@ai-ecoverse/slicc-kernel 1.2.0 → 1.3.0

package/dist/kernel-worker.js

@@ -71,18 +71,18 @@ var IndexedDbMeta = class {
     const [transaction, store] = this.transaction("readonly");
     const found = paths.map(() => void 0);
     paths.forEach((path, i) => {
-      const request = store.get(path);
-      request.onsuccess = () => {
-        found[i] = request.result;
+      const request2 = store.get(path);
+      request2.onsuccess = () => {
+        found[i] = request2.result;
       };
     });
     return settle(transaction, () => found);
   }
   async update(path, change) {
     const [transaction, store] = this.transaction("readwrite");
-    const request = store.get(path);
-    request.onsuccess = () => {
-      const next = change(request.result);
+    const request2 = store.get(path);
+    request2.onsuccess = () => {
+      const next = change(request2.result);
       if (next) store.put(next);
       else store.delete(path);
     };
@@ -114,8 +114,8 @@ var IndexedDbMeta = class {
   }
   async links(dir) {
     const [transaction, store] = this.transaction("readonly");
-    const request = store.index("dir").getAll(dir);
-    return settle(transaction, () => request.result);
+    const request2 = store.index("dir").getAll(dir);
+    return settle(transaction, () => request2.result);
   }
   async under(path) {
     const [transaction, store] = this.transaction("readonly");
@@ -130,20 +130,20 @@ var IndexedDbMeta = class {
   }
   async all() {
     const [transaction, store] = this.transaction("readonly");
-    const request = store.getAll();
-    return settle(transaction, () => request.result);
+    const request2 = store.getAll();
+    return settle(transaction, () => request2.result);
   }
 };
-function openMeta(name, factory) {
+function openMeta(name2, factory) {
   return new Promise((resolve, reject) => {
-    const request = factory.open(name, META_VERSION);
-    request.onupgradeneeded = (event) => {
+    const request2 = factory.open(name2, META_VERSION);
+    request2.onupgradeneeded = (event) => {
       if (event.oldVersion < 1) {
-        request.result.createObjectStore(META_STORE, { keyPath: "path" }).createIndex("dir", "dir");
+        request2.result.createObjectStore(META_STORE, { keyPath: "path" }).createIndex("dir", "dir");
       }
     };
-    request.onsuccess = () => resolve(new IndexedDbMeta(request.result));
-    request.onerror = () => reject(request.error);
+    request2.onsuccess = () => resolve(new IndexedDbMeta(request2.result));
+    request2.onerror = () => reject(request2.error);
   });
 }
 
@@ -193,8 +193,8 @@ var ERRNO_BY_DOM_ERROR = {
 };
 function translate(err, path) {
   if (typeof err?.code === "string") return err;
-  const name = err?.name;
-  return fsError(typeof name === "string" && ERRNO_BY_DOM_ERROR[name] || "EIO", path);
+  const name2 = err?.name;
+  return fsError(typeof name2 === "string" && ERRNO_BY_DOM_ERROR[name2] || "EIO", path);
 }
 function missing(err) {
   const code = err?.code;
@@ -240,19 +240,19 @@ var OpfsFs = class {
   }
   async parent(path) {
     const parts = split(path);
-    const name = parts.pop();
-    if (name === void 0) throw fsError("EBUSY", path);
-    return [await this.dir(`/${parts.join("/")}`), name];
+    const name2 = parts.pop();
+    if (name2 === void 0) throw fsError("EBUSY", path);
+    return [await this.dir(`/${parts.join("/")}`), name2];
   }
   async handle(path) {
     if (split(path).length === 0) return this.root;
-    const [dir, name] = await this.parent(path);
+    const [dir, name2] = await this.parent(path);
     try {
-      return await dir.getFileHandle(name);
+      return await dir.getFileHandle(name2);
     } catch (err) {
       if (err?.name !== "TypeMismatchError") throw translate(err, path);
     }
-    return dir.getDirectoryHandle(name);
+    return dir.getDirectoryHandle(name2);
   }
   real(path) {
     return this.handle(path).then(
@@ -274,11 +274,11 @@ var OpfsFs = class {
         return { path: current, handle: await this.handle(current) };
       } catch (err) {
         if (!missing(err)) throw err;
-        const link = await this.linkAlong(current);
-        if (!link) throw err;
-        if (link.path === current && !follow) return { path: current, link };
-        const rest = current.slice(link.path.length);
-        current = resolvePath(parentOf2(link.path), `${link.link}${rest}`);
+        const link2 = await this.linkAlong(current);
+        if (!link2) throw err;
+        if (link2.path === current && !follow) return { path: current, link: link2 };
+        const rest = current.slice(link2.path.length);
+        current = resolvePath(parentOf2(link2.path), `${link2.link}${rest}`);
       }
     }
     throw fsError("ELOOP", path);
@@ -305,15 +305,15 @@ var OpfsFs = class {
     };
   }
   linkStat(entry) {
-    const time = new Date(entry.mtimeMs ?? 0);
+    const time2 = new Date(entry.mtimeMs ?? 0);
     return {
       isFile: false,
       isDirectory: false,
       isSymbolicLink: true,
       size: new TextEncoder().encode(entry.link).length,
       mode: S_IFLNK | 511,
-      mtime: time,
-      atime: time,
+      mtime: time2,
+      atime: time2,
       ctime: new Date(entry.ctimeMs ?? 0),
       ino: entry.ino ?? inodeOf(entry.path)
     };
@@ -364,10 +364,10 @@ var OpfsFs = class {
   }
   async writeFile(path, content) {
     const target = await this.writeTarget(path);
-    const [dir, name] = await this.parent(target);
+    const [dir, name2] = await this.parent(target);
     let file;
     try {
-      file = await dir.getFileHandle(name, { create: true });
+      file = await dir.getFileHandle(name2, { create: true });
     } catch (err) {
       const code = err?.name === "TypeMismatchError" ? "EISDIR" : null;
       throw code ? fsError(code, path) : translate(err, path);
@@ -380,26 +380,26 @@ var OpfsFs = class {
     const found = await this.locate(path, true);
     const handle = found.handle;
     if (handle.kind !== "directory") throw fsError("ENOTDIR", path);
-    const children = /* @__PURE__ */ new Map();
-    for await (const child of handle.values()) children.set(child.name, child);
-    for (const link of await this.meta.links(found.path)) {
-      const name = baseOf(link.path);
-      if (!children.has(name)) children.set(name, link);
+    const children2 = /* @__PURE__ */ new Map();
+    for await (const child of handle.values()) children2.set(child.name, child);
+    for (const link2 of await this.meta.links(found.path)) {
+      const name2 = baseOf(link2.path);
+      if (!children2.has(name2)) children2.set(name2, link2);
     }
-    return [found.path, [...children].sort(([a], [b]) => a < b ? -1 : 1)];
+    return [found.path, [...children2].sort(([a], [b]) => a < b ? -1 : 1)];
   }
   async readdir(path) {
-    return (await this.listing(path))[1].map(([name]) => name);
+    return (await this.listing(path))[1].map(([name2]) => name2);
   }
   async readdirStat(path) {
-    const [dir, children] = await this.listing(path);
+    const [dir, children2] = await this.listing(path);
     const base = dir === "/" ? "" : dir;
-    const metas = await this.meta.get(children.map(([name]) => `${base}/${name}`));
+    const metas = await this.meta.get(children2.map(([name2]) => `${base}/${name2}`));
     return Promise.all(
-      children.map(async ([name, child], i) => {
-        if (!isHandle(child)) return [name, this.linkStat(child)];
-        const stat = await this.statOf(`${base}/${name}`, child, metas[i]).catch(() => null);
-        return [name, stat];
+      children2.map(async ([name2, child], i) => {
+        if (!isHandle(child)) return [name2, this.linkStat(child)];
+        const stat = await this.statOf(`${base}/${name2}`, child, metas[i]).catch(() => null);
+        return [name2, stat];
       })
     );
   }
@@ -432,9 +432,9 @@ var OpfsFs = class {
       throw error;
     }
     if (found.handle) {
-      const [dir, name] = await this.parent(found.path);
+      const [dir, name2] = await this.parent(found.path);
       try {
-        await dir.removeEntry(name, { recursive: options.recursive === true });
+        await dir.removeEntry(name2, { recursive: options.recursive === true });
       } catch (err) {
         throw translate(err, path);
       }
@@ -473,9 +473,9 @@ var OpfsFs = class {
       return;
     }
     const dir = parent.handle;
-    const name = baseOf(destination);
+    const name2 = baseOf(destination);
     const swap = targetStat?.isDirectory === true;
-    const staging = swap ? `.${name}.${crypto.randomUUID()}` : name;
+    const staging = swap ? `.${name2}.${crypto.randomUUID()}` : name2;
     const timed = await this.explicitTimes(source.path);
     const moved2 = await this.place(source.handle, dir, staging);
     if (swap) await this.rm(destination, { recursive: true });
@@ -484,7 +484,7 @@ var OpfsFs = class {
     let copied = !moved2;
     if (swap) {
       const staged = await dir.getDirectoryHandle(staging);
-      const placed = await this.place(staged, dir, name);
+      const placed = await this.place(staged, dir, name2);
       if (!placed) await dir.removeEntry(staging, { recursive: true });
       copied ||= !placed;
     }
@@ -509,28 +509,28 @@ var OpfsFs = class {
       await this.meta.update(path + rest, (entry) => entry && { ...entry, mtimeFor });
     }
   }
-  async place(handle, dir, name) {
-    const moved2 = await handle.move?.(dir, name).then(
+  async place(handle, dir, name2) {
+    const moved2 = await handle.move?.(dir, name2).then(
       () => true,
       () => false
     );
     if (moved2) return true;
     try {
-      await this.copy(handle, dir, name);
+      await this.copy(handle, dir, name2);
     } catch (err) {
-      if (handle.kind === "directory") await dir.removeEntry(name, { recursive: true });
-      throw translate(err, name);
+      if (handle.kind === "directory") await dir.removeEntry(name2, { recursive: true });
+      throw translate(err, name2);
     }
     return false;
   }
-  async copy(handle, dir, name) {
+  async copy(handle, dir, name2) {
     if (handle.kind === "file") {
-      const writable = await (await dir.getFileHandle(name, { create: true })).createWritable();
+      const writable = await (await dir.getFileHandle(name2, { create: true })).createWritable();
       await writable.write(await handle.getFile());
       await writable.close();
       return;
     }
-    const target = await dir.getDirectoryHandle(name, { create: true });
+    const target = await dir.getDirectoryHandle(name2, { create: true });
     for await (const child of handle.values()) await this.copy(child, target, child.name);
   }
   async symlink(target, path) {
@@ -595,259 +595,6 @@ var OpfsFs = class {
   }
 };
 
-// src/kernel/signals.ts
-var SIG = {
-  HUP: 1,
-  INT: 2,
-  QUIT: 3,
-  ILL: 4,
-  TRAP: 5,
-  ABRT: 6,
-  BUS: 7,
-  FPE: 8,
-  KILL: 9,
-  USR1: 10,
-  SEGV: 11,
-  USR2: 12,
-  PIPE: 13,
-  ALRM: 14,
-  TERM: 15,
-  STKFLT: 16,
-  CHLD: 17,
-  CONT: 18,
-  STOP: 19,
-  TSTP: 20,
-  TTIN: 21,
-  TTOU: 22,
-  URG: 23,
-  XCPU: 24,
-  XFSZ: 25,
-  VTALRM: 26,
-  PROF: 27,
-  WINCH: 28,
-  POLL: 29,
-  PWR: 30,
-  SYS: 31
-};
-var IGNORED_BY_DEFAULT = /* @__PURE__ */ new Set([SIG.CHLD, SIG.URG, SIG.WINCH]);
-var STOPPING = /* @__PURE__ */ new Set([SIG.STOP, SIG.TSTP, SIG.TTIN, SIG.TTOU]);
-function defaultAction(sig) {
-  if (sig === SIG.CONT) return "continue";
-  if (STOPPING.has(sig)) return "stop";
-  return IGNORED_BY_DEFAULT.has(sig) ? "ignore" : "terminate";
-}
-function isSignal(sig) {
-  return Number.isInteger(sig) && sig >= 1 && sig <= 31;
-}
-function sigbit(sig) {
-  return 1 << sig;
-}
-var SIGNAL_BY_NAME = {
-  SIGINT: SIG.INT,
-  SIGTERM: SIG.TERM,
-  SIGKILL: SIG.KILL,
-  SIGSTOP: SIG.STOP,
-  SIGCONT: SIG.CONT
-};
-
-// src/commands.ts
-var NAME = /^[A-Za-z0-9._+-]+$/;
-var ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
-var PACKAGE = /\$\{package\}/g;
-function inside(pkg, rel) {
-  if (typeof rel !== "string" || rel === "") return void 0;
-  const clean = rel.replace(/^\.\//, "");
-  if (clean.startsWith("/") || clean.split("/").includes("..")) return void 0;
-  return `${pkg}/${clean}`;
-}
-function envOf(pkg, raw) {
-  const env = {};
-  if (!raw || typeof raw !== "object") return env;
-  for (const [key, value] of Object.entries(raw)) {
-    if (ENV_KEY.test(key) && typeof value === "string") env[key] = value.replace(PACKAGE, pkg);
-  }
-  return env;
-}
-function argsOf(pkg, raw) {
-  if (!Array.isArray(raw) || raw.length === 0) return void 0;
-  if (!raw.every((arg) => typeof arg === "string")) return void 0;
-  return raw.map((arg) => arg.replace(PACKAGE, pkg));
-}
-function commandsOf(pkg, manifest) {
-  const slicc = manifest.slicc;
-  if (!slicc || typeof slicc !== "object" || (slicc.abi ?? "emscripten") !== "emscripten")
-    return [];
-  const entries = slicc.commands;
-  if (!entries || typeof entries !== "object") return [];
-  const shared = envOf(pkg, slicc.env);
-  const out = [];
-  for (const [name, raw] of Object.entries(entries)) {
-    if (!NAME.test(name) || name === "." || name === ".." || !raw || typeof raw !== "object") {
-      continue;
-    }
-    const glue = inside(pkg, raw.glue);
-    const wasm = inside(pkg, raw.wasm);
-    if ((raw.abi ?? "emscripten") !== "emscripten" || !glue || !wasm) continue;
-    const argv0 = typeof raw.argv0 === "string" && raw.argv0 ? raw.argv0 : name;
-    const args = argsOf(pkg, raw.args);
-    const env = { ...shared, ...envOf(pkg, raw.env) };
-    out.push({
-      name,
-      glue,
-      wasm,
-      argv0,
-      ...args ? { args } : {},
-      ...Object.keys(env).length > 0 ? { env } : {}
-    });
-  }
-  return out;
