@ai-ecoverse/slicc-kernel 1.5.0 → 1.6.1

package/README.md

@@ -14,8 +14,8 @@ const { status, stdout, stderr } = await kernel.run(['bash', '-c', 'echo hi > he
 ## Requirements
 
 - **The page must be cross-origin isolated**: serve it with `Cross-Origin-Opener-Policy: same-origin` and `Cross-Origin-Embedder-Policy: require-corp` (or `credentialless`). Processes block on `Atomics.wait` over a `SharedArrayBuffer`, which only exists in isolated contexts. `createKernel` throws if `crossOriginIsolated` is false.
-- **The kernel lives in a dedicated worker owned by the page.** A `SharedWorker` is never cross-origin isolated in Chromium (and has no `Worker` constructor), so it cannot host the kernel. `createKernel` starts `dist/kernel-worker.js`; that worker owns OPFS and starts one nested dedicated worker (`dist/process-worker.js`) per process.
-- The page's CSP must allow `eval`: each process evaluates its program's Emscripten glue with `new Function`.
+- **The kernel lives in a dedicated worker owned by the page.** A `SharedWorker` is never cross-origin isolated in Chromium (and has no `Worker` constructor), so it cannot host the kernel. `createKernel` starts `dist/kernel-worker.js`; that worker owns OPFS and starts one nested dedicated worker (`dist/process-worker.js`) per process. The kernel worker reads `process-worker.js` once when it starts and runs every process and thread from that copy (a `blob:` URL), so updating the package in place while a kernel runs does not mix versions: the next page load switches both.
+- The page's CSP must allow `eval`, since each process evaluates its program's Emscripten glue with `new Function`, and `blob:` workers (`worker-src 'self' blob:`, or the `script-src` it falls back to), since processes run from the kernel's pinned copy of `process-worker.js`.
 
 `dist/` is plain ESM with no bare imports, and the workers are referenced with `new URL('./….js', import.meta.url)`, so the files work when served as-is (for example from OPFS through a service worker). Whatever serves them must send the COOP/COEP headers on the page and a compatible `Cross-Origin-Resource-Policy` on the scripts.
 
@@ -87,7 +87,7 @@ Entries may also set `argv0`, `args` and `env`, and a package can set `slicc.env
 
 A WASI program runs in a process worker of its own like an Emscripten one, against the same kernel: its descriptors, pipes, terminals and job control are the kernel's, and its files are OPFS. Preopens are `.` (the cwd), `/dev` and every top-level directory, plus the virtual `/usr` and `/bin`. On top of preview1 it gets:
 
-- **Threads**: `wasi.thread-spawn` (wasm32-wasip1-threads) and WASIX `thread_spawn_v2` start a worker per thread on the process's shared memory, sized from the module's own import (a 2 GiB maximum when the engine cannot reserve more). The threads share one descriptor table; `exit` or a trap in any thread ends the process. At most 64 threads per process, fewer with `SLICC_WASM_THREADS`.
+- **Threads**: `wasi.thread-spawn` (wasm32-wasip1-threads) and WASIX `thread_spawn_v2` start a worker per thread on the process's shared memory, sized from the module's own import (a 2 GiB maximum when the engine cannot reserve more). The threads share one descriptor table; `exit` or a trap in any thread ends the process. At most 64 threads per process; `SLICC_WASM_THREADS` sets another cap, up to 256.
 - **WASIX** (a module importing `wasix_32v1`): fork and setjmp/longjmp through Asyncify (the module is built with `wasm-opt --asyncify`), exec, `posix_spawn`, `waitpid`, pipes, `dup2`, signal handlers and interval timers, terminal modes, and dynamic linking: a position-independent main module loads side modules with `dlopen` from `LD_LIBRARY_PATH`, its runtime path, `/lib`, `/usr/lib` and `/usr/local/lib`.
 - **Sockets**: the WASIX socket calls (`sock_open`, `bind`, `listen`, `connect`, `accept`, options, local and peer names) are the kernel's loopback sockets, and preview1's `sock_recv` / `sock_send` / `sock_shutdown` work on them and on inherited ones. HTTP and HTTPS leave through the realm proxy that `https_proxy` names, as for any other program; `resolve` answers loopback names and literal addresses.
 - **Diagnostics**: a trap ends the program with 134 and its message on stderr; with `SLICC_WASM_BACKTRACE=1` the wasm frames follow, named from the module's name section, or from a sidecar for a module shipped without one (`<module>.names` beside it, or the same path in a `<package>-names` package). `SLICC_WASI_STATS=1` makes a program print its calls, counted and timed, as it ends.
@@ -100,6 +100,8 @@ A WASI command can name an ES module of its package that provides imports of its
 - `fs`: the synchronous filesystem the WASI calls use (absolute paths);
 - `fds`: `open(path, { read, write, append, create, exclusive, truncate, directory, nofollow, mode })` returns a WASI descriptor of the program; `close`, `fstat` (`{ kind, path, mode, uid, gid, size, ino, mtimeMs }`), `fchmod`, and `tryLock(fd, exclusive)` / `unlock(fd)`: advisory locks held by the kernel across processes and threads, keyed by path, released on unlock, on closing the descriptor and at exit (`tryLock` returns 0, or 6 when another process holds the lock);
 - `syscall(req)`: a kernel syscall, synchronously;
+- `spawn({ argv, env, cwd, stdin, stdout, stderr })` starts a command (resolved like `kernel.run`) as a child and returns `{ pid, stdin, stdout, stderr }`. `env` is the child's whole environment (the program's own by default), `cwd` the program's by default. Each stdio is `'inherit'` (the default: the program's own), `'null'`, or `'pipe'`: a kernel pipe whose end the result holds as a descriptor, read and written with `fd-read` (`{ op: 'fd-read', fd, max }`, an empty read at the end), `fd-write` (`{ op: 'fd-write', fd, body }`) and `fd-close`, through `syscall` or `async.submit`; the child's ends are closed in the program. A command that does not exist throws `ENOENT`;
+- `wait(pid)` blocks until a child ends and returns `{ status }`, or `{ status: 128 + signal, signal }` when a signal ended it; `kill(pid, sig)` signals it;
 - `async`: operations of the process that any of its threads can wait for: `submit(req)` runs a kernel syscall without blocking the caller, `resolve(value)` completes at once, `hold()` never completes, and each returns an id; `wait(timeoutMs?)` returns the id of a completed one (0 after the timeout, -1 once `close()` was called), `take(id)` its `{ value }` or `{ error }` (`undefined` while it is pending), and `cancel(id)` drops one;
 - `errno(err)`: the WASI errno of an error.
 
@@ -117,11 +119,11 @@ await kernel.run(['curl', '-sS', 'https://registry.npmjs.org/@ai-ecoverse/wasm-b
 - **Sockets**: `AF_INET` stream sockets on `127.x` and `AF_UNIX` sockets are kernel descriptors on one loopback network per kernel, so processes can serve and connect to each other. They survive `dup`, `fork` and `exec` and work with `select` and `poll`, like pipe ends. A bind of an `AF_UNIX` socket creates its path in OPFS. Other addresses are unreachable: programs reach the outside world only through the proxy.
 - **The proxy** listens on `127.0.0.1:3128` from the first connection on. It takes absolute-form `http:` requests and `CONNECT` tunnels, which it terminates with a certificate for the requested host, issued by the kernel's own CA, then hands each request to the transport. Programs start with `http_proxy`, `https_proxy` (and the upper-case names) pointing at it, `no_proxy` covering loopback, and `SSL_CERT_FILE`, `CURL_CA_BUNDLE` and `GIT_SSL_CAINFO` pointing at the CA certificate in `/etc/ssl/certs/slicc-kernel-ca.pem`; variables in `env` override them. The CA's key never leaves WebCrypto; it is kept in IndexedDB (`<metadata>-ca`, or in memory with `metadata: false`).
 - **TLS** needs [`@ai-ecoverse/wasm-tls-engine`](https://www.npmjs.com/package/@ai-ecoverse/wasm-tls-engine) installed under `modules`, like a command. Without it, `CONNECT` is answered `501` with the reason.
-- **The transport** is an object on the page with `traits` (`manualRedirects`, `encodedBodies`, `maxRequestBody`) and `fetch(request)`, which answers `{ status, statusText, headers, body, cancel }` with `body` an async iterable of `Uint8Array`. The kernel pulls the body one chunk at a time, so a slow program slows the download. A rejection with a numeric `status` is answered with that status; any other with `502`. `fetchTransport()` is the plain `fetch` of the page, bound by CORS (`registry.npmjs.org` and jsDelivr allow it); an embedder with a way around CORS passes its own.
+- **The transport** is an object on the page with `traits` (`manualRedirects`, `encodedBodies`, `maxRequestBody`, and `crossOrigin`: `'cors'` or `'any'`) and `fetch(request)`, which answers `{ status, statusText, headers, body, cancel }` with `body` an async iterable of `Uint8Array`. The kernel pulls the body one chunk at a time, so a slow program slows the download. A rejection with a numeric `status` is answered with that status; any other with `502`. `fetchTransport()` is the plain `fetch` of the page, bound by CORS (`registry.npmjs.org` and jsDelivr allow it); an embedder with a way around CORS passes its own.
 - **`localProxyTransport({ url, key })`** sends every request to a local proxy on loopback, such as [slicc-node](https://github.com/ai-ecoverse/slicc-node) or slicc-swift, which fetches it without CORS. Redirects reach the program unfollowed, with every `Set-Cookie`; bodies arrive decoded. `probeLocalProxy({ url, key })` resolves with the proxy's capabilities, or `null` when it is gone or refuses the key, so a page can fall back to `fetchTransport()`. Both take a `fetch` option, and the transport a `maxRequestBody` (default 64 MiB).
 - **Without a transport**, every request is answered `502` with `slicc-kernel: no network transport (createKernel({ network: { transport } }))`.
 
-Process workers can also use the transport directly, without a socket: the `net-request`, `net-read` and `net-close` syscalls (`Module.sliccKernel.http` in a process) open a request and read its body in pieces. Requests are per process and closed when it exits.
+Process workers can also use the transport directly, without a socket: the `net-request`, `net-read` and `net-close` syscalls (`Module.sliccKernel.http` in a process) open a request and read its body in pieces. Requests are per process and closed when it exits, and a request body has no size limit of its own (the transport's `maxRequestBody` applies to the proxy). `net-traits` answers the transport's `traits` with `crossOrigin`: `'cors'` when it is bound by CORS like `fetchTransport()`, `'any'` (the default for a transport that does not say) when it is not; without a transport it fails with `ENETUNREACH`.
 
 ### Local proxy protocol
 
@@ -135,7 +137,7 @@ The proxy answers `200` with `Content-Type: application/vnd.slicc.raw-fetch`: a
 
 ## Filesystem
 
-`/` is the OPFS root. Each process mounts the top-level directories that exist when it starts (plus `/usr` and `/bin`), so files in them are shared by all processes and visible through the OPFS API as soon as the process that wrote them has closed them; `run` resolves only after that. `createKernel` creates `/tmp` and `/home` in OPFS, so they are shared too. `/dev`, `/proc` and anything created directly in `/` while a process runs live in that process's memory unless it already exists in OPFS. File contents are buffered per open file and written back on close, `fsync` and exit; metadata operations (`mkdir`, `rename`, `rm`, …) go straight to OPFS. The kernel worker is the only writer.
+`/` is the OPFS root. Each process mounts the top-level directories that exist when it starts (plus `/usr` and `/bin`), so files in them are shared by all processes and visible through the OPFS API as soon as the process that wrote them has closed them; `run` resolves only after that. `createKernel` creates `/tmp` and `/home` in OPFS, so they are shared too. Files directly in `/`, and directories created there after a process started, are OPFS as well, the same for Emscripten and WASI programs; only `/dev` and `/proc` live in each process's memory. File contents are buffered per open file and written back on close, `fsync` and exit; metadata operations (`mkdir`, `rename`, `rm`, …) go straight to OPFS. The kernel worker is the only writer.
 
 Directories are renamed with `FileSystemHandle.move()` where available, else by copy and delete.
 
