@ai-ecoverse/slicc-kernel 1.95.3 → 1.96.0

package/dist/process-worker.js

@@ -4703,7 +4703,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.95.3" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.96.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -6473,6 +6473,7 @@ function entryOf(info) {
   return {
     type: "kernel",
     kind: info.kind,
+    dgram: info.dgram === true,
     nonblock: ((info.flags ?? 0) & O_NONBLOCK2) !== 0,
     append: ((info.flags ?? 0) & O_APPEND2) !== 0
   };
@@ -6687,8 +6688,8 @@ var init_wasi_fds = __esm({
       sockets() {
         return [...this.table].filter(([, e]) => e.type === "kernel" && e.kind === "socket").map(([fd]) => fd).sort((a, b) => a - b);
       }
-      adopt(fd, kind, nonblock) {
-        this.table.set(fd, { type: "kernel", kind, nonblock, append: false });
+      adopt(fd, kind, nonblock, dgram = false) {
+        this.table.set(fd, { type: "kernel", kind, dgram, nonblock, append: false });
         if (this.shared && nonblock) this.publishFlags(fd, { nonblock, append: false });
         this.bump();
       }
@@ -6910,9 +6911,17 @@ var init_wasi_fds = __esm({
         if (!e.kind) {
           const info = this.kernel.call({ op: "fd-info", fd });
           e.kind = info.kind ?? (info.tty ? "tty" : "stream");
+          e.dgram = info.dgram === true;
         }
         return e.kind;
       }
+      datagram(fd, e) {
+        if (this.kind(fd, e) !== "socket") return false;
+        if (e.dgram === void 0) {
+          e.dgram = this.kernel.call({ op: "fd-info", fd }).dgram === true;
+        }
+        return e.dgram;
+      }
       flushAll() {
         for (const buffer of this.buffers.values()) {
           try {
@@ -7464,169 +7473,526 @@ var init_wasi_termios = __esm({
   }
 });
 
-// src/process/wasi/wasi-host.ts
-function idOf3(value2) {
-  return value2 >>> 0 === 4294967295 ? void 0 : value2 >>> 0;
+// src/kernel/net/datagram-wire.ts
+function decodeReceived(raw) {
+  const view = new DataView(raw.buffer, raw.byteOffset, raw.byteLength);
+  const length = view.getUint8(3);
+  return {
+    truncated: (view.getUint8(0) & 1) !== 0,
+    port: view.getUint16(1),
+    host: new TextDecoder().decode(raw.subarray(4, 4 + length)),
+    bytes: raw.subarray(4 + length)
+  };
 }
-function linkedOf(st) {
-  return (st.nlink ?? 1) > 1 ? st : void 0;
+var init_datagram_wire = __esm({
+  "src/kernel/net/datagram-wire.ts"() {
+    "use strict";
+  }
+});
+
+// src/kernel/net/routes.ts
+function ipv4Bytes(text) {
+  const parts = text.split(".");
+  if (parts.length !== 4 || !parts.every((p) => /^\d{1,3}$/.test(p))) return void 0;
+  const bytes = parts.map(Number);
+  return bytes.every((b) => b <= 255) ? bytes : void 0;
 }
-function linkedElsewhere(fs, path) {
+function ipv6Groups(text) {
+  if (!text.includes(":")) return void 0;
+  let canonical;
   try {
-    return linkedOf(fs.lstat(path));
+    canonical = new URL(`http://[${text}]/`).hostname.slice(1, -1);
   } catch {
     return void 0;
   }
+  const [head, tail] = canonical.split("::");
+  const part = (s) => s ? s.split(":").map((h) => Number.parseInt(h, 16)) : [];
+  const front = part(head);
