@ai-ecoverse/slicc-kernel 1.22.1 → 1.24.0

package/dist/kernel-worker.js

@@ -177,80 +177,6 @@ function openMeta(name2, factory) {
   });
 }
 
-// src/mount/media.ts
-var MEDIA_STORE = "handles";
-function memoryMedia() {
-  const handles = /* @__PURE__ */ new Map();
-  return {
-    get: async (id) => handles.get(id),
-    put: async (id, handle) => void handles.set(id, handle)
-  };
-}
-function settle2(request2, value) {
-  return new Promise((resolve, reject) => {
-    request2.onsuccess = () => resolve(value());
-    request2.onerror = () => reject(request2.error);
-  });
-}
-function openMedia(name2, factory) {
-  const request2 = factory.open(name2, 1);
-  request2.onupgradeneeded = () => request2.result.createObjectStore(MEDIA_STORE);
-  return settle2(request2, () => {
-    const db = request2.result;
-    const store = (mode) => db.transaction(MEDIA_STORE, mode).objectStore(MEDIA_STORE);
-    return {
-      get: (id) => {
-        const got = store("readonly").get(id);
-        return settle2(got, () => got.result);
-      },
-      put: (id, handle) => settle2(store("readwrite").put(handle, id), () => void 0)
-    };
-  });
-}
-
-// src/pin.ts
-function pinScript(url) {
-  try {
-    const request2 = new XMLHttpRequest();
-    request2.open("GET", url.href, false);
-    request2.send();
-    if (request2.status !== 200) return url.href;
-    const source = `${request2.responseText}
-//# sourceURL=${url.href}
-`;
-    return URL.createObjectURL(new Blob([source], { type: "text/javascript" }));
-  } catch {
-    return url.href;
-  }
-}
-
-// src/client/protocol.ts
-var PROTOCOL = [1, 4];
-var FS_METHODS = [
-  "readFile",
-  "writeFile",
-  "stat",
-  "lstat",
-  "readdir",
-  "mkdir",
-  "rm",
-  "rename",
-  "realpath",
-  "symlink",
-  "readlink",
-  "exists"
-];
-function locksOf(scope = globalThis) {
-  const locks = scope.navigator?.locks;
-  return typeof locks?.request === "function" ? locks : void 0;
-}
-function versionError(theirs) {
-  const major = Array.isArray(theirs) ? theirs[0] : void 0;
-  if (major === PROTOCOL[0]) return void 0;
-  const named = typeof major === "number" ? `${major}.x` : "without a version";
-  return `slicc-kernel client protocol ${named} is not supported: this side speaks ${PROTOCOL.join(".")}`;
-}
-
 // src/fs/types.ts
 function rangedOps(fs) {
   const { pread, pwrite, truncate } = fs;
@@ -285,1626 +211,1878 @@ function inodeOf(path) {
   return 4294967296 * (2097151 & h2) + (h1 >>> 0) || 1;
 }
 
-// src/kernel/pipe.ts
-var PIPE_CAPACITY = 64 * 1024;
-var PipeError = class extends Error {
-  code;
-  constructor(code) {
-    super(code);
-    this.code = code;
-  }
+// src/fs/opfs.ts
+var S_IFDIR = 16384;
+var S_IFREG = 32768;
+var S_IFLNK = 40960;
+var PERM_MASK = 4095;
+var READ_ATTEMPTS = 3;
+var MAX_LINKS = 40;
+var CHECK_MS = 1e3;
+var EXECUTABLE = /\/node_modules\/(?:@[^/]+\/)?[^/]+\/bin\//;
+var ERRNO_BY_DOM_ERROR = {
+  NotFoundError: "ENOENT",
+  TypeMismatchError: "ENOTDIR",
+  InvalidModificationError: "ENOTEMPTY",
+  NoModificationAllowedError: "EBUSY",
+  TypeError: "EINVAL",
+  NotAllowedError: "EACCES"
 };
-var KernelPipe = class {
-  chunks = [];
-  size = 0;
-  readers = 0;
-  writers = 0;
-  waiters = [];
-  capacity;
-  constructor(capacity = PIPE_CAPACITY) {
-    this.capacity = capacity;
+function translate(err, path) {
+  if (typeof err?.code === "string") return err;
+  const name2 = err?.name;
+  return fsError(typeof name2 === "string" && ERRNO_BY_DOM_ERROR[name2] || "EIO", path);
+}
+function missing(err) {
+  const code = err?.code;
+  return code === "ENOENT" || code === "ENOTDIR";
+}
+function split(path) {
+  return path.split("/").filter(Boolean);
+}
+function parentOf2(path) {
+  return path.slice(0, path.lastIndexOf("/")) || "/";
+}
+function baseOf(path) {
+  return path.slice(path.lastIndexOf("/") + 1);
+}
+function prefixes(path) {
+  const parts = split(path);
+  return parts.map((_, i) => `/${parts.slice(0, i + 1).join("/")}`);
+}
+function within(path, root) {
+  return path === root || path.startsWith(`${root}/`);
+}
+var LOCKED = /* @__PURE__ */ new Set(["NotReadableError", "NoModificationAllowedError", "InvalidStateError"]);
+var SYNC_BACKOFF_MS = [5, 10, 20, 40, 80];
+async function openSync(handle) {
+  const sync = handle.createSyncAccessHandle;
+  if (!sync) return void 0;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await sync.call(handle, { mode: "readwrite-unsafe" });
+    } catch (err) {
+      const delay = SYNC_BACKOFF_MS[attempt];
+      if (!LOCKED.has(err?.name)) throw err;
+      if (delay === void 0) return void 0;
+      await new Promise((resolve) => setTimeout(resolve, delay));
+    }
   }
-  get buffered() {
-    return this.size;
+}
+function writeAll(access, at, bytes) {
+  for (let done4 = 0; done4 < bytes.length; ) {
+    const n = access.write(bytes.subarray(done4), { at: at + done4 });
+    if (!(n > 0))
+      throw Object.assign(new Error("the file system took no more bytes"), { code: "ENOSPC" });
+    done4 += n;
   }
-  get readReady() {
-    return this.size > 0 || this.writers === 0;
+}
+async function positioned(handle, op) {
+  const access = await openSync(handle);
+  if (access) {
+    try {
+      op({
+        write: (at, bytes) => writeAll(access, at, bytes),
+        truncate: (n) => access.truncate(n)
+      });
+      access.flush();
+    } finally {
+      access.close();
+    }
+    return;
   }
-  get writeReady() {
-    return this.size < this.capacity || this.readers === 0;
+  const writable = await handle.createWritable({ keepExistingData: true });
+  try {
+    await op({
+      write: (at, bytes) => writable.write({ type: "write", position: at, data: bytes }),
+      truncate: (n) => writable.truncate(n)
+    });
+  } catch (err) {
+    await writable.abort();
+    throw err;
   }
-  get writersGone() {
-    return this.writers === 0;
+  await writable.close();
+}
+function syncAccessHandles(scope = globalThis) {
+  const handle = scope.FileSystemFileHandle;
+  return handle !== void 0 && "createSyncAccessHandle" in handle.prototype;
+}
+function isHandle(child) {
+  return "kind" in child;
+}
+var OpfsFs = class {
+  root;
+  meta;
+  dirs = /* @__PURE__ */ new Map();
+  checked = /* @__PURE__ */ new WeakMap();
+  channel;
+  ranged;
+  constructor(root, meta = new MemoryMeta(), channel, options = {}) {
+    this.root = root;
+    this.meta = meta;
+    this.ranged = options.ranged === true;
+    this.channel = channel === void 0 ? void 0 : new BroadcastChannel(channel);
+    if (this.channel) {
+      this.channel.onmessage = ({ data }) => {
+        for (const path of data) this.forget(path);
+      };
+      this.channel.unref?.();
+    }
   }
-  get readersGone() {
-    return this.readers === 0;
+  changed(...paths) {
+    for (const path of paths) this.forget(path);
+    this.channel?.postMessage(paths);
   }
-  openRead() {
-    this.readers += 1;
+  resolvePath(base, path) {
+    return resolvePath(base, path);
   }
-  openWrite() {
-    this.writers += 1;
+  async walk(parts, from, start) {
+    let dir = start;
+    for (let at = from; at < parts.length; at++) {
+      dir = await dir.getDirectoryHandle(parts[at]);
+      this.dirs.set(`/${parts.slice(0, at + 1).join("/")}`, dir);
+      this.checked.set(dir, performance.now());
+    }
+    return dir;
   }
-  closeRead() {
-    if (this.readers > 0) this.readers -= 1;
-    if (this.readers === 0) {
-      this.chunks = [];
-      this.size = 0;
+  async dir(path) {
+    const parts = split(path);
+    let from = parts.length;
+    let cached;
+    for (; from > 0 && !cached; from--)
+      cached = this.dirs.get(`/${parts.slice(0, from).join("/")}`);
+    if (cached) from++;
+    const at = `/${parts.slice(0, from).join("/")}`;
+    if (cached && !await this.current(at, cached)) {
+      this.forget(at);
+      cached = void 0;
+      from = 0;
+    }
+    try {
+      return await this.walk(parts, from, cached ?? this.root);
+    } catch (err) {
+      throw translate(err, path);
     }
-    this.wake();
   }
-  closeWrite() {
-    if (this.writers > 0) this.writers -= 1;
-    this.wake();
+  async current(path, dir) {
+    if (performance.now() - (this.checked.get(dir) ?? -CHECK_MS) < CHECK_MS) return true;
+    const where = await this.root.resolve(dir).catch(() => null);
+    if (where === null || `/${where.join("/")}` !== path) return false;
+    this.checked.set(dir, performance.now());
+    return true;
   }
-  async read(max, signal) {
-    while (this.size === 0) {
-      if (this.writers === 0) return new Uint8Array(0);
-      await this.changed(signal);
-    }
-    const out = this.take(Math.min(max, this.size));
-    this.wake();
-    return out;
+  forget(path) {
+    for (const key of [...this.dirs.keys()]) if (within(key, path)) this.dirs.delete(key);
   }
-  async peek(max, signal) {
-    while (this.size === 0) {
-      if (this.writers === 0) return new Uint8Array(0);
-      await this.changed(signal);
-    }
-    const out = new Uint8Array(Math.min(max, this.size));
-    let filled = 0;
-    for (const chunk2 of this.chunks) {
-      if (filled === out.length) break;
-      const count = Math.min(chunk2.length, out.length - filled);
-      out.set(chunk2.subarray(0, count), filled);
-      filled += count;
+  async inDir(path, op) {
+    const dir = await this.dir(path);
+    try {
+      return await op(dir);
+    } catch (err) {
+      if (err?.name !== "NotFoundError" || await this.current(path, dir))
+        throw err;
+      this.forget(path);
+      return op(await this.dir(path));
     }
-    return out;
   }
-  async write(bytes, signal) {
-    let offset = 0;
-    while (offset < bytes.length) {
-      if (this.readers === 0) throw new PipeError("EPIPE");
-      const room = this.capacity - this.size;
-      if (room === 0) {
-        try {
-          await this.changed(signal);
-        } catch (e) {
-          if (offset > 0) return offset;
-          throw e;
-        }
-        continue;
+  async child(parent, name2, kind) {
+    return kind === "file" ? parent.getFileHandle(name2) : parent.getDirectoryHandle(name2);
+  }
+  async parent(path) {
+    const parts = split(path);
+    const name2 = parts.pop();
+    if (name2 === void 0) throw fsError("EBUSY", path);
+    return [`/${parts.join("/")}`, name2];
+  }
+  async handle(path) {
+    if (split(path).length === 0) return this.root;
+    const [dir, name2] = await this.parent(path);
+    const known = this.dirs.has(path);
+    return this.inDir(dir, async (parent) => {
+      const [first, second] = known ? ["directory", "file"] : ["file", "directory"];
+      try {
+        return await this.child(parent, name2, first);
+      } catch (err) {
+        if (err?.name !== "TypeMismatchError") throw err;
       }
-      const n = Math.min(room, bytes.length - offset);
-      this.chunks.push(bytes.slice(offset, offset + n));
-      this.size += n;
-      offset += n;
-      this.wake();
+      return this.child(parent, name2, second);
+    }).catch((err) => {
+      throw translate(err, path);
+    });
+  }
+  real(path) {
+    return this.handle(path).then(
+      () => true,
+      () => false
+    );
+  }
+  async linkAlong(path) {
+    for (const entry of await this.meta.get(prefixes(path))) {
+      if (entry?.link === void 0) continue;
+      if (!await this.real(entry.path) && await this.real(parentOf2(entry.path))) return entry;
     }
-    return bytes.length;
+    return void 0;
   }
-  take(n) {
-    const out = new Uint8Array(n);
-    let filled = 0;
-    while (filled < n) {
-      const head = this.chunks[0];
-      const count = Math.min(head.length, n - filled);
-      out.set(head.subarray(0, count), filled);
-      filled += count;
-      if (count === head.length) this.chunks.shift();
-      else this.chunks[0] = head.subarray(count);
+  async locate(path, follow) {
+    let current = path;
+    for (let hops = 0; hops <= MAX_LINKS; hops++) {
+      try {
+        return { path: current, handle: await this.handle(current) };
+      } catch (err) {
+        if (!missing(err)) throw err;
+        const link2 = await this.linkAlong(current);
+        if (!link2) throw err;
+        if (link2.path === current && !follow) return { path: current, link: link2 };
+        const rest = current.slice(link2.path.length);
+        current = resolvePath(parentOf2(link2.path), `${link2.link}${rest}`);
+      }
     }
-    this.size -= n;
-    return out;
+    throw fsError("ELOOP", path);
   }
-  changed(signal) {
-    if (signal?.aborted) return Promise.reject(new PipeError("EINTR"));
-    return new Promise((resolve, reject) => {
-      const onAbort = () => {
-        this.waiters = this.waiters.filter((w) => w !== waiter);
-        reject(new PipeError("EINTR"));
-      };
-      const waiter = () => {
-        signal?.removeEventListener("abort", onAbort);
-        resolve();
-      };
-      this.waiters.push(waiter);
-      signal?.addEventListener("abort", onAbort, { once: true });
-    });
+  mode(path, directory, meta) {
+    const fallback = directory || EXECUTABLE.test(path) ? 493 : 420;
+    return (directory ? S_IFDIR : S_IFREG) | (meta?.mode ?? fallback);
   }
-  wake() {
-    const waiters = this.waiters;
-    this.waiters = [];
-    for (const resolve of waiters) resolve();
+  async statOf(path, handle, meta) {
+    const directory = handle.kind === "directory";
+    const file = directory ? void 0 : await handle.getFile();
+    const modified = file?.lastModified ?? 0;
+    const mtime = meta?.mtimeMs !== void 0 && meta.mtimeFor === modified ? meta.mtimeMs : modified;
+    return {
+      isFile: !directory,
+      isDirectory: directory,
+      isSymbolicLink: false,
+      size: file?.size ?? 0,
+      mode: this.mode(path, directory, meta),
+      mtime: new Date(mtime),
+      atime: new Date(meta?.atimeMs ?? mtime),
+      ctime: new Date(Math.max(meta?.ctimeMs ?? mtime, modified)),
+      ino: meta?.ino ?? inodeOf(path),
+      ...this.ranged && !directory ? { ranged: true } : {}
+    };
   }
-};
-
-// src/kernel/fd-table.ts
-var KernelError = class extends Error {
-  code;
-  constructor(code) {
-    super(code);
-    this.code = code;
+  linkStat(entry) {
+    const time2 = new Date(entry.mtimeMs ?? 0);
+    return {
+      isFile: false,
+      isDirectory: false,
+      isSymbolicLink: true,
+      size: new TextEncoder().encode(entry.link).length,
+      mode: S_IFLNK | 511,
+      mtime: time2,
+      atime: time2,
+      ctime: new Date(entry.ctimeMs ?? 0),
+      ino: entry.ino ?? inodeOf(entry.path)
+    };
   }
-};
-function pollFile(file) {
-  return file.poll?.() ?? { readable: !!file.read, writable: !!file.write, hangup: false };
-}
-var OpenFile = class {
-  refs = 1;
-  file;
-  constructor(file) {
-    this.file = file;
+  async describe(found) {
+    if (found.link) return this.linkStat(found.link);
+    const [meta] = await this.meta.get([found.path]);
+    return this.statOf(found.path, found.handle, meta);
   }
-  retain() {
-    this.refs += 1;
-    return this;
+  async stat(path) {
+    return this.describe(await this.locate(path, true));
   }
-  release() {
-    this.refs -= 1;
-    if (this.refs === 0) return this.file.close();
+  async lstat(path) {
+    return this.describe(await this.locate(path, false));
   }
-};
-function openPipe(capacity) {
-  const pipe = new KernelPipe(capacity);
-  pipe.openRead();
-  pipe.openWrite();
-  return {
-    read: new OpenFile({
-      read: async (max, signal) => {
-        try {
-          return await pipe.read(max, signal);
-        } catch (e) {
-          throw new KernelError(e.code);
-        }
-      },
-      close: () => pipe.closeRead(),
-      poll: () => ({ readable: pipe.readReady, writable: false, hangup: pipe.writersGone }),
-      changed: (signal) => pipe.changed(signal)
-    }),
-    write: new OpenFile({
-      write: async (bytes, signal) => {
-        try {
-          return await pipe.write(bytes, signal);
-        } catch (e) {
-          throw new KernelError(e.code);
-        }
-      },
-      close: () => pipe.closeWrite(),
-      poll: () => ({ readable: false, writable: pipe.writeReady, hangup: pipe.readersGone }),
-      changed: (signal) => pipe.changed(signal)
-    })
-  };
-}
-function bytesSource(data) {
-  let offset = 0;
-  return new OpenFile({
-    read: async (max) => {
-      const out = data.subarray(offset, offset + max);
-      offset += out.length;
-      return out;
-    },
-    close: () => {
-    }
-  });
-}
-function sinkFile(onData) {
-  return new OpenFile({
-    write: async (bytes) => {
-      onData(bytes.slice());
-      return bytes.length;
-    },
-    close: () => {
-    }
-  });
-}
-function nullFile() {
-  return new OpenFile({
-    read: async () => new Uint8Array(0),
-    write: async (bytes) => bytes.length,
-    close: () => {
-    }
-  });
-}
-function deviceFile(device, access) {
-  const read = async (max) => {
-    if (device === "null") return new Uint8Array(0);
-    const out = new Uint8Array(max);
-    if (device === "urandom") {