@@ -165,10 +167,10 @@ The filesystem is our own rather than [ZenFS](https://github.com/zen-fs/core) (w
 The kernel is ported from SLICC's `packages/webapp/src/kernel/` with the browser-specific VFS replaced by an OPFS one:
 
 - `src/kernel/`: the kernel side, per process (`host.ts` starts the worker and answers its syscalls in `process.ts`) and shared tables (descriptors, pipes, children, jobs, signals, terminals and pseudo-terminals, `select`).
-- `src/process/`: the runtime inside each process worker. It evaluates the Emscripten glue, mounts the live VFS, routes descriptors through the kernel and implements `fork` by copying the whole linear memory into a new worker (Asyncify). `src/process/wasi/` runs WASI and WASIX programs.
+- `src/process/`: the runtime inside each process worker. It evaluates the Emscripten glue, mounts the live VFS, routes descriptors through the kernel and implements `fork` by copying the whole linear memory into a new worker (Asyncify). `fork` is the only call allowed to suspend through Asyncify: an `fsync` that Emscripten made asynchronous is answered synchronously by the file's own stream instead. `src/process/wasi/` runs WASI and WASIX programs.
 - `src/realm/`: the synchronous bridge (`SharedArrayBuffer` + `Atomics.wait`) and the live Emscripten filesystem on top of it.
 - `src/fs/`: the OPFS filesystem and the virtual command directories.
-- `src/launcher.ts`, `src/commands.ts`, `src/serve.ts`, `src/index.ts`: command resolution, the kernel worker protocol and the page API.
+- `src/launcher.ts`, `src/commands.ts`, `src/serve.ts`, `src/index.ts`: command resolution, the kernel worker protocol and the page API. An embedder that uses `Launcher` directly, without `createKernel`, calls `await launcher.prepare()` first: it creates `/tmp` and `/home` and writes the CA certificate.
 - `src/kernel/net/`: the proxy, HTTP/1.1, TLS termination and the local CA, and the bridge to the page's transport; `src/transport.ts` and `src/local-proxy-transport.ts` are the page side.
 
 

package/dist/index.js

@@ -27,7 +27,8 @@ function fetchTransport(options = {}) {
     traits: {
       manualRedirects: false,
       encodedBodies: false,
-      maxRequestBody: options.maxRequestBody ?? MAX_REQUEST_BODY
+      maxRequestBody: options.maxRequestBody ?? MAX_REQUEST_BODY,
+      crossOrigin: "cors"
     },
     async fetch(request) {
       let response;

