@ai-ecoverse/slicc-kernel 1.3.0 → 1.4.0

package/dist/kernel-worker.js

@@ -1206,12 +1206,12 @@ var Budget = class {
     while (this.free < n) {
       signal.throwIfAborted();
       await new Promise((resolve) => {
-        const done3 = () => {
-          signal.removeEventListener("abort", done3);
+        const done4 = () => {
+          signal.removeEventListener("abort", done4);
           resolve();
         };
-        this.waiters.push(done3);
-        signal.addEventListener("abort", done3, { once: true });
+        this.waiters.push(done4);
+        signal.addEventListener("abort", done4, { once: true });
       });
     }
     this.free -= n;
@@ -1422,11 +1422,11 @@ var RealmProxy = class {
           this.slots.release(1);
           break;
         }
-        const done3 = this.serve(conn).finally(() => {
+        const done4 = this.serve(conn).finally(() => {
           this.slots.release(1);
-          served.delete(done3);
+          served.delete(done4);
         });
-        served.add(done3);
+        served.add(done4);
       }
     } catch {
     }
@@ -2450,44 +2450,83 @@ function envOf(pkg, raw) {
   const env = {};
   if (!raw || typeof raw !== "object") return env;
   for (const [key, value] of Object.entries(raw)) {
-    if (ENV_KEY.test(key) && typeof value === "string") env[key] = value.replace(PACKAGE, pkg);
+    if (!ENV_KEY.test(key)) continue;
+    if (typeof value === "string") env[key] = value.replace(PACKAGE, pkg);
+    else if (value === null) env[key] = null;
   }
   return env;
 }
+function envFields(merged) {
+  const env = {};
+  const unset = [];
+  for (const [key, value] of Object.entries(merged)) {
+    if (value === null) unset.push(key);
+    else env[key] = value;
+  }
+  return {
+    ...Object.keys(env).length > 0 ? { env } : {},
+    ...unset.length > 0 ? { unset } : {}
+  };
+}
 function argsOf(pkg, raw) {
   if (!Array.isArray(raw) || raw.length === 0) return void 0;
   if (!raw.every((arg) => typeof arg === "string")) return void 0;
   return raw.map((arg) => arg.replace(PACKAGE, pkg));
 }
+function abiOf(raw, fallback) {
+  const abi = raw ?? fallback;
+  return abi === "emscripten" || abi === "wasi" ? abi : void 0;
+}
+function commandOf(pkg, name2, raw, packageAbi, shared) {
+  const withEnv = envFields({ ...shared, ...envOf(pkg, raw.env) });
+  const script = inside(pkg, raw.script);
+  if (script) {
+    return { name: name2, abi: packageAbi, glue: script, wasm: script, argv0: name2, script, ...withEnv };
+  }
+  const abi = abiOf(raw.abi, packageAbi);
+  const wasm = inside(pkg, raw.wasm);
+  const glue = abi === "wasi" ? wasm : inside(pkg, raw.glue);
+  if (!abi || !glue || !wasm) return void 0;
+  const argv0 = typeof raw.argv0 === "string" && raw.argv0 ? raw.argv0 : name2;
+  const args = argsOf(pkg, raw.args);
+  const imports = abi === "wasi" ? inside(pkg, raw.imports) : void 0;
+  return {
+    name: name2,
+    abi,
+    glue,
+    wasm,
+    argv0,
+    ...args ? { args } : {},
+    ...withEnv,
+    ...imports ? { imports } : {}
+  };
+}
 function commandsOf(pkg, manifest) {
   const slicc = manifest.slicc;
-  if (!slicc || typeof slicc !== "object" || (slicc.abi ?? "emscripten") !== "emscripten")
-    return [];
+  if (!slicc || typeof slicc !== "object") return [];
+  const packageAbi = abiOf(slicc.abi, "emscripten");
   const entries = slicc.commands;
-  if (!entries || typeof entries !== "object") return [];
+  if (!packageAbi || !entries || typeof entries !== "object") return [];
   const shared = envOf(pkg, slicc.env);
   const out = [];
   for (const [name2, raw] of Object.entries(entries)) {
     if (!NAME.test(name2) || name2 === "." || name2 === ".." || !raw || typeof raw !== "object") {
       continue;