-      for (let at = 0; at < max; at += 65536) {
-        crypto.getRandomValues(out.subarray(at, Math.min(max, at + 65536)));
+  async exists(path) {
+    return this.locate(path, true).then(
+      () => true,
+      () => false
+    );
+  }
+  async retrying(path, op, locks) {
+    for (let attempt = 1; ; attempt++) {
+      try {
+        return await op();
+      } catch (err) {
+        const name2 = err?.name;
+        const again = name2 === "NotReadableError" || locks && LOCKED.has(name2);
+        if (!again || attempt >= READ_ATTEMPTS) throw translate(err, path);
+        await new Promise((resolve) => setTimeout(resolve, attempt * 10));
       }
     }
-    return out;
-  };
-  return new OpenFile({
-    ...access !== "write" ? { read } : {},
-    ...access !== "read" ? { write: async (bytes) => bytes.length } : {},
-    seek: async () => 0,
-    heldMeta: { device, ...access ? { access } : {} },
-    close: () => {
-    }
-  });
-}
-function heldFile(meta) {
-  return new OpenFile({ held: true, ...meta ? { heldMeta: meta } : {}, close: () => {
-  } });
-}
-function kernelFdKind(file) {
-  if (file.held) return "held";
-  if (file.heldMeta && "device" in file.heldMeta) return "device";
-  if (file.tty) return "tty";
-  return file.seek ? "file" : "stream";
-}
-var FdTable = class _FdTable {
-  static MAX_FDS = 1024;
-  fds = /* @__PURE__ */ new Map();
-  cloexec = /* @__PURE__ */ new Set();
-  status = /* @__PURE__ */ new Map();
-  get(fd) {
-    const file = this.fds.get(fd);
-    if (!file) throw new KernelError("EBADF");
-    return file;
-  }
-  stdioTerminal() {
-    for (const fd of [0, 1, 2]) {
-      const tty = this.fds.get(fd)?.file.tty;
-      if (tty) return tty;
-    }
-    return void 0;
-  }
-  numbers() {
-    return [...this.fds.keys()].sort((a, b) => a - b);
   }
-  has(fd) {
-    return this.fds.has(fd);
+  async existing(path) {
+    const handle = (await this.locate(path, true)).handle;
+    if (handle.kind === "directory") throw fsError("EISDIR", path);
+    return handle;
   }
-  setCloseOnExec(fd) {
-    this.get(fd);
-    this.cloexec.add(fd);
+  async readFileBuffer(path) {
+    const handle = await this.existing(path);
+    return this.retrying(
+      path,
+      async () => new Uint8Array(await (await handle.getFile()).arrayBuffer()),
+      false
+    );
   }
-  clearCloseOnExec(fd) {
-    this.get(fd);
-    this.cloexec.delete(fd);
+  async pread(path, offset, length2) {
+    const handle = await this.existing(path);
+    return this.retrying(
+      path,
+      async () => new Uint8Array(await (await handle.getFile()).slice(offset, offset + length2).arrayBuffer()),
+      false
+    );
   }
-  closesOnExec(fd) {
-    return this.cloexec.has(fd);
+  async pwrite(path, offset, bytes) {
+    const handle = (await this.fileFor(path))[0];
+    await this.retrying(path, () => positioned(handle, (io) => io.write(offset, bytes)), true);
   }
-  setStatusFlags(fd, flags) {
-    this.get(fd);
-    this.status.set(fd, flags);
+  async truncate(path, size) {
+    const handle = await this.existing(path);
+    await this.retrying(path, () => positioned(handle, (io) => io.truncate(size)), true);
   }
-  statusFlags(fd) {
-    return this.status.get(fd);
+  async readFile(path) {
+    return new TextDecoder().decode(await this.readFileBuffer(path));
   }
-  install(file, min = 0) {
-    for (let fd = min; fd < _FdTable.MAX_FDS; fd++) {
-      if (!this.fds.has(fd)) {
-        this.fds.set(fd, file);
-        return fd;
-      }
+  async writeTarget(path) {
+    try {
+      return [(await this.locate(path, true)).path, true];
+    } catch (err) {
+      if (!missing(err)) throw err;
     }
-    void Promise.resolve(file.release()).catch(() => void 0);
-    throw new KernelError("EMFILE");
+    const [entry] = await this.meta.get([path]);
+    const wanted = entry?.link === void 0 ? path : resolvePath(parentOf2(path), entry.link);
+    return [resolvePath((await this.locate(parentOf2(wanted), true)).path, baseOf(wanted)), false];
   }
-  installAt(fd, file) {
-    if (fd < 0 || fd >= _FdTable.MAX_FDS) {
-      void Promise.resolve(file.release()).catch(() => void 0);
-      throw new KernelError("EBADF");
+  async fileFor(path) {
+    const [target, existed] = await this.writeTarget(path);
+    const [dir, name2] = await this.parent(target);
+    try {
+      return [
+        await this.inDir(dir, (parent) => parent.getFileHandle(name2, { create: true })),
+        existed
+      ];
+    } catch (err) {
+      const code = err?.name === "TypeMismatchError" ? "EISDIR" : null;
+      throw code ? fsError(code, path) : translate(err, path);
     }
-    const previous = this.fds.get(fd);
-    this.fds.set(fd, file);
-    this.cloexec.delete(fd);
-    this.status.delete(fd);
-    void Promise.resolve(previous?.release()).catch(() => void 0);
   }
-  dup(fd, min = 0) {
-    return this.install(this.get(fd).retain(), min);
+  async writeFile(path, content) {
+    const [file, existed] = await this.fileFor(path);
+    if (!existed && content.length === 0) return;
+    const writable = await file.createWritable();
+    await writable.write(content);
+    await writable.close();
   }
-  dup2(oldFd, newFd) {
-    const file = this.get(oldFd);
-    if (oldFd !== newFd) this.installAt(newFd, file.retain());
-    return newFd;
+  async listing(path) {
+    const found = await this.locate(path, true);
+    const handle = found.handle;
+    if (handle.kind !== "directory") throw fsError("ENOTDIR", path);
+    const children2 = /* @__PURE__ */ new Map();
+    for await (const child of handle.values()) children2.set(child.name, child);
+    for (const link2 of await this.meta.links(found.path)) {
+      const name2 = baseOf(link2.path);
+      if (!children2.has(name2)) children2.set(name2, link2);
+    }
+    return [found.path, [...children2].sort(([a], [b]) => a < b ? -1 : 1)];
   }
-  close(fd) {
-    const file = this.get(fd);
-    this.fds.delete(fd);
-    this.cloexec.delete(fd);
-    this.status.delete(fd);
-    return file.release();
+  async readdir(path) {
+    return (await this.listing(path))[1].map(([name2]) => name2);
   }
-  fork() {
-    const child = new _FdTable();
-    for (const [fd, file] of this.fds) child.fds.set(fd, file.retain());
-    for (const fd of this.cloexec) child.cloexec.add(fd);
-    for (const [fd, flags] of this.status) child.status.set(fd, flags);
-    return child;
+  async readdirStat(path) {
+    const [dir, children2] = await this.listing(path);
+    const base = dir === "/" ? "" : dir;
+    const metas = await this.meta.get(children2.map(([name2]) => `${base}/${name2}`));
+    return Promise.all(
+      children2.map(async ([name2, child], i) => {
+        if (!isHandle(child)) return [name2, this.linkStat(child)];
+        const stat = await this.statOf(`${base}/${name2}`, child, metas[i]).catch(() => null);
+        return [name2, stat];
+      })
+    );
   }
-  async closeAll() {
-    const files = [...this.fds.values()];
-    this.fds.clear();
-    this.cloexec.clear();
-    this.status.clear();
-    await Promise.allSettled(files.map((file) => Promise.resolve().then(() => file.release())));
+  async mkdir(path, options = {}) {
+    let found;
+    try {
+      found = await this.locate(path, true);
+    } catch (err) {
+      if (!missing(err)) throw err;
+    }
+    if (found) {
+      const directory = found.handle?.kind === "directory";
+      if (options.recursive && directory) return;
+      throw fsError(options.recursive ? "ENOTDIR" : "EEXIST", path);
+    }
+    const [entry] = await this.meta.get([path]);
+    if (entry?.link !== void 0) throw fsError("EEXIST", path);
+    if (options.recursive) await this.mkdir(parentOf2(path), options);
+    const parent = await this.locate(parentOf2(path), true);
+    if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
+    await parent.handle.getDirectoryHandle(baseOf(path), { create: true });
   }
-};
-
-// src/kernel/socket.ts
-var SOMAXCONN = 4096;
-var EPHEMERAL_FIRST = 32768;
-var EPHEMERAL_LAST = 60999;
-var SOL_SOCKET = 1;
-var SO_TYPE = 3;
-var SO_ERROR = 4;
-var SO_SNDBUF = 7;
-var SO_RCVBUF = 8;
-var SO_ACCEPTCONN = 30;
-var SO_DOMAIN = 39;
-var SOCK_STREAM = 1;
-var AF_UNIX = 1;
-var AF_INET = 2;
-var SHUT_RD = 0;
-var SHUT_WR = 1;
-var SHUT_RDWR = 2;
-function isLoopback(host) {
-  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
-}
-async function pipeCall(op) {
-  try {
-    return await op();
-  } catch (e) {
-    if (e instanceof PipeError) throw new KernelError(e.code);
-    throw e;
+  async rm(path, options = {}) {
+    let found;
+    try {
+      found = await this.locate(path, false);
+    } catch (err) {
+      const error = translate(err, path);
+      if (options.force && error.code === "ENOENT") return;
+      throw error;
+    }
+    if (found.handle) {
+      const [dir, name2] = await this.parent(found.path);
+      try {
+        await this.inDir(
+          dir,
+          (parent) => parent.removeEntry(name2, { recursive: options.recursive === true })
+        );
+      } catch (err) {
+        throw translate(err, path);
+      }
+      this.changed(found.path);
+    }
+    await this.meta.remove([found.path]);
   }
-}
-var Changes = class {
-  waiters = [];
-  wait(signal) {
-    if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
-    return new Promise((resolve, reject) => {
-      const onAbort = () => {
-        this.waiters = this.waiters.filter((w) => w !== waiter);
-        reject(new KernelError("EINTR"));
-      };
-      const waiter = () => {
-        signal?.removeEventListener("abort", onAbort);
-        resolve();
-      };
-      this.waiters.push(waiter);
-      signal?.addEventListener("abort", onAbort, { once: true });
+  async rename(from, to) {
+    if (from === to) return;
+    const source = await this.locate(from, false);
+    this.forget(source.path);
+    const parent = await this.locate(parentOf2(to), true);
+    const destination = resolvePath(parent.path, baseOf(to));
+    const sourceStat = await this.describe(source);
+    if (sourceStat.isDirectory && within(destination, source.path)) throw fsError("EINVAL", to);
+    const target = await this.locate(destination, false).catch((err) => {
+      if (missing(err)) return null;
+      throw err;
     });
-  }
-  wake() {
-    const waiters = this.waiters;
-    this.waiters = [];
-    for (const resolve of waiters) resolve();
-  }
-};
-function link(a, b) {
-  const ab = new KernelPipe();
-  const ba = new KernelPipe();
-  for (const pipe of [ab, ba]) {
-    pipe.openRead();
-    pipe.openWrite();
-  }
-  a.attach({ rx: ba, tx: ab });
-  b.attach({ rx: ab, tx: ba });
-}
-var KernelSocket = class _KernelSocket {
-  net;
-  domain;
-  state = "open";
-  local;
-  peer;
-  link;
-  readShut = false;
-  writeShut = false;
-  queue = [];
-  backlog = 0;
-  bound = false;
-  changes = new Changes();
-  options = /* @__PURE__ */ new Map();
-  constructor(net, domain) {
-    this.net = net;
-    this.domain = domain;
-  }
-  attach(link2) {
-    this.link = link2;
-    this.state = "connected";
-    this.changes.wake();
-  }
-  get listening() {
-    return this.state === "listening";
-  }
-  connection() {
-    if (!this.link || this.state !== "connected") throw new KernelError("ENOTCONN");
-    return this.link;
-  }
-  async read(max, signal) {
-    const { rx } = this.connection();
-    if (this.readShut || max <= 0) return new Uint8Array(0);
-    return pipeCall(() => rx.read(max, signal));
-  }
-  async peek(max, signal) {
-    const { rx } = this.connection();
-    if (this.readShut || max <= 0) return new Uint8Array(0);
-    return pipeCall(() => rx.peek(max, signal));
-  }
-  async write(bytes, signal) {
-    const { tx } = this.connection();
-    if (this.writeShut) throw new KernelError("EPIPE");
-    return pipeCall(() => tx.write(bytes, signal));
-  }
-  poll() {
-    if (this.state === "listening") {
-      return { readable: this.queue.length > 0, writable: false, hangup: false };
+    const targetStat = target && await this.describe(target);
+    if (targetStat?.isDirectory && !sourceStat.isDirectory) throw fsError("EISDIR", to);
+    if (targetStat && !targetStat.isDirectory && sourceStat.isDirectory) {
+      throw fsError("ENOTDIR", to);
     }
-    if (this.state !== "connected" || !this.link) {
-      return { readable: false, writable: false, hangup: true };
+    if (targetStat?.isDirectory && (await this.readdir(destination)).length > 0) {
+      throw fsError("ENOTEMPTY", to);
     }
-    const { rx, tx } = this.link;
-    return {
-      readable: this.readShut || rx.readReady,
-      writable: this.writeShut || tx.writeReady,
-      hangup: rx.writersGone && tx.readersGone
-    };
-  }
-  changed(signal) {
-    const own = this.changes.wait(signal);
-    if (this.state !== "connected" || !this.link) return own;
-    const waits = [own, this.link.rx.changed(signal), this.link.tx.changed(signal)];
-    for (const wait2 of waits) wait2.catch(() => void 0);
-    return pipeCall(() => Promise.race(waits));
-  }
-  bind(addr) {
-    if (this.state !== "open" || this.local) throw new KernelError("EINVAL");
-    if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
-    this.local = this.net.bind(this, addr);
-    this.bound = true;
-  }
-  listen(backlog) {
-    if (this.state === "connected") throw new KernelError("EISCONN");
-    if (this.state !== "open" && this.state !== "listening") throw new KernelError("EINVAL");
-    if (!this.local) {
-      if (this.domain === "unix") throw new KernelError("EINVAL");
-      this.bind({ family: "inet", host: "0.0.0.0", port: 0 });
+    const now = Date.now();
+    const carry = (entry) => ({
+      ino: inodeOf(source.path),
+      ...entry,
+      path: destination,
+      ctimeMs: now
+    });
+    if (source.link) {
+      if (target?.handle) await this.rm(destination);
+      await this.meta.move(source.path, destination, carry);
+      return;
     }
-    this.backlog = Math.min(Math.max(backlog, 1), SOMAXCONN);
-    this.state = "listening";
-  }
-  async accept(signal, nonblock = false) {
-    for (; ; ) {
-      if (this.state !== "listening") throw new KernelError("EINVAL");
-      const next = this.queue.shift();
-      if (next) return next;
-      if (nonblock) throw new KernelError("EAGAIN");
-      await this.changes.wait(signal);
+    const dir = parent.handle;
+    const name2 = baseOf(destination);
+    const swap = targetStat?.isDirectory === true;
+    const staging = swap ? `.${name2}.${crypto.randomUUID()}` : name2;
+    this.forget(destination);
+    const timed = await this.explicitTimes(source.path);
+    const moved2 = await this.place(source.handle, dir, staging);
+    if (swap) await this.rm(destination, { recursive: true });
+    await this.meta.move(source.path, destination, carry);
+    if (!moved2) await this.rm(source.path, { recursive: true });
+    let copied = !moved2;
+    if (swap) {
+      const staged = await dir.getDirectoryHandle(staging);
+      const placed = await this.place(staged, dir, name2);
+      if (!placed) await dir.removeEntry(staging, { recursive: true });
+      copied ||= !placed;
     }
+    if (copied) await this.restamp(destination, timed);
+    this.changed(source.path, destination);
   }
-  offer(server) {
-    if (this.state !== "listening" || this.queue.length >= this.backlog) return false;
-    this.queue.push(server);
-    this.changes.wake();
-    return true;
+  async modified(path) {
+    const handle = await this.handle(path);
+    return handle.kind === "file" ? (await handle.getFile()).lastModified : 0;
   }
-  connect(addr) {
-    if (this.state === "connected") throw new KernelError("EISCONN");
-    if (this.state !== "open") throw new KernelError("EINVAL");
-    if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
-    const target = this.net.target(addr);
-    if (!this.local) {
-      if (addr.family === "inet") {
-        this.local = this.net.bind(this, { family: "inet", host: "127.0.0.1", port: 0 });
-        this.bound = true;
-      } else this.local = { family: "unix", path: "" };
-    }
-    const server = new _KernelSocket(this.net, this.domain);
-    server.local = addr.family === "inet" ? { ...addr, host: canonicalHost(addr.host) } : addr;
-    server.peer = this.local;
-    this.peer = server.local;
-    link(this, server);
-    if (!target.offer(server)) {
-      this.unlink();
-      server.close();
-      throw new KernelError("ECONNREFUSED");
+  async explicitTimes(path) {
+    const timed = [];
+    for (const entry of await this.meta.under(path)) {
+      if (entry.mtimeFor === void 0 || entry.link !== void 0) continue;
+      const current = await this.modified(entry.path).catch(() => void 0);
+      if (current === entry.mtimeFor) timed.push(entry.path.slice(path.length));
     }
+    return timed;
   }
-  unlink() {
-    const link2 = this.link;
-    if (link2) {
-      link2.rx.closeRead();
-      link2.tx.closeWrite();
+  async restamp(path, timed) {
+    for (const rest of timed) {
