@ai-ecoverse/slicc-kernel 1.26.6 → 1.28.0

package/dist/kernel-worker.js

@@ -883,7 +883,7 @@ function portCdpHook(ask, gone) {
 }
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 5];
+var PROTOCOL = [1, 7];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -1253,6 +1253,170 @@ var FdTable = class _FdTable {
   }
 };
 
+// src/process/wasi/wasi-abi.ts
+var E = {
+  SUCCESS: 0,
+  "2BIG": 1,
+  ACCES: 2,
+  ADDRINUSE: 3,
+  ADDRNOTAVAIL: 4,
+  AFNOSUPPORT: 5,
+  AGAIN: 6,
+  ALREADY: 7,
+  BADF: 8,
+  BADMSG: 9,
+  BUSY: 10,
+  CANCELED: 11,
+  CHILD: 12,
+  CONNABORTED: 13,
+  CONNREFUSED: 14,
+  CONNRESET: 15,
+  DEADLK: 16,
+  DESTADDRREQ: 17,
+  DOM: 18,
+  DQUOT: 19,
+  EXIST: 20,
+  FAULT: 21,
+  FBIG: 22,
+  HOSTUNREACH: 23,
+  IDRM: 24,
+  ILSEQ: 25,
+  INPROGRESS: 26,
+  INTR: 27,
+  INVAL: 28,
+  IO: 29,
+  ISCONN: 30,
+  ISDIR: 31,
+  LOOP: 32,
+  MFILE: 33,
+  MLINK: 34,
+  MSGSIZE: 35,
+  MULTIHOP: 36,
+  NAMETOOLONG: 37,
+  NETDOWN: 38,
+  NETRESET: 39,
+  NETUNREACH: 40,
+  NFILE: 41,
+  NOBUFS: 42,
+  NODEV: 43,
+  NOENT: 44,
+  NOEXEC: 45,
+  NOLCK: 46,
+  NOLINK: 47,
+  NOMEM: 48,
+  NOMSG: 49,
+  NOPROTOOPT: 50,
+  NOSPC: 51,
+  NOSYS: 52,
+  NOTCONN: 53,
+  NOTDIR: 54,
+  NOTEMPTY: 55,
+  NOTRECOVERABLE: 56,
+  NOTSOCK: 57,
+  NOTSUP: 58,
+  NOTTY: 59,
+  NXIO: 60,
+  OVERFLOW: 61,
+  OWNERDEAD: 62,
+  PERM: 63,
+  PIPE: 64,
+  PROTO: 65,
+  PROTONOSUPPORT: 66,
+  PROTOTYPE: 67,
+  RANGE: 68,
+  ROFS: 69,
+  SPIPE: 70,
+  SRCH: 71,
+  STALE: 72,
+  TIMEDOUT: 73,
+  TXTBSY: 74,
+  XDEV: 75,
+  NOTCAPABLE: 76
+};
+var RIGHTS = {
+  FD_DATASYNC: 1n << 0n,
+  FD_READ: 1n << 1n,
+  FD_SEEK: 1n << 2n,
+  FD_FDSTAT_SET_FLAGS: 1n << 3n,
+  FD_SYNC: 1n << 4n,
+  FD_TELL: 1n << 5n,
+  FD_WRITE: 1n << 6n,
+  ALL: (1n << 30n) - 1n
+};
+var WASI_SIGNAL_TO_POSIX = Object.fromEntries(
+  Array.from({ length: 30 }, (_, i) => [i + 1, i + 1 < 16 ? i + 1 : i + 2])
+);
+
+// src/process/wasi-errno.ts
+var WASI_ERRNO = {
+  ...Object.fromEntries(Object.entries(E).map(([name2, errno]) => [`E${name2}`, errno])),
+  EWOULDBLOCK: E.AGAIN,
+  ENOTSUP: 138,
+  EOPNOTSUPP: 138,
+  ENOMEDIUM: 148
+};
+function wasiErrno(code) {
+  return WASI_ERRNO[code] ?? E.IO;
+}
+
+// src/kernel/net/uplink-socket.ts
+var CHUNK = 64 * 1024;
+function hostPort(text) {
+  const match = /^\[?([^\]]*?)\]?:(\d{1,5})$/.exec(text);
+  const port = Number(match?.[2]);
+  const host = match?.[1];
+  if (!host || port > 65535) return void 0;
+  return { host, port };
+}
+async function inbound(conn, rx) {
+  for (; ; ) {
+    while (!rx.writeReady) await rx.changed();
+    if (rx.readersGone) return;
+    const bytes = await conn.read();
+    if (!bytes) return;
+    await rx.write(bytes);
+  }
+}
+async function outbound(conn, tx) {
+  for (; ; ) {
+    const bytes = await tx.read(CHUNK);
+    if (bytes.length === 0) {
+      conn.closeWrite();
+      return;
+    }
+    for (let at = 0; at < bytes.length; ) {
+      const n = await conn.write(bytes.subarray(at));
+      if (!(n > 0)) throw new Error("the uplink wrote nothing");
+      at += n;
+    }
+  }
+}
+async function released(rx, tx) {
+  while (!(rx.readersGone && tx.writersGone)) await Promise.race([rx.changed(), tx.changed()]);
+}
+function uplinkLink(conn, onReset) {
+  const rx = new KernelPipe();
+  const tx = new KernelPipe();
+  for (const pipe of [rx, tx]) {
+    pipe.openRead();
+    pipe.openWrite();
+  }
+  let open = true;
+  const close = () => {
+    if (!open) return;
+    open = false;
+    conn.close();
+  };
+  void inbound(conn, rx).catch(() => {
+    onReset();
+    close();
+    tx.closeRead();
+  }).finally(() => rx.closeWrite());
+  void outbound(conn, tx).catch(close).finally(() => tx.closeRead());
+  void released(rx, tx).then(close);
+  return { rx, tx };
+}
+
 // src/kernel/socket.ts
 var SOMAXCONN = 4096;
 var EPHEMERAL_FIRST = 32768;
@@ -1270,6 +1434,21 @@ var AF_INET = 2;
 var SHUT_RD = 0;
 var SHUT_WR = 1;
 var SHUT_RDWR = 2;
+var DIAL_TIMEOUT_MS = 3e4;
+var DIAL_ERRORS = [
+  "ECONNREFUSED",
+  "ENETUNREACH",
+  "EHOSTUNREACH",
+  "ETIMEDOUT",
+  "ECONNRESET"
+];
+function dialError(e, timedOut, closed) {
+  if (timedOut) return new KernelError("ETIMEDOUT");
+  if (closed) return new KernelError("ECONNABORTED");
+  const code = e?.code;
+  const known = DIAL_ERRORS.find((errno) => errno === code);
+  return new KernelError(known ?? "EHOSTUNREACH");
+}
 function isLoopback(host) {
   return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
 }
@@ -1318,6 +1497,9 @@ var KernelSocket = class _KernelSocket {