-}
-async function packages(fs, modules) {
-  const names = await fs.readdir(modules).catch(() => []);
-  const dirs = [];
-  for (const name of names) {
-    if (name.startsWith(".")) continue;
-    if (!name.startsWith("@")) {
-      dirs.push(`${modules}/${name}`);
-      continue;
-    }
-    for (const inner of await fs.readdir(`${modules}/${name}`).catch(() => [])) {
-      dirs.push(`${modules}/${name}/${inner}`);
-    }
-  }
-  return dirs;
-}
-async function scanCommands(fs, modules) {
-  const found = /* @__PURE__ */ new Map();
-  for (const pkg of await packages(fs, modules)) {
-    let manifest;
-    try {
-      manifest = JSON.parse(await fs.readFile(`${pkg}/package.json`));
-    } catch {
-      continue;
-    }
-    for (const command of commandsOf(pkg, manifest)) {
-      if (!found.has(command.name)) found.set(command.name, command);
-    }
-  }
-  if (!found.has("sh") && found.has("bash")) {
-    found.set("sh", { ...found.get("bash"), name: "sh", argv0: "sh" });
-  }
-  return found;
-}
-
-// src/fs/commands.ts
-var S_IFDIR2 = 16384;
-var S_IFREG2 = 32768;
-var COMMAND = /^\/(?:usr\/)?bin\/([^/]+)$/;
-var MAX_LINKS2 = 40;
-function missing2(err) {
-  return err?.code === "ENOENT";
-}
-function synthetic(directory, path) {
-  const epoch = /* @__PURE__ */ new Date(0);
-  return {
-    isFile: !directory,
-    isDirectory: directory,
-    isSymbolicLink: false,
-    size: 0,
-    mode: (directory ? S_IFDIR2 : S_IFREG2) | 493,
-    mtime: epoch,
-    atime: epoch,
-    ctime: epoch,
-    ino: inodeOf(path)
-  };
-}
-async function followLinks(fs, path) {
-  let current = path;
-  for (let hops = 0; hops < MAX_LINKS2; hops++) {
-    const st = await fs.lstat(current).catch(() => void 0);
-    if (!st?.isSymbolicLink) return current;
-    const parent = current.slice(0, current.lastIndexOf("/")) || "/";
-    current = fs.resolvePath(parent, await fs.readlink(current));
-  }
-  return current;
-}
-function withCommandDirs(fs, names) {
-  async function children(path) {
-    if (path === "/") return ["bin", "usr"];
-    if (path === "/usr") return ["bin"];
-    if (path === "/bin" || path === "/usr/bin") return [...await names()];
-    return void 0;
-  }
-  async function virtual(path) {
-    if (path === "/usr" || path === "/bin" || path === "/usr/bin") return synthetic(true, path);
-    const name = COMMAND.exec(path)?.[1];
-    return name !== void 0 && (await names()).has(name) ? synthetic(false, path) : void 0;
-  }
-  async function linked(path) {
-    return await virtual(path) ?? virtual(await followLinks(fs, path));
-  }
-  async function stat(path, real) {
-    try {
-      return await real(path);
-    } catch (err) {
-      const found = missing2(err) ? await linked(path) : void 0;
-      if (found) return found;
-      throw err;
-    }
-  }
-  return {
-    resolvePath: (base, path) => fs.resolvePath(base, path),
-    readFile: (path) => fs.readFile(path),
-    async readFileBuffer(path) {
-      try {
-        return await fs.readFileBuffer(path);
-      } catch (err) {
-        if (missing2(err) && (await linked(path))?.isFile) return new Uint8Array(0);
-        throw err;
-      }
-    },
-    writeFile: (path, content) => fs.writeFile(path, content),
-    async exists(path) {
-      return await fs.exists(path) || await linked(path) !== void 0;
-    },
-    stat: (path) => stat(path, (p) => fs.stat(p)),
-    lstat: (path) => stat(path, (p) => fs.lstat(p)),
-    async readdir(path) {
-      const extra = await children(path);
-      if (!extra) return fs.readdir(path);
-      const real = await fs.readdir(path).catch((err) => {
-        if (missing2(err)) return [];
-        throw err;
-      });
-      return [.../* @__PURE__ */ new Set([...real, ...extra])].sort();
-    },
-    async readdirStat(path) {
-      const extra = await children(path);
-      if (!extra) return fs.readdirStat(path);
-      const real = await fs.readdirStat(path).catch((err) => {
-        if (missing2(err)) return [];
-        throw err;
-      });
-      const seen = new Set(real.map(([name]) => name));
-      const base = path === "/" ? "" : path;
-      const added = extra.filter((name) => !seen.has(name));
-      const virtuals = await Promise.all(
-        added.map(
-          async (name) => [
-            name,
-            await virtual(`${base}/${name}`)
-          ]
-        )
-      );
-      return [...real, ...virtuals].sort(([a], [b]) => a < b ? -1 : 1);
-    },
-    mkdir: (path, options) => fs.mkdir(path, options),
-    rm: (path, options) => fs.rm(path, options),
-    rename: (from, to) => fs.rename(from, to),
-    symlink: (target, path) => fs.symlink(target, path),
-    readlink: (path) => fs.readlink(path),
-    chmod: (path, mode) => fs.chmod(path, mode),
-    utimes: (path, atime, mtime) => fs.utimes(path, atime, mtime)
-  };
-}
-
 // src/kernel/pipe.ts
 var PIPE_CAPACITY = 64 * 1024;
 var PipeError = class extends Error {
@@ -916,10 +663,10 @@ var KernelPipe = class {
     }
     const out = new Uint8Array(Math.min(max, this.size));
     let filled = 0;
-    for (const chunk of this.chunks) {
+    for (const chunk2 of this.chunks) {
       if (filled === out.length) break;
-      const count = Math.min(chunk.length, out.length - filled);
-      out.set(chunk.subarray(0, count), filled);
+      const count = Math.min(chunk2.length, out.length - filled);
+      out.set(chunk2.subarray(0, count), filled);
       filled += count;
     }
     return out;
@@ -1147,50 +894,1745 @@ var FdTable = class _FdTable {
         return fd;
       }
     }
-    void Promise.resolve(file.release()).catch(() => void 0);
-    throw new KernelError("EMFILE");
-  }
-  installAt(fd, file) {
-    if (fd < 0 || fd >= _FdTable.MAX_FDS) {
-      void Promise.resolve(file.release()).catch(() => void 0);
-      throw new KernelError("EBADF");
+    void Promise.resolve(file.release()).catch(() => void 0);
+    throw new KernelError("EMFILE");
+  }
+  installAt(fd, file) {
+    if (fd < 0 || fd >= _FdTable.MAX_FDS) {
+      void Promise.resolve(file.release()).catch(() => void 0);
+      throw new KernelError("EBADF");
+    }
+    const previous = this.fds.get(fd);
+    this.fds.set(fd, file);
+    this.cloexec.delete(fd);
+    this.status.delete(fd);
+    void Promise.resolve(previous?.release()).catch(() => void 0);
+  }
+  dup(fd, min = 0) {
+    return this.install(this.get(fd).retain(), min);
+  }
+  dup2(oldFd, newFd) {
+    const file = this.get(oldFd);
+    if (oldFd !== newFd) this.installAt(newFd, file.retain());
+    return newFd;
+  }
+  close(fd) {
+    const file = this.get(fd);
+    this.fds.delete(fd);
+    this.cloexec.delete(fd);
+    this.status.delete(fd);
+    return file.release();
+  }
+  fork() {
+    const child = new _FdTable();
+    for (const [fd, file] of this.fds) child.fds.set(fd, file.retain());
+    for (const fd of this.cloexec) child.cloexec.add(fd);
+    for (const [fd, flags] of this.status) child.status.set(fd, flags);
+    return child;
+  }
+  async closeAll() {
+    const files = [...this.fds.values()];
+    this.fds.clear();
+    this.cloexec.clear();
+    this.status.clear();
+    await Promise.allSettled(files.map((file) => Promise.resolve().then(() => file.release())));
+  }
+};
+
+// src/kernel/net/http1.ts
+var HttpError = class extends Error {
+  status;
+  constructor(status, message2) {
+    super(message2);
+    this.status = status;
+  }
+};
+var CR = 13;
+var LF = 10;
+var READ_SIZE = 64 * 1024;
+var TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+var REASON = {
+  100: "Continue",
+  200: "OK",
+  400: "Bad Request",
+  403: "Forbidden",
+  408: "Request Timeout",
+  411: "Length Required",
+  413: "Content Too Large",
+  417: "Expectation Failed",
+  421: "Misdirected Request",
+  431: "Request Header Fields Too Large",
+  501: "Not Implemented",
+  502: "Bad Gateway",
+  503: "Service Unavailable",
+  505: "HTTP Version Not Supported"
+};
+var Incoming = class {
+  source;
+  buf = new Uint8Array(0);
+  eof = false;
+  constructor(source) {
+    this.source = source;
+  }
+  get buffered() {
+    return this.buf.length;
+  }
+  async fill(signal) {
+    if (this.eof) return false;
+    const chunk2 = await this.source.read(READ_SIZE, signal);
+    if (chunk2.length === 0) {
+      this.eof = true;
+      return false;
+    }
+    const next = new Uint8Array(this.buf.length + chunk2.length);
+    next.set(this.buf);
+    next.set(chunk2, this.buf.length);
+    this.buf = next;
+    return true;
+  }
+  take(n) {
+    const out = this.buf.slice(0, n);
+    this.buf = this.buf.subarray(n);
+    return out;
+  }
+  async some(max, signal) {
+    if (this.buf.length > 0) return this.take(Math.min(max, this.buf.length));
+    if (this.eof) return new Uint8Array(0);
+    const chunk2 = await this.source.read(max, signal);
+    if (chunk2.length === 0) this.eof = true;
+    return chunk2;
+  }
+  async head(limit, signal) {
+    let from = 0;
+    for (; ; ) {
+      const end = headEnd(this.buf, from);
+      if (end > 0) {
+        if (end > limit) throw new HttpError(431, "request head too large");
+        return this.take(end);
+      }
+      if (this.buf.length > limit) throw new HttpError(431, "request head too large");
+      from = Math.max(0, this.buf.length - 3);
+      if (!await this.fill(signal)) {
+        if (this.buf.length === 0) return null;
+        throw new HttpError(400, "connection closed inside a request head");
+      }
+    }
+  }
+  async line(limit, signal) {
+    let from = 0;
+    for (; ; ) {
+      const at = this.buf.indexOf(LF, from);
+      if (at >= 0) {
+        const line = this.take(at + 1);
+        const text = latin1(line.subarray(0, line[at - 1] === CR ? at - 1 : at));
+        return text;
+      }
+      if (this.buf.length > limit) throw new HttpError(400, "line too long");
+      from = this.buf.length;
+      if (!await this.fill(signal)) throw new HttpError(400, "connection closed inside a body");
+    }
+  }
+  async exactly(n, signal) {
+    while (this.buf.length < n) {
+      if (!await this.fill(signal)) throw new HttpError(400, "connection closed inside a body");
+    }
+    return this.take(n);
+  }
+};
+function headEnd(buf, from) {
+  for (let i = from; i < buf.length; i++) {
+    if (buf[i] !== LF) continue;
+    if (buf[i + 1] === LF) return i + 2;
+    if (buf[i + 1] === CR && buf[i + 2] === LF) return i + 3;
+  }
+  return 0;
+}
+function latin1(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    out += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  }
+  return out;
+}
+function latin1Bytes(text) {
+  const out = new Uint8Array(text.length);
+  for (let i = 0; i < text.length; i++) out[i] = text.charCodeAt(i) & 255;
+  return out;
+}
+function parseRequestHead(bytes) {
+  const lines = latin1(bytes).split(/\r?\n/);
+  while (lines.length > 0 && lines[0] === "") lines.shift();
+  const match = /^([!#$%&'*+\-.^_`|~0-9A-Za-z]+) (\S+) HTTP\/(\d)\.(\d)$/.exec(lines.shift() ?? "");
+  if (!match) throw new HttpError(400, "malformed request line");
+  if (match[3] !== "1") throw new HttpError(505, `HTTP/${match[3]}.${match[4]} is not supported`);
+  return {
+    method: match[1],
+    target: match[2],
+    minor: Number(match[4]),
+    headers: parseFields(lines)
+  };
+}
+function parseFields(lines) {
+  const headers = [];
+  for (const line of lines) {
+    if (line === "") continue;
+    if (line.startsWith(" ") || line.startsWith("	")) {
+      throw new HttpError(400, "obsolete line folding");
+    }
+    const colon = line.indexOf(":");
+    const name2 = colon > 0 ? line.slice(0, colon) : "";
+    if (!TOKEN.test(name2)) throw new HttpError(400, "malformed header field");
+    headers.push([name2, line.slice(colon + 1).trim()]);
+  }
+  return headers;
+}
+function fieldValues(headers, name2) {
+  const lower = name2.toLowerCase();
+  return headers.filter(([n]) => n.toLowerCase() === lower).map(([, v]) => v);
+}
+function fieldTokens(headers, name2) {
+  return fieldValues(headers, name2).flatMap((v) => v.split(",")).map((t) => t.trim().toLowerCase()).filter((t) => t !== "");
+}
+function requestFraming(headers) {
+  const codings = fieldTokens(headers, "transfer-encoding");
+  const lengths = fieldValues(headers, "content-length");
+  if (codings.length > 0) {
+    if (lengths.length > 0) throw new HttpError(400, "both Transfer-Encoding and Content-Length");
+    if (codings.length !== 1 || codings[0] !== "chunked") {
+      throw new HttpError(501, `unsupported Transfer-Encoding: ${codings.join(", ")}`);
+    }
+    return { kind: "chunked" };
+  }
+  if (lengths.length === 0) return { kind: "none" };
+  const distinct = new Set(lengths.flatMap((v) => v.split(",")).map((v) => v.trim()));
+  const [only] = distinct;
+  if (distinct.size !== 1 || !/^\d{1,15}$/.test(only)) {
+    throw new HttpError(400, "invalid Content-Length");
+  }
+  const length2 = Number(only);
+  return length2 === 0 ? { kind: "none" } : { kind: "length", length: length2 };
+}
+var MAX_CHUNK_LINE = 4096;
+var MAX_TRAILERS = 64 * 1024;
+async function readBody(incoming, framing, cap, signal) {
+  if (framing.kind === "none") return void 0;
+  if (framing.kind === "length") {
+    if (framing.length > cap) throw new HttpError(413, `request body over ${cap} bytes`);
+    return incoming.exactly(framing.length, signal);
+  }
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const sizeLine = await incoming.line(MAX_CHUNK_LINE, signal);
+    const size = /^([0-9A-Fa-f]{1,12})[ \t]*(;.*)?$/.exec(sizeLine);
+    if (!size) throw new HttpError(400, "malformed chunk size");
+    const n = Number.parseInt(size[1], 16);
+    if (n === 0) break;
+    total += n;