+      const mtimeFor = await this.modified(path + rest);
+      await this.meta.update(path + rest, (entry) => entry && { ...entry, mtimeFor });
     }
-    this.link = void 0;
-    this.peer = void 0;
-    this.state = "open";
   }
-  shutdown(how) {
-    const { rx, tx } = this.connection();
-    if (how !== SHUT_RD && how !== SHUT_WR && how !== SHUT_RDWR) throw new KernelError("EINVAL");
-    if (how !== SHUT_WR && !this.readShut) {
-      this.readShut = true;
-      rx.closeRead();
-    }
-    if (how !== SHUT_RD && !this.writeShut) {
-      this.writeShut = true;
-      tx.closeWrite();
+  async place(handle, dir, name2) {
+    const moved2 = await handle.move?.(dir, name2).then(
+      () => true,
+      () => false
+    );
+    if (moved2) return true;
+    try {
+      await this.copy(handle, dir, name2);
+    } catch (err) {
+      if (handle.kind === "directory") await dir.removeEntry(name2, { recursive: true });
+      throw translate(err, name2);
     }
-    this.changes.wake();
+    return false;
   }
-  getOption(level, name2) {
-    if (level === SOL_SOCKET) {
-      switch (name2) {
-        case SO_TYPE:
-          return SOCK_STREAM;
-        case SO_ERROR:
-          return 0;
-        case SO_ACCEPTCONN:
-          return this.state === "listening" ? 1 : 0;
-        case SO_DOMAIN:
-          return this.domain === "inet" ? AF_INET : AF_UNIX;
-        case SO_SNDBUF:
-        case SO_RCVBUF:
-          return this.options.get(`${level}:${name2}`) ?? PIPE_CAPACITY;
-      }
+  async copy(handle, dir, name2) {
+    if (handle.kind === "file") {
+      const writable = await (await dir.getFileHandle(name2, { create: true })).createWritable();
+      await writable.write(await handle.getFile());
+      await writable.close();
+      return;
     }
-    return this.options.get(`${level}:${name2}`) ?? 0;
-  }
-  setOption(level, name2, value) {
-    this.options.set(`${level}:${name2}`, value);
+    const target = await dir.getDirectoryHandle(name2, { create: true });
+    for await (const child of handle.values()) await this.copy(child, target, child.name);
   }
-  close() {
-    const was = this.state;
-    this.state = "closed";
-    if (was === "listening") {
-      for (const pending of this.queue.splice(0)) pending.close();
-    }
-    if (this.link) {
-      if (!this.readShut) this.link.rx.closeRead();
-      if (!this.writeShut) this.link.tx.closeWrite();
-      this.readShut = true;
-      this.writeShut = true;
+  async symlink(target, path) {
+    const parent = await this.locate(parentOf2(path), true);
+    if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
+    const at = resolvePath(parent.path, baseOf(path));
+    if (await this.locate(at, false).then(
+      () => true,
+      (err) => !missing(err)
+    )) {
+      throw fsError("EEXIST", path);
     }
-    if (this.bound && this.local) this.net.release(this.local, this);
-    this.bound = false;
-    this.changes.wake();
+    const now = Date.now();
+    await this.meta.update(at, () => ({
+      path: at,
+      link: target,
+      dir: parent.path,
+      ino: inodeOf(at),
+      mtimeMs: now,
+      ctimeMs: now
+    }));
   }
-  static pair(net, domain) {
-    const a = new _KernelSocket(net, domain);
-    const b = new _KernelSocket(net, domain);
-    const name2 = domain === "inet" ? { family: "inet", host: "127.0.0.1", port: 0 } : { family: "unix", path: "" };
-    a.local = b.local = a.peer = b.peer = name2;
-    link(a, b);
-    return [a, b];
+  async readlink(path) {
+    const found = await this.locate(path, false);
+    if (found.link) return found.link.link;
+    throw fsError("EINVAL", path);
   }
-};
-function canonicalHost(host) {
-  return host === "0.0.0.0" ? "127.0.0.1" : host;
-}
-function keyOf(addr) {
-  return addr.family === "inet" ? `inet:${addr.port}` : `unix:${addr.path}`;
-}
-var LoopbackNet = class {
-  bound = /* @__PURE__ */ new Map();
-  activators = /* @__PURE__ */ new Map();
-  nextEphemeral = EPHEMERAL_FIRST;
-  activate(addr, start) {
-    this.activators.set(keyOf(addr), start);
-  }
-  socket(domain) {
-    return new KernelSocket(this, domain);
-  }
-  listen(addr, backlog = 128) {
-    const socket = this.socket(addr.family);
-    socket.bind(addr);
-    socket.listen(backlog);
-    return socket;
-  }
-  connect(addr) {
-    const socket = this.socket(addr.family);
-    socket.connect(addr);
-    return socket;
-  }
-  bind(socket, addr) {
-    if (addr.family === "unix") {
-      if (addr.path === "") throw new KernelError("EINVAL");
-    } else if (addr.host !== "0.0.0.0" && !isLoopback(addr.host)) {
-      throw new KernelError("EADDRNOTAVAIL");
-    }
-    const named = addr.family === "inet" && addr.port === 0 ? { ...addr, port: this.ephemeral() } : addr;
-    const key = keyOf(named);
-    if (this.bound.has(key)) throw new KernelError("EADDRINUSE");
-    this.bound.set(key, socket);
-    return named;
-  }
-  release(addr, socket) {
-    const key = keyOf(addr);
-    if (this.bound.get(key) === socket) this.bound.delete(key);
+  async chmod(path, mode) {
+    const found = await this.locate(path, true);
+    const ctimeMs = Date.now();
+    await this.meta.update(found.path, (entry) => ({
+      ...entry,
+      path: found.path,
+      mode: mode & PERM_MASK,
+      ctimeMs
+    }));
   }
-  target(addr) {
-    if (addr.family === "inet" && !isLoopback(canonicalHost(addr.host))) {
-      throw new KernelError("ENETUNREACH");
-    }
-    const key = keyOf(addr);
-    if (!this.bound.has(key)) this.activators.get(key)?.();
-    const socket = this.bound.get(key);
-    if (!socket?.listening) throw new KernelError("ECONNREFUSED");
-    return socket;
+  async utimes(path, atime, mtime) {
+    const found = await this.locate(path, true);
+    const handle = found.handle;
+    const file = handle.kind === "file" ? await handle.getFile() : void 0;
+    const ctimeMs = Date.now();
+    await this.meta.update(found.path, (entry) => ({
+      ...entry,
+      path: found.path,
+      atimeMs: atime.getTime(),
+      mtimeMs: mtime.getTime(),
+      mtimeFor: file?.lastModified ?? 0,
+      ctimeMs
+    }));
   }
-  ephemeral() {
-    const span = EPHEMERAL_LAST - EPHEMERAL_FIRST + 1;
-    for (let i = 0; i < span; i++) {
-      const port = this.nextEphemeral;
-      this.nextEphemeral = port === EPHEMERAL_LAST ? EPHEMERAL_FIRST : port + 1;
-      if (!this.bound.has(`inet:${port}`)) return port;
+  async reconcile() {
+    let removed = 0;
+    for (const entry of await this.meta.all()) {
+      const real = await this.real(entry.path);
+      const stale = entry.link === void 0 ? !real : real || !await this.real(parentOf2(entry.path));
+      if (!stale) continue;
+      await this.meta.update(entry.path, () => void 0);
+      removed++;
     }
-    throw new KernelError("EADDRINUSE");
+    return removed;
   }
 };
 
-// src/kernel/dial.ts
-var CHUNK = 64 * 1024;
-var LOOPBACK_NAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
-function dialSocket(net, port, host = "127.0.0.1") {
-  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new KernelError("EINVAL");
-  const target = LOOPBACK_NAMES.has(host.toLowerCase()) ? "127.0.0.1" : host;
-  return net.connect({ family: "inet", host: target, port });
-}
-var codeOf = (err) => {
-  const code = err?.code;
-  return typeof code === "string" ? code : "EIO";
-};
-function serveSocket(socket, port, onClose) {
-  let closed = false;
-  let writes = Promise.resolve();
-  let credit = 0;
-  let granted2;
-  const send = (message2, transfer) => {
-    if (!closed) port.postMessage(message2, transfer);
-  };
-  const close = (reset = false) => {
-    if (closed) return;
-    if (reset) send({ error: "ECONNRESET" });
-    closed = true;
-    granted2?.();
-    socket.close();
-    port.close();
-    onClose?.();
-  };
-  const write = (data) => {
-    writes = writes.then(async () => {
-      if (closed) return;
-      try {
-        await socket.write(data);
-        send({ ack: true });
-      } catch (err) {
-        send({ error: codeOf(err) });
-      }
-    });
+// src/mount/media.ts
+var MEDIA_STORE = "handles";
+function memoryMedia() {
+  const handles = /* @__PURE__ */ new Map();
+  return {
+    get: async (id) => handles.get(id),
+    put: async (id, handle) => void handles.set(id, handle)
   };
-  port.addEventListener("message", ({ data }) => {
-    if (data instanceof Uint8Array) write(data);
-    else if ("more" in data) {
-      credit++;
-      granted2?.();
-    } else if ("end" in data) {
-      writes = writes.then(() => {
-        if (!closed) socket.shutdown(SHUT_WR);
-      });
-    } else if ("close" in data) close();
-  });
-  port.start?.();
-  const turn = () => credit > 0 || closed ? Promise.resolve() : new Promise((r) => granted2 = r);
-  void (async () => {
-    try {
-      for (; ; ) {
-        await turn();
-        if (closed) return;
-        const chunk2 = await socket.read(CHUNK);
-        if (chunk2.length === 0) break;
-        credit--;
-        send(chunk2, [chunk2.buffer]);
-      }
-      send({ end: true });
-    } catch (err) {
-      send({ error: codeOf(err) });
-    }
-  })();
-  return () => close(true);
-}
-
-// src/kernel/signals.ts
-var SIG = {
-  HUP: 1,
-  INT: 2,
-  QUIT: 3,
-  ILL: 4,
-  TRAP: 5,
-  ABRT: 6,
-  BUS: 7,
-  FPE: 8,
-  KILL: 9,
-  USR1: 10,
-  SEGV: 11,
-  USR2: 12,
-  PIPE: 13,
-  ALRM: 14,
-  TERM: 15,
-  STKFLT: 16,
-  CHLD: 17,
-  CONT: 18,
-  STOP: 19,
-  TSTP: 20,
-  TTIN: 21,
-  TTOU: 22,
-  URG: 23,
-  XCPU: 24,
-  XFSZ: 25,
-  VTALRM: 26,
-  PROF: 27,
-  WINCH: 28,
-  POLL: 29,
-  PWR: 30,
-  SYS: 31
-};
-var IGNORED_BY_DEFAULT = /* @__PURE__ */ new Set([SIG.CHLD, SIG.URG, SIG.WINCH]);
-var STOPPING = /* @__PURE__ */ new Set([SIG.STOP, SIG.TSTP, SIG.TTIN, SIG.TTOU]);
-function defaultAction(sig) {
-  if (sig === SIG.CONT) return "continue";
-  if (STOPPING.has(sig)) return "stop";
-  return IGNORED_BY_DEFAULT.has(sig) ? "ignore" : "terminate";
 }
-function isSignal(sig) {
-  return Number.isInteger(sig) && sig >= 1 && sig <= 31;
+function settle2(request2, value) {
+  return new Promise((resolve, reject) => {
+    request2.onsuccess = () => resolve(value());
+    request2.onerror = () => reject(request2.error);
+  });
 }
-function sigbit(sig) {
-  return 1 << sig;
+function openMedia(name2, factory) {
+  const request2 = factory.open(name2, 1);
+  request2.onupgradeneeded = () => request2.result.createObjectStore(MEDIA_STORE);
+  return settle2(request2, () => {
+    const db = request2.result;
+    const store = (mode) => db.transaction(MEDIA_STORE, mode).objectStore(MEDIA_STORE);
+    return {
+      get: (id) => {
+        const got = store("readonly").get(id);
+        return settle2(got, () => got.result);
+      },
+      put: (id, handle) => settle2(store("readwrite").put(handle, id), () => void 0)
+    };
+  });
 }
-var SIGNAL_BY_NAME = {
-  SIGINT: SIG.INT,
-  SIGTERM: SIG.TERM,
-  SIGKILL: SIG.KILL,
-  SIGSTOP: SIG.STOP,
-  SIGCONT: SIG.CONT
-};
 
-// src/body-idle.ts
-var BODY_IDLE_MS = 5 * 60 * 1e3;
+// src/pin.ts
+function pinScript(url) {
+  try {
+    const request2 = new XMLHttpRequest();
+    request2.open("GET", url.href, false);
+    request2.send();
+    if (request2.status !== 200) return url.href;
+    const source = `${request2.responseText}
+//# sourceURL=${url.href}
+`;
+    return URL.createObjectURL(new Blob([source], { type: "text/javascript" }));
+  } catch {
+    return url.href;
+  }
+}
 
-// src/transport.ts
-var MAX_REQUEST_BODY = 64 * 1024 * 1024;
-function serveTransport(peer, transport) {
-  const open = /* @__PURE__ */ new Map();
-  const fail = (nid, e) => {
-    open.delete(nid);
-    const { status, code } = e;
-    peer.postMessage({
-      net: "error",
-      nid,
-      message: e instanceof Error ? e.message : String(e),
-      ...typeof status === "number" ? { status } : {},
-      ...typeof code === "string" ? { code } : {}
-    });
-  };
-  const start = async (call) => {
-    const abort = new AbortController();
-    const entry = { abort };
-    open.set(call.nid, entry);
-    try {
-      const response = await transport.fetch({
-        url: call.url,
-        method: call.method,
-        headers: call.headers,
-        ...call.body ? { body: call.body } : {},
-        signal: abort.signal
-      });
-      if (!open.has(call.nid)) {
-        await response.cancel();
-        return;
+// src/cdp/port.ts
+function portCdpHook(ask, gone) {
+  return (request2) => new Promise((resolve, reject) => {
+    const { port1, port2 } = new MessageChannel();
+    let closed = false;
+    const conn = {
+      send: (m) => {
+        if (!closed) port1.postMessage({ m });
+      },
+      onmessage: null,
+      onclose: null,
+      close: () => {
+        if (closed) return;
+        closed = true;
+        port1.postMessage({ close: true });
+        port1.close();
       }
-      open.set(call.nid, { abort, body: response.body[Symbol.asyncIterator](), response });
-      peer.postMessage({
-        net: "head",
-        nid: call.nid,
-        status: response.status,
-        statusText: response.statusText,
-        headers: response.headers
-      });
-    } catch (e) {
-      fail(call.nid, e);
-    }
-  };
-  const read = async (nid) => {
-    const body = open.get(nid)?.body;
-    if (!body) return;
-    try {
-      const next = await body.next();
-      if (next.done) {
-        open.delete(nid);
-        peer.postMessage({ net: "end", nid });
-      } else {
-        const bytes = next.value.slice();
-        peer.postMessage({ net: "chunk", nid, bytes }, [bytes.buffer]);
+    };
+    port1.addEventListener("message", ({ data }) => {
+      if ("m" in data) conn.onmessage?.(data.m);
+      else if ("open" in data) resolve(conn);
+      else if ("error" in data) {
+        closed = true;
+        port1.close();
+        reject(new Error(data.error));
+      } else if (!closed) {
+        closed = true;
+        port1.close();
+        conn.onclose?.(data.close ?? void 0);
       }
-    } catch (e) {
-      fail(nid, e);
-    }
-  };
-  const drop = (nid) => {
-    const entry = open.get(nid);
-    open.delete(nid);
-    entry?.abort.abort();
-    void entry?.response?.cancel().catch(() => void 0);
-  };
-  return {
-    answer(call) {
-      if (call.net === "fetch") void start(call);
-      else if (call.net === "read") void read(call.nid);
-      else drop(call.nid);
-    },
-    close() {
-      for (const nid of [...open.keys()]) drop(nid);
-    }
-  };
+    });
+    port1.start();
+    void gone?.then(() => {
+      if (closed) return;
+      closed = true;
+      port1.close();
+      reject(new Error("the CDP host is gone"));
+      conn.onclose?.("the CDP host is gone");
+    });
+    ask(request2, port2);
+  });
 }
 
-// src/client/serve-client.ts
-var MAX_LINKS = 40;
-function act(session, req, signal) {
-  if (req.action === "write") session.write(req.bytes);
-  else if (req.action === "resize") session.resize(req.cols, req.rows);
-  else if (req.action === "signal") session.signal(signal(req.signal));
-  else session.close();
+// src/client/protocol.ts
+var PROTOCOL = [1, 5];
+var FS_METHODS = [
+  "readFile",
+  "writeFile",
+  "stat",
+  "lstat",
+  "readdir",
+  "mkdir",
+  "rm",
+  "rename",
+  "realpath",
+  "symlink",
+  "readlink",
+  "exists"
+];
+function locksOf(scope = globalThis) {
+  const locks = scope.navigator?.locks;
+  return typeof locks?.request === "function" ? locks : void 0;
 }
-async function realpath(fs, path) {
-  let parts = fs.resolvePath("/", path).split("/").filter(Boolean);
-  let resolved = "";
-  for (let hops = 0; parts.length > 0; ) {
-    const [name2, ...rest] = parts;
-    const next = `${resolved}/${name2}`;
-    if (!(await fs.lstat(next)).isSymbolicLink) {
-      resolved = next;
-      parts = rest;
-      continue;
+function versionError(theirs) {
+  const major = Array.isArray(theirs) ? theirs[0] : void 0;
+  if (major === PROTOCOL[0]) return void 0;
+  const named = typeof major === "number" ? `${major}.x` : "without a version";
+  return `slicc-kernel client protocol ${named} is not supported: this side speaks ${PROTOCOL.join(".")}`;
+}
+
+// src/kernel/pipe.ts
+var PIPE_CAPACITY = 64 * 1024;
+var PipeError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+};
+var KernelPipe = class {
+  chunks = [];
+  size = 0;
+  readers = 0;
+  writers = 0;
+  waiters = [];
+  capacity;
+  constructor(capacity = PIPE_CAPACITY) {
+    this.capacity = capacity;
+  }
+  get buffered() {
+    return this.size;
+  }
+  get readReady() {
+    return this.size > 0 || this.writers === 0;
+  }
+  get writeReady() {
+    return this.size < this.capacity || this.readers === 0;
+  }
+  get writersGone() {
+    return this.writers === 0;
+  }
+  get readersGone() {
+    return this.readers === 0;
+  }
+  openRead() {
+    this.readers += 1;
+  }
+  openWrite() {
+    this.writers += 1;
+  }
+  closeRead() {
+    if (this.readers > 0) this.readers -= 1;
+    if (this.readers === 0) {
+      this.chunks = [];
+      this.size = 0;
     }
