEOF]: 4, 6: 1, 8: 17, 9: 19, [VSUSP]: 26 });
-  Object.assign(cCc, { 12: 18, 13: 15, [VWERASE]: 23, 15: 22 });
-  return {
-    c_iflag: ICRNL | 1024 | 8192 | IUTF8,
-    c_oflag: OPOST | ONLCR,
-    c_cflag: 15 | 48 | 128,
-    c_lflag: ISIG | ICANON | ECHO | ECHOE | 32 | ECHOCTL | 2048 | IEXTEN,
-    c_cc: cCc
-  };
-}
-var encoder2 = new TextEncoder();
-function isContinuation(byte) {
-  return (byte & 192) === 128;
-}
-var KernelTty = class {
-  termios = defaultTermios();
-  cols = 80;
-  rows = 24;
-  readable = [];
-  line = [];
-  waiters = [];
-  hungUp = false;
-  name;
-  screen;
-  signal;
-  constructor(screen, signal) {
-    this.screen = screen;
-    this.signal = signal;
-  }
-  receive(bytes) {
-    for (const byte of bytes) this.key(byte);
-    this.wake();
-  }
-  resize(cols, rows) {
-    this.setSize(cols, rows);
-    this.signal(SIG.WINCH);
-  }
-  hangup() {
-    this.hungUp = true;
-    this.wake();
-  }
-  signalHangup() {
-    this.signal(SIG.HUP);
-  }
-  setSize(cols, rows) {
-    this.cols = cols;
-    this.rows = rows;
-  }
-  tcgets() {
-    return { ...this.termios, c_cc: [...this.termios.c_cc] };
-  }
-  tcsets(termios) {
-    const wasCanonical = this.canonical;
-    this.termios = { ...termios, c_cc: [...termios.c_cc] };
-    if (wasCanonical && !this.canonical && this.line.length > 0) {
-      this.readable.push(Uint8Array.from(this.line));
-      this.line = [];
-      this.wake();
-    }
-  }
-  winsize() {
-    return [this.rows, this.cols];
-  }
-  file() {
-    return new OpenFile({
-      read: (max, signal) => this.read(max, signal),
-      write: async (bytes) => {
-        if (this.hungUp) throw new KernelError("EIO");
-        this.output(bytes);
-        return bytes.length;
-      },
-      poll: () => ({
-        readable: this.readable.length > 0 || this.hungUp,
-        writable: true,
-        hangup: this.hungUp
-      }),
-      changed: (signal) => this.changed(signal),
-      close: () => {
-      },
-      tty: this
-    });
-  }
-  get canonical() {
-    return (this.termios.c_lflag & ICANON) !== 0;
-  }
-  cc(slot) {
-    return this.termios.c_cc[slot] ?? 0;
-  }
-  key(input) {
-    const { c_iflag, c_lflag } = this.termios;
-    const byte = input === 13 && c_iflag & ICRNL ? 10 : input;
-    if (c_lflag & ISIG && this.signalKey(byte)) return;
-    if (!this.canonical) {
-      this.readable.push(Uint8Array.of(byte));
-      if (c_lflag & ECHO) this.echo(byte);
-      return;
-    }
-    this.edit(byte);
-  }
-  signalKey(byte) {
-    const sig = byte === this.cc(VINTR) ? SIG.INT : byte === this.cc(VQUIT) ? SIG.QUIT : byte === this.cc(VSUSP) ? SIG.TSTP : 0;
-    if (!sig || byte === 0) return false;
-    if (this.termios.c_lflag & ECHO) this.echo(byte);
-    if (!(this.termios.c_lflag & NOFLSH)) {
-      this.line = [];
-      this.readable = [];
-    }
-    this.signal(sig);
-    return true;
-  }
-  edit(byte) {
-    const echo = (this.termios.c_lflag & ECHO) !== 0;
-    if (byte === this.cc(VERASE) || byte === 8) {
-      this.rubOut(this.lastCharLength());
-    } else if (byte === this.cc(VKILL)) {
-      this.rubOut(this.line.length);
-    } else if (byte === this.cc(VWERASE)) {
-      this.rubOut(this.lastWordLength());
-    } else if (byte === this.cc(VEOF)) {
-      this.readable.push(this.line.length > 0 ? Uint8Array.from(this.line) : null);
-      this.line = [];
-    } else if (byte === 10) {
-      this.line.push(byte);
-      if (echo) this.output(encoder2.encode("\n"));
-      this.readable.push(Uint8Array.from(this.line));
-      this.line = [];
-    } else {
-      this.line.push(byte);
-      if (echo) this.echo(byte);
-    }
-  }
-  lastWordLength() {
-    let end = this.line.length;
-    while (end > 0 && this.line[end - 1] === 32) end--;
-    while (end > 0 && this.line[end - 1] !== 32) end--;
-    return this.line.length - end;
-  }
-  lastCharLength() {
-    const { line } = this;
-    let n = Math.min(1, line.length);
-    if (this.termios.c_iflag & IUTF8) {
-      while (n < line.length && isContinuation(line[line.length - n] ?? 0)) n++;
-    }
-    return n;
-  }
-  rubOut(n) {
-    const dropped2 = this.line.splice(this.line.length - n, n);
-    const utf82 = (this.termios.c_iflag & IUTF8) !== 0;
-    const cells = utf82 ? dropped2.filter((b) => !isContinuation(b)).length : dropped2.length;
-    if (cells > 0 && this.termios.c_lflag & ECHO) {
-      this.output(encoder2.encode("\b \b".repeat(cells)), false);
-    }
-  }
-  echo(byte) {
-    if (byte < 32 && byte !== 10 && byte !== 9 && this.termios.c_lflag & ECHOCTL) {
-      this.output(Uint8Array.of(94, byte + 64), false);
-      return;
+      };
+      return { ok: true, kind: "json", json: head };
+    } catch (e) {
+      const text = message(e);
+      if (text === NO_TRANSPORT) return { ok: false, errno: "ENETUNREACH", message: text };
+      const status = e.status;
+      if (typeof status !== "number" || status === 502) {
+        return { ok: false, errno: "ECONNREFUSED", message: text };
+      }
+      const body = new TextEncoder().encode(text);
+      const handle = this.add(abort, once(body), async () => void 0);
+      const head = {
+        handle,
+        status,
+        statusText: "",
+        url: req.url,
+        headers: [["content-type", "text/plain; charset=utf-8"]]
+      };
+      return { ok: true, kind: "json", json: head };