+    if (total > cap) throw new HttpError(413, `request body over ${cap} bytes`);
+    chunks.push(await incoming.exactly(n, signal));
+    if (await incoming.line(2, signal) !== "") throw new HttpError(400, "malformed chunk");
+  }
+  let trailers = 0;
+  for (let line = await incoming.line(MAX_TRAILERS, signal); line !== ""; ) {
+    trailers += line.length;
+    if (trailers > MAX_TRAILERS) throw new HttpError(431, "trailers too large");
+    line = await incoming.line(MAX_TRAILERS, signal);
+  }
+  return concat(chunks, total);
+}
+function concat(chunks, total = chunks.reduce((n, c) => n + c.length, 0)) {
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const chunk2 of chunks) {
+    out.set(chunk2, at);
+    at += chunk2.length;
+  }
+  return out;
+}
+function safeValue(value) {
+  return !/[\r\n\0]/.test(value);
+}
+function responseHead(status, reason, headers) {
+  const phrase = /^[\t\x20-\x7e\x80-\xff]*$/.test(reason) ? reason : "";
+  let head = `HTTP/1.1 ${status} ${phrase}\r
+`;
+  for (const [name2, value] of headers) {
+    if (TOKEN.test(name2) && safeValue(value)) head += `${name2}: ${value}\r
+`;
+  }
+  return latin1Bytes(`${head}\r
+`);
+}
+function chunk(bytes) {
+  const size = latin1Bytes(`${bytes.length.toString(16)}\r
+`);
+  const out = new Uint8Array(size.length + bytes.length + 2);
+  out.set(size);
+  out.set(bytes, size.length);
+  out[out.length - 2] = CR;
+  out[out.length - 1] = LF;
+  return out;
+}
+var LAST_CHUNK = latin1Bytes("0\r\n\r\n");
+
+// src/kernel/net/proxy-service.ts
+var REALM_PROXY_PORT = 3128;
+var DEFAULT_LIMITS = {
+  maxConnections: 64,
+  maxHead: 64 * 1024,
+  idleMs: 12e4,
+  bodyBudget: 128 * 1024 * 1024
+};
+var HOP_BY_HOP = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-connection",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var REQUEST_OWN = /* @__PURE__ */ new Set(["host", "content-length", "expect"]);
+var Budget = class {
+  free;
+  waiters = [];
+  constructor(free) {
+    this.free = free;
+  }
+  async acquire(n, signal) {
+    while (this.free < n) {
+      signal.throwIfAborted();
+      await new Promise((resolve) => {
+        const done3 = () => {
+          signal.removeEventListener("abort", done3);
+          resolve();
+        };
+        this.waiters.push(done3);
+        signal.addEventListener("abort", done3, { once: true });
+      });
+    }
+    this.free -= n;
+  }
+  release(n) {
+    this.free += n;
+    const waiters = this.waiters;
+    this.waiters = [];
+    for (const wake of waiters) wake();
+  }
+};
+function canonicalHost(host) {
+  const bare = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+  try {
+    return new URL(`http://${bare}/`).hostname;
+  } catch {
+    return void 0;
+  }
+}
+function localV4(a, b) {
+  return a === 127 || a === 0 || a === 169 && b === 254;
+}
+function hextets(address) {
+  const [head, tail, extra] = address.split("::");
+  if (extra !== void 0) return void 0;
+  const part = (text) => text ? text.split(":").map((h) => Number.parseInt(h, 16)) : [];
+  const front = part(head);
+  const back = part(tail);
+  const groups = tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
+  return groups.length === 8 && groups.every((g) => g >= 0 && g <= 65535) ? groups : void 0;
+}
+function localV6(address) {
+  const g = hextets(address);
+  if (!g) return true;
+  if ((g[0] & 65472) === 65152) return true;
+  const zeroPrefix = g.slice(0, 5).every((x) => x === 0);
+  if (!zeroPrefix) return false;
+  if (g[5] === 65535 || g[5] === 0 && g[6] !== 0) return localV4(g[6] >> 8, g[6] & 255);
+  return g[5] === 0 && g[6] === 0;
+}
+function isLoopbackHost(hostname) {
+  const canonical = canonicalHost(hostname);
+  if (canonical === void 0) return false;
+  const host = canonical.replace(/\.+$/, "");
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  if (host.startsWith("[")) return localV6(host.slice(1, -1));
+  const v4 = /^(\d+)\.(\d+)\.\d+\.\d+$/.exec(host);
+  return v4 ? localV4(Number(v4[1]), Number(v4[2])) : false;
+}
+function dropped(headers) {
+  return /* @__PURE__ */ new Set([...HOP_BY_HOP, ...fieldTokens(headers, "connection")]);
+}
+function forwardRequestHeaders(headers) {
+  const drop = dropped(headers);
+  return headers.filter(([name2]) => {
+    const lower = name2.toLowerCase();
+    return !drop.has(lower) && !REQUEST_OWN.has(lower);
+  });
+}
+function forwardResponseHeaders(headers, opts) {
+  const drop = dropped(headers);
+  if (!opts.encodedBodies) drop.add("content-encoding");
+  if (!(opts.encodedBodies && opts.bodiless)) drop.add("content-length");
+  return headers.filter(([name2]) => !drop.has(name2.toLowerCase()));
+}
+function keepsAlive(req) {
+  const tokens = fieldTokens(req.headers, "connection");
+  if (tokens.includes("close")) return false;
+  return req.minor >= 1 || tokens.includes("keep-alive");
+}
+function tunnelRequestUrl(req, origin) {
+  const base = new URL(origin);
+  let url;
+  try {
+    url = new URL(req.target, req.target.startsWith("/") ? base : void 0);
+  } catch {
+    throw new HttpError(400, "malformed request target");
+  }
+  const hosts = fieldValues(req.headers, "host");
+  const hostOk = hosts.every(
+    (h) => URL.canParse(`https://${h}`) && new URL(`https://${h}`).host === base.host
+  );
+  if (url.origin !== base.origin || !hostOk) {
+    throw new HttpError(421, `this tunnel is for ${base.host}`);
+  }
+  return url.href;
+}
+function requestUrl(req) {
+  if (req.target.startsWith("/")) {
+    throw new HttpError(400, "this is a proxy: send the absolute URL (GET http://host/path)");
+  }
+  let url;
+  try {
+    url = new URL(req.target);
+  } catch {
+    throw new HttpError(400, "malformed request target");
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new HttpError(400, `unsupported scheme ${url.protocol}`);
+  }
+  if (isLoopbackHost(url.hostname)) {
+    throw new HttpError(
+      403,
+      `${url.hostname} is the realm's own loopback, which the proxy does not reach: list it in no_proxy`
+    );
+  }
+  return url.href;
+}
+function tunnelTarget(req) {
+  const match = /^([A-Za-z0-9.-]+|\[[0-9A-Fa-f:.]+\]):(\d{1,5})$/.exec(req.target);
+  const port = Number(match?.[2]);
+  if (!match || port < 1 || port > 65535) {
+    throw new HttpError(400, "CONNECT needs host:port");
+  }
+  const host = canonicalHost(match[1]);
+  if (host === void 0) throw new HttpError(400, "CONNECT needs host:port");
+  if (isLoopbackHost(host)) {
+    throw new HttpError(
+      403,
+      `${host} is the realm's own loopback, which the proxy does not reach: list it in no_proxy`
+    );
+  }
+  return { host, port };
+}
+async function watchHangup(conn, abort, until) {
+  while (!until.aborted && !abort.signal.aborted) {
+    if (conn.poll().hangup) {
+      abort.abort(new KernelError("EPIPE"));
+      return;
+    }
+    try {
+      await conn.changed(until);
+    } catch {
+      return;
+    }
+  }
+}
+function untilAborted(response, signal) {
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      reject(signal.reason ?? new KernelError("EINTR"));
+      response.then((late) => late.cancel()).catch(() => void 0);
+    };
+    if (signal.aborted) return onAbort();
+    signal.addEventListener("abort", onAbort, { once: true });
+    response.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+  });
+}
+function plainResponse(status, message2) {
+  const body = latin1Bytes(`slicc realm proxy: ${message2}
+`);
+  return {
+    status,
+    statusText: REASON[status] ?? "",
+    headers: [["Content-Type", "text/plain; charset=utf-8"]],
+    body: (async function* () {
+      yield body;
+    })(),
+    cancel: async () => void 0
+  };
+}
+function timedSource(conn, idleMs, stop) {
+  return {
+    read: (max) => conn.read(max, AbortSignal.any([stop, AbortSignal.timeout(idleMs)]))
+  };
+}
+var RealmProxy = class {
+  options;
+  listener;
+  stop = new AbortController();
+  limits;
+  slots;
+  bodies;
+  connections = /* @__PURE__ */ new Set();
+  closed;
+  port;
+  constructor(options) {
+    this.options = options;
+    this.limits = { ...DEFAULT_LIMITS, ...options.limits };
+    this.slots = new Budget(this.limits.maxConnections);
+    this.bodies = new Budget(this.limits.bodyBudget);
+    this.listener = options.net.listen({
+      family: "inet",
+      host: options.host ?? "127.0.0.1",
+      port: options.port ?? REALM_PROXY_PORT
+    });
+    this.port = this.listener.local?.family === "inet" ? this.listener.local.port : 0;
+    this.closed = this.acceptLoop();
+  }
+  get stopped() {
+    return this.stop.signal.aborted;
+  }
+  close() {
+    if (this.stop.signal.aborted) return;
+    this.stop.abort();
+    this.listener.close();
+    for (const conn of this.connections) conn.close();
+  }
+  async acceptLoop() {
+    const served = /* @__PURE__ */ new Set();
+    try {
+      for (; ; ) {
+        await this.slots.acquire(1, this.stop.signal);
+        let conn;
+        try {
+          conn = await this.listener.accept(this.stop.signal);
+        } catch {
+          this.slots.release(1);
+          break;
+        }
+        const done3 = this.serve(conn).finally(() => {
+          this.slots.release(1);
+          served.delete(done3);
+        });
+        served.add(done3);
+      }
+    } catch {
+    }
+    await Promise.allSettled([...served]);
+  }
+  async serve(conn) {
+    this.connections.add(conn);
+    const incoming = new Incoming(timedSource(conn, this.limits.idleMs, this.stop.signal));
+    try {
+      await this.requests({ sink: conn, incoming, conn, socket: conn });
+    } finally {
+      this.connections.delete(conn);
+      conn.close();
+    }
+  }
+  async requests(ctx) {
+    try {
+      for (; ; ) {
+        const head = await ctx.incoming.head(this.limits.maxHead);
+        if (!head || !await this.exchange(ctx, head)) break;
+      }
+    } catch (e) {
+      if (e instanceof HttpError) await this.refuse(ctx.sink, e);
+    }
+  }
+  async refuse(sink, error) {
+    try {
+      await this.relay(sink, "GET", 1, plainResponse(error.status, error.message), false);
+    } catch {
+    }
+  }
+  async exchange(ctx, head) {
+    const { sink: conn, incoming } = ctx;
+    const req = parseRequestHead(head);
+    if (req.method === "CONNECT") {
+      if (!ctx.conn) throw new HttpError(400, "CONNECT inside a tunnel");
+      await this.connect(ctx.conn, incoming, req);
+      return false;
+    }
+    const url = ctx.origin ? tunnelRequestUrl(req, ctx.origin) : requestUrl(req);
+    const keep = keepsAlive(req);
+    const framing = requestFraming(req.headers);
+    const reserve = framing.kind === "length" ? framing.length : framing.kind === "chunked" ? this.cap() : 0;
+    if (reserve > this.cap()) throw new HttpError(413, `request body over ${this.cap()} bytes`);
+    await this.expectContinue(conn, req, framing.kind !== "none");
+    await this.bodies.acquire(reserve, this.stop.signal);
+    let response;
+    const abort = new AbortController();
+    const stopExchange = () => abort.abort();
+    this.stop.signal.addEventListener("abort", stopExchange, { once: true });
+    try {
+      try {
+        const body = await readBody(incoming, framing, this.cap());
+        const waiting = new AbortController();
+        void watchHangup(ctx.socket, abort, waiting.signal);
+        try {
+          response = await this.upstream(req, url, body, abort.signal);
+        } finally {
+          waiting.abort();
+        }
+      } finally {
+        this.bodies.release(reserve);
+      }
+      return await this.relay(conn, req.method, req.minor, response, keep);
+    } finally {
+      this.stop.signal.removeEventListener("abort", stopExchange);
+      abort.abort();
+    }
+  }
+  cap() {
+    return Math.min(this.options.transport.traits.maxRequestBody, this.limits.bodyBudget);
+  }
+  async expectContinue(conn, req, hasBody) {
+    const expect = fieldTokens(req.headers, "expect");
+    if (expect.length === 0) return;
+    if (expect.length !== 1 || expect[0] !== "100-continue") {
+      throw new HttpError(417, `unsupported expectation: ${expect.join(", ")}`);
+    }
+    if (hasBody && req.minor >= 1) {
+      await conn.write(latin1Bytes("HTTP/1.1 100 Continue\r\n\r\n"), this.stop.signal);
+    }
+  }
+  async upstream(req, url, body, signal) {
+    try {
+      const fetching = this.options.transport.fetch({
+        url,
+        method: req.method.toUpperCase(),
+        headers: forwardRequestHeaders(req.headers),
+        body: req.method === "GET" || req.method === "HEAD" ? void 0 : body,
+        signal
+      });
+      return await untilAborted(fetching, signal);
+    } catch (e) {
+      if (signal.aborted) throw e;
+      const message2 = e instanceof Error ? e.message : String(e);
+      const status = e?.status;
+      const own = typeof status === "number" && status >= 400 && status <= 599 ? status : 502;
+      return plainResponse(own, message2 || "upstream request failed");
+    }
+  }
+  async relay(conn, method, minor, response, keepAlive) {
+    const status = response.status;
+    const bodiless = method === "HEAD" || status === 204 || status === 304 || status < 200;
+    const headers = forwardResponseHeaders(response.headers, {
+      encodedBodies: this.options.transport.traits.encodedBodies,
+      bodiless
+    });
+    const chunked = !bodiless && minor >= 1;
+    const keep = keepAlive && (bodiless || chunked);
+    headers.push(["Connection", keep ? "keep-alive" : "close"]);
+    if (chunked) headers.push(["Transfer-Encoding", "chunked"]);
+    const signal = this.stop.signal;
+    await conn.write(
+      responseHead(status, response.statusText || REASON[status] || "", headers),
+      signal
+    );
+    if (bodiless) {
+      await response.cancel();