-    if (++hops > MAX_LINKS) throw fsError("ELOOP", path);
-    const target = await fs.readlink(next);
-    const base = target.startsWith("/") ? "/" : resolved || "/";
-    parts = [...fs.resolvePath(base, target).split("/").filter(Boolean), ...rest];
-    resolved = "";
+    this.wake();
   }
-  return resolved || "/";
-}
-async function fsCall(fs, method, args) {
-  const path = (i) => fs.resolvePath("/", String(args[i]));
-  switch (method) {
-    case "readFile": {
-      const bytes = (await fs.readFileBuffer(path(0))).slice();
-      return { result: bytes, transfer: [bytes.buffer] };
+  closeWrite() {
+    if (this.writers > 0) this.writers -= 1;
+    this.wake();
+  }
+  async read(max, signal) {
+    while (this.size === 0) {
+      if (this.writers === 0) return new Uint8Array(0);
+      await this.changed(signal);
     }
-    case "writeFile":
-      await fs.writeFile(path(0), args[1]);
-      return { result: true };
-    case "stat":
-      return { result: await fs.stat(path(0)) };
-    case "lstat":
-      return { result: await fs.lstat(path(0)) };
-    case "readdir":
-      return { result: await fs.readdir(path(0)) };
-    case "mkdir":
-      await fs.mkdir(path(0), { recursive: true });
-      return { result: true };
-    case "rm":
-      await fs.rm(path(0), { recursive: true, force: args[1] === true });
-      return { result: true };
-    case "rename":
-      await fs.rename(path(0), path(1));
-      return { result: true };
-    case "realpath":
-      return { result: await realpath(fs, String(args[0])) };
-    case "symlink":
-      await fs.symlink(String(args[0]), path(1));
-      return { result: true };
-    case "readlink":
-      return { result: await fs.readlink(path(0)) };
-    default:
-      return { result: await fs.exists(path(0)) };
+    const out = this.take(Math.min(max, this.size));
+    this.wake();
+    return out;
   }
-}
-function signalOf(host) {
-  return host.signal ?? ((name2) => {
-    throw fsError("EINVAL", `this kernel names no signal ${name2}`);
-  });
-}
-function dialFor(l, req, open) {
-  const socket = dialSocket(l.net, req.port, req.host);
-  const { port1, port2 } = new MessageChannel();
-  open.set(
-    req.id,
-    serveSocket(socket, port1, () => open.delete(req.id))
-  );
-  return { result: port2, transfer: [port2] };
-}
-function killGroups(host, pgids) {
-  if (pgids.length === 0) return;
-  void host.launcher().then((launcher) => {
-    for (const pgid of pgids) launcher.kill(-pgid, SIG.KILL);
-  });
-}
-function joinable(l, pgid, ours) {
-  const sid = l.groupSession(pgid);
-  if (sid === void 0) throw fsError("ESRCH", `no process group ${pgid}`);
-  if (!ours(sid)) throw fsError("EPERM", `process group ${pgid} is in another session`);
-}
-function serveClient(port, host) {
-  let state = "new";
-  const terminals = /* @__PURE__ */ new Map();
-  const groups = /* @__PURE__ */ new Set();
-  const sessions = /* @__PURE__ */ new Set();
-  const watches = /* @__PURE__ */ new Map();
-  let net;
-  const ended = Promise.withResolvers();
-  const send = (message2, transfer = []) => {
-    if (state !== "closed") port.postMessage(message2, transfer);
-  };
-  const reply = (id, body, transfer) => send({ id, ...body }, transfer);
-  function detach(kill = false, bye = "the slicc-kernel detached this client") {
-    if (state === "closed") return;
-    send({ bye });
-    state = "closed";
-    net?.close();
-    for (const unwatch of watches.values()) unwatch();
-    watches.clear();
-    for (const session of terminals.values()) session.close();
-    terminals.clear();
-    if (kill) killGroups(host, [...groups]);
-    groups.clear();
-    port.close?.();
-    ended.resolve();
+  async peek(max, signal) {
+    while (this.size === 0) {
+      if (this.writers === 0) return new Uint8Array(0);
+      await this.changed(signal);
+    }
+    const out = new Uint8Array(Math.min(max, this.size));
+    let filled = 0;
+    for (const chunk2 of this.chunks) {
+      if (filled === out.length) break;
+      const count = Math.min(chunk2.length, out.length - filled);
+      out.set(chunk2.subarray(0, count), filled);
+      filled += count;
+    }
+    return out;
   }
-  async function hello(message2) {
-    const refused = versionError(message2.protocol);
-    if (refused) {
-      send({ hello: { protocol: PROTOCOL, error: refused } });
-      detach();
-      return;
+  async write(bytes, signal) {
+    let offset = 0;
+    while (offset < bytes.length) {
+      if (this.readers === 0) throw new PipeError("EPIPE");
+      const room = this.capacity - this.size;
+      if (room === 0) {
+        try {
+          await this.changed(signal);
+        } catch (e) {
+          if (offset > 0) return offset;
+          throw e;
+        }
+        continue;
+      }
+      const n = Math.min(room, bytes.length - offset);
+      this.chunks.push(bytes.slice(offset, offset + n));
+      this.size += n;
+      offset += n;
+      this.wake();
     }
-    const launcher = await host.launcher();
-    const transport = host.transport?.() ?? launcher.transport;
-    net = serveTransport({ postMessage: (m, t) => send(m, t) }, transport);
-    state = "open";
-    if (message2.lock && host.locks) void host.locks.request(message2.lock, () => detach());
-    send({
-      hello: {
-        protocol: PROTOCOL,
-        traits: transport.traits,
-        ...host.lock ? { lock: host.lock } : {}
+    return bytes.length;
+  }
+  take(n) {
+    const out = new Uint8Array(n);
+    let filled = 0;
+    while (filled < n) {
+      const head = this.chunks[0];
+      const count = Math.min(head.length, n - filled);
+      out.set(head.subarray(0, count), filled);
+      filled += count;
+      if (count === head.length) this.chunks.shift();
+      else this.chunks[0] = head.subarray(count);
+    }
+    this.size -= n;
+    return out;
+  }
+  changed(signal) {
+    if (signal?.aborted) return Promise.reject(new PipeError("EINTR"));
+    return new Promise((resolve, reject) => {
+      const onAbort = () => {
+        this.waiters = this.waiters.filter((w) => w !== waiter);
+        reject(new PipeError("EINTR"));
+      };
+      const waiter = () => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve();
+      };
+      this.waiters.push(waiter);
+      signal?.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  wake() {
+    const waiters = this.waiters;
+    this.waiters = [];
+    for (const resolve of waiters) resolve();
+  }
+};
+
+// src/kernel/fd-table.ts
+var KernelError = class extends Error {
+  code;
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+};
+function pollFile(file) {
+  return file.poll?.() ?? { readable: !!file.read, writable: !!file.write, hangup: false };
+}
+var OpenFile = class {
+  refs = 1;
+  file;
+  constructor(file) {
+    this.file = file;
+  }
+  retain() {
+    this.refs += 1;
+    return this;
+  }
+  release() {
+    this.refs -= 1;
+    if (this.refs === 0) return this.file.close();
+  }
+};
+function openPipe(capacity) {
+  const pipe = new KernelPipe(capacity);
+  pipe.openRead();
+  pipe.openWrite();
+  return {
+    read: new OpenFile({
+      read: async (max, signal) => {
+        try {
+          return await pipe.read(max, signal);
+        } catch (e) {
+          throw new KernelError(e.code);
+        }
+      },
+      close: () => pipe.closeRead(),
+      poll: () => ({ readable: pipe.readReady, writable: false, hangup: pipe.writersGone }),
+      changed: (signal) => pipe.changed(signal)
+    }),
+    write: new OpenFile({
+      write: async (bytes, signal) => {
+        try {
+          return await pipe.write(bytes, signal);
+        } catch (e) {
+          throw new KernelError(e.code);
+        }
+      },
+      close: () => pipe.closeWrite(),
+      poll: () => ({ readable: false, writable: pipe.writeReady, hangup: pipe.readersGone }),
+      changed: (signal) => pipe.changed(signal)
+    })
+  };
+}
+function bytesSource(data) {
+  let offset = 0;
+  return new OpenFile({
+    read: async (max) => {
+      const out = data.subarray(offset, offset + max);
+      offset += out.length;
+      return out;
+    },
+    close: () => {
+    }
+  });
+}
+function sinkFile(onData) {
+  return new OpenFile({
+    write: async (bytes) => {
+      onData(bytes.slice());
+      return bytes.length;
+    },
+    close: () => {
+    }
+  });
+}
+function nullFile() {
+  return new OpenFile({
+    read: async () => new Uint8Array(0),
+    write: async (bytes) => bytes.length,
+    close: () => {
+    }
+  });
+}
+function deviceFile(device, access) {
+  const read = async (max) => {
+    if (device === "null") return new Uint8Array(0);
+    const out = new Uint8Array(max);
+    if (device === "urandom") {
+      for (let at = 0; at < max; at += 65536) {
+        crypto.getRandomValues(out.subarray(at, Math.min(max, at + 65536)));
+      }
+    }
+    return out;
+  };
+  return new OpenFile({
+    ...access !== "write" ? { read } : {},
+    ...access !== "read" ? { write: async (bytes) => bytes.length } : {},
+    seek: async () => 0,
+    heldMeta: { device, ...access ? { access } : {} },
+    close: () => {
+    }
+  });
+}
+function heldFile(meta) {
+  return new OpenFile({ held: true, ...meta ? { heldMeta: meta } : {}, close: () => {
+  } });
+}
+function kernelFdKind(file) {
+  if (file.held) return "held";
+  if (file.heldMeta && "device" in file.heldMeta) return "device";
+  if (file.tty) return "tty";
+  return file.seek ? "file" : "stream";
+}
+var FdTable = class _FdTable {
+  static MAX_FDS = 1024;
+  fds = /* @__PURE__ */ new Map();
+  cloexec = /* @__PURE__ */ new Set();
+  status = /* @__PURE__ */ new Map();
+  get(fd) {
+    const file = this.fds.get(fd);
+    if (!file) throw new KernelError("EBADF");
+    return file;
+  }
+  stdioTerminal() {
+    for (const fd of [0, 1, 2]) {
+      const tty = this.fds.get(fd)?.file.tty;
+      if (tty) return tty;
+    }
+    return void 0;
+  }
+  numbers() {
+    return [...this.fds.keys()].sort((a, b) => a - b);
+  }
+  has(fd) {
+    return this.fds.has(fd);
+  }
+  setCloseOnExec(fd) {
+    this.get(fd);
+    this.cloexec.add(fd);
+  }
+  clearCloseOnExec(fd) {
+    this.get(fd);
+    this.cloexec.delete(fd);
+  }
+  closesOnExec(fd) {
+    return this.cloexec.has(fd);
+  }
+  setStatusFlags(fd, flags) {
+    this.get(fd);
+    this.status.set(fd, flags);
+  }
+  statusFlags(fd) {
+    return this.status.get(fd);
+  }
+  install(file, min = 0) {
+    for (let fd = min; fd < _FdTable.MAX_FDS; fd++) {
+      if (!this.fds.has(fd)) {
+        this.fds.set(fd, file);
+        return fd;
       }
+    }
+    void Promise.resolve(file.release()).catch(() => void 0);
+    throw new KernelError("EMFILE");
+  }
+  installAt(fd, file) {
+    if (fd < 0 || fd >= _FdTable.MAX_FDS) {
+      void Promise.resolve(file.release()).catch(() => void 0);
+      throw new KernelError("EBADF");
+    }
+    const previous = this.fds.get(fd);
+    this.fds.set(fd, file);
+    this.cloexec.delete(fd);
+    this.status.delete(fd);
+    void Promise.resolve(previous?.release()).catch(() => void 0);
+  }
+  dup(fd, min = 0) {
+    return this.install(this.get(fd).retain(), min);
+  }
+  dup2(oldFd, newFd) {
+    const file = this.get(oldFd);
+    if (oldFd !== newFd) this.installAt(newFd, file.retain());
+    return newFd;
+  }
+  close(fd) {
+    const file = this.get(fd);
+    this.fds.delete(fd);
+    this.cloexec.delete(fd);
+    this.status.delete(fd);
+    return file.release();
+  }
+  fork() {
+    const child = new _FdTable();
+    for (const [fd, file] of this.fds) child.fds.set(fd, file.retain());
+    for (const fd of this.cloexec) child.cloexec.add(fd);
+    for (const [fd, flags] of this.status) child.status.set(fd, flags);
+    return child;
+  }
+  async closeAll() {
+    const files = [...this.fds.values()];
+    this.fds.clear();
+    this.cloexec.clear();
+    this.status.clear();
+    await Promise.allSettled(files.map((file) => Promise.resolve().then(() => file.release())));
+  }
+};
+
+// src/kernel/socket.ts
+var SOMAXCONN = 4096;
+var EPHEMERAL_FIRST = 32768;
+var EPHEMERAL_LAST = 60999;
+var SOL_SOCKET = 1;
+var SO_TYPE = 3;
+var SO_ERROR = 4;
+var SO_SNDBUF = 7;
+var SO_RCVBUF = 8;
+var SO_ACCEPTCONN = 30;
+var SO_DOMAIN = 39;
+var SOCK_STREAM = 1;
+var AF_UNIX = 1;
+var AF_INET = 2;
+var SHUT_RD = 0;
+var SHUT_WR = 1;
+var SHUT_RDWR = 2;
+function isLoopback(host) {
+  return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+async function pipeCall(op) {
+  try {
+    return await op();
+  } catch (e) {
+    if (e instanceof PipeError) throw new KernelError(e.code);
+    throw e;
+  }
+}
+var Changes = class {
+  waiters = [];
+  wait(signal) {
+    if (signal?.aborted) return Promise.reject(new KernelError("EINTR"));
+    return new Promise((resolve, reject) => {
+      const onAbort = () => {
+        this.waiters = this.waiters.filter((w) => w !== waiter);
+        reject(new KernelError("EINTR"));
+      };
+      const waiter = () => {
+        signal?.removeEventListener("abort", onAbort);
+        resolve();
+      };
+      this.waiters.push(waiter);
+      signal?.addEventListener("abort", onAbort, { once: true });
     });
   }
-  async function terminal(req, l) {
-    const session = await l.openTerminal(req.argv, {
-      ...req.options,
-      onData: (bytes) => reply(req.id, { fd: 1, bytes: bytes.slice() })
-    });
-    if (state === "closed") {
-      session.close();
-    } else {
-      terminals.set(req.id, session);
-      sessions.add(session.pid);
-      reply(req.id, { started: session.pid });
+  wake() {
+    const waiters = this.waiters;
+    this.waiters = [];
+    for (const resolve of waiters) resolve();
+  }
+};
+function link(a, b) {
+  const ab = new KernelPipe();
+  const ba = new KernelPipe();
+  for (const pipe of [ab, ba]) {
+    pipe.openRead();
+    pipe.openWrite();
+  }
+  a.attach({ rx: ba, tx: ab });
+  b.attach({ rx: ab, tx: ba });
+}
+var KernelSocket = class _KernelSocket {
+  net;
+  domain;
+  state = "open";
+  local;
+  peer;
+  link;
+  readShut = false;
+  writeShut = false;
+  queue = [];
+  backlog = 0;
+  bound = false;
+  changes = new Changes();
+  options = /* @__PURE__ */ new Map();
+  constructor(net, domain) {
+    this.net = net;
+    this.domain = domain;
+  }
+  attach(link2) {
+    this.link = link2;
+    this.state = "connected";
+    this.changes.wake();
+  }
+  get listening() {
+    return this.state === "listening";
+  }
+  connection() {
+    if (!this.link || this.state !== "connected") throw new KernelError("ENOTCONN");
+    return this.link;
+  }
+  async read(max, signal) {
+    const { rx } = this.connection();
+    if (this.readShut || max <= 0) return new Uint8Array(0);
+    return pipeCall(() => rx.read(max, signal));
+  }
+  async peek(max, signal) {
+    const { rx } = this.connection();
+    if (this.readShut || max <= 0) return new Uint8Array(0);
+    return pipeCall(() => rx.peek(max, signal));
+  }
+  async write(bytes, signal) {
+    const { tx } = this.connection();
+    if (this.writeShut) throw new KernelError("EPIPE");
+    return pipeCall(() => tx.write(bytes, signal));
+  }
+  poll() {
+    if (this.state === "listening") {
+      return { readable: this.queue.length > 0, writable: false, hangup: false };
+    }
+    if (this.state !== "connected" || !this.link) {
+      return { readable: false, writable: false, hangup: true };
+    }
+    const { rx, tx } = this.link;
+    return {
+      readable: this.readShut || rx.readReady,
+      writable: this.writeShut || tx.writeReady,
+      hangup: rx.writersGone && tx.readersGone
+    };
+  }
+  changed(signal) {
+    const own = this.changes.wait(signal);
+    if (this.state !== "connected" || !this.link) return own;
+    const waits = [own, this.link.rx.changed(signal), this.link.tx.changed(signal)];
+    for (const wait2 of waits) wait2.catch(() => void 0);
+    return pipeCall(() => Promise.race(waits));
+  }
+  bind(addr) {
+    if (this.state !== "open" || this.local) throw new KernelError("EINVAL");
+    if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
+    this.local = this.net.bind(this, addr);
+    this.bound = true;
+  }
+  listen(backlog) {
+    if (this.state === "connected") throw new KernelError("EISCONN");
+    if (this.state !== "open" && this.state !== "listening") throw new KernelError("EINVAL");
+    if (!this.local) {
+      if (this.domain === "unix") throw new KernelError("EINVAL");
+      this.bind({ family: "inet", host: "0.0.0.0", port: 0 });
+    }
+    this.backlog = Math.min(Math.max(backlog, 1), SOMAXCONN);
+    this.state = "listening";
+  }
+  async accept(signal, nonblock = false) {
+    for (; ; ) {
+      if (this.state !== "listening") throw new KernelError("EINVAL");
+      const next = this.queue.shift();
+      if (next) return next;
+      if (nonblock) throw new KernelError("EAGAIN");
+      await this.changes.wait(signal);
+    }
+  }
+  offer(server) {
+    if (this.state !== "listening" || this.queue.length >= this.backlog) return false;
+    this.queue.push(server);