     }
-    this.output(Uint8Array.of(byte));
   }
-  output(bytes, translate2 = true) {
-    const { c_oflag } = this.termios;
-    if (!translate2 || !(c_oflag & OPOST && c_oflag & ONLCR) || !bytes.includes(10)) {
-      this.screen.write(bytes);
-      return;
-    }
-    const out = [];
-    for (const byte of bytes) {
-      if (byte === 10) out.push(13);
-      out.push(byte);
-    }
-    this.screen.write(Uint8Array.from(out));
+  async read(handle, max) {
+    const entry = this.open.get(handle);
+    if (!entry) return { ok: false, errno: "EBADF", message: `no request ${handle}` };
+    const turn = entry.reading.then(() => this.take(entry, max));
+    entry.reading = turn.then(() => void 0);
+    return turn;
   }
-  async read(max, signal) {
-    while (this.readable.length === 0) {
-      if (this.hungUp) return new Uint8Array(0);
-      await this.changed(signal);
-    }
-    const head = this.readable[0];
-    if (head === null) {
-      this.readable.shift();
-      return new Uint8Array(0);
-    }
-    if (head === void 0) return new Uint8Array(0);
-    const chunks = [];
-    let n = 0;
-    while (this.readable.length > 0 && n < max) {
-      const next = this.readable[0];
-      if (next === null || next === void 0) break;
-      const take = next.subarray(0, max - n);
-      chunks.push(take);
-      n += take.length;
-      if (take.length < next.length) this.readable[0] = next.subarray(take.length);
-      else this.readable.shift();
-      if (this.canonical) break;
-    }
-    const out = new Uint8Array(n);
-    let at = 0;
-    for (const chunk2 of chunks) {
-      out.set(chunk2, at);
-      at += chunk2.length;
+  async take(entry, max) {
+    if (entry.left.length === 0 && !entry.done) {
+      try {
+        const next = await entry.body.next();
+        if (next.done) entry.done = true;
+        else entry.left = next.value;
+      } catch (e) {
+        entry.done = true;
+        const timedOut = e?.code === "ETIMEDOUT";
+        return { ok: false, errno: timedOut ? "ETIMEDOUT" : "EIO", message: message(e) };
+      }
     }
-    return out;
+    const bytes = entry.left.subarray(0, Math.max(0, max));
+    entry.left = entry.left.subarray(bytes.length);
+    return { ok: true, kind: "bytes", bytes };
   }
-  changed(signal) {
-    if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
-    return new Promise((resolve, reject) => {
-      const onAbort = () => {
-        this.waiters = this.waiters.filter((w) => w !== waiter);
-        reject(new KernelError("EINTR"));
-      };
-      const waiter = () => {
-        signal?.removeEventListener("abort", onAbort);
-        resolve();
-      };
-      this.waiters.push(waiter);
-      signal?.addEventListener("abort", onAbort, { once: true });
-    });
+  async close(handle) {
+    const entry = this.open.get(handle);
+    if (!entry) return { ok: false, errno: "EBADF", message: `no request ${handle}` };
+    this.open.delete(handle);
+    entry.abort.abort();
+    await entry.cancel().catch(() => void 0);
+    return { ok: true, kind: "void" };
   }
-  wake() {
-    const waiters = this.waiters;
-    this.waiters = [];
-    for (const resolve of waiters) resolve();
+  async closeAll() {
+    await Promise.all([...this.open.keys()].map((handle) => this.close(handle)));
   }
 };
 
-// src/kernel/pty.ts
-var PtyPair = class {
-  slave;
-  locked = true;
-  packet = false;
-  queue = [];
+// src/kernel/tty.ts
+var ICRNL = 256;
+var IUTF8 = 16384;
+var OPOST = 1;
+var ONLCR = 4;
+var ISIG = 1;
+var ICANON = 2;
+var ECHO = 8;
+var ECHOE = 16;
+var ECHOCTL = 512;
+var NOFLSH = 128;
+var IEXTEN = 32768;
+var VINTR = 0;
+var VQUIT = 1;
+var VERASE = 2;
+var VKILL = 3;
+var VEOF = 4;
+var VSUSP = 10;
+var VWERASE = 14;
+function defaultTermios() {
+  const cCc = new Array(32).fill(0);
+  Object.assign(cCc, { [VINTR]: 3, [VQUIT]: 28, [VERASE]: 127, [VKILL]: 21 });
+  Object.assign(cCc, { [VEOF]: 4, 6: 1, 8: 17, 9: 19, [VSUSP]: 26 });
+  Object.assign(cCc, { 12: 18, 13: 15, [VWERASE]: 23, 15: 22 });
+  return {
+    c_iflag: ICRNL | 1024 | 8192 | IUTF8,
+    c_oflag: OPOST | ONLCR,
+    c_cflag: 15 | 48 | 128,
+    c_lflag: ISIG | ICANON | ECHO | ECHOE | 32 | ECHOCTL | 2048 | IEXTEN,
+    c_cc: cCc
+  };
+}
+var encoder2 = new TextEncoder();
+function isContinuation(byte) {
+  return (byte & 192) === 128;
+}
+var KernelTty = class {
+  termios = defaultTermios();
+  cols = 80;
+  rows = 24;
+  readable = [];
+  line = [];
   waiters = [];
-  masterOpen = true;
-  slaveRefs = 0;
-  slaveSeen = false;
-  index;
-  onFree;
-  constructor(index, signal, onFree) {
-    this.index = index;
-    this.onFree = onFree;
-    this.slave = new KernelTty(
-      { write: (bytes) => this.fromSlave(bytes) },
-      (sig) => signal(this.slave, sig)
-    );
-    this.slave.name = `/dev/pts/${index}`;
-  }
-  master() {
-    return new OpenFile({
-      read: (max, signal) => this.readMaster(max, signal),
-      write: async (bytes) => {
-        this.slave.receive(bytes);
-        return bytes.length;
-      },
-      poll: () => ({
-        readable: this.queue.length > 0 || this.slaveGone,
-        writable: true,
-        hangup: this.slaveGone
-      }),
-      changed: (signal) => this.changed(signal),
-      close: () => this.closeMaster(),
-      pty: this
-    });
+  hungUp = false;
+  name;
+  screen;
+  signal;