+      return keep;
+    }
+    try {
+      for await (const piece of response.body) {
+        if (piece.length > 0) await conn.write(chunked ? chunk(piece) : piece, signal);
+      }
+    } catch {
+      await response.cancel().catch(() => void 0);
+      return false;
+    }
+    if (chunked) await conn.write(LAST_CHUNK, signal);
+    return keep;
+  }
+  async connect(conn, incoming, req) {
+    const target = tunnelTarget(req);
+    const tunnel = this.options.tunnel;
+    if (!tunnel) {
+      throw new HttpError(
+        501,
+        `CONNECT ${target.host}:${target.port}: no tunnels through this proxy`
+      );
+    }
+    await this.options.tunnelReady?.().catch((e) => {
+      throw new HttpError(
+        501,
+        `CONNECT ${target.host}:${target.port}: ${e instanceof Error ? e.message : String(e)}`
+      );
+    });
+    await conn.write(latin1Bytes("HTTP/1.1 200 Connection Established\r\n\r\n"), this.stop.signal);
+    try {
+      await tunnel(
+        conn,
+        incoming,
+        target,
+        this.stop.signal,
+        (source, sink, origin) => this.requests({ sink, incoming: new Incoming(source), origin, socket: conn })
+      );
+    } catch {
+    }
+  }
+};
+
+// src/kernel/net/x509.ts
+function concat2(parts) {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let at = 0;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+  return out;
+}
+function length(n) {
+  if (n < 128) return Uint8Array.of(n);
+  const bytes = [];
+  for (let v = n; v > 0; v = Math.floor(v / 256)) bytes.unshift(v & 255);
+  return Uint8Array.of(128 | bytes.length, ...bytes);
+}
+function tlv(tag, ...contents2) {
+  const body = concat2(contents2);
+  return concat2([Uint8Array.of(tag), length(body.length), body]);
+}
+var seq = (...parts) => tlv(48, ...parts);
+var set = (...parts) => tlv(49, ...parts);
+var octets = (bytes) => tlv(4, bytes);
+var bits = (bytes, unused = 0) => tlv(3, Uint8Array.of(unused), bytes);
+var TRUE = tlv(1, Uint8Array.of(255));
+function integer(magnitude) {
+  let start = 0;
+  while (start < magnitude.length - 1 && magnitude[start] === 0) start++;
+  const trimmed = magnitude.subarray(start);
+  return tlv(2, trimmed[0] & 128 ? concat2([Uint8Array.of(0), trimmed]) : trimmed);
+}
+function oid(dotted) {
+  const [a, b, ...rest] = dotted.split(".").map(Number);
+  const out = [40 * a + b];
+  for (const arc of rest) {
+    const groups = [];
+    for (let v = arc; ; v = Math.floor(v / 128)) {
+      groups.unshift(v & 127);
+      if (v < 128) break;
+    }
+    out.push(...groups.map((g, i) => i < groups.length - 1 ? g | 128 : g));
+  }
+  return tlv(6, Uint8Array.from(out));
+}
+var utf8 = (text) => tlv(12, new TextEncoder().encode(text));
+var ascii = (text) => Uint8Array.from(text, (c) => c.charCodeAt(0) & 127);
+function time(date) {
+  const iso = date.toISOString().replace(/[-:T]/g, "").slice(0, 14);
+  const year = date.getUTCFullYear();
+  return year < 2050 ? tlv(23, ascii(`${iso.slice(2)}Z`)) : tlv(24, ascii(`${iso}Z`));
+}
+var ECDSA_SHA256 = seq(oid("1.2.840.10045.4.3.2"));
+function name(dn) {
+  const rdns = [];
+  if (dn.organization) rdns.push(set(seq(oid("2.5.4.10"), utf8(dn.organization))));
+  rdns.push(set(seq(oid("2.5.4.3"), utf8(dn.commonName))));
+  return seq(...rdns);
+}
+function extension(id, critical, value) {
+  return critical ? seq(oid(id), TRUE, octets(value)) : seq(oid(id), octets(value));
+}
+function children(der) {
+  const out = [];
+  const [, bodyStart, bodyEnd] = header(der, 0);
+  for (let at = bodyStart; at < bodyEnd; ) {
+    const [, , end] = header(der, at);
+    out.push(der.subarray(at, end));
+    at = end;
+  }
+  return out;
+}
+function header(der, at) {
+  const tag = der[at];
+  let len = der[at + 1];
+  let start = at + 2;
+  if (len & 128) {
+    const count = len & 127;
+    len = 0;
+    for (let i = 0; i < count; i++) len = len * 256 + der[start + i];
+    start += count;
+  }
+  if (start + len > der.length) throw new Error("truncated DER");
+  return [tag, start, start + len];
+}
+function contents(element) {
+  const [, start, end] = header(element, 0);
+  return element.subarray(start, end);
+}
+function publicKeyBits(spki) {
+  const key = children(spki)[1];
+  return contents(key).subarray(1);
+}
+async function keyId(spki) {
+  return new Uint8Array(
+    await crypto.subtle.digest("SHA-1", publicKeyBits(spki))
+  );
+}
+function ecdsaDer(raw) {
+  const half = raw.length / 2;
+  return seq(integer(raw.subarray(0, half)), integer(raw.subarray(half)));
+}
+function randomSerial() {
+  const serial = crypto.getRandomValues(new Uint8Array(16));
+  serial[0] = serial[0] & 127 | 1;
+  return serial;
+}
+function ipv4(host) {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  if (!m) return void 0;
+  const parts = m.slice(1).map(Number);
+  return parts.every((p) => p <= 255) ? Uint8Array.from(parts) : void 0;
+}
+function ipv6(host) {
+  if (!host.includes(":") || !/^[0-9A-Fa-f:.]+$/.test(host)) return void 0;
+  const v4 = /(\d{1,3}(?:\.\d{1,3}){3})$/.exec(host);
+  let text = host;
+  const tail = [];
+  if (v4) {
+    const bytes = ipv4(v4[1]);
+    if (!bytes) return void 0;
+    tail.push(bytes[0] << 8 | bytes[1], bytes[2] << 8 | bytes[3]);
+    text = host.slice(0, -v4[1].length).replace(/:$/, host.endsWith(`::${v4[1]}`) ? ":" : "");
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return void 0;
+  const groups = (part) => part === "" ? [] : part.split(":");
+  const head = groups(halves[0]);
+  const back = halves.length === 2 ? groups(halves[1]) : [];
+  if (![...head, ...back].every((g) => /^[0-9A-Fa-f]{1,4}$/.test(g))) return void 0;
+  const words = [...head, ...back].map((g) => Number.parseInt(g, 16));
+  const missing3 = 8 - words.length - tail.length;
+  if (halves.length === 2 ? missing3 < 1 : missing3 !== 0) return void 0;
+  const all = [
+    ...head.map((g) => Number.parseInt(g, 16)),
+    ...new Array(halves.length === 2 ? missing3 : 0).fill(0),
+    ...back.map((g) => Number.parseInt(g, 16)),
+    ...tail
+  ];
+  return Uint8Array.from(all.flatMap((w) => [w >> 8, w & 255]));
+}
+async function extensions(req) {
+  const list = [extension("2.5.29.14", false, octets(await keyId(req.spki)))];
+  if (req.kind.ca) {
+    list.push(extension("2.5.29.19", true, seq(TRUE, integer(Uint8Array.of(0)))));
+    list.push(extension("2.5.29.15", true, bits(Uint8Array.of(134), 1)));
+  } else {
+    list.push(extension("2.5.29.35", false, seq(tlv(128, await keyId(req.issuerSpki)))));
+    list.push(extension("2.5.29.19", true, seq()));
+    list.push(extension("2.5.29.15", true, bits(Uint8Array.of(128), 7)));
+    list.push(extension("2.5.29.37", false, seq(oid("1.3.6.1.5.5.7.3.1"))));
+    const ip = ipv4(req.kind.host) ?? ipv6(req.kind.host);
+    const altName = ip ? tlv(135, ip) : tlv(130, ascii(req.kind.host));
+    list.push(extension("2.5.29.17", false, seq(altName)));
+  }
+  return tlv(163, seq(...list));
+}
+async function certificate(req) {
+  const tbs = seq(
+    tlv(160, integer(Uint8Array.of(2))),
+    integer(req.serial),
+    ECDSA_SHA256,
+    name(req.issuer),
+    seq(time(req.notBefore), time(req.notAfter)),
+    name(req.subject),
+    req.spki,
+    await extensions(req)
+  );
+  const signature = ecdsaDer(await req.sign(tbs));
+  return seq(tbs, ECDSA_SHA256, bits(signature));
+}
+function pem(der) {
+  let b64 = "";
+  for (let i = 0; i < der.length; i += 32768) {
+    b64 += String.fromCharCode(...der.subarray(i, i + 32768));
+  }
+  const lines = btoa(b64).match(/.{1,64}/g) ?? [];
+  return `-----BEGIN CERTIFICATE-----
+${lines.join("\n")}
+-----END CERTIFICATE-----
+`;
+}
+
+// src/kernel/net/realm-ca.ts
+function sameCert(a, b) {
+  if (!a || !b) return a === b;
+  return a.cert.length === b.cert.length && a.cert.every((byte, i) => byte === b.cert[i]);
+}
+function winner(current, expected, record) {
+  return sameCert(current, expected) ? record : current;
+}
+var DAY = 24 * 60 * 60 * 1e3;
+var CA_LIFETIME = 3650 * DAY;
+var CA_RENEW_BEFORE = 30 * DAY;
+var LEAF_LIFETIME = 7 * DAY;
+var ECDSA = { name: "ECDSA", namedCurve: "P-256" };
+var SIGN = { name: "ECDSA", hash: "SHA-256" };
+function request(req) {
+  return new Promise((resolve, reject) => {
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
+}
+function indexedDbCaStore(dbName = "slicc-realm-ca") {
+  let db;
+  const open = () => {
+    db ??= new Promise((resolve, reject) => {
+      const req = indexedDB.open(dbName, 1);
+      req.onupgradeneeded = () => req.result.createObjectStore("ca");
+      req.onsuccess = () => resolve(req.result);
+      req.onerror = () => reject(req.error);
+    });
+    db.catch(() => {
+      db = void 0;
+    });
+    return db;
+  };
+  return {
+    async get(owner) {
+      const store = (await open()).transaction("ca").objectStore("ca");
+      return await request(store.get(owner));
+    },
+    async swap(owner, expected, record) {
+      const tx = (await open()).transaction("ca", "readwrite");
+      const store = tx.objectStore("ca");
+      let stored = record;
+      const read = store.get(owner);
+      read.onsuccess = () => {
+        const current = read.result;
+        const kept = winner(current, expected, record);
+        if (kept === record) store.put(record, owner);
+        else stored = kept;
+      };
+      await new Promise((resolve, reject) => {
+        tx.oncomplete = () => resolve();
+        tx.onerror = () => reject(tx.error);
+      });
+      return stored;
+    }
+  };
+}
+var LeafNameError = class extends Error {
+};
+function validLeafName(host) {
+  if (ipv6(host)) return true;
+  if (host.length === 0 || host.length > 253) return false;
+  return host.split(".").every((label) => /^(?!-)[a-z0-9-]{1,63}(?<!-)$/i.test(label));
+}
+var RealmCa = class _RealmCa {
+  record;
+  constructor(record) {
+    this.record = record;
+  }
+  static async open(owner, store, now = Date.now()) {
+    const stored = await store.get(owner).catch(() => void 0);
+    if (stored && stored.notAfter - now > CA_RENEW_BEFORE) return new _RealmCa(stored);
+    const record = await _RealmCa.create(owner, now);
+    return new _RealmCa(await store.swap(owner, stored, record));
+  }
+  static async create(owner, now) {
+    const pair = await crypto.subtle.generateKey(ECDSA, false, ["sign", "verify"]);
+    const spki = new Uint8Array(await crypto.subtle.exportKey("spki", pair.publicKey));
+    const id = Array.from(
+      crypto.getRandomValues(new Uint8Array(4)),
+      (b) => b.toString(16).padStart(2, "0")
+    ).join("");
+    const name2 = { organization: "SLICC", commonName: `SLICC realm CA ${owner} ${id}` };
+    const notAfter = now + CA_LIFETIME;
+    const cert = await certificate({
+      serial: randomSerial(),
+      issuer: name2,
+      subject: name2,
+      notBefore: new Date(now - DAY),
+      notAfter: new Date(notAfter),
+      spki,
+      issuerSpki: spki,
+      kind: { ca: true },
+      sign: signer(pair.privateKey)
+    });
+    return { key: pair.privateKey, cert, spki, notAfter, name: name2 };
+  }
+  get cert() {
+    return this.record.cert;
+  }
+  get pem() {
+    return pem(this.record.cert);
+  }
+  async issue(host, spki, now = Date.now()) {
+    const name2 = host.toLowerCase();
+    if (!validLeafName(name2)) throw new LeafNameError(`no certificate for ${host}`);
+    return certificate({
+      serial: randomSerial(),
+      issuer: this.record.name,
+      subject: { commonName: name2.length <= 64 ? name2 : "SLICC realm leaf" },
+      notBefore: new Date(now - 60 * 60 * 1e3),
+      notAfter: new Date(now + LEAF_LIFETIME),
+      spki,
+      issuerSpki: this.record.spki,
+      kind: { ca: false, host: name2 },
+      sign: signer(this.record.key)
+    });
+  }
+};
+function signer(key) {
+  return async (tbs) => new Uint8Array(await crypto.subtle.sign(SIGN, key, tbs));
+}
+var opened = /* @__PURE__ */ new WeakMap();
+function realmCa(owner, store) {
+  const cas = opened.get(store) ?? /* @__PURE__ */ new Map();
+  opened.set(store, cas);
+  let ca = cas.get(owner);
+  if (!ca) {
+    const opening = RealmCa.open(owner, store);
+    ca = opening;
+    cas.set(owner, opening);
+    opening.catch(() => {
+      if (cas.get(owner) === opening) cas.delete(owner);
+    });
+  }
+  return ca;
+}
+
+// src/kernel/net/tls-engine.ts
+var SCRATCH = 64 * 1024;
+var EOF = -1;
+var TlsError = class extends Error {
+  code;
+  constructor(code, message2) {
+    super(message2);
+    this.code = code;
+  }
+};
+var TlsEngine = class {
+  m;
+  scratch;
+  constructor(m) {
+    this.m = m;
+    this.scratch = m._malloc(SCRATCH);
+    if (!this.scratch) throw new Error("tls engine: out of memory");
+  }
+  put(bytes) {
+    const ptr = this.m._malloc(bytes.length + 1);
+    if (!ptr) throw new Error("tls engine: out of memory");
+    this.m.HEAPU8.set(bytes, ptr);
+    this.m.HEAPU8[ptr + bytes.length] = 0;
+    return ptr;
+  }
+  taken(n) {
+    return this.m.HEAPU8.slice(this.scratch, this.scratch + n);
+  }
+  error(code, what) {
+    this.m._tls_strerror(code, this.scratch, 256);
+    const end = this.m.HEAPU8.indexOf(0, this.scratch);
+    const text = new TextDecoder().decode(this.m.HEAPU8.subarray(this.scratch, end));
+    return new TlsError(code, `${what}: ${text || code}`);
+  }
+  leaf() {
+    const ptr = this.m._tls_leaf_new();
+    if (!ptr) throw this.error(this.m._tls_last_error(), "leaf key");
+    return new TlsLeaf(this, this.m, ptr);
+  }
+  session(leaf, host) {
+    const name2 = this.put(new TextEncoder().encode(host));
+    try {
+      const ptr = this.m._tls_session_new(leaf.ptr, name2);
+      if (!ptr) throw this.error(this.m._tls_last_error(), "tls session");
