@ai-ecoverse/slicc-kernel 1.95.2 → 1.96.0

package/dist/kernel-worker.js

@@ -3265,6 +3265,149 @@ function wasiErrno(code) {
   return WASI_ERRNO[code] ?? E.IO;
 }
 
+// src/kernel/net/loopback-names.ts
+var HOST_LOOPBACK = "host.slicc.internal";
+var HOST_LOOPBACK_ADDRESS = [10, 0, 2, 2];
+var PAGE_LOOPBACK = "kernel.localhost";
+var PAGE_LOOPBACK_URL = `http://{port}.${PAGE_LOOPBACK}`;
+function toHostLoopback(href) {
+  const url = new URL(href);
+  if (url.hostname.replace(/\.$/, "").toLowerCase() !== HOST_LOOPBACK) return href;
+  url.hostname = "127.0.0.1";
+  return url.href;
+}
+var LOOPBACK_V4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+var LOOPBACK_V6 = /* @__PURE__ */ new Set(["::1", "::", "0:0:0:0:0:0:0:1"]);
+var MAPPED_V4 = /^::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}$/;
+var KERNEL_PORT = /^(\d{1,5})\.kernel\.localhost$/;
+var SCHEMES = {
+  "http:": 80,
+  "ws:": 80,
+  "https:": 443,
+  "wss:": 443
+};
+function isKernelLoopbackHost(hostname) {
+  const host = hostname.replace(/^\[(.*)\]$/, "$1").replace(/\.$/, "").toLowerCase();
+  return host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || LOOPBACK_V4.test(host) || LOOPBACK_V6.has(host) || MAPPED_V4.test(host);
+}
+function kernelLoopbackPort(href) {
+  let url;
+  try {
+    url = new URL(href);
+  } catch {
+    return void 0;
+  }
+  const fallback = SCHEMES[url.protocol];
+  if (fallback === void 0 || !isKernelLoopbackHost(url.hostname)) return void 0;
+  const named = KERNEL_PORT.exec(url.hostname.replace(/\.$/, "").toLowerCase())?.[1];
+  const port = Number(named ?? (url.port || fallback));
+  return port >= 1 && port <= 65535 ? port : void 0;
+}
+var DEFAULT_HOSTNAME = "slicc";
+var HOSTNAME_ADDRESS = "127.0.1.1";
+var LIBC_HOSTNAMES = ["emscripten", "wasmer.sh"];
+var LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+function reserved(name2) {
+  const lower = name2.toLowerCase();
+  return lower === "localhost" || lower.endsWith(".localhost") || lower === HOST_LOOPBACK || lower === "wasmer.sh" || /^\d+(\.\d+){3}$/.test(lower);
+}
+function isHostname(name2) {
+  if (typeof name2 !== "string" || name2.length > 253 || reserved(name2)) return false;
+  return name2.split(".").every((l) => LABEL.test(l));
+}
+function ownNames(hostname) {
+  return [.../* @__PURE__ */ new Set([hostname.toLowerCase(), ...LIBC_HOSTNAMES])];
+}
+
+// src/kernel/net/routes.ts
+var HOST_ADDRESS = HOST_LOOPBACK_ADDRESS.join(".");
+function ipv4Bytes(text) {
+  const parts2 = text.split(".");
+  if (parts2.length !== 4 || !parts2.every((p) => /^\d{1,3}$/.test(p))) return void 0;
+  const bytes = parts2.map(Number);
+  return bytes.every((b) => b <= 255) ? bytes : void 0;
+}
+function ipv6Groups(text) {
+  if (!text.includes(":")) return void 0;
+  let canonical;
+  try {
+    canonical = new URL(`http://[${text}]/`).hostname.slice(1, -1);
+  } catch {
+    return void 0;
+  }
+  const [head, tail] = canonical.split("::");
+  const part = (s) => s ? s.split(":").map((h) => Number.parseInt(h, 16)) : [];
+  const front = part(head);
+  const back = part(tail);
+  return tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
+}
+function toBits(values, width) {
+  return values.reduce((acc, v) => acc << BigInt(width) | BigInt(v), 0n);
+}
+function addressBits(host) {
+  const v4 = ipv4Bytes(host);
+  if (v4) return { v6: false, bits: toBits(v4, 8) };
+  const v6 = ipv6Groups(host);
+  return v6 ? { v6: true, bits: toBits(v6, 16) } : void 0;
+}
+function parsePrefix(text) {
+  const parts2 = text.trim().split("/");
+  if (parts2.length > 2) return void 0;
+  const [address = "", size] = parts2;
+  const parsed2 = addressBits(address);
+  if (!parsed2) return void 0;
+  const max = parsed2.v6 ? 128 : 32;
+  const length2 = size === void 0 ? max : /^\d{1,3}$/.test(size) ? Number(size) : -1;
+  if (length2 < 0 || length2 > max) return void 0;
+  return { ...parsed2, length: length2 };
+}
+function within3(prefix, addr) {
+  if (prefix.v6 !== addr.v6) return false;
+  const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