   net;
   domain;
   state = "open";
+  dialing;
+  failed;
+  reset = false;
   local;
   peer;
   link;
@@ -1325,7 +1507,7 @@ var KernelSocket = class _KernelSocket {
   writeShut = false;
   queue = [];
   backlog = 0;
-  bound = false;
+  boundAt;
   changes = new Changes();
   options = /* @__PURE__ */ new Map();
   constructor(net, domain) {
@@ -1347,12 +1529,16 @@ var KernelSocket = class _KernelSocket {
   async read(max, signal) {
     const { rx } = this.connection();
     if (this.readShut || max <= 0) return new Uint8Array(0);
-    return pipeCall(() => rx.read(max, signal));
+    const bytes = await pipeCall(() => rx.read(max, signal));
+    if (bytes.length === 0 && this.reset) throw new KernelError("ECONNRESET");
+    return bytes;
   }
   async peek(max, signal) {
     const { rx } = this.connection();
     if (this.readShut || max <= 0) return new Uint8Array(0);
-    return pipeCall(() => rx.peek(max, signal));
+    const bytes = await pipeCall(() => rx.peek(max, signal));
+    if (bytes.length === 0 && this.reset) throw new KernelError("ECONNRESET");
+    return bytes;
   }
   async write(bytes, signal) {
     const { tx } = this.connection();
@@ -1363,6 +1549,8 @@ var KernelSocket = class _KernelSocket {
     if (this.state === "listening") {
       return { readable: this.queue.length > 0, writable: false, hangup: false };
     }
+    if (this.state === "connecting") return { readable: false, writable: false, hangup: false };
+    if (this.failed) return { readable: true, writable: true, hangup: true };
     if (this.state !== "connected" || !this.link) {
       return { readable: false, writable: false, hangup: true };
     }
@@ -1384,7 +1572,7 @@ var KernelSocket = class _KernelSocket {
     if (this.state !== "open" || this.local) throw new KernelError("EINVAL");
     if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
     this.local = this.net.bind(this, addr);
-    this.bound = true;
+    this.boundAt = this.local;
   }
   listen(backlog) {
     if (this.state === "connected") throw new KernelError("EISCONN");
@@ -1411,15 +1599,19 @@ var KernelSocket = class _KernelSocket {
     this.changes.wake();
     return true;
   }
-  connect(addr) {
+  connect(addr, viaUplink = true) {
     if (this.state === "connected") throw new KernelError("EISCONN");
+    if (this.state === "connecting") throw new KernelError("EALREADY");
     if (this.state !== "open") throw new KernelError("EINVAL");
     if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
+    this.failed = void 0;
+    const route = viaUplink && addr.family === "inet" ? this.net.uplinkFor(addr.host) : void 0;
+    if (route) return this.dial(addr, route);
     const target = this.net.target(addr);
     if (!this.local) {
       if (addr.family === "inet") {
         this.local = this.net.bind(this, { family: "inet", host: "127.0.0.1", port: 0 });
-        this.bound = true;
+        this.boundAt = this.local;
       } else this.local = { family: "unix", path: "" };
     }
     const server = new _KernelSocket(this.net, this.domain);
@@ -1432,6 +1624,52 @@ var KernelSocket = class _KernelSocket {
       server.close();
       throw new KernelError("ECONNREFUSED");
     }
+    return void 0;
+  }
+  dial(addr, route) {
+    this.state = "connecting";
+    const abort = new AbortController();
+    this.dialing = abort;
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      abort.abort(new KernelError("ETIMEDOUT"));
+    }, route.timeoutMs ?? DIAL_TIMEOUT_MS);
+    const abandoned = new Promise((_, reject) => {
+      abort.signal.addEventListener("abort", () => reject(abort.signal.reason), { once: true });
+    });
+    const { host, port } = addr;
+    const dialled = new Promise(
+      (resolve) => resolve(route.uplink.dial({ network: "tcp", host, port, signal: abort.signal }))
+    );
+    dialled.then(
+      (conn) => abort.signal.aborted && conn.close(),
+      () => void 0
+    );
+    return Promise.race([dialled, abandoned]).then(
+      (conn) => {
+        if (abort.signal.aborted) throw dialError(abort.signal.reason, timedOut, true);
+        this.local = { family: "inet", host: "0.0.0.0", port: 0, ...hostPort(conn.localAddr) };
+        this.peer = { ...addr, ...hostPort(conn.remoteAddr) };
+        this.dialing = void 0;
+        this.attach(
+          uplinkLink(conn, () => {
+            this.reset = true;
+            this.changes.wake();
+          })
+        );
+      },
+      (e) => {
+        const error = dialError(e, timedOut, abort.signal.aborted);