     }
-    const glue = inside(pkg, raw.glue);
-    const wasm = inside(pkg, raw.wasm);
-    if ((raw.abi ?? "emscripten") !== "emscripten" || !glue || !wasm) continue;
-    const argv0 = typeof raw.argv0 === "string" && raw.argv0 ? raw.argv0 : name2;
-    const args = argsOf(pkg, raw.args);
-    const env = { ...shared, ...envOf(pkg, raw.env) };
-    out.push({
-      name: name2,
-      glue,
-      wasm,
-      argv0,
-      ...args ? { args } : {},
-      ...Object.keys(env).length > 0 ? { env } : {}
-    });
+    const command = commandOf(pkg, name2, raw, packageAbi, shared);
+    if (command) out.push(command);
   }
   return out;
 }
+async function withPackagePaths(fs, pkg, command) {
+  if (!command.env) return command;
+  const env = {};
+  for (const [key, value] of Object.entries(command.env)) {
+    const path = !value.startsWith("/") && value.includes("/") && inside(pkg, value);
+    env[key] = path && await fs.exists(path) ? path : value;
+  }
+  return { ...command, env };
+}
 async function packages(fs, modules) {
   const names = await fs.readdir(modules).catch(() => []);
   const dirs = [];
@@ -2513,7 +2552,8 @@ async function scanCommands(fs, modules) {
       continue;
     }
     for (const command of commandsOf(pkg, manifest)) {
-      if (!found.has(command.name)) found.set(command.name, command);
+      if (!found.has(command.name))
+        found.set(command.name, await withPackagePaths(fs, pkg, command));
     }
   }
   if (!found.has("sh") && found.has("bash")) {
@@ -2750,8 +2790,8 @@ var ChildTable = class {
       for (; ; ) {
         const candidates = this.candidates(pid, flags);
         if (candidates.length === 0) throw new KernelError("ECHILD");
-        const done3 = candidates.find(([, child]) => child.code !== void 0);
-        if (done3) return this.reap(done3[0], done3[1].code);
+        const done4 = candidates.find(([, child]) => child.code !== void 0);
+        if (done4) return this.reap(done4[0], done4[1].code);
         const changed = this.stateReport(candidates, flags);
         if (changed) return changed;
         if (nohang) return [0, 0];
@@ -3061,6 +3101,167 @@ function attachSyncSabResponder(port, sab, token, opts) {
   };
 }
 
+// src/kernel/host-ops.ts
+var HOST_OPS = [
+  "lock",
+  "unlock",
+  "async-submit",
+  "async-wait",
+  "async-take",
+  "async-resolve",
+  "async-hold",
+  "async-cancel",
+  "async-close"
+];
+var json2 = (value) => ({ ok: true, kind: "json", json: value });
+var done2 = { ok: true, kind: "void" };
+var LockTable = class {
+  held = /* @__PURE__ */ new Map();
+  lock(pid, path, exclusive, fd) {
+    const holders = this.held.get(path) ?? /* @__PURE__ */ new Map();
+    for (const [other, h] of holders) if (other !== pid && (exclusive || h.exclusive)) return false;
+    const mine = holders.get(pid) ?? { exclusive, fds: /* @__PURE__ */ new Set() };
+    mine.exclusive = exclusive;
+    mine.fds.add(fd);
+    holders.set(pid, mine);
+    this.held.set(path, holders);
+    return true;
+  }
+  unlock(pid, path) {
+    const holders = this.held.get(path);
+    holders?.delete(pid);
+    if (holders?.size === 0) this.held.delete(path);
+  }
+  closed(pid, fd) {
+    for (const [path, holders] of [...this.held]) {
+      const mine = holders.get(pid);
+      if (mine?.fds.delete(fd) && mine.fds.size === 0) this.unlock(pid, path);
+    }
+  }
+  release(pid) {
+    for (const path of [...this.held.keys()]) this.unlock(pid, path);
+  }
+};
+var AsyncOps = class {
+  next = 1;
+  results = /* @__PURE__ */ new Map();
+  ready = [];
+  waiters = /* @__PURE__ */ new Set();
+  closed = false;
+  run;
+  constructor(run2) {
+    this.run = run2;
+  }
+  submit(req) {
+    const id = this.hold();