+    this.changes.wake();
+    return true;
+  }
+  connect(addr) {
+    if (this.state === "connected") throw new KernelError("EISCONN");
+    if (this.state !== "open") throw new KernelError("EINVAL");
+    if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
+    const target = this.net.target(addr);
+    if (!this.local) {
+      if (addr.family === "inet") {
+        this.local = this.net.bind(this, { family: "inet", host: "127.0.0.1", port: 0 });
+        this.bound = true;
+      } else this.local = { family: "unix", path: "" };
     }
-    try {
-      return { result: await session.exited };
-    } finally {
-      terminals.delete(req.id);
+    const server = new _KernelSocket(this.net, this.domain);
+    server.local = addr.family === "inet" ? { ...addr, host: canonicalHost(addr.host) } : addr;
+    server.peer = this.local;
+    this.peer = server.local;
+    link(this, server);
+    if (!target.offer(server)) {
+      this.unlink();
+      server.close();
+      throw new KernelError("ECONNREFUSED");
     }
   }
-  async function spawn(req, l) {
-    const out = (fd) => (bytes) => reply(req.id, { fd, bytes: bytes.slice() });
-    if (req.options.pgid !== void 0) joinable(l, req.options.pgid, (sid) => sessions.has(sid));
-    let leader;
-    const result = await l.run(req.argv, {
-      ...req.options,
-      collect: false,
-      onStdout: out(1),
-      onStderr: out(2),
-      onStarted: (pid) => {
-        leader = pid;
-        if (state === "closed") return;
-        groups.add(req.options.pgid ?? pid);
-        if (req.options.pgid === void 0) sessions.add(pid);
-        reply(req.id, { started: pid });
-      }
-    });
-    if (leader === void 0) throw fsError("ENOENT", `${req.argv[0] ?? ""}: command not found`);
-    if (!l.list().some((p) => p.pgid === leader)) groups.delete(leader);
-    return { result: result.status };
+  unlink() {
+    const link2 = this.link;
+    if (link2) {
+      link2.rx.closeRead();
+      link2.tx.closeWrite();
+    }
+    this.link = void 0;
+    this.peer = void 0;
+    this.state = "open";
   }
-  async function handle(req) {
-    if (host.scope === "transport" && req.op !== "detach") {
-      throw fsError("EPERM", `${req.op}: this client may only use the network transport`);
+  shutdown(how) {
+    const { rx, tx } = this.connection();
+    if (how !== SHUT_RD && how !== SHUT_WR && how !== SHUT_RDWR) throw new KernelError("EINVAL");
+    if (how !== SHUT_WR && !this.readShut) {
+      this.readShut = true;
+      rx.closeRead();
     }
-    const l = await host.launcher();
-    switch (req.op) {
-      case "spawn":
-        return spawn(req, l);
-      case "open-terminal":
-        return terminal(req, l);
-      case "terminal": {
-        const session = terminals.get(req.terminal);
-        if (!session) throw new Error(`no terminal ${req.terminal}`);
-        act(session, req, signalOf(host));
-        return { result: true };
-      }
-      case "kill":
-        if (!l.kill(req.pid, signalOf(host)(req.signal))) throw fsError("ESRCH", `pid ${req.pid}`);
-        return { result: true };
-      case "ps":
-        return {
-          result: l.list().map(({ tid: _, ...entry }) => entry)
-        };
-      case "fs":
-        if (!FS_METHODS.includes(req.method)) {
-          throw new Error(`unknown file system call ${req.method}`);
-        }
-        return fsCall(l.fs, req.method, req.args);
-      case "watch": {
-        const unwatch = l.watchers.watch(
-          req.paths,
-          { recursive: req.recursive },
-          (change) => send({ watch: req.id, change })
-        );
-        watches.set(req.id, unwatch);
-        return { result: req.id };
-      }
-      case "unwatch":
-        watches.get(req.watch)?.();
-        watches.delete(req.watch);
-        return { result: true };
-      case "mount":
-        return { result: await l.mount(req.spec) };
-      case "umount":
-        l.umount(req.target);
-        return { result: true };
-      case "mounts":
-        return { result: l.mounts.list() };
-      case "dial":
-        return dialFor(l, req, watches);
-      case "detach":
-        return { result: true };
-      default:
-        throw new Error(`unknown op ${req.op}`);
+    if (how !== SHUT_RD && !this.writeShut) {
+      this.writeShut = true;
+      tx.closeWrite();
     }
+    this.changes.wake();
   }
-  port.addEventListener("message", (event) => {
-    const data = event.data;
-    if (state === "closed") return;
-    if (data.hello) {
-      if (state === "new") {
-        hello(data.hello).catch((err) => {
-          send({ hello: { protocol: PROTOCOL, error: String(err?.message ?? err) } });
-          detach();
-        });
+  getOption(level, name2) {
+    if (level === SOL_SOCKET) {
+      switch (name2) {
+        case SO_TYPE:
+          return SOCK_STREAM;
+        case SO_ERROR:
+          return 0;
+        case SO_ACCEPTCONN:
+          return this.state === "listening" ? 1 : 0;
+        case SO_DOMAIN:
+          return this.domain === "inet" ? AF_INET : AF_UNIX;
+        case SO_SNDBUF:
+        case SO_RCVBUF:
+          return this.options.get(`${level}:${name2}`) ?? PIPE_CAPACITY;
       }
-      return;
     }
-    if (state !== "open") return;
-    if (data.net !== void 0) {
-      net?.answer(data);
-      return;
+    return this.options.get(`${level}:${name2}`) ?? 0;
+  }
+  setOption(level, name2, value) {
+    this.options.set(`${level}:${name2}`, value);
+  }
+  close() {
+    const was = this.state;
+    this.state = "closed";
+    if (was === "listening") {
+      for (const pending of this.queue.splice(0)) pending.close();
     }
-    const req = data;
-    handle(req).then(
-      ({ result, transfer }) => {
-        reply(req.id, { result }, transfer);
-        if (req.op === "detach") detach(req.kill === true);
-      },
-      (err) => {
-        const code = err?.code;
-        reply(req.id, {
-          error: err instanceof Error ? err.message : String(err),
-          ...typeof code === "string" ? { code } : {}
-        });
-      }
-    );
-  });
-  port.addEventListener("close", () => detach());
-  port.start?.();
-  return { detach, closed: ended.promise };
-}
-
-// src/fs/opfs.ts
-var S_IFDIR = 16384;
-var S_IFREG = 32768;
-var S_IFLNK = 40960;
-var PERM_MASK = 4095;
-var READ_ATTEMPTS = 3;
-var MAX_LINKS2 = 40;
-var CHECK_MS = 1e3;
-var EXECUTABLE = /\/node_modules\/(?:@[^/]+\/)?[^/]+\/bin\//;
-var ERRNO_BY_DOM_ERROR = {
-  NotFoundError: "ENOENT",
-  TypeMismatchError: "ENOTDIR",
-  InvalidModificationError: "ENOTEMPTY",
-  NoModificationAllowedError: "EBUSY",
-  TypeError: "EINVAL",
-  NotAllowedError: "EACCES"
+    if (this.link) {
+      if (!this.readShut) this.link.rx.closeRead();
+      if (!this.writeShut) this.link.tx.closeWrite();
+      this.readShut = true;
+      this.writeShut = true;
+    }
+    if (this.bound && this.local) this.net.release(this.local, this);
+    this.bound = false;
+    this.changes.wake();
+  }
+  static pair(net, domain) {
+    const a = new _KernelSocket(net, domain);
+    const b = new _KernelSocket(net, domain);
+    const name2 = domain === "inet" ? { family: "inet", host: "127.0.0.1", port: 0 } : { family: "unix", path: "" };
+    a.local = b.local = a.peer = b.peer = name2;
+    link(a, b);
+    return [a, b];
+  }
 };
-function translate(err, path) {
-  if (typeof err?.code === "string") return err;
-  const name2 = err?.name;
-  return fsError(typeof name2 === "string" && ERRNO_BY_DOM_ERROR[name2] || "EIO", path);
-}
-function missing(err) {
-  const code = err?.code;
-  return code === "ENOENT" || code === "ENOTDIR";
-}
-function split(path) {
-  return path.split("/").filter(Boolean);
-}
-function parentOf2(path) {
-  return path.slice(0, path.lastIndexOf("/")) || "/";
-}
-function baseOf(path) {
-  return path.slice(path.lastIndexOf("/") + 1);
-}
-function prefixes(path) {
-  const parts = split(path);
-  return parts.map((_, i) => `/${parts.slice(0, i + 1).join("/")}`);
-}
-function within(path, root) {
-  return path === root || path.startsWith(`${root}/`);
-}
-function isHandle(child) {
-  return "kind" in child;
+function canonicalHost(host) {
+  return host === "0.0.0.0" ? "127.0.0.1" : host;
 }
-var OpfsFs = class {
-  root;
-  meta;
-  dirs = /* @__PURE__ */ new Map();
-  checked = /* @__PURE__ */ new WeakMap();
-  channel;
-  constructor(root, meta = new MemoryMeta(), channel) {
-    this.root = root;
-    this.meta = meta;
-    this.channel = channel === void 0 ? void 0 : new BroadcastChannel(channel);
-    if (this.channel) {
-      this.channel.onmessage = ({ data }) => {
-        for (const path of data) this.forget(path);
-      };
-      this.channel.unref?.();
-    }
+function keyOf(addr) {
+  return addr.family === "inet" ? `inet:${addr.port}` : `unix:${addr.path}`;
+}
+var LoopbackNet = class {
+  bound = /* @__PURE__ */ new Map();
+  activators = /* @__PURE__ */ new Map();
+  internal = /* @__PURE__ */ new Set();
+  nextEphemeral = EPHEMERAL_FIRST;
+  kernelOnly(port, reserve = false) {
+    if (reserve) this.internal.add(port);
+    return this.internal.has(port);
   }
-  changed(...paths) {
-    for (const path of paths) this.forget(path);
-    this.channel?.postMessage(paths);
+  activate(addr, start) {
+    this.activators.set(keyOf(addr), start);
   }
-  resolvePath(base, path) {
-    return resolvePath(base, path);
+  socket(domain) {
+    return new KernelSocket(this, domain);
   }
-  async walk(parts, from, start) {
-    let dir = start;
-    for (let at = from; at < parts.length; at++) {
-      dir = await dir.getDirectoryHandle(parts[at]);
-      this.dirs.set(`/${parts.slice(0, at + 1).join("/")}`, dir);
-      this.checked.set(dir, performance.now());
-    }
-    return dir;
+  listen(addr, backlog = 128) {
+    const socket = this.socket(addr.family);
+    socket.bind(addr);
+    socket.listen(backlog);
+    return socket;
   }
-  async dir(path) {
-    const parts = split(path);
-    let from = parts.length;
-    let cached;
-    for (; from > 0 && !cached; from--)
-      cached = this.dirs.get(`/${parts.slice(0, from).join("/")}`);
-    if (cached) from++;
-    const at = `/${parts.slice(0, from).join("/")}`;
-    if (cached && !await this.current(at, cached)) {
-      this.forget(at);
-      cached = void 0;
-      from = 0;
-    }
-    try {
-      return await this.walk(parts, from, cached ?? this.root);
-    } catch (err) {
-      throw translate(err, path);
-    }
+  connect(addr) {
+    const socket = this.socket(addr.family);
+    socket.connect(addr);
+    return socket;
   }
-  async current(path, dir) {
-    if (performance.now() - (this.checked.get(dir) ?? -CHECK_MS) < CHECK_MS) return true;
-    const where = await this.root.resolve(dir).catch(() => null);
-    if (where === null || `/${where.join("/")}` !== path) return false;
-    this.checked.set(dir, performance.now());
-    return true;
+  bind(socket, addr) {
+    if (addr.family === "unix") {
+      if (addr.path === "") throw new KernelError("EINVAL");
+    } else if (addr.host !== "0.0.0.0" && !isLoopback(addr.host)) {
+      throw new KernelError("EADDRNOTAVAIL");
+    }
+    const named = addr.family === "inet" && addr.port === 0 ? { ...addr, port: this.ephemeral() } : addr;
+    const key = keyOf(named);
+    if (this.bound.has(key)) throw new KernelError("EADDRINUSE");
+    this.bound.set(key, socket);
+    return named;
   }
-  forget(path) {
-    for (const key of [...this.dirs.keys()]) if (within(key, path)) this.dirs.delete(key);
+  release(addr, socket) {
+    const key = keyOf(addr);
+    if (this.bound.get(key) === socket) this.bound.delete(key);
   }
-  async inDir(path, op) {
-    const dir = await this.dir(path);
-    try {
-      return await op(dir);
-    } catch (err) {
-      if (err?.name !== "NotFoundError" || await this.current(path, dir))
-        throw err;
-      this.forget(path);
-      return op(await this.dir(path));
+  target(addr) {
+    if (addr.family === "inet" && !isLoopback(canonicalHost(addr.host))) {
+      throw new KernelError("ENETUNREACH");
     }
+    const key = keyOf(addr);
+    if (!this.bound.has(key)) this.activators.get(key)?.();
+    const socket = this.bound.get(key);
+    if (!socket?.listening) throw new KernelError("ECONNREFUSED");
+    return socket;
   }
-  async child(parent, name2, kind) {
-    return kind === "file" ? parent.getFileHandle(name2) : parent.getDirectoryHandle(name2);
+  ephemeral() {
+    const span = EPHEMERAL_LAST - EPHEMERAL_FIRST + 1;
+    for (let i = 0; i < span; i++) {
+      const port = this.nextEphemeral;
+      this.nextEphemeral = port === EPHEMERAL_LAST ? EPHEMERAL_FIRST : port + 1;
+      if (!this.bound.has(`inet:${port}`)) return port;
+    }
+    throw new KernelError("EADDRINUSE");
   }
-  async parent(path) {
-    const parts = split(path);
-    const name2 = parts.pop();
-    if (name2 === void 0) throw fsError("EBUSY", path);
-    return [`/${parts.join("/")}`, name2];
+};
+
+// src/kernel/dial.ts
+var CHUNK = 64 * 1024;
+var LOOPBACK_NAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
+function dialSocket(net, port, host = "127.0.0.1") {
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new KernelError("EINVAL");
+  const target = LOOPBACK_NAMES.has(host.toLowerCase()) ? "127.0.0.1" : host;
+  if (net.kernelOnly(port)) {
+    throw Object.assign(
+      new Error(`ECONNREFUSED: port ${port} only takes connections from inside the kernel`),
+      {
+        code: "ECONNREFUSED"
+      }
+    );
   }
-  async handle(path) {
-    if (split(path).length === 0) return this.root;
-    const [dir, name2] = await this.parent(path);
-    const known = this.dirs.has(path);
-    return this.inDir(dir, async (parent) => {
-      const [first, second] = known ? ["directory", "file"] : ["file", "directory"];
+  return net.connect({ family: "inet", host: target, port });
+}
+var codeOf = (err) => {
+  const code = err?.code;
+  return typeof code === "string" ? code : "EIO";
+};
+function serveSocket(socket, port, onClose) {
+  let closed = false;
+  let writes = Promise.resolve();
+  let credit = 0;
+  let granted2;
+  const send = (message2, transfer) => {
+    if (!closed) port.postMessage(message2, transfer);
+  };
+  const close = (reset = false) => {
+    if (closed) return;
+    if (reset) send({ error: "ECONNRESET" });
+    closed = true;
+    granted2?.();
+    socket.close();
+    port.close();
+    onClose?.();
+  };
+  const write = (data) => {
+    writes = writes.then(async () => {
+      if (closed) return;
       try {
-        return await this.child(parent, name2, first);
+        await socket.write(data);
+        send({ ack: true });
       } catch (err) {
-        if (err?.name !== "TypeMismatchError") throw err;
+        send({ error: codeOf(err) });
       }
-      return this.child(parent, name2, second);
-    }).catch((err) => {
-      throw translate(err, path);
     });
-  }
-  real(path) {
-    return this.handle(path).then(
-      () => true,
-      () => false
-    );
-  }
-  async linkAlong(path) {
-    for (const entry of await this.meta.get(prefixes(path))) {
-      if (entry?.link === void 0) continue;
-      if (!await this.real(entry.path) && await this.real(parentOf2(entry.path))) return entry;
-    }
-    return void 0;
-  }
-  async locate(path, follow) {
-    let current = path;
-    for (let hops = 0; hops <= MAX_LINKS2; hops++) {
-      try {
-        return { path: current, handle: await this.handle(current) };
-      } catch (err) {
-        if (!missing(err)) throw err;
-        const link2 = await this.linkAlong(current);
-        if (!link2) throw err;
-        if (link2.path === current && !follow) return { path: current, link: link2 };
-        const rest = current.slice(link2.path.length);
-        current = resolvePath(parentOf2(link2.path), `${link2.link}${rest}`);
+  };
+  port.addEventListener("message", ({ data }) => {
+    if (data instanceof Uint8Array) write(data);
+    else if ("more" in data) {
+      credit++;
+      granted2?.();
+    } else if ("end" in data) {
+      writes = writes.then(() => {
+        if (!closed) socket.shutdown(SHUT_WR);
+      });
+    } else if ("close" in data) close();
+  });
+  port.start?.();
+  const turn = () => credit > 0 || closed ? Promise.resolve() : new Promise((r) => granted2 = r);
+  void (async () => {
+    try {
+      for (; ; ) {
+        await turn();
+        if (closed) return;
+        const chunk2 = await socket.read(CHUNK);
+        if (chunk2.length === 0) break;
+        credit--;
+        send(chunk2, [chunk2.buffer]);
+      }
+      send({ end: true });
+    } catch (err) {
+      send({ error: codeOf(err) });
+    }
+  })();
+  return () => close(true);
+}
+
+// src/kernel/signals.ts
+var SIG = {
+  HUP: 1,
+  INT: 2,
+  QUIT: 3,
+  ILL: 4,
+  TRAP: 5,
+  ABRT: 6,
+  BUS: 7,
+  FPE: 8,
+  KILL: 9,
+  USR1: 10,
+  SEGV: 11,
+  USR2: 12,
+  PIPE: 13,
+  ALRM: 14,
+  TERM: 15,
+  STKFLT: 16,
+  CHLD: 17,
+  CONT: 18,
+  STOP: 19,
+  TSTP: 20,
+  TTIN: 21,
+  TTOU: 22,
+  URG: 23,
