@ai-ecoverse/slicc-kernel 1.26.6 → 1.28.0

package/dist/node.js

@@ -465,6 +465,170 @@ var FdTable = class _FdTable {
   }
 };
 
+// src/process/wasi/wasi-abi.ts
+var E = {
+  SUCCESS: 0,
+  "2BIG": 1,
+  ACCES: 2,
+  ADDRINUSE: 3,
+  ADDRNOTAVAIL: 4,
+  AFNOSUPPORT: 5,
+  AGAIN: 6,
+  ALREADY: 7,
+  BADF: 8,
+  BADMSG: 9,
+  BUSY: 10,
+  CANCELED: 11,
+  CHILD: 12,
+  CONNABORTED: 13,
+  CONNREFUSED: 14,
+  CONNRESET: 15,
+  DEADLK: 16,
+  DESTADDRREQ: 17,
+  DOM: 18,
+  DQUOT: 19,
+  EXIST: 20,
+  FAULT: 21,
+  FBIG: 22,
+  HOSTUNREACH: 23,
+  IDRM: 24,
+  ILSEQ: 25,
+  INPROGRESS: 26,
+  INTR: 27,
+  INVAL: 28,
+  IO: 29,
+  ISCONN: 30,
+  ISDIR: 31,
+  LOOP: 32,
+  MFILE: 33,
+  MLINK: 34,
+  MSGSIZE: 35,
+  MULTIHOP: 36,
+  NAMETOOLONG: 37,
+  NETDOWN: 38,
+  NETRESET: 39,
+  NETUNREACH: 40,
+  NFILE: 41,
+  NOBUFS: 42,
+  NODEV: 43,
+  NOENT: 44,
+  NOEXEC: 45,
+  NOLCK: 46,
+  NOLINK: 47,
+  NOMEM: 48,
+  NOMSG: 49,
+  NOPROTOOPT: 50,
+  NOSPC: 51,
+  NOSYS: 52,
+  NOTCONN: 53,
+  NOTDIR: 54,
+  NOTEMPTY: 55,
+  NOTRECOVERABLE: 56,
+  NOTSOCK: 57,
+  NOTSUP: 58,
+  NOTTY: 59,
+  NXIO: 60,
+  OVERFLOW: 61,
+  OWNERDEAD: 62,
+  PERM: 63,
+  PIPE: 64,
+  PROTO: 65,
+  PROTONOSUPPORT: 66,
+  PROTOTYPE: 67,
+  RANGE: 68,
+  ROFS: 69,
+  SPIPE: 70,
+  SRCH: 71,
+  STALE: 72,
+  TIMEDOUT: 73,
+  TXTBSY: 74,
+  XDEV: 75,
+  NOTCAPABLE: 76
+};
+var RIGHTS = {
+  FD_DATASYNC: 1n << 0n,
+  FD_READ: 1n << 1n,
+  FD_SEEK: 1n << 2n,
+  FD_FDSTAT_SET_FLAGS: 1n << 3n,
+  FD_SYNC: 1n << 4n,
+  FD_TELL: 1n << 5n,
+  FD_WRITE: 1n << 6n,
+  ALL: (1n << 30n) - 1n
+};
+var WASI_SIGNAL_TO_POSIX = Object.fromEntries(
+  Array.from({ length: 30 }, (_, i) => [i + 1, i + 1 < 16 ? i + 1 : i + 2])
+);
+
+// src/process/wasi-errno.ts
+var WASI_ERRNO = {
+  ...Object.fromEntries(Object.entries(E).map(([name2, errno]) => [`E${name2}`, errno])),
+  EWOULDBLOCK: E.AGAIN,
+  ENOTSUP: 138,
+  EOPNOTSUPP: 138,
+  ENOMEDIUM: 148
+};
+function wasiErrno(code) {
+  return WASI_ERRNO[code] ?? E.IO;
+}
+
+// src/kernel/net/uplink-socket.ts
+var CHUNK = 64 * 1024;
+function hostPort(text) {
+  const match = /^\[?([^\]]*?)\]?:(\d{1,5})$/.exec(text);
+  const port = Number(match?.[2]);
+  const host = match?.[1];
+  if (!host || port > 65535) return void 0;
+  return { host, port };
+}
+async function inbound(conn, rx) {
+  for (; ; ) {
+    while (!rx.writeReady) await rx.changed();
+    if (rx.readersGone) return;
+    const bytes = await conn.read();
+    if (!bytes) return;
+    await rx.write(bytes);
+  }
+}
+async function outbound(conn, tx) {
+  for (; ; ) {
+    const bytes = await tx.read(CHUNK);
+    if (bytes.length === 0) {
+      conn.closeWrite();
+      return;
+    }
+    for (let at = 0; at < bytes.length; ) {
+      const n = await conn.write(bytes.subarray(at));
+      if (!(n > 0)) throw new Error("the uplink wrote nothing");
+      at += n;
+    }
+  }
+}
+async function released(rx, tx) {
+  while (!(rx.readersGone && tx.writersGone)) await Promise.race([rx.changed(), tx.changed()]);
+}
+function uplinkLink(conn, onReset) {
+  const rx = new KernelPipe();
+  const tx = new KernelPipe();
+  for (const pipe of [rx, tx]) {
+    pipe.openRead();
+    pipe.openWrite();
+  }
+  let open = true;
+  const close = () => {
+    if (!open) return;
+    open = false;
+    conn.close();
+  };
+  void inbound(conn, rx).catch(() => {
+    onReset();
+    close();
+    tx.closeRead();
+  }).finally(() => rx.closeWrite());
+  void outbound(conn, tx).catch(close).finally(() => tx.closeRead());
+  void released(rx, tx).then(close);
+  return { rx, tx };
+}
+
 // src/kernel/socket.ts
 var SOMAXCONN = 4096;
 var EPHEMERAL_FIRST = 32768;
@@ -482,6 +646,21 @@ var AF_INET = 2;
 var SHUT_RD = 0;
 var SHUT_WR = 1;
 var SHUT_RDWR = 2;
+var DIAL_TIMEOUT_MS = 3e4;
+var DIAL_ERRORS = [
+  "ECONNREFUSED",
+  "ENETUNREACH",
+  "EHOSTUNREACH",
+  "ETIMEDOUT",
+  "ECONNRESET"
+];
+function dialError(e, timedOut, closed) {
+  if (timedOut) return new KernelError("ETIMEDOUT");