+        if (this.dialing === abort) {
+          this.dialing = void 0;
+          this.failed = error.code;
+          this.state = "open";
+          this.changes.wake();
+        }
+        throw error;
+      }
+    ).finally(() => clearTimeout(timer));
   }
   unlink() {
     const link2 = this.link;
@@ -1461,8 +1699,11 @@ var KernelSocket = class _KernelSocket {
       switch (name2) {
         case SO_TYPE:
           return SOCK_STREAM;
-        case SO_ERROR:
-          return 0;
+        case SO_ERROR: {
+          const failed = this.failed;
+          this.failed = void 0;
+          return failed ? wasiErrno(failed) : 0;
+        }
         case SO_ACCEPTCONN:
           return this.state === "listening" ? 1 : 0;
         case SO_DOMAIN:
@@ -1480,6 +1721,8 @@ var KernelSocket = class _KernelSocket {
   close() {
     const was = this.state;
     this.state = "closed";
+    this.dialing?.abort(new KernelError("ECONNABORTED"));
+    this.dialing = void 0;
     if (was === "listening") {
       for (const pending of this.queue.splice(0)) pending.close();
     }
@@ -1489,8 +1732,8 @@ var KernelSocket = class _KernelSocket {
       this.readShut = true;
       this.writeShut = true;
     }
-    if (this.bound && this.local) this.net.release(this.local, this);
-    this.bound = false;
+    if (this.boundAt) this.net.release(this.boundAt, this);
+    this.boundAt = void 0;
     this.changes.wake();
   }
   static pair(net, domain) {
@@ -1513,6 +1756,15 @@ var LoopbackNet = class {
   activators = /* @__PURE__ */ new Map();
   internal = /* @__PURE__ */ new Set();
   nextEphemeral = EPHEMERAL_FIRST;
+  route;
+  useUplink(route) {
+    this.route = route;
+  }
+  uplinkFor(host) {
+    const route = this.route;
+    if (!route) return void 0;
+    return route.routes.classify(host) === "uplink" ? route : void 0;
+  }
   kernelOnly(port, reserve = false) {
     if (reserve) this.internal.add(port);
     return this.internal.has(port);
@@ -1531,7 +1783,7 @@ var LoopbackNet = class {
   }
   connect(addr) {
     const socket = this.socket(addr.family);
-    socket.connect(addr);
+    void socket.connect(addr, false);
     return socket;
   }
   bind(socket, addr) {
@@ -1572,7 +1824,7 @@ var LoopbackNet = class {
 };
 
 // src/kernel/dial.ts
-var CHUNK = 64 * 1024;
+var CHUNK2 = 64 * 1024;
 var LOOPBACK_NAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
 function dialSocket(net, port, host = "127.0.0.1") {
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new KernelError("EINVAL");
@@ -1637,7 +1889,7 @@ function serveSocket(socket, port, onClose) {
       for (; ; ) {
         await turn();
         if (closed) return;
-        const chunk2 = await socket.read(CHUNK);
+        const chunk2 = await socket.read(CHUNK2);
         if (chunk2.length === 0) break;
         credit--;
         send(chunk2, [chunk2.buffer]);
@@ -2086,6 +2338,7 @@ function serveClient(port, host) {
 
 // src/kernel/net/loopback-names.ts
 var HOST_LOOPBACK = "host.slicc.internal";
+var HOST_LOOPBACK_ADDRESS = [10, 0, 2, 2];
 var PAGE_LOOPBACK = "kernel.localhost";
 var PAGE_LOOPBACK_URL = `http://{port}.${PAGE_LOOPBACK}`;
 function toHostLoopback(href) {
@@ -3569,6 +3822,178 @@ var RemoteTransport = class {
   }
 };
 
+// src/kernel/net/routes.ts
+var HOST_ADDRESS = HOST_LOOPBACK_ADDRESS.join(".");
+function ipv4Bytes(text) {
+  const parts = text.split(".");
+  if (parts.length !== 4 || !parts.every((p) => /^\d{1,3}$/.test(p))) return void 0;
+  const bytes = parts.map(Number);
+  return bytes.every((b) => b <= 255) ? bytes : void 0;
+}
+function ipv6Groups(text) {
+  if (!text.includes(":")) return void 0;
+  let canonical;
+  try {
+    canonical = new URL(`http://[${text}]/`).hostname.slice(1, -1);
+  } catch {
+    return void 0;
+  }
+  const [head, tail] = canonical.split("::");
+  const part = (s) => s ? s.split(":").map((h) => Number.parseInt(h, 16)) : [];
+  const front = part(head);
+  const back = part(tail);
+  return tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
+}
+function toBits(values, width) {
+  return values.reduce((acc, v) => acc << BigInt(width) | BigInt(v), 0n);
+}
+function addressBits(host) {
+  const v4 = ipv4Bytes(host);
+  if (v4) return { v6: false, bits: toBits(v4, 8) };
+  const v6 = ipv6Groups(host);
+  return v6 ? { v6: true, bits: toBits(v6, 16) } : void 0;
+}
+function parsePrefix(text) {
+  const parts = text.trim().split("/");
+  if (parts.length > 2) return void 0;
+  const [address = "", size] = parts;
+  const parsed = addressBits(address);