+  constructor(screen, signal) {
+    this.screen = screen;
+    this.signal = signal;
   }
-  openSlave() {
-    if (!this.masterOpen || this.locked) throw new KernelError("EIO");
-    const file = this.slave.file().file;
-    this.slaveRefs += 1;
-    this.slaveSeen = true;
-    return new OpenFile({ ...file, close: () => this.closeSlave() });
+  receive(bytes) {
+    for (const byte of bytes) this.key(byte);
+    this.wake();
   }
-  get slaveGone() {
-    return this.slaveSeen && this.slaveRefs === 0;
+  resize(cols, rows) {
+    this.setSize(cols, rows);
+    this.signal(SIG.WINCH);
   }
-  fromSlave(bytes) {
-    if (!this.masterOpen) return;
-    this.queue.push(bytes.slice());
+  hangup() {
+    this.hungUp = true;
     this.wake();
   }
-  async readMaster(max, signal) {
-    while (this.queue.length === 0) {
-      if (this.slaveGone) throw new KernelError("EIO");
-      await this.changed(signal);
-    }
-    const status = this.packet ? 1 : 0;
-    const chunks = [];
-    let n = 0;
-    while (this.queue.length > 0 && n < max - status) {
-      const next = this.queue[0];
-      const take = next.subarray(0, max - status - n);
-      chunks.push(take);
-      n += take.length;
-      if (take.length < next.length) this.queue[0] = next.subarray(take.length);
-      else this.queue.shift();
-    }
-    const out = new Uint8Array(status + n);
-    let at = status;
-    for (const chunk2 of chunks) {
-      out.set(chunk2, at);
-      at += chunk2.length;
-    }
-    return out;
+  signalHangup() {
+    this.signal(SIG.HUP);
   }
-  closeMaster() {
-    this.masterOpen = false;
-    this.queue = [];
-    this.slave.hangup();
-    this.slave.signalHangup();
-    this.freeIfUnused();
+  setSize(cols, rows) {
+    this.cols = cols;
+    this.rows = rows;
   }
-  closeSlave() {
-    this.slaveRefs -= 1;
-    this.wake();
-    this.freeIfUnused();
+  tcgets() {
+    return { ...this.termios, c_cc: [...this.termios.c_cc] };
+  }
+  tcsets(termios) {
+    const wasCanonical = this.canonical;
+    this.termios = { ...termios, c_cc: [...termios.c_cc] };
+    if (wasCanonical && !this.canonical && this.line.length > 0) {
+      this.readable.push(Uint8Array.from(this.line));
+      this.line = [];
+      this.wake();
+    }
   }
-  freeIfUnused() {
-    if (!this.masterOpen && this.slaveRefs === 0) this.onFree(this);
+  winsize() {
+    return [this.rows, this.cols];
   }
-  changed(signal) {
-    if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
-    return new Promise((resolve, reject) => {
-      const onAbort = () => {
-        this.waiters = this.waiters.filter((w) => w !== waiter);
-        reject(new KernelError("EINTR"));
-      };
-      const waiter = () => {
-        signal?.removeEventListener("abort", onAbort);
-        resolve();
-      };
-      this.waiters.push(waiter);
-      signal?.addEventListener("abort", onAbort, { once: true });
+  file() {
+    return new OpenFile({
+      read: (max, signal) => this.read(max, signal),
+      write: async (bytes) => {
+        if (this.hungUp) throw new KernelError("EIO");
+        this.output(bytes);
+        return bytes.length;
+      },
+      poll: () => ({
+        readable: this.readable.length > 0 || this.hungUp,
+        writable: true,
+        hangup: this.hungUp
+      }),
+      changed: (signal) => this.changed(signal),
+      close: () => {
+      },
+      tty: this
     });
   }
-  wake() {
-    const waiters = this.waiters;
-    this.waiters = [];
-    for (const resolve of waiters) resolve();
+  get canonical() {
+    return (this.termios.c_lflag & ICANON) !== 0;
   }
-};
-var PtyTable = class {
-  pairs = /* @__PURE__ */ new Map();
-  signal;
-  constructor(signal) {
-    this.signal = signal;
+  cc(slot) {
+    return this.termios.c_cc[slot] ?? 0;
   }
-  open() {
-    let index = 0;
-    while (this.pairs.has(index)) index += 1;
-    const pair = new PtyPair(index, this.signal, (p) => this.pairs.delete(p.index));
-    this.pairs.set(index, pair);
-    return { pair, master: pair.master() };
+  key(input) {
+    const { c_iflag, c_lflag } = this.termios;
+    const byte = input === 13 && c_iflag & ICRNL ? 10 : input;
+    if (c_lflag & ISIG && this.signalKey(byte)) return;
+    if (!this.canonical) {
+      this.readable.push(Uint8Array.of(byte));
+      if (c_lflag & ECHO) this.echo(byte);
+      return;
+    }
+    this.edit(byte);
   }
-  get(index) {
-    const pair = this.pairs.get(index);
-    if (!pair) throw new KernelError("ENOENT");
-    return pair;
+  signalKey(byte) {
+    const sig = byte === this.cc(VINTR) ? SIG.INT : byte === this.cc(VQUIT) ? SIG.QUIT : byte === this.cc(VSUSP) ? SIG.TSTP : 0;
+    if (!sig || byte === 0) return false;
+    if (this.termios.c_lflag & ECHO) this.echo(byte);
+    if (!(this.termios.c_lflag & NOFLSH)) {
+      this.line = [];
+      this.readable = [];
+    }
+    this.signal(sig);
+    return true;
   }
-  numbers() {
-    return [...this.pairs.keys()].sort((a, b) => a - b);
+  edit(byte) {
+    const echo = (this.termios.c_lflag & ECHO) !== 0;
+    if (byte === this.cc(VERASE) || byte === 8) {
+      this.rubOut(this.lastCharLength());
+    } else if (byte === this.cc(VKILL)) {
+      this.rubOut(this.line.length);
+    } else if (byte === this.cc(VWERASE)) {
+      this.rubOut(this.lastWordLength());
+    } else if (byte === this.cc(VEOF)) {