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/transport.ts", "../src/local-proxy-transport.ts", "../src/index.ts"],
-  "sourcesContent": ["import type { TransportCall, TransportReply } from './kernel/net/remote-transport.ts';\nimport type {\n  HeaderList,\n  RealmTransport,\n  RealmTransportRequest,\n  RealmTransportResponse,\n  RealmTransportTraits,\n} from './kernel/net/transport.ts';\n\nexport type {\n  HeaderList,\n  RealmTransport as NetworkTransport,\n  RealmTransportRequest as NetworkRequest,\n  RealmTransportResponse as NetworkResponse,\n  RealmTransportTraits as NetworkTraits,\n};\n\nexport interface FetchTransportOptions {\n  fetch?: typeof globalThis.fetch;\n  maxRequestBody?: number;\n}\n\nconst MAX_REQUEST_BODY = 64 * 1024 * 1024;\n\nfunction joinHeaders(headers: HeaderList): Headers {\n  const out = new Headers();\n  for (const [name, value] of headers) {\n    try {\n      out.append(name, value);\n    } catch {}\n  }\n  return out;\n}\n\nasync function* chunks(body: ReadableStream<Uint8Array> | null): AsyncGenerator<Uint8Array> {\n  if (!body) return;\n  const reader = body.getReader();\n  try {\n    for (let next = await reader.read(); !next.done; next = await reader.read()) {\n      if (next.value.byteLength > 0) yield next.value;\n    }\n  } finally {\n    await reader.cancel().catch(() => undefined);\n  }\n}\n\nexport function fetchTransport(options: FetchTransportOptions = {}): RealmTransport {\n  const send = options.fetch ?? globalThis.fetch.bind(globalThis);\n  return {\n    traits: {\n      manualRedirects: false,\n      encodedBodies: false,\n      maxRequestBody: options.maxRequestBody ?? MAX_REQUEST_BODY,\n    },\n    async fetch(request: RealmTransportRequest): Promise<RealmTransportResponse> {\n      let response: Response;\n      try {\n        response = await send(request.url, {\n          method: request.method,\n          headers: joinHeaders(request.headers),\n          ...(request.body ? { body: request.body as BodyInit } : {}),\n          signal: request.signal,\n          redirect: 'follow',\n          credentials: 'omit',\n          mode: 'cors',\n        });\n      } catch (e) {\n        if (request.signal.aborted) throw e;\n        throw Object.assign(\n          new Error(`fetch ${request.url} failed (unreachable, or not allowed by CORS)`),\n          { status: 502 }\n        );\n      }\n      const headers: Array<[string, string]> = [];\n      response.headers.forEach((value, name) => {\n        headers.push([name, value]);\n      });\n      const body = chunks(response.body);\n      return {\n        status: response.status,\n        statusText: response.statusText,\n        headers,\n        body,\n        cancel: async () => {\n          await body.return(undefined);\n          await response.body?.cancel().catch(() => undefined);\n        },\n      };\n    },\n  };\n}\n\nexport interface TransportPeer {\n  postMessage(message: TransportReply, transfer?: Transferable[]): void;\n}\n\nexport interface TransportServer {\n  answer(call: TransportCall): void;\n  close(): void;\n}\n\nexport function serveTransport(peer: TransportPeer, transport: RealmTransport): TransportServer {\n  const open = new Map<\n    number,\n    { abort: AbortController; body?: AsyncIterator<Uint8Array>; response?: RealmTransportResponse }\n  >();\n  const fail = (nid: number, e: unknown) => {\n    open.delete(nid);\n    const status = (e as { status?: unknown }).status;\n    peer.postMessage({\n      net: 'error',\n      nid,\n      message: e instanceof Error ? e.message : String(e),\n      ...(typeof status === 'number' ? { status } : {}),\n    });\n  };\n  const start = async (call: Extract<TransportCall, { net: 'fetch' }>) => {\n    const abort = new AbortController();\n    const entry: { abort: AbortController; body?: AsyncIterator<Uint8Array> } = { abort };\n    open.set(call.nid, entry);\n    try {\n      const response = await transport.fetch({\n        url: call.url,\n        method: call.method,\n        headers: call.headers,\n        ...(call.body ? { body: call.body } : {}),\n        signal: abort.signal,\n      });\n      if (!open.has(call.nid)) {\n        await response.cancel();\n        return;\n      }\n      open.set(call.nid, { abort, body: response.body[Symbol.asyncIterator](), response });\n      peer.postMessage({\n        net: 'head',\n        nid: call.nid,\n        status: response.status,\n        statusText: response.statusText,\n        headers: response.headers,\n      });\n    } catch (e) {\n      fail(call.nid, e);\n    }\n  };\n  const read = async (nid: number) => {\n    const body = open.get(nid)?.body;\n    if (!body) return;\n    try {\n      const next = await body.next();\n      if (next.done) {\n        open.delete(nid);\n        peer.postMessage({ net: 'end', nid });\n      } else {\n        const bytes = next.value.slice();\n        peer.postMessage({ net: 'chunk', nid, bytes }, [bytes.buffer]);\n      }\n    } catch (e) {\n      fail(nid, e);\n    }\n  };\n  const drop = (nid: number) => {\n    const entry = open.get(nid);\n    open.delete(nid);\n    entry?.abort.abort();\n    void entry?.response?.cancel().catch(() => undefined);\n  };\n  return {\n    answer(call) {\n      if (call.net === 'fetch') void start(call);\n      else if (call.net === 'read') void read(call.nid);\n      else drop(call.nid);\n    },\n    close() {\n      for (const nid of [...open.keys()]) drop(nid);\n    },\n  };\n}\n", "import type {\n  HeaderList,\n  RealmTransport,\n  RealmTransportRequest,\n  RealmTransportResponse,\n} from './kernel/net/transport.ts';\n\nexport interface LocalProxyOptions {\n  url: string;\n  key: string;\n  fetch?: typeof globalThis.fetch;\n}\n\nexport interface LocalProxyTransportOptions extends LocalProxyOptions {\n  maxRequestBody?: number;\n}\n\nexport interface LocalProxyProbe {\n  rawFetch: number;\n  requestBodyStreaming: boolean;\n  maxRequestBodyBytes: number;\n}\n\nconst PATH = '/api/fetch-proxy';\nconst RAW_CONTENT_TYPE = 'application/vnd.slicc.raw-fetch';\nconst MAX_HEAD = 1024 * 1024;\nconst MAX_REQUEST_BODY = 64 * 1024 * 1024;\n\ninterface ResponseHead {\n  status: number;\n  statusText: string;\n  headers: Array<[string, string]>;\n}\n\nconst failure = (message: string, status = 502) =>\n  Object.assign(new Error(`local proxy: ${message}`), { status });\n\nfunction encodeHead(url: string, method: string, headers: HeaderList): string {\n  return JSON.stringify({ url, method, headers }).replace(\n    /[\\u007f-\uFFFF]/g,\n    (c) => `\\\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`\n  );\n}\n\nfunction hopHeaders(options: LocalProxyOptions, extra: Record<string, string>): Headers {\n  return new Headers({ 'X-Bridge-Token': options.key, ...extra });\n}\n\nfunction send(options: LocalProxyOptions) {\n  return options.fetch ?? globalThis.fetch.bind(globalThis);\n}\n\nasync function refusal(response: Response): Promise<Error> {\n  const text = await response.text().catch(() => '');\n  let message = text || response.statusText || `answered ${response.status}`;\n  try {\n    const parsed = JSON.parse(text) as { error?: unknown };\n    if (typeof parsed.error === 'string') message = parsed.error;\n  } catch {}\n  return failure(message, response.ok ? 502 : response.status);\n}\n\nfunction isHead(value: unknown): value is ResponseHead {\n  const head = value as Partial<ResponseHead> | null;\n  return (\n    !!head &&\n    typeof head.status === 'number' &&\n    typeof head.statusText === 'string' &&\n    Array.isArray(head.headers) &&\n    head.headers.every(\n      (pair) =>\n        Array.isArray(pair) &&\n        pair.length === 2 &&\n        typeof pair[0] === 'string' &&\n        typeof pair[1] === 'string'\n    )\n  );\n}\n\nfunction concat(a: Uint8Array, b: Uint8Array): Uint8Array {\n  const out = new Uint8Array(a.byteLength + b.byteLength);\n  out.set(a);\n  out.set(b, a.byteLength);\n  return out;\n}\n\nasync function readHead(\n  reader: ReadableStreamDefaultReader<Uint8Array>\n): Promise<{ head: ResponseHead; rest: Uint8Array }> {\n  let buffer: Uint8Array = new Uint8Array(0);\n  for (;;) {\n    if (buffer.byteLength >= 4) {\n      const length = new DataView(buffer.buffer, buffer.byteOffset, 4).getUint32(0);\n      if (length > MAX_HEAD) throw failure(`response head of ${length} bytes`);\n      if (buffer.byteLength >= 4 + length) {\n        let head: unknown;\n        try {\n          head = JSON.parse(new TextDecoder().decode(buffer.subarray(4, 4 + length)));\n        } catch {}\n        if (!isHead(head)) throw failure('malformed response head');\n        return { head, rest: buffer.subarray(4 + length) };\n      }\n    }\n    const next = await reader.read();\n    if (next.done) throw failure('closed before the response head');\n    buffer = concat(buffer, next.value);\n  }\n}\n\nasync function* chunks(\n  rest: Uint8Array,\n  reader: ReadableStreamDefaultReader<Uint8Array>\n): AsyncGenerator<Uint8Array> {\n  try {\n    if (rest.byteLength > 0) yield rest;\n    for (let next = await reader.read(); !next.done; next = await reader.read()) {\n      if (next.value.byteLength > 0) yield next.value;\n    }\n  } finally {\n    await reader.cancel().catch(() => undefined);\n  }\n}\n\nexport async function probeLocalProxy(options: LocalProxyOptions): Promise<LocalProxyProbe | null> {\n  try {\n    const response = await send(options)(new URL(PATH, options.url), {\n      method: 'POST',\n      headers: hopHeaders(options, { 'X-Slicc-Raw-Probe': '1' }),\n      credentials: 'omit',\n      mode: 'cors',\n    });\n    if (!response.ok) return null;\n    const reply = (await response.json()) as Partial<LocalProxyProbe>;\n    if (typeof reply.rawFetch !== 'number' || reply.rawFetch < 1) return null;\n    if (typeof reply.requestBodyStreaming !== 'boolean') return null;\n    if (typeof reply.maxRequestBodyBytes !== 'number') return null;\n    return {\n      rawFetch: reply.rawFetch,\n      requestBodyStreaming: reply.requestBodyStreaming,\n      maxRequestBodyBytes: reply.maxRequestBodyBytes,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport function localProxyTransport(options: LocalProxyTransportOptions): RealmTransport {\n  const endpoint = new URL(PATH, options.url);\n  return {\n    traits: {\n      manualRedirects: true,\n      encodedBodies: false,\n      maxRequestBody: options.maxRequestBody ?? MAX_REQUEST_BODY,\n    },\n    async fetch(request: RealmTransportRequest): Promise<RealmTransportResponse> {\n      let response: Response;\n      try {\n        response = await send(options)(endpoint, {\n          method: 'POST',\n          headers: hopHeaders(options, {\n            'X-Slicc-Raw-Request': encodeHead(request.url, request.method, request.headers),\n          }),\n          ...(request.body ? { body: request.body as BodyInit } : {}),\n          signal: request.signal,\n          credentials: 'omit',\n          mode: 'cors',\n        });\n      } catch (e) {\n        if (request.signal.aborted) throw e;\n        throw failure(`${endpoint.origin} is unreachable or refuses this origin`);\n      }\n      const type = response.headers.get('content-type') ?? '';\n      if (response.status !