+  if (!parsed) return void 0;
+  const max = parsed.v6 ? 128 : 32;
+  const length2 = size === void 0 ? max : /^\d{1,3}$/.test(size) ? Number(size) : -1;
+  if (length2 < 0 || length2 > max) return void 0;
+  return { ...parsed, length: length2 };
+}
+function within2(prefix, addr) {
+  if (prefix.v6 !== addr.v6) return false;
+  const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
+  return addr.bits >> shift === prefix.bits >> shift;
+}
+var RESERVED = [
+  "0.0.0.0/8",
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "224.0.0.0/4",
+  "240.0.0.0/4",
+  "::/96",
+  "::ffff:0:0/96",
+  "fe80::/10",
+  "ff00::/8"
+].map((p) => parsePrefix(p));
+var Routes = class {
+  table = [];
+  exit = false;
+  ipv6;
+  constructor(ipv62 = false) {
+    this.ipv6 = ipv62;
+  }
+  set(table) {
+    const parsed = (table.prefixes ?? []).map(parsePrefix);
+    const bad = (table.prefixes ?? []).find((_, i) => !parsed[i]);
+    if (bad !== void 0) throw new Error(`not an address prefix: ${bad}`);
+    this.table = parsed;
+    this.exit = table.exit === true;
+  }
+  classify(host) {
+    const name2 = host.toLowerCase().replace(/\.$/, "");
+    if (name2 === "localhost" || name2.endsWith(".localhost") || name2 === "0.0.0.0") {
+      return "loopback";
+    }
+    if (name2 === HOST_LOOPBACK || name2 === HOST_ADDRESS) return "host";
+    const addr = addressBits(name2);
+    if (!addr) return "unreachable";
+    if (addr.v6 && addr.bits === 1n) return "loopback";
+    if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
+    if (RESERVED.some((p) => within2(p, addr))) return "reserved";
+    if (addr.v6 && !this.ipv6) return "unreachable";
+    if (this.exit || this.table.some((p) => within2(p, addr))) return "uplink";
+    return "unreachable";
+  }
+};
+
+// src/kernel/net/uplink.ts
+function answerOf(result) {
+  const answer = Array.isArray(result) ? { addresses: result } : result;
+  const addresses = Array.isArray(answer?.addresses) ? answer.addresses.filter((a) => typeof a === "string") : [];
+  return {
+    addresses,
+    ...typeof answer?.ttl === "number" && answer.ttl >= 0 ? { ttl: answer.ttl } : {}
+  };
+}
+var NEVER = new Routes(true);
+var RemoteUplink = class {
+  traits;
+  routes;
+  port;
+  waiting = /* @__PURE__ */ new Map();
+  nextId = 0;
+  constructor(port, traits, routes) {
+    this.port = port;
+    this.traits = traits;
+    this.routes = routes;
+  }
+  receive(reply) {
+    const waiter = this.waiting.get(reply.uid);
+    if (!waiter) return;
+    this.waiting.delete(reply.uid);
+    if (reply.uplink === "error") {
+      waiter.reject(Object.assign(new Error(reply.message), { code: reply.code }));
+    } else waiter.resolve(reply);
+  }
+  ask(call, signal, transfer) {
+    const waiter = Promise.withResolvers();
+    this.waiting.set(call.uid, waiter);
+    const abort = () => {
+      this.waiting.delete(call.uid);
+      this.port.postMessage({ uplink: "cancel", uid: call.uid });
+      waiter.reject(signal?.reason);
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+    const settled = () => signal?.removeEventListener("abort", abort);
+    waiter.promise.then(settled, settled);
+    this.port.postMessage(call, transfer);
+    return waiter.promise;
+  }
+  async resolve(name2, family, signal) {
+    const reply = await this.ask(
+      { uplink: "resolve", uid: ++this.nextId, name: name2, family },
+      signal
+    );
+    return answerOf(reply);
+  }
+  async dial(req) {
+    req.signal.throwIfAborted();
+    const { host, port } = req;
+    const opened2 = await this.ask(
+      { uplink: "dial", uid: ++this.nextId, host, port },
+      req.signal
+    );
+    const { cid, localAddr, remoteAddr } = opened2;
+    return {
+      localAddr,
+      remoteAddr,
+      read: async () => {
+        const got = await this.ask({
+          uplink: "read",
+          uid: ++this.nextId,
+          cid
+        });
+        return got.bytes;
+      },
+      write: async (bytes) => {
+        const copy = bytes.slice();
+        const call = { uplink: "write", uid: ++this.nextId, cid, bytes: copy };
+        const done4 = await this.ask(call, void 0, [
+          copy.buffer
+        ]);
+        return done4.n;
+      },
+      closeWrite: () => this.port.postMessage({ uplink: "close-write", cid }),
+      close: () => this.port.postMessage({ uplink: "close", cid })
+    };
+  }
+};
+
 // src/cdp/types.ts
 var CDP_PORT = 9222;
 var NO_CDP_HOST = "slicc-kernel: no CDP host is attached (createKernel({ cdp }) or client.serveCdp)";
