@ai-ecoverse/slicc-kernel 1.103.3 → 1.106.2

package/dist/process-worker.js

@@ -2491,7 +2491,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.103.3" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.106.2" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -4207,7 +4207,7 @@ function orphanContents(stream) {
   if (live.ranged) return live.ranged.read(0, live.ranged.size());
   return live.data?.slice(0, live.len ?? live.data.length) ?? new Uint8Array(0);
 }
-function vfsPromoter(Fs, sys, streams, livePath) {
+function vfsPromoter(Fs, sys, streams2, livePath) {
   const promoted = /* @__PURE__ */ new Map();
   return (stream) => {
     if (stream.sliccKernelFd !== void 0 || !isVfsFile(Fs, stream)) return;
@@ -4227,11 +4227,11 @@ function vfsPromoter(Fs, sys, streams, livePath) {
       );
       promoted.set(stream.shared, kfd);
     }
-    streams.attachFile(stream, kfd);
+    streams2.attachFile(stream, kfd);
   };
 }
-function describeForFork(Fs, sys, streams, livePath) {
-  const promote = vfsPromoter(Fs, sys, streams, livePath);
+function describeForFork(Fs, sys, streams2, livePath) {
+  const promote = vfsPromoter(Fs, sys, streams2, livePath);
   const out = [];
   for (const stream of Fs.streams) {
     if (!stream) continue;
@@ -4255,7 +4255,7 @@ function kernelEntry(stream, kernel) {
   const access = kind === "tty" ? O_RDWR : (stream.flags ?? O_RDWR) & O_ACCMODE4;
   return { fd: stream.fd, kernel, kind, flags: access, ...cloexec };
 }
-function describeInherited(Fs, sys, streams, livePath, actions = []) {
+function describeInherited(Fs, sys, streams2, livePath, actions = []) {
   const table = /* @__PURE__ */ new Map();
   for (const stream of Fs.streams) {
     if (stream) table.set(stream.fd, { stream, cloexec: closesOnExec(stream) });
@@ -4270,7 +4270,7 @@ function describeInherited(Fs, sys, streams, livePath, actions = []) {
   for (const [fd, { stream, cloexec }] of table) {
     if (fd > 2 && !cloexec) slots3.set(fd, stream);
   }
-  const promote = vfsPromoter(Fs, sys, streams, livePath);
+  const promote = vfsPromoter(Fs, sys, streams2, livePath);
   const out = [];
   for (const [fd, stream] of slots3) {
     promote(stream);
@@ -4299,50 +4299,50 @@ function place(Fs, stream, fd) {
   Fs.closeStream(stream.fd);
   return moved;
 }
-function placeholder(Fs, streams, entry) {
+function placeholder(Fs, streams2, entry) {
   const access = entry.flags ?? O_RDWR;
-  if (entry.kind === "socket") return streams.socketStream(access);
+  if (entry.kind === "socket") return streams2.socketStream(access);
   if (entry.kind === "tty") return Fs.open("/dev/tty", O_RDWR);
   if (entry.kind === "stream" || entry.kind === "clipboard" || entry.kind === "sealed")
     return Fs.open("/dev/null", access);
   Fs.mkdirTree(PLACEHOLDER_DIR);
   return Fs.open(`${PLACEHOLDER_DIR}/${entry.fd}`, access | O_CREAT3);
 }
-function asFifo(stream, streams, identity) {
-  const inos = streamInos.get(streams) ?? /* @__PURE__ */ new Map();
-  streamInos.set(streams, inos);
+function asFifo(stream, streams2, identity) {
+  const inos = streamInos.get(streams2) ?? /* @__PURE__ */ new Map();
+  streamInos.set(streams2, inos);
   const fixed = inos.get(identity) ?? nextStreamIno++;
   inos.set(identity, fixed);
   const node = stream.node;
-  streams.describe(stream, `pipe:[${fixed}]`, () => ({
+  streams2.describe(stream, `pipe:[${fixed}]`, () => ({
     ...node.node_ops?.getattr?.(node),
     mode: FIFO_MODE,
     ino: fixed,
     size: 0
   }));
 }
-function placeKernelStream(Fs, streams, entry) {
-  const stream = place(Fs, placeholder(Fs, streams, entry), entry.fd);
+function placeKernelStream(Fs, streams2, entry) {
+  const stream = place(Fs, placeholder(Fs, streams2, entry), entry.fd);
   if (entry.kind === "file") {
-    streams.attachFile(stream, entry.kernel);
-    streams.sizeFromKernel(stream, entry.kernel);
-  } else if (entry.kind === "socket") streams.attachSocket(stream, entry.kernel);
-  else streams.attach(stream, entry.kernel, entry.kind === "tty");
-  if (entry.kind === "clipboard") streams.reportClose(entry.kernel);
-  if (entry.kind === "sealed" || entry.kind === "clipboard") streams.nameDevice(stream, entry.kind);
-  if (entry.kind === "tty") streams.nameTerminal(stream);
+    streams2.attachFile(stream, entry.kernel);
+    streams2.sizeFromKernel(stream, entry.kernel);
+  } else if (entry.kind === "socket") streams2.attachSocket(stream, entry.kernel);
+  else streams2.attach(stream, entry.kernel, entry.kind === "tty");
+  if (entry.kind === "clipboard") streams2.reportClose(entry.kernel);
+  if (entry.kind === "sealed" || entry.kind === "clipboard") streams2.nameDevice(stream, entry.kind);
+  if (entry.kind === "tty") streams2.nameTerminal(stream);
   if (entry.kind === "stream") {
-    asFifo(stream, streams, entry.desc !== void 0 ? `d${entry.desc}` : `k${entry.kernel}`);
+    asFifo(stream, streams2, entry.desc !== void 0 ? `d${entry.desc}` : `k${entry.kernel}`);
   }
   setCloseOnExec(stream, entry.cloexec === true);
   return stream;
 }
-function restoreForkedStreams(Fs, streams, table) {
+function restoreForkedStreams(Fs, streams2, table) {