+      return new TlsSession(this, this.m, ptr);
+    } finally {
+      this.m._free(name2);
+    }
+  }
+  withBytes(bytes, fn) {
+    const ptr = this.put(bytes);
+    try {
+      return fn(ptr);
+    } finally {
+      this.m._free(ptr);
+    }
+  }
+  intoScratch(fn) {
+    const n = fn(this.scratch, SCRATCH);
+    return n > 0 ? this.taken(n) : n;
+  }
+};
+var TlsLeaf = class {
+  engine;
+  m;
+  ptr;
+  constructor(engine, m, ptr) {
+    this.engine = engine;
+    this.m = m;
+    this.ptr = ptr;
+  }
+  spki() {
+    const out = this.engine.intoScratch((ptr, max) => this.m._tls_leaf_spki(this.ptr, ptr, max));
+    if (typeof out === "number") throw this.engine.error(out, "leaf public key");
+    return out;
+  }
+  addCert(der) {
+    const ret = this.engine.withBytes(
+      der,
+      (ptr) => this.m._tls_leaf_add_cert(this.ptr, ptr, der.length)
+    );
+    if (ret !== 0) throw this.engine.error(ret, "leaf certificate");
+  }
+  release() {
+    this.m._tls_leaf_free(this.ptr);
+  }
+};
+var TlsSession = class {
+  engine;
+  m;
+  ptr;
+  constructor(engine, m, ptr) {
+    this.engine = engine;
+    this.m = m;
+    this.ptr = ptr;
+  }
+  feed(bytes) {
+    return this.engine.withBytes(bytes, (ptr) => this.m._tls_feed(this.ptr, ptr, bytes.length));
+  }
+  feedEnd() {
+    this.m._tls_feed_eof(this.ptr);
+  }
+  read() {
+    const out = this.engine.intoScratch((ptr, max) => this.m._tls_read(this.ptr, ptr, max));
+    if (out instanceof Uint8Array) return out;
+    if (out === 0) return "more";
+    if (out === EOF) return "eof";
+    throw this.engine.error(out, "tls");
+  }
+  write(bytes) {
+    const n = this.engine.withBytes(bytes, (ptr) => this.m._tls_write(this.ptr, ptr, bytes.length));
+    if (n < 0) throw this.engine.error(n, "tls");
+    return n;
+  }
+  take() {
+    if (this.m._tls_out_size(this.ptr) === 0) return new Uint8Array(0);
+    const out = this.engine.intoScratch((ptr, max) => this.m._tls_out_take(this.ptr, ptr, max));
+    return out instanceof Uint8Array ? out : new Uint8Array(0);
+  }
+  close() {
+    this.m._tls_close(this.ptr);
+  }
+  free() {
+    this.m._tls_session_free(this.ptr);
+  }
+};
+var loading = /* @__PURE__ */ new WeakMap();
+function loadTlsEngine(load) {
+  let engine = loading.get(load);
+  if (!engine) {
+    const started = load().then((m) => new TlsEngine(m));
+    engine = started;
+    loading.set(load, started);
+    started.catch(() => {
+      if (loading.get(load) === started) loading.delete(load);
+    });
+  }
+  return engine;
+}
+
+// src/kernel/net/tls-tunnel.ts
+var LEAF_REUSE = LEAF_LIFETIME - 24 * 60 * 60 * 1e3;
+var LEAF_CACHE = 256;
+var CIPHER_READ = 64 * 1024;
+var TlsStream = class {
+  session;
+  cipherIn;
+  cipherOut;
+  pending = new Uint8Array(0);
+  ended = false;
+  constructor(session, cipherIn, cipherOut) {
+    this.session = session;
+    this.cipherIn = cipherIn;
+    this.cipherOut = cipherOut;
+  }
+  async flush(signal) {
+    for (let out = this.session.take(); out.length > 0; out = this.session.take()) {
+      await this.cipherOut.write(out, signal);
+    }
+  }
+  feedPending() {
+    if (this.pending.length === 0) return;
+    const n = this.session.feed(this.pending);
+    this.pending = this.pending.subarray(n);
+  }
+  async read(_max, signal) {
+    for (; ; ) {
+      this.feedPending();
+      const got = this.session.read();
+      await this.flush(signal);
+      if (got instanceof Uint8Array) return got;
+      if (got === "eof") return new Uint8Array(0);
+      if (this.pending.length > 0) continue;
+      if (this.ended) {
+        this.session.feedEnd();
+        const last = this.session.read();
+        await this.flush(signal);
+        return last instanceof Uint8Array ? last : new Uint8Array(0);
+      }
+      const cipher = await this.cipherIn.read(CIPHER_READ, signal);
+      if (cipher.length === 0) this.ended = true;
+      else this.pending = cipher;
+    }
+  }
+  async write(bytes, signal) {
+    for (let at = 0; at < bytes.length; ) {
+      const n = this.session.write(bytes.subarray(at, at + 16 * 1024));
+      await this.flush(signal);
+      at += n;
+    }
+    return bytes.length;
+  }
+  async close(signal) {
+    this.session.close();
+    await this.flush(signal);
+  }
+};
+var TlsTerminator = class {
+  options;
+  leaves = /* @__PURE__ */ new Map();
+  now;
+  constructor(options) {
+    this.options = options;
+    this.now = options.now ?? Date.now;
+  }
+  leafFor(engine, host) {
+    const now = this.now();
+    const cached = this.leaves.get(host);
+    if (cached && cached.expires > now) {
+      this.leaves.delete(host);
+      this.leaves.set(host, cached);
+      return cached.leaf;
+    }
+    if (cached) void this.drop(host, cached);
+    const leaf = this.issue(engine, host, now);
+    const entry = { leaf, expires: now + LEAF_REUSE };
+    this.leaves.set(host, entry);
+    leaf.catch(() => {
+      if (this.leaves.get(host) === entry) this.leaves.delete(host);
+    });
+    for (const [oldest, old] of this.leaves) {
+      if (this.leaves.size <= LEAF_CACHE) break;
+      void this.drop(oldest, old);
+    }
+    return leaf;
+  }
+  async drop(host, entry) {
+    if (this.leaves.get(host) === entry) this.leaves.delete(host);
+    (await entry.leaf.catch(() => void 0))?.release();
+  }
+  async issue(engine, host, now) {
+    const ca = await this.options.ca();
+    const leaf = engine.leaf();
+    try {
+      leaf.addCert(await ca.issue(host, leaf.spki(), now));
+      leaf.addCert(ca.cert);
+      return leaf;
+    } catch (e) {
+      leaf.release();
+      throw e;
+    }
+  }
+  async close() {
+    await Promise.all([...this.leaves].map(([host, entry]) => this.drop(host, entry)));
+  }
+  handler = async (conn, incoming, target, signal, serveHttp) => {
+    const engine = await this.options.engine();
+    const host = target.host.replace(/^\[|\]$/g, "");
+    const leaf = await this.leafFor(engine, host);
+    const session = engine.session(leaf, host);
+    try {
+      const stream = new TlsStream(session, cipherSource(incoming), conn);
+      const origin = `https://${authority(target)}`;
+      await serveHttp(stream, stream, origin);
+      await stream.close(signal).catch(() => void 0);
+    } finally {
+      session.free();
+    }
+  };
+};
+function authority(target) {
+  return target.port === 443 ? target.host : `${target.host}:${target.port}`;
+}
+function cipherSource(incoming) {
+  return { read: (max, signal) => incoming.some(max, signal) };
+}
+
+// src/kernel/net/network.ts
+var NO_TRANSPORT = "slicc-kernel: no network transport (createKernel({ network: { transport } }))";
+var TLS_ENGINE_PACKAGE = "@ai-ecoverse/wasm-tls-engine";
+var CA_PATH = "/etc/ssl/certs/slicc-kernel-ca.pem";
+var PROXY_URL = `http://127.0.0.1:${REALM_PROXY_PORT}`;
+var NO_PROXY = "localhost,.localhost,127.0.0.1,127.0.0.0/8";
+var CA_OWNER = "slicc-kernel";
+function networkEnv() {
+  return {
+    http_proxy: PROXY_URL,
+    https_proxy: PROXY_URL,
+    HTTP_PROXY: PROXY_URL,
+    HTTPS_PROXY: PROXY_URL,
+    no_proxy: NO_PROXY,
+    NO_PROXY,
+    SSL_CERT_FILE: CA_PATH,
+    CURL_CA_BUNDLE: CA_PATH,
+    GIT_SSL_CAINFO: CA_PATH
+  };
+}
+function missingTransport() {
+  return {
+    traits: { manualRedirects: true, encodedBodies: true, maxRequestBody: 0 },
+    fetch: () => Promise.reject(Object.assign(new Error(NO_TRANSPORT), { status: 502 }))
+  };
+}
+function memoryCaStore() {
+  const records = /* @__PURE__ */ new Map();
+  return {
+    get: async (owner) => records.get(owner),
+    swap: async (owner, expected, record) => {
+      const kept = winner(records.get(owner), expected, record);
+      records.set(owner, kept);
+      return kept;
+    }
+  };
+}
+function caStore(metadata) {
+  return metadata === false ? memoryCaStore() : indexedDbCaStore(`${metadata}-ca`);
+}
+function base64(bytes) {
+  let text = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    text += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  }
+  return btoa(text);
+}
+function packageTlsEngine(fs, modules) {
+  const dir = `${modules.replace(/\/+$/, "")}/${TLS_ENGINE_PACKAGE}/dist`;
+  return async () => {
+    let glue;
+    let wasmBinary;
+    try {
+      [glue, wasmBinary] = await Promise.all([
+        fs.readFileBuffer(`${dir}/slicc-tls-engine.mjs`),
+        fs.readFileBuffer(`${dir}/slicc-tls-engine.wasm`)
+      ]);
+    } catch {
+      throw new Error(`TLS needs ${TLS_ENGINE_PACKAGE} installed in ${modules}`);
+    }
+    const url = `data:text/javascript;base64,${base64(glue)}`;
+    const factory = await import(url);
+    return factory.default({ wasmBinary, locateFile: (path) => path });
+  };
+}
+function kernelCa(store) {
+  return () => realmCa(CA_OWNER, store);
+}
+function kernelTlsEngine(load) {
+  return () => loadTlsEngine(load);
+}
+async function writeCaFile(fs, ca) {
+  const { pem: pem2 } = await ca();
+  const current = await fs.exists(CA_PATH) ? await fs.readFile(CA_PATH) : void 0;
+  if (current === pem2) return;
+  await fs.mkdir(CA_PATH.slice(0, CA_PATH.lastIndexOf("/")), { recursive: true });
+  await fs.writeFile(CA_PATH, pem2);
+}
+function enableNetwork(net, options) {
+  let proxy;
+  const transport = options.transport ?? missingTransport();
+  net.activate({ family: "inet", host: "127.0.0.1", port: REALM_PROXY_PORT }, () => {
+    const tls = new TlsTerminator({
+      ca: options.ca,
+      engine: options.engine,
+      ...options.now ? { now: options.now } : {}
+    });
+    const started = new RealmProxy({
+      net,
+      transport,
+      tunnel: tls.handler,
+      tunnelReady: async () => {
+        await options.engine();
+      }
+    });
+    proxy = started;
+    void started.closed.then(async () => {
+      if (proxy === started) proxy = void 0;
+      await tls.close();
+    });
+  });
+  return () => proxy;
+}
+
+// src/kernel/net/remote-transport.ts
+var TransportError = class extends Error {
+  status;
+  constructor(message2, status) {
+    super(message2);
+    this.status = status;
+  }
+};
+var RemoteTransport = class {
+  traits;
+  port;
+  waiting = /* @__PURE__ */ new Map();
+  nextId = 0;
+  constructor(port, traits) {
+    this.port = port;
+    this.traits = traits;
+  }
+  receive(reply) {
+    const waiter = this.waiting.get(reply.nid);
+    if (!waiter) return;
+    this.waiting.delete(reply.nid);
+    if (reply.net === "error") waiter.reject(new TransportError(reply.message, reply.status));
+    else waiter.resolve(reply);
+  }
+  ask(call) {
+    return new Promise((resolve, reject) => {
+      this.waiting.set(call.nid, { resolve, reject });
+      this.port.postMessage(call);
+    });
+  }
+  cancel(nid) {
+    const waiter = this.waiting.get(nid);
+    this.waiting.delete(nid);
+    waiter?.reject(new TransportError("the request was cancelled"));
+    this.port.postMessage({ net: "cancel", nid });
+  }
+  async fetch(request2) {
+    const nid = ++this.nextId;
+    const { signal } = request2;
+    signal.throwIfAborted();
+    let finished = false;
+    const abort = () => {
+      finished = true;
+      this.cancel(nid);
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    const finish = () => {
+      if (finished) return;
+      finished = true;
+      signal.removeEventListener("abort", abort);
+    };
+    let head;
+    try {
+      head = await this.ask({
+        net: "fetch",
+        nid,
+        url: request2.url,
+        method: request2.method,
+        headers: request2.headers,
+        ...request2.body ? { body: request2.body } : {}
+      });
+    } catch (e) {
+      finish();
+      throw e;
+    }
+    const { status, statusText, headers } = head;
+    const read = async () => {
+      if (finished) return void 0;
+      const reply = await this.ask({ net: "read", nid }).catch((e) => {
+        finish();
+        throw e;
+      });
+      if (reply.net === "chunk") return reply.bytes;
+      finish();
+      return void 0;
+    };
+    const cancel = async () => {
+      if (finished) return;
+      finish();
+      this.cancel(nid);
+    };
+    return {
+      status,
+      statusText,
+      headers,
+      cancel,
+      body: {
+        [Symbol.asyncIterator]: () => ({
+          next: async () => {
+            const bytes = await read();
+            return bytes ? { value: bytes, done: false } : { value: void 0, done: true };
+          },
+          return: async () => {
+            await cancel();
+            return { value: void 0, done: true };
+          }
+        })
+      }
+    };
+  }
+};
+
+// src/kernel/signals.ts
+var SIG = {
+  HUP: 1,
+  INT: 2,
+  QUIT: 3,
+  ILL: 4,
+  TRAP: 5,
+  ABRT: 6,
+  BUS: 7,
+  FPE: 8,
+  KILL: 9,
+  USR1: 10,
+  SEGV: 11,
+  USR2: 12,
+  PIPE: 13,
+  ALRM: 14,
+  TERM: 15,
+  STKFLT: 16,
+  CHLD: 17,
+  CONT: 18,
+  STOP: 19,
+  TSTP: 20,
+  TTIN: 21,
+  TTOU: 22,
+  URG: 23,
+  XCPU: 24,
+  XFSZ: 25,
+  VTALRM: 26,
+  PROF: 27,
+  WINCH: 28,
+  POLL: 29,
+  PWR: 30,
+  SYS: 31
+};
+var IGNORED_BY_DEFAULT = /* @__PURE__ */ new Set([SIG.CHLD, SIG.URG, SIG.WINCH]);
+var STOPPING = /* @__PURE__ */ new Set([SIG.STOP, SIG.TSTP, SIG.TTIN, SIG.TTOU]);
+function defaultAction(sig) {
+  if (sig === SIG.CONT) return "continue";
+  if (STOPPING.has(sig)) return "stop";
+  return IGNORED_BY_DEFAULT.has(sig) ? "ignore" : "terminate";
+}
+function isSignal(sig) {
+  return Number.isInteger(sig) && sig >= 1 && sig <= 31;
+}
+function sigbit(sig) {
+  return 1 << sig;
+}
+var SIGNAL_BY_NAME = {
+  SIGINT: SIG.INT,
+  SIGTERM: SIG.TERM,
+  SIGKILL: SIG.KILL,
+  SIGSTOP: SIG.STOP,
+  SIGCONT: SIG.CONT
+};
+
+// src/commands.ts
+var NAME = /^[A-Za-z0-9._+-]+$/;
+var ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var PACKAGE = /\$\{package\}/g;