+  if (closed) return new KernelError("ECONNABORTED");
+  const code = e?.code;
+  const known = DIAL_ERRORS.find((errno) => errno === code);
+  return new KernelError(known ?? "EHOSTUNREACH");
+}
 function isLoopback(host) {
   return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
 }
@@ -530,6 +709,9 @@ var KernelSocket = class _KernelSocket {
   net;
   domain;
   state = "open";
+  dialing;
+  failed;
+  reset = false;
   local;
   peer;
   link;
@@ -537,7 +719,7 @@ var KernelSocket = class _KernelSocket {
   writeShut = false;
   queue = [];
   backlog = 0;
-  bound = false;
+  boundAt;
   changes = new Changes();
   options = /* @__PURE__ */ new Map();
   constructor(net, domain) {
@@ -559,12 +741,16 @@ var KernelSocket = class _KernelSocket {
   async read(max, signal) {
     const { rx } = this.connection();
     if (this.readShut || max <= 0) return new Uint8Array(0);
-    return pipeCall(() => rx.read(max, signal));
+    const bytes = await pipeCall(() => rx.read(max, signal));
+    if (bytes.length === 0 && this.reset) throw new KernelError("ECONNRESET");
+    return bytes;
   }
   async peek(max, signal) {
     const { rx } = this.connection();
     if (this.readShut || max <= 0) return new Uint8Array(0);
-    return pipeCall(() => rx.peek(max, signal));
+    const bytes = await pipeCall(() => rx.peek(max, signal));
+    if (bytes.length === 0 && this.reset) throw new KernelError("ECONNRESET");
+    return bytes;
   }
   async write(bytes, signal) {
     const { tx } = this.connection();
@@ -575,6 +761,8 @@ var KernelSocket = class _KernelSocket {
     if (this.state === "listening") {
       return { readable: this.queue.length > 0, writable: false, hangup: false };
     }
+    if (this.state === "connecting") return { readable: false, writable: false, hangup: false };
+    if (this.failed) return { readable: true, writable: true, hangup: true };
     if (this.state !== "connected" || !this.link) {
       return { readable: false, writable: false, hangup: true };
     }
@@ -596,7 +784,7 @@ var KernelSocket = class _KernelSocket {
     if (this.state !== "open" || this.local) throw new KernelError("EINVAL");
     if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
     this.local = this.net.bind(this, addr);
-    this.bound = true;
+    this.boundAt = this.local;
   }
   listen(backlog) {
     if (this.state === "connected") throw new KernelError("EISCONN");
@@ -623,15 +811,19 @@ var KernelSocket = class _KernelSocket {
     this.changes.wake();
     return true;
   }
-  connect(addr) {
+  connect(addr, viaUplink = true) {
     if (this.state === "connected") throw new KernelError("EISCONN");
+    if (this.state === "connecting") throw new KernelError("EALREADY");
     if (this.state !== "open") throw new KernelError("EINVAL");
     if (addr.family !== this.domain) throw new KernelError("EAFNOSUPPORT");
+    this.failed = void 0;
+    const route = viaUplink && addr.family === "inet" ? this.net.uplinkFor(addr.host) : void 0;
+    if (route) return this.dial(addr, route);
     const target = this.net.target(addr);
     if (!this.local) {
       if (addr.family === "inet") {
         this.local = this.net.bind(this, { family: "inet", host: "127.0.0.1", port: 0 });
-        this.bound = true;
+        this.boundAt = this.local;
       } else this.local = { family: "unix", path: "" };
     }
     const server = new _KernelSocket(this.net, this.domain);
@@ -644,6 +836,52 @@ var KernelSocket = class _KernelSocket {
       server.close();
       throw new KernelError("ECONNREFUSED");
     }
+    return void 0;
+  }
+  dial(addr, route) {
+    this.state = "connecting";
+    const abort = new AbortController();
+    this.dialing = abort;
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      abort.abort(new KernelError("ETIMEDOUT"));
+    }, route.timeoutMs ?? DIAL_TIMEOUT_MS);
+    const abandoned = new Promise((_, reject) => {
+      abort.signal.addEventListener("abort", () => reject(abort.signal.reason), { once: true });
+    });