+  return addr.bits >> shift === prefix.bits >> shift;
+}
+var RESERVED = [
+  "0.0.0.0/8",
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "224.0.0.0/4",
+  "240.0.0.0/4",
+  "::/96",
+  "::ffff:0:0/96",
+  "fe80::/10",
+  "ff00::/8"
+].map((p) => parsePrefix(p));
+var Routes = class {
+  table = [];
+  exit = false;
+  ipv6;
+  constructor(ipv62 = false) {
+    this.ipv6 = ipv62;
+  }
+  set(table) {
+    const parsed2 = (table.prefixes ?? []).map(parsePrefix);
+    const bad = (table.prefixes ?? []).find((_, i) => !parsed2[i]);
+    if (bad !== void 0) throw new Error(`not an address prefix: ${bad}`);
+    this.table = parsed2;
+    this.exit = table.exit === true;
+  }
+  classify(host) {
+    const name2 = host.toLowerCase().replace(/\.$/, "");
+    if (name2 === "localhost" || name2.endsWith(".localhost") || name2 === "0.0.0.0") {
+      return "loopback";
+    }
+    if (name2 === HOST_LOOPBACK || name2 === HOST_ADDRESS) return "host";
+    const addr = addressBits(name2);
+    if (!addr) return "unreachable";
+    if (addr.v6 && addr.bits === 1n) return "loopback";
+    if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
+    if (RESERVED.some((p) => within3(p, addr))) return "reserved";
+    if (addr.v6 && !this.ipv6) return "unreachable";
+    if (this.exit || this.table.some((p) => within3(p, addr))) return "uplink";
+    return "unreachable";
+  }
+};
+
 // src/kernel/net/uplink-socket.ts
 var CHUNK = 64 * 1024;
 function hostPort(text) {
@@ -3669,8 +3812,10 @@ function canonicalHost(host) {
 function keyOf(addr) {
   return addr.family === "inet" ? `inet:${addr.port}` : `unix:${addr.path}`;
 }
+var LOCAL_ONLY = new Routes();
 var LoopbackNet = class {
   bound = /* @__PURE__ */ new Map();
+  dgrams = /* @__PURE__ */ new Map();
   activators = /* @__PURE__ */ new Map();
   internal = /* @__PURE__ */ new Set();
   reserved = /* @__PURE__ */ new Set();
@@ -3683,7 +3828,31 @@ var LoopbackNet = class {
   uplinkFor(host) {
     const route = this.route;
     if (!route) return void 0;
-    return route.routes.classify(host) === "uplink" ? route : void 0;
+    return this.destination(host) === "uplink" ? route : void 0;
+  }
+  destination(host) {
+    return (this.route?.routes ?? LOCAL_ONLY).classify(host);
+  }
+  bindDgram(socket, addr, kernel = false) {
+    if (addr.family !== "inet") throw new KernelError("EAFNOSUPPORT");
+    this.bindable(addr, kernel);
+    const port = addr.port === 0 ? this.ephemeral() : addr.port;
+    if (this.dgrams.has(port)) throw new KernelError("EADDRINUSE");
+    this.dgrams.set(port, socket);
+    return { ...addr, port };
+  }
+  releaseDgram(addr, socket) {
+    if (this.dgrams.get(addr.port) === socket) this.dgrams.delete(addr.port);
+  }
+  deliverDgram(port, datagram2) {
+    const target = this.dgrams.get(port);
+    return target ? target.deliver(datagram2) : false;
+  }
+  bindable(addr, kernel) {
+    if (addr.host !== "0.0.0.0" && !isLoopback(addr.host)) {
+      throw new KernelError("EADDRNOTAVAIL");
+    }
+    if (!kernel && this.reserved.has(addr.port)) throw new KernelError("EADDRINUSE");
   }
   kernelOnly(port, reserve = false) {
     if (reserve) this.internal.add(port);
@@ -3721,11 +3890,7 @@ var LoopbackNet = class {
   bind(socket, addr, kernel = false) {
     if (addr.family === "unix") {
       if (addr.path === "") throw new KernelError("EINVAL");
-    } else if (addr.host !== "0.0.0.0" && !isLoopback(addr.host)) {
-      throw new KernelError("EADDRNOTAVAIL");
-    } else if (!kernel && this.reserved.has(addr.port)) {
-      throw new KernelError("EADDRINUSE");
-    }
+    } else this.bindable(addr, kernel);
     const named = addr.family === "inet" && addr.port === 0 ? { ...addr, port: this.ephemeral() } : addr;
     const key = keyOf(named);
     if (this.bound.has(key)) throw new KernelError("EADDRINUSE");
@@ -3751,7 +3916,8 @@ var LoopbackNet = class {
     for (let i = 0; i < span; i++) {
       const port = this.nextEphemeral;
       this.nextEphemeral = port === EPHEMERAL_LAST ? EPHEMERAL_FIRST : port + 1;