+function inside(pkg, rel) {
+  if (typeof rel !== "string" || rel === "") return void 0;
+  const clean = rel.replace(/^\.\//, "");
+  if (clean.startsWith("/") || clean.split("/").includes("..")) return void 0;
+  return `${pkg}/${clean}`;
+}
+function envOf(pkg, raw) {
+  const env = {};
+  if (!raw || typeof raw !== "object") return env;
+  for (const [key, value] of Object.entries(raw)) {
+    if (ENV_KEY.test(key) && typeof value === "string") env[key] = value.replace(PACKAGE, pkg);
+  }
+  return env;
+}
+function argsOf(pkg, raw) {
+  if (!Array.isArray(raw) || raw.length === 0) return void 0;
+  if (!raw.every((arg) => typeof arg === "string")) return void 0;
+  return raw.map((arg) => arg.replace(PACKAGE, pkg));
+}
+function commandsOf(pkg, manifest) {
+  const slicc = manifest.slicc;
+  if (!slicc || typeof slicc !== "object" || (slicc.abi ?? "emscripten") !== "emscripten")
+    return [];
+  const entries = slicc.commands;
+  if (!entries || typeof entries !== "object") return [];
+  const shared = envOf(pkg, slicc.env);
+  const out = [];
+  for (const [name2, raw] of Object.entries(entries)) {
+    if (!NAME.test(name2) || name2 === "." || name2 === ".." || !raw || typeof raw !== "object") {
+      continue;
+    }
+    const glue = inside(pkg, raw.glue);
+    const wasm = inside(pkg, raw.wasm);
+    if ((raw.abi ?? "emscripten") !== "emscripten" || !glue || !wasm) continue;
+    const argv0 = typeof raw.argv0 === "string" && raw.argv0 ? raw.argv0 : name2;
+    const args = argsOf(pkg, raw.args);
+    const env = { ...shared, ...envOf(pkg, raw.env) };
+    out.push({
+      name: name2,
+      glue,
+      wasm,
+      argv0,
+      ...args ? { args } : {},
+      ...Object.keys(env).length > 0 ? { env } : {}
+    });
+  }
+  return out;
+}
+async function packages(fs, modules) {
+  const names = await fs.readdir(modules).catch(() => []);
+  const dirs = [];
+  for (const name2 of names) {
+    if (name2.startsWith(".")) continue;
+    if (!name2.startsWith("@")) {
+      dirs.push(`${modules}/${name2}`);
+      continue;
+    }
+    for (const inner of await fs.readdir(`${modules}/${name2}`).catch(() => [])) {
+      dirs.push(`${modules}/${name2}/${inner}`);
+    }
+  }
+  return dirs;
+}
+async function scanCommands(fs, modules) {
+  const found = /* @__PURE__ */ new Map();
+  for (const pkg of await packages(fs, modules)) {
+    let manifest;
+    try {
+      manifest = JSON.parse(await fs.readFile(`${pkg}/package.json`));
+    } catch {
+      continue;
+    }
+    for (const command of commandsOf(pkg, manifest)) {
+      if (!found.has(command.name)) found.set(command.name, command);
     }
-    const previous = this.fds.get(fd);
-    this.fds.set(fd, file);
-    this.cloexec.delete(fd);
-    this.status.delete(fd);
-    void Promise.resolve(previous?.release()).catch(() => void 0);
   }
-  dup(fd, min = 0) {
-    return this.install(this.get(fd).retain(), min);
+  if (!found.has("sh") && found.has("bash")) {
+    found.set("sh", { ...found.get("bash"), name: "sh", argv0: "sh" });
   }
-  dup2(oldFd, newFd) {
-    const file = this.get(oldFd);
-    if (oldFd !== newFd) this.installAt(newFd, file.retain());
-    return newFd;
+  return found;
+}
+
+// src/fs/commands.ts
+var S_IFDIR2 = 16384;
+var S_IFREG2 = 32768;
+var COMMAND = /^\/(?:usr\/)?bin\/([^/]+)$/;
+var MAX_LINKS2 = 40;
+function missing2(err) {
+  return err?.code === "ENOENT";
+}
+function synthetic(directory, path) {
+  const epoch = /* @__PURE__ */ new Date(0);
+  return {
+    isFile: !directory,
+    isDirectory: directory,
+    isSymbolicLink: false,
+    size: 0,
+    mode: (directory ? S_IFDIR2 : S_IFREG2) | 493,
+    mtime: epoch,
+    atime: epoch,
+    ctime: epoch,
+    ino: inodeOf(path)
+  };
+}
+async function followLinks(fs, path) {
+  let current = path;
+  for (let hops = 0; hops < MAX_LINKS2; hops++) {
+    const st = await fs.lstat(current).catch(() => void 0);
+    if (!st?.isSymbolicLink) return current;
+    const parent = current.slice(0, current.lastIndexOf("/")) || "/";
+    current = fs.resolvePath(parent, await fs.readlink(current));
   }
-  close(fd) {
-    const file = this.get(fd);
-    this.fds.delete(fd);
-    this.cloexec.delete(fd);
-    this.status.delete(fd);
-    return file.release();
+  return current;
+}
+function withCommandDirs(fs, names) {
+  async function children2(path) {
+    if (path === "/") return ["bin", "usr"];
+    if (path === "/usr") return ["bin"];
+    if (path === "/bin" || path === "/usr/bin") return [...await names()];
+    return void 0;
   }
-  fork() {
-    const child = new _FdTable();
-    for (const [fd, file] of this.fds) child.fds.set(fd, file.retain());
-    for (const fd of this.cloexec) child.cloexec.add(fd);
-    for (const [fd, flags] of this.status) child.status.set(fd, flags);
-    return child;
+  async function virtual(path) {
+    if (path === "/usr" || path === "/bin" || path === "/usr/bin") return synthetic(true, path);
+    const name2 = COMMAND.exec(path)?.[1];
+    return name2 !== void 0 && (await names()).has(name2) ? synthetic(false, path) : void 0;
   }
-  async closeAll() {
-    const files = [...this.fds.values()];
-    this.fds.clear();
-    this.cloexec.clear();
-    this.status.clear();
-    await Promise.allSettled(files.map((file) => Promise.resolve().then(() => file.release())));
+  async function linked(path) {
+    return await virtual(path) ?? virtual(await followLinks(fs, path));
   }
-};
+  async function stat(path, real) {
+    try {
+      return await real(path);
+    } catch (err) {
+      const found = missing2(err) ? await linked(path) : void 0;
+      if (found) return found;
+      throw err;
+    }
+  }
+  return {
+    resolvePath: (base, path) => fs.resolvePath(base, path),
+    readFile: (path) => fs.readFile(path),
+    async readFileBuffer(path) {
+      try {
+        return await fs.readFileBuffer(path);
+      } catch (err) {
+        if (missing2(err) && (await linked(path))?.isFile) return new Uint8Array(0);
+        throw err;
+      }
+    },
+    writeFile: (path, content) => fs.writeFile(path, content),
+    async exists(path) {
+      return await fs.exists(path) || await linked(path) !== void 0;
+    },
+    stat: (path) => stat(path, (p) => fs.stat(p)),
+    lstat: (path) => stat(path, (p) => fs.lstat(p)),
+    async readdir(path) {
+      const extra = await children2(path);
+      if (!extra) return fs.readdir(path);
+      const real = await fs.readdir(path).catch((err) => {
+        if (missing2(err)) return [];
+        throw err;
+      });
+      return [.../* @__PURE__ */ new Set([...real, ...extra])].sort();
+    },
+    async readdirStat(path) {
+      const extra = await children2(path);
+      if (!extra) return fs.readdirStat(path);
+      const real = await fs.readdirStat(path).catch((err) => {
+        if (missing2(err)) return [];
+        throw err;
+      });
+      const seen = new Set(real.map(([name2]) => name2));
+      const base = path === "/" ? "" : path;
+      const added = extra.filter((name2) => !seen.has(name2));
+      const virtuals = await Promise.all(
+        added.map(
+          async (name2) => [
+            name2,
+            await virtual(`${base}/${name2}`)
+          ]
+        )
+      );
+      return [...real, ...virtuals].sort(([a], [b]) => a < b ? -1 : 1);
+    },
+    mkdir: (path, options) => fs.mkdir(path, options),
+    rm: (path, options) => fs.rm(path, options),
+    rename: (from, to) => fs.rename(from, to),
+    symlink: (target, path) => fs.symlink(target, path),
+    readlink: (path) => fs.readlink(path),
+    chmod: (path, mode) => fs.chmod(path, mode),
+    utimes: (path, atime, mtime) => fs.utimes(path, atime, mtime)
+  };
+}
 
 // src/kernel/children.ts
 var SpawnError = class extends Error {
@@ -1214,12 +2656,12 @@ var CONTINUED_STATUS = 65535;
 function waitStatus(code, termsig) {
   return termsig ? termsig & 127 : (code & 255) << 8;
 }
-function concat(chunks) {
+function concat3(chunks) {
   const out = new Uint8Array(chunks.reduce((n, c) => n + c.length, 0));
   let offset = 0;
-  for (const chunk of chunks) {
-    out.set(chunk, offset);
-    offset += chunk.length;
+  for (const chunk2 of chunks) {
+    out.set(chunk2, offset);
+    offset += chunk2.length;
   }
   return out;
 }
@@ -1371,7 +2813,7 @@ var ChildTable = class {
     if (!slots || !chunks) return new Uint8Array(0);
     slots.delete(slot);
     if (slots.size === 0) this.leftovers.delete(pid);
-    return concat(chunks);
+    return concat3(chunks);
   }
 };
 
@@ -1397,12 +2839,12 @@ function syncError(code, label) {
 
 // src/realm/sync-fs-dispatch.ts
 function toErrno(err) {
-  const message = err instanceof Error ? err.message : String(err);
+  const message2 = err instanceof Error ? err.message : String(err);
   const code = err?.code;
   if (typeof code === "string" && /^E[A-Z]+$/.test(code)) {
-    return { ok: false, errno: code, message };
+    return { ok: false, errno: code, message: message2 };
   }
-  return { ok: false, errno: "EIO", message };
+  return { ok: false, errno: "EIO", message: message2 };
 }
 function statJson(s) {
   return {
@@ -1418,7 +2860,7 @@ function statJson(s) {
   };
 }
 async function readdirStat(fs, dir) {
-  return (await fs.readdirStat(dir)).map(([name, stat]) => [name, stat && statJson(stat)]);
+  return (await fs.readdirStat(dir)).map(([name2, stat]) => [name2, stat && statJson(stat)]);
 }
 var done = { ok: true, kind: "void" };
 function json(value) {
@@ -1537,7 +2979,7 @@ function sabViews(sab) {
 var PENDING_TTL_MS = SYNC_FS_REQUEST_TIMEOUT_MS + 5e3;
 function attachSyncSabResponder(port, sab, token, opts) {
   const views = sabViews(sab);
-  const { header, window } = views;
+  const { header: header2, window } = views;
   const pending = /* @__PURE__ */ new Map();
   let disposed = false;
   const { dispatch } = opts;
@@ -1548,16 +2990,16 @@ function attachSyncSabResponder(port, sab, token, opts) {
     pending.delete(id);
   }
   function publish(id, entry, offset) {
-    const chunk = Math.min(window.byteLength, entry.payload.byteLength - offset);
-    if (chunk > 0) window.set(entry.payload.subarray(offset, offset + chunk));
-    Atomics.store(header, SAB_I_STATUS, entry.status);
-    Atomics.store(header, SAB_I_TOTAL, entry.payload.byteLength);
-    Atomics.store(header, SAB_I_CHUNK, chunk);
-    Atomics.store(header, SAB_I_OFFSET, offset);
-    Atomics.store(header, SAB_I_SEQ, id);
-    Atomics.store(header, SAB_I_STATE, SAB_STATE_READY);
-    Atomics.notify(header, SAB_I_STATE);
-    if (offset + chunk >= entry.payload.byteLength) drop(id);
+    const chunk2 = Math.min(window.byteLength, entry.payload.byteLength - offset);
+    if (chunk2 > 0) window.set(entry.payload.subarray(offset, offset + chunk2));
+    Atomics.store(header2, SAB_I_STATUS, entry.status);
+    Atomics.store(header2, SAB_I_TOTAL, entry.payload.byteLength);
+    Atomics.store(header2, SAB_I_CHUNK, chunk2);
+    Atomics.store(header2, SAB_I_OFFSET, offset);
+    Atomics.store(header2, SAB_I_SEQ, id);
+    Atomics.store(header2, SAB_I_STATE, SAB_STATE_READY);
+    Atomics.notify(header2, SAB_I_STATE);
+    if (offset + chunk2 >= entry.payload.byteLength) drop(id);
   }
   function settle2(id, result) {
     if (disposed) return;
@@ -1619,6 +3061,112 @@ function attachSyncSabResponder(port, sab, token, opts) {
   };
 }
 
+// src/kernel/net/http-syscalls.ts
+var HTTP_OPS = ["net-request", "net-read", "net-close"];
+var EMPTY = new Uint8Array(0);
+function message(e) {
+  return e instanceof Error ? e.message : String(e);
+}
+async function* once(bytes) {
+  yield bytes;
+}
+var HttpHandles = class {
+  transport;
+  open = /* @__PURE__ */ new Map();
+  nextHandle = 0;
+  constructor(transport) {
+    this.transport = transport;
+  }
+  syscall(req) {
+    if (req.op === "net-request") return this.request(req);
+    if (req.op === "net-read") return this.read(req.handle, req.max);
+    return this.close(req.handle);
+  }
+  add(abort, body, cancel) {
+    const handle = ++this.nextHandle;
+    this.open.set(handle, {
+      abort,
+      body: body[Symbol.asyncIterator](),
+      left: EMPTY,
+      done: false,
+      reading: Promise.resolve(),
+      cancel
+    });
+    return handle;
+  }
+  async request(req) {
+    const abort = new AbortController();
+    try {
+      const response = await this.transport.fetch({
+        url: req.url,
+        method: req.method,
+        headers: req.headers,
+        ...req.body ? { body: req.body } : {},
+        signal: abort.signal
+      });
+      const handle = this.add(abort, response.body, () => response.cancel());
+      const head = {
+        handle,
+        status: response.status,
+        statusText: response.statusText,
+        url: req.url,
+        headers: response.headers
+      };
+      return { ok: true, kind: "json", json: head };
+    } catch (e) {
+      const text = message(e);
+      if (text === NO_TRANSPORT) return { ok: false, errno: "ENETUNREACH", message: text };
+      const status = e.status;
+      if (typeof status !== "number" || status === 502) {
+        return { ok: false, errno: "ECONNREFUSED", message: text };
+      }
+      const body = new TextEncoder().encode(text);
+      const handle = this.add(abort, once(body), async () => void 0);
+      const head = {
+        handle,
+        status,
+        statusText: "",
+        url: req.url,
+        headers: [["content-type", "text/plain; charset=utf-8"]]
+      };
+      return { ok: true, kind: "json", json: head };
+    }
+  }
+  async read(handle, max) {
+    const entry = this.open.get(handle);
+    if (!entry) return { ok: false, errno: "EBADF", message: `no request ${handle}` };