+    const { host, port } = addr;
+    const dialled = new Promise(
+      (resolve) => resolve(route.uplink.dial({ network: "tcp", host, port, signal: abort.signal }))
+    );
+    dialled.then(
+      (conn) => abort.signal.aborted && conn.close(),
+      () => void 0
+    );
+    return Promise.race([dialled, abandoned]).then(
+      (conn) => {
+        if (abort.signal.aborted) throw dialError(abort.signal.reason, timedOut, true);
+        this.local = { family: "inet", host: "0.0.0.0", port: 0, ...hostPort(conn.localAddr) };
+        this.peer = { ...addr, ...hostPort(conn.remoteAddr) };
+        this.dialing = void 0;
+        this.attach(
+          uplinkLink(conn, () => {
+            this.reset = true;
+            this.changes.wake();
+          })
+        );
+      },
+      (e) => {
+        const error = dialError(e, timedOut, abort.signal.aborted);
+        if (this.dialing === abort) {
+          this.dialing = void 0;
+          this.failed = error.code;
+          this.state = "open";
+          this.changes.wake();
+        }
+        throw error;
+      }
+    ).finally(() => clearTimeout(timer));
   }
   unlink() {
     const link2 = this.link;
@@ -673,8 +911,11 @@ var KernelSocket = class _KernelSocket {
       switch (name2) {
         case SO_TYPE:
           return SOCK_STREAM;
-        case SO_ERROR:
-          return 0;
+        case SO_ERROR: {
+          const failed = this.failed;
+          this.failed = void 0;
+          return failed ? wasiErrno(failed) : 0;
+        }
         case SO_ACCEPTCONN:
           return this.state === "listening" ? 1 : 0;
         case SO_DOMAIN:
@@ -692,6 +933,8 @@ var KernelSocket = class _KernelSocket {
   close() {
     const was = this.state;
     this.state = "closed";
+    this.dialing?.abort(new KernelError("ECONNABORTED"));
+    this.dialing = void 0;
     if (was === "listening") {
       for (const pending of this.queue.splice(0)) pending.close();
     }
@@ -701,8 +944,8 @@ var KernelSocket = class _KernelSocket {
       this.readShut = true;
       this.writeShut = true;
     }
-    if (this.bound && this.local) this.net.release(this.local, this);
-    this.bound = false;
+    if (this.boundAt) this.net.release(this.boundAt, this);
+    this.boundAt = void 0;
     this.changes.wake();
   }
   static pair(net, domain) {
@@ -725,6 +968,15 @@ var LoopbackNet = class {
   activators = /* @__PURE__ */ new Map();
   internal = /* @__PURE__ */ new Set();
   nextEphemeral = EPHEMERAL_FIRST;
+  route;
+  useUplink(route) {
+    this.route = route;
+  }
+  uplinkFor(host) {
+    const route = this.route;
+    if (!route) return void 0;
+    return route.routes.classify(host) === "uplink" ? route : void 0;
+  }
   kernelOnly(port, reserve = false) {
     if (reserve) this.internal.add(port);
     return this.internal.has(port);
@@ -743,7 +995,7 @@ var LoopbackNet = class {
   }
   connect(addr) {
     const socket = this.socket(addr.family);
-    socket.connect(addr);
+    void socket.connect(addr, false);
     return socket;
   }
   bind(socket, addr) {
@@ -784,7 +1036,7 @@ var LoopbackNet = class {
 };
 
 // src/kernel/dial.ts
-var CHUNK = 64 * 1024;
+var CHUNK2 = 64 * 1024;
 var LOOPBACK_NAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1", "[::1]"]);
 function dialSocket(net, port, host = "127.0.0.1") {
   if (!Number.isInteger(port) || port < 1 || port > 65535) throw new KernelError("EINVAL");
@@ -849,7 +1101,7 @@ function serveSocket(socket, port, onClose) {
       for (; ; ) {
         await turn();
         if (closed) return;
-        const chunk2 = await socket.read(CHUNK);
+        const chunk2 = await socket.read(CHUNK2);
         if (chunk2.length === 0) break;
         credit--;
         send(chunk2, [chunk2.buffer]);
@@ -1084,7 +1336,7 @@ function serveTransport(peer, transport) {
 }
 
 // src/client/protocol.ts
-var PROTOCOL = [1, 5];
+var PROTOCOL = [1, 7];
 var FS_METHODS = [
   "readFile",
   "writeFile",
@@ -4491,6 +4743,7 @@ async function hostSyscall(req, ctx) {
 