   for (const stream of Fs.streams) if (stream) Fs.closeStream(stream.fd);
   for (const entry of table) {
     try {
       if ("kernel" in entry) {
-        placeKernelStream(Fs, streams, entry);
+        placeKernelStream(Fs, streams2, entry);
       } else {
         const placed = place(
           Fs,
@@ -4410,14 +4410,14 @@ function forkRestarted(deps, state, snapshotAt) {
   let memory = state.memory;
   let seen = snapshotAt;
   return restarted(() => {
-    const streams = deps.describeFork();
+    const streams2 = deps.describeFork();
     const now = deps.deliveries?.();
     if (now !== seen) {
       seen = now;
       const live = deps.memory?.();
       if (live) memory = new Uint8Array(live.buffer).slice();
     }
-    const forked = { ...state, memory, streams, cwd: deps.Fs.cwd() };
+    const forked = { ...state, memory, streams: streams2, cwd: deps.Fs.cwd() };
     return deps.transport.call(
       { op: "proc-fork", state: forked, restart: true },
       Infinity,
@@ -4729,6 +4729,8 @@ var init_process_signals = __esm({
       unwinding = false;
       quieted = 0;
       delivered = 0;
+      raised = 0;
+      entering = 0;
       raw;
       header;
       hooks;
@@ -4791,9 +4793,18 @@ var init_process_signals = __esm({
         const header = this.header;
         const pending = Atomics.load(header, SAB_I_SIGNALS) & ~Atomics.load(header, SAB_I_BLOCKED) | Atomics.load(header, SAB_I_TIMERS) | Atomics.load(header, SAB_I_KILLED);
         if (pending === 0) return false;
-        this.deliver();
+        if (this.entering === 0) this.raised = this.quieted > 0 ? -1 : 0;
+        this.entering++;
+        try {
+          this.deliver();
+        } finally {
+          this.entering--;
+        }
         return true;
       }
+      raisedOnEntry() {
+        return this.raised;
+      }
       deliver() {
         if (this.quieted > 0) return;
         const killed = Atomics.load(this.header, SAB_I_KILLED);
@@ -4806,6 +4817,7 @@ var init_process_signals = __esm({
         const pending = blocked === 0 ? Atomics.exchange(this.header, SAB_I_SIGNALS, 0) : Atomics.and(this.header, SAB_I_SIGNALS, blocked) & ~blocked;
         if (this.depth <= 1) this.lastDelivered = pending | (timers & 1 ? sigbit(SIG.ALRM) : 0);
         if (pending !== 0 || timers !== 0) this.delivered++;
+        this.raised |= pending | (timers & 1 ? sigbit(SIG.ALRM) : 0) | (timers & ~1 ? -1 : 0);
         for (let which = 0; which < 3; which++) {
           if (timers & 1 << which) this.hooks.timer?.(which);
         }
@@ -4828,7 +4840,7 @@ function resolved(Fs, addr) {
   return { family: "unix", path: normalizePath(path) };
 }
 function createSocketKernel(deps) {
-  const { transport, Fs, sys, streams } = deps;
+  const { transport, Fs, sys, streams: streams2 } = deps;
   const call2 = (req) => {
     const r = transport.call(req, Number.POSITIVE_INFINITY, req.op);
     if (!r.ok) throw new SyscallError(r.errno);
@@ -4864,12 +4876,12 @@ function createSocketKernel(deps) {
   const install = (k, nonblock, cloexec = false) => {
     let stream;
     try {
-      stream = streams.socketStream(O_RDWR2 | (nonblock ? O_NONBLOCK : 0));
+      stream = streams2.socketStream(O_RDWR2 | (nonblock ? O_NONBLOCK : 0));
     } catch (e) {
       sys.close(k);
       throw e;
     }
-    streams.attachSocket(stream, k);
+    streams2.attachSocket(stream, k);
     setCloseOnExec(stream, cloexec);
     return stream.fd;
   };
@@ -5562,9 +5574,9 @@ function kernelSys(transport) {
     }
   };
 }
-function wireKernelFd(Fs, streams, entry) {
+function wireKernelFd(Fs, streams2, entry) {
   if (entry.device && openDevice(Fs, entry.fd, entry.device)) return;
-  placeKernelStream(Fs, streams, {
+  placeKernelStream(Fs, streams2, {
     ...entry,
     kind: entry.device ? "stream" : entry.kind,
     kernel: entry.fd
@@ -5589,7 +5601,7 @@ function openAt(Fs, fd, path, flags) {
   }
   return true;
 }
-function wireKernelStdio(Fs, streams, sys) {
+function wireKernelStdio(Fs, streams2, sys) {
   for (const fd of [0, 1, 2]) {
     const stream = Fs.getStream(fd);
     if (!stream) continue;
@@ -5600,11 +5612,11 @@ function wireKernelStdio(Fs, streams, sys) {
       const flags = sys?.access ? stream.flags & ~O_ACCMODE5 | accessMode(sys.access(fd)) : stream.flags;
       Fs.closeStream(fd);
       const kernel = { fd, kernel: fd, kind, flags };
-      placeKernelStream(Fs, streams, kernel).flags = flags;
+      placeKernelStream(Fs, streams2, kernel).flags = flags;
       continue;
     }
-    streams.attach(stream, fd);
-    streams.nameTerminal(stream);
+    streams2.attach(stream, fd);
+    streams2.nameTerminal(stream);
   }
 }
 function glueBody(glue) {
@@ -5703,6 +5715,11 @@ function credSyncTransport(gated, early, cred) {
     }
   };
 }
+function sigpipeSpared(transport) {
+  const req = { op: "proc-kill-self", sig: SIG.PIPE, probe: true };
+  const r = transport.call(req, Number.POSITIVE_INFINITY, "proc-kill-self");
+  return r.ok && !(r.kind === "json" && r.json === "terminate");
+}
 async function runWasmProcess(init, port2, deps = {}) {
   const signals = new SignalGate(
     createSyncSabTransport(init.sab, port2, {