-      if (!this.bound.has(`inet:${port}`) && !this.reserved.has(port)) return port;
+      const taken = this.bound.has(`inet:${port}`) || this.dgrams.has(port);
+      if (!taken && !this.reserved.has(port)) return port;
     }
     throw new KernelError("EADDRINUSE");
   }
@@ -5167,60 +5333,6 @@ function integrityAsker(port) {
   return { lookup: lookup2, answer };
 }
 
-// src/kernel/net/loopback-names.ts
-var HOST_LOOPBACK = "host.slicc.internal";
-var HOST_LOOPBACK_ADDRESS = [10, 0, 2, 2];
-var PAGE_LOOPBACK = "kernel.localhost";
-var PAGE_LOOPBACK_URL = `http://{port}.${PAGE_LOOPBACK}`;
-function toHostLoopback(href) {
-  const url = new URL(href);
-  if (url.hostname.replace(/\.$/, "").toLowerCase() !== HOST_LOOPBACK) return href;
-  url.hostname = "127.0.0.1";
-  return url.href;
-}
-var LOOPBACK_V4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
-var LOOPBACK_V6 = /* @__PURE__ */ new Set(["::1", "::", "0:0:0:0:0:0:0:1"]);
-var MAPPED_V4 = /^::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}$/;
-var KERNEL_PORT = /^(\d{1,5})\.kernel\.localhost$/;
-var SCHEMES = {
-  "http:": 80,
-  "ws:": 80,
-  "https:": 443,
-  "wss:": 443
-};
-function isKernelLoopbackHost(hostname) {
-  const host = hostname.replace(/^\[(.*)\]$/, "$1").replace(/\.$/, "").toLowerCase();
-  return host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || LOOPBACK_V4.test(host) || LOOPBACK_V6.has(host) || MAPPED_V4.test(host);
-}
-function kernelLoopbackPort(href) {
-  let url;
-  try {
-    url = new URL(href);
-  } catch {
-    return void 0;
-  }
-  const fallback = SCHEMES[url.protocol];
-  if (fallback === void 0 || !isKernelLoopbackHost(url.hostname)) return void 0;
-  const named = KERNEL_PORT.exec(url.hostname.replace(/\.$/, "").toLowerCase())?.[1];
-  const port = Number(named ?? (url.port || fallback));
-  return port >= 1 && port <= 65535 ? port : void 0;
-}
-var DEFAULT_HOSTNAME = "slicc";
-var HOSTNAME_ADDRESS = "127.0.1.1";
-var LIBC_HOSTNAMES = ["emscripten", "wasmer.sh"];
-var LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
-function reserved(name2) {
-  const lower = name2.toLowerCase();
-  return lower === "localhost" || lower.endsWith(".localhost") || lower === HOST_LOOPBACK || lower === "wasmer.sh" || /^\d+(\.\d+){3}$/.test(lower);
-}
-function isHostname(name2) {
-  if (typeof name2 !== "string" || name2.length > 253 || reserved(name2)) return false;
-  return name2.split(".").every((l) => LABEL.test(l));
-}
-function ownNames(hostname) {
-  return [.../* @__PURE__ */ new Set([hostname.toLowerCase(), ...LIBC_HOSTNAMES])];
-}
-
 // src/kernel/net/http1.ts
 var HttpError = class extends Error {
   status;
@@ -7134,96 +7246,10 @@ var RemoteTransport = class {
   }
 };
 
-// src/kernel/net/routes.ts
-var HOST_ADDRESS = HOST_LOOPBACK_ADDRESS.join(".");
-function ipv4Bytes(text) {
-  const parts2 = text.split(".");
-  if (parts2.length !== 4 || !parts2.every((p) => /^\d{1,3}$/.test(p))) return void 0;
-  const bytes = parts2.map(Number);
-  return bytes.every((b) => b <= 255) ? bytes : void 0;
-}
-function ipv6Groups(text) {
-  if (!text.includes(":")) return void 0;
-  let canonical;
-  try {
-    canonical = new URL(`http://[${text}]/`).hostname.slice(1, -1);
-  } catch {
-    return void 0;
-  }
-  const [head, tail] = canonical.split("::");
-  const part = (s) => s ? s.split(":").map((h) => Number.parseInt(h, 16)) : [];
-  const front = part(head);
-  const back = part(tail);
-  return tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
-}
-function toBits(values, width) {
-  return values.reduce((acc, v) => acc << BigInt(width) | BigInt(v), 0n);
-}
-function addressBits(host) {
-  const v4 = ipv4Bytes(host);
-  if (v4) return { v6: false, bits: toBits(v4, 8) };
-  const v6 = ipv6Groups(host);
-  return v6 ? { v6: true, bits: toBits(v6, 16) } : void 0;
-}
-function parsePrefix(text) {
-  const parts2 = text.trim().split("/");
-  if (parts2.length > 2) return void 0;
-  const [address = "", size] = parts2;
-  const parsed2 = addressBits(address);
-  if (!parsed2) return void 0;
-  const max = parsed2.v6 ? 128 : 32;