== 200 || !type.startsWith(RAW_CONTENT_TYPE) || !response.body) {\n        throw await refusal(response);\n      }\n      const reader = response.body.getReader();\n      let framed: { head: ResponseHead; rest: Uint8Array };\n      try {\n        framed = await readHead(reader);\n      } catch (e) {\n        await reader.cancel().catch(() => undefined);\n        throw e;\n      }\n      const body = chunks(framed.rest, reader);\n      return {\n        status: framed.head.status,\n        statusText: framed.head.statusText,\n        headers: framed.head.headers,\n        body,\n        cancel: async () => {\n          await body.return(undefined);\n          await reader.cancel().catch(() => undefined);\n        },\n      };\n    },\n  };\n}\n", "import type { TransportCall } from './kernel/net/remote-transport.ts';\nimport type { KernelCall, TerminalAction } from './serve.ts';\nimport { type NetworkTransport, serveTransport } from './transport.ts';\n\nexport {\n  type LocalProxyOptions,\n  type LocalProxyProbe,\n  type LocalProxyTransportOptions,\n  localProxyTransport,\n  probeLocalProxy,\n} from './local-proxy-transport.ts';\nexport {\n  type FetchTransportOptions,\n  fetchTransport,\n  type HeaderList,\n  type NetworkRequest,\n  type NetworkResponse,\n  type NetworkTraits,\n  type NetworkTransport,\n} from './transport.ts';\n\nexport interface NetworkOptions {\n  transport?: NetworkTransport;\n}\n\nexport interface KernelOptions {\n  root?: FileSystemDirectoryHandle;\n  modules?: string;\n  env?: Record<string, string>;\n  metadata?: string | false;\n  worker?: string | URL;\n  network?: NetworkOptions;\n}\n\nexport interface RunOptions {\n  cwd?: string;\n  env?: Record<string, string>;\n  stdin?: string | Uint8Array;\n  onStdout?: (text: string) => void;\n  onStderr?: (text: string) => void;\n}\n\nexport interface RunResult {\n  status: number;\n  stdout: string;\n  stderr: string;\n}\n\nexport interface Kernel {\n  run(argv: string[], options?: RunOptions): Promise<RunResult>;\n  openTerminal(argv: string[], options?: TerminalOptions): Promise<Terminal>;\n  terminate(): void;\n}\n\nexport interface TerminalOptions {\n  cwd?: string;\n  env?: Record<string, string>;\n  cols?: number;\n  rows?: number;\n  onData?: (bytes: Uint8Array) => void;\n}\n\nexport type TerminalSignal =\n  | 'SIGINT'\n  | 'SIGTSTP'\n  | 'SIGQUIT'\n  | 'SIGHUP'\n  | 'SIGTERM'\n  | 'SIGKILL'\n  | 'SIGCONT';\n\nexport interface Terminal {\n  readonly pid: number;\n  readonly exited: Promise<number>;\n  onData: ((bytes: Uint8Array) => void) | null;\n  write(data: string | Uint8Array): void;\n  resize(cols: number, rows: number): void;\n  signal(name: TerminalSignal): void;\n  close(): void;\n}\n\ninterface Reply {\n  id: number;\n  result?: unknown;\n  error?: string;\n  fd?: 1 | 2;\n  bytes?: Uint8Array;\n  started?: number;\n}\n\ninterface Pending {\n  resolve: (value: unknown) => void;\n  reject: (error: Error) => void;\n  output?: (fd: 1 | 2, bytes: Uint8Array) => void;\n  started?: (pid: number) => void;\n}\n\ninterface Handlers {\n  output?: Pending['output'];\n  started?: Pending['started'];\n}\n\nconst ISOLATION =\n  'slicc-kernel needs a cross-origin isolated page (Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp or credentialless)';\n\nfunction streamer(callback: ((text: string) => void) | undefined) {\n  const decoder = new TextDecoder();\n  return (bytes: Uint8Array) => callback?.(decoder.decode(bytes, { stream: true }));\n}\n\nexport async function createKernel(options: KernelOptions = {}): Promise<Kernel> {\n  if (!globalThis.crossOriginIsolated) throw new Error(ISOLATION);\n  const url = options.worker ?? new URL('./kernel-worker.js', import.meta.url);\n  const worker = new Worker(url, { type: 'module', name: 'slicc-kernel' });\n  const pending = new Map<number, Pending>();\n  let nextId = 0;\n  let failure: Error | undefined;\n\n  const fail = (error: Error) => {\n    failure = error;\n    bridge?.close();\n    for (const call of pending.values()) call.reject(error);\n    pending.clear();\n  };\n  const transport = options.network?.transport;\n  const bridge = transport ? serveTransport(worker, transport) : undefined;\n  worker.addEventListener('message', ({ data }: MessageEvent<Reply | TransportCall>) => {\n    if ('net' in data) return bridge?.answer(data);\n    const call = pending.get(data.id);\n    if (!call) return;\n    if (data.fd !== undefined) return call.output?.(data.fd, data.bytes as Uint8Array);\n    if (data.started !== undefined) return call.started?.(data.started);\n    pending.delete(data.id);\n    if (data.error !== undefined) call.reject(new Error(data.error));\n    else call.resolve(data.result);\n  });\n  worker.addEventListener('error', (event) => {\n    event.preventDefault();\n    fail(new Error(`slicc-kernel worker failed: ${event.message}`));\n  });\n\n  function request(\n    req: KernelCall,\n    handlers: Handlers = {}\n  ): { id: number; done: Promise<unknown> } {\n    const id = ++nextId;\n    if (failure) return { id, done: Promise.reject(failure) };\n    const done = new Promise((resolve, reject) => {\n      pending.set(id, { resolve, reject, ...handlers });\n      worker.postMessage({ ...req, id });\n    });\n    return { id, done };\n  }\n\n  const call = (req: KernelCall, handlers?: Handlers) => request(req, handlers).done;\n\n  async function openTerminal(argv: string[], opts: TerminalOptions = {}): Promise<Terminal> {\n    const { onData, ...options } = opts;\n    let listener = onData ?? null;\n    const backlog: Uint8Array[] = [];\n    const started = Promise.withResolvers<number>();\n    const { id, done } = request(\n      { op: 'open-terminal', argv, options },\n      {\n        output: (_fd, bytes) => (listener ? listener(bytes) : backlog.push(bytes)),\n        started: started.resolve,\n      }\n    );\n    done.catch(started.reject);\n    const pid = await started.promise;\n    const send = (action: TerminalAction) =>\n      void call({ op: 'terminal', terminal: id, ...action }).catch(() => undefined);\n    return {\n      pid,\n      exited: done as Promise<number>,\n      get onData() {\n        return listener;\n      },\n      set onData(next) {\n        listener = next;\n        if (next) for (const bytes of backlog.splice(0)) next(bytes);\n      },\n      write: (data) =>\n        send({\n          action: 'write',\n          bytes: typeof data === 'string' ? new TextEncoder().encode(data) : data,\n        }),\n      resize: (cols, rows) => send({ action: 'resize', cols, rows }),\n      signal: (name) => send({ action: 'signal', signal: name }),\n      close: () => send({ action: 'close' }),\n    };\n  }\n\n  await call({\n    op: 'init',\n    ...(options.root ? { root: options.root } : {}),\n    ...(options.modules ? { modules: options.modules } : {}),\n    ...(options.env ? { env: options.env } : {}),\n    ...(options.metadata !== undefined ? { metadata: options.metadata } : {}),\n    ...(transport ? { transport: transport.traits } : {}),\n  });\n\n  return {\n    async run(argv, runOptions = {}) {\n      const { onStdout, onStderr, stdin, ...rest } = runOptions;\n      const streams = { 1: streamer(onStdout), 2: streamer(onStderr) };\n      const input = typeof stdin === 'string' ? new TextEncoder().encode(stdin) : stdin;\n      const result = (await call(\n        { op: 'run', argv, options: { ...rest, ...(input ? { stdin: input } : {}) } },\n        { output: (fd, bytes) => streams[fd](bytes) }\n      )) as { status: number; stdout: Uint8Array; stderr: Uint8Array };\n      const decoder = new TextDecoder();\n      return {\n        status: result.status,\n        stdout: decoder.decode(result.stdout),\n        stderr: decoder.decode(result.stderr),\n      };\n    },\n    openTerminal,\n    terminate() {\n      fail(new Error('slicc-kernel terminated'));\n      worker.terminate();\n    },\n  };\n}\n"],
-  "mappings": ";AAsBA,IAAM,mBAAmB,KAAK,OAAO;AAErC,SAAS,YAAY,SAA8B;AACjD,QAAM,MAAM,IAAI,QAAQ;AACxB,aAAW,CAAC,MAAM,KAAK,KAAK,SAAS;AACnC,QAAI;AACF,UAAI,OAAO,MAAM,KAAK;AAAA,IACxB,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,SAAO;AACT;AAEA,gBAAgB,OAAO,MAAqE;AAC1F,MAAI,CAAC,KAAM;AACX,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI;AACF,aAAS,OAAO,MAAM,OAAO,KAAK,GAAG,CAAC,KAAK,MAAM,OAAO,MAAM,OAAO,KAAK,GAAG;AAC3E,UAAI,KAAK,MAAM,aAAa,EAAG,OAAM,KAAK;AAAA,IAC5C;AAAA,EACF,UAAE;AACA,UAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EAC7C;AACF;AAEO,SAAS,eAAe,UAAiC,CAAC,GAAmB;AAClF,QAAMA,QAAO,QAAQ,SAAS,WAAW,MAAM,KAAK,UAAU;AAC9D,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf,gBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAAA,IACA,MAAM,MAAM,SAAiE;AAC3E,UAAI;AACJ,UAAI;AACF,mBAAW,MAAMA,MAAK,QAAQ,KAAK;AAAA,UACjC,QAAQ,QAAQ;AAAA,UAChB,SAAS,YAAY,QAAQ,OAAO;AAAA,UACpC,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAiB,IAAI,CAAC;AAAA,UACzD,QAAQ,QAAQ;AAAA,UAChB,UAAU;AAAA,UACV,aAAa;AAAA,UACb,MAAM;AAAA,QACR,CAAC;AAAA,MACH,SAAS,GAAG;AACV,YAAI,QAAQ,OAAO,QAAS,OAAM;AAClC,cAAM,OAAO;AAAA,UACX,IAAI,MAAM,SAAS,QAAQ,GAAG,+CAA+C;AAAA,UAC7E,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,YAAM,UAAmC,CAAC;AAC1C,eAAS,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACxC,gBAAQ,KAAK,CAAC,MAAM,KAAK,CAAC;AAAA,MAC5B,CAAC;AACD,YAAM,OAAO,OAAO,SAAS,IAAI;AACjC,aAAO;AAAA,QACL,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB;AAAA,QACA;AAAA,QACA,QAAQ,YAAY;AAClB,gBAAM,KAAK,OAAO,MAAS;AAC3B,gBAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAWO,SAAS,eAAe,MAAqB,WAA4C;AAC9F,QAAM,OAAO,oBAAI,IAGf;AACF,QAAM,OAAO,CAAC,KAAa,MAAe;AACxC,SAAK,OAAO,GAAG;AACf,UAAM,SAAU,EAA2B;AAC3C,SAAK,YAAY;AAAA,MACf,KAAK;AAAA,MACL;AAAA,MACA,SAAS,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AAAA,MAClD,GAAI,OAAO,WAAW,WAAW,EAAE,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,OAAO,SAAmD;AACtE,UAAM,QAAQ,IAAI,gBAAgB;AAClC,UAAM,QAAsE,EAAE,MAAM;AACpF,SAAK,IAAI,KAAK,KAAK,KAAK;AACxB,QAAI;AACF,YAAM,WAAW,MAAM,UAAU,MAAM;AAAA,QACrC,KAAK,KAAK;AAAA,QACV,QAAQ,KAAK;AAAA,QACb,SAAS,KAAK;AAAA,QACd,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,QACvC,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,UAAI,CAAC,KAAK,IAAI,KAAK,GAAG,GAAG;AACvB,cAAM,SAAS,OAAO;AACtB;AAAA,MACF;AACA,WAAK,IAAI,KAAK,KAAK,EAAE,OAAO,MAAM,SAAS,KAAK,OAAO,aAAa,EAAE,GAAG,SAAS,CAAC;AACnF,WAAK,YAAY;AAAA,QACf,KAAK;AAAA,QACL,KAAK,KAAK;AAAA,QACV,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,SAAS,SAAS;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,GAAG;AACV,WAAK,KAAK,KAAK,CAAC;AAAA,IAClB;AAAA,EACF;AACA,QAAM,OAAO,OAAO,QAAgB;AAClC,UAAM,OAAO,KAAK,IAAI,GAAG,GAAG;AAC5B,QAAI,CAAC,KAAM;AACX,QAAI;AACF,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAI,KAAK,MAAM;AACb,aAAK,OAAO,GAAG;AACf,aAAK,YAAY,EAAE,KAAK,OAAO,IAAI,CAAC;AAAA,MACtC,OAAO;AACL,cAAM,QAAQ,KAAK,MAAM,MAAM;AAC/B,aAAK,YAAY,EAAE,KAAK,SAAS,KAAK,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC;AAAA,MAC/D;AAAA,IACF,SAAS,GAAG;AACV,WAAK,KAAK,CAAC;AAAA,IACb;AAAA,EACF;AACA,QAAM,OAAO,CAAC,QAAgB;AAC5B,UAAM,QAAQ,KAAK,IAAI,GAAG;AAC1B,SAAK,OAAO,GAAG;AACf,WAAO,MAAM,MAAM;AACnB,SAAK,OAAO,UAAU,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EACtD;AACA,SAAO;AAAA,IACL,OAAO,MAAM;AACX,UAAI,KAAK,QAAQ,QAAS,MAAK,MAAM,IAAI;AAAA,eAChC,KAAK,QAAQ,OAAQ,MAAK,KAAK,KAAK,GAAG;AAAA,UAC3C,MAAK,KAAK,GAAG;AAAA,IACpB;AAAA,IACA,QAAQ;AACN,iBAAW,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,EAAG,MAAK,GAAG;AAAA,IAC9C;AAAA,EACF;AACF;;;ACzJA,IAAM,OAAO;AACb,IAAM,mBAAmB;AACzB,IAAM,WAAW,OAAO;AACxB,IAAMC,oBAAmB,KAAK,OAAO;AAQrC,IAAM,UAAU,CAAC,SAAiB,SAAS,QACzC,OAAO,OAAO,IAAI,MAAM,gBAAgB,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;AAEhE,SAAS,WAAW,KAAa,QAAgB,SAA6B;AAC5E,SAAO,KAAK,UAAU,EAAE,KAAK,QAAQ,QAAQ,CAAC,EAAE;AAAA,IAC9C;AAAA,IACA,CAAC,MAAM,MAAM,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,EAC5D;AACF;AAEA,SAAS,WAAW,SAA4B,OAAwC;AACtF,SAAO,IAAI,QAAQ,EAAE,kBAAkB,QAAQ,KAAK,GAAG,MAAM,CAAC;AAChE;AAEA,SAAS,KAAK,SAA4B;AACxC,SAAO,QAAQ,SAAS,WAAW,MAAM,KAAK,UAAU;AAC1D;AAEA,eAAe,QAAQ,UAAoC;AACzD,QAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,MAAI,UAAU,QAAQ,SAAS,cAAc,YAAY,SAAS,MAAM;AACxE,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAI,OAAO,OAAO,UAAU,SAAU,WAAU,OAAO;AAAA,EACzD,QAAQ;AAAA,EAAC;AACT,SAAO,QAAQ,SAAS,SAAS,KAAK,MAAM,SAAS,MAAM;AAC7D;AAEA,SAAS,OAAO,OAAuC;AACrD,QAAM,OAAO;AACb,SACE,CAAC,CAAC,QACF,OAAO,KAAK,WAAW,YACvB,OAAO,KAAK,eAAe,YAC3B,MAAM,QAAQ,KAAK,OAAO,KAC1B,KAAK,QAAQ;AAAA,IACX,CAAC,SACC,MAAM,QAAQ,IAAI,KAClB,KAAK,WAAW,KAChB,OAAO,KAAK,CAAC,MAAM,YACnB,OAAO,KAAK,CAAC,MAAM;AAAA,EACvB;AAEJ;AAEA,SAAS,OAAO,GAAe,GAA2B;AACxD,QAAM,MAAM,IAAI,WAAW,EAAE,aAAa,EAAE,UAAU;AACtD,MAAI,IAAI,CAAC;AACT,MAAI,IAAI,GAAG,EAAE,UAAU;AACvB,SAAO;AACT;AAEA,eAAe,SACb,QACmD;AACnD,MAAI,SAAqB,IAAI,WAAW,CAAC;AACzC,aAAS;AACP,QAAI,OAAO,cAAc,GAAG;AAC1B,YAAM,SAAS,IAAI,SAAS,OAAO,QAAQ,OAAO,YAAY,CAAC,EAAE,UAAU,CAAC;AAC5E,UAAI,SAAS,SAAU,OAAM,QAAQ,oBAAoB,MAAM,QAAQ;AACvE,UAAI,OAAO,cAAc,IAAI,QAAQ;AACnC,YAAI;AACJ,YAAI;AACF,iBAAO,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,OAAO,SAAS,GAAG,IAAI,MAAM,CAAC,CAAC;AAAA,QAC5E,QAAQ;AAAA,QAAC;AACT,YAAI,CAAC,OAAO,IAAI,EAAG,OAAM,QAAQ,yBAAyB;AAC1D,eAAO,EAAE,MAAM,MAAM,OAAO,SAAS,IAAI,MAAM,EAAE;AAAA,MACnD;AAAA,IACF;AACA,UAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,QAAI,KAAK,KAAM,OAAM,QAAQ,iCAAiC;AAC9D,aAAS,OAAO,QAAQ,KAAK,KAAK;AAAA,EACpC;AACF;AAEA,gBAAgBC,QACd,MACA,QAC4B;AAC5B,MAAI;AACF,QAAI,KAAK,aAAa,EAAG,OAAM;AAC/B,aAAS,OAAO,MAAM,OAAO,KAAK,GAAG,CAAC,KAAK,MAAM,OAAO,MAAM,OAAO,KAAK,GAAG;AAC3E,UAAI,KAAK,MAAM,aAAa,EAAG,OAAM,KAAK;AAAA,IAC5C;AAAA,EACF,UAAE;AACA,UAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EAC7C;AACF;AAEA,eAAsB,gBAAgB,SAA6D;AACjG,MAAI;AACF,UAAM,WAAW,MAAM,KAAK,OAAO,EAAE,IAAI,IAAI,MAAM,QAAQ,GAAG,GAAG;AAAA,MAC/D,QAAQ;AAAA,MACR,SAAS,WAAW,SAAS,EAAE,qBAAqB,IAAI,CAAC;AAAA,MACzD,aAAa;AAAA,MACb,MAAM;AAAA,IACR,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,QAAS,MAAM,SAAS,KAAK;AACnC,QAAI,OAAO,MAAM,aAAa,YAAY,MAAM,WAAW,EAAG,QAAO;AACrE,QAAI,OAAO,MAAM,yBAAyB,UAAW,QAAO;AAC5D,QAAI,OAAO,MAAM,wBAAwB,SAAU,QAAO;AAC1D,WAAO;AAAA,MACL,UAAU,MAAM;AAAA,MAChB,sBAAsB,MAAM;AAAA,MAC5B,qBAAqB,MAAM;AAAA,IAC7B;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,oBAAoB,SAAqD;AACvF,QAAM,WAAW,IAAI,IAAI,MAAM,QAAQ,GAAG;AAC1C,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf,gBAAgB,QAAQ,kBAAkBD;AAAA,IAC5C;AAAA,IACA,MAAM,MAAM,SAAiE;AAC3E,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,KAAK,OAAO,EAAE,UAAU;AAAA,UACvC,QAAQ;AAAA,UACR,SAAS,WAAW,SAAS;AAAA,YAC3B,uBAAuB,WAAW,QAAQ,KAAK,QAAQ,QAAQ,QAAQ,OAAO;AAAA,UAChF,CAAC;AAAA,UACD,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAiB,IAAI,CAAC;AAAA,UACzD,QAAQ,QAAQ;AAAA,UAChB,aAAa;AAAA,UACb,MAAM;AAAA,QACR,CAAC;AAAA,MACH,SAAS,GAAG;AACV,YAAI,QAAQ,OAAO,QAAS,OAAM;AAClC,cAAM,QAAQ,GAAG,SAAS,MAAM,wCAAwC;AAAA,MAC1E;AACA,YAAM,OAAO,SAAS,QAAQ,IAAI,cAAc,KAAK;AACrD,UAAI,SAAS,WAAW,OAAO,CAAC,KAAK,WAAW,gBAAgB,KAAK,CAAC,SAAS,MAAM;AACnF,cAAM,MAAM,QAAQ,QAAQ;AAAA,MAC9B;AACA,YAAM,SAAS,SAAS,KAAK,UAAU;AACvC,UAAI;AACJ,UAAI;AACF,iBAAS,MAAM,SAAS,MAAM;AAAA,MAChC,SAAS,GAAG;AACV,cAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,cAAM;AAAA,MACR;AACA,YAAM,OAAOC,QAAO,OAAO,MAAM,MAAM;AACvC,aAAO;AAAA,QACL,QAAQ,OAAO,KAAK;AAAA,QACpB,YAAY,OAAO,KAAK;AAAA,QACxB,SAAS,OAAO,KAAK;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAClB,gBAAM,KAAK,OAAO,MAAS;AAC3B,gBAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,QAC7C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;AC9FA,IAAM,YACJ;AAEF,SAAS,SAAS,UAAgD;AAChE,QAAM,UAAU,IAAI,YAAY;AAChC,SAAO,CAAC,UAAsB,WAAW,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,CAAC;AAClF;AAEA,eAAsB,aAAa,UAAyB,CAAC,GAAoB;AAC/E,MAAI,CAAC,WAAW,oBAAqB,OAAM,IAAI,MAAM,SAAS;AAC9D,QAAM,MAAM,QAAQ,UAAU,IAAI,IAAI,sBAAsB,YAAY,GAAG;AAC3E,QAAM,SAAS,IAAI,OAAO,KAAK,EAAE,MAAM,UAAU,MAAM,eAAe,CAAC;AACvE,QAAM,UAAU,oBAAI,IAAqB;AACzC,MAAI,SAAS;AACb,MAAIC;AAEJ,QAAM,OAAO,CAAC,UAAiB;AAC7B,IAAAA,WAAU;AACV,YAAQ,MAAM;AACd,eAAWC,SAAQ,QAAQ,OAAO,EAAG,CAAAA,MAAK,OAAO,KAAK;AACtD,YAAQ,MAAM;AAAA,EAChB;AACA,QAAM,YAAY,QAAQ,SAAS;AACnC,QAAM,SAAS,YAAY,eAAe,QAAQ,SAAS,IAAI;AAC/D,SAAO,iBAAiB,WAAW,CAAC,EAAE,KAAK,MAA2C;AACpF,QAAI,SAAS,KAAM,QAAO,QAAQ,OAAO,IAAI;AAC7C,UAAMA,QAAO,QAAQ,IAAI,KAAK,EAAE;AAChC,QAAI,CAACA,MAAM;AACX,QAAI,KAAK,OAAO,OAAW,QAAOA,MAAK,SAAS,KAAK,IAAI,KAAK,KAAmB;AACjF,QAAI,KAAK,YAAY,OAAW,QAAOA,MAAK,UAAU,KAAK,OAAO;AAClE,YAAQ,OAAO,KAAK,EAAE;AACtB,QAAI,KAAK,UAAU,OAAW,CAAAA,MAAK,OAAO,IAAI,MAAM,KAAK,KAAK,CAAC;AAAA,QAC1D,CAAAA,MAAK,QAAQ,KAAK,MAAM;AAAA,EAC/B,CAAC;AACD,SAAO,iBAAiB,SAAS,CAAC,UAAU;AAC1C,UAAM,eAAe;AACrB,SAAK,IAAI,MAAM,+BAA+B,MAAM,OAAO,EAAE,CAAC;AAAA,EAChE,CAAC;AAED,WAAS,QACP,KACA,WAAqB,CAAC,GACkB;AACxC,UAAM,KAAK,EAAE;AACb,QAAID,SAAS,QAAO,EAAE,IAAI,MAAM,QAAQ,OAAOA,QAAO,EAAE;AACxD,UAAM,OAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC5C,cAAQ,IAAI,IAAI,EAAE,SAAS,QAAQ,GAAG,SAAS,CAAC;AAChD,aAAO,YAAY,EAAE,GAAG,KAAK,GAAG,CAAC;AAAA,IACnC,CAAC;AACD,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB;AAEA,QAAM,OAAO,CAAC,KAAiB,aAAwB,QAAQ,KAAK,QAAQ,EAAE;AAE9E,iBAAe,aAAa,MAAgB,OAAwB,CAAC,GAAsB;AACzF,UAAM,EAAE,QAAQ,GAAGE,SAAQ,IAAI;AAC/B,QAAI,WAAW,UAAU;AACzB,UAAM,UAAwB,CAAC;AAC/B,UAAM,UAAU,QAAQ,cAAsB;AAC9C,UAAM,EAAE,IAAI,KAAK,IAAI;AAAA,MACnB,EAAE,IAAI,iBAAiB,MAAM,SAAAA,SAAQ;AAAA,MACrC;AAAA,QACE,QAAQ,CAAC,KAAK,UAAW,WAAW,SAAS,KAAK,IAAI,QAAQ,KAAK,KAAK;AAAA,QACxE,SAAS,QAAQ;AAAA,MACnB;AAAA,IACF;AACA,SAAK,MAAM,QAAQ,MAAM;AACzB,UAAM,MAAM,MAAM,QAAQ;AAC1B,UAAMC,QAAO,CAAC,WACZ,KAAK,KAAK,EAAE,IAAI,YAAY,UAAU,IAAI,GAAG,OAAO,CAAC,EAAE,MAAM,MAAM,MAAS;AAC9E,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,MACR,IAAI,SAAS;AACX,eAAO;AAAA,MACT;AAAA,MACA,IAAI,OAAO,MAAM;AACf,mBAAW;AACX,YAAI,KAAM,YAAW,SAAS,QAAQ,OAAO,CAAC,EAAG,MAAK,KAAK;AAAA,MAC7D;AAAA,MACA,OAAO,CAAC,SACNA,MAAK;AAAA,QACH,QAAQ;AAAA,QACR,OAAO,OAAO,SAAS,WAAW,IAAI,YAAY,EAAE,OAAO,IAAI,IAAI;AAAA,MACrE,CAAC;AAAA,MACH,QAAQ,CAAC,MAAM,SAASA,MAAK,EAAE,QAAQ,UAAU,MAAM,KAAK,CAAC;AAAA,MAC7D,QAAQ,CAAC,SAASA,MAAK,EAAE,QAAQ,UAAU,QAAQ,KAAK,CAAC;AAAA,MACzD,OAAO,MAAMA,MAAK,EAAE,QAAQ,QAAQ,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,QAAM,KAAK;AAAA,IACT,IAAI;AAAA,IACJ,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC7C,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,IACtD,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,IAC1C,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACvE,GAAI,YAAY,EAAE,WAAW,UAAU,OAAO,IAAI,CAAC;AAAA,EACrD,CAAC;AAED,SAAO;AAAA,IACL,MAAM,IAAI,MAAM,aAAa,CAAC,GAAG;AAC/B,YAAM,EAAE,UAAU,UAAU,OAAO,GAAG,KAAK,IAAI;AAC/C,YAAM,UAAU,EAAE,GAAG,SAAS,QAAQ,GAAG,GAAG,SAAS,QAAQ,EAAE;AAC/D,YAAM,QAAQ,OAAO,UAAU,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAI;AAC5E,YAAM,SAAU,MAAM;AAAA,QACpB,EAAE,IAAI,OAAO,MAAM,SAAS,EAAE,GAAG,MAAM,GAAI,QAAQ,EAAE,OAAO,MAAM,IAAI,CAAC,EAAG,EAAE;AAAA,QAC5E,EAAE,QAAQ,CAAC,IAAI,UAAU,QAAQ,EAAE,EAAE,KAAK,EAAE;AAAA,MAC9C;AACA,YAAM,UAAU,IAAI,YAAY;AAChC,aAAO;AAAA,QACL,QAAQ,OAAO;AAAA,QACf,QAAQ,QAAQ,OAAO,OAAO,MAAM;AAAA,QACpC,QAAQ,QAAQ,OAAO,OAAO,MAAM;AAAA,MACtC;AAAA,IACF;AAAA,IACA;AAAA,IACA,YAAY;AACV,WAAK,IAAI,MAAM,yBAAyB,CAAC;AACzC,aAAO,UAAU;AAAA,IACnB;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { TransportCall, TransportReply } from './kernel/net/remote-transport.ts';\nimport type {\n  HeaderList,\n  RealmTransport,\n  RealmTransportRequest,\n  RealmTransportResponse,\n  RealmTransportTraits,\n} from './kernel/net/transport.ts';\n\nexport type {\n  HeaderList,\n  RealmTransport as NetworkTransport,\n  RealmTransportRequest as NetworkRequest,\n  RealmTransportResponse as NetworkResponse,\n  RealmTransportTraits as NetworkTraits,\n};\n\nexport interface FetchTransportOptions {\n  fetch?: typeof globalThis.fetch;\n  maxRequestBody?: number;\n}\n\nconst MAX_REQUEST_BODY = 64 * 1024 * 1024;\n\nfunction joinHeaders(headers: HeaderList): Headers {\n  const out = new Headers();\n  for (const [name, value] of headers) {\n    try {\n      out.append(name, value);\n    } catch {}\n  }\n  return out;\n}\n\nasync function* chunks(body: ReadableStream<Uint8Array> | null): AsyncGenerator<Uint8Array> {\n  if (!body) return;\n  const reader = body.getReader();\n  try {\n    for (let next = await reader.read(); !next.done; next = await reader.read()) {\n      if (next.value.byteLength > 0) yield next.value;\n    }\n  } finally {\n    await reader.cancel().catch(() => undefined);\n  }\n}\n\nexport function fetchTransport(options: FetchTransportOptions = {}): RealmTransport {\n  const send = options.fetch ?? globalThis.fetch.bind(globalThis);\n  return {\n    traits: {\n      manualRedirects: false,\n      encodedBodies: false,\n      maxRequestBody: options.maxRequestBody ?? MAX_REQUEST_BODY,\n      crossOrigin: 'cors',\n    },\n    async fetch(request: RealmTransportRequest): Promise<RealmTransportResponse> {\n      let response: Response;\n      try {\n        response = await send(request.url, {\n          method: request.method,\n          headers: joinHeaders(request.headers),\n          ...(request.body ? { body: request.body as BodyInit } : {}),\n          signal: request.signal,\n          redirect: 'follow',\n          credentials: 'omit',\n          mode: 'cors',\n        });\n      } catch (e) {\n        if (request.signal.aborted) throw e;\n        throw Object.assign(\n          new Error(`fetch ${request.url} failed (unreachable, or not allowed by CORS)`),\n          { status: 502 }\n        );\n      }\n      const headers: Array<[string, string]> = [];\n      response.headers.forEach((value, name) => {\n        headers.push([name, value]);\n      });\n      const body = chunks(response.body);\n      return {\n        status: response.status,\n        statusText: response.statusText,\n        headers,\n        body,\n        cancel: async () => {\n          await body.return(undefined);\n          await response.body?.cancel().catch(() => undefined);\n        },\n      };\n    },\n  };\n}\n\nexport interface TransportPeer {\n  postMessage(message: TransportReply, transfer?: Transferable[]): void;\n}\n\nexport interface TransportServer {\n  answer(call: TransportCall): void;\n  close(): void;\n}\n\nexport function serveTransport(peer: TransportPeer, transport: RealmTransport): TransportServer {\n  const open = new Map<\n    number,\n    { abort: AbortController; body?: AsyncIterator<Uint8Array>; response?: RealmTransportResponse }\n  >();\n  const fail = (nid: number, e: unknown) => {\n    open.delete(nid);\n    const status = (e as { status?: unknown }).status;\n    peer.postMessage({\n      net: 'error',\n      nid,\n      message: e instanceof Error ? e.message : String(e),\n      ...(typeof status === 'number' ? { status } : {}),\n    });\n  };\n  const start = async (call: Extract<TransportCall, { net: 'fetch' }>) => {\n    const abort = new AbortController();\n    const entry: { abort: AbortController; body?: AsyncIterator<Uint8Array> } = { abort };\n    open.set(call.nid, entry);\n    try {\n      const response = await transport.fetch({\n        url: call.url,\n        method: call.method,\n        headers: call.headers,\n        ...(call.body ? { body: call.body } : {}),\n        signal: abort.signal,\n      });\n      if (!open.has(call.nid)) {\n        await response.cancel();\n        return;\n      }\n      open.set(call.nid, { abort, body: response.body[Symbol.asyncIterator](), response });\n      peer.postMessage({\n        net: 'head',\n        nid: call.nid,\n        status: response.status,\n        statusText: response.statusText,\n        headers: response.headers,\n      });\n    } catch (e) {\n      fail(call.nid, e);\n    }\n  };\n  const read = async (nid: number) => {\n    const body = open.get(nid)?.body;\n    if (!body) return;\n    try {\n      const next = await body.next();\n      if (next.done) {\n        open.delete(nid);\n        peer.postMessage({ net: 'end', nid });\n      } else {\n        const bytes = next.value.slice();\n        peer.postMessage({ net: 'chunk', nid, bytes }, [bytes.buffer]);\n      }\n    } catch (e) {\n      fail(nid, e);\n    }\n  };\n  const drop = (nid: number) => {\n    const entry = open.get(nid);\n    open.delete(nid);\n    entry?.abort.abort();\n    void entry?.response?.cancel().catch(() => undefined);\n  };\n  return {\n    answer(call) {\n      if (call.net === 'fetch') void start(call);\n      else if (call.net === 'read') void read(call.nid);\n      else drop(call.nid);\n    },\n    close() {\n      for (const nid of [...open.keys()]) drop(nid);\n    },\n  };\n}\n", "import type {\n  HeaderList,\n  RealmTransport,\n  RealmTransportRequest,\n  RealmTransportResponse,\n} from './kernel/net/transport.ts';\n\nexport interface LocalProxyOptions {\n  url: string;\n  key: string;\n  fetch?: typeof globalThis.fetch;\n}\n\nexport interface LocalProxyTransportOptions extends LocalProxyOptions {\n  maxRequestBody?: number;\n}\n\nexport interface LocalProxyProbe {\n  rawFetch: number;\n  requestBodyStreaming: boolean;\n  maxRequestBodyBytes: number;\n}\n\nconst PATH = '/api/fetch-proxy';\nconst RAW_CONTENT_TYPE = 'application/vnd.slicc.raw-fetch';\nconst MAX_HEAD = 1024 * 1024;\nconst MAX_REQUEST_BODY = 64 * 1024 * 1024;\n\ninterface ResponseHead {\n  status: number;\n  statusText: string;\n  headers: Array<[string, string]>;\n}\n\nconst failure = (message: string, status = 502) =>\n  Object.assign(new Error(`local proxy: ${message}`), { status });\n\nfunction encodeHead(url: string, method: string, headers: HeaderList): string {\n  return JSON.stringify({ url, method, headers }).replace(\n    /[\\u007f-\uFFFF]/g,\n    (c) => `\\\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`\n  );\n}\n\nfunction hopHeaders(options: LocalProxyOptions, extra: Record<string, string>): Headers {\n  return new Headers({ 'X-Bridge-Token': options.key, ...extra });\n}\n\nfunction send(options: LocalProxyOptions) {\n  return options.fetch ?? globalThis.fetch.bind(globalThis);\n}\n\nasync function refusal(response: Response): Promise<Error> {\n  const text = await response.text().catch(() => '');\n  let message = text || response.statusText || `answered ${response.status}`;\n  try {\n    const parsed = JSON.parse(text) as { error?: unknown };\n    if (typeof parsed.error === 'string') message = parsed.error;\n  } catch {}\n  return failure(message, response.ok ? 