 // src/kernel/net/loopback-names.ts
 var HOST_LOOPBACK = "host.slicc.internal";
+var HOST_LOOPBACK_ADDRESS = [10, 0, 2, 2];
 var PAGE_LOOPBACK = "kernel.localhost";
 var PAGE_LOOPBACK_URL = `http://{port}.${PAGE_LOOPBACK}`;
 function toHostLoopback(href) {
@@ -5687,6 +5940,215 @@ var HttpHandles = class {
   }
 };
 
+// src/kernel/net/routes.ts
+var HOST_ADDRESS = HOST_LOOPBACK_ADDRESS.join(".");
+function ipv4Bytes(text) {
+  const parts = text.split(".");
+  if (parts.length !== 4 || !parts.every((p) => /^\d{1,3}$/.test(p))) return void 0;
+  const bytes = parts.map(Number);
+  return bytes.every((b) => b <= 255) ? bytes : void 0;
+}
+function ipv6Groups(text) {
+  if (!text.includes(":")) return void 0;
+  let canonical;
+  try {
+    canonical = new URL(`http://[${text}]/`).hostname.slice(1, -1);
+  } catch {
+    return void 0;
+  }
+  const [head, tail] = canonical.split("::");
+  const part = (s) => s ? s.split(":").map((h) => Number.parseInt(h, 16)) : [];
+  const front = part(head);
+  const back = part(tail);
+  return tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
+}
+function toBits(values, width) {
+  return values.reduce((acc, v) => acc << BigInt(width) | BigInt(v), 0n);
+}
+function addressBits(host) {
+  const v4 = ipv4Bytes(host);
+  if (v4) return { v6: false, bits: toBits(v4, 8) };
+  const v6 = ipv6Groups(host);
+  return v6 ? { v6: true, bits: toBits(v6, 16) } : void 0;
+}
+function parsePrefix(text) {
+  const parts = text.trim().split("/");
+  if (parts.length > 2) return void 0;
+  const [address = "", size] = parts;
+  const parsed = addressBits(address);
+  if (!parsed) return void 0;
+  const max = parsed.v6 ? 128 : 32;
+  const length2 = size === void 0 ? max : /^\d{1,3}$/.test(size) ? Number(size) : -1;
+  if (length2 < 0 || length2 > max) return void 0;
+  return { ...parsed, length: length2 };
+}
+function within3(prefix, addr) {
+  if (prefix.v6 !== addr.v6) return false;
+  const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
+  return addr.bits >> shift === prefix.bits >> shift;
+}
+var RESERVED = [
+  "0.0.0.0/8",
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "224.0.0.0/4",
+  "240.0.0.0/4",
+  "::/96",
+  "::ffff:0:0/96",
+  "fe80::/10",
+  "ff00::/8"
+].map((p) => parsePrefix(p));
+var Routes = class {
+  table = [];
+  exit = false;
+  ipv6;
+  constructor(ipv62 = false) {
+    this.ipv6 = ipv62;
+  }
+  set(table) {
+    const parsed = (table.prefixes ?? []).map(parsePrefix);
+    const bad = (table.prefixes ?? []).find((_, i) => !parsed[i]);
+    if (bad !== void 0) throw new Error(`not an address prefix: ${bad}`);
+    this.table = parsed;
+    this.exit = table.exit === true;
+  }
+  classify(host) {
+    const name2 = host.toLowerCase().replace(/\.$/, "");
+    if (name2 === "localhost" || name2.endsWith(".localhost") || name2 === "0.0.0.0") {
+      return "loopback";
+    }
+    if (name2 === HOST_LOOPBACK || name2 === HOST_ADDRESS) return "host";
+    const addr = addressBits(name2);
+    if (!addr) return "unreachable";
+    if (addr.v6 && addr.bits === 1n) return "loopback";
+    if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
+    if (RESERVED.some((p) => within3(p, addr))) return "reserved";
+    if (addr.v6 && !this.ipv6) return "unreachable";
+    if (this.exit || this.table.some((p) => within3(p, addr))) return "uplink";
+    return "unreachable";
+  }
+};
+
+// src/kernel/net/uplink.ts
+function answerOf(result) {
+  const answer = Array.isArray(result) ? { addresses: result } : result;
+  const addresses = Array.isArray(answer?.addresses) ? answer.addresses.filter((a) => typeof a === "string") : [];
+  return {
+    addresses,
+    ...typeof answer?.ttl === "number" && answer.ttl >= 0 ? { ttl: answer.ttl } : {}
+  };
+}
+var NEVER = new Routes(true);
+
+// src/kernel/net/resolver.ts
+var RESOLVE_TTL_MAX = 60;
+var RESOLVE_TIMEOUT_MS = 1e4;
+var RESOLVE_CACHE_MAX = 256;
+var LOOPBACK_NAMES2 = /* @__PURE__ */ new Set(["localhost", "localhost.localdomain", "ip6-localhost", "::1"]);