@@ -5810,10 +5827,10 @@ async function runWasmProcess(init, port2, deps = {}) {
   });
   early = () => signals.quiet(() => vfs.flushDirty());
   closeDropsLocks(running.FS, sys);
-  const sigpipe = () => running.sliccSigpipe?.() === 1;
+  const sigpipe = () => running.sliccSigpipe?.() === 1 || sigpipeSpared(gated);
   const restartable = () => signals.restartable();
   const owners = init.owners ? { owners: true } : {};
-  const streams = new KernelStreams(running.FS, sys, {
+  const streams2 = new KernelStreams(running.FS, sys, {
     sigpipe,
     restartable,
     ...owners,
@@ -5821,21 +5838,21 @@ async function runWasmProcess(init, port2, deps = {}) {
   });
   trackCloseOnExec(running.FS);
   quietQuit(running.FS, (on) => {
-    streams.quitting = on;
+    streams2.quitting = on;
   });
-  atExit = () => streams.exiting();
+  atExit = () => streams2.exiting();
   useMounts(running.FS, init.env, true);
   useZeroDevices(running.FS);
   useProcfs(running.FS, sys, init.pid);
-  if (init.fork) restoreForkedStreams(running.FS, streams, init.fork.streams ?? []);
+  if (init.fork) restoreForkedStreams(running.FS, streams2, init.fork.streams ?? []);
   else {
-    wireKernelStdio(running.FS, streams, sys);
-    for (const entry of init.fds ?? []) wireKernelFd(running.FS, streams, entry);
+    wireKernelStdio(running.FS, streams2, sys);
+    for (const entry of init.fds ?? []) wireKernelFd(running.FS, streams2, entry);
   }
   const pipefs = ownValue(running, "PIPEFS");
-  if (pipefs) streams.usePipes(pipefs);
-  streams.useControllingTerminal();
-  streams.useKernelFdMetadata();
+  if (pipefs) streams2.usePipes(pipefs);
+  streams2.useControllingTerminal();
+  streams2.useKernelFdMetadata();
   useDevFd(running.FS);
   useDevRemoval(running.FS);
   useFileMmap(running.FS, {
@@ -5855,9 +5872,9 @@ async function runWasmProcess(init, port2, deps = {}) {
     restartable,
     memory: () => memory,
     deliveries: () => signals.deliveries(),
-    describeFork: () => describeForFork(running.FS, sys, streams, livePath),
-    inherit: (actions) => describeInherited(running.FS, sys, streams, livePath, actions),
-    stdioPromoter: () => vfsPromoter(running.FS, sys, streams, livePath),
+    describeFork: () => describeForFork(running.FS, sys, streams2, livePath),
+    inherit: (actions) => describeInherited(running.FS, sys, streams2, livePath, actions),
+    stdioPromoter: () => vfsPromoter(running.FS, sys, streams2, livePath),
     ...callerOwner(running.FS, init)
   });
   running.sliccKernel.http = createHttpKernel(transport);
@@ -5866,15 +5883,15 @@ async function runWasmProcess(init, port2, deps = {}) {
     transport,
     Fs: running.FS,
     sys,
-    streams,
+    streams: streams2,
     sigpipe,
     restartable
   });
-  return runWithFlush(running, init, streams, vfs);
+  return runWithFlush(running, init, streams2, vfs);
 }
-function runWithFlush(running, init, streams, vfs) {
+function runWithFlush(running, init, streams2, vfs) {
   try {
-    return streams.exitStatus(runMain(running, init));
+    return streams2.exitStatus(runMain(running, init));
   } finally {
     try {
       vfs.flush();
@@ -6419,7 +6436,7 @@ function pinnedIo2(bridge, handle, rewriting) {
     } : {}
   };
 }
-var WasiError, FileBuffer, LocalFile, MAX_LINKS, MISS_TTL_MS, FS_GEN, RING2, RING_SIZE2, SLOT2, SHARED_IDS_BYTES, StatCache;
+var WasiError, FileBuffer, LocalFile, MAX_LINKS, MISS_TTL_MS, FS_GEN, CRED_GEN, RING2, RING_SIZE2, SLOT2, SHARED_IDS_BYTES, StatCache;
 var init_wasi_files = __esm({
   "src/process/wasi/wasi-files.ts"() {
     "use strict";
@@ -6641,6 +6658,7 @@ var init_wasi_files = __esm({
     MAX_LINKS = 40;
     MISS_TTL_MS = 20;
     FS_GEN = 4;
+    CRED_GEN = 5;
     RING2 = 8;
     RING_SIZE2 = 64;
     SLOT2 = 3;
@@ -6861,6 +6879,48 @@ var init_slicc_sem = __esm({
   }
 });
 
+// src/process/wasi/wasi-cred.ts
+var CredCache;
+var init_wasi_cred = __esm({
+  "src/process/wasi/wasi-cred.ts"() {
+    "use strict";
+    init_wasi_files();
+    CredCache = class {
+      cred;
+      stamp = 0;
+      fetch;
+      shared;
+      constructor(fetch, shared) {
+        this.fetch = fetch;
+        this.shared = shared;
+      }
+      gen() {
+        return this.shared ? Atomics.load(this.shared, CRED_GEN) : 0;
+      }
+      get() {
+        const gen = this.gen();
+        if (this.cred === void 0 || this.stamp !== gen) {
+          this.cred = this.fetch();
+          this.stamp = gen;
+        }
+        return this.cred;
+      }
+      change(apply2) {
+        const seen = this.gen();
+        const cred = apply2();
+        if (!this.shared) {
+          this.cred = cred;
+          return cred;
+        }
+        const was = Atomics.add(this.shared, CRED_GEN, 1);
+        this.cred = was === seen ? cred : void 0;
+        this.stamp = was + 1;
+        return cred;
+      }
+    };
+  }
+});
+
 // src/kernel/pipe.ts
 var PIPE_CAPACITY;
 var init_pipe = __esm({
@@ -7949,6 +8009,92 @@ var init_wasi_termios = __esm({
   }
 });
 
+// src/process/wasi/wasix-epoll.ts
+function timeoutMs(ns) {
+  const value2 = BigInt.asUintN(64, ns);
+  if (value2 === FOREVER) return -1;
+  const ms = (value2 + NS_PER_MS2 - 1n) / NS_PER_MS2;