+  XCPU: 24,
+  XFSZ: 25,
+  VTALRM: 26,
+  PROF: 27,
+  WINCH: 28,
+  POLL: 29,
+  PWR: 30,
+  SYS: 31
+};
+var IGNORED_BY_DEFAULT = /* @__PURE__ */ new Set([SIG.CHLD, SIG.URG, SIG.WINCH]);
+var STOPPING = /* @__PURE__ */ new Set([SIG.STOP, SIG.TSTP, SIG.TTIN, SIG.TTOU]);
+function defaultAction(sig) {
+  if (sig === SIG.CONT) return "continue";
+  if (STOPPING.has(sig)) return "stop";
+  return IGNORED_BY_DEFAULT.has(sig) ? "ignore" : "terminate";
+}
+function isSignal(sig) {
+  return Number.isInteger(sig) && sig >= 1 && sig <= 31;
+}
+function sigbit(sig) {
+  return 1 << sig;
+}
+var SIGNAL_BY_NAME = {
+  SIGINT: SIG.INT,
+  SIGTERM: SIG.TERM,
+  SIGKILL: SIG.KILL,
+  SIGSTOP: SIG.STOP,
+  SIGCONT: SIG.CONT
+};
+
+// src/body-idle.ts
+var BODY_IDLE_MS = 5 * 60 * 1e3;
+
+// src/transport.ts
+var MAX_REQUEST_BODY = 64 * 1024 * 1024;
+function serveTransport(peer, transport) {
+  const open = /* @__PURE__ */ new Map();
+  const fail = (nid, e) => {
+    open.delete(nid);
+    const { status, code } = e;
+    peer.postMessage({
+      net: "error",
+      nid,
+      message: e instanceof Error ? e.message : String(e),
+      ...typeof status === "number" ? { status } : {},
+      ...typeof code === "string" ? { code } : {}
+    });
+  };
+  const start = async (call) => {
+    const abort = new AbortController();
+    const entry = { abort };
+    open.set(call.nid, entry);
+    try {
+      const response = await transport.fetch({
+        url: call.url,
+        method: call.method,
+        headers: call.headers,
+        ...call.body ? { body: call.body } : {},
+        signal: abort.signal
+      });
+      if (!open.has(call.nid)) {
+        await response.cancel();
+        return;
       }
+      open.set(call.nid, { abort, body: response.body[Symbol.asyncIterator](), response });
+      peer.postMessage({
+        net: "head",
+        nid: call.nid,
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+    } catch (e) {
+      fail(call.nid, e);
     }
-    throw fsError("ELOOP", path);
-  }
-  mode(path, directory, meta) {
-    const fallback = directory || EXECUTABLE.test(path) ? 493 : 420;
-    return (directory ? S_IFDIR : S_IFREG) | (meta?.mode ?? fallback);
-  }
-  async statOf(path, handle, meta) {
-    const directory = handle.kind === "directory";
-    const file = directory ? void 0 : await handle.getFile();
-    const modified = file?.lastModified ?? 0;
-    const mtime = meta?.mtimeMs !== void 0 && meta.mtimeFor === modified ? meta.mtimeMs : modified;
-    return {
-      isFile: !directory,
-      isDirectory: directory,
-      isSymbolicLink: false,
-      size: file?.size ?? 0,
-      mode: this.mode(path, directory, meta),
-      mtime: new Date(mtime),
-      atime: new Date(meta?.atimeMs ?? mtime),
-      ctime: new Date(Math.max(meta?.ctimeMs ?? mtime, modified)),
-      ino: meta?.ino ?? inodeOf(path)
-    };
-  }
-  linkStat(entry) {
-    const time2 = new Date(entry.mtimeMs ?? 0);
-    return {
-      isFile: false,
-      isDirectory: false,
-      isSymbolicLink: true,
-      size: new TextEncoder().encode(entry.link).length,
-      mode: S_IFLNK | 511,
-      mtime: time2,
-      atime: time2,
-      ctime: new Date(entry.ctimeMs ?? 0),
-      ino: entry.ino ?? inodeOf(entry.path)
-    };
-  }
-  async describe(found) {
-    if (found.link) return this.linkStat(found.link);
-    const [meta] = await this.meta.get([found.path]);
-    return this.statOf(found.path, found.handle, meta);
-  }
-  async stat(path) {
-    return this.describe(await this.locate(path, true));
-  }
-  async lstat(path) {
-    return this.describe(await this.locate(path, false));
-  }
-  async exists(path) {
-    return this.locate(path, true).then(
-      () => true,
-      () => false
-    );
-  }
-  async readFileBuffer(path) {
-    const handle = (await this.locate(path, true)).handle;
-    if (handle.kind === "directory") throw fsError("EISDIR", path);
-    for (let attempt = 1; ; attempt++) {
-      try {
-        return new Uint8Array(await (await handle.getFile()).arrayBuffer());
-      } catch (err) {
-        if (err?.name !== "NotReadableError" || attempt >= READ_ATTEMPTS) {
-          throw translate(err, path);
-        }
-        await new Promise((resolve) => setTimeout(resolve, attempt * 10));
+  };
+  const read = async (nid) => {
+    const body = open.get(nid)?.body;
+    if (!body) return;
+    try {
+      const next = await body.next();
+      if (next.done) {
+        open.delete(nid);
+        peer.postMessage({ net: "end", nid });
+      } else {
+        const bytes = next.value.slice();
+        peer.postMessage({ net: "chunk", nid, bytes }, [bytes.buffer]);
       }
+    } catch (e) {
+      fail(nid, e);
     }
-  }
-  async readFile(path) {
-    return new TextDecoder().decode(await this.readFileBuffer(path));
-  }
-  async writeTarget(path) {
-    try {
-      return [(await this.locate(path, true)).path, true];
-    } catch (err) {
-      if (!missing(err)) throw err;
+  };
+  const drop = (nid) => {
+    const entry = open.get(nid);
+    open.delete(nid);
+    entry?.abort.abort();
+    void entry?.response?.cancel().catch(() => void 0);
+  };
+  return {
+    answer(call) {
+      if (call.net === "fetch") void start(call);
+      else if (call.net === "read") void read(call.nid);
+      else drop(call.nid);
+    },
+    close() {
+      for (const nid of [...open.keys()]) drop(nid);
     }
-    const [entry] = await this.meta.get([path]);
-    const wanted = entry?.link === void 0 ? path : resolvePath(parentOf2(path), entry.link);
-    return [resolvePath((await this.locate(parentOf2(wanted), true)).path, baseOf(wanted)), false];
+  };
+}
+
+// src/client/serve-client.ts
+var MAX_LINKS2 = 40;
+function act(session, req, signal) {
+  if (req.action === "write") session.write(req.bytes);
+  else if (req.action === "resize") session.resize(req.cols, req.rows);
+  else if (req.action === "signal") session.signal(signal(req.signal));
+  else session.close();
+}
+async function realpath(fs, path) {
+  let parts = fs.resolvePath("/", path).split("/").filter(Boolean);
+  let resolved = "";
+  for (let hops = 0; parts.length > 0; ) {
+    const [name2, ...rest] = parts;
+    const next = `${resolved}/${name2}`;
+    if (!(await fs.lstat(next)).isSymbolicLink) {
+      resolved = next;
+      parts = rest;
+      continue;
+    }
+    if (++hops > MAX_LINKS2) throw fsError("ELOOP", path);
+    const target = await fs.readlink(next);
+    const base = target.startsWith("/") ? "/" : resolved || "/";
+    parts = [...fs.resolvePath(base, target).split("/").filter(Boolean), ...rest];
+    resolved = "";
   }
-  async writeFile(path, content) {
-    const [target, existed] = await this.writeTarget(path);
-    const [dir, name2] = await this.parent(target);
-    let file;
-    try {
-      file = await this.inDir(dir, (parent) => parent.getFileHandle(name2, { create: true }));
-    } catch (err) {
-      const code = err?.name === "TypeMismatchError" ? "EISDIR" : null;
-      throw code ? fsError(code, path) : translate(err, path);
+  return resolved || "/";
+}
+async function fsCall(fs, method, args) {
+  const path = (i) => fs.resolvePath("/", String(args[i]));
+  switch (method) {
+    case "readFile": {
+      const bytes = (await fs.readFileBuffer(path(0))).slice();
+      return { result: bytes, transfer: [bytes.buffer] };
     }
-    if (!existed && content.length === 0) return;
-    const writable = await file.createWritable();
-    await writable.write(content);
-    await writable.close();
+    case "writeFile":
+      await fs.writeFile(path(0), args[1]);
+      return { result: true };
+    case "stat":
+      return { result: await fs.stat(path(0)) };
+    case "lstat":
+      return { result: await fs.lstat(path(0)) };
+    case "readdir":
+      return { result: await fs.readdir(path(0)) };
+    case "mkdir":
+      await fs.mkdir(path(0), { recursive: true });
+      return { result: true };
+    case "rm":
+      await fs.rm(path(0), { recursive: true, force: args[1] === true });
+      return { result: true };
+    case "rename":
+      await fs.rename(path(0), path(1));
+      return { result: true };
+    case "realpath":
+      return { result: await realpath(fs, String(args[0])) };
+    case "symlink":
+      await fs.symlink(String(args[0]), path(1));
+      return { result: true };
+    case "readlink":
+      return { result: await fs.readlink(path(0)) };
+    default:
+      return { result: await fs.exists(path(0)) };
   }
-  async listing(path) {
-    const found = await this.locate(path, true);
-    const handle = found.handle;
-    if (handle.kind !== "directory") throw fsError("ENOTDIR", path);
-    const children2 = /* @__PURE__ */ new Map();
-    for await (const child of handle.values()) children2.set(child.name, child);
-    for (const link2 of await this.meta.links(found.path)) {
-      const name2 = baseOf(link2.path);
-      if (!children2.has(name2)) children2.set(name2, link2);
+}
+function signalOf(host) {
+  return host.signal ?? ((name2) => {
+    throw fsError("EINVAL", `this kernel names no signal ${name2}`);
+  });
+}
+function dialFor(l, req, open) {
+  const socket = dialSocket(l.net, req.port, req.host);
+  const { port1, port2 } = new MessageChannel();
+  open.set(
+    req.id,
+    serveSocket(socket, port1, () => open.delete(req.id))
+  );
+  return { result: port2, transfer: [port2] };
+}
+function killGroups(host, pgids) {
+  if (pgids.length === 0) return;
+  void host.launcher().then((launcher) => {
+    for (const pgid of pgids) launcher.kill(-pgid, SIG.KILL);
+  });
+}
+function joinable(l, pgid, ours) {
+  const sid = l.groupSession(pgid);
+  if (sid === void 0) throw fsError("ESRCH", `no process group ${pgid}`);
+  if (!ours(sid)) throw fsError("EPERM", `process group ${pgid} is in another session`);
+}
+function cdpRegistry(send, gone) {
+  const registered = /* @__PURE__ */ new Map();
+  const drop = (id) => {
+    registered.get(id)?.();
+    return registered.delete(id);
+  };
+  return {
+    serve(l, req) {
+      const hook = portCdpHook(
+        (request2, cdp) => send({ cdpOpen: { ...request2, registration: req.id }, port: cdp }, [
+          cdp
+        ]),
+        gone
+      );
+      registered.set(req.id, l.cdp.register(hook, req.runtime));
+      return req.id;
+    },
+    drop,
+    close: () => {
+      for (const id of [...registered.keys()]) drop(id);
     }
-    return [found.path, [...children2].sort(([a], [b]) => a < b ? -1 : 1)];
-  }
-  async readdir(path) {
-    return (await this.listing(path))[1].map(([name2]) => name2);
-  }
-  async readdirStat(path) {
-    const [dir, children2] = await this.listing(path);
-    const base = dir === "/" ? "" : dir;
-    const metas = await this.meta.get(children2.map(([name2]) => `${base}/${name2}`));
-    return Promise.all(
-      children2.map(async ([name2, child], i) => {
-        if (!isHandle(child)) return [name2, this.linkStat(child)];
-        const stat = await this.statOf(`${base}/${name2}`, child, metas[i]).catch(() => null);
-        return [name2, stat];
-      })
-    );
+  };
+}
+function watchOp(l, req, watches, send) {
+  if (req.op === "unwatch") {
+    watches.get(req.watch)?.();
+    watches.delete(req.watch);
+    return { result: true };
   }
-  async mkdir(path, options = {}) {
-    let found;
-    try {
-      found = await this.locate(path, true);
-    } catch (err) {
-      if (!missing(err)) throw err;
-    }
-    if (found) {
-      const directory = found.handle?.kind === "directory";
-      if (options.recursive && directory) return;
-      throw fsError(options.recursive ? "ENOTDIR" : "EEXIST", path);
-    }
-    const [entry] = await this.meta.get([path]);
-    if (entry?.link !== void 0) throw fsError("EEXIST", path);
-    if (options.recursive) await this.mkdir(parentOf2(path), options);
-    const parent = await this.locate(parentOf2(path), true);
-    if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
-    await parent.handle.getDirectoryHandle(baseOf(path), { create: true });
+  const unwatch = l.watchers.watch(
+    req.paths,
+    { recursive: req.recursive },
+    (change) => send({ watch: req.id, change })
+  );
+  watches.set(req.id, unwatch);
+  return { result: req.id };
+}
+function serveClient(port, host) {
+  let state = "new";
+  const terminals = /* @__PURE__ */ new Map();
+  const groups = /* @__PURE__ */ new Set();
+  const sessions = /* @__PURE__ */ new Set();
+  const watches = /* @__PURE__ */ new Map();
+  let net;
+  const ended = Promise.withResolvers();
+  const send = (message2, transfer = []) => {
+    if (state !== "closed") port.postMessage(message2, transfer);
+  };
+  const reply = (id, body, transfer) => send({ id, ...body }, transfer);
+  const cdps = cdpRegistry(send, ended.promise);
+  function detach(kill = false, bye = "the slicc-kernel detached this client") {
+    if (state === "closed") return;
+    send({ bye });
+    state = "closed";
+    net?.close();
+    for (const unwatch of watches.values()) unwatch();
+    watches.clear();
+    cdps.close();
+    for (const session of terminals.values()) session.close();
+    terminals.clear();
+    if (kill) killGroups(host, [...groups]);
+    groups.clear();
+    port.close?.();
+    ended.resolve();
   }
-  async rm(path, options = {}) {
-    let found;
-    try {
-      found = await this.locate(path, false);
-    } catch (err) {
-      const error = translate(err, path);
-      if (options.force && error.code === "ENOENT") return;
-      throw error;
+  async function hello(message2) {
+    const refused = versionError(message2.protocol);
+    if (refused) {
+      send({ hello: { protocol: PROTOCOL, error: refused } });
+      detach();
+      return;
     }
-    if (found.handle) {
-      const [dir, name2] = await this.parent(found.path);
-      try {
-        await this.inDir(
-          dir,
-          (parent) => parent.removeEntry(name2, { recursive: options.recursive === true })
-        );
-      } catch (err) {
-        throw translate(err, path);
+    const launcher = await host.launcher();
+    const transport = host.transport?.() ?? launcher.transport;
+    net = serveTransport({ postMessage: (m, t) => send(m, t) }, transport);
+    state = "open";
+    if (message2.lock && host.locks) void host.locks.request(message2.lock, () => detach());
+    send({
+      hello: {
+        protocol: PROTOCOL,
+        traits: transport.traits,
+        ...host.lock ? { lock: host.lock } : {}
       }
-      this.changed(found.path);
-    }
-    await this.meta.remove([found.path]);
-  }
-  async rename(from, to) {
-    if (from === to) return;
-    const source = await this.locate(from, false);
-    this.forget(source.path);
-    const parent = await this.locate(parentOf2(to), true);
-    const destination = resolvePath(parent.path, baseOf(to));
-    const sourceStat = await this.describe(source);
-    if (sourceStat.isDirectory && within(destination, source.path)) throw fsError("EINVAL", to);
-    const target = await this.locate(destination, false).catch((err) => {
-      if (missing(err)) return null;
-      throw err;
     });
-    const targetStat = target && await this.describe(target);
-    if (targetStat?.isDirectory && !sourceStat.isDirectory) throw fsError("EISDIR", to);
-    if (targetStat && !targetStat.isDirectory && sourceStat.isDirectory) {
-      throw fsError("ENOTDIR", to);
-    }
-    if (targetStat?.isDirectory && (await this.readdir(destination)).length > 0) {
-      throw fsError("ENOTEMPTY", to);
-    }
-    const now = Date.now();
-    const carry = (entry) => ({
-      ino: inodeOf(source.path),
-      ...entry,
-      path: destination,
-      ctimeMs: now
+  }
+  async function terminal(req, l) {
+    const session = await l.openTerminal(req.argv, {
+      ...req.options,
+      onData: (bytes) => reply(req.id, { fd: 1, bytes: bytes.slice() })
     });
-    if (source.link) {
-      if (target?.handle) await this.rm(destination);
-      await this.meta.move(source.path, destination, carry);
-      return;
+    if (state === "closed") {
+      session.close();
+    } else {
+      terminals.set(req.id, session);
+      sessions.add(session.pid);
+      reply(req.id, { started: session.pid });
     }
-    const dir = parent.handle;
-    const name2 = baseOf(destination);
-    const swap = targetStat?.isDirectory === true;
-    const staging = swap ? `.${name2}.${crypto.randomUUID()}` : name2;
-    this.forget(destination);
-    const timed = await this.explicitTimes(source.path);
-    const moved2 = await this.place(source.handle, dir, staging);
-    if (swap) await this.rm(destination, { recursive: true });
-    await this.meta.move(source.path, destination, carry);
-    if (!moved2) await this.rm(source.path, { recursive: true });
-    let copied = !moved2;
-    if (swap) {
-      const staged = await dir.getDirectoryHandle(staging);
-      const placed = await this.place(staged, dir, name2);
-      if (!placed) await dir.removeEntry(staging, { recursive: true });
-      copied ||= !placed;