+    const turn = entry.reading.then(() => this.take(entry, max));
+    entry.reading = turn.then(() => void 0);
+    return turn;
+  }
+  async take(entry, max) {
+    if (entry.left.length === 0 && !entry.done) {
+      try {
+        const next = await entry.body.next();
+        if (next.done) entry.done = true;
+        else entry.left = next.value;
+      } catch (e) {
+        entry.done = true;
+        return { ok: false, errno: "EIO", message: message(e) };
+      }
+    }
+    const bytes = entry.left.subarray(0, Math.max(0, max));
+    entry.left = entry.left.subarray(bytes.length);
+    return { ok: true, kind: "bytes", bytes };
+  }
+  async close(handle) {
+    const entry = this.open.get(handle);
+    if (!entry) return { ok: false, errno: "EBADF", message: `no request ${handle}` };
+    this.open.delete(handle);
+    entry.abort.abort();
+    await entry.cancel().catch(() => void 0);
+    return { ok: true, kind: "void" };
+  }
+  async closeAll() {
+    await Promise.all([...this.open.keys()].map((handle) => this.close(handle)));
+  }
+};
+
 // src/kernel/tty.ts
 var ICRNL = 256;
 var IUTF8 = 16384;
@@ -1787,9 +3335,9 @@ var KernelTty = class {
     return n;
   }
   rubOut(n) {
-    const dropped = this.line.splice(this.line.length - n, n);
-    const utf8 = (this.termios.c_iflag & IUTF8) !== 0;
-    const cells = utf8 ? dropped.filter((b) => !isContinuation(b)).length : dropped.length;
+    const dropped2 = this.line.splice(this.line.length - n, n);
+    const utf82 = (this.termios.c_iflag & IUTF8) !== 0;
+    const cells = utf82 ? dropped2.filter((b) => !isContinuation(b)).length : dropped2.length;
     if (cells > 0 && this.termios.c_lflag & ECHO) {
       this.output(encoder2.encode("\b \b".repeat(cells)), false);
     }
@@ -1839,9 +3387,9 @@ var KernelTty = class {
     }
     const out = new Uint8Array(n);
     let at = 0;
-    for (const chunk of chunks) {
-      out.set(chunk, at);
-      at += chunk.length;
+    for (const chunk2 of chunks) {
+      out.set(chunk2, at);
+      at += chunk2.length;
     }
     return out;
   }
@@ -1938,9 +3486,9 @@ var PtyPair = class {
     }
     const out = new Uint8Array(status + n);
     let at = status;
-    for (const chunk of chunks) {
-      out.set(chunk, at);
-      at += chunk.length;
+    for (const chunk2 of chunks) {
+      out.set(chunk2, at);
+      at += chunk2.length;
     }
     return out;
   }
@@ -2111,6 +3659,391 @@ async function waitReady(fds, read, write, deadline, interrupted2) {
   }
 }
 
+// src/kernel/socket.ts
+var SOMAXCONN = 4096;
+var EPHEMERAL_FIRST = 32768;
+var EPHEMERAL_LAST = 60999;
+var SOL_SOCKET = 1;
+var SO_TYPE = 3;
+var SO_ERROR = 4;
+var SO_SNDBUF = 7;
+var SO_RCVBUF = 8;
+var SO_ACCEPTCONN = 30;
+var SO_DOMAIN = 39;
+var SOCK_STREAM = 1;
+var AF_UNIX = 1;
+var AF_INET = 2;
+var SHUT_RD = 0;
+var SHUT_WR = 1;
+var SHUT_RDWR = 2;
+function isLoopback(host) {
+  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+async function pipeCall(op) {
+  try {
+    return await op();
+  } catch (e) {
+    if (e instanceof PipeError) throw new KernelError(e.code);
+    throw e;
+  }
+}
+var Changes = class {
+  waiters = [];
+  wait(signal) {
+    if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
+    return new Promise((resolve, reject) => {
+      const onAbort = () => {
+        this.waiters = this.waiters.filter((w) => w !== waiter);
+        reject(new KernelError("EINTR"));
+      };
+      const waiter = () => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve();
+      };
+      this.waiters.push(waiter);
+      signal?.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  wake() {
+    const waiters = this.waiters;
+    this.waiters = [];
+    for (const resolve of waiters) resolve();
+  }
+};
+function link(a, b) {
+  const ab = new KernelPipe();
+  const ba = new KernelPipe();
+  for (const pipe of [ab, ba]) {
+    pipe.openRead();
+    pipe.openWrite();
+  }
+  a.attach({ rx: ba, tx: ab });
+  b.attach({ rx: ab, tx: ba });
+}
+var KernelSocket = class _KernelSocket {
+  net;
+  domain;
+  state = "open";
+  local;
+  peer;
+  link;
+  readShut = false;
+  writeShut = false;
+  queue = [];
+  backlog = 0;
+  bound = false;
+  changes = new Changes();
+  options = /* @__PURE__ */ new Map();
+  constructor(net, domain) {
+    this.net = net;
+    this.domain = domain;
+  }
+  attach(link2) {
+    this.link = link2;
+    this.state = "connected";
+    this.changes.wake();
+  }
+  get listening() {
+    return this.state === "listening";
+  }
+  connection() {
+    if (!this.link || this.state !== "connected") throw new KernelError("ENOTCONN");
+    return this.link;
+  }
+  async read(max, signal) {
+    const { rx } = this.connection();
+    if (this.readShut || max <= 0) return new Uint8Array(0);
+    return pipeCall(() => rx.read(max, signal));
+  }
+  async peek(max, signal) {
+    const { rx } = this.connection();
+    if (this.readShut || max <= 0) return new Uint8Array(0);
+    return pipeCall(() => rx.peek(max, signal));
+  }
+  async write(bytes, signal) {
+    const { tx } = this.connection();
+    if (this.writeShut) throw new KernelError("EPIPE");
+    return pipeCall(() => tx.write(bytes, signal));
+  }
+  poll() {
+    if (this.state === "listening") {
+      return { readable: this.queue.length > 0, writable: false, hangup: false };
+    }
+    if (this.state !== "connected" || !this.link) {
+      return { readable: false, writable: false, hangup: true };
+    }
+    const { rx, tx } = this.link;
+    return {
+      readable: this.readShut || rx.readReady,
+      writable: this.writeShut || tx.writeReady,
+      hangup: rx.writersGone && tx.readersGone
+    };
+  }
+  changed(signal) {
+    const own = this.changes.wait(signal);
+    if (this.state !== "connected" || !this.link) return own;
+    const waits = [own, this.link.rx.changed(signal), this.link.tx.changed(signal)];
+    for (const wait of waits) wait.catch(() => void 0);
+    return pipeCall(() => Promise.race(waits));
+  }
+  bind(addr) {
+    if (this.state !== "open" || this.local) throw new KernelError("EINVAL");
+    if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
+    this.local = this.net.bind(this, addr);
+    this.bound = true;
+  }
+  listen(backlog) {
+    if (this.state === "connected") throw new KernelError("EISCONN");
+    if (this.state !== "open" && this.state !== "listening") throw new KernelError("EINVAL");
+    if (!this.local) {
+      if (this.domain === "unix") throw new KernelError("EINVAL");
+      this.bind({ family: "inet", host: "0.0.0.0", port: 0 });
+    }
+    this.backlog = Math.min(Math.max(backlog, 1), SOMAXCONN);
+    this.state = "listening";
+  }
+  async accept(signal, nonblock = false) {
+    for (; ; ) {
+      if (this.state !== "listening") throw new KernelError("EINVAL");
+      const next = this.queue.shift();
+      if (next) return next;
+      if (nonblock) throw new KernelError("EAGAIN");
+      await this.changes.wait(signal);
+    }
+  }
+  offer(server) {
+    if (this.state !== "listening" || this.queue.length >= this.backlog) return false;
+    this.queue.push(server);
+    this.changes.wake();
+    return true;
+  }
+  connect(addr) {
+    if (this.state === "connected") throw new KernelError("EISCONN");
+    if (this.state !== "open") throw new KernelError("EINVAL");
+    if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
+    const target = this.net.target(addr);
+    if (!this.local) {
+      if (addr.family === "inet") {
+        this.local = this.net.bind(this, { family: "inet", host: "127.0.0.1", port: 0 });
+        this.bound = true;
+      } else this.local = { family: "unix", path: "" };
+    }
+    const server = new _KernelSocket(this.net, this.domain);
+    server.local = addr.family === "inet" ? { ...addr, host: canonicalHost2(addr.host) } : addr;
+    server.peer = this.local;
+    this.peer = server.local;
+    link(this, server);
+    if (!target.offer(server)) {
+      this.unlink();
+      server.close();
+      throw new KernelError("ECONNREFUSED");
+    }
+  }
+  unlink() {
+    const link2 = this.link;
+    if (link2) {
+      link2.rx.closeRead();
+      link2.tx.closeWrite();
+    }
+    this.link = void 0;
+    this.peer = void 0;
+    this.state = "open";
+  }
+  shutdown(how) {
+    const { rx, tx } = this.connection();
+    if (how !== SHUT_RD && how !== SHUT_WR && how !== SHUT_RDWR) throw new KernelError("EINVAL");
+    if (how !== SHUT_WR && !this.readShut) {
+      this.readShut = true;
+      rx.closeRead();
+    }
+    if (how !== SHUT_RD && !this.writeShut) {
+      this.writeShut = true;
+      tx.closeWrite();
+    }
+    this.changes.wake();
+  }
+  getOption(level, name2) {
+    if (level === SOL_SOCKET) {
+      switch (name2) {
+        case SO_TYPE:
+          return SOCK_STREAM;
+        case SO_ERROR:
+          return 0;
+        case SO_ACCEPTCONN:
+          return this.state === "listening" ? 1 : 0;
+        case SO_DOMAIN:
+          return this.domain === "inet" ? AF_INET : AF_UNIX;
+        case SO_SNDBUF:
+        case SO_RCVBUF:
+          return this.options.get(`${level}:${name2}`) ?? PIPE_CAPACITY;
+      }
+    }
+    return this.options.get(`${level}:${name2}`) ?? 0;
+  }
+  setOption(level, name2, value) {
+    this.options.set(`${level}:${name2}`, value);
+  }
+  close() {
+    const was = this.state;
+    this.state = "closed";
+    if (was === "listening") {
+      for (const pending of this.queue.splice(0)) pending.close();
+    }
+    if (this.link) {
+      if (!this.readShut) this.link.rx.closeRead();
+      if (!this.writeShut) this.link.tx.closeWrite();
+      this.readShut = true;
+      this.writeShut = true;
+    }
+    if (this.bound && this.local) this.net.release(this.local, this);
+    this.bound = false;
+    this.changes.wake();
+  }
+  static pair(net, domain) {
+    const a = new _KernelSocket(net, domain);
+    const b = new _KernelSocket(net, domain);
+    const name2 = domain === "inet" ? { family: "inet", host: "127.0.0.1", port: 0 } : { family: "unix", path: "" };
+    a.local = b.local = a.peer = b.peer = name2;
+    link(a, b);
+    return [a, b];
+  }
+};
+function canonicalHost2(host) {
+  return host === "0.0.0.0" ? "127.0.0.1" : host;
+}
+function keyOf(addr) {
+  return addr.family === "inet" ? `inet:${addr.port}` : `unix:${addr.path}`;
+}
+var LoopbackNet = class {
+  bound = /* @__PURE__ */ new Map();
+  activators = /* @__PURE__ */ new Map();
+  nextEphemeral = EPHEMERAL_FIRST;
+  activate(addr, start) {
+    this.activators.set(keyOf(addr), start);
+  }
+  socket(domain) {
+    return new KernelSocket(this, domain);
+  }
+  listen(addr, backlog = 128) {
+    const socket = this.socket(addr.family);
+    socket.bind(addr);
+    socket.listen(backlog);
+    return socket;
+  }
+  connect(addr) {
+    const socket = this.socket(addr.family);
+    socket.connect(addr);
+    return socket;
+  }
+  bind(socket, addr) {
+    if (addr.family === "unix") {
+      if (addr.path === "") throw new KernelError("EINVAL");
+    } else if (addr.host !== "0.0.0.0" && !isLoopback(addr.host)) {
+      throw new KernelError("EADDRNOTAVAIL");
+    }
+    const named = addr.family === "inet" && addr.port === 0 ? { ...addr, port: this.ephemeral() } : addr;
+    const key = keyOf(named);
+    if (this.bound.has(key)) throw new KernelError("EADDRINUSE");
+    this.bound.set(key, socket);
+    return named;
+  }
+  release(addr, socket) {
+    const key = keyOf(addr);
+    if (this.bound.get(key) === socket) this.bound.delete(key);
+  }
+  target(addr) {
+    if (addr.family === "inet" && !isLoopback(canonicalHost2(addr.host))) {
+      throw new KernelError("ENETUNREACH");
+    }
+    const key = keyOf(addr);
+    if (!this.bound.has(key)) this.activators.get(key)?.();
+    const socket = this.bound.get(key);
+    if (!socket?.listening) throw new KernelError("ECONNREFUSED");
+    return socket;
+  }
+  ephemeral() {
+    const span = EPHEMERAL_LAST - EPHEMERAL_FIRST + 1;
+    for (let i = 0; i < span; i++) {
+      const port = this.nextEphemeral;
+      this.nextEphemeral = port === EPHEMERAL_LAST ? EPHEMERAL_FIRST : port + 1;
+      if (!this.bound.has(`inet:${port}`)) return port;
+    }
+    throw new KernelError("EADDRINUSE");
+  }
+};
+
+// src/kernel/socket-syscalls.ts
+var SOCKET_OPS = [
+  "sock-open",
+  "sock-pair",
+  "sock-bind",
+  "sock-listen",
+  "sock-accept",
+  "sock-connect",
+  "sock-shutdown",
+  "sock-name",
+  "sock-getopt",
+  "sock-setopt"
+];
+function socketAt(fds, fd) {
+  const file = fds.get(fd).file;
+  if (!(file instanceof KernelSocket)) throw new KernelError("ENOTSOCK");
+  return file;
+}
+var ok = (json3) => json3 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json3 };
+async function socketSyscall(req, proc) {
+  const { fds, net } = proc;
+  switch (req.op) {
+    case "sock-open":
+      return ok(fds.install(new OpenFile(net.socket(req.domain)), 3));
+    case "sock-pair": {
+      const [a, b] = KernelSocket.pair(net, req.domain);
+      const first = fds.install(new OpenFile(a), 3);
+      try {
+        return ok([first, fds.install(new OpenFile(b), 3)]);
+      } catch (e) {
+        await Promise.resolve(fds.close(first));
+        throw e;
+      }
+    }
+    case "sock-bind":
+      socketAt(fds, req.fd).bind(req.addr);
+      return ok();
+    case "sock-listen":
+      socketAt(fds, req.fd).listen(req.backlog);
+      return ok();
+    case "sock-accept":
+      return ok(await accept(proc, req.fd, req.nonblock));
+    case "sock-connect":
+      socketAt(fds, req.fd).connect(req.addr);
+      if (req.nonblock) throw new KernelError("EINPROGRESS");
+      return ok();
+    case "sock-shutdown":