-  const length2 = size === void 0 ? max : /^\d{1,3}$/.test(size) ? Number(size) : -1;
-  if (length2 < 0 || length2 > max) return void 0;
-  return { ...parsed2, length: length2 };
-}
-function within3(prefix, addr) {
-  if (prefix.v6 !== addr.v6) return false;
-  const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
-  return addr.bits >> shift === prefix.bits >> shift;
-}
-var RESERVED = [
-  "0.0.0.0/8",
-  "127.0.0.0/8",
-  "169.254.0.0/16",
-  "224.0.0.0/4",
-  "240.0.0.0/4",
-  "::/96",
-  "::ffff:0:0/96",
-  "fe80::/10",
-  "ff00::/8"
-].map((p) => parsePrefix(p));
-var Routes = class {
-  table = [];
-  exit = false;
-  ipv6;
-  constructor(ipv62 = false) {
-    this.ipv6 = ipv62;
-  }
-  set(table) {
-    const parsed2 = (table.prefixes ?? []).map(parsePrefix);
-    const bad = (table.prefixes ?? []).find((_, i) => !parsed2[i]);
-    if (bad !== void 0) throw new Error(`not an address prefix: ${bad}`);
-    this.table = parsed2;
-    this.exit = table.exit === true;
-  }
-  classify(host) {
-    const name2 = host.toLowerCase().replace(/\.$/, "");
-    if (name2 === "localhost" || name2.endsWith(".localhost") || name2 === "0.0.0.0") {
-      return "loopback";
-    }
-    if (name2 === HOST_LOOPBACK || name2 === HOST_ADDRESS) return "host";
-    const addr = addressBits(name2);
-    if (!addr) return "unreachable";
-    if (addr.v6 && addr.bits === 1n) return "loopback";
-    if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
-    if (RESERVED.some((p) => within3(p, addr))) return "reserved";
-    if (addr.v6 && !this.ipv6) return "unreachable";
-    if (this.exit || this.table.some((p) => within3(p, addr))) return "uplink";
-    return "unreachable";
-  }
-};
-
 // src/kernel/net/uplink.ts
+function carriesUdp(uplink) {
+  return uplink.traits.udp === true && typeof uplink.udp === "function";
+}
 function answerOf(result) {
   const answer = Array.isArray(result) ? { addresses: result } : result;
   const addresses = Array.isArray(answer?.addresses) ? answer.addresses.filter((a) => typeof a === "string") : [];
@@ -7304,6 +7330,44 @@ var RemoteUplink = class {
       close: () => this.port.postMessage({ uplink: "close", cid })
     };
   }
+  async udp(req) {
+    req.signal.throwIfAborted();
+    const opened2 = await this.ask(
+      { uplink: "udp-open", uid: ++this.nextId, family: req.family },
+      req.signal
+    );
+    const { cid, localAddr } = opened2;
+    const recv = () => this.ask({
+      uplink: "udp-recv",
+      uid: ++this.nextId,
+      cid
+    });
+    return {
+      localAddr,
+      send: async (bytes, host, port) => {
+        const copy = bytes.slice();
+        const call = {
+          uplink: "udp-send",
+          uid: ++this.nextId,
+          cid,
+          bytes: copy,
+          host,
+          port
+        };
+        await this.ask(call, void 0, [copy.buffer]);
+      },
+      messages: {
+        [Symbol.asyncIterator]: async function* () {
+          for (; ; ) {
+            const got = await recv();
+            if (!got.message) return;
+            yield got.message;
+          }
+        }
+      },
+      close: () => this.port.postMessage({ uplink: "udp-close", cid })
+    };
+  }
 };
 
 // src/cdp/types.ts
@@ -11470,6 +11534,268 @@ var ProcessClocks = class {
   }
 };
 
+// src/kernel/dgram.ts
+var DGRAM_QUEUE_BYTES = 256 * 1024;
+var DGRAM_QUEUE_COUNT = 512;
+var DGRAM_SEND_ROOM = 256 * 1024;
+var MAX_DATAGRAM_V4 = 65507;
+var MAX_DATAGRAM_V6 = 65527;
+var SOL_SOCKET2 = 1;
+var IPPROTO_IP = 0;
+var SO_TYPE2 = 3;
+var SO_ERROR2 = 4;
+var SO_BROADCAST = 6;
+var SO_SNDBUF2 = 7;
+var SO_RCVBUF2 = 8;
+var SO_DOMAIN2 = 39;
+var SOCK_DGRAM = 2;
+var AF_INET2 = 2;
+var IP_MULTICAST_FIRST = 32;
+var IP_MULTICAST_LAST = 36;
+var SEND_ERRORS = ["ENETUNREACH", "EHOSTUNREACH", "EACCES", "EMSGSIZE"];
+var UNREACHABLE = ["EACCES", "ENETUNREACH", "EHOSTUNREACH"];
+function sendError(e) {
+  if (e instanceof KernelError) return e;
+  const code = e?.code;
+  return new KernelError(SEND_ERRORS.find((errno2) => errno2 === code) ?? "EHOSTUNREACH");
+}
+function sameAddr(a, b) {