+  const back = part(tail);
+  return tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
 }
-function filetypeOf(s) {
-  if (!s) return FILETYPE.UNKNOWN;
-  if (s.isSymbolicLink) return FILETYPE.SYMBOLIC_LINK;
-  if (s.isDirectory) return FILETYPE.DIRECTORY;
-  return s.isFile ? FILETYPE.REGULAR_FILE : FILETYPE.UNKNOWN;
+function toBits(values, width) {
+  return values.reduce((acc, v) => acc << BigInt(width) | BigInt(v), 0n);
 }
-function filestatOf(path, s) {
-  return {
-    filetype: filetypeOf(s),
-    size: BigInt(s.size),
-    ino: s.ino !== void 0 ? BigInt(s.ino) : pathInode(path),
-    ...s.nlink !== void 0 ? { nlink: BigInt(s.nlink) } : {},
-    mtimeNs: BigInt(Math.round(s.mtimeMs ?? 0)) * NS_PER_MS
-  };
+function addressBits(host) {
+  const v4 = ipv4Bytes(host);
+  if (v4) return { v6: false, bits: toBits(v4, 8) };
+  const v6 = ipv6Groups(host);
+  return v6 ? { v6: true, bits: toBits(v6, 16) } : void 0;
 }
-function kernelFiletype(kind) {
-  switch (kind) {
-    case "tty":
-    case "sealed":
-    case "clipboard":
-      return { filetype: FILETYPE.CHARACTER_DEVICE, seeks: false };
-    case "device":
-      return { filetype: FILETYPE.CHARACTER_DEVICE, seeks: true };
-    case "socket":
-      return { filetype: FILETYPE.SOCKET_STREAM, seeks: false };
-    case "file":
-      return { filetype: FILETYPE.REGULAR_FILE, seeks: true };
-    default:
-      return { filetype: FILETYPE.UNKNOWN, seeks: false };
+function parsePrefix(text) {
+  const parts = text.trim().split("/");
+  if (parts.length > 2) return void 0;
+  const [address = "", size] = parts;
+  const parsed = addressBits(address);
+  if (!parsed) return void 0;
+  const max = parsed.v6 ? 128 : 32;
+  const length = size === void 0 ? max : /^\d{1,3}$/.test(size) ? Number(size) : -1;
+  if (length < 0 || length > max) return void 0;
+  return { ...parsed, length };
+}
+var HOST_ADDRESS, RESERVED;
+var init_routes = __esm({
+  "src/kernel/net/routes.ts"() {
+    "use strict";
+    init_loopback_names();
+    HOST_ADDRESS = HOST_LOOPBACK_ADDRESS.join(".");
+    RESERVED = [
+      "0.0.0.0/8",
+      "127.0.0.0/8",
+      "169.254.0.0/16",
+      "224.0.0.0/4",
+      "240.0.0.0/4",
+      "::/96",
+      "::ffff:0:0/96",
+      "fe80::/10",
+      "ff00::/8"
+    ].map((p) => parsePrefix(p));
+  }
+});
+
+// src/process/wasi/wasix-sockets.ts
+function readAddr(view, ptr) {
+  const tag = view.getUint8(ptr);
+  if (tag === UNIX) {
+    let end = ptr + 2;
+    while (end < ptr + 110 && view.getUint8(end) !== 0) end++;
+    const path = new TextDecoder().decode(
+      new Uint8Array(view.buffer, ptr + 2, end - ptr - 2).slice()
+    );
+    return { family: "unix", path };
+  }
+  const port2 = view.getUint16(ptr + 2, true);
+  if (tag === INET4) {
+    const host = [0, 1, 2, 3].map((i) => view.getUint8(ptr + 4 + i)).join(".");
+    return { family: "inet", host, port: port2 };
+  }
+  if (tag === INET6) {
+    return { family: "inet", host: ipv6Host(new Uint8Array(view.buffer, ptr + 4, 16)), port: port2 };
   }
+  throw new WasiError("EAFNOSUPPORT");
 }
-function direntRecord(next2, ino, name2, filetype) {