+    try {
+      return { result: await session.exited };
+    } finally {
+      terminals.delete(req.id);
     }
-    if (copied) await this.restamp(destination, timed);
-    this.changed(source.path, destination);
-  }
-  async modified(path) {
-    const handle = await this.handle(path);
-    return handle.kind === "file" ? (await handle.getFile()).lastModified : 0;
   }
-  async explicitTimes(path) {
-    const timed = [];
-    for (const entry of await this.meta.under(path)) {
-      if (entry.mtimeFor === void 0 || entry.link !== void 0) continue;
-      const current = await this.modified(entry.path).catch(() => void 0);
-      if (current === entry.mtimeFor) timed.push(entry.path.slice(path.length));
-    }
-    return timed;
+  async function spawn(req, l) {
+    const out = (fd) => (bytes) => reply(req.id, { fd, bytes: bytes.slice() });
+    if (req.options.pgid !== void 0) joinable(l, req.options.pgid, (sid) => sessions.has(sid));
+    let leader;
+    const result = await l.run(req.argv, {
+      ...req.options,
+      collect: false,
+      onStdout: out(1),
+      onStderr: out(2),
+      onStarted: (pid) => {
+        leader = pid;
+        if (state === "closed") return;
+        groups.add(req.options.pgid ?? pid);
+        if (req.options.pgid === void 0) sessions.add(pid);
+        reply(req.id, { started: pid });
+      }
+    });
+    if (leader === void 0) throw fsError("ENOENT", `${req.argv[0] ?? ""}: command not found`);
+    if (!l.list().some((p) => p.pgid === leader)) groups.delete(leader);
+    return { result: result.status };
   }
-  async restamp(path, timed) {
-    for (const rest of timed) {
-      const mtimeFor = await this.modified(path + rest);
-      await this.meta.update(path + rest, (entry) => entry && { ...entry, mtimeFor });
+  async function handle(req) {
+    if (host.scope === "transport" && req.op !== "detach") {
+      throw fsError("EPERM", `${req.op}: this client may only use the network transport`);
     }
-  }
-  async place(handle, dir, name2) {
-    const moved2 = await handle.move?.(dir, name2).then(
-      () => true,
-      () => false
-    );
-    if (moved2) return true;
-    try {
-      await this.copy(handle, dir, name2);
-    } catch (err) {
-      if (handle.kind === "directory") await dir.removeEntry(name2, { recursive: true });
-      throw translate(err, name2);
+    const l = await host.launcher();
+    switch (req.op) {
+      case "spawn":
+        return spawn(req, l);
+      case "open-terminal":
+        return terminal(req, l);
+      case "terminal": {
+        const session = terminals.get(req.terminal);
+        if (!session) throw new Error(`no terminal ${req.terminal}`);
+        act(session, req, signalOf(host));
+        return { result: true };
+      }
+      case "kill":
+        if (!l.kill(req.pid, signalOf(host)(req.signal))) throw fsError("ESRCH", `pid ${req.pid}`);
+        return { result: true };
+      case "ps":
+        return {
+          result: l.list().map(({ tid: _, ...entry }) => entry)
+        };
+      case "fs":
+        if (!FS_METHODS.includes(req.method)) {
+          throw new Error(`unknown file system call ${req.method}`);
+        }
+        return fsCall(l.fs, req.method, req.args);
+      case "watch":
+      case "unwatch":
+        return watchOp(l, req, watches, send);
+      case "mount":
+        return { result: await l.mount(req.spec) };
+      case "umount":
+        l.umount(req.target);
+        return { result: true };
+      case "mounts":
+        return { result: l.mounts.list() };
+      case "dial":
+        return dialFor(l, req, watches);
+      case "serve-cdp":
+        return { result: cdps.serve(l, req) };
+      case "unserve-cdp":
+        return { result: cdps.drop(req.registration) };
+      case "detach":
+        return { result: true };
+      default:
+        throw new Error(`unknown op ${req.op}`);
     }
-    return false;
   }
-  async copy(handle, dir, name2) {
-    if (handle.kind === "file") {
-      const writable = await (await dir.getFileHandle(name2, { create: true })).createWritable();
-      await writable.write(await handle.getFile());
-      await writable.close();
+  port.addEventListener("message", (event) => {
+    const data = event.data;
+    if (state === "closed") return;
+    if (data.hello) {
+      if (state === "new") {
+        hello(data.hello).catch((err) => {
+          send({ hello: { protocol: PROTOCOL, error: String(err?.message ?? err) } });
+          detach();
+        });
+      }
       return;
     }
-    const target = await dir.getDirectoryHandle(name2, { create: true });
-    for await (const child of handle.values()) await this.copy(child, target, child.name);
-  }
-  async symlink(target, path) {
-    const parent = await this.locate(parentOf2(path), true);
-    if (parent.handle?.kind !== "directory") throw fsError("ENOTDIR", path);
-    const at = resolvePath(parent.path, baseOf(path));
-    if (await this.locate(at, false).then(
-      () => true,
-      (err) => !missing(err)
-    )) {
-      throw fsError("EEXIST", path);
-    }
-    const now = Date.now();
-    await this.meta.update(at, () => ({
-      path: at,
-      link: target,
-      dir: parent.path,
-      ino: inodeOf(at),
-      mtimeMs: now,
-      ctimeMs: now
-    }));
-  }
-  async readlink(path) {
-    const found = await this.locate(path, false);
-    if (found.link) return found.link.link;
-    throw fsError("EINVAL", path);
-  }
-  async chmod(path, mode) {
-    const found = await this.locate(path, true);
-    const ctimeMs = Date.now();
-    await this.meta.update(found.path, (entry) => ({
-      ...entry,
-      path: found.path,
-      mode: mode & PERM_MASK,
-      ctimeMs
-    }));
-  }
-  async utimes(path, atime, mtime) {
-    const found = await this.locate(path, true);
-    const handle = found.handle;
-    const file = handle.kind === "file" ? await handle.getFile() : void 0;
-    const ctimeMs = Date.now();
-    await this.meta.update(found.path, (entry) => ({
-      ...entry,
-      path: found.path,
-      atimeMs: atime.getTime(),
-      mtimeMs: mtime.getTime(),
-      mtimeFor: file?.lastModified ?? 0,
-      ctimeMs
-    }));
-  }
-  async reconcile() {
-    let removed = 0;
-    for (const entry of await this.meta.all()) {
-      const real = await this.real(entry.path);
-      const stale = entry.link === void 0 ? !real : real || !await this.real(parentOf2(entry.path));
-      if (!stale) continue;
-      await this.meta.update(entry.path, () => void 0);
-      removed++;
+    if (state !== "open") return;
+    if (data.net !== void 0) {
+      net?.answer(data);
+      return;
     }
-    return removed;
-  }
-};
+    const req = data;
+    handle(req).then(
+      ({ result, transfer }) => {
+        reply(req.id, { result }, transfer);
+        if (req.op === "detach") detach(req.kill === true);
+      },
+      (err) => {
+        const code = err?.code;
+        reply(req.id, {
+          error: err instanceof Error ? err.message : String(err),
+          ...typeof code === "string" ? { code } : {}
+        });
+      }
+    );
+  });
+  port.addEventListener("close", () => detach());
+  port.start?.();
+  return { detach, closed: ended.promise };
+}
 
 // src/kernel/net/loopback-names.ts
 var HOST_LOOPBACK = "host.slicc.internal";
@@ -1934,6 +2112,8 @@ var REASON = {
   200: "OK",
   400: "Bad Request",
   403: "Forbidden",
+  404: "Not Found",
+  405: "Method Not Allowed",
   408: "Request Timeout",
   411: "Length Required",
   413: "Content Too Large",
@@ -1943,6 +2123,7 @@ var REASON = {
   501: "Not Implemented",
   502: "Bad Gateway",
   503: "Service Unavailable",
+  504: "Gateway Timeout",
   505: "HTTP Version Not Supported"
 };
 var Incoming = class {
@@ -3388,6 +3569,465 @@ var RemoteTransport = class {
   }
 };
 
+// src/cdp/types.ts
+var CDP_PORT = 9222;
+var NO_CDP_HOST = "slicc-kernel: no CDP host is attached (createKernel({ cdp }) or client.serveCdp)";
+
+// src/cdp/websocket.ts
+var GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+var MAX_MESSAGE = 256 * 1024 * 1024;
+var CLOSE = {
+  normal: 1e3,
+  protocol: 1002,
+  unsupported: 1003,
+  invalid: 1007,
+  tooBig: 1009,
+  error: 1011
+};
+var OP_TEXT = 1;
+var OP = { continuation: 0, text: OP_TEXT, binary: 2, close: 8, ping: 9, pong: 10 };
+var WsError = class extends Error {
+  code;
+  constructor(code, message2) {
+    super(message2);
+    this.code = code;
+  }
+};
+function field(headers, name2) {
+  return headers.find(([n]) => n.toLowerCase() === name2)?.[1];
+}
+async function acceptKey(headers) {
+  const tokens = (name2) => (field(headers, name2) ?? "").split(",").map((t) => t.trim().toLowerCase());
+  if (!tokens("upgrade").includes("websocket") || !tokens("connection").includes("upgrade")) {
+    throw new HttpError(400, "expected a WebSocket upgrade");
+  }
+  if (field(headers, "sec-websocket-version") !== "13") {
+    throw new HttpError(400, "Sec-WebSocket-Version must be 13");
+  }
+  const key = field(headers, "sec-websocket-key") ?? "";
+  if (!/^[A-Za-z0-9+/]{22}==$/.test(key)) throw new HttpError(400, "bad Sec-WebSocket-Key");
+  const digest = await crypto.subtle.digest("SHA-1", new TextEncoder().encode(key + GUID));
+  return btoa(String.fromCharCode(...new Uint8Array(digest)));
+}
+function isUpgrade(headers) {
+  return (field(headers, "upgrade") ?? "").toLowerCase().includes("websocket");
+}
+function frame(opcode, payload) {
+  const n = payload.length;
+  const size = n < 126 ? 2 : n < 65536 ? 4 : 10;
+  const out = new Uint8Array(size + n);
+  const view = new DataView(out.buffer);
+  out[0] = 128 | opcode;
+  if (n < 126) out[1] = n;
+  else if (n < 65536) {
+    out[1] = 126;
+    view.setUint16(2, n);
+  } else {
+    out[1] = 127;
+    view.setBigUint64(2, BigInt(n));
+  }
+  out.set(payload, size);
+  return out;
+}
+function closeFrame(code, reason = "") {
+  let bytes = new TextEncoder().encode(reason);
+  if (bytes.length > 123) bytes = bytes.subarray(0, 123);
+  const payload = new Uint8Array(2 + bytes.length);
+  new DataView(payload.buffer).setUint16(0, code);
+  payload.set(bytes, 2);
+  return frame(OP.close, payload);
+}
+function pongFrame(payload) {
+  return frame(OP.pong, payload);
+}
+async function fill(incoming, out, signal) {
+  for (let at = 0; at < out.length; ) {
+    const piece = await incoming.some(out.length - at, signal);
+    if (piece.length === 0) throw new WsError(CLOSE.protocol, "the connection closed mid-frame");
+    out.set(piece, at);
+    at += piece.length;
+  }
+}
+var fatal = new TextDecoder("utf-8", { fatal: true });
+function decode(bytes) {
+  try {
+    return fatal.decode(bytes);
+  } catch {
+    throw new WsError(CLOSE.invalid, "a text message is not UTF-8");
+  }
+}
+var WsReader = class {
+  incoming;
+  max;
+  parts = [];
+  size = 0;
+  continuing = false;
+  constructor(incoming, max = MAX_MESSAGE) {
+    this.incoming = incoming;
+    this.max = max;
+  }
+  async next(signal) {
+    for (; ; ) {
+      const first = await this.incoming.some(1, signal);
+      if (first.length === 0) return null;
+      const head = new Uint8Array(2);
+      head[0] = first[0];
+      await fill(this.incoming, head.subarray(1), signal);
+      const fin = (head[0] & 128) !== 0;
+      const opcode = head[0] & 15;
+      if ((head[0] & 112) !== 0) throw new WsError(CLOSE.protocol, "reserved bits are set");
+      if ((head[1] & 128) === 0) throw new WsError(CLOSE.protocol, "client frames must be masked");
+      const length2 = await this.length(head[1] & 127, signal);
+      const control = opcode >= 8;
+      if (control && (length2 > 125 || !fin)) {
+        throw new WsError(CLOSE.protocol, "a control frame is too long or fragmented");
+      }
+      if (!control && this.size + length2 > this.max) {
+        throw new WsError(CLOSE.tooBig, `a message is over ${this.max} bytes`);
+      }
+      const mask = new Uint8Array(4);
+      await fill(this.incoming, mask, signal);
+      const payload = new Uint8Array(length2);
+      await fill(this.incoming, payload, signal);
+      for (let i = 0; i < length2; i++) payload[i] ^= mask[i & 3];
+      const event = this.take(opcode, fin, payload);
+      if (event) return event;
+    }
+  }
+  async length(short, signal) {
+    if (short < 126) return short;
+    const ext = new Uint8Array(short === 126 ? 2 : 8);
+    await fill(this.incoming, ext, signal);
+    const view = new DataView(ext.buffer);
+    if (short === 126) return view.getUint16(0);
+    const long = view.getBigUint64(0);
+    return long > BigInt(this.max) ? this.max + 1 : Number(long);
+  }
+  take(opcode, fin, payload) {
+    switch (opcode) {
+      case OP.ping:
+        return { kind: "ping", payload };
+      case OP.pong:
+        return void 0;
+      case OP.close: {
+        if (payload.length === 1) throw new WsError(CLOSE.protocol, "a close frame is malformed");
+        const code = payload.length >= 2 ? new DataView(payload.buffer).getUint16(0) : 1005;
+        return { kind: "close", code, reason: decode(payload.subarray(2)) };
+      }
+      case OP.text:
+      case OP.continuation: {
+        if (opcode === OP.continuation !== this.continuing) {
+          throw new WsError(CLOSE.protocol, "unexpected continuation frame");
+        }
+        this.parts.push(payload);
+        this.size += payload.length;
+        this.continuing = !fin;
+        if (!fin) return void 0;
+        const whole = this.parts.length === 1 ? payload : concat(this.parts, this.size);
+        this.parts = [];
+        this.size = 0;
+        return { kind: "text", text: decode(whole) };
+      }
+      case OP.binary:
+        throw new WsError(CLOSE.unsupported, "CDP messages are text");
+      default:
+        throw new WsError(CLOSE.protocol, `unknown opcode ${opcode}`);
+    }
+  }
+};
+function switchingHead(accept2) {
+  return latin1Bytes(
+    `HTTP/1.1 101 Switching Protocols\r
+Upgrade: websocket\r
+Connection: Upgrade\r
+Sec-WebSocket-Accept: ${accept2}\r
+\r
+`
+  );
+}
+
+// src/cdp/facade.ts
+var MAX_HEAD = 64 * 1024;
+var LIST_TIMEOUT = 1e4;
+function respond(status, body, type = "text/plain; charset=utf-8") {
+  const bytes = new TextEncoder().encode(body);
+  const head = latin1Bytes(
+    `HTTP/1.1 ${status} ${REASON[status]}\r
+Content-Type: ${type}\r
+Content-Length: ${bytes.length}\r
+Connection: close\r
+\r
+`
+  );
+  const out = new Uint8Array(head.length + bytes.length);
+  out.set(head);
+  out.set(bytes, head.length);
+  return out;
+}
+function json(value) {
+  return respond(200, `${JSON.stringify(value, null, 2)}
+`, "application/json; charset=UTF-8");
+}
+var CdpFacade = class {
+  options;
+  listener;
+  stop = new AbortController();
+  connections = /* @__PURE__ */ new Set();
+  closed;
+  constructor(options) {
+    this.options = options;
+    this.listener = options.net.listen({
+      family: "inet",
+      host: "127.0.0.1",
+      port: options.port ?? CDP_PORT
+    });
+    this.closed = this.acceptLoop();
+  }
+  close() {
+    if (this.stop.signal.aborted) return;
+    this.stop.abort();
+    this.listener.close();
+    for (const conn of this.connections) conn.close();
+  }
+  async acceptLoop() {
+    const served = /* @__PURE__ */ new Set();
+    for (; ; ) {
+      let conn;
+      try {
+        conn = await this.listener.accept(this.stop.signal);
+      } catch {
+        break;
+      }
+      const done4 = this.serve(conn).finally(() => served.delete(done4));
+      served.add(done4);
+    }
+    await Promise.allSettled([...served]);
+  }
+  async serve(conn) {
+    this.connections.add(conn);
+    const incoming = new Incoming(conn);
+    try {
+      const head = await incoming.head(MAX_HEAD, this.stop.signal);
+      if (head) await this.route(conn, incoming, parseRequestHead(head));
+    } catch (e) {
+      if (e instanceof HttpError) await this.write(conn, respond(e.status, `${e.message}
+`));
+    } finally {
+      this.connections.delete(conn);
+      conn.close();
+    }
+  }
+  async write(conn, bytes) {
+    try {
+      await conn.write(bytes, this.stop.signal);
+    } catch {
+    }
+  }
+  async route(conn, incoming, req) {
+    const url = new URL(req.target, "http://127.0.0.1");
+    const runtime = url.searchParams.get("runtime") ?? void 0;
+    const host = req.headers.find(([n]) => n.toLowerCase() === "host")?.[1] ?? "127.0.0.1";
+    if (req.method !== "GET") throw new HttpError(405, `${req.method} is not supported here`);
+    const { hosts } = this.options;
+    if (url.pathname === hosts.path && isUpgrade(req.headers)) {
+      return this.upgrade(conn, incoming, req, runtime);
+    }
+    const path = url.pathname.replace(/\/+$/, "");
+    if (path !== "/json/version" && path !== "/json/list" && path !== "/json") {
+      throw new HttpError(404, "not found: try /json/version");
+    }
+    if (!this.options.hosts.available(runtime)) {
+      throw new HttpError(503, NO_CDP_HOST);
+    }
+    if (path === "/json/version") {
+      await this.write(