+      socketAt(fds, req.fd).shutdown(req.how);
+      return ok();
+    case "sock-name": {
+      const socket = socketAt(fds, req.fd);
+      const addr = req.peer ? socket.peer : socket.local;
+      if (req.peer && !addr) throw new KernelError("ENOTCONN");
+      return ok(addr ?? unnamed(socket.domain));
+    }
+    case "sock-getopt":
+      return ok(socketAt(fds, req.fd).getOption(req.level, req.name));
+    case "sock-setopt":
+      socketAt(fds, req.fd).setOption(req.level, req.name, req.value);
+      return ok();
+  }
+}
+function unnamed(domain) {
+  return domain === "inet" ? { family: "inet", host: "0.0.0.0", port: 0 } : { family: "unix", path: "" };
+}
+async function accept(proc, fd, nonblock) {
+  const listener = socketAt(proc.fds, fd);
+  const waits = !nonblock && !pollFile(listener).readable;
+  const socket = await listener.accept(waits ? proc.blocking() : void 0, nonblock);
+  return { fd: proc.fds.install(new OpenFile(socket), 3), peer: socket.peer };
+}
+
 // src/kernel/vfs-file.ts
 var O_ACCMODE = 3;
 var O_WRONLY = 1;
@@ -2140,14 +4073,14 @@ var VfsNode = class {
   fs;
   path;
   orphaned;
-  constructor(fs, path, contents, orphaned = false, dirty = false) {
+  constructor(fs, path, contents2, orphaned = false, dirty = false) {
     this.fs = fs;
     this.path = path;
     this.orphaned = orphaned;
-    if (contents !== void 0) this.data = new Uint8Array(contents);
+    if (contents2 !== void 0) this.data = new Uint8Array(contents2);
     else if (orphaned) this.data = new Uint8Array(0);
     this.length = this.data?.length ?? 0;
-    if (dirty && contents !== void 0) this.markDirty();
+    if (dirty && contents2 !== void 0) this.markDirty();
   }
   serial(op) {
     const next = this.queue.then(op);
@@ -2167,8 +4100,8 @@ var VfsNode = class {
     }
     return this.data;
   }
-  replace(contents) {
-    this.data = new Uint8Array(contents);
+  replace(contents2) {
+    this.data = new Uint8Array(contents2);
     this.length = this.data.length;
     this.missing = false;
     this.markDirty();
@@ -2249,13 +4182,13 @@ var VfsNodes = class {
     node.opens++;
     return node;
   }
-  adopt(path, contents, dirty) {
+  adopt(path, contents2, dirty) {
     let node = this.byPath.get(path);
     if (!node) {
-      node = new VfsNode(this.fs, path, contents, false, dirty);
+      node = new VfsNode(this.fs, path, contents2, false, dirty);
       this.byPath.set(path, node);
     } else if (dirty) {
-      node.replace(contents);
+      node.replace(contents2);
     }
     node.opens++;
     return node;
@@ -2377,6 +4310,12 @@ var JOB_OPS = /* @__PURE__ */ new Set([
 function isJobSyscall(req) {
   return JOB_OPS.has(req.op);
 }
+function isHttpSyscall(req) {
+  return req.op.startsWith("net-");
+}
+function isSocketSyscall(req) {
+  return req.op.startsWith("sock-");
+}
 function isPtySyscall(req) {
   return req.op.startsWith("pty-");
 }
@@ -2435,6 +4374,8 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "tty-pgrp-set",
   "sig-mask",
   "sig-pause",
+  ...SOCKET_OPS,
+  ...HTTP_OPS,
   ...PTY_OPS
 ]);
 function isWasmSyscall(req) {
@@ -2455,6 +4396,7 @@ var WasmProcess = class {
   resumed = Promise.resolve();
   wake;
   stateListeners = [];
+  net;
   nodes;
   pid;
   fds;
@@ -2524,6 +4466,8 @@ var WasmProcess = class {
       if (isFdSyscall(req)) return await this.fdSyscall(req);
       if (isTtySyscall(req)) return this.ttySyscall(req);
       if (isJobSyscall(req)) return this.jobSyscall(req);
+      if (isSocketSyscall(req)) return await this.socketSyscall(req);
+      if (isHttpSyscall(req)) return await this.httpSyscall(req);
       if (isPtySyscall(req)) {
         const { ptys, jobs } = this.options;
         return ptySyscall(req, { pid: this.pid, fds: this.fds, ptys, jobs });
@@ -2721,7 +4665,7 @@ var WasmProcess = class {
     const flags = this.fds.statusFlags(fd);
     return {
       tty: file.tty !== void 0,
-      kind: kernelFdKind(file),
+      kind: file instanceof KernelSocket ? "socket" : kernelFdKind(file),
       ...file.heldMeta ? { meta: file.heldMeta } : {},
       ...flags !== void 0 ? { flags } : {},
       ...this.fds.closesOnExec(fd) ? { cloexec: true } : {},
@@ -2794,6 +4738,19 @@ var WasmProcess = class {
         return { ok: true, kind: "json", json: jobs.setsid(this.pid) };
     }
   }
+  httpSyscall(req) {
+    const http = this.options.http;
+    if (!http) return Promise.resolve({ ok: false, errno: "ENETUNREACH", message: NO_TRANSPORT });
+    return http.syscall(req);
+  }
+  socketSyscall(req) {
+    this.net ??= this.options.net ?? new LoopbackNet();
+    return socketSyscall(req, {
+      fds: this.fds,
+      net: this.net,
+      blocking: () => this.blockingSignal()
+    });
+  }
   tty(fd) {
     const file = this.fds.get(fd).file;
     const tty = file.tty ?? file.pty?.slave;
@@ -2892,6 +4849,7 @@ var WasmProcess = class {
     this.clearAlarm();
     for (const pid of this.children.pids()) this.options.onReap?.(pid);
     await this.fds.closeAll();
+    await this.options.http?.closeAll();
   }
 };
 
@@ -2913,7 +4871,7 @@ function inheritedFds(fds) {
   return fds.numbers().filter((fd) => fd > 2 && !fds.get(fd).file.held).map((fd) => {
     const open = fds.get(fd);
     const flags = fds.statusFlags(fd);
-    const kind = kernelFdKind(open.file);
+    const kind = open.file instanceof KernelSocket ? "socket" : kernelFdKind(open.file);
     const meta = open.file.heldMeta;
     return {
       fd,
@@ -2927,7 +4885,7 @@ function inheritedFds(fds) {
 }
 function spawnWasmProcess(opts) {
   const sab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
-  const header = new Int32Array(sab, 0, SAB_HEADER_I32);
+  const header2 = new Int32Array(sab, 0, SAB_HEADER_I32);
   const process = new WasmProcess(opts.pid, opts.fds, {
     spawner: opts.spawner,
     forker: opts.forker,
@@ -2935,10 +4893,12 @@ function spawnWasmProcess(opts) {
     kill: opts.kill,
     jobs: opts.jobs,
     ptys: opts.ptys,
+    net: opts.net,
+    http: opts.http,
     onReap: opts.onReap,
-    onPending: (sig) => void Atomics.or(header, SAB_I_SIGNALS, sigbit(sig)),
-    onTimer: (which) => void Atomics.or(header, SAB_I_TIMERS, 1 << which),
-    hasPending: () => Atomics.load(header, SAB_I_SIGNALS) !== 0 || Atomics.load(header, SAB_I_TIMERS) !== 0,
+    onPending: (sig) => void Atomics.or(header2, SAB_I_SIGNALS, sigbit(sig)),
+    onTimer: (which) => void Atomics.or(header2, SAB_I_TIMERS, 1 << which),
+    hasPending: () => Atomics.load(header2, SAB_I_SIGNALS) !== 0 || Atomics.load(header2, SAB_I_TIMERS) !== 0,
     raise: (sig) => signal(sig)
   });
   const token = mintSyncFsToken({ fs: opts.fs, cwd: opts.cwd });
@@ -3073,9 +5033,9 @@ var JobTable = class {
     this.terminals.delete(pid);
     return pid;
   }
-  terminalNamed(name) {
+  terminalNamed(name2) {
     const known = /* @__PURE__ */ new Set([...this.terminals.values(), ...this.foreground.keys()]);
-    return [...known].find((tty) => tty.name === name);
+    return [...known].find((tty) => tty.name === name2);
   }
   controllingTerminal(pid) {
     const member = this.members.get(pid);
@@ -3145,12 +5105,12 @@ function childHandle(handle) {
     onState: (listener) => handle.onState(listener)
   };
 }
-function concat2(chunks) {
-  const out = new Uint8Array(chunks.reduce((n, chunk) => n + chunk.length, 0));
+function concat4(chunks) {
+  const out = new Uint8Array(chunks.reduce((n, chunk2) => n + chunk2.length, 0));
   let offset = 0;
-  for (const chunk of chunks) {
-    out.set(chunk, offset);
-    offset += chunk.length;
+  for (const chunk2 of chunks) {
+    out.set(chunk2, offset);
+    offset += chunk2.length;
   }
   return out;
 }
@@ -3167,13 +5127,23 @@ var Launcher = class {
   orphans = /* @__PURE__ */ new Set();
   jobs = new JobTable();
   ptys = new PtyTable((tty, sig) => this.jobs.signalOwnedForeground(tty, sig));
+  net = new LoopbackNet();
+  ca;
+  transport;
   nextPid = 1e3;
   terminals = 0;
   constructor(options) {
     this.base = options.fs;
     this.createWorker = options.createWorker;
     this.modulesDir = options.modules ?? "/node_modules";
-    this.env = options.env ?? {};
+    this.env = { ...networkEnv(), ...options.env };
+    this.ca = kernelCa(options.caStore ?? memoryCaStore());
+    this.transport = options.transport ?? missingTransport();
+    enableNetwork(this.net, {
+      transport: this.transport,
+      engine: kernelTlsEngine(packageTlsEngine(options.fs, this.modulesDir)),
+      ca: this.ca
+    });
     this.fs = withCommandDirs(options.fs, async () => new Set((await this.commands()).keys()));
   }
   commands() {
@@ -3181,9 +5151,9 @@ var Launcher = class {
     return this.catalog;
   }
   async resolve(file, argv0, cwd) {
-    const name = COMMAND2.exec(file)?.[1] ?? (file.includes("/") ? void 0 : file);
-    if (name !== void 0) {
-      const command = (await this.commands()).get(name);
+    const name2 = COMMAND2.exec(file)?.[1] ?? (file.includes("/") ? void 0 : file);
+    if (name2 !== void 0) {
+      const command = (await this.commands()).get(name2);
       return command && targetOf(command);
     }
     const glue = await followLinks(this.base, this.fs.resolvePath(cwd, file));
@@ -3276,6 +5246,8 @@ var Launcher = class {
       kill: (target, sig) => this.kill(target, sig),
       jobs: this.jobs,
       ptys: this.ptys,
+      net: this.net,
+      http: new HttpHandles(this.transport),
       onReap: (child) => this.reaped(child),
       ...req.fork ? { fork: req.fork } : {},
       ...req.ppid !== void 0 ? { ppid: req.ppid } : {}
@@ -3316,6 +5288,7 @@ var Launcher = class {
   }
   async prepare() {
     for (const dir of SHARED_DIRS) await this.base.mkdir(dir, { recursive: true });
+    await writeCaFile(this.base, this.ca).catch(() => void 0);
   }
   environment(cwd, extra) {
     return { PATH: "/usr/bin:/bin", HOME: "/home", ...this.env, PWD: cwd, ...extra };
@@ -3347,7 +5320,7 @@ var Launcher = class {
       COLORTERM: "truecolor",
       ...options.env
     });
-    const report = (message) => options.onData(encoder3.encode(`${message}\r
+    const report = (message2) => options.onData(encoder3.encode(`${message2}\r
 `));
     const handle = await this.launch(planned, { env, cwd, fds, report });
     leader = handle.pid;
@@ -3375,11 +5348,11 @@ var Launcher = class {
     };
     const stdout = collect(out, options.onStdout);
     const stderr = collect(err, options.onStderr);
-    const report = (message) => stderr(encoder3.encode(`${message}
+    const report = (message2) => stderr(encoder3.encode(`${message2}
 `));
     if (!planned) {
       report(`${file}: command not found`);
-      return { status: NOT_FOUND, stdout: concat2(out), stderr: concat2(err) };
+      return { status: NOT_FOUND, stdout: concat4(out), stderr: concat4(err) };
     }
     const fds = new FdTable();
     fds.installAt(0, options.stdin ? bytesSource(options.stdin) : nullFile());
@@ -3387,15 +5360,15 @@ var Launcher = class {
     fds.installAt(2, sinkFile(stderr));
     const handle = await this.launch(planned, { env, cwd, fds, report });
     const status = await handle.exited;
-    return { status, stdout: concat2(out), stderr: concat2(err) };
+    return { status, stdout: concat4(out), stderr: concat4(err) };
   }
 };
 
 // src/serve.ts
-function signalNumber(name) {
-  const key = name.slice(3);
-  if (!name.startsWith("SIG") || !Object.hasOwn(SIG, key))
-    throw new Error(`unknown signal ${name}`);
+function signalNumber(name2) {
+  const key = name2.slice(3);
+  if (!name2.startsWith("SIG") || !Object.hasOwn(SIG, key))
+    throw new Error(`unknown signal ${name2}`);
   return SIG[key];
 }
 function act(session, req) {
@@ -3406,6 +5379,7 @@ function act(session, req) {
 }
 function serveKernel(port, deps) {
   let launcher;
+  let remote;
   const terminals = /* @__PURE__ */ new Map();
   const reply = (id, body) => port.postMessage({ id, ...body });
   async function ready2() {
@@ -3426,15 +5400,18 @@ function serveKernel(port, deps) {
   async function handle(req) {
     if (req.op === "init") {
       launcher = (req.root ? Promise.resolve(req.root) : deps.storage()).then(async (root) => {
-        const name = req.metadata ?? META_DB;
-        const meta = name === false ? void 0 : await deps.metadata?.(name);
+        const name2 = req.metadata ?? META_DB;
+        const meta = name2 === false ? void 0 : await deps.metadata?.(name2);
+        remote = req.transport ? new RemoteTransport(port, req.transport) : void 0;
         const fs = new OpfsFs(root, meta);
         await fs.reconcile();
         const started = new Launcher({
           fs,
           createWorker: deps.createWorker,
           ...req.modules ? { modules: req.modules } : {},
-          ...req.env ? { env: req.env } : {}
+          ...req.env ? { env: req.env } : {},
+          ...remote ? { transport: remote } : {},
+          caStore: caStore(deps.metadata ? name2 : false)
         });
         await started.prepare();
         return started;
@@ -3456,6 +5433,10 @@ function serveKernel(port, deps) {
     });
   }
   port.addEventListener("message", (event) => {
+    if (event.data.net !== void 0) {
+      remote?.receive(event.data);
+      return;
+    }
     const req = event.data;
     handle(req).then(
       (result) => reply(req.id, { result }),
@@ -3469,6 +5450,6 @@ var processWorker = new URL("./process-worker.js", import.meta.url);
 serveKernel(globalThis, {
   storage: () => navigator.storage.getDirectory(),
   createWorker: () => new Worker(processWorker, { type: "module" }),
-  metadata: (name) => openMeta(name, indexedDB)
+  metadata: (name2) => openMeta(name2, indexedDB)
 });
 //# sourceMappingURL=kernel-worker.js.map