+function hostsEntry(name2) {
+  if (LOOPBACK_NAMES2.has(name2) || name2.endsWith(".localhost")) return "127.0.0.1";
+  if (name2 === HOST_LOOPBACK) return HOST_LOOPBACK_ADDRESS.join(".");
+  return ipv4Bytes(name2) ? name2 : void 0;
+}
+var Resolver = class {
+  uplink;
+  routes;
+  now;
+  timeoutMs;
+  log;
+  cache = /* @__PURE__ */ new Map();
+  pending = /* @__PURE__ */ new Map();
+  constructor(options) {
+    this.uplink = options.uplink;
+    this.routes = options.routes;
+    this.now = options.now ?? Date.now;
+    this.timeoutMs = options.timeoutMs ?? RESOLVE_TIMEOUT_MS;
+    this.log = options.log ?? ((message2) => console.warn(message2));
+  }
+  async resolve(name2, family, blocking) {
+    const key = name2.toLowerCase().replace(/\.$/, "");
+    const local = hostsEntry(key);
+    if (ipv6Groups(key)) {
+      const v4 = family !== 6 && local ? [local] : [];
+      return family === 4 ? v4 : [...v4, key];
+    }
+    if (local) {
+      const six = LOOPBACK_NAMES2.has(key) || key.endsWith(".localhost") ? ["::1"] : [];
+      return family === 6 ? six : family === 4 ? [local] : [local, ...six];
+    }
+    if (!this.uplink || key === "") return [];
+    const asked = this.uplink.traits.ipv6 ? family : 4;
+    if (family === 6 && asked !== 6) return [];
+    const id = `${asked}:${key}`;
+    const hit = this.cache.get(id);
+    if (hit && hit.expires > this.now()) return hit.addresses;
+    const signal = blocking?.();
+    if (signal?.aborted) throw new KernelError("EINTR");
+    let lookup = this.pending.get(id);
+    if (!lookup) {
+      const abort = new AbortController();
+      lookup = { work: this.lookup(key, asked, id, abort.signal), abort, waiters: 0 };
+      this.pending.set(id, lookup);
+      void lookup.work.then(() => this.pending.delete(id));
+    }
+    return waitFor(lookup, signal);
+  }
+  async lookup(name2, family, id, abandoned) {
+    const uplink = this.uplink;
+    const timeout = AbortSignal.any([AbortSignal.timeout(this.timeoutMs), abandoned]);
+    let answer;
+    try {
+      answer = answerOf(
+        await Promise.race([
+          uplink.resolve(name2, family, timeout),
+          new Promise(
+            (_, reject) => timeout.addEventListener("abort", () => reject(timeout.reason), { once: true })
+          )
+        ])
+      );
+    } catch {
+      return [];
+    }
+    const addresses = answer.addresses.filter((a) => this.usable(name2, a, family));
+    if (addresses.length > 0) this.remember(id, addresses, answer.ttl);
+    return addresses;
+  }
+  usable(name2, address, family) {
+    const v4 = ipv4Bytes(address) !== void 0;
+    if (!v4 && (family === 4 || !ipv6Groups(address))) return false;
+    if (v4 && family === 6) return false;
+    const kind = this.routes.classify(address);
+    if (kind !== "loopback" && kind !== "host" && kind !== "reserved") return true;
+    this.log(`slicc-kernel: dropped the uplink's answer ${address} for ${name2}: it is ${kind}`);
+    return false;
+  }
+  remember(id, addresses, ttl) {
+    const seconds = Math.min(ttl ?? RESOLVE_TTL_MAX, RESOLVE_TTL_MAX);
+    if (seconds <= 0) return;
+    this.cache.delete(id);
+    this.cache.set(id, { addresses, expires: this.now() + seconds * 1e3 });
+    if (this.cache.size > RESOLVE_CACHE_MAX) {
+      this.cache.delete(this.cache.keys().next().value);
+    }
+  }
+};
+function waitFor(lookup, signal) {
+  lookup.waiters++;
+  return new Promise((resolve, reject) => {
+    const abort = () => {
+      if (--lookup.waiters === 0) lookup.abort.abort(new KernelError("EINTR"));
+      reject(new KernelError("EINTR"));
+    };
+    signal?.addEventListener("abort", abort, { once: true });
+    void lookup.work.then((value) => {
+      if (signal?.aborted) return;
+      lookup.waiters--;
+      signal?.removeEventListener("abort", abort);
+      resolve(value);
+    });
+  });
+}
+
 // src/kernel/tty.ts
 var ICRNL = 256;
 var IUTF8 = 16384;
@@ -6190,7 +6652,8 @@ var SOCKET_OPS = [
   "sock-shutdown",