+      this.readable.push(this.line.length > 0 ? Uint8Array.from(this.line) : null);
+      this.line = [];
+    } else if (byte === 10) {
+      this.line.push(byte);
+      if (echo) this.output(encoder2.encode("\n"));
+      this.readable.push(Uint8Array.from(this.line));
+      this.line = [];
+    } else {
+      this.line.push(byte);
+      if (echo) this.echo(byte);
+    }
   }
-};
-var PTY_OPS = [
-  "pty-open",
-  "pty-slave-open",
-  "pty-number",
-  "pty-lock",
-  "pty-ctty",
-  "pty-packet",
-  "pty-list",
-  "pty-winsz-set"
-];
-function masterOf(ctx, fd) {
-  const pair = ctx.fds.get(fd).file.pty;
-  if (!pair) throw new KernelError("ENOTTY");
-  return pair;
-}
-function terminalOf(ctx, fd) {
-  const file = ctx.fds.get(fd).file;
-  const tty = file.tty ?? file.pty?.slave;
-  if (!tty) throw new KernelError("ENOTTY");
-  return tty;
-}
-var json3 = (value) => ({ ok: true, kind: "json", json: value });
-var done3 = { ok: true, kind: "void" };
-function ptySyscall(req, ctx) {
-  switch (req.op) {
-    case "pty-open": {
-      if (!ctx.ptys) throw new KernelError("ENOENT");
-      return json3(ctx.fds.install(ctx.ptys.open().master, 3));
+  lastWordLength() {
+    let end = this.line.length;
+    while (end > 0 && this.line[end - 1] === 32) end--;
+    while (end > 0 && this.line[end - 1] !== 32) end--;
+    return this.line.length - end;
+  }
+  lastCharLength() {
+    const { line } = this;
+    let n = Math.min(1, line.length);
+    if (this.termios.c_iflag & IUTF8) {
+      while (n < line.length && isContinuation(line[line.length - n] ?? 0)) n++;
     }
-    case "pty-slave-open": {
-      if (!ctx.ptys) throw new KernelError("ENOENT");
-      const pair = ctx.ptys.get(req.n);
-      const fd = ctx.fds.install(pair.openSlave(), 3);
-      if (!req.noctty) ctx.jobs?.acquireTerminal(ctx.pid, pair.slave);
-      return json3(fd);
+    return n;
+  }
+  rubOut(n) {
+    const dropped2 = this.line.splice(this.line.length - n, n);
+    const utf82 = (this.termios.c_iflag & IUTF8) !== 0;
+    const cells = utf82 ? dropped2.filter((b) => !isContinuation(b)).length : dropped2.length;
+    if (cells > 0 && this.termios.c_lflag & ECHO) {
+      this.output(encoder2.encode("\b \b".repeat(cells)), false);
     }
-    case "pty-number":
-      return json3(masterOf(ctx, req.fd).index);
-    case "pty-lock":
-      masterOf(ctx, req.fd).locked = req.lock;
-      return done3;
-    case "pty-ctty": {
-      const tty = terminalOf(ctx, req.fd);
-      const leader = ctx.jobs?.getsid(ctx.pid, 0) === ctx.pid;
-      if (leader && ctx.jobs?.controllingTerminal(ctx.pid) === tty) return done3;
-      if (!ctx.jobs?.acquireTerminal(ctx.pid, tty)) throw new KernelError("EPERM");
-      return done3;
+  }
+  echo(byte) {
+    if (byte < 32 && byte !== 10 && byte !== 9 && this.termios.c_lflag & ECHOCTL) {
+      this.output(Uint8Array.of(94, byte + 64), false);
+      return;
     }
-    case "pty-list":
-      return json3(ctx.ptys?.numbers() ?? []);
-    case "pty-packet":
-      masterOf(ctx, req.fd).packet = req.on;
-      return done3;
-    case "pty-winsz-set":
-      terminalOf(ctx, req.fd).resize(req.cols, req.rows);
-      return done3;
+    this.output(Uint8Array.of(byte));
   }
-}
-
-// src/kernel/select.ts
-function ready(fds, read, write) {
-  const hangup = /* @__PURE__ */ new Set();
-  const pick = (list, dir) => list.filter((fd) => {
-    const state = pollFile(fds.get(fd).file);
-    if (state.hangup) hangup.add(fd);
-    return state[dir] || state.hangup;
-  });
-  const out = { read: pick(read, "readable"), write: pick(write, "writable") };
-  if (hangup.size > 0) out.hangup = [...hangup];
-  return out;
-}
-function interruption(signal) {
-  const { promise, reject } = Promise.withResolvers();
-  const fail = () => reject(new KernelError("EINTR"));
-  if (signal.aborted) fail();
-  else signal.addEventListener("abort", fail, { once: true });
-  return { promise, done: () => signal.removeEventListener("abort", fail) };
-}
-async function selectFds(fds, read, write, timeoutMs, interrupt) {
-  const deadline = timeoutMs < 0 ? Number.POSITIVE_INFINITY : Date.now() + timeoutMs;
-  const interrupted2 = interruption(interrupt);
-  interrupted2.promise.catch(() => {
-  });
-  try {
-    return await waitReady(fds, read, write, deadline, interrupted2.promise);
-  } finally {
-    interrupted2.done();
+  output(bytes, translate2 = true) {
+    const { c_oflag } = this.termios;
+    if (!translate2 || !(c_oflag & OPOST && c_oflag & ONLCR) || !bytes.includes(10)) {
+      this.screen.write(bytes);
+      return;
+    }
+    const out = [];
+    for (const byte of bytes) {
+      if (byte === 10) out.push(13);
+      out.push(byte);
+    }
+    this.screen.write(Uint8Array.from(out));
   }
-}
-async function waitReady(fds, read, write, deadline, interrupted2) {
-  for (; ; ) {
-    const now = ready(fds, read, write);
-    if (now.read.length > 0 || now.write.length > 0 || Date.now() >= deadline) return now;
-    const round = new AbortController();
-    const changes = [.../* @__PURE__ */ new Set([...read, ...write])].flatMap((fd) => {
-      const file = fds.get(fd).file;
-      return file.changed === void 0 ? [] : [file.changed(round.signal).catch(() => void 0)];
-    });
-    let timer;
-    const expiry = deadline === Number.POSITIVE_INFINITY ? [] : [new Promise((resolve) => timer = setTimeout(resolve, deadline - Date.now()))];