+  return a.port === b.port && canonicalHost(a.host) === canonicalHost(b.host);
+}
+function familyOf(host) {
+  return host.includes(":") ? 6 : 4;
+}
+var KernelDgram = class {
+  local;
+  peer;
+  net;
+  queue = [];
+  queued = 0;
+  pending;
+  closed = false;
+  sending = 0;
+  changes = new Changes();
+  options = /* @__PURE__ */ new Map();
+  uplinks = /* @__PURE__ */ new Map();
+  stop = new AbortController();
+  constructor(net) {
+    this.net = net;
+  }
+  bind(addr) {
+    if (this.local) throw new KernelError("EINVAL");
+    this.local = this.net.bindDgram(this, addr);
+  }
+  bound() {
+    this.local ??= this.net.bindDgram(this, { family: "inet", host: "0.0.0.0", port: 0 });
+    return this.local;
+  }
+  connectTo(addr) {
+    if (addr.family !== "inet") throw new KernelError("EAFNOSUPPORT");
+    this.route(addr.host);
+    this.bound();
+    this.peer = { family: "inet", host: canonicalHost(addr.host), port: addr.port };
+    this.pending = void 0;
+    this.drain((d) => sameAddr(d.from, addr));
+  }
+  drain(keep2) {
+    const kept = this.queue.filter(keep2);
+    this.queue.splice(0, this.queue.length, ...kept);
+    this.queued = kept.reduce((sum, d) => sum + d.bytes.length, 0);
+  }
+  route(host) {
+    const where = this.net.destination(host);
+    if (where === "loopback" || where === "uplink") return where;
+    throw new KernelError("ENETUNREACH");
+  }
+  takeError() {
+    const pending = this.pending;
+    this.pending = void 0;
+    return pending;
+  }
+  async send(bytes, to) {
+    if (this.closed) throw new KernelError("EBADF");
+    const pending = this.takeError();
+    if (pending) throw new KernelError(pending);
+    const target = to ?? this.peer;
+    if (!target) throw new KernelError("EDESTADDRREQ");
+    if (target.family !== "inet") throw new KernelError("EAFNOSUPPORT");
+    const max = familyOf(target.host) === 6 ? MAX_DATAGRAM_V6 : MAX_DATAGRAM_V4;
+    if (bytes.length > max) throw new KernelError("EMSGSIZE");
+    const where = this.route(target.host);
+    const local = this.bound();
+    if (where === "uplink") return this.sendUp(bytes, target);
+    const from = {
+      family: "inet",
+      host: local.host === "0.0.0.0" ? "127.0.0.1" : local.host,
+      port: local.port
+    };
+    const delivered = this.net.deliverDgram(target.port, { bytes: bytes.slice(), from });
+    if (!delivered && this.peer && sameAddr(this.peer, target)) {
+      this.pending = "ECONNREFUSED";
+      this.changes.wake();
+    }
+    return bytes.length;
+  }
+  async sendUp(bytes, to) {
+    const uplink = this.net.uplinkFor(to.host)?.uplink;
+    if (!uplink || !carriesUdp(uplink)) throw new KernelError("ENETUNREACH");
+    this.sending += bytes.length;
+    try {
+      const socket = await this.uplinkSocket(uplink, familyOf(to.host));
+      await socket.send(bytes.slice(), to.host, to.port);
+    } catch (e) {
+      throw sendError(e);
+    } finally {
+      this.sending -= bytes.length;
+      this.changes.wake();
+    }
+    return bytes.length;
+  }
+  uplinkSocket(uplink, family) {
+    const known = this.uplinks.get(family);
+    if (known !== void 0) return known;
+    const opening2 = Promise.resolve().then(() => {
+      if (!uplink.udp) throw new KernelError("ENETUNREACH");
+      return uplink.udp({ family, signal: this.stop.signal });
+    });
+    this.uplinks.set(family, opening2);
+    opening2.then(
+      (socket) => {
+        if (this.closed) {
+          socket.close();
+          return;
+        }
+        void this.pump(socket, family);
+      },
+      () => this.uplinks.delete(family)
+    );
+    return opening2;
+  }
+  async pump(socket, family) {
+    const iterate = async () => {
+      for await (const message3 of socket.messages) {
+        if (this.closed) return;
+        const from = { family: "inet", host: message3.host, port: message3.port };
+        if ("bytes" in message3) this.deliver({ bytes: message3.bytes, from });
+        else this.unreachable(message3.error, from);
+      }
+    };
+    await iterate().catch(() => void 0);