@@ -4701,9 +5126,9 @@ function parseSize(text) {
   if (!match) throw errnoError("EINVAL", `not a size: ${text}`);
   return Math.floor(Number(match[1]) * UNITS[match[2].toLowerCase()]);
 }
-var within2 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var within3 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
 function heldUnder(held, target) {
-  for (const paths of held) for (const path of paths.keys()) if (within2(path, target)) return true;
+  for (const paths of held) for (const path of paths.keys()) if (within3(path, target)) return true;
   return false;
 }
 var HeldPaths = class extends Map {
@@ -4717,11 +5142,11 @@ var HeldPaths = class extends Map {
     }
   }
   revoke(prefix) {
-    for (const path of this.keys()) if (within2(path, prefix)) this.revoked.add(path);
+    for (const path of this.keys()) if (within3(path, prefix)) this.revoked.add(path);
   }
   renamed(from, to) {
     for (const [path, count] of [...this]) {
-      if (!within2(path, from)) continue;
+      if (!within3(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.delete(path);
       this.set(moved2, (this.get(moved2) ?? 0) + count);
@@ -4819,7 +5244,7 @@ var MountTable = class {
   locate(path) {
     let best;
     for (const mount of this.mounts.values()) {
-      if (within2(path, mount.target) && (!best || mount.target.length > best.target.length))
+      if (within3(path, mount.target) && (!best || mount.target.length > best.target.length))
         best = mount;
     }
     if (!best) return void 0;
@@ -4931,10 +5356,10 @@ var MountTable = class {
     this.deps.changed?.(...full);
   }
   forget(mount, path) {
-    for (const key of [...mount.attrs.keys()]) if (within2(key, path)) mount.attrs.delete(key);
+    for (const key of [...mount.attrs.keys()]) if (within3(key, path)) mount.attrs.delete(key);
     mount.lists.delete(path);
     mount.lists.delete(parentOf4(path));
-    for (const key of [...mount.lists.keys()]) if (within2(key, path)) mount.lists.delete(key);
+    for (const key of [...mount.lists.keys()]) if (within3(key, path)) mount.lists.delete(key);
   }
   async getattr(mount, path, rel2) {
     if (mount.conn.failure) throw mount.conn.failure;
@@ -5897,6 +6322,115 @@ var HttpHandles = class {
   }
 };
 
+// src/kernel/net/resolver.ts
+var RESOLVE_TTL_MAX = 60;
+var RESOLVE_TIMEOUT_MS = 1e4;
+var RESOLVE_CACHE_MAX = 256;
+var LOOPBACK_NAMES2 = /* @__PURE__ */ new Set(["localhost", "localhost.localdomain", "ip6-localhost", "::1"]);
+function hostsEntry(name2) {
+  if (LOOPBACK_NAMES2.has(name2) || name2.endsWith(".localhost")) return "127.0.0.1";
+  if (name2 === HOST_LOOPBACK) return HOST_LOOPBACK_ADDRESS.join(".");
+  return ipv4Bytes(name2) ? name2 : void 0;
+}
+var Resolver = class {
+  uplink;
+  routes;
+  now;
+  timeoutMs;
+  log;
+  cache = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.uplink = options.uplink;
+    this.routes = options.routes;
+    this.now = options.now ?? Date.now;
+    this.timeoutMs = options.timeoutMs ?? RESOLVE_TIMEOUT_MS;
+    this.log = options.log ?? ((message2) => console.warn(message2));
+  }
+  async resolve(name2, family, blocking) {
+    const key = name2.toLowerCase().replace(/\.$/, "");
+    const local = hostsEntry(key);
+    if (ipv6Groups(key)) {
+      const v4 = family !== 6 && local ? [local] : [];
+      return family === 4 ? v4 : [...v4, key];
+    }
+    if (local) {
+      const six = LOOPBACK_NAMES2.has(key) || key.endsWith(".localhost") ? ["::1"] : [];
+      return family === 6 ? six : family === 4 ? [local] : [local, ...six];
+    }
+    if (!this.uplink || key === "") return [];
+    const asked = this.uplink.traits.ipv6 ? family : 4;
+    if (family === 6 && asked !== 6) return [];
+    const id = `${asked}:${key}`;
+    const hit = this.cache.get(id);
+    if (hit && hit.expires > this.now()) return hit.addresses;
+    const signal = blocking?.();
+    if (signal?.aborted) throw new KernelError("EINTR");
+    let lookup = this.pending.get(id);
+    if (!lookup) {
+      const abort = new AbortController();
+      lookup = { work: this.lookup(key, asked, id, abort.signal), abort, waiters: 0 };
+      this.pending.set(id, lookup);
+      void lookup.work.then(() => this.pending.delete(id));
+    }
+    return waitFor(lookup, signal);
+  }
+  async lookup(name2, family, id, abandoned) {
+    const uplink = this.uplink;
+    const timeout = AbortSignal.any([AbortSignal.timeout(this.timeoutMs), abandoned]);
+    let answer;
+    try {
+      answer = answerOf(