+  return ms > BigInt(MAX_TIMEOUT_MS) ? -1 : Number(ms);
+}
+function wasixEpollImports(host) {
+  const { mem, fds, o } = host;
+  const call2 = (req) => o.kernel.call(req);
+  const kernelFd = (fd, refusal2) => {
+    const e = fds.find(fd);
+    if (!e) throw new WasiError("EBADF");
+    if (e.type !== "kernel") throw new WasiError(refusal2);
+  };
+  const writeEvents2 = (ptr, events) => {
+    const view = mem.view();
+    events.forEach((ev, i) => {
+      const at = ptr + i * EVENT_SIZE;
+      mem.bytes(at, EVENT_SIZE).fill(0);
+      view.setUint32(at, ev.events, true);
+      mem.bytes(at + DATA_OFFSET, DATA_SIZE).set(ev.data);
+    });
+  };
+  return {
+    epoll_create: (out) => {
+      const fd = call2({ op: "epoll-create" });
+      fds.adopt(fd, "stream", false);
+      mem.view().setUint32(out, fd, true);
+    },
+    epoll_ctl: (epfd, op, fd, event) => {
+      const how = (host.strictEpoll ? WASIX_OPS : DUAL_OPS)[op];
+      if (!how) throw new WasiError("EINVAL");
+      kernelFd(epfd, "EINVAL");
+      kernelFd(fd, "EPERM");
+      if (how !== "del" && event === 0) throw new WasiError("EINVAL");
+      const events = event === 0 ? 0 : mem.view().getUint32(event, true);
+      const data = event === 0 ? [] : [...mem.bytes(event + DATA_OFFSET, DATA_SIZE)];
+      call2({ op: "epoll-ctl", epfd, how, fd, events, data });
+    },
+    epoll_wait: (epfd, ptr, maxevents, timeout, out) => {
+      mem.view().setUint32(out, 0, true);
+      if ((maxevents | 0) <= 0) throw new WasiError("EINVAL");
+      kernelFd(epfd, "EINVAL");
+      const max = Math.min(maxevents | 0, MAX_EVENTS);
+      const ms = host.entered ? 0 : timeoutMs(timeout);
+      const events = call2({ op: "epoll-wait", epfd, max, timeoutMs: ms });
+      if (host.entered && events.length === 0 && timeoutMs(timeout) !== 0) return E.INTR;
+      writeEvents2(ptr, events);
+      mem.view().setUint32(out, events.length, true);
+      return E.SUCCESS;
+    },
+    fd_event: (initial, flags, out) => {
+      const value2 = BigInt.asUintN(64, initial);
+      if (value2 > EVENTFD_MAX) throw new WasiError("EINVAL");
+      const fd = call2({
+        op: "eventfd-open",
+        initial: value2.toString(),
+        semaphore: (flags & EVENTFD_SEMAPHORE) !== 0
+      });
+      fds.adopt(fd, "stream", (flags & EVENTFD_NONBLOCK) !== 0);
+      mem.view().setUint32(out, fd, true);
+    }
+  };
+}
+var EVENT_SIZE, DATA_OFFSET, DATA_SIZE, MAX_EVENTS, FOREVER, MAX_TIMEOUT_MS, NS_PER_MS2, EVENTFD_SEMAPHORE, EVENTFD_NONBLOCK, EVENTFD_MAX, WASIX_OPS, DUAL_OPS;
+var init_wasix_epoll = __esm({
+  "src/process/wasi/wasix-epoll.ts"() {
+    "use strict";
+    init_wasi_abi();
+    init_wasi_files();
+    EVENT_SIZE = 32;
+    DATA_OFFSET = 8;
+    DATA_SIZE = 24;
+    MAX_EVENTS = 4096;
+    FOREVER = 0xffffffffffffffffn;
+    MAX_TIMEOUT_MS = 2147483647;
+    NS_PER_MS2 = 1000000n;
+    EVENTFD_SEMAPHORE = 1;
+    EVENTFD_NONBLOCK = 4;
+    EVENTFD_MAX = 0xfffffffffffffffen;
+    WASIX_OPS = ["add", "mod", "del"];
+    DUAL_OPS = ["add", "set", "del", "mod"];
+  }
+});
+
 // src/kernel/net/datagram-wire.ts
 function decodeReceived(raw) {
   const view = new DataView(raw.buffer, raw.byteOffset, raw.byteLength);
@@ -8335,7 +8481,7 @@ function filestatOf(path, s) {
     size: BigInt(s.size),
     ino: s.ino !== void 0 ? BigInt(s.ino) : pathInode(path),
     ...s.nlink !== void 0 ? { nlink: BigInt(s.nlink) } : {},
-    mtimeNs: BigInt(Math.round(s.mtimeMs ?? 0)) * NS_PER_MS2
+    mtimeNs: BigInt(Math.round(s.mtimeMs ?? 0)) * NS_PER_MS3
   };
 }
 function kernelFiletype(kind) {
@@ -8385,7 +8531,7 @@ function wrap(table) {
   }
   return out;
 }
-var WasiExit, IDS, NS_PER_MS2, AT_SYMLINK_NOFOLLOW2, AT_EACCESS2, ROOT_IDS, GONE, S_IFIFO, DEFAULT_UMASK, MONOTONIC_BASE, MAX_READ, SIGPIPE_EXIT, SIG_IGN, SEALED_MODE, WasiHost;
+var WasiExit, IDS, NS_PER_MS3, AT_SYMLINK_NOFOLLOW2, AT_EACCESS2, ROOT_IDS, GONE, S_IFIFO, DEFAULT_UMASK, MONOTONIC_BASE, MAX_READ, SIGPIPE_EXIT, SIG_IGN, SEALED_MODE, WasiHost;
 var init_wasi_host = __esm({
   "src/process/wasi/wasi-host.ts"() {
     "use strict";
@@ -8393,14 +8539,17 @@ var init_wasi_host = __esm({
     init_physical_path();
     init_cpu_clock();
     init_cred();
+    init_signals();
     init_slicc_lock();
     init_slicc_sem();
     init_wasi_abi();
+    init_wasi_cred();
     init_wasi_fds();
     init_wasi_files();
     init_wasi_memory();
     init_wasi_poll();
     init_wasi_termios();
+    init_wasix_epoll();
     init_wasix_sockets();
     WasiExit = class extends Error {
       code;
@@ -8410,26 +8559,30 @@ var init_wasi_host = __esm({
       }
     };
     IDS = ["ruid", "euid", "suid", "rgid", "egid", "sgid"];
-    NS_PER_MS2 = 1000000n;
+    NS_PER_MS3 = 1000000n;
     AT_SYMLINK_NOFOLLOW2 = 1;
     AT_EACCESS2 = 2;
     ROOT_IDS = Object.freeze({ uid: 0, gid: 0 });
     GONE = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
     S_IFIFO = 4096;
     DEFAULT_UMASK = 18;
-    MONOTONIC_BASE = BigInt(Math.round(performance.timeOrigin)) * NS_PER_MS2;
+    MONOTONIC_BASE = BigInt(Math.round(performance.timeOrigin)) * NS_PER_MS3;
     MAX_READ = 1024 * 1024;
-    SIGPIPE_EXIT = 141;