502 : response.status);\n}\n\nfunction isHead(value: unknown): value is ResponseHead {\n  const head = value as Partial<ResponseHead> | null;\n  return (\n    !!head &&\n    typeof head.status === 'number' &&\n    typeof head.statusText === 'string' &&\n    Array.isArray(head.headers) &&\n    head.headers.every(\n      (pair) =>\n        Array.isArray(pair) &&\n        pair.length === 2 &&\n        typeof pair[0] === 'string' &&\n        typeof pair[1] === 'string'\n    )\n  );\n}\n\nfunction concat(a: Uint8Array, b: Uint8Array): Uint8Array {\n  const out = new Uint8Array(a.byteLength + b.byteLength);\n  out.set(a);\n  out.set(b, a.byteLength);\n  return out;\n}\n\nasync function readHead(\n  reader: ReadableStreamDefaultReader<Uint8Array>\n): Promise<{ head: ResponseHead; rest: Uint8Array }> {\n  let buffer: Uint8Array = new Uint8Array(0);\n  for (;;) {\n    if (buffer.byteLength >= 4) {\n      const length = new DataView(buffer.buffer, buffer.byteOffset, 4).getUint32(0);\n      if (length > MAX_HEAD) throw failure(`response head of ${length} bytes`);\n      if (buffer.byteLength >= 4 + length) {\n        let head: unknown;\n        try {\n          head = JSON.parse(new TextDecoder().decode(buffer.subarray(4, 4 + length)));\n        } catch {}\n        if (!isHead(head)) throw failure('malformed response head');\n        return { head, rest: buffer.subarray(4 + length) };\n      }\n    }\n    const next = await reader.read();\n    if (next.done) throw failure('closed before the response head');\n    buffer = concat(buffer, next.value);\n  }\n}\n\nasync function* chunks(\n  rest: Uint8Array,\n  reader: ReadableStreamDefaultReader<Uint8Array>\n): AsyncGenerator<Uint8Array> {\n  try {\n    if (rest.byteLength > 0) yield rest;\n    for (let next = await reader.read(); !next.done; next = await reader.read()) {\n      if (next.value.byteLength > 0) yield next.value;\n    }\n  } finally {\n    await reader.cancel().catch(() => undefined);\n  }\n}\n\nexport async function probeLocalProxy(options: LocalProxyOptions): Promise<LocalProxyProbe | null> {\n  try {\n    const response = await send(options)(new URL(PATH, options.url), {\n      method: 'POST',\n      headers: hopHeaders(options, { 'X-Slicc-Raw-Probe': '1' }),\n      credentials: 'omit',\n      mode: 'cors',\n    });\n    if (!response.ok) return null;\n    const reply = (await response.json()) as Partial<LocalProxyProbe>;\n    if (typeof reply.rawFetch !== 'number' || reply.rawFetch < 1) return null;\n    if (typeof reply.requestBodyStreaming !== 'boolean') return null;\n    if (typeof reply.maxRequestBodyBytes !== 'number') return null;\n    return {\n      rawFetch: reply.rawFetch,\n      requestBodyStreaming: reply.requestBodyStreaming,\n      maxRequestBodyBytes: reply.maxRequestBodyBytes,\n    };\n  } catch {\n    return null;\n  }\n}\n\nexport function localProxyTransport(options: LocalProxyTransportOptions): RealmTransport {\n  const endpoint = new URL(PATH, options.url);\n  return {\n    traits: {\n      manualRedirects: true,\n      encodedBodies: false,\n      maxRequestBody: options.maxRequestBody ?? MAX_REQUEST_BODY,\n    },\n    async fetch(request: RealmTransportRequest): Promise<RealmTransportResponse> {\n      let response: Response;\n      try {\n        response = await send(options)(endpoint, {\n          method: 'POST',\n          headers: hopHeaders(options, {\n            'X-Slicc-Raw-Request': encodeHead(request.url, request.method, request.headers),\n          }),\n          ...(request.body ? { body: request.body as BodyInit } : {}),\n          signal: request.signal,\n          credentials: 'omit',\n          mode: 'cors',\n        });\n      } catch (e) {\n        if (request.signal.aborted) throw e;\n        throw failure(`${endpoint.origin} is unreachable or refuses this origin`);\n      }\n      const type = response.headers.get('content-type') ?? '';\n      if (response.status !== 200 || !type.startsWith(RAW_CONTENT_TYPE) || !response.body) {\n        throw await refusal(response);\n      }\n      const reader = response.body.getReader();\n      let framed: { head: ResponseHead; rest: Uint8Array };\n      try {\n        framed = await readHead(reader);\n      } catch (e) {\n        await reader.cancel().catch(() => undefined);\n        throw e;\n      }\n      const body = chunks(framed.rest, reader);\n      return {\n        status: framed.head.status,\n        statusText: framed.head.statusText,\n        headers: framed.head.headers,\n        body,\n        cancel: async () => {\n          await body.return(undefined);\n          await reader.cancel().catch(() => undefined);\n        },\n      };\n    },\n  };\n}\n", "import type { TransportCall } from './kernel/net/remote-transport.ts';\nimport type { KernelCall, TerminalAction } from './serve.ts';\nimport { type NetworkTransport, serveTransport } from './transport.ts';\n\nexport {\n  type LocalProxyOptions,\n  type LocalProxyProbe,\n  type LocalProxyTransportOptions,\n  localProxyTransport,\n  probeLocalProxy,\n} from './local-proxy-transport.ts';\nexport {\n  type FetchTransportOptions,\n  fetchTransport,\n  type HeaderList,\n  type NetworkRequest,\n  type NetworkResponse,\n  type NetworkTraits,\n  type NetworkTransport,\n} from './transport.ts';\n\nexport interface NetworkOptions {\n  transport?: NetworkTransport;\n}\n\nexport interface KernelOptions {\n  root?: FileSystemDirectoryHandle;\n  modules?: string;\n  env?: Record<string, string>;\n  metadata?: string | false;\n  worker?: string | URL;\n  network?: NetworkOptions;\n}\n\nexport interface RunOptions {\n  cwd?: string;\n  env?: Record<string, string>;\n  stdin?: string | Uint8Array;\n  onStdout?: (text: string) => void;\n  onStderr?: (text: string) => void;\n}\n\nexport interface RunResult {\n  status: number;\n  stdout: string;\n  stderr: string;\n}\n\nexport interface Kernel {\n  run(argv: string[], options?: RunOptions): Promise<RunResult>;\n  openTerminal(argv: string[], options?: TerminalOptions): Promise<Terminal>;\n  terminate(): void;\n}\n\nexport interface TerminalOptions {\n  cwd?: string;\n  env?: Record<string, string>;\n  cols?: number;\n  rows?: number;\n  onData?: (bytes: Uint8Array) => void;\n}\n\nexport type TerminalSignal =\n  | 'SIGINT'\n  | 'SIGTSTP'\n  | 'SIGQUIT'\n  | 'SIGHUP'\n  | 'SIGTERM'\n  | 'SIGKILL'\n  | 'SIGCONT';\n\nexport interface Terminal {\n  readonly pid: number;\n  readonly exited: Promise<number>;\n  onData: ((bytes: Uint8Array) => void) | null;\n  write(data: string | Uint8Array): void;\n  resize(cols: number, rows: number): void;\n  signal(name: TerminalSignal): void;\n  close(): void;\n}\n\ninterface Reply {\n  id: number;\n  result?: unknown;\n  error?: string;\n  fd?: 1 | 2;\n  bytes?: Uint8Array;\n  started?: number;\n}\n\ninterface Pending {\n  resolve: (value: unknown) => void;\n  reject: (error: Error) => void;\n  output?: (fd: 1 | 2, bytes: Uint8Array) => void;\n  started?: (pid: number) => void;\n}\n\ninterface Handlers {\n  output?: Pending['output'];\n  started?: Pending['started'];\n}\n\nconst ISOLATION =\n  'slicc-kernel needs a cross-origin isolated page (Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp or credentialless)';\n\nfunction streamer(callback: ((text: string) => void) | undefined) {\n  const decoder = new TextDecoder();\n  return (bytes: Uint8Array) => callback?.(decoder.decode(bytes, { stream: true }));\n}\n\nexport async function createKernel(options: KernelOptions = {}): Promise<Kernel> {\n  if (!globalThis.crossOriginIsolated) throw new Error(ISOLATION);\n  const url = options.worker ?? new URL('./kernel-worker.js', import.meta.url);\n  const worker = new Worker(url, { type: 'module', name: 'slicc-kernel' });\n  const pending = new Map<number, Pending>();\n  let nextId = 0;\n  let failure: Error | undefined;\n\n  const fail = (error: Error) => {\n    failure = error;\n    bridge?.close();\n    for (const call of pending.values()) call.reject(error);\n    pending.clear();\n  };\n  const transport = options.network?.transport;\n  const bridge = transport ? serveTransport(worker, transport) : undefined;\n  worker.addEventListener('message', ({ data }: MessageEvent<Reply | TransportCall>) => {\n    if ('net' in data) return bridge?.answer(data);\n    const call = pending.get(data.id);\n    if (!call) return;\n    if (data.fd !== undefined) return call.output?.(data.fd, data.bytes as Uint8Array);\n    if (data.started !== undefined) return call.started?.(data.started);\n    pending.delete(data.id);\n    if (data.error !== undefined) call.reject(new Error(data.error));\n    else call.resolve(data.result);\n  });\n  worker.addEventListener('error', (event) => {\n    event.preventDefault();\n    fail(new Error(`slicc-kernel worker failed: ${event.message}`));\n  });\n\n  function request(\n    req: KernelCall,\n    handlers: Handlers = {}\n  ): { id: number; done: Promise<unknown> } {\n    const id = ++nextId;\n    if (failure) return { id, done: Promise.reject(failure) };\n    const done = new Promise((resolve, reject) => {\n      pending.set(id, { resolve, reject, ...handlers });\n      worker.postMessage({ ...req, id });\n    });\n    return { id, done };\n  }\n\n  const call = (req: KernelCall, handlers?: Handlers) => request(req, handlers).done;\n\n  async function openTerminal(argv: string[], opts: TerminalOptions = {}): Promise<Terminal> {\n    const { onData, ...options } = opts;\n    let listener = onData ?? null;\n    const backlog: Uint8Array[] = [];\n    const started = Promise.withResolvers<number>();\n    const { id, done } = request(\n      { op: 'open-terminal', argv, options },\n      {\n        output: (_fd, bytes) => (listener ? listener(bytes) : backlog.push(bytes)),\n        started: started.resolve,\n      }\n    );\n    done.catch(started.reject);\n    const pid = await started.promise;\n    const send = (action: TerminalAction) =>\n      void call({ op: 'terminal', terminal: id, ...action }).catch(() => undefined);\n    return {\n      pid,\n      exited: done as Promise<number>,\n      get onData() {\n        return listener;\n      },\n      set onData(next) {\n        listener = next;\n        if (next) for (const bytes of backlog.splice(0)) next(bytes);\n      },\n      write: (data) =>\n        send({\n          action: 'write',\n          bytes: typeof data === 'string' ? new TextEncoder().encode(data) : data,\n        }),\n      resize: (cols, rows) => send({ action: 'resize', cols, rows }),\n      signal: (name) => send({ action: 'signal', signal: name }),\n      close: () => send({ action: 'close' }),\n    };\n  }\n\n  await call({\n    op: 'init',\n    ...(options.root ? { root: options.root } : {}),\n    ...(options.modules ? { modules: options.modules } : {}),\n    ...(options.env ? { env: options.env } : {}),\n    ...(options.metadata !== undefined ? { metadata: options.metadata } : {}),\n    ...(transport ? { transport: transport.traits } : {}),\n  });\n\n  return {\n    async run(argv, runOptions = {}) {\n      const { onStdout, onStderr, stdin, ...rest } = runOptions;\n      const streams = { 1: streamer(onStdout), 2: streamer(onStderr) };\n      const input = typeof stdin === 'string' ? new TextEncoder().encode(stdin) : stdin;\n      const result = (await call(\n        { op: 'run', argv, options: { ...rest, ...(input ? { stdin: input } : {}) } },\n        { output: (fd, bytes) => streams[fd](bytes) }\n      )) as { status: number; stdout: Uint8Array; stderr: Uint8Array };\n      const decoder = new TextDecoder();\n      return {\n        status: result.status,\n        stdout: decoder.decode(result.stdout),\n        stderr: decoder.decode(result.stderr),\n      };\n    },\n    openTerminal,\n    terminate() {\n      fail(new Error('slicc-kernel terminated'));\n      worker.terminate();\n    },\n  };\n}\n"],