+    this.run(req).then(
+      (result) => this.complete(id, result),
+      (err) => this.complete(id, { ok: false, errno: "EIO", message: String(err) })
+    );
+    return id;
+  }
+  resolve(value) {
+    const id = this.hold();
+    this.complete(id, json2(value));
+    return id;
+  }
+  hold() {
+    const id = this.next++;
+    this.results.set(id, void 0);
+    return id;
+  }
+  take(id) {
+    if (!this.results.has(id)) throw new KernelError("EINVAL");
+    const result = this.results.get(id);
+    if (!result) throw new KernelError("EAGAIN");
+    this.cancel(id);
+    return result;
+  }
+  cancel(id) {
+    this.results.delete(id);
+    const at = this.ready.indexOf(id);
+    if (at >= 0) this.ready.splice(at, 1);
+  }
+  async wait(timeoutMs, signal) {
+    for (; ; ) {
+      if (this.closed) return -1;
+      const id = this.ready.shift();
+      if (id !== void 0) return id;
+      if (timeoutMs !== void 0 && timeoutMs <= 0) return 0;
+      const woke = await this.sleep(timeoutMs, signal);
+      if (!woke) return 0;
+    }
+  }
+  close() {
+    this.closed = true;
+    this.wake();
+  }
+  sleep(timeoutMs, signal) {
+    return new Promise((resolve, reject) => {
+      let timer;
+      const cleanup = () => {
+        clearTimeout(timer);
+        this.waiters.delete(wake);
+        signal.removeEventListener("abort", abort);
+      };
+      const wake = () => {
+        cleanup();
+        resolve(true);
+      };
+      const abort = () => {
+        cleanup();
+        reject(new KernelError("EINTR"));
+      };
+      this.waiters.add(wake);
+      signal.addEventListener("abort", abort, { once: true });
+      if (timeoutMs !== void 0) {
+        timer = setTimeout(() => {
+          cleanup();
+          resolve(false);
+        }, timeoutMs);
+      }
+    });
+  }
+  complete(id, result) {
+    if (!this.results.has(id)) return;
+    this.results.set(id, result);
+    this.ready.push(id);
+    this.wake();
+  }
+  wake() {
+    for (const wake of [...this.waiters]) wake();
+  }
+};
+async function hostSyscall(req, ctx) {
+  switch (req.op) {
+    case "lock":
+      if (!ctx.locks) throw new KernelError("ENOSYS");
+      if (!ctx.locks.lock(ctx.pid, req.path, req.exclusive, req.fd))
+        throw new KernelError("EAGAIN");
+      return done2;
+    case "unlock":
+      ctx.locks?.unlock(ctx.pid, req.path);
+      return done2;
+    case "async-submit":
+      if (!ctx.valid(req.req)) throw new KernelError("EINVAL");
+      return json2(ctx.ops.submit(req.req));
+    case "async-wait":
+      return json2(await ctx.ops.wait(req.timeoutMs, ctx.blocking()));
+    case "async-take":
+      return ctx.ops.take(req.id);
+    case "async-resolve":
+      return json2(ctx.ops.resolve(req.value));
+    case "async-hold":
+      return json2(ctx.ops.hold());
+    case "async-cancel":
+      ctx.ops.cancel(req.id);
+      return done2;
+    case "async-close":
+      ctx.ops.close();
+      return done2;
+  }
+}
+
 // src/kernel/net/http-syscalls.ts
 var HTTP_OPS = ["net-request", "net-read", "net-close"];
 var EMPTY = new Uint8Array(0);
@@ -3571,41 +3772,41 @@ function terminalOf(ctx, fd) {
   if (!tty) throw new KernelError("ENOTTY");
   return tty;
 }
-var json2 = (value) => ({ ok: true, kind: "json", json: value });
-var done2 = { ok: true, kind: "void" };
+var json3 = (value) => ({ ok: true, kind: "json", json: value });
+var done3 = { ok: true, kind: "void" };
 function ptySyscall(req, ctx) {
   switch (req.op) {
     case "pty-open": {
       if (!ctx.ptys) throw new KernelError("ENOENT");
-      return json2(ctx.fds.install(ctx.ptys.open().master, 3));
+      return json3(ctx.fds.install(ctx.ptys.open().master, 3));
     }
     case "pty-slave-open": {