-    try {
-      await Promise.race([...changes, ...expiry, interrupted2]);
-    } finally {
-      round.abort();
-      clearTimeout(timer);
+  async read(max, signal) {
+    while (this.readable.length === 0) {
+      if (this.hungUp) return new Uint8Array(0);
+      await this.changed(signal);
+    }
+    const head = this.readable[0];
+    if (head === null) {
+      this.readable.shift();
+      return new Uint8Array(0);
+    }
+    if (head === void 0) return new Uint8Array(0);
+    const chunks = [];
+    let n = 0;
+    while (this.readable.length > 0 && n < max) {
+      const next = this.readable[0];
+      if (next === null || next === void 0) break;
+      const take = next.subarray(0, max - n);
+      chunks.push(take);
+      n += take.length;
+      if (take.length < next.length) this.readable[0] = next.subarray(take.length);
+      else this.readable.shift();
+      if (this.canonical) break;
     }
+    const out = new Uint8Array(n);
+    let at = 0;
+    for (const chunk2 of chunks) {
+      out.set(chunk2, at);
+      at += chunk2.length;
+    }
+    return out;
   }
-}
-
-// src/kernel/socket.ts
-var SOMAXCONN = 4096;
-var EPHEMERAL_FIRST = 32768;
-var EPHEMERAL_LAST = 60999;
-var SOL_SOCKET = 1;
-var SO_TYPE = 3;
-var SO_ERROR = 4;
-var SO_SNDBUF = 7;
-var SO_RCVBUF = 8;
-var SO_ACCEPTCONN = 30;
-var SO_DOMAIN = 39;
-var SOCK_STREAM = 1;
-var AF_UNIX = 1;
-var AF_INET = 2;
-var SHUT_RD = 0;
-var SHUT_WR = 1;
-var SHUT_RDWR = 2;
-function isLoopback(host) {
-  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
-}
-async function pipeCall(op) {
-  try {
-    return await op();
-  } catch (e) {
-    if (e instanceof PipeError) throw new KernelError(e.code);
-    throw e;
-  }
-}
-var Changes = class {
-  waiters = [];
-  wait(signal) {
+  changed(signal) {
     if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
     return new Promise((resolve, reject) => {
       const onAbort = () => {
@@ -5192,267 +5321,250 @@ var Changes = class {
     for (const resolve of waiters) resolve();
   }
 };
-function link(a, b) {
-  const ab = new KernelPipe();
-  const ba = new KernelPipe();
-  for (const pipe of [ab, ba]) {
-    pipe.openRead();
-    pipe.openWrite();
-  }
-  a.attach({ rx: ba, tx: ab });
-  b.attach({ rx: ab, tx: ba });
-}
-var KernelSocket = class _KernelSocket {
-  net;
-  domain;
-  state = "open";
-  local;
-  peer;
-  link;
-  readShut = false;
-  writeShut = false;
+
+// src/kernel/pty.ts
+var PtyPair = class {
+  slave;
+  locked = true;
+  packet = false;
   queue = [];
-  backlog = 0;
-  bound = false;
-  changes = new Changes();
-  options = /* @__PURE__ */ new Map();
-  constructor(net, domain) {
-    this.net = net;
-    this.domain = domain;
-  }
-  attach(link2) {
-    this.link = link2;
-    this.state = "connected";
-    this.changes.wake();
-  }
-  get listening() {
-    return this.state === "listening";
-  }
-  connection() {
-    if (!this.link || this.state !== "connected") throw new KernelError("ENOTCONN");
-    return this.link;
-  }
-  async read(max, signal) {
-    const { rx } = this.connection();
-    if (this.readShut || max <= 0) return new Uint8Array(0);
-    return pipeCall(() => rx.read(max, signal));
-  }
-  async peek(max, signal) {
-    const { rx } = this.connection();
-    if (this.readShut || max <= 0) return new Uint8Array(0);
-    return pipeCall(() => rx.peek(max, signal));
-  }
-  async write(bytes, signal) {
-    const { tx } = this.connection();
-    if (this.writeShut) throw new KernelError("EPIPE");
-    return pipeCall(() => tx.write(bytes, signal));
-  }
-  poll() {
-    if (this.state === "listening") {
-      return { readable: this.queue.length > 0, writable: false, hangup: false };
-    }
-    if (this.state !== "connected" || !this.link) {
-      return { readable: false, writable: false, hangup: true };
-    }
-    const { rx, tx } = this.link;
-    return {
-      readable: this.readShut || rx.readReady,
-      writable: this.writeShut || tx.writeReady,
-      hangup: rx.writersGone && tx.readersGone
-    };
-  }
-  changed(signal) {
-    const own = this.changes.wait(signal);
-    if (this.state !== "connected" || !this.link) return own;
-    const waits = [own, this.link.rx.changed(signal), this.link.tx.changed(signal)];
-    for (const wait of waits) wait.catch(() => void 0);
-    return pipeCall(() => Promise.race(waits));
-  }
-  bind(addr) {
-    if (this.state !== "open" || this.local) throw new KernelError("EINVAL");
-    if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
-    this.local = this.net.bind(this, addr);
-    this.bound = true;
+  waiters = [];
+  masterOpen = true;
+  slaveRefs = 0;
+  slaveSeen = false;
+  index;
+  onFree;
+  constructor(index, signal, onFree) {
+    this.index = index;
+    this.onFree = onFree;
+    this.slave = new KernelTty(
+      { write: (bytes) => this.fromSlave(bytes) },
+      (sig) => signal(this.slave, sig)
+    );
+    this.slave.name = `/dev/pts/${index}`;
   }
-  listen(backlog) {
-    if (this.state === "connected") throw new KernelError("EISCONN");
-    if (this.state !== "open" && this.state !== "listening") throw new KernelError("EINVAL");
-    if (!this.local) {
-      if (this.domain === "unix") throw new KernelError("EINVAL");
-      this.bind({ family: "inet", host: "0.0.0.0", port: 0 });
-    }
-    this.backlog = Math.min(Math.max(backlog, 1), SOMAXCONN);