-  const nameBytes = new TextEncoder().encode(name2);
-  const record = new Uint8Array(SIZE.DIRENT + nameBytes.length);
-  const v = new DataView(record.buffer);
-  v.setBigUint64(0, BigInt(next2), true);
-  v.setBigUint64(8, ino, true);
-  v.setUint32(16, nameBytes.length, true);
-  v.setUint8(20, filetype);
-  record.set(nameBytes, SIZE.DIRENT);
-  return record;
+function ipv6Host(bytes) {
+  const zeros = (n) => bytes.subarray(0, n).every((b) => b === 0);
+  if (zeros(16)) return "0.0.0.0";
+  if (zeros(15) && bytes[15] === 1) return LOOPBACK;
+  if (zeros(10) && bytes[10] === 255 && bytes[11] === 255) return bytes.subarray(12).join(".");
+  const groups = [0, 2, 4, 6, 8, 10, 12, 14].map(
+    (i) => (bytes[i] << 8 | bytes[i + 1]).toString(16)
+  );
+  return new URL(`http://[${groups.join(":")}]/`).hostname.slice(1, -1);
 }
-function wrap(table) {
-  const out = {};
-  for (const [name2, fn] of Object.entries(table)) {
-    out[name2] = (...args) => {
-      try {
-        return fn(...args) ?? E.SUCCESS;
-      } catch (e) {
-        if (e instanceof WasiExit) throw e;
-        if (e instanceof WasiError) return wasiErrnoOf(e.code);
-        const code2 = e?.code;
-        if (typeof code2 === "string") return wasiErrnoOf(code2);
-        if (e instanceof RangeError) return E.FAULT;
-        throw e;
-      }
-    };
+function writeAddr(view, ptr, addr) {
+  new Uint8Array(view.buffer, ptr, 110).fill(0);
+  if (!addr) return;
+  if (addr.family === "unix") {
+    view.setUint8(ptr, UNIX);
+    new Uint8Array(view.buffer, ptr + 2, 107).set(
+      new TextEncoder().encode(addr.path).subarray(0, 107)
+    );
+    return;
   }
-  return out;
+  view.setUint16(ptr + 2, addr.port, true);
+  const groups = ipv4(addr.host) ? void 0 : ipv6Groups(addr.host);
+  if (groups) {
+    view.setUint8(ptr, INET6);
+    groups.forEach((g, i) => void view.setUint16(ptr + 4 + i * 2, g));
+    return;
+  }
+  view.setUint8(ptr, INET4);
+  const octets = ipv4(addr.host) ?? [127, 0, 0, 1];
+  octets.forEach((b, i) => void view.setUint8(ptr + 4 + i, b));
 }
-var WasiExit, IDS, NS_PER_MS, AT_SYMLINK_NOFOLLOW2, AT_EACCESS2, ROOT_IDS, GONE, S_IFIFO, DEFAULT_UMASK, MONOTONIC_BASE, MAX_READ, SIGPIPE_EXIT, SIG_IGN, SEALED_MODE, WasiHost;
-var init_wasi_host = __esm({
-  "src/process/wasi/wasi-host.ts"() {
-    "use strict";
-    init_dev_removal();
-    init_physical_path();
-    init_cpu_clock();
-    init_cred();
-    init_wasi_abi();
-    init_wasi_fds();
-    init_wasi_files();
-    init_wasi_memory();
-    init_wasi_poll();
-    init_wasi_termios();
-    WasiExit = class extends Error {
-      code;
-      constructor(code2) {
-        super(`exit ${code2}`);
-        this.code = code2;
-      }
-    };
-    IDS = ["ruid", "euid", "suid", "rgid", "egid", "sgid"];
-    NS_PER_MS = 1000000n;
-    AT_SYMLINK_NOFOLLOW2 = 1;
-    AT_EACCESS2 = 2;
-    ROOT_IDS = Object.freeze({ uid: 0, gid: 0 });
-    GONE = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
-    S_IFIFO = 4096;
-    DEFAULT_UMASK = 18;
-    MONOTONIC_BASE = BigInt(Math.round(performance.timeOrigin)) * NS_PER_MS;
-    MAX_READ = 1024 * 1024;
-    SIGPIPE_EXIT = 141;