+        conn,
+        json({
+          Browser: "slicc-kernel",
+          "Protocol-Version": "1.3",
+          webSocketDebuggerUrl: `ws://${host}${hosts.path}${url.search}`
+        })
+      );
+      return;
+    }
+    await this.write(conn, json(await this.list(runtime)));
+  }
+  async list(runtime) {
+    const conn = await this.host(runtime);
+    try {
+      const reply = await new Promise(
+        (resolve, reject) => {
+          const timer = setTimeout(
+            () => reject(new HttpError(504, "the CDP host did not answer Target.getTargets")),
+            this.options.listTimeout ?? LIST_TIMEOUT
+          );
+          conn.onclose = (reason) => {
+            clearTimeout(timer);
+            reject(new HttpError(502, `the CDP host closed: ${reason ?? "no reason"}`));
+          };
+          conn.onmessage = (message2) => {
+            const parsed = JSON.parse(message2);
+            if (parsed.id !== 1) return;
+            clearTimeout(timer);
+            resolve(parsed);
+          };
+          conn.send(JSON.stringify({ id: 1, method: "Target.getTargets" }));
+        }
+      );
+      if (!reply.result) {
+        throw new HttpError(502, `Target.getTargets failed: ${JSON.stringify(reply.error)}`);
+      }
+      return (reply.result.targetInfos ?? []).map((t) => ({
+        description: "",
+        id: t.targetId,
+        title: t.title,
+        type: t.type,
+        url: t.url
+      }));
+    } finally {
+      conn.close();
+    }
+  }
+  host(runtime) {
+    return this.options.hosts.connect(runtime ? { runtime } : {});
+  }
+  async upgrade(conn, incoming, req, runtime) {
+    const accept2 = await acceptKey(req.headers);
+    const host = await this.host(runtime);
+    await new Relay(conn, incoming, host, this.options.maxMessage ?? MAX_MESSAGE, this.stop.signal).start(switchingHead(accept2)).finally(() => host.close());
+  }
+};
+var Relay = class {
+  writes = Promise.resolve();
+  ended = false;
+  conn;
+  incoming;
+  host;
+  max;
+  stop;
+  constructor(conn, incoming, host, max, stop) {
+    this.conn = conn;
+    this.incoming = incoming;
+    this.host = host;
+    this.max = max;
+    this.stop = stop;
+  }
+  send(bytes) {
+    this.writes = this.writes.then(() => this.conn.write(bytes, this.stop)).catch(() => void 0);
+    return this.writes;
+  }
+  end(code, reason) {
+    if (this.ended) return this.writes;
+    this.ended = true;
+    return this.send(closeFrame(code, reason));
+  }
+  async start(head) {
+    await this.send(head);
+    const hostGone = new Promise((resolve) => {
+      this.host.onclose = (reason) => {
+        void this.end(reason ? CLOSE.error : CLOSE.normal, reason ?? "").then(() => resolve());
+      };
+    });
+    this.host.onmessage = (message2) => {
+      if (this.ended) return;
+      const bytes = new TextEncoder().encode(message2);
+      if (bytes.length > this.max)
+        void this.end(CLOSE.tooBig, `a message is over ${this.max} bytes`);
+      else void this.send(frame(OP_TEXT, bytes));
+    };
+    await Promise.race([this.pump(), hostGone]);
+    await this.writes;
+  }
+  async pump() {
+    const reader = new WsReader(this.incoming, this.max);
+    try {
+      for (; ; ) {
+        const event = await reader.next(this.stop);
+        if (!event) return;
+        if (event.kind === "text") this.host.send(event.text);
+        else if (event.kind === "ping") void this.send(pongFrame(event.payload));
+        else {
+          await this.end(event.code === 1005 ? CLOSE.normal : event.code, "");
+          return;
+        }
+      }
+    } catch (e) {
+      if (e instanceof WsError) await this.end(e.code, e.message);
+    }
+  }
+};
+function enableCdp(net, hosts) {
+  let facade;
+  net.kernelOnly(CDP_PORT, true);
+  net.activate({ family: "inet", host: "127.0.0.1", port: CDP_PORT }, () => {
+    const started = new CdpFacade({ net, hosts });
+    facade = started;
+    void started.closed.then(() => {
+      if (facade === started) facade = void 0;
+    });
+  });
+  return () => facade;
+}
+
+// src/cdp/hosts.ts
+var CdpHosts = class {
+  embedder;
+  clients = [];
+  closed = false;
+  path = `/devtools/browser/${crypto.randomUUID()}`;
+  url = `ws://127.0.0.1:${CDP_PORT}${this.path}`;
+  constructor(hook) {
+    this.embedder = hook ? { hook, runtime: void 0, open: /* @__PURE__ */ new Set() } : void 0;
+  }
+  register(hook, runtime) {
+    const entry = { hook, runtime, open: /* @__PURE__ */ new Set() };
+    this.clients.push(entry);
+    return () => {
+      const at = this.clients.indexOf(entry);
+      if (at >= 0) this.clients.splice(at, 1);
+      closeAll(entry);
+    };
+  }
+  pick(runtime) {
+    if (this.closed) return void 0;
+    const named = runtime ? this.clients.findLast((c) => c.runtime === runtime) : void 0;
+    return named ?? this.embedder ?? this.clients.at(-1);
+  }
+  available(runtime) {
+    return this.pick(runtime) !== void 0;
+  }
+  async connect(request2) {
+    const entry = this.pick(request2.runtime);
+    if (!entry) throw new HttpError(503, NO_CDP_HOST);
+    let conn;
+    try {
+      conn = await entry.hook(request2.runtime ? { runtime: request2.runtime } : {});
+    } catch (e) {
+      throw new HttpError(502, `CDP host: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (this.closed || !(entry === this.embedder || this.clients.includes(entry))) {
+      conn.close();
+      throw new HttpError(503, NO_CDP_HOST);
+    }
+    entry.open.add(conn);
+    const close = conn.close.bind(conn);
+    conn.close = () => {
+      if (entry.open.delete(conn)) close();
+    };
+    return conn;
+  }
+  close() {
+    this.closed = true;
+    for (const entry of [this.embedder, ...this.clients]) if (entry) closeAll(entry);
+  }
+};
+function closeAll(entry) {
+  for (const conn of [...entry.open]) {
+    conn.close();
+    conn.onclose?.("the CDP host is gone");
+  }
+}
+
 // src/commands.ts
 var NAME = /^[A-Za-z0-9._+-]+$/;
 var ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -4434,6 +5074,7 @@ var MountFs = class {
   async pread(path, offset, length2) {
     const real = await this.follow(path);
     const found = this.at(real);
+    if (!found && this.base.pread) return this.base.pread(real, offset, length2);
     if (!found) return (await this.base.readFileBuffer(real)).slice(offset, offset + length2);
     const { mount, rel: rel2 } = found;
     if ((await this.table.getattr(mount, real, rel2)).kind === "directory") {
@@ -4471,6 +5112,7 @@ var MountFs = class {
   async pwrite(path, offset, bytes, transfer = false) {
     const real = await this.follow(path, 0, true);
     const found = this.at(real);
+    if (!found && this.base.pwrite) return this.base.pwrite(real, offset, bytes);
     if (!found)
       return this.base.writeFile(
         real,
@@ -4502,6 +5144,7 @@ var MountFs = class {
   async truncate(path, size) {
     const real = await this.follow(path);
     const found = this.at(real);
+    if (!found && this.base.truncate) return this.base.truncate(real, size);
     if (!found?.mount.caps.ranges) {
       return this.writeFile(real, resized(await this.readFileBuffer(real), size));
     }
@@ -4711,7 +5354,7 @@ async function storageUsage() {
   return { quota: estimate.quota, usage: estimate.usage ?? 0 };
 }
 var done = { ok: true, kind: "void" };
-function json(value) {
+function json2(value) {
   return { ok: true, kind: "json", json: value };
 }
 async function run(entry, path, req) {
@@ -4723,15 +5366,15 @@ async function run(entry, path, req) {
       await fs.writeFile(path, req.body ?? new Uint8Array(0));
       return done;
     case "exists":
-      return json(await fs.exists(path));
+      return json2(await fs.exists(path));
     case "stat":
-      return json(statJson(await fs.stat(path)));
+      return json2(statJson(await fs.stat(path)));
     case "lstat":
-      return json(statJson(await fs.lstat(path)));
+      return json2(statJson(await fs.lstat(path)));
     case "readdir":
-      return json(await fs.readdir(path));
+      return json2(await fs.readdir(path));
     case "readdir-stat":
-      return json(await readdirStat(fs, path));
+      return json2(await readdirStat(fs, path));
     case "mkdir":
       await fs.mkdir(path, { recursive: true });
       return done;
@@ -4757,7 +5400,7 @@ async function run(entry, path, req) {
       await fs.symlink(req.arg2 ?? "", path);
       return done;
     case "readlink":
-      return json(await fs.readlink(path));
+      return json2(await fs.readlink(path));
     case "chmod":
       await fs.chmod(path, req.mode ?? 0);
       return done;
@@ -4788,7 +5431,7 @@ async function dispatchSyncFs(req) {
   const { fs, cwd } = entry;
   try {
     const path = fs.resolvePath(cwd, req.path);
-    if (req.op === "statfs") return json(await entry.statfs?.(path) ?? await storageUsage());
+    if (req.op === "statfs") return json2(await entry.statfs?.(path) ?? await storageUsage());
     if (req.op === "hold") {
       entry.hold?.(path, req.mode === 1);
       return done;
@@ -4961,7 +5604,7 @@ var HOST_OPS = [
   "async-cancel",
   "async-close"
 ];
-var json2 = (value) => ({ ok: true, kind: "json", json: value });
+var json3 = (value) => ({ ok: true, kind: "json", json: value });
 var done2 = { ok: true, kind: "void" };
 var LockTable = class {
   held = /* @__PURE__ */ new Map();
@@ -5010,7 +5653,7 @@ var AsyncOps = class {
   }
   resolve(value) {
     const id = this.hold();
-    this.complete(id, json2(value));
+    this.complete(id, json3(value));
     return id;
   }
   hold() {
@@ -5092,15 +5735,15 @@ async function hostSyscall(req, ctx) {
       return done2;
     case "async-submit":
       if (!ctx.valid(req.req)) throw new KernelError("EINVAL");
-      return json2(ctx.ops.submit(req.req));
+      return json3(ctx.ops.submit(req.req));
     case "async-wait":
-      return json2(await ctx.ops.wait(req.timeoutMs, ctx.blocking()));
+      return json3(await ctx.ops.wait(req.timeoutMs, ctx.blocking()));
     case "async-take":
       return ctx.ops.take(req.id);
     case "async-resolve":
-      return json2(ctx.ops.resolve(req.value));
+      return json3(ctx.ops.resolve(req.value));
     case "async-hold":
-      return json2(ctx.ops.hold());
+      return json3(ctx.ops.hold());
     case "async-cancel":
       ctx.ops.cancel(req.id);
       return done2;
@@ -5627,23 +6270,23 @@ function terminalOf(ctx, fd) {
   if (!tty) throw new KernelError("ENOTTY");
   return tty;
 }
-var json3 = (value) => ({ ok: true, kind: "json", json: value });
+var json4 = (value) => ({ ok: true, kind: "json", json: value });
 var done3 = { ok: true, kind: "void" };
 function ptySyscall(req, ctx) {
   switch (req.op) {
     case "pty-open": {
       if (!ctx.ptys) throw new KernelError("ENOENT");
-      return json3(ctx.fds.install(ctx.ptys.open().master, 3));
+      return json4(ctx.fds.install(ctx.ptys.open().master, 3));
     }
     case "pty-slave-open": {
       if (!ctx.ptys) throw new KernelError("ENOENT");
       const pair = ctx.ptys.get(req.n);
       const fd = ctx.fds.install(pair.openSlave(), 3);
       if (!req.noctty) ctx.jobs?.acquireTerminal(ctx.pid, pair.slave);
-      return json3(fd);
+      return json4(fd);
     }
     case "pty-number":
-      return json3(masterOf(ctx, req.fd).index);
+      return json4(masterOf(ctx, req.fd).index);
     case "pty-lock":
       masterOf(ctx, req.fd).locked = req.lock;
       return done3;
@@ -5655,7 +6298,7 @@ function ptySyscall(req, ctx) {
       return done3;
     }
     case "pty-list":
-      return json3(ctx.ptys?.numbers() ?? []);
+      return json4(ctx.ptys?.numbers() ?? []);
     case "pty-packet":
       masterOf(ctx, req.fd).packet = req.on;
       return done3;
@@ -5733,7 +6376,7 @@ function socketAt(fds, fd) {
   if (!(file instanceof KernelSocket)) throw new KernelError("ENOTSOCK");
   return file;
 }
-var ok = (json4) => json4 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json4 };
+var ok = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
 async function socketSyscall(req, proc) {
   const { fds, net } = proc;
   switch (req.op) {
@@ -7697,8 +8340,8 @@ function umountCall(target, flags) {
 var FSTAB_PATH = "/etc/fstab";
 var FSTAB_RETRIES = [1e3, 4e3, 16e3];
 var FINAL = /* @__PURE__ */ new Set(["EINVAL", "EBUSY", "EPERM", "EACCES"]);
-function unescape(field) {
-  return field.replace(
+function unescape(field2) {
+  return field2.replace(
     /\\([0-7]{3})/g,
     (_, octal) => String.fromCharCode(Number.parseInt(octal, 8))
   );
@@ -8346,7 +8989,7 @@ function importedMemory(bytes) {
     const count = u32();
     for (let i = 0; i < count; i++) {
       const module = name2();
-      const field = name2();
+      const field2 = name2();
       const kind = bytes[at++];
       if (kind === 0) u32();
       else if (kind === 1) {
@@ -8354,7 +8997,7 @@ function importedMemory(bytes) {
         limits();
       } else if (kind === 2) {
         const l = limits();
-        return { module, name: field, ...l };
+        return { module, name: field2, ...l };
       } else if (kind === 3) at += 2;
       else if (kind === 4) {
         at++;
@@ -8445,12 +9088,12 @@ function readImports(r, types) {
   const foreign = {};
   for (let i = r.u32(); i > 0; i--) {
     const module = r.name();
-    const field = r.name();
+    const field2 = r.name();
     const kind = r.byte();
     if (kind !== 0) skipImport(r, kind);
     else {
       const type = types[r.u32()] ?? "other";
-      if (!RESERVED_NAMESPACES.has(module)) (foreign[module] ??= {})[field] = type;
+      if (!RESERVED_NAMESPACES.has(module)) (foreign[module] ??= {})[field2] = type;
     }
   }
   return foreign;
@@ -8557,6 +9200,7 @@ var Launcher = class {
   locks = new LockTable();
   ptys = new PtyTable((tty, sig) => this.jobs.signalOwnedForeground(tty, sig));
   net = new LoopbackNet();
+  cdp;
   ca;
   transport;
   watchers = new FsWatchers();
@@ -8593,7 +9237,8 @@ var Launcher = class {
     this.processMounts = options.processMounts ?? true;
     this.pnpmHome = options.env?.PNPM_HOME ?? PNPM_HOME;
     this.modulesDir = options.modules ?? "/node_modules";
-    this.env = { ...networkEnv(), ...options.env };
+    this.cdp = new CdpHosts(options.cdp);
+    this.env = { ...networkEnv(), SLICC_CDP_URL: this.cdp.url, ...options.env };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
     this.transport = options.transport ?? missingTransport();
     enableNetwork(this.net, {
@@ -8601,6 +9246,7 @@ var Launcher = class {
       engine: kernelTlsEngine(packageTlsEngine(options.fs, this.modulesDir)),
       ca: this.ca
     });
+    enableCdp(this.net, this.cdp);
     this.fs = withCommandDirs(this.base, async () => new Set((await this.commands()).keys()));
     this.watchers.watch([this.modulesDir, this.pnpmHome], { recursive: true }, () => {
       this.catalog = void 0;
@@ -9126,6 +9772,11 @@ var Launcher = class {
 };
 
 // src/serve.ts
+async function inOpfs(deps, root) {
+  if (deps.syncAccess !== true) return false;
+  const opfs = await deps.storage().catch(() => void 0);
+  return await opfs?.resolve(root).catch(() => null) != null;
+}
 function signalNumber(name2) {
   const key = name2.slice(3);
   if (!name2.startsWith("SIG") || !Object.hasOwn(SIG, key))
@@ -9159,6 +9810,14 @@ async function stores(deps, name2, media) {
     ...handles === false ? {} : { media: await deps.media?.(handles) }
   };
 }
+function cdpOption(req, port) {
+  if (!req.cdp) return {};
+  return {
+    cdp: portCdpHook(
+      (request2, cdp) => port.postMessage({ cdpOpen: request2, port: cdp }, [cdp])
+    )
+  };
+}
 function serveKernel(port, deps) {
   let launcher;
   let remote;
@@ -9218,7 +9877,8 @@ function serveKernel(port, deps) {
       const name2 = req.metadata ?? META_DB;
       const { meta, media } = await stores(deps, name2, req.media);
       remote = req.transport ? new RemoteTransport(port, req.transport) : void 0;
-      const fs = new OpfsFs(root, meta, dirsChannel(name2));
+      const ranged2 = await inOpfs(deps, root);
+      const fs = new OpfsFs(root, meta, dirsChannel(name2), { ranged: ranged2 });
       await fs.reconcile();
       const started = new Launcher({
         fs,
@@ -9230,6 +9890,7 @@ function serveKernel(port, deps) {
         ...media ? { media } : {},
         onMountPending: (medium) => port.postMessage({ medium }),
         ...req.hostfs ? { hostfs: askGrant } : {},
+        ...cdpOption(req, port),
         ...mountPolicy(req.processMounts),
         caStore: caStore(deps.metadata ? caDb(req) : false)
       });
@@ -9315,6 +9976,7 @@ var processWorker = pinScript(new URL("./process-worker.js", import.meta.url));
 var driverWorker = pinScript(new URL("./driver-worker.js", import.meta.url));
 serveKernel(globalThis, {
   storage: () => navigator.storage.getDirectory(),
+  syncAccess: syncAccessHandles(),
   createWorker: () => new Worker(processWorker, { type: "module" }),
   createDriverWorker: () => new Worker(driverWorker, { type: "module" }),
   metadata: (name2) => openMeta(name2, indexedDB),