+    if (!this.closed) this.uplinks.delete(family);
+    socket.close();
+  }
+  unreachable(error, from) {
+    if (!this.peer || !sameAddr(this.peer, from)) return;
+    this.pending = UNREACHABLE.find((errno2) => errno2 === error) ?? "EHOSTUNREACH";
+    this.changes.wake();
+  }
+  deliver(datagram2) {
+    if (this.closed) return false;
+    if (this.peer && !sameAddr(this.peer, datagram2.from)) return true;
+    const full = this.queue.length >= DGRAM_QUEUE_COUNT || this.queued + datagram2.bytes.length > DGRAM_QUEUE_BYTES;
+    if (full) return true;
+    this.queue.push(datagram2);
+    this.queued += datagram2.bytes.length;
+    this.changes.wake();
+    return true;
+  }
+  async receive(max, peek, signal) {
+    for (; ; ) {
+      const pending = this.takeError();
+      if (pending) throw new KernelError(pending);
+      if (this.closed) throw new KernelError("EBADF");
+      const next2 = this.queue[0];
+      if (next2) {
+        if (!peek) {
+          this.queue.shift();
+          this.queued -= next2.bytes.length;
+          this.changes.wake();
+        }
+        const size = Math.max(0, max);
+        return {
+          bytes: next2.bytes.slice(0, size),
+          from: next2.from,
+          truncated: next2.bytes.length > size
+        };
+      }
+      await this.changes.wait(signal);
+    }
+  }
+  async read(max, signal) {
+    return (await this.receive(max, false, signal)).bytes;
+  }
+  async peek(max, signal) {
+    return (await this.receive(max, true, signal)).bytes;
+  }
+  write(bytes) {
+    return this.send(bytes);
+  }
+  poll() {
+    return {
+      readable: this.queue.length > 0 || this.pending !== void 0 || this.closed,
+      writable: this.sending < DGRAM_SEND_ROOM,
+      hangup: this.closed,
+      ...this.pending !== void 0 ? { error: true } : {}
+    };
+  }
+  changed(signal) {
+    return this.changes.wait(signal);
+  }
+  shutdown(how) {
+    if (!this.peer) throw new KernelError("ENOTCONN");
+    if (how < 0 || how > 2) throw new KernelError("EINVAL");
+  }
+  getOption(level, name2) {
+    if (level === SOL_SOCKET2) {
+      switch (name2) {
+        case SO_TYPE2:
+          return SOCK_DGRAM;
+        case SO_ERROR2: {
+          const pending = this.takeError();
+          return pending ? wasiErrno(pending) : 0;
+        }
+        case SO_DOMAIN2:
+          return AF_INET2;
+        case SO_BROADCAST:
+          return 0;
+        case SO_SNDBUF2:
+          return this.options.get(`${level}:${name2}`) ?? DGRAM_SEND_ROOM;
+        case SO_RCVBUF2:
+          return this.options.get(`${level}:${name2}`) ?? DGRAM_QUEUE_BYTES;
+      }
+    }
+    if (level === IPPROTO_IP && name2 >= IP_MULTICAST_FIRST && name2 <= IP_MULTICAST_LAST) {
+      throw new KernelError("ENOPROTOOPT");
+    }
+    return this.options.get(`${level}:${name2}`) ?? 0;
+  }
+  setOption(level, name2, value) {
+    if (level === SOL_SOCKET2 && name2 === SO_BROADCAST && value !== 0) {
+      throw new KernelError("EOPNOTSUPP");
+    }
+    if (level === IPPROTO_IP && name2 >= IP_MULTICAST_FIRST && name2 <= IP_MULTICAST_LAST) {
+      throw new KernelError("ENOPROTOOPT");
+    }
+    this.options.set(`${level}:${name2}`, value);
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.stop.abort();
+    for (const opening2 of this.uplinks.values()) {
+      opening2.then(
+        (socket) => socket.close(),
+        () => void 0
+      );
+    }
+    this.uplinks.clear();
+    if (this.local) this.net.releaseDgram(this.local, this);
+    this.queue.length = 0;
+    this.queued = 0;
+    this.changes.wake();
+  }
+};
+
 // src/fs/pages.ts
 var PAGE = 64 * 1024;
 var READAHEAD = 1024 * 1024;
@@ -11728,7 +12054,7 @@ function mountTable(mounts = []) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.95.2" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.96.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -12215,6 +12541,7 @@ function levelOf(file) {
   if (state.readable) bits2 |= EPOLL.IN;
   if (state.writable) bits2 |= EPOLL.OUT;
   if (state.rdhup) bits2 |= EPOLL.RDHUP;
+  if (state.error) bits2 |= EPOLL.ERR;