-    SIG_IGN = 1;
-    SEALED_MODE = 8630;
-    WasiHost = class {
-      mem = new WasiMemory();
-      fds;
-      started = performance.now();
-      cache;
-      startCwd;
-      interruptWakes = false;
-      entered = false;
-      onRaise;
-      muted;
-      signals;
-      sigmask;
-      linkedTls;
-      linkedModules;
-      interrupted;
-      quietly = (fn) => fn();
-      listening;
-      o;
-      constructor(o) {
-        const { kernel } = o;
-        const call2 = (req) => {
-          if (req.op !== "fd-promote") this.fds.flushEarly();
-          return kernel.call(req);
-        };
-        const sys = new Proxy(kernel.sys, {
-          get: (target, name2) => {
-            const member = Reflect.get(target, name2);
-            if (typeof member !== "function") return member;
-            return (...args) => {
-              this.fds.flushEarly();
-              return member.apply(target, args);
-            };
-          }
-        });
-        this.o = { ...o, kernel: { sys, call: call2 } };
-        this.startCwd = o.cwd;
-        this.fds = new WasiFds(this.o.kernel, o.fs);
-        if (o.shared) this.fds.share(o.shared, true);
-        else if (o.forked) this.fds.restore(o.forked.fds, o.forked.cloexec);
-        else this.fds.setup(o.cwd, o.inherited ?? [], o.preopenRoot === true);
-        this.listening = o.shared ? [] : this.fds.sockets();
-      }
-      get cwd() {
-        return this.fds.cwd() ?? this.startCwd;
-      }
-      created(path, mode) {
-        const umask = this.o.kernel.call({ op: "proc-umask" });
-        if (umask !== DEFAULT_UMASK) this.o.fs.chmod(path, mode & ~umask);
-      }
-      sliccTtyImports() {
-        return wrap(sliccTty(this.mem, this.fds, this.o.kernel, () => this.interrupted?.()));
-      }
-      sliccFsImports() {
-        const { mem, fds } = this;
-        const at = (dirfd, p, l) => fds.resolve(dirfd, mem.string(p, l));
+function ipBytes(host) {
+  const groups = ipv4(host) ? void 0 : ipv6Groups(host);
+  return groups ? groups.flatMap((g) => [g >> 8, g & 255]) : ipv4(host);
+}
+function ipv4(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4) return void 0;
+  const bytes = parts.map((p) => /^\d{1,3}$/.test(p) ? Number(p) : Number.NaN);
+  return bytes.every((b) => b >= 0 && b <= 255) ? bytes : void 0;
+}
+function openRequest(af, type) {
+  if (af !== INET4 && af !== INET6 && af !== UNIX) throw new WasiError("EAFNOSUPPORT");
+  if (type !== STREAM && (type !== DGRAM || af === UNIX)) throw new WasiError("EPROTONOSUPPORT");
+  const domain = af === UNIX ? "unix" : "inet";
+  return {
+    op: "sock-open",
+    domain,
+    ...type === DGRAM ? { type: "dgram" } : {}
+  };
+}
+function optionalAddr(view, ptr) {
+  if (ptr === 0 || view.getUint8(ptr) === 0) return void 0;
+  return readAddr(view, ptr);
+}
+function datagramCalls(host) {
+  const { mem, o } = host;
+  const call2 = (req) => o.kernel.call(req);
+  return {
+    recvFrom(fd, nonblock, iovs, n, riflags, outLen, outFlags, outAddr) {
+      const max = Math.min(mem.capacity(iovs, n), MAX_DATAGRAM);
+      const peek = (riflags & RIFLAG_PEEK) !== 0;