       if (!ctx.ptys) throw new KernelError("ENOENT");
       const pair = ctx.ptys.get(req.n);
       const fd = ctx.fds.install(pair.openSlave(), 3);
       if (!req.noctty) ctx.jobs?.acquireTerminal(ctx.pid, pair.slave);
-      return json2(fd);
+      return json3(fd);
     }
     case "pty-number":
-      return json2(masterOf(ctx, req.fd).index);
+      return json3(masterOf(ctx, req.fd).index);
     case "pty-lock":
       masterOf(ctx, req.fd).locked = req.lock;
-      return done2;
+      return done3;
     case "pty-ctty": {
       const tty = terminalOf(ctx, req.fd);
       const leader = ctx.jobs?.getsid(ctx.pid, 0) === ctx.pid;
-      if (leader && ctx.jobs?.controllingTerminal(ctx.pid) === tty) return done2;
+      if (leader && ctx.jobs?.controllingTerminal(ctx.pid) === tty) return done3;
       if (!ctx.jobs?.acquireTerminal(ctx.pid, tty)) throw new KernelError("EPERM");
-      return done2;
+      return done3;
     }
     case "pty-list":
-      return json2(ctx.ptys?.numbers() ?? []);
+      return json3(ctx.ptys?.numbers() ?? []);
     case "pty-packet":
       masterOf(ctx, req.fd).packet = req.on;
-      return done2;
+      return done3;
     case "pty-winsz-set":
       terminalOf(ctx, req.fd).resize(req.cols, req.rows);
-      return done2;
+      return done3;
   }
 }
 
@@ -3990,7 +4191,7 @@ function socketAt(fds, fd) {
   if (!(file instanceof KernelSocket)) throw new KernelError("ENOTSOCK");
   return file;
 }
-var ok = (json3) => json3 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json3 };
+var ok = (json4) => json4 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json4 };
 async function socketSyscall(req, proc) {
   const { fds, net } = proc;
   switch (req.op) {
@@ -4316,6 +4517,9 @@ function isHttpSyscall(req) {
 function isSocketSyscall(req) {
   return req.op.startsWith("sock-");
 }
+function isHostSyscall(req) {
+  return HOST_OPS.includes(req.op);
+}
 function isPtySyscall(req) {
   return req.op.startsWith("pty-");
 }
@@ -4353,6 +4557,7 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "fd-cloexec",
   "fd-list",
   "proc-alarm",
+  "dl-log",
   "fd-renumber",
   "fd-promote",
   "fd-open-tty",
@@ -4376,7 +4581,8 @@ var SYSCALL_OPS = /* @__PURE__ */ new Set([
   "sig-pause",
   ...SOCKET_OPS,
   ...HTTP_OPS,
-  ...PTY_OPS
+  ...PTY_OPS,
+  ...HOST_OPS
 ]);
 function isWasmSyscall(req) {
   const op = req.op;
@@ -4424,6 +4630,9 @@ var WasmProcess = class {
       const action = defaultAction(sig);
       return action === "stop" ? this.stop(sig) : action;
     }
+    if (((this.options.pendingBits?.() ?? 0) & bit) !== 0 && defaultAction(sig) === "terminate") {
+      return "terminate";
+    }
     this.options.onPending?.(sig);
     const blocked = this.interrupt;
     this.interrupt = new AbortController();
@@ -4468,6 +4677,15 @@ var WasmProcess = class {
       if (isJobSyscall(req)) return this.jobSyscall(req);
       if (isSocketSyscall(req)) return await this.socketSyscall(req);
       if (isHttpSyscall(req)) return await this.httpSyscall(req);
+      if (isHostSyscall(req)) {
+        return await hostSyscall(req, {
+          pid: this.pid,
+          locks: this.options.locks,
+          ops: this.asyncOps,
+          blocking: () => this.blockingSignal(),
+          valid: (inner) => isWasmSyscall(inner) && !isHostSyscall(inner)
+        });
+      }
       if (isPtySyscall(req)) {
         const { ptys, jobs } = this.options;
         return ptySyscall(req, { pid: this.pid, fds: this.fds, ptys, jobs });
@@ -4531,6 +4749,7 @@ var WasmProcess = class {
       case "fd-write":
         return { ok: true, kind: "json", json: await this.write(req.fd, req.body, req.nonblock) };
       case "fd-close":