+        await Promise.race([
+          uplink.resolve(name2, family, timeout),
+          new Promise(
+            (_, reject) => timeout.addEventListener("abort", () => reject(timeout.reason), { once: true })
+          )
+        ])
+      );
+    } catch {
+      return [];
+    }
+    const addresses = answer.addresses.filter((a) => this.usable(name2, a, family));
+    if (addresses.length > 0) this.remember(id, addresses, answer.ttl);
+    return addresses;
+  }
+  usable(name2, address, family) {
+    const v4 = ipv4Bytes(address) !== void 0;
+    if (!v4 && (family === 4 || !ipv6Groups(address))) return false;
+    if (v4 && family === 6) return false;
+    const kind = this.routes.classify(address);
+    if (kind !== "loopback" && kind !== "host" && kind !== "reserved") return true;
+    this.log(`slicc-kernel: dropped the uplink's answer ${address} for ${name2}: it is ${kind}`);
+    return false;
+  }
+  remember(id, addresses, ttl) {
+    const seconds = Math.min(ttl ?? RESOLVE_TTL_MAX, RESOLVE_TTL_MAX);
+    if (seconds <= 0) return;
+    this.cache.delete(id);
+    this.cache.set(id, { addresses, expires: this.now() + seconds * 1e3 });
+    if (this.cache.size > RESOLVE_CACHE_MAX) {
+      this.cache.delete(this.cache.keys().next().value);
+    }
+  }
+};
+function waitFor(lookup, signal) {
+  lookup.waiters++;
+  return new Promise((resolve, reject) => {
+    const abort = () => {
+      if (--lookup.waiters === 0) lookup.abort.abort(new KernelError("EINTR"));
+      reject(new KernelError("EINTR"));
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+    void lookup.work.then((value) => {
+      if (signal?.aborted) return;
+      lookup.waiters--;
+      signal?.removeEventListener("abort", abort);
+      resolve(value);
+    });
+  });
+}
+
 // src/kernel/tty.ts
 var ICRNL = 256;
 var IUTF8 = 16384;
@@ -6400,7 +6934,8 @@ var SOCKET_OPS = [
   "sock-shutdown",
   "sock-name",
   "sock-getopt",
-  "sock-setopt"
+  "sock-setopt",
+  "sock-resolve"
 ];
 function socketAt(fds, fd) {
   const file = fds.get(fd).file;
@@ -6431,10 +6966,15 @@ async function socketSyscall(req, proc) {
       return ok();
     case "sock-accept":
       return ok(await accept(proc, req.fd, req.nonblock));
-    case "sock-connect":
-      socketAt(fds, req.fd).connect(req.addr);
-      if (req.nonblock) throw new KernelError("EINPROGRESS");
+    case "sock-connect": {
+      const dialing = socketAt(fds, req.fd).connect(req.addr);
+      if (req.nonblock) {
+        dialing?.catch(() => void 0);
+        throw new KernelError("EINPROGRESS");
+      }
+      if (dialing !== void 0) await interruptible(dialing, proc.blocking());
       return ok();
+    }
     case "sock-shutdown":
       socketAt(fds, req.fd).shutdown(req.how);
       return ok();
@@ -6449,8 +6989,20 @@ async function socketSyscall(req, proc) {
     case "sock-setopt":
       socketAt(fds, req.fd).setOption(req.level, req.name, req.value);
       return ok();
+    case "sock-resolve": {
+      const addresses = await proc.resolve(req.name, req.family, () => proc.blocking());
+      if (addresses.length === 0) throw new KernelError("ENOENT");
+      return ok(addresses);
+    }
   }
 }
+function interruptible(dialing, signal) {
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(new KernelError("EINTR"));
+    signal.addEventListener("abort", abort, { once: true });
+    dialing.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+  });
+}
 function unnamed(domain) {
   return domain === "inet" ? { family: "inet", host: "0.0.0.0", port: 0 } : { family: "unix", path: "" };
 }
@@ -6700,7 +7252,7 @@ function isMissing(err) {
   if (err?.code === "ENOENT") return true;
   return err instanceof Error && err.message.startsWith("ENOENT");
 }
-function within3(path, root) {
+function within4(path, root) {
   return path === root || path.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 var VfsNode = class {
@@ -6908,7 +7460,7 @@ var VfsNodes = class {
     return node;
   }
   holds(prefix) {
-    for (const path of this.byPath.keys()) if (within3(path, prefix)) return true;
+    for (const path of this.byPath.keys()) if (within4(path, prefix)) return true;
     return false;
   }
   closed(node) {
@@ -6916,24 +7468,24 @@ var VfsNodes = class {
     if (node.opens === 0 && this.byPath.get(node.path) === node) this.byPath.delete(node.path);
   }
   async flush(path) {
-    for (const [p, node] of this.byPath) if (within3(p, path)) await node.serial(() => node.flush());