   "sock-name",
   "sock-getopt",
-  "sock-setopt"
+  "sock-setopt",
+  "sock-resolve"
 ];
 function socketAt(fds, fd) {
   const file = fds.get(fd).file;
@@ -6221,10 +6684,15 @@ async function socketSyscall(req, proc) {
       return ok();
     case "sock-accept":
       return ok(await accept(proc, req.fd, req.nonblock));
-    case "sock-connect":
-      socketAt(fds, req.fd).connect(req.addr);
-      if (req.nonblock) throw new KernelError("EINPROGRESS");
+    case "sock-connect": {
+      const dialing = socketAt(fds, req.fd).connect(req.addr);
+      if (req.nonblock) {
+        dialing?.catch(() => void 0);
+        throw new KernelError("EINPROGRESS");
+      }
+      if (dialing !== void 0) await interruptible(dialing, proc.blocking());
       return ok();
+    }
     case "sock-shutdown":
       socketAt(fds, req.fd).shutdown(req.how);
       return ok();
@@ -6239,8 +6707,20 @@ async function socketSyscall(req, proc) {
     case "sock-setopt":
       socketAt(fds, req.fd).setOption(req.level, req.name, req.value);
       return ok();
+    case "sock-resolve": {
+      const addresses = await proc.resolve(req.name, req.family, () => proc.blocking());
+      if (addresses.length === 0) throw new KernelError("ENOENT");
+      return ok(addresses);
+    }
   }
 }
+function interruptible(dialing, signal) {
+  return new Promise((resolve, reject) => {
+    const abort = () => reject(new KernelError("EINTR"));
+    signal.addEventListener("abort", abort, { once: true });
+    dialing.then(resolve, reject).finally(() => signal.removeEventListener("abort", abort));
+  });
+}
 function unnamed(domain) {
   return domain === "inet" ? { family: "inet", host: "0.0.0.0", port: 0 } : { family: "unix", path: "" };
 }
@@ -6490,7 +6970,7 @@ function isMissing(err) {
   if (err?.code === "ENOENT") return true;
   return err instanceof Error && err.message.startsWith("ENOENT");
 }
-function within3(path, root) {
+function within4(path, root) {
   return path === root || path.startsWith(root.endsWith("/") ? root : `${root}/`);
 }
 var VfsNode = class {
@@ -6698,7 +7178,7 @@ var VfsNodes = class {
     return node;
   }
   holds(prefix) {
-    for (const path of this.byPath.keys()) if (within3(path, prefix)) return true;
+    for (const path of this.byPath.keys()) if (within4(path, prefix)) return true;
     return false;
   }
   closed(node) {
@@ -6706,24 +7186,24 @@ var VfsNodes = class {
     if (node.opens === 0 && this.byPath.get(node.path) === node) this.byPath.delete(node.path);
   }
   async flush(path) {
-    for (const [p, node] of this.byPath) if (within3(p, path)) await node.serial(() => node.flush());
+    for (const [p, node] of this.byPath) if (within4(p, path)) await node.serial(() => node.flush());
   }
   async unlinking(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within3(held, path)) continue;
+      if (!within4(held, path)) continue;
       await node.serial(async () => void await Promise.all([node.keep(), node.limit()]));
     }
   }
   revoke(prefix) {
     for (const [path, node] of this.byPath) {
-      if (!within3(path, prefix)) continue;
+      if (!within4(path, prefix)) continue;
       node.revoke();
       this.byPath.delete(path);
     }
   }
   unlinked(path) {
     for (const [held, node] of [...this.byPath]) {
-      if (!within3(held, path)) continue;
+      if (!within4(held, path)) continue;
       node.orphaned = true;
       this.byPath.delete(held);
     }
@@ -6732,8 +7212,8 @@ var VfsNodes = class {
     if (from === to) return;
     const moved2 = [];
     for (const [p, node] of this.byPath) {
-      if (within3(p, from)) moved2.push(node);
-      else if (within3(p, to)) {
+      if (within4(p, from)) moved2.push(node);
+      else if (within4(p, to)) {
         node.orphaned = true;
         this.byPath.delete(p);
       }
@@ -6987,6 +7467,7 @@ function isWasmSyscall(req) {
   return typeof op === "string" && SYSCALL_OPS.has(op);
 }
 var MAX_READ = 1024 * 1024;
+var HOSTS_ONLY = new Resolver({ routes: new Routes() });