   if (state.hangup) bits2 |= file.read ? EPOLL.HUP : EPOLL.ERR;
   return bits2;
 }
@@ -13980,6 +14307,19 @@ async function waitReady(fds, read, write, deadline, interrupted3) {
   }
 }
 
+// src/kernel/net/datagram-wire.ts
+function encodeReceived(got) {
+  const host = new TextEncoder().encode(got.host);
+  const out = new Uint8Array(4 + host.length + got.bytes.length);
+  const view2 = new DataView(out.buffer);
+  view2.setUint8(0, got.truncated ? 1 : 0);
+  view2.setUint16(1, got.port);
+  view2.setUint8(3, host.length);
+  out.set(host, 4);
+  out.set(got.bytes, 4 + host.length);
+  return out;
+}
+
 // src/kernel/socket-syscalls.ts
 var SOCKET_OPS = [
   "sock-open",
@@ -13992,19 +14332,36 @@ var SOCKET_OPS = [
   "sock-name",
   "sock-getopt",
   "sock-setopt",
-  "sock-resolve"
+  "sock-resolve",
+  "sock-sendto",
+  "sock-recvfrom"
 ];
 function socketAt(fds, fd) {
+  const file = anySocketAt(fds, fd);
+  if (file instanceof KernelDgram) throw new KernelError("EOPNOTSUPP");
+  return file;
+}
+function anySocketAt(fds, fd) {
   const file = fds.get(fd).file;
-  if (!(file instanceof KernelSocket)) throw new KernelError("ENOTSOCK");
+  if (!(file instanceof KernelSocket) && !(file instanceof KernelDgram)) {
+    throw new KernelError("ENOTSOCK");
+  }
+  return file;
+}
+function dgramAt(fds, fd) {
+  const file = anySocketAt(fds, fd);
+  if (!(file instanceof KernelDgram)) throw new KernelError("EOPNOTSUPP");
   return file;
 }
 var ok2 = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
 async function socketSyscall(req, proc) {
   const { fds, net } = proc;
   switch (req.op) {
-    case "sock-open":
-      return ok2(fds.install(new OpenFile(net.socket(req.domain)), 3));
+    case "sock-open": {
+      if (req.type === "dgram" && req.domain !== "inet") throw new KernelError("EPROTONOSUPPORT");
+      const file = req.type === "dgram" ? new KernelDgram(net) : net.socket(req.domain);
+      return ok2(fds.install(new OpenFile(file), 3));
+    }
     case "sock-pair": {
       const [a, b] = KernelSocket.pair(net, req.domain, proc.cred?.());
       const first = fds.install(new OpenFile(a), 3);
@@ -14016,44 +14373,64 @@ async function socketSyscall(req, proc) {
       }
     }
     case "sock-bind":
-      socketAt(fds, req.fd).bind(req.addr);
+      anySocketAt(fds, req.fd).bind(req.addr);
       return ok2();
     case "sock-listen":
       socketAt(fds, req.fd).listen(req.backlog, proc.cred?.());
       return ok2();
     case "sock-accept":
       return ok2(await accept(proc, req.fd, req.nonblock));
-    case "sock-connect": {
-      const socket = socketAt(fds, req.fd);
-      const stamp = net.facadeAt(req.addr) && await proc.stamp?.();
-      const dialing = socket.connect(req.addr, true, proc.cred?.(), stamp || void 0);
-      if (req.nonblock) {
-        dialing?.catch(() => void 0);
-        throw new KernelError("EINPROGRESS");
-      }
-      if (dialing !== void 0) await interruptible2(dialing, proc.blocking());
-      return ok2();
-    }
+    case "sock-connect":
+      return connect(req, proc);
     case "sock-shutdown":
-      socketAt(fds, req.fd).shutdown(req.how);
+      anySocketAt(fds, req.fd).shutdown(req.how);
       return ok2();
     case "sock-name": {
-      const socket = socketAt(fds, req.fd);
+      const socket = anySocketAt(fds, req.fd);
       const addr = req.peer ? socket.peer : socket.local;
       if (req.peer && !addr) throw new KernelError("ENOTCONN");
-      return ok2(addr ?? unnamed(socket.domain));
+      return ok2(addr ?? unnamed(socket instanceof KernelDgram ? "inet" : socket.domain));
     }
     case "sock-getopt":
-      return ok2(socketAt(fds, req.fd).getOption(req.level, req.name));
+      return ok2(anySocketAt(fds, req.fd).getOption(req.level, req.name));
     case "sock-setopt":
-      socketAt(fds, req.fd).setOption(req.level, req.name, req.value);
+      anySocketAt(fds, req.fd).setOption(req.level, req.name, req.value);
       return ok2();
     case "sock-resolve": {
       const addresses = await proc.resolve(req.name, req.family, () => proc.blocking());