+    for (const [p, node] of this.byPath) if (within4(p, path)) await node.serial(() => node.flush());
   }
   async unlinking(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within3(held, path)) continue;
+      if (!within4(held, path)) continue;
       await node.serial(async () => void await Promise.all([node.keep(), node.limit()]));
     }
   }
   revoke(prefix) {
     for (const [path, node] of this.byPath) {
-      if (!within3(path, prefix)) continue;
+      if (!within4(path, prefix)) continue;
       node.revoke();
       this.byPath.delete(path);
     }
   }
   unlinked(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within3(held, path)) continue;
+      if (!within4(held, path)) continue;
       node.orphaned = true;
       this.byPath.delete(held);
     }
@@ -6942,8 +7494,8 @@ var VfsNodes = class {
     if (from === to) return;
     const moved2 = [];
     for (const [p, node] of this.byPath) {
-      if (within3(p, from)) moved2.push(node);
-      else if (within3(p, to)) {
+      if (within4(p, from)) moved2.push(node);
+      else if (within4(p, to)) {
         node.orphaned = true;
         this.byPath.delete(p);
       }
@@ -7197,6 +7749,7 @@ function isWasmSyscall(req) {
   return typeof op === "string" && SYSCALL_OPS.has(op);
 }
 var MAX_READ = 1024 * 1024;
+var HOSTS_ONLY = new Resolver({ routes: new Routes() });
 var WasmProcess = class {
   exited = false;
   children;
@@ -7588,10 +8141,12 @@ var WasmProcess = class {
   }
   socketSyscall(req) {
     this.net ??= this.options.net ?? new LoopbackNet();
+    const resolver = this.options.resolver ?? HOSTS_ONLY;
     return socketSyscall(req, {
       fds: this.fds,
       net: this.net,
-      blocking: () => this.blockingSignal()
+      blocking: () => this.blockingSignal(),
+      resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking)
     });
   }
   tty(fd) {
@@ -7786,6 +8341,7 @@ function spawnWasmProcess(opts) {
     http: opts.http,
     locks: opts.locks,
     onReap: opts.onReap,
+    resolver: opts.resolver,
     onPending: (sig) => void Atomics.or(header2, SAB_I_SIGNALS, sigbit(sig)),
     onTimer: (which) => void Atomics.or(header2, SAB_I_TIMERS, 1 << which),
     hasPending: () => Atomics.load(header2, SAB_I_SIGNALS) !== 0 || Atomics.load(header2, SAB_I_TIMERS) !== 0,
@@ -8867,7 +9423,7 @@ async function openHostfs(spec, hook, fetch2, timing = {}) {
 }
 
 // src/mount/chunked.ts
-var CHUNK2 = 1024 * 1024;
+var CHUNK3 = 1024 * 1024;
 var ChunkedBytes = class {
   chunks = [];
   size = 0;
@@ -8876,9 +9432,9 @@ var ChunkedBytes = class {
     if (end <= offset) return new Uint8Array(0);
     const out = new Uint8Array(end - offset);
     for (let at = offset; at < end; ) {
-      const index = Math.floor(at / CHUNK2);
-      const from = at - index * CHUNK2;
-      const n = Math.min(CHUNK2 - from, end - at);
+      const index = Math.floor(at / CHUNK3);
+      const from = at - index * CHUNK3;
+      const n = Math.min(CHUNK3 - from, end - at);
       const chunk2 = this.chunks[index];
       if (chunk2) out.set(chunk2.subarray(from, Math.min(from + n, chunk2.length)), at - offset);
       at += n;
@@ -8889,10 +9445,10 @@ var ChunkedBytes = class {
     const whole = owned && bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength;
     for (let done4 = 0; done4 < bytes.length; ) {
       const at = offset + done4;
-      const index = Math.floor(at / CHUNK2);
-      const from = at - index * CHUNK2;
-      const n = Math.min(CHUNK2 - from, bytes.length - done4);
-      if (whole && n === CHUNK2 && bytes.length === CHUNK2) this.chunks[index] = bytes;
+      const index = Math.floor(at / CHUNK3);
+      const from = at - index * CHUNK3;
+      const n = Math.min(CHUNK3 - from, bytes.length - done4);
+      if (whole && n === CHUNK3 && bytes.length === CHUNK3) this.chunks[index] = bytes;
       else this.room(index, from + n).set(bytes.subarray(done4, done4 + n), from);
       done4 += n;
     }
@@ -8900,10 +9456,10 @@ var ChunkedBytes = class {
   }
   truncate(size) {
     if (size < this.size) {
-      const keep = Math.ceil(size / CHUNK2);
+      const keep = Math.ceil(size / CHUNK3);
       this.chunks.length = Math.min(this.chunks.length, keep);
       const tail = this.chunks[keep - 1];
-      const from = size - (keep - 1) * CHUNK2;
+      const from = size - (keep - 1) * CHUNK3;
       if (tail && from < tail.length) tail.fill(0, from);
     }
     this.size = size;
@@ -8911,7 +9467,7 @@ var ChunkedBytes = class {
   room(index, need) {
     const chunk2 = this.chunks[index];