+        this.options.locks?.closed(this.pid, req.fd);
         await Promise.resolve(this.fds.close(req.fd));
         return { ok: true, kind: "void" };
       case "fd-pipe": {
@@ -4802,6 +5021,9 @@ var WasmProcess = class {
       case "proc-alarm":
         this.setAlarm(req.sig, req.firstMs ?? req.ms, req.repeat ? req.ms : 0, req.timer);
         return { ok: true, kind: "void" };
+      case "dl-log":
+        if (req.append) this.dlLog.push(req.append);
+        return { ok: true, kind: "json", json: this.dlLog.slice(req.from) };
       case "sig-mask":
         this.caught = req.caught;
         this.ignored = req.ignored;
@@ -4819,6 +5041,8 @@ var WasmProcess = class {
     });
   }
   alarm;
+  dlLog = [];
+  asyncOps = new AsyncOps((req) => this.syscall(req));
   alarmEvery;
   setAlarm(sig, first, every, timer) {
     if (!isSignal(sig)) throw new KernelError("EINVAL");
@@ -4847,6 +5071,8 @@ var WasmProcess = class {
     if (this.exited) return;
     this.exited = true;
     this.clearAlarm();
+    this.options.locks?.release(this.pid);
+    this.asyncOps.close();
     for (const pid of this.children.pids()) this.options.onReap?.(pid);
     await this.fds.closeAll();
     await this.options.http?.closeAll();
@@ -4857,6 +5083,10 @@ var WasmProcess = class {
 var WASM_PROCESS_INIT = "wasm-process-init";
 var WASM_PROCESS_EXIT = "wasm-process-exit";
 var WASM_PROCESS_ERROR = "wasm-process-error";
+var WASM_THREAD_SPAWN = "wasm-thread-spawn";
+var WASM_THREAD_INIT = "wasm-thread-init";
+var WASM_THREAD_EXIT = "wasm-thread-exit";
+var WASM_MAX_THREADS = 64;
 
 // src/kernel/host.ts
 var CRASHED = 70;
@@ -4895,11 +5125,13 @@ function spawnWasmProcess(opts) {
     ptys: opts.ptys,
     net: opts.net,
     http: opts.http,
+    locks: opts.locks,
     onReap: opts.onReap,
     onPending: (sig) => void Atomics.or(header2, SAB_I_SIGNALS, sigbit(sig)),
     onTimer: (which) => void Atomics.or(header2, SAB_I_TIMERS, 1 << which),
     hasPending: () => Atomics.load(header2, SAB_I_SIGNALS) !== 0 || Atomics.load(header2, SAB_I_TIMERS) !== 0,
-    raise: (sig) => signal(sig)
+    raise: (sig) => signal(sig),
+    ...opts.program.abi === "wasi" ? { pendingBits: () => Atomics.load(header2, SAB_I_SIGNALS) } : {}
   });
   const token = mintSyncFsToken({ fs: opts.fs, cwd: opts.cwd });
   const worker = opts.createWorker();
@@ -4910,14 +5142,15 @@ function spawnWasmProcess(opts) {
   const responder = attachSyncSabResponder(worker, sab, token, { dispatch });
   let settle2;
   const exited = new Promise((resolve) => settle2 = resolve);
-  let done3 = false;
+  let done4 = false;
   let endedBy;
   const finish = (code, sig) => {
-    if (done3) return;
-    done3 = true;
+    if (done4) return;
+    done4 = true;
     endedBy = sig ?? process.execTermsig;
     worker.removeEventListener("message", onMessage);
     worker.removeEventListener("error", onError);
+    for (const tid of [...threads.keys()]) endThread(tid);
     responder.dispose();
     revokeSyncFsToken(token);
     worker.terminate();
@@ -4926,15 +5159,17 @@ function spawnWasmProcess(opts) {
       () => settle2(code)
     );
   };
-  const onMessage = (event) => {
-    const data = event.data;
+  const handle = (data) => {
     if (data?.type === WASM_PROCESS_EXIT) {
       finish(typeof data.code === "number" ? data.code : CRASHED);
     } else if (data?.type === WASM_PROCESS_ERROR) {
       opts.onError?.(String(data.message));
       finish(CRASHED);
+    } else if (data?.type === WASM_THREAD_SPAWN && data.thread) {
+      spawnThread(data.thread);
     }
   };
+  const onMessage = (event) => handle(event.data);
   const onError = (event) => {
     event.preventDefault();
     opts.onError?.(String(event.message ?? "worker error"));