 var WasmProcess = class {
   exited = false;
   children;
@@ -7378,10 +7859,12 @@ var WasmProcess = class {
   }
   socketSyscall(req) {
     this.net ??= this.options.net ?? new LoopbackNet();
+    const resolver = this.options.resolver ?? HOSTS_ONLY;
     return socketSyscall(req, {
       fds: this.fds,
       net: this.net,
-      blocking: () => this.blockingSignal()
+      blocking: () => this.blockingSignal(),
+      resolve: (name2, family, blocking) => resolver.resolve(name2, family, blocking)
     });
   }
   tty(fd) {
@@ -7576,6 +8059,7 @@ function spawnWasmProcess(opts) {
     http: opts.http,
     locks: opts.locks,
     onReap: opts.onReap,
+    resolver: opts.resolver,
     onPending: (sig) => void Atomics.or(header3, SAB_I_SIGNALS, sigbit(sig)),
     onTimer: (which) => void Atomics.or(header3, SAB_I_TIMERS, 1 << which),
     hasPending: () => Atomics.load(header3, SAB_I_SIGNALS) !== 0 || Atomics.load(header3, SAB_I_TIMERS) !== 0,
@@ -8666,7 +9150,7 @@ function memoryMedia() {
 }
 
 // src/mount/chunked.ts
-var CHUNK2 = 1024 * 1024;
+var CHUNK3 = 1024 * 1024;
 var ChunkedBytes = class {
   chunks = [];
   size = 0;
@@ -8675,9 +9159,9 @@ var ChunkedBytes = class {
     if (end <= offset) return new Uint8Array(0);
     const out = new Uint8Array(end - offset);
     for (let at = offset; at < end; ) {
-      const index = Math.floor(at / CHUNK2);
-      const from = at - index * CHUNK2;
-      const n = Math.min(CHUNK2 - from, end - at);
+      const index = Math.floor(at / CHUNK3);
+      const from = at - index * CHUNK3;
+      const n = Math.min(CHUNK3 - from, end - at);
       const chunk2 = this.chunks[index];
       if (chunk2) out.set(chunk2.subarray(from, Math.min(from + n, chunk2.length)), at - offset);
       at += n;
@@ -8688,10 +9172,10 @@ var ChunkedBytes = class {
     const whole = owned && bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength;
     for (let done4 = 0; done4 < bytes.length; ) {
       const at = offset + done4;
-      const index = Math.floor(at / CHUNK2);
-      const from = at - index * CHUNK2;
-      const n = Math.min(CHUNK2 - from, bytes.length - done4);
-      if (whole && n === CHUNK2 && bytes.length === CHUNK2) this.chunks[index] = bytes;
+      const index = Math.floor(at / CHUNK3);
+      const from = at - index * CHUNK3;
+      const n = Math.min(CHUNK3 - from, bytes.length - done4);
+      if (whole && n === CHUNK3 && bytes.length === CHUNK3) this.chunks[index] = bytes;
       else this.room(index, from + n).set(bytes.subarray(done4, done4 + n), from);
       done4 += n;
     }
@@ -8699,10 +9183,10 @@ var ChunkedBytes = class {
   }
   truncate(size) {
     if (size < this.size) {
-      const keep = Math.ceil(size / CHUNK2);
+      const keep = Math.ceil(size / CHUNK3);
       this.chunks.length = Math.min(this.chunks.length, keep);
       const tail = this.chunks[keep - 1];
-      const from = size - (keep - 1) * CHUNK2;
+      const from = size - (keep - 1) * CHUNK3;
       if (tail && from < tail.length) tail.fill(0, from);
     }
     this.size = size;
@@ -8710,7 +9194,7 @@ var ChunkedBytes = class {
   room(index, need) {
     const chunk2 = this.chunks[index];
     if (chunk2 && chunk2.length >= need) return chunk2;
-    const grown = new Uint8Array(Math.min(CHUNK2, Math.max(need, (chunk2?.length ?? 0) * 2)));
+    const grown = new Uint8Array(Math.min(CHUNK3, Math.max(need, (chunk2?.length ?? 0) * 2)));
     if (chunk2) grown.set(chunk2);
     this.chunks[index] = grown;
     return grown;
@@ -9124,6 +9608,9 @@ var Launcher = class {
   cdp;
   ca;
   transport;
+  uplink;
+  routes;
+  resolver;
   watchers = new FsWatchers();
   pnpmHome;
   mounts;
@@ -9163,6 +9650,11 @@ var Launcher = class {
     this.env = { ...networkEnv(), SLICC_CDP_URL: this.cdp.url, ...options.env };
     this.ca = kernelCa(options.caStore ?? memoryCaStore());
     this.transport = options.transport ?? missingTransport();
+    this.uplink = options.uplink;