-    this.state = "listening";
+  master() {
+    return new OpenFile({
+      read: (max, signal) => this.readMaster(max, signal),
+      write: async (bytes) => {
+        this.slave.receive(bytes);
+        return bytes.length;
+      },
+      poll: () => ({
+        readable: this.queue.length > 0 || this.slaveGone,
+        writable: true,
+        hangup: this.slaveGone
+      }),
+      changed: (signal) => this.changed(signal),
+      close: () => this.closeMaster(),
+      pty: this
+    });
   }
-  async accept(signal, nonblock = false) {
-    for (; ; ) {
-      if (this.state !== "listening") throw new KernelError("EINVAL");
-      const next = this.queue.shift();
-      if (next) return next;
-      if (nonblock) throw new KernelError("EAGAIN");
-      await this.changes.wait(signal);
-    }
+  openSlave() {
+    if (!this.masterOpen || this.locked) throw new KernelError("EIO");
+    const file = this.slave.file().file;
+    this.slaveRefs += 1;
+    this.slaveSeen = true;
+    return new OpenFile({ ...file, close: () => this.closeSlave() });
   }
-  offer(server) {
-    if (this.state !== "listening" || this.queue.length >= this.backlog) return false;
-    this.queue.push(server);
-    this.changes.wake();
-    return true;
+  get slaveGone() {
+    return this.slaveSeen && this.slaveRefs === 0;
   }
-  connect(addr) {
-    if (this.state === "connected") throw new KernelError("EISCONN");
-    if (this.state !== "open") throw new KernelError("EINVAL");
-    if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
-    const target = this.net.target(addr);
-    if (!this.local) {
-      if (addr.family === "inet") {
-        this.local = this.net.bind(this, { family: "inet", host: "127.0.0.1", port: 0 });
-        this.bound = true;
-      } else this.local = { family: "unix", path: "" };
-    }
-    const server = new _KernelSocket(this.net, this.domain);
-    server.local = addr.family === "inet" ? { ...addr, host: canonicalHost2(addr.host) } : addr;
-    server.peer = this.local;
-    this.peer = server.local;
-    link(this, server);
-    if (!target.offer(server)) {
-      this.unlink();
-      server.close();
-      throw new KernelError("ECONNREFUSED");
-    }
+  fromSlave(bytes) {
+    if (!this.masterOpen) return;
+    this.queue.push(bytes.slice());
+    this.wake();
   }
-  unlink() {
-    const link2 = this.link;
-    if (link2) {
-      link2.rx.closeRead();
-      link2.tx.closeWrite();
+  async readMaster(max, signal) {
+    while (this.queue.length === 0) {
+      if (this.slaveGone) throw new KernelError("EIO");
+      await this.changed(signal);
     }
-    this.link = void 0;
-    this.peer = void 0;
-    this.state = "open";
-  }
-  shutdown(how) {
-    const { rx, tx } = this.connection();
-    if (how !== SHUT_RD && how !== SHUT_WR && how !== SHUT_RDWR) throw new KernelError("EINVAL");
-    if (how !== SHUT_WR && !this.readShut) {
-      this.readShut = true;
-      rx.closeRead();
+    const status = this.packet ? 1 : 0;
+    const chunks = [];
+    let n = 0;
+    while (this.queue.length > 0 && n < max - status) {
+      const next = this.queue[0];
+      const take = next.subarray(0, max - status - n);
+      chunks.push(take);
+      n += take.length;
+      if (take.length < next.length) this.queue[0] = next.subarray(take.length);
+      else this.queue.shift();
     }
-    if (how !== SHUT_RD && !this.writeShut) {
-      this.writeShut = true;
-      tx.closeWrite();
+    const out = new Uint8Array(status + n);
+    let at = status;
+    for (const chunk2 of chunks) {
+      out.set(chunk2, at);
+      at += chunk2.length;
     }
-    this.changes.wake();
+    return out;
   }
-  getOption(level, name2) {
-    if (level === SOL_SOCKET) {
-      switch (name2) {
-        case SO_TYPE:
-          return SOCK_STREAM;
-        case SO_ERROR:
-          return 0;
-        case SO_ACCEPTCONN:
-          return this.state === "listening" ? 1 : 0;
-        case SO_DOMAIN:
-          return this.domain === "inet" ? AF_INET : AF_UNIX;
-        case SO_SNDBUF:
-        case SO_RCVBUF:
-          return this.options.get(`${level}:${name2}`) ?? PIPE_CAPACITY;
-      }
-    }
-    return this.options.get(`${level}:${name2}`) ?? 0;
+  closeMaster() {
+    this.masterOpen = false;
+    this.queue = [];
+    this.slave.hangup();
+    this.slave.signalHangup();
+    this.freeIfUnused();
   }
-  setOption(level, name2, value) {
-    this.options.set(`${level}:${name2}`, value);
+  closeSlave() {
+    this.slaveRefs -= 1;
+    this.wake();
+    this.freeIfUnused();
   }
-  close() {
-    const was = this.state;
-    this.state = "closed";
-    if (was === "listening") {
-      for (const pending of this.queue.splice(0)) pending.close();
-    }
-    if (this.link) {
-      if (!this.readShut) this.link.rx.closeRead();
-      if (!this.writeShut) this.link.tx.closeWrite();
-      this.readShut = true;
-      this.writeShut = true;
-    }
-    if (this.bound && this.local) this.net.release(this.local, this);
-    this.bound = false;
-    this.changes.wake();
+  freeIfUnused() {
+    if (!this.masterOpen && this.slaveRefs === 0) this.onFree(this);
   }
-  static pair(net, domain) {
-    const a = new _KernelSocket(net, domain);
-    const b = new _KernelSocket(net, domain);
-    const name2 = domain === "inet" ? { family: "inet", host: "127.0.0.1", port: 0 } : { family: "unix", path: "" };