@@ -4942,6 +5177,49 @@ function spawnWasmProcess(opts) {
   };
   worker.addEventListener("message", onMessage);
   worker.addEventListener("error", onError);
+  const threads = /* @__PURE__ */ new Map();
+  const endThread = (tid) => {
+    const end = threads.get(tid);
+    threads.delete(tid);
+    end?.();
+  };
+  const spawnThread = (thread) => {
+    if (done4) return;
+    if (threads.size >= WASM_MAX_THREADS - 1) {
+      opts.onError?.(`more than ${WASM_MAX_THREADS} threads`);
+      finish(CRASHED);
+      return;
+    }
+    const tsab = new SharedArrayBuffer(SAB_HEADER_BYTES + SAB_DEFAULT_WINDOW_BYTES);
+    const tw = opts.createWorker();
+    const tresponder = attachSyncSabResponder(tw, tsab, token, { dispatch });
+    const onThreadMessage = (event) => {
+      const data = event.data;
+      if (data?.type === WASM_THREAD_EXIT) endThread(thread.tid);
+      else handle(data);
+    };
+    tw.addEventListener("message", onThreadMessage);
+    tw.addEventListener("error", onError);
+    threads.set(thread.tid, () => {
+      tw.removeEventListener("message", onThreadMessage);
+      tw.removeEventListener("error", onError);
+      tresponder.dispose();
+      tw.terminate();
+    });
+    const tinit = {
+      type: WASM_THREAD_INIT,
+      pid: opts.pid,
+      program: opts.program,
+      argv0: opts.argv0,
+      args: opts.args,
+      env: opts.env,
+      cwd: opts.cwd,
+      sab: tsab,
+      ...opts.ppid !== void 0 ? { ppid: opts.ppid } : {},
+      thread
+    };
+    tw.postMessage(tinit);
+  };
   const init = {
     type: WASM_PROCESS_INIT,
     pid: opts.pid,
@@ -5076,8 +5354,67 @@ var JobTable = class {
   }
 };
 
+// src/process/wasi/wasi-module.ts
+function importedMemory(bytes) {
+  let at = 8;
+  const u32 = () => {
+    let result = 0;
+    let shift = 0;
+    for (; ; ) {
+      const b = bytes[at++];
+      result |= (b & 127) << shift;
+      if (!(b & 128)) return result >>> 0;
+      shift += 7;
+    }
+  };
+  const name2 = () => {
+    const len = u32();
+    const s = new TextDecoder().decode(bytes.subarray(at, at + len));
+    at += len;
+    return s;
+  };
+  const limits = () => {
+    const flags = bytes[at++];
+    const initial = u32();
+    const maximum = flags & 1 ? u32() : void 0;
+    return { initial, maximum, shared: (flags & 2) !== 0 };
+  };
+  while (at < bytes.length) {
+    const id = bytes[at++];
+    const size = u32();
+    const end = at + size;
+    if (id !== 2) {
+      at = end;
+      continue;
+    }
+    const count = u32();
+    for (let i = 0; i < count; i++) {
+      const module = name2();
+      const field = name2();
+      const kind = bytes[at++];
+      if (kind === 0) u32();
+      else if (kind === 1) {
+        at++;
+        limits();
+      } else if (kind === 2) {
+        const l = limits();
+        return { module, name: field, ...l };
+      } else if (kind === 3) at += 2;
+      else if (kind === 4) {
+        at++;
+        u32();
+      }
+    }
+    return void 0;
+  }
+  return void 0;
+}
+
 // src/launcher.ts
 var COMMAND2 = /^\/(?:usr\/)?bin\/([^/]+)$/;
+var PACKAGE_ROOT = /^(.*\/node_modules\/(?:@[^/]+\/)?[^/]+)\//;
+var ENV_REFERENCE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+var WASM_MAGIC = [0, 97, 115, 109];
 var SHEBANG_MAX = 256;
 var NOT_FOUND = 127;
 var SHARED_DIRS = ["/tmp", "/home"];
@@ -5088,13 +5425,43 @@ function baseName(path) {
 function modulePath(glue) {
   return glue.endsWith(".js") ? `${glue.slice(0, -3)}.wasm` : `${glue}.wasm`;
 }
+function isWasm(bytes) {
+  return WASM_MAGIC.every((b, i) => bytes[i] === b);
+}
+function shebang(head) {
+  if (head[0] !== 35 || head[1] !== 33) return void 0;