+      const raw = call2({ op: "sock-recvfrom", fd, max, peek, nonblock });
+      const got = decodeReceived(raw);
+      const view = mem.view();
+      view.setUint32(outLen, mem.scatter(iovs, n, got.bytes), true);
+      view.setUint16(outFlags, got.truncated ? RECV_DATA_TRUNCATED : 0, true);
+      if (outAddr)
+        writeAddr(mem.view(), outAddr, { family: "inet", host: got.host, port: got.port });
+      return E.SUCCESS;
+    },
+    sendTo(fd, nonblock, iovs, n, addr, out) {
+      const to = optionalAddr(mem.view(), addr);
+      const body = mem.gather(iovs, n);
+      const sent = call2({ op: "sock-sendto", fd, body, ...to ? { addr: to } : {}, nonblock });
+      mem.view().setUint32(out, sent, true);
+      return E.SUCCESS;
+    }
+  };
+}
+function wasixSocketImports(host, preview1) {
+  const { mem, fds, o } = host;
+  const call2 = (req) => o.kernel.call(req);
+  const socket = (fd) => {
+    const e = fds.get(fd);
+    if (e.type !== "kernel" || fds.kind(fd, e) !== "socket") throw new WasiError("ENOTSOCK");
+    return e;
+  };
+  const option = (opt) => OPTIONS[opt];
+  const datagrams = (fd) => {
+    try {
+      const e = fds.get(fd);
+      return e.type === "kernel" && fds.datagram(fd, e);
+    } catch {
+      return false;
+    }
+  };
+  const dgram = datagramCalls(host);
+  return {
+    sock_open: (af, type, _proto, out) => {
+      const req = openRequest(af, type);
+      const fd = call2(req);
+      fds.adopt(fd, "socket", false, "type" in req);
+      mem.view().setUint32(out, fd, true);
+    },
+    sock_pair: (af, type, _proto, out1, out2) => {
+      if (af !== UNIX)
+        throw new WasiError(af === INET4 || af === INET6 ? "EOPNOTSUPP" : "EAFNOSUPPORT");
+      if (type !== STREAM) throw new WasiError("EPROTONOSUPPORT");
+      mem.view().setUint32(out1, 0, true);
+      mem.view().setUint32(out2, 0, true);
+      const [a, b] = call2({ op: "sock-pair", domain: "unix" });
+      fds.adopt(a, "socket", false);
+      fds.adopt(b, "socket", false);
+      mem.view().setUint32(out1, a, true);
+      mem.view().setUint32(out2, b, true);
+    },
+    sock_bind: (fd, addr) => {
+      socket(fd);
+      call2({ op: "sock-bind", fd, addr: readAddr(mem.view(), addr) });
+    },
+    sock_listen: (fd, backlog) => {
+      socket(fd);
+      call2({ op: "sock-listen", fd, backlog });
+    },
+    sock_connect: (fd, addr) => {
+      const e = socket(fd);
+      call2({ op: "sock-connect", fd, addr: readAddr(mem.view(), addr), nonblock: e.nonblock });
+    },
+    sock_accept_v2: (fd, flags, outFd, outAddr) => {
+      const e = socket(fd);
+      const r = call2({ op: "sock-accept", fd, nonblock: e.nonblock });
+      fds.adopt(r.fd, "socket", (flags & FDFLAGS.NONBLOCK) !== 0);
+      mem.view().setUint32(outFd, r.fd, true);
+      writeAddr(mem.view(), outAddr, r.peer);
+    },
+    sock_addr_local: (fd, out) => {
+      socket(fd);
+      writeAddr(mem.view(), out, call2({ op: "sock-name", fd, peer: false }));
+    },
+    sock_addr_peer: (fd, out) => {
+      socket(fd);
+      writeAddr(mem.view(), out, call2({ op: "sock-name", fd, peer: true }));
+    },
+    sock_recv_from: (fd, iovs, n, riflags, outLen, outFlags, outAddr) => {