+  "mappings": ";AAsBA,IAAM,mBAAmB,KAAK,OAAO;AAErC,SAAS,YAAY,SAA8B;AACjD,QAAM,MAAM,IAAI,QAAQ;AACxB,aAAW,CAAC,MAAM,KAAK,KAAK,SAAS;AACnC,QAAI;AACF,UAAI,OAAO,MAAM,KAAK;AAAA,IACxB,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,SAAO;AACT;AAEA,gBAAgB,OAAO,MAAqE;AAC1F,MAAI,CAAC,KAAM;AACX,QAAM,SAAS,KAAK,UAAU;AAC9B,MAAI;AACF,aAAS,OAAO,MAAM,OAAO,KAAK,GAAG,CAAC,KAAK,MAAM,OAAO,MAAM,OAAO,KAAK,GAAG;AAC3E,UAAI,KAAK,MAAM,aAAa,EAAG,OAAM,KAAK;AAAA,IAC5C;AAAA,EACF,UAAE;AACA,UAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EAC7C;AACF;AAEO,SAAS,eAAe,UAAiC,CAAC,GAAmB;AAClF,QAAMA,QAAO,QAAQ,SAAS,WAAW,MAAM,KAAK,UAAU;AAC9D,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,aAAa;AAAA,IACf;AAAA,IACA,MAAM,MAAM,SAAiE;AAC3E,UAAI;AACJ,UAAI;AACF,mBAAW,MAAMA,MAAK,QAAQ,KAAK;AAAA,UACjC,QAAQ,QAAQ;AAAA,UAChB,SAAS,YAAY,QAAQ,OAAO;AAAA,UACpC,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAiB,IAAI,CAAC;AAAA,UACzD,QAAQ,QAAQ;AAAA,UAChB,UAAU;AAAA,UACV,aAAa;AAAA,UACb,MAAM;AAAA,QACR,CAAC;AAAA,MACH,SAAS,GAAG;AACV,YAAI,QAAQ,OAAO,QAAS,OAAM;AAClC,cAAM,OAAO;AAAA,UACX,IAAI,MAAM,SAAS,QAAQ,GAAG,+CAA+C;AAAA,UAC7E,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,YAAM,UAAmC,CAAC;AAC1C,eAAS,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACxC,gBAAQ,KAAK,CAAC,MAAM,KAAK,CAAC;AAAA,MAC5B,CAAC;AACD,YAAM,OAAO,OAAO,SAAS,IAAI;AACjC,aAAO;AAAA,QACL,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB;AAAA,QACA;AAAA,QACA,QAAQ,YAAY;AAClB,gBAAM,KAAK,OAAO,MAAS;AAC3B,gBAAM,SAAS,MAAM,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAWO,SAAS,eAAe,MAAqB,WAA4C;AAC9F,QAAM,OAAO,oBAAI,IAGf;AACF,QAAM,OAAO,CAAC,KAAa,MAAe;AACxC,SAAK,OAAO,GAAG;AACf,UAAM,SAAU,EAA2B;AAC3C,SAAK,YAAY;AAAA,MACf,KAAK;AAAA,MACL;AAAA,MACA,SAAS,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AAAA,MAClD,GAAI,OAAO,WAAW,WAAW,EAAE,OAAO,IAAI,CAAC;AAAA,IACjD,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,OAAO,SAAmD;AACtE,UAAM,QAAQ,IAAI,gBAAgB;AAClC,UAAM,QAAsE,EAAE,MAAM;AACpF,SAAK,IAAI,KAAK,KAAK,KAAK;AACxB,QAAI;AACF,YAAM,WAAW,MAAM,UAAU,MAAM;AAAA,QACrC,KAAK,KAAK;AAAA,QACV,QAAQ,KAAK;AAAA,QACb,SAAS,KAAK;AAAA,QACd,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,QACvC,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,UAAI,CAAC,KAAK,IAAI,KAAK,GAAG,GAAG;AACvB,cAAM,SAAS,OAAO;AACtB;AAAA,MACF;AACA,WAAK,IAAI,KAAK,KAAK,EAAE,OAAO,MAAM,SAAS,KAAK,OAAO,aAAa,EAAE,GAAG,SAAS,CAAC;AACnF,WAAK,YAAY;AAAA,QACf,KAAK;AAAA,QACL,KAAK,KAAK;AAAA,QACV,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,SAAS,SAAS;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,GAAG;AACV,WAAK,KAAK,KAAK,CAAC;AAAA,IAClB;AAAA,EACF;AACA,QAAM,OAAO,OAAO,QAAgB;AAClC,UAAM,OAAO,KAAK,IAAI,GAAG,GAAG;AAC5B,QAAI,CAAC,KAAM;AACX,QAAI;AACF,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAI,KAAK,MAAM;AACb,aAAK,OAAO,GAAG;AACf,aAAK,YAAY,EAAE,KAAK,OAAO,IAAI,CAAC;AAAA,MACtC,OAAO;AACL,cAAM,QAAQ,KAAK,MAAM,MAAM;AAC/B,aAAK,YAAY,EAAE,KAAK,SAAS,KAAK,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC;AAAA,MAC/D;AAAA,IACF,SAAS,GAAG;AACV,WAAK,KAAK,CAAC;AAAA,IACb;AAAA,EACF;AACA,QAAM,OAAO,CAAC,QAAgB;AAC5B,UAAM,QAAQ,KAAK,IAAI,GAAG;AAC1B,SAAK,OAAO,GAAG;AACf,WAAO,MAAM,MAAM;AACnB,SAAK,OAAO,UAAU,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EACtD;AACA,SAAO;AAAA,IACL,OAAO,MAAM;AACX,UAAI,KAAK,QAAQ,QAAS,MAAK,MAAM,IAAI;AAAA,eAChC,KAAK,QAAQ,OAAQ,MAAK,KAAK,KAAK,GAAG;AAAA,UAC3C,MAAK,KAAK,GAAG;AAAA,IACpB;AAAA,IACA,QAAQ;AACN,iBAAW,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC,EAAG,MAAK,GAAG;AAAA,IAC9C;AAAA,EACF;AACF;;;AC1JA,IAAM,OAAO;AACb,IAAM,mBAAmB;AACzB,IAAM,WAAW,OAAO;AACxB,IAAMC,oBAAmB,KAAK,OAAO;AAQrC,IAAM,UAAU,CAAC,SAAiB,SAAS,QACzC,OAAO,OAAO,IAAI,MAAM,gBAAgB,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;AAEhE,SAAS,WAAW,KAAa,QAAgB,SAA6B;AAC5E,SAAO,KAAK,UAAU,EAAE,KAAK,QAAQ,QAAQ,CAAC,EAAE;AAAA,IAC9C;AAAA,IACA,CAAC,MAAM,MAAM,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC;AAAA,EAC5D;AACF;AAEA,SAAS,WAAW,SAA4B,OAAwC;AACtF,SAAO,IAAI,QAAQ,EAAE,kBAAkB,QAAQ,KAAK,GAAG,MAAM,CAAC;AAChE;AAEA,SAAS,KAAK,SAA4B;AACxC,SAAO,QAAQ,SAAS,WAAW,MAAM,KAAK,UAAU;AAC1D;AAEA,eAAe,QAAQ,UAAoC;AACzD,QAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,MAAI,UAAU,QAAQ,SAAS,cAAc,YAAY,SAAS,MAAM;AACxE,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,QAAI,OAAO,OAAO,UAAU,SAAU,WAAU,OAAO;AAAA,EACzD,QAAQ;AAAA,EAAC;AACT,SAAO,QAAQ,SAAS,SAAS,KAAK,MAAM,SAAS,MAAM;AAC7D;AAEA,SAAS,OAAO,OAAuC;AACrD,QAAM,OAAO;AACb,SACE,CAAC,CAAC,QACF,OAAO,KAAK,WAAW,YACvB,OAAO,KAAK,eAAe,YAC3B,MAAM,QAAQ,KAAK,OAAO,KAC1B,KAAK,QAAQ;AAAA,IACX,CAAC,SACC,MAAM,QAAQ,IAAI,KAClB,KAAK,WAAW,KAChB,OAAO,KAAK,CAAC,MAAM,YACnB,OAAO,KAAK,CAAC,MAAM;AAAA,EACvB;AAEJ;AAEA,SAAS,OAAO,GAAe,GAA2B;AACxD,QAAM,MAAM,IAAI,WAAW,EAAE,aAAa,EAAE,UAAU;AACtD,MAAI,IAAI,CAAC;AACT,MAAI,IAAI,GAAG,EAAE,UAAU;AACvB,SAAO;AACT;AAEA,eAAe,SACb,QACmD;AACnD,MAAI,SAAqB,IAAI,WAAW,CAAC;AACzC,aAAS;AACP,QAAI,OAAO,cAAc,GAAG;AAC1B,YAAM,SAAS,IAAI,SAAS,OAAO,QAAQ,OAAO,YAAY,CAAC,EAAE,UAAU,CAAC;AAC5E,UAAI,SAAS,SAAU,OAAM,QAAQ,oBAAoB,MAAM,QAAQ;AACvE,UAAI,OAAO,cAAc,IAAI,QAAQ;AACnC,YAAI;AACJ,YAAI;AACF,iBAAO,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,OAAO,SAAS,GAAG,IAAI,MAAM,CAAC,CAAC;AAAA,QAC5E,QAAQ;AAAA,QAAC;AACT,YAAI,CAAC,OAAO,IAAI,EAAG,OAAM,QAAQ,yBAAyB;AAC1D,eAAO,EAAE,MAAM,MAAM,OAAO,SAAS,IAAI,MAAM,EAAE;AAAA,MACnD;AAAA,IACF;AACA,UAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,QAAI,KAAK,KAAM,OAAM,QAAQ,iCAAiC;AAC9D,aAAS,OAAO,QAAQ,KAAK,KAAK;AAAA,EACpC;AACF;AAEA,gBAAgBC,QACd,MACA,QAC4B;AAC5B,MAAI;AACF,QAAI,KAAK,aAAa,EAAG,OAAM;AAC/B,aAAS,OAAO,MAAM,OAAO,KAAK,GAAG,CAAC,KAAK,MAAM,OAAO,MAAM,OAAO,KAAK,GAAG;AAC3E,UAAI,KAAK,MAAM,aAAa,EAAG,OAAM,KAAK;AAAA,IAC5C;AAAA,EACF,UAAE;AACA,UAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EAC7C;AACF;AAEA,eAAsB,gBAAgB,SAA6D;AACjG,MAAI;AACF,UAAM,WAAW,MAAM,KAAK,OAAO,EAAE,IAAI,IAAI,MAAM,QAAQ,GAAG,GAAG;AAAA,MAC/D,QAAQ;AAAA,MACR,SAAS,WAAW,SAAS,EAAE,qBAAqB,IAAI,CAAC;AAAA,MACzD,aAAa;AAAA,MACb,MAAM;AAAA,IACR,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,QAAO;AACzB,UAAM,QAAS,MAAM,SAAS,KAAK;AACnC,QAAI,OAAO,MAAM,aAAa,YAAY,MAAM,WAAW,EAAG,QAAO;AACrE,QAAI,OAAO,MAAM,yBAAyB,UAAW,QAAO;AAC5D,QAAI,OAAO,MAAM,wBAAwB,SAAU,QAAO;AAC1D,WAAO;AAAA,MACL,UAAU,MAAM;AAAA,MAChB,sBAAsB,MAAM;AAAA,MAC5B,qBAAqB,MAAM;AAAA,IAC7B;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,oBAAoB,SAAqD;AACvF,QAAM,WAAW,IAAI,IAAI,MAAM,QAAQ,GAAG;AAC1C,SAAO;AAAA,IACL,QAAQ;AAAA,MACN,iBAAiB;AAAA,MACjB,eAAe;AAAA,MACf,gBAAgB,QAAQ,kBAAkBD;AAAA,IAC5C;AAAA,IACA,MAAM,MAAM,SAAiE;AAC3E,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,KAAK,OAAO,EAAE,UAAU;AAAA,UACvC,QAAQ;AAAA,UACR,SAAS,WAAW,SAAS;AAAA,YAC3B,uBAAuB,WAAW,QAAQ,KAAK,QAAQ,QAAQ,QAAQ,OAAO;AAAA,UAChF,CAAC;AAAA,UACD,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAiB,IAAI,CAAC;AAAA,UACzD,QAAQ,QAAQ;AAAA,UAChB,aAAa;AAAA,UACb,MAAM;AAAA,QACR,CAAC;AAAA,MACH,SAAS,GAAG;AACV,YAAI,QAAQ,OAAO,QAAS,OAAM;AAClC,cAAM,QAAQ,GAAG,SAAS,MAAM,wCAAwC;AAAA,MAC1E;AACA,YAAM,OAAO,SAAS,QAAQ,IAAI,cAAc,KAAK;AACrD,UAAI,SAAS,WAAW,OAAO,CAAC,KAAK,WAAW,gBAAgB,KAAK,CAAC,SAAS,MAAM;AACnF,cAAM,MAAM,QAAQ,QAAQ;AAAA,MAC9B;AACA,YAAM,SAAS,SAAS,KAAK,UAAU;AACvC,UAAI;AACJ,UAAI;AACF,iBAAS,MAAM,SAAS,MAAM;AAAA,MAChC,SAAS,GAAG;AACV,cAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,cAAM;AAAA,MACR;AACA,YAAM,OAAOC,QAAO,OAAO,MAAM,MAAM;AACvC,aAAO;AAAA,QACL,QAAQ,OAAO,KAAK;AAAA,QACpB,YAAY,OAAO,KAAK;AAAA,QACxB,SAAS,OAAO,KAAK;AAAA,QACrB;AAAA,QACA,QAAQ,YAAY;AAClB,gBAAM,KAAK,OAAO,MAAS;AAC3B,gBAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,QAC7C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;AC9FA,IAAM,YACJ;AAEF,SAAS,SAAS,UAAgD;AAChE,QAAM,UAAU,IAAI,YAAY;AAChC,SAAO,CAAC,UAAsB,WAAW,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC,CAAC;AAClF;AAEA,eAAsB,aAAa,UAAyB,CAAC,GAAoB;AAC/E,MAAI,CAAC,WAAW,oBAAqB,OAAM,IAAI,MAAM,SAAS;AAC9D,QAAM,MAAM,QAAQ,UAAU,IAAI,IAAI,sBAAsB,YAAY,GAAG;AAC3E,QAAM,SAAS,IAAI,OAAO,KAAK,EAAE,MAAM,UAAU,MAAM,eAAe,CAAC;AACvE,QAAM,UAAU,oBAAI,IAAqB;AACzC,MAAI,SAAS;AACb,MAAIC;AAEJ,QAAM,OAAO,CAAC,UAAiB;AAC7B,IAAAA,WAAU;AACV,YAAQ,MAAM;AACd,eAAWC,SAAQ,QAAQ,OAAO,EAAG,CAAAA,MAAK,OAAO,KAAK;AACtD,YAAQ,MAAM;AAAA,EAChB;AACA,QAAM,YAAY,QAAQ,SAAS;AACnC,QAAM,SAAS,YAAY,eAAe,QAAQ,SAAS,IAAI;AAC/D,SAAO,iBAAiB,WAAW,CAAC,EAAE,KAAK,MAA2C;AACpF,QAAI,SAAS,KAAM,QAAO,QAAQ,OAAO,IAAI;AAC7C,UAAMA,QAAO,QAAQ,IAAI,KAAK,EAAE;AAChC,QAAI,CAACA,MAAM;AACX,QAAI,KAAK,OAAO,OAAW,QAAOA,MAAK,SAAS,KAAK,IAAI,KAAK,KAAmB;AACjF,QAAI,KAAK,YAAY,OAAW,QAAOA,MAAK,UAAU,KAAK,OAAO;AAClE,YAAQ,OAAO,KAAK,EAAE;AACtB,QAAI,KAAK,UAAU,OAAW,CAAAA,MAAK,OAAO,IAAI,MAAM,KAAK,KAAK,CAAC;AAAA,QAC1D,CAAAA,MAAK,QAAQ,KAAK,MAAM;AAAA,EAC/B,CAAC;AACD,SAAO,iBAAiB,SAAS,CAAC,UAAU;AAC1C,UAAM,eAAe;AACrB,SAAK,IAAI,MAAM,+BAA+B,MAAM,OAAO,EAAE,CAAC;AAAA,EAChE,CAAC;AAED,WAAS,QACP,KACA,WAAqB,CAAC,GACkB;AACxC,UAAM,KAAK,EAAE;AACb,QAAID,SAAS,QAAO,EAAE,IAAI,MAAM,QAAQ,OAAOA,QAAO,EAAE;AACxD,UAAM,OAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC5C,cAAQ,IAAI,IAAI,EAAE,SAAS,QAAQ,GAAG,SAAS,CAAC;AAChD,aAAO,YAAY,EAAE,GAAG,KAAK,GAAG,CAAC;AAAA,IACnC,CAAC;AACD,WAAO,EAAE,IAAI,KAAK;AAAA,EACpB;AAEA,QAAM,OAAO,CAAC,KAAiB,aAAwB,QAAQ,KAAK,QAAQ,EAAE;AAE9E,iBAAe,aAAa,MAAgB,OAAwB,CAAC,GAAsB;AACzF,UAAM,EAAE,QAAQ,GAAGE,SAAQ,IAAI;AAC/B,QAAI,WAAW,UAAU;AACzB,UAAM,UAAwB,CAAC;AAC/B,UAAM,UAAU,QAAQ,cAAsB;AAC9C,UAAM,EAAE,IAAI,KAAK,IAAI;AAAA,MACnB,EAAE,IAAI,iBAAiB,MAAM,SAAAA,SAAQ;AAAA,MACrC;AAAA,QACE,QAAQ,CAAC,KAAK,UAAW,WAAW,SAAS,KAAK,IAAI,QAAQ,KAAK,KAAK;AAAA,QACxE,SAAS,QAAQ;AAAA,MACnB;AAAA,IACF;AACA,SAAK,MAAM,QAAQ,MAAM;AACzB,UAAM,MAAM,MAAM,QAAQ;AAC1B,UAAMC,QAAO,CAAC,WACZ,KAAK,KAAK,EAAE,IAAI,YAAY,UAAU,IAAI,GAAG,OAAO,CAAC,EAAE,MAAM,MAAM,MAAS;AAC9E,WAAO;AAAA,MACL;AAAA,MACA,QAAQ;AAAA,MACR,IAAI,SAAS;AACX,eAAO;AAAA,MACT;AAAA,MACA,IAAI,OAAO,MAAM;AACf,mBAAW;AACX,YAAI,KAAM,YAAW,SAAS,QAAQ,OAAO,CAAC,EAAG,MAAK,KAAK;AAAA,MAC7D;AAAA,MACA,OAAO,CAAC,SACNA,MAAK;AAAA,QACH,QAAQ;AAAA,QACR,OAAO,OAAO,SAAS,WAAW,IAAI,YAAY,EAAE,OAAO,IAAI,IAAI;AAAA,MACrE,CAAC;AAAA,MACH,QAAQ,CAAC,MAAM,SAASA,MAAK,EAAE,QAAQ,UAAU,MAAM,KAAK,CAAC;AAAA,MAC7D,QAAQ,CAAC,SAASA,MAAK,EAAE,QAAQ,UAAU,QAAQ,KAAK,CAAC;AAAA,MACzD,OAAO,MAAMA,MAAK,EAAE,QAAQ,QAAQ,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,QAAM,KAAK;AAAA,IACT,IAAI;AAAA,IACJ,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC7C,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,IACtD,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,IAC1C,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,IACvE,GAAI,YAAY,EAAE,WAAW,UAAU,OAAO,IAAI,CAAC;AAAA,EACrD,CAAC;AAED,SAAO;AAAA,IACL,MAAM,IAAI,MAAM,aAAa,CAAC,GAAG;AAC/B,YAAM,EAAE,UAAU,UAAU,OAAO,GAAG,KAAK,IAAI;AAC/C,YAAM,UAAU,EAAE,GAAG,SAAS,QAAQ,GAAG,GAAG,SAAS,QAAQ,EAAE;AAC/D,YAAM,QAAQ,OAAO,UAAU,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,IAAI;AAC5E,YAAM,SAAU,MAAM;AAAA,QACpB,EAAE,IAAI,OAAO,MAAM,SAAS,EAAE,GAAG,MAAM,GAAI,QAAQ,EAAE,OAAO,MAAM,IAAI,CAAC,EAAG,EAAE;AAAA,QAC5E,EAAE,QAAQ,CAAC,IAAI,UAAU,QAAQ,EAAE,EAAE,KAAK,EAAE;AAAA,MAC9C;AACA,YAAM,UAAU,IAAI,YAAY;AAChC,aAAO;AAAA,QACL,QAAQ,OAAO;AAAA,QACf,QAAQ,QAAQ,OAAO,OAAO,MAAM;AAAA,QACpC,QAAQ,QAAQ,OAAO,OAAO,MAAM;AAAA,MACtC;AAAA,IACF;AAAA,IACA;AAAA,IACA,YAAY;AACV,WAAK,IAAI,MAAM,yBAAyB,CAAC;AACzC,aAAO,UAAU;AAAA,IACnB;AAAA,EACF;AACF;",
   "names": ["send", "MAX_REQUEST_BODY", "chunks", "failure", "call", "options", "send"]
 }