+  return new TextDecoder().decode(head.subarray(0, SHEBANG_MAX)).slice(2).split("\n")[0].trim().split(/[ \t]+/);
+}
+function interpreter(head) {
+  const words = shebang(head);
+  if (!words) return "node";
+  if (baseName(words[0]) === "env") words.shift();
+  if (words[0] === "-S") words.shift();
+  return baseName(words[0] ?? "");
+}
+function expandDefaults(defaults, env) {
+  const out = {};
+  for (const [key, value] of Object.entries(defaults ?? {})) {
+    let missing3 = false;
+    const expanded = value.replace(ENV_REFERENCE, (_, name2) => {
+      const set2 = Object.hasOwn(env, name2) ? env[name2] : void 0;
+      if (set2 === void 0) missing3 = true;
+      return set2 ?? "";
+    });
+    if (!missing3) out[key] = expanded;
+  }
+  return out;
+}
 function targetOf(command) {
   return {
+    abi: command.abi,
     glue: command.glue,
     wasm: command.wasm,
     argv0: command.argv0,
     ...command.args ? { prefix: command.args } : {},
-    ...command.env ? { env: command.env } : {}
+    ...command.env ? { env: command.env } : {},
+    ...command.unset ? { unset: command.unset } : {},
+    ...command.imports ? { imports: command.imports } : {}
   };
 }
 function childHandle(handle) {
@@ -5126,6 +5493,7 @@ var Launcher = class {
   zombies = /* @__PURE__ */ new Set();
   orphans = /* @__PURE__ */ new Set();
   jobs = new JobTable();
+  locks = new LockTable();
   ptys = new PtyTable((tty, sig) => this.jobs.signalOwnedForeground(tty, sig));
   net = new LoopbackNet();
   ca;
@@ -5154,35 +5522,62 @@ var Launcher = class {
     const name2 = COMMAND2.exec(file)?.[1] ?? (file.includes("/") ? void 0 : file);
     if (name2 !== void 0) {
       const command = (await this.commands()).get(name2);
-      return command && targetOf(command);
+      return command && !command.script ? targetOf(command) : void 0;
     }
     const glue = await followLinks(this.base, this.fs.resolvePath(cwd, file));
     const linked = COMMAND2.exec(glue)?.[1];
     if (linked !== void 0) return this.resolve(`/bin/${linked}`, argv0, cwd);
+    const head = await this.head(glue);
+    if (!head) return void 0;
+    if (isWasm(head)) {
+      return {
+        abi: "wasi",
+        glue,
+        wasm: glue,
+        argv0: baseName(argv0 || file).replace(/\.wasm$/, "")
+      };
+    }
+    if (interpreter(head) !== "node") return void 0;
     const wasm = modulePath(glue);
-    if (!await this.base.exists(glue) || !await this.base.exists(wasm)) return void 0;
-    return { glue, wasm, argv0: baseName(argv0 || file) };
+    if (!await this.base.exists(wasm)) return void 0;
+    return { abi: "emscripten", glue, wasm, argv0: baseName(argv0 || file) };
   }
-  async interpreted(file, argv, cwd) {
-    let head;
+  async head(path) {
     try {
-      head = (await this.base.readFileBuffer(this.fs.resolvePath(cwd, file))).subarray(
-        0,
-        SHEBANG_MAX
-      );
+      return (await this.base.readFileBuffer(path)).subarray(0, SHEBANG_MAX);
     } catch {
       return void 0;
     }
-    if (head[0] !== 35 || head[1] !== 33) return void 0;
-    const words = new TextDecoder().decode(head).slice(2).split("\n")[0].trim().split(/[ \t]+/);
+  }
+  async scriptCommand(file) {
+    const name2 = COMMAND2.exec(file)?.[1] ?? (file.includes("/") ? void 0 : file);
+    if (name2 === void 0) return void 0;
+    const command = (await this.commands()).get(name2);
+    return command?.script ? command : void 0;
+  }
+  async interpreted(file, argv, cwd) {
+    const command = await this.scriptCommand(file);
+    const script = command?.script ?? this.fs.resolvePath(cwd, file);
+    const words = shebang(await this.head(script) ?? new Uint8Array());
+    if (!words) return void 0;
     if (baseName(words[0]) === "env") words.shift();