+    SIGPIPE_EXIT = 128 + SIG.PIPE;
     SIG_IGN = 1;
     SEALED_MODE = 8630;
     WasiHost = class {
       mem = new WasiMemory();
       fds;
+      creds;
       started = performance.now();
       cache;
       startCwd;
       interruptWakes = false;
+      strictEpoll = false;
       entered = false;
+      enteredSignals = 0;
+      raisedOnEntry;
       onRaise;
       muted;
       signals;
@@ -8460,6 +8613,10 @@ var init_wasi_host = __esm({
         this.o = { ...o, kernel: { sys, call: call2 } };
         this.startCwd = o.cwd;
         this.fds = new WasiFds(this.o.kernel, o.fs);
+        this.creds = new CredCache(
+          () => this.o.kernel.call({ op: "proc-cred" }),
+          o.credGen ?? o.shared
+        );
         if (o.shared) this.fds.share(o.shared, true);
         else if (o.forked) this.fds.restore(o.forked.fds, o.forked.cloexec);
         else this.fds.setup(o.cwd, o.inherited ?? [], o.preopenRoot === true);
@@ -8499,7 +8656,7 @@ var init_wasi_host = __esm({
           own.call(this.o.fs, path, idOf3(uid), idOf3(gid), follow2, handle);
         };
         const caller = () => {
-          const cred = this.o.kernel.call({ op: "proc-cred" });
+          const cred = this.creds.get();
           return [cred.euid, cred.egid];
         };
         const owner = (st, out) => {
@@ -8604,7 +8761,7 @@ var init_wasi_host = __esm({
           }),
           umount2: (tp, tl, flags) => void this.o.kernel.call({ op: "umount", target: path(tp, tl), flags }),
           cred_get: (out) => {
-            const cred = this.o.kernel.call({ op: "proc-cred" });
+            const cred = this.creds.get();
             const view = mem.view();
             view.getUint32(out + 20, true);
             IDS.forEach((key, i) => void view.setUint32(out + i * 4, cred[key], true));
@@ -8614,7 +8771,7 @@ var init_wasi_host = __esm({
             IDS.forEach((key, i) => {
               if (ids[i] !== -1) change[key] = ids[i] >>> 0;
             });
-            void this.o.kernel.call({ op: "proc-setcred", change });
+            void this.creds.change(() => this.o.kernel.call({ op: "proc-setcred", change }));
           },
           ...semImports(this),
           ...lockImports({
@@ -8638,7 +8795,7 @@ var init_wasi_host = __esm({
             }
           }),
           groups_get: (buf, cap, count) => {
-            const { groups } = this.o.kernel.call({ op: "proc-cred" });
+            const { groups } = this.creds.get();
             if (cap !== 0 && cap < groups.length) throw new WasiError("EINVAL");
             const shown = cap === 0 ? [] : groups;
             const view = mem.view();
@@ -8651,7 +8808,9 @@ var init_wasi_host = __esm({
             if (n < 0 || n > MAX_GROUPS) throw new WasiError("EINVAL");
             const view = mem.view();
             const groups = Array.from({ length: n }, (_, i) => view.getUint32(buf + i * 4, true));
-            void this.o.kernel.call({ op: "proc-setcred", change: { groups } });
+            void this.creds.change(
+              () => this.o.kernel.call({ op: "proc-setcred", change: { groups } })
+            );
           },
           sigaction_set: (sig, disposition, flags) => {
             if (!this.signals) return E.NOSYS;
@@ -8666,6 +8825,24 @@ var init_wasi_host = __esm({
             view.setUint32(old + 4, oldHi, true);
           }) : E.NOSYS,
           sigmask_poll: (lo, hi, inPtr, outPtr, n, nevents) => this.sigmask ? this.maskedPoll(this.sigmask, [lo, hi], [inPtr, outPtr, n, nevents]) : E.NOSYS,
+          sigmask_epoll_wait: (lo, hi, epfd, events, max, timeout, nevents) => this.sigmask ? this.maskedEpoll(
+            this.sigmask,
+            [lo, hi],
+            nevents,
+            (epoll) => epoll(epfd, events, max, timeout, nevents)
+          ) : E.NOSYS,
+          sigwait: (lo, _hi, timeout, out) => {
+            const mask = this.sigmask;
+            if (!mask) return E.NOSYS;
+            mem.view().setUint32(out, 0, true);
+            return mask.sigwait(
+              lo,
+              timeout,
+              (set) => void this.o.kernel.call({ op: "sig-waiting", tid: mask.tid, set }),
+              (sig) => void mem.view().setUint32(out, sig, true),
+              this.entered
+            );
+          },
           sigpending_get: (out) => {
             if (!this.sigmask) return E.NOSYS;
             mem.view().setBigUint64(out, BigInt(this.sigmask.pending()), true);
@@ -8698,6 +8875,7 @@ var init_wasi_host = __esm({
         try {
           this.mem.view().setUint32(nevents, 0, true);
           if (mask.deliverUnblocked()) return E.INTR;
+          this.settleEntry(mask);
           if (n > 0) return this.poll(inPtr, outPtr, n, nevents);
           return this.entered ? E.INTR : this.suspend();
         } finally {
@@ -8705,6 +8883,23 @@ var init_wasi_host = __esm({
           mask.restore(old);
         }
       }
+      epollWait;
+      settleEntry(mask) {
+        if (this.entered && (this.enteredSignals & ~mask.blockedBits()) === 0) this.entered = false;
+      }
+      maskedEpoll(mask, set, nevents, wait2) {
+        const old = mask.swap(set[0], set[1]);
+        try {
+          this.mem.view().setUint32(nevents, 0, true);
+          if (mask.deliverUnblocked()) return E.INTR;
+          this.settleEntry(mask);
+          this.epollWait ??= wasixEpollImports(this).epoll_wait;
+          return wait2(this.epollWait) ?? E.SUCCESS;
+        } finally {
+          mask.deliverUnblocked();
+          mask.restore(old);
+        }
+      }
       suspend() {
         for (; ; ) {
           try {
@@ -8727,7 +8922,7 @@ var init_wasi_host = __esm({
         return this.cache;
       }
       now(id) {
-        if (id === CLOCK.REALTIME) return BigInt(Date.now()) * NS_PER_MS2;
+        if (id === CLOCK.REALTIME) return BigInt(Date.now()) * NS_PER_MS3;
         if (id === CLOCK.MONOTONIC) {
           return MONOTONIC_BASE + BigInt(Math.round(performance.now() * 1e6));
         }
@@ -9061,7 +9256,7 @@ var init_wasi_host = __esm({
             return this.fds.kind(fd, e) === "file" ? this.changed(fd, e, n) : n;
           } catch (err) {
             const broken = err.code === "EPIPE";
-            if (broken && this.fds.kind(fd, e) !== "socket") throw new WasiExit(SIGPIPE_EXIT);
+            if (broken && this.fds.kind(fd, e) !== "socket") this.brokenPipe();
             throw err;
           }
         }
@@ -9073,6 +9268,18 @@ var init_wasi_host = __esm({
         }
         return this.file(fd, "write").write(data);
       }
+      brokenPipe() {
+        let action;
+        try {
+          action = this.o.kernel.call({ op: "proc-kill-self", sig: SIG.PIPE, probe: true });
+        } catch {
+          action = "terminate";
+        }
+        if (action !== "terminate") return;
+        const mask = this.sigmask;
+        if (!mask?.blocks(SIG.PIPE)) throw new WasiExit(SIGPIPE_EXIT);
+        this.o.kernel.call({ op: "thread-kill", tid: mask.tid, sig: SIG.PIPE });
+      }
       read(fd, max) {
         const e = this.fds.get(fd);
         if (e.type === "kernel") {
@@ -9256,7 +9463,7 @@ var init_wasi_host = __esm({
           current ??= statOf(path);
           return current[field2] ?? current.mtimeMs ?? now;
         };
-        const pick = (set, setNow, value2, field2) => flags & setNow ? now : flags & set ? Number(value2 / NS_PER_MS2) : kept(field2);
+        const pick = (set, setNow, value2, field2) => flags & setNow ? now : flags & set ? Number(value2 / NS_PER_MS3) : kept(field2);
         (follow2 ? this.o.fs.utimes : this.o.fs.lutimes).call(
           this.o.fs,
           path,
@@ -10257,7 +10464,7 @@ var init_wasi_procfs = __esm({
 });
 
 // src/process/wasi/wasi-sigmask.ts
-var UNBLOCKABLE, LIBC_UNBLOCKABLE, SIG_BLOCK, SIG_UNBLOCK, SIG_SETMASK, kernelBits, libcBits, apply, WasiSigmask;
+var UNBLOCKABLE, LIBC_UNBLOCKABLE, FOREVER2, NS_PER_MS4, POLL_MS, SIG_BLOCK, SIG_UNBLOCK, SIG_SETMASK, kernelBits, libcBits, apply, WasiSigmask;
 var init_wasi_sigmask = __esm({
   "src/process/wasi/wasi-sigmask.ts"() {
     "use strict";
@@ -10266,6 +10473,9 @@ var init_wasi_sigmask = __esm({
     init_wasi_abi();
     UNBLOCKABLE = sigbit(SIG.KILL) | sigbit(SIG.STOP);
     LIBC_UNBLOCKABLE = 1 << SIG.KILL - 1 | 1 << SIG.STOP - 1;
+    FOREVER2 = 0xffffffffffffffffn;
+    NS_PER_MS4 = 1000000n;
+    POLL_MS = 50;
     SIG_BLOCK = 0;
     SIG_UNBLOCK = 1;
     SIG_SETMASK = 2;
@@ -10282,10 +10492,12 @@ var init_wasi_sigmask = __esm({
       header;
       deliver;
       process;
-      constructor(header, deliver, process) {
+      tid;
+      constructor(header, deliver, process, tid = 1) {
         this.header = header;
         this.deliver = deliver;
         this.process = process;
+        this.tid = tid;
         this.lo = libcBits(Atomics.load(header, SAB_I_BLOCKED));
         this.hi = Atomics.load(header, SAB_I_BLOCKED_HI);
       }
@@ -10319,6 +10531,12 @@ var init_wasi_sigmask = __esm({
         this.set(SIG_SETMASK, lo, hi, () => {
         });
       }
+      blockedBits() {
+        return Atomics.load(this.header, SAB_I_BLOCKED);
+      }
+      blocks(sig) {
+        return (Atomics.load(this.header, SAB_I_BLOCKED) & sigbit(sig)) !== 0;
+      }
       inherited() {
         return [kernelBits(this.lo), this.hi];
       }
@@ -10326,6 +10544,47 @@ var init_wasi_sigmask = __esm({
         Atomics.and(this.header, SAB_I_SIGNALS, ~sigbit(sig));
         if (this.process) Atomics.and(this.process, SAB_I_SIGNALS, ~sigbit(sig));
       }
+      sigwait(setLo, timeoutNs, publish, took, entered = false) {
+        const set = kernelBits(setLo | 0);
+        const value2 = BigInt.asUintN(64, timeoutNs);
+        const deadline = value2 === FOREVER2 ? Number.POSITIVE_INFINITY : performance.now() + Number((value2 + NS_PER_MS4 - 1n) / NS_PER_MS4);
+        publish(set);
+        try {
+          for (; ; ) {
+            const seen = Atomics.load(this.header, SAB_I_SIGNALS);
+            const sig = this.take(set);
+            if (sig !== 0) {
+              took(sig);
+              return E.SUCCESS;
+            }
+            if (entered || this.deliverUnblocked() || this.interrupted()) return E.INTR;
+            const left = deadline - performance.now();
+            if (left <= 0) return E.AGAIN;
+            Atomics.wait(this.header, SAB_I_SIGNALS, seen, Math.min(left, POLL_MS));