-    a.local = b.local = a.peer = b.peer = name2;
-    link(a, b);
-    return [a, b];
+  changed(signal) {
+    if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
+    return new Promise((resolve, reject) => {
+      const onAbort = () => {
+        this.waiters = this.waiters.filter((w) => w !== waiter);
+        reject(new KernelError("EINTR"));
+      };
+      const waiter = () => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve();
+      };
+      this.waiters.push(waiter);
+      signal?.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  wake() {
+    const waiters = this.waiters;
+    this.waiters = [];
+    for (const resolve of waiters) resolve();
   }
 };
-function canonicalHost2(host) {
-  return host === "0.0.0.0" ? "127.0.0.1" : host;
-}
-function keyOf(addr) {
-  return addr.family === "inet" ? `inet:${addr.port}` : `unix:${addr.path}`;
-}
-var LoopbackNet = class {
-  bound = /* @__PURE__ */ new Map();
-  activators = /* @__PURE__ */ new Map();
-  nextEphemeral = EPHEMERAL_FIRST;
-  activate(addr, start) {
-    this.activators.set(keyOf(addr), start);
+var PtyTable = class {
+  pairs = /* @__PURE__ */ new Map();
+  signal;
+  constructor(signal) {
+    this.signal = signal;
   }
-  socket(domain) {
-    return new KernelSocket(this, domain);
+  open() {
+    let index = 0;
+    while (this.pairs.has(index)) index += 1;
+    const pair = new PtyPair(index, this.signal, (p) => this.pairs.delete(p.index));
+    this.pairs.set(index, pair);
+    return { pair, master: pair.master() };
   }
-  listen(addr, backlog = 128) {
-    const socket = this.socket(addr.family);
-    socket.bind(addr);
-    socket.listen(backlog);
-    return socket;
+  get(index) {
+    const pair = this.pairs.get(index);
+    if (!pair) throw new KernelError("ENOENT");
+    return pair;
   }
-  connect(addr) {
-    const socket = this.socket(addr.family);
-    socket.connect(addr);
-    return socket;
+  numbers() {
+    return [...this.pairs.keys()].sort((a, b) => a - b);
   }
-  bind(socket, addr) {
-    if (addr.family === "unix") {
-      if (addr.path === "") throw new KernelError("EINVAL");
-    } else if (addr.host !== "0.0.0.0" && !isLoopback(addr.host)) {
-      throw new KernelError("EADDRNOTAVAIL");
+};
+var PTY_OPS = [
+  "pty-open",
+  "pty-slave-open",
+  "pty-number",
+  "pty-lock",
+  "pty-ctty",
+  "pty-packet",
+  "pty-list",
+  "pty-winsz-set"
+];
+function masterOf(ctx, fd) {
+  const pair = ctx.fds.get(fd).file.pty;
+  if (!pair) throw new KernelError("ENOTTY");
+  return pair;
+}
+function terminalOf(ctx, fd) {
+  const file = ctx.fds.get(fd).file;
+  const tty = file.tty ?? file.pty?.slave;
+  if (!tty) throw new KernelError("ENOTTY");
+  return tty;
+}
+var json3 = (value) => ({ ok: true, kind: "json", json: value });
+var done3 = { ok: true, kind: "void" };
+function ptySyscall(req, ctx) {
+  switch (req.op) {
+    case "pty-open": {
+      if (!ctx.ptys) throw new KernelError("ENOENT");
+      return json3(ctx.fds.install(ctx.ptys.open().master, 3));
     }
-    const named = addr.family === "inet" && addr.port === 0 ? { ...addr, port: this.ephemeral() } : addr;
-    const key = keyOf(named);
-    if (this.bound.has(key)) throw new KernelError("EADDRINUSE");
-    this.bound.set(key, socket);
-    return named;
-  }
-  release(addr, socket) {
-    const key = keyOf(addr);
-    if (this.bound.get(key) === socket) this.bound.delete(key);
-  }
-  target(addr) {
-    if (addr.family === "inet" && !isLoopback(canonicalHost2(addr.host))) {
-      throw new KernelError("ENETUNREACH");
+    case "pty-slave-open": {
+      if (!ctx.ptys) throw new KernelError("ENOENT");
+      const pair = ctx.ptys.get(req.n);
+      const fd = ctx.fds.install(pair.openSlave(), 3);
+      if (!req.noctty) ctx.jobs?.acquireTerminal(ctx.pid, pair.slave);
+      return json3(fd);
     }
-    const key = keyOf(addr);
-    if (!this.bound.has(key)) this.activators.get(key)?.();
-    const socket = this.bound.get(key);
-    if (!socket?.listening) throw new KernelError("ECONNREFUSED");
-    return socket;
+    case "pty-number":
+      return json3(masterOf(ctx, req.fd).index);
+    case "pty-lock":
+      masterOf(ctx, req.fd).locked = req.lock;
+      return done3;
+    case "pty-ctty": {
+      const tty = terminalOf(ctx, req.fd);
+      const leader = ctx.jobs?.getsid(ctx.pid, 0) === ctx.pid;
+      if (leader && ctx.jobs?.controllingTerminal(ctx.pid) === tty) return done3;
+      if (!ctx.jobs?.acquireTerminal(ctx.pid, tty)) throw new KernelError("EPERM");
+      return done3;
+    }
+    case "pty-list":
+      return json3(ctx.ptys?.numbers() ?? []);
+    case "pty-packet":
+      masterOf(ctx, req.fd).packet = req.on;
+      return done3;
+    case "pty-winsz-set":
+      terminalOf(ctx, req.fd).resize(req.cols, req.rows);
+      return done3;
   }
-  ephemeral() {
-    const span = EPHEMERAL_LAST - EPHEMERAL_FIRST + 1;
-    for (let i = 0; i < span; i++) {
-      const port = this.nextEphemeral;
-      this.nextEphemeral = port === EPHEMERAL_LAST ? EPHEMERAL_FIRST : port + 1;
-      if (!this.bound.has(`inet:${port}`)) return port;
+}
+
+// src/kernel/select.ts
+function ready(fds, read, write) {
+  const hangup = /* @__PURE__ */ new Set();
+  const pick = (list, dir) => list.filter((fd) => {
+    const state = pollFile(fds.get(fd).file);