+    this.routes = new Routes(options.uplink?.traits.ipv6 === true);
+    if (options.uplink?.routes) this.routes.set(options.uplink.routes);
+    this.resolver = new Resolver({ uplink: options.uplink, routes: this.routes });
+    if (options.uplink) this.net.useUplink({ uplink: options.uplink, routes: this.routes });
     enableNetwork(this.net, {
       transport: this.transport,
       engine: kernelTlsEngine(packageTlsEngine(options.fs, this.modulesDir)),
@@ -9177,6 +9669,9 @@ var Launcher = class {
       this.catalog = void 0;
     });
   }
+  setRoutes(table) {
+    this.routes.set(table);
+  }
   commands() {
     this.catalog ??= this.roots().then((roots) => scanCommands(this.base, roots));
     return this.catalog;
@@ -9356,6 +9851,7 @@ var Launcher = class {
       net: this.net,
       http: new HttpHandles(this.transport),
       locks: this.locks,
+      resolver: this.resolver,
       onReap: (child) => this.reaped(child),
       ...req.fork ? { fork: req.fork } : {},
       ...this.shownIds(req)
@@ -9720,7 +10216,7 @@ function valid(name2) {
     throw new TypeError(`invalid name: ${name2}`);
   }
 }
-var CHUNK3 = 1024 * 1024;
+var CHUNK4 = 1024 * 1024;
 function bytesOf(data) {
   if (typeof data === "string") return new TextEncoder().encode(data);
   if (data instanceof Blob) return data.arrayBuffer().then((buffer) => new Uint8Array(buffer));
@@ -9744,19 +10240,19 @@ var Chunks = class {
   }
   grow(end) {
     if (end <= this.size) return;
-    const last = Math.floor((end - 1) / CHUNK3);
-    for (let i = 0; i < last; i++) this.pad(i, CHUNK3);
-    this.pad(last, end - last * CHUNK3);
+    const last = Math.floor((end - 1) / CHUNK4);
+    for (let i = 0; i < last; i++) this.pad(i, CHUNK4);
+    this.pad(last, end - last * CHUNK4);
     this.size = end;
   }
   async write(at, bytes) {
     if (bytes.length === 0) return;
-    const first = Math.floor(at / CHUNK3);
-    for (let i = 0; i < first; i++) this.pad(i, CHUNK3);
+    const first = Math.floor(at / CHUNK4);
+    for (let i = 0; i < first; i++) this.pad(i, CHUNK4);
     for (let done4 = 0; done4 < bytes.length; ) {
-      const index = Math.floor((at + done4) / CHUNK3);
-      const from = at + done4 - index * CHUNK3;
-      const n = Math.min(CHUNK3 - from, bytes.length - done4);
+      const index = Math.floor((at + done4) / CHUNK4);
+      const from = at + done4 - index * CHUNK4;
+      const n = Math.min(CHUNK4 - from, bytes.length - done4);
       const view = bytes.subarray(done4, done4 + n);
       const part = view.buffer instanceof ArrayBuffer ? view : view.slice();
       const old = this.blobs[index];
@@ -9776,10 +10272,10 @@ var Chunks = class {
       this.grow(size);
       return;
     }
-    const keep = Math.ceil(size / CHUNK3);
+    const keep = Math.ceil(size / CHUNK4);
     this.blobs.length = keep;
     if (keep > 0)
-      this.blobs[keep - 1] = this.blobs[keep - 1].slice(0, size - (keep - 1) * CHUNK3);
+      this.blobs[keep - 1] = this.blobs[keep - 1].slice(0, size - (keep - 1) * CHUNK4);
     this.size = size;
   }
 };
@@ -10705,6 +11201,7 @@ async function createNodeKernel(options = {}) {
     ...options.modules ? { modules: options.modules } : {},
     ...options.env ? { env: options.env } : {},
     ...transport ? { transport } : {},
+    ...options.network?.uplink ? { uplink: options.network.uplink } : {},
     ...options.processMounts !== void 0 ? { processMounts: options.processMounts } : {},
     ...options.fstabRetries ? { fstabRetries: options.fstabRetries } : {},
     ...options.hostfs ? { hostfs: options.hostfs } : {},
@@ -10772,6 +11269,7 @@ async function createNodeKernel(options = {}) {
     mount: (spec) => guard(() => launcher.mount(spec)),
     umount: (target) => guard(async () => launcher.umount(target)),
     mounts: async () => launcher.mounts.list(),
+    setRoutes: (routes) => guard(async () => launcher.setRoutes(routes)),
     async connect() {
       if (terminated) throw new Error(TERMINATED);
       const { port1, port2 } = new MessageChannel2();