     const [interp, ...rest] = words;
-    const target = interp ? await this.resolve(interp, interp, cwd) : void 0;
-    if (!target) return void 0;
+    const found = interp ? await this.resolve(interp, interp, cwd) : void 0;
+    if (!found) return void 0;
+    const target = command ? {
+      ...found,
+      env: { ...found.env, ...command.env },
+      unset: [...found.unset ?? [], ...command.unset ?? []]
+    } : found;
     const arg = rest.join(" ");
     return {
       target,
-      args: [...target.prefix ?? [], ...arg ? [arg] : [], file, ...argv.slice(1)]
+      args: [
+        ...target.prefix ?? [],
+        ...arg ? [arg] : [],
+        command ? script : file,
+        ...argv.slice(1)
+      ]
     };
   }
   async plan(file, argv, cwd) {
@@ -5199,33 +5594,58 @@ var Launcher = class {
       const key = `${path}:${st.size}:${st.mtime.getTime()}`;
       let module = this.compiled.get(key);
       if (!module) {
-        module = this.base.readFileBuffer(path).then((bytes) => WebAssembly.compile(bytes));
+        module = this.base.readFileBuffer(path).then(async (bytes) => {
+          const memory = importedMemory(bytes);
+          const compiled = await WebAssembly.compile(bytes);
+          return { module: compiled, ...memory ? { memory } : {} };
+        });
         this.compiled.set(key, module);
         module.catch(() => this.compiled.delete(key));
       }
       return module;
     });
   }
+  async names(path, module) {
+    if (WebAssembly.Module.customSections(module, "name").length > 0) return void 0;
+    const beside = `${path}.names`;
+    if (await this.base.exists(beside)) return beside;
+    const root = PACKAGE_ROOT.exec(path)?.[1];
+    if (root === void 0) return void 0;
+    const optional = `${root}-names${beside.slice(root.length)}`;
+    return await this.base.exists(optional) ? optional : void 0;
+  }
+  async program(target, env) {
+    if (target.abi !== "wasi") {
+      const [glue, { module: module2 }] = await Promise.all([
+        this.base.readFile(target.glue),
+        this.module(target.wasm)
+      ]);
+      return { glue, module: module2 };
+    }
+    const { module, memory } = await this.module(target.wasm);
+    const names = env.SLICC_WASM_BACKTRACE === "1" ? await this.names(target.wasm, module) : void 0;
+    const imports = target.imports ? await this.base.readFile(target.imports) : void 0;
+    return {
+      abi: "wasi",
+      glue: "",
+      module,
+      ...memory ? { memory } : {},
+      ...names ? { names } : {},
+      ...imports !== void 0 ? { imports } : {}
+    };
+  }
   async launch(planned, req) {
     const { target, args } = planned;
+    const env = { ...expandDefaults(target.env, { ...req.env, cwd: req.cwd }), ...req.env };
+    for (const key of target.unset ?? []) delete env[key];
     let program;
     try {
-      const [glue, module] = await Promise.all([
-        this.base.readFile(target.glue),
-        this.module(target.wasm)
-      ]);
-      program = { glue, module };
+      program = await this.program(target, env);
     } catch (err) {
       await req.fds.closeAll();
       throw err;
     }
-    return this.start({
-      ...req,
-      program,
-      argv0: target.argv0,
-      args,
-      env: { ...target.env, ...req.env }
-    });
+    return this.start({ ...req, program, argv0: target.argv0, args, env });
   }
   start(req) {
     const pid = this.nextPid++;
@@ -5248,6 +5668,7 @@ var Launcher = class {
       ptys: this.ptys,
       net: this.net,
       http: new HttpHandles(this.transport),
+      locks: this.locks,
       onReap: (child) => this.reaped(child),
       ...req.fork ? { fork: req.fork } : {},
       ...req.ppid !== void 0 ? { ppid: req.ppid } : {}