package/dist/kernel-worker.js

@@ -177,6 +177,22 @@ function openMeta(name2, factory) {
   });
 }
 
+// src/pin.ts
+function pinScript(url) {
+  try {
+    const request2 = new XMLHttpRequest();
+    request2.open("GET", url.href, false);
+    request2.send();
+    if (request2.status !== 200) return url.href;
+    const source = `${request2.responseText}
+//# sourceURL=${url.href}
+`;
+    return URL.createObjectURL(new Blob([source], { type: "text/javascript" }));
+  } catch {
+    return url.href;
+  }
+}
+
 // src/fs/types.ts
 function fsError(code, path) {
   return Object.assign(new Error(`${code}: ${path}`), { code });
@@ -2299,7 +2315,7 @@ function networkEnv() {
 }
 function missingTransport() {
   return {
-    traits: { manualRedirects: true, encodedBodies: true, maxRequestBody: 0 },
+    traits: { manualRedirects: true, encodedBodies: true, maxRequestBody: 0, unavailable: true },
     fetch: () => Promise.reject(Object.assign(new Error(NO_TRANSPORT), { status: 502 }))
   };
 }
@@ -3365,7 +3381,7 @@ async function hostSyscall(req, ctx) {
 }
 
 // src/kernel/net/http-syscalls.ts
-var HTTP_OPS = ["net-request", "net-read", "net-close"];
+var HTTP_OPS = ["net-request", "net-read", "net-close", "net-traits"];
 var EMPTY = new Uint8Array(0);
 function message(e) {
   return e instanceof Error ? e.message : String(e);
@@ -3383,8 +3399,14 @@ var HttpHandles = class {
   syscall(req) {
     if (req.op === "net-request") return this.request(req);
     if (req.op === "net-read") return this.read(req.handle, req.max);
+    if (req.op === "net-traits") return Promise.resolve(this.traits());
     return this.close(req.handle);
   }
+  traits() {
+    const { unavailable, crossOrigin = "any", ...rest } = this.transport.traits;
+    if (unavailable) return { ok: false, errno: "ENETUNREACH", message: NO_TRANSPORT };
+    return { ok: true, kind: "json", json: { ...rest, crossOrigin } };
+  }
   add(abort, body, cancel) {
     const handle = ++this.nextHandle;
     this.open.set(handle, {
@@ -5188,7 +5210,7 @@ var WASM_PROCESS_ERROR = "wasm-process-error";
 var WASM_THREAD_SPAWN = "wasm-thread-spawn";
 var WASM_THREAD_INIT = "wasm-thread-init";
 var WASM_THREAD_EXIT = "wasm-thread-exit";
-var WASM_MAX_THREADS = 64;
+var WASM_MAX_THREADS = 256;
 
 // src/kernel/host.ts
 var CRASHED = 70;
@@ -5972,7 +5994,7 @@ function serveKernel(port, deps) {
 }
 
 // src/kernel-worker.ts
-var processWorker = new URL("./process-worker.js", import.meta.url);
+var processWorker = pinScript(new URL("./process-worker.js", import.meta.url));
 serveKernel(globalThis, {
   storage: () => navigator.storage.getDirectory(),
   createWorker: () => new Worker(processWorker, { type: "module" }),