       if (addresses.length === 0) throw new KernelError("ENOENT");
       return ok2(addresses);
     }
+    default:
+      return datagram(req, proc);
+  }
+}
+async function connect(req, proc) {
+  const target = anySocketAt(proc.fds, req.fd);
+  if (target instanceof KernelDgram) {
+    target.connectTo(req.addr);
+    return ok2();
+  }
+  const stamp = proc.net.facadeAt(req.addr) && await proc.stamp?.();
+  const dialing = target.connect(req.addr, true, proc.cred?.(), stamp || void 0);
+  if (req.nonblock) {
+    dialing?.catch(() => void 0);
+    throw new KernelError("EINPROGRESS");
+  }
+  if (dialing !== void 0) await interruptible2(dialing, proc.blocking());
+  return ok2();
+}
+async function datagram(req, proc) {
+  const dgram = dgramAt(proc.fds, req.fd);
+  if (req.op === "sock-sendto") {
+    if (req.nonblock && !pollFile(dgram).writable) throw new KernelError("EAGAIN");
+    return ok2(await dgram.send(req.body, req.addr));
   }
+  const ready2 = pollFile(dgram).readable;
+  if (req.nonblock && !ready2) throw new KernelError("EAGAIN");
+  const got = await dgram.receive(req.max, req.peek, ready2 ? void 0 : proc.blocking());
+  const { bytes, from, truncated } = got;
+  return { ok: true, kind: "bytes", bytes: encodeReceived({ bytes, truncated, ...from }) };
 }
 function interruptible2(dialing, signal) {
   return new Promise((resolve2, reject) => {
@@ -15657,7 +16034,8 @@ var WasmProcess = class {
     const terminal = (file.tty ?? file.pty?.slave)?.name;
     return {
       tty: file.tty !== void 0,
-      kind: file instanceof KernelSocket ? "socket" : kernelFdKind(file),
+      kind: file instanceof KernelSocket || file instanceof KernelDgram ? "socket" : kernelFdKind(file),
+      ...file instanceof KernelDgram ? { dgram: true } : {},
       ...file.heldMeta ? { meta: file.heldMeta } : {},
       ...flags2 !== void 0 ? { flags: flags2 } : {},
       ...this.fds.closesOnExec(fd) ? { cloexec: true } : {},
@@ -16046,7 +16424,7 @@ function inheritedFds(fds) {
   return fds.numbers().filter((fd) => fd > 2 && !fds.get(fd).file.held).map((fd) => {
     const open = fds.get(fd);
     const flags2 = fds.statusFlags(fd);
-    const kind = open.file instanceof KernelSocket ? "socket" : kernelFdKind(open.file);
+    const kind = open.file instanceof KernelSocket || open.file instanceof KernelDgram ? "socket" : kernelFdKind(open.file);
     const meta = open.file.heldMeta;
     return {
       fd,
@@ -18691,7 +19069,7 @@ function grantConnect(hook, fetch2, liveness = {}) {
     return new HostfsClient(first, grant, fetch2);
   };
 }
-async function openHostfs(spec, connect, timing = {}) {
+async function openHostfs(spec, connect2, timing = {}) {
   const readonly2 = spec.options?.ro !== void 0;
   const { port1, port2 } = new MessageChannel();
   const slot2 = mediumSlot(
@@ -18718,7 +19096,7 @@ async function openHostfs(spec, connect, timing = {}) {
   );
   const watching = keepWatching(
     {
-      connect: () => connect(spec.source, { readonly: readonly2 }),
+      connect: () => connect2(spec.source, { readonly: readonly2 }),
       up(client) {
         active = timed(client, timing.callMs ?? HOSTFS_CALL_MS);
         slot2.insert(client, handlers);
@@ -21817,7 +22195,7 @@ function serveKernel(port, deps) {
     });
     return holding;
   }
-  async function connect(user, tag) {
+  async function connect2(user, tag) {
     const l = await ready2();
     tagOption(tag);
     if (user !== void 0 && !await l.users.lookup(user)) {
@@ -21898,7 +22276,7 @@ function serveKernel(port, deps) {
     if (req.op === "init") return init(req);
     if (isAttestRequest(req)) return attestOp(await ready2(), req);
     if (req.op === "open-terminal") return terminal(req);
-    if (req.op === "connect") return connect(req.user, req.tag);
+    if (req.op === "connect") return connect2(req.user, req.tag);
     if (isUsersRequest(req)) return usersOp(await ready2(), req);
     if (req.op === "routes" || req.op === "transport-traits") {
       return networkOp(await ready2(), req, remote);