+          }
+        } finally {
+          publish(0);
+        }
+      }
+      take(set) {
+        for (const header of this.process ? [this.header, this.process] : [this.header]) {
+          const ready = Atomics.load(header, SAB_I_SIGNALS) & set;
+          if (ready === 0) continue;
+          const bit = ready & -ready;
+          if ((Atomics.and(header, SAB_I_SIGNALS, ~bit) & bit) !== 0) return 31 - Math.clz32(bit);
+        }
+        return 0;
+      }
+      interrupted() {
+        const killed = this.process ?? this.header;
+        if (Atomics.load(killed, SAB_I_KILLED) !== 0) {
+          this.deliver();
+          return true;
+        }
+        if (Atomics.load(killed, SAB_I_STOP) !== 1) return false;
+        while (Atomics.load(killed, SAB_I_STOP) === 1) Atomics.wait(killed, SAB_I_STOP, 1);
+        return true;
+      }
       pending() {
         const own = Atomics.load(this.header, SAB_I_SIGNALS);
         return libcBits(own | (this.process ? Atomics.load(this.process, SAB_I_SIGNALS) : 0));
@@ -10684,91 +10943,6 @@ var init_wasix_fork = __esm({
   }
 });
 
-// src/process/wasi/wasix-epoll.ts
-function timeoutMs(ns) {
-  const value2 = BigInt.asUintN(64, ns);
-  if (value2 === FOREVER) return -1;
-  const ms = (value2 + NS_PER_MS3 - 1n) / NS_PER_MS3;
-  return ms > BigInt(MAX_TIMEOUT_MS) ? -1 : Number(ms);
-}
-function wasixEpollImports(host) {
-  const { mem, fds, o } = host;
-  const call2 = (req) => o.kernel.call(req);
-  const kernelFd = (fd, refusal2) => {
-    const e = fds.find(fd);
-    if (!e) throw new WasiError("EBADF");
-    if (e.type !== "kernel") throw new WasiError(refusal2);
-  };
-  const writeEvents2 = (ptr, events) => {
-    const view = mem.view();
-    events.forEach((ev, i) => {
-      const at = ptr + i * EVENT_SIZE;
-      mem.bytes(at, EVENT_SIZE).fill(0);
-      view.setUint32(at, ev.events, true);
-      mem.bytes(at + DATA_OFFSET, DATA_SIZE).set(ev.data);
-    });
-  };
-  return {
-    epoll_create: (out) => {
-      const fd = call2({ op: "epoll-create" });
-      fds.adopt(fd, "stream", false);
-      mem.view().setUint32(out, fd, true);
-    },
-    epoll_ctl: (epfd, op, fd, event) => {
-      const how = OPS[op];
-      if (!how) throw new WasiError("EINVAL");
-      kernelFd(epfd, "EINVAL");
-      kernelFd(fd, "EPERM");
-      if (how !== "del" && event === 0) throw new WasiError("EINVAL");
-      const events = event === 0 ? 0 : mem.view().getUint32(event, true);
-      const data = event === 0 ? [] : [...mem.bytes(event + DATA_OFFSET, DATA_SIZE)];
-      call2({ op: "epoll-ctl", epfd, how, fd, events, data });
-    },
-    epoll_wait: (epfd, ptr, maxevents, timeout, out) => {
-      mem.view().setUint32(out, 0, true);
-      if ((maxevents | 0) <= 0) throw new WasiError("EINVAL");
-      kernelFd(epfd, "EINVAL");
-      const max = Math.min(maxevents | 0, MAX_EVENTS);
-      const ms = host.entered ? 0 : timeoutMs(timeout);
-      const events = call2({ op: "epoll-wait", epfd, max, timeoutMs: ms });
-      if (host.entered && events.length === 0 && timeoutMs(timeout) !== 0) return E.INTR;
-      writeEvents2(ptr, events);
-      mem.view().setUint32(out, events.length, true);
-      return E.SUCCESS;
-    },
-    fd_event: (initial, flags, out) => {
-      const value2 = BigInt.asUintN(64, initial);
-      if (value2 > EVENTFD_MAX) throw new WasiError("EINVAL");
-      const fd = call2({
-        op: "eventfd-open",
-        initial: value2.toString(),
-        semaphore: (flags & EVENTFD_SEMAPHORE) !== 0
-      });
-      fds.adopt(fd, "stream", (flags & EVENTFD_NONBLOCK) !== 0);
-      mem.view().setUint32(out, fd, true);
-    }
-  };
-}
-var EVENT_SIZE, DATA_OFFSET, DATA_SIZE, MAX_EVENTS, FOREVER, MAX_TIMEOUT_MS, NS_PER_MS3, EVENTFD_SEMAPHORE, EVENTFD_NONBLOCK, EVENTFD_MAX, OPS;
-var init_wasix_epoll = __esm({
-  "src/process/wasi/wasix-epoll.ts"() {
-    "use strict";
-    init_wasi_abi();
-    init_wasi_files();
-    EVENT_SIZE = 32;
-    DATA_OFFSET = 8;
-    DATA_SIZE = 24;
-    MAX_EVENTS = 4096;
-    FOREVER = 0xffffffffffffffffn;
-    MAX_TIMEOUT_MS = 2147483647;
-    NS_PER_MS3 = 1000000n;
-    EVENTFD_SEMAPHORE = 1;
-    EVENTFD_NONBLOCK = 4;
-    EVENTFD_MAX = 0xfffffffffffffffen;
-    OPS = ["add", "set", "del", "mod"];
-  }
-});
-
 // src/process/wasi/wasix-ffi.ts
 function read(view, at, type) {
   if (type === "i32") return view.getInt32(at, true);
@@ -11675,7 +11849,7 @@ function posixSignal(sig) {
 function nsToMs(ns) {
   return Math.ceil(Number(ns) / 1e6);
 }
-var FDFLAGSEXT_CLOEXEC, SPAWN_OP_SIZE, SPAWN_OPS, RIGHTS_FD_WRITE, ICANON, ECHO, FUTEX_SLICE_MS, EINTR_LIBC, MAIN_HANDLE, WasixHost;
+var FDFLAGSEXT_CLOEXEC, SPAWN_OP_SIZE, SPAWN_OPS, RIGHTS_FD_WRITE, ICANON, ECHO, FUTEX_SLICE_MS, EINTR_LIBC, STRICT_EPOLL_LIBC, MAIN_HANDLE, WasixHost;
 var init_wasix_host = __esm({
   "src/process/wasi/wasix-host.ts"() {
     "use strict";
@@ -11699,6 +11873,7 @@ var init_wasix_host = __esm({
     ECHO = 8;
     FUTEX_SLICE_MS = 50;
     EINTR_LIBC = 22;
+    STRICT_EPOLL_LIBC = 29;
     MAIN_HANDLE = 2147483647;
     WasixHost = class _WasixHost {
       process;
@@ -11717,6 +11892,7 @@ var init_wasix_host = __esm({