+      if (datagrams(fd)) {
+        const e = socket(fd);
+        return dgram.recvFrom(fd, e.nonblock, iovs, n, riflags, outLen, outFlags, outAddr);
+      }
+      const r = preview1.sock_recv(
+        fd,
+        iovs,
+        n,
+        riflags,
+        outLen,
+        outFlags
+      );
+      if (r !== E.SUCCESS) return r;
+      writeAddr(mem.view(), outAddr, call2({ op: "sock-name", fd, peer: true }));
+      return E.SUCCESS;
+    },
+    sock_send_to: (fd, iovs, n, flags, addr, out) => {
+      if (datagrams(fd)) return dgram.sendTo(fd, socket(fd).nonblock, iovs, n, addr, out);
+      return preview1.sock_send(
+        fd,
+        iovs,
+        n,
+        flags,
+        out
+      );
+    },
+    sock_status: (fd, out) => {
+      socket(fd);
+      mem.view().setUint8(out, 1);
+    },
+    sock_get_opt_flag: (fd, opt, out) => {
+      socket(fd);
+      const pair = option(opt);
+      const v = pair ? call2({ op: "sock-getopt", fd, level: pair[0], name: pair[1] }) : 0;
+      mem.view().setUint8(out, v ? 1 : 0);
+    },
+    sock_set_opt_flag: (fd, opt, flag) => {
+      socket(fd);
+      const pair = option(opt);
+      if (pair) call2({ op: "sock-setopt", fd, level: pair[0], name: pair[1], value: flag ? 1 : 0 });
+    },
+    sock_get_opt_size: (fd, opt, out) => {
+      socket(fd);
+      const pair = option(opt);
+      const v = pair ? call2({ op: "sock-getopt", fd, level: pair[0], name: pair[1] }) : 0;
+      mem.view().setBigUint64(out, BigInt(v), true);
+    },
+    sock_set_opt_size: (fd, opt, size) => {
+      socket(fd);
+      const pair = option(opt);
+      if (pair) call2({ op: "sock-setopt", fd, level: pair[0], name: pair[1], value: Number(size) });
+    },
+    sock_get_opt_time: (fd, _opt, out) => {
+      socket(fd);
+      new Uint8Array(mem.view().buffer, out, 16).fill(0);
+    },
+    sock_set_opt_time: (fd) => void socket(fd),
+    sock_send_file: () => E.NOSYS,
+    resolve: (name2, len, _port, addrs, naddrs, out) => {
+      const found = call2({ op: "sock-resolve", name: mem.string(name2, len), family: 0 });
+      const ips = found.map(ipBytes).filter((ip) => ip !== void 0);
+      if (ips.length === 0) throw new WasiError("ENOENT");
+      if (naddrs < 1) throw new WasiError("EINVAL");
+      const view = mem.view();
+      const count = Math.min(ips.length, naddrs);
+      new Uint8Array(view.buffer, addrs, ADDR_IP_SIZE * count).fill(0);
+      for (let i = 0; i < count; i++) {
+        const at = addrs + i * ADDR_IP_SIZE;
+        view.setUint8(at, ips[i].length === 4 ? INET4 : INET6);
+        new Uint8Array(view.buffer, at + 2, ips[i].length).set(ips[i]);
+      }
+      view.setUint32(out, count, true);
+    }
+  };
+}
+var INET4, INET6, UNIX, STREAM, DGRAM, RECV_DATA_TRUNCATED, RIFLAG_PEEK, MAX_DATAGRAM, ADDR_IP_SIZE, LOOPBACK, OPTIONS;
+var init_wasix_sockets = __esm({
+  "src/process/wasi/wasix-sockets.ts"() {
+    "use strict";
+    init_datagram_wire();
+    init_routes();
+    init_wasi_abi();
+    init_wasi_files();
+    INET4 = 1;
+    INET6 = 2;
+    UNIX = 3;
+    STREAM = 1;
+    DGRAM = 2;