+    if (state.hangup) hangup.add(fd);
+    return state[dir] || state.hangup;
+  });
+  const out = { read: pick(read, "readable"), write: pick(write, "writable") };
+  if (hangup.size > 0) out.hangup = [...hangup];
+  return out;
+}
+function interruption(signal) {
+  const { promise, reject } = Promise.withResolvers();
+  const fail = () => reject(new KernelError("EINTR"));
+  if (signal.aborted) fail();
+  else signal.addEventListener("abort", fail, { once: true });
+  return { promise, done: () => signal.removeEventListener("abort", fail) };
+}
+async function selectFds(fds, read, write, timeoutMs, interrupt) {
+  const deadline = timeoutMs < 0 ? Number.POSITIVE_INFINITY : Date.now() + timeoutMs;
+  const interrupted2 = interruption(interrupt);
+  interrupted2.promise.catch(() => {
+  });
+  try {
+    return await waitReady(fds, read, write, deadline, interrupted2.promise);
+  } finally {
+    interrupted2.done();
+  }
+}
+async function waitReady(fds, read, write, deadline, interrupted2) {
+  for (; ; ) {
+    const now = ready(fds, read, write);
+    if (now.read.length > 0 || now.write.length > 0 || Date.now() >= deadline) return now;
+    const round = new AbortController();
+    const changes = [.../* @__PURE__ */ new Set([...read, ...write])].flatMap((fd) => {
+      const file = fds.get(fd).file;
+      return file.changed === void 0 ? [] : [file.changed(round.signal).catch(() => void 0)];
+    });
+    let timer;
+    const expiry = deadline === Number.POSITIVE_INFINITY ? [] : [new Promise((resolve) => timer = setTimeout(resolve, deadline - Date.now()))];
+    try {
+      await Promise.race([...changes, ...expiry, interrupted2]);
+    } finally {
+      round.abort();
+      clearTimeout(timer);
     }
-    throw new KernelError("EADDRINUSE");
   }
-};
+}
 
 // src/kernel/socket-syscalls.ts
 var SOCKET_OPS = [
@@ -6984,8 +7096,8 @@ function mediumSlot(lost, onLost) {
 
 // src/mount/fsa.ts
 var FSA_CAPABILITIES = { listingStats: true };
-var codeOf = (err) => err?.code;
-var denied = (err) => codeOf(err) === "EACCES" || err?.name === "NotAllowedError";
+var codeOf2 = (err) => err?.code;
+var denied = (err) => codeOf2(err) === "EACCES" || err?.name === "NotAllowedError";
 function attrOf(st) {
   return {
     kind: st.isDirectory ? "directory" : st.isSymbolicLink ? "symlink" : "file",
@@ -7007,7 +7119,7 @@ function kernelFsHandlers(fs) {
     try {
       return await fs.stat(path);
     } catch (err) {
-      if (codeOf(err) === "ENOENT") return void 0;
+      if (codeOf2(err) === "ENOENT") return void 0;
       throw err;
     }
   }
@@ -7091,8 +7203,8 @@ function removableMedium(onLost, open = (handle) => new OpfsFs(handle)) {
 
 // src/mount/hostfs.ts
 var HOSTFS_IO = 16 * 1024 * 1024;
-var codeOf2 = (err) => err?.code;
-var unreachable = (err) => codeOf2(err) === "ENOTCONN";
+var codeOf3 = (err) => err?.code;
+var unreachable = (err) => codeOf3(err) === "ENOTCONN";
 function rel(path) {
   return path.replace(/^\/+/, "");
 }
@@ -7227,7 +7339,7 @@ function hostfsHandlers(current) {
     try {
       return { opened: await opening(), restore: void 0 };
     } catch (err) {
-      if (!flags.write || codeOf2(err) !== "EACCES") throw err;
+      if (!flags.write || codeOf3(err) !== "EACCES") throw err;
       const mode = (await client.call("stat", { path: rel(path) })).mode ?? 0;
       if (mode & 128) throw err;
       const restore = { path: rel(path), mode };
@@ -8469,6 +8581,14 @@ function act2(session, req) {
 function dirsChannel(name2) {
   return name2 === false ? void 0 : `slicc-kernel-dirs:${name2}`;
 }
+function caDb(req) {
+  const name2 = req.ca ?? (req.metadata ? `${req.metadata}-ca` : CA_DB);
+  const taken = [req.metadata ?? META_DB, req.media ?? `${req.metadata ?? META_DB}:media`];
+  if (name2 !== false && taken.includes(name2)) {
+    throw new Error(`the CA cannot share the IndexedDB database ${name2}`);
+  }
+  return name2;
+}
 async function stores(deps, name2, media) {
   const handles = media ?? (name2 === false ? false : `${name2}:media`);
   if (handles !== false && handles === name2) {
@@ -8512,6 +8632,12 @@ function serveKernel(port, deps) {
     void served.closed.then(() => clients.delete(served));
     return port2;
   }
+  async function dial(req) {
+    const socket = dialSocket((await ready2()).net, req.port, req.host);
+    const { port1, port2 } = new MessageChannel();
+    serveSocket(socket, port1);
+    return port2;
+  }
   async function ready2() {
     if (!launcher) throw new Error("the kernel is not initialized");
     return launcher;
@@ -8545,7 +8671,7 @@ function serveKernel(port, deps) {
         onMountPending: (medium) => port.postMessage({ medium }),
         ...req.hostfs ? { hostfs: askGrant } : {},
         ...mountPolicy(req.processMounts),
-        caStore: caStore(deps.metadata ? name2 : false)
+        caStore: caStore(deps.metadata ? caDb(req) : false)
       });
       await started.prepare();
       return started;
@@ -8564,6 +8690,7 @@ function serveKernel(port, deps) {
     if (req.op === "init") return init(req);
     if (req.op === "open-terminal") return terminal(req);
     if (req.op === "connect") return connect();
+    if (req.op === "dial") return dial(req);
     if (req.op === "mount" || req.op === "umount" || req.op === "mounts" || req.op === "insert")
       return mountOp(req);
     if (req.op === "terminal") {