     if (chunk2 && chunk2.length >= need) return chunk2;
-    const grown = new Uint8Array(Math.min(CHUNK2, Math.max(need, (chunk2?.length ?? 0) * 2)));
+    const grown = new Uint8Array(Math.min(CHUNK3, Math.max(need, (chunk2?.length ?? 0) * 2)));
     if (chunk2) grown.set(chunk2);
     this.chunks[index] = grown;
     return grown;
@@ -9325,6 +9881,9 @@ var Launcher = class {
   cdp;
   ca;
   transport;
+  uplink;
+  routes;
+  resolver;
   watchers = new FsWatchers();
   pnpmHome;
   mounts;
@@ -9364,6 +9923,11 @@ var Launcher = class {
     this.env = { ...networkEnv(), SLICC_CDP_URL: this.cdp.url, ...options.env };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
     this.transport = options.transport ?? missingTransport();
+    this.uplink = options.uplink;
+    this.routes = new Routes(options.uplink?.traits.ipv6 === true);
+    if (options.uplink?.routes) this.routes.set(options.uplink.routes);
+    this.resolver = new Resolver({ uplink: options.uplink, routes: this.routes });
+    if (options.uplink) this.net.useUplink({ uplink: options.uplink, routes: this.routes });
     enableNetwork(this.net, {
       transport: this.transport,
       engine: kernelTlsEngine(packageTlsEngine(options.fs, this.modulesDir)),
@@ -9378,6 +9942,9 @@ var Launcher = class {
       this.catalog = void 0;
     });
   }
+  setRoutes(table) {
+    this.routes.set(table);
+  }
   commands() {
     this.catalog ??= this.roots().then((roots) => scanCommands(this.base, roots));
     return this.catalog;
@@ -9557,6 +10124,7 @@ var Launcher = class {
       net: this.net,
       http: new HttpHandles(this.transport),
       locks: this.locks,
+      resolver: this.resolver,
       onReap: (child) => this.reaped(child),
       ...req.fork ? { fork: req.fork } : {},
       ...this.shownIds(req)
@@ -9959,9 +10527,22 @@ function cdpOption(req, port) {
     )
   };
 }
+function remotes(port, req) {
+  return {
+    ...req.transport ? { transport: new RemoteTransport(port, req.transport) } : {},
+    ...req.uplink ? { uplink: new RemoteUplink(port, req.uplink.traits, req.uplink.routes) } : {}
+  };
+}
+function answered(data, remote, uplink) {
+  if (data.net !== void 0) remote?.receive(data);
+  else if (typeof data.uplink === "string") uplink?.receive(data);
+  else return false;
+  return true;
+}
 function serveKernel(port, deps) {
   let launcher;
   let remote;
+  let uplink;
   const terminals = /* @__PURE__ */ new Map();
   const reply = (id, body, transfer) => port.postMessage({ id, ...body }, transfer);
   const clients = /* @__PURE__ */ new Set();
@@ -10017,7 +10598,8 @@ function serveKernel(port, deps) {
     launcher = (req.root ? Promise.resolve(req.root) : deps.storage()).then(async (root) => {
       const name2 = req.metadata ?? META_DB;
       const { meta, media } = await stores(deps, name2, req.media);
-      remote = req.transport ? new RemoteTransport(port, req.transport) : void 0;
+      const net = remotes(port, req);
+      ({ transport: remote, uplink } = net);
       const ranged2 = await inOpfs(deps, root);
       const fs = new OpfsFs(root, meta, dirsChannel(name2), { ranged: ranged2 });
       await fs.reconcile();
@@ -10027,7 +10609,7 @@ function serveKernel(port, deps) {
         ...deps.createDriverWorker ? { createDriverWorker: deps.createDriverWorker } : {},
         ...req.modules ? { modules: req.modules } : {},
         ...req.env ? { env: req.env } : {},
-        ...remote ? { transport: remote } : {},
+        ...net,
         ...media ? { media } : {},
         onMountPending: (medium) => port.postMessage({ medium }),
         ...req.hostfs ? { hostfs: askGrant } : {},
@@ -10052,6 +10634,10 @@ function serveKernel(port, deps) {
     if (req.op === "init") return init(req);
     if (req.op === "open-terminal") return terminal(req);
     if (req.op === "connect") return connect();
+    if (req.op === "routes") {
+      (await ready2()).setRoutes(req.routes);
+      return true;
+    }
     if (req.op === "dial") return dial(req);
     if (req.op === "mount" || req.op === "umount" || req.op === "mounts" || req.op === "insert")
       return mountOp(req);
@@ -10100,10 +10686,7 @@ function serveKernel(port, deps) {
       policies.delete(answer.id);
       return;
     }
-    if (event.data.net !== void 0) {
-      remote?.receive(event.data);
-      return;
-    }
+    if (answered(event.data, remote, uplink)) return;
     const req = event.data;
     handle(req).then(
       (result) => reply(req.id, { result }, result instanceof MessagePort ? [result] : void 0),