           driver,
           () => (this.threads?.tid ?? MAIN_TID) !== MAIN_TID
         );
+        if (module) host.strictEpoll = (libcVersion(module) ?? 0) >= STRICT_EPOLL_LIBC;
         if (module && !WebAssembly.Module.imports(module).some((i) => i.name === "fd_fdflags_set")) {
           host.fds.implicitCloexec = true;
           host.interruptWakes = (libcVersion(module) ?? 0) < EINTR_LIBC;
@@ -12177,6 +12353,7 @@ __export(wasi_runtime_exports, {
 });
 function wireSignals(host, gate) {
   host.interrupted = () => gate.interrupt();
+  host.raisedOnEntry = () => gate.raisedOnEntry();
   host.quietly = (fn) => gate.quiet(fn);
 }
 function catchUpFirst(host, sync) {
@@ -12202,6 +12379,7 @@ function delivering(ns, table, host, driver, before) {
       if (driver.idle) {
         before?.();
         host.entered = host.interrupted?.() === true;
+        host.enteredSignals = host.entered ? host.raisedOnEntry?.() ?? -1 : 0;
       }
       return fn(...args);
     };
@@ -12216,7 +12394,7 @@ function sigmaskOf(module, sab, gate, threads, process) {
   }
   if (threads) threads.blocked = () => loadBlocked(header);
   const shared = process && new Int32Array(process, 0, SAB_HEADER_I32);
-  return new WasiSigmask(header, () => gate.deliver(), shared);
+  return new WasiSigmask(header, () => gate.deliver(), shared, threads?.tid ?? MAIN_TID);
 }
 function enosys(module, name2, foreign) {
   const type = foreign?.[module]?.[name2];
@@ -12570,7 +12748,8 @@ async function runWasiProcess(init, port2) {
       ),
       procTree(call2, id.pid)
     ),
-    ...descriptors(init, fork, threads)
+    ...descriptors(init, fork, threads),
+    ...threads ? { credGen: threads.ids } : {}
   });
   host.sigmask = sigmaskOf(module, init.sab, gate, threads);
   if (threads) {
@@ -13935,6 +14114,9 @@ function rewrite(hop, status2, location) {
     );
   }
   const toGet = (status2 === 301 || status2 === 302) && hop.method === "POST" || status2 === 303 && hop.method !== "GET" && hop.method !== "HEAD";
+  if (hop.stream && !toGet) {
+    throw failed3(new JsCallError("EIO", `a ${status2} redirect would send a streamed body again`));
+  }
   const crossOrigin = next2.origin !== new URL(hop.url).origin;
   const headers = hop.headers.filter(
     ([name2]) => !(toGet && BODY_HEADERS.has(name2.toLowerCase())) && !(crossOrigin && CREDENTIALS.has(name2.toLowerCase()))
@@ -14101,6 +14283,44 @@ async function bodyOf(request, cap, signal) {
   }
   return out;
 }
+function streams(known, request, init, url) {
+  if (known.streamingBodies !== true || !(init?.body instanceof ReadableStream)) return false;
+  return request.method !== "GET" && request.method !== "HEAD" && !local2(url);
+}
+async function pump(kernel, handle, stream, signal) {
+  const reader = stream.getReader();
+  const stop = () => void reader.cancel(signal.reason).catch(() => void 0);
+  signal.addEventListener("abort", stop, { once: true });
+  try {
+    await pumpFrom(kernel, handle, reader, signal);
+  } finally {
+    signal.removeEventListener("abort", stop);
+  }
+}
+async function pumpFrom(kernel, handle, reader, signal) {
+  for (; ; ) {
+    let bytes;
+    try {
+      const next2 = await reader.read();
+      if (next2.done) break;
+      bytes = bytesOf(next2.value);
+    } catch (err) {
+      await reader.cancel(err).catch(() => void 0);
+      await kernel.raw({ op: "net-close", handle });
+      return;
+    }
+    if (bytes.length === 0) continue;
+    const taken = await kernel.blocking({ op: "net-write", handle, bytes }, signal).then(
+      () => true,
+      () => false
+    );
+    if (!taken) {
+      await reader.cancel().catch(() => void 0);
+      return;
+    }
+  }
+  await kernel.raw({ op: "net-end", handle });
+}
 function fetchOp(kernel) {
   const traits = /* @__PURE__ */ new Map();
   const traitsOf = (url) => {
@@ -14120,8 +14340,9 @@ function fetchOp(kernel) {
       url: hop.url,
       method: hop.method,
       headers: hop.headers,
-      ...hop.body ? { body: hop.body } : {}
+      ...hop.stream ? { stream: true } : hop.body ? { body: hop.body } : {}
     });
+    if (hop.stream) void pump(kernel, handle, hop.stream, signal);
     try {
       const r = await kernel.blocking({ op: "net-head", handle }, signal);
       signal.throwIfAborted();
@@ -14215,7 +14436,8 @@ function fetchOp(kernel) {
       throw failed3(new JsCallError("ENOTSUP", `redirect: ${request.redirect}`));
     }
     const url = withoutFragment(new URL(request.url));
-    const bytes = await bodyOf(request, known.maxRequestBody, signal);
+    const streamed = streams(known, request, init, url);
+    const bytes = streamed ? void 0 : await bodyOf(request, known.maxRequestBody, signal);
     if (bytes === OVER) {
       return withMeta(plain(413, `request body over ${known.maxRequestBody} bytes`), url, false);
     }
@@ -14223,7 +14445,8 @@ function fetchOp(kernel) {
       url,
       method: request.method,
       headers: [...request.headers],
-      body: bytes
+      body: bytes,
+      ...streamed && request.body ? { stream: request.body } : {}
     };
     for (let hops = 0; ; hops++) {
       const head = await send(hop, signal);