+    RECV_DATA_TRUNCATED = 1;
+    RIFLAG_PEEK = 1;
+    MAX_DATAGRAM = 65536;
+    ADDR_IP_SIZE = 18;
+    LOOPBACK = "127.0.0.1";
+    OPTIONS = {
+      1: [1, 15],
+      2: [1, 2],
+      3: [6, 1],
+      4: [1, 5],
+      6: [1, 6],
+      10: [1, 30],
+      11: [1, 4],
+      12: [1, 9],
+      14: [1, 10],
+      15: [1, 8],
+      16: [1, 7],
+      25: [1, 3]
+    };
+  }
+});
+
+// src/process/wasi/wasi-host.ts
+function idOf3(value2) {
+  return value2 >>> 0 === 4294967295 ? void 0 : value2 >>> 0;
+}
+function linkedOf(st) {
+  return (st.nlink ?? 1) > 1 ? st : void 0;
+}
+function linkedElsewhere(fs, path) {
+  try {
+    return linkedOf(fs.lstat(path));
+  } catch {
+    return void 0;
+  }
+}
+function filetypeOf(s) {
+  if (!s) return FILETYPE.UNKNOWN;
+  if (s.isSymbolicLink) return FILETYPE.SYMBOLIC_LINK;
+  if (s.isDirectory) return FILETYPE.DIRECTORY;
+  return s.isFile ? FILETYPE.REGULAR_FILE : FILETYPE.UNKNOWN;
+}
+function filestatOf(path, s) {
+  return {
+    filetype: filetypeOf(s),
+    size: BigInt(s.size),
+    ino: s.ino !== void 0 ? BigInt(s.ino) : pathInode(path),
+    ...s.nlink !== void 0 ? { nlink: BigInt(s.nlink) } : {},
+    mtimeNs: BigInt(Math.round(s.mtimeMs ?? 0)) * NS_PER_MS
+  };
+}
+function kernelFiletype(kind) {
+  switch (kind) {
+    case "tty":
+    case "sealed":
+    case "clipboard":
+      return { filetype: FILETYPE.CHARACTER_DEVICE, seeks: false };
+    case "device":
+      return { filetype: FILETYPE.CHARACTER_DEVICE, seeks: true };
+    case "socket":
+      return { filetype: FILETYPE.SOCKET_STREAM, seeks: false };
+    case "dgram":
+      return { filetype: FILETYPE.SOCKET_DGRAM, seeks: false };
+    case "file":
+      return { filetype: FILETYPE.REGULAR_FILE, seeks: true };
+    default:
+      return { filetype: FILETYPE.UNKNOWN, seeks: false };
+  }
+}
+function direntRecord(next2, ino, name2, filetype) {
+  const nameBytes = new TextEncoder().encode(name2);
+  const record = new Uint8Array(SIZE.DIRENT + nameBytes.length);
+  const v = new DataView(record.buffer);
+  v.setBigUint64(0, BigInt(next2), true);
+  v.setBigUint64(8, ino, true);
+  v.setUint32(16, nameBytes.length, true);
+  v.setUint8(20, filetype);
+  record.set(nameBytes, SIZE.DIRENT);
+  return record;
+}
+function wrap(table) {
+  const out = {};
+  for (const [name2, fn] of Object.entries(table)) {
+    out[name2] = (...args) => {
+      try {
+        return fn(...args) ?? E.SUCCESS;
+      } catch (e) {
+        if (e instanceof WasiExit) throw e;
+        if (e instanceof WasiError) return wasiErrnoOf(e.code);
+        const code2 = e?.code;
+        if (typeof code2 === "string") return wasiErrnoOf(code2);
+        if (e instanceof RangeError) return E.FAULT;
+        throw e;
+      }
+    };
+  }
+  return out;
+}
+var WasiExit, IDS, NS_PER_MS, AT_SYMLINK_NOFOLLOW2, AT_EACCESS2, ROOT_IDS, GONE, S_IFIFO, DEFAULT_UMASK, MONOTONIC_BASE, MAX_READ, SIGPIPE_EXIT, SIG_IGN, SEALED_MODE, WasiHost;
+var init_wasi_host = __esm({
+  "src/process/wasi/wasi-host.ts"() {
+    "use strict";
+    init_dev_removal();
+    init_physical_path();
+    init_cpu_clock();
+    init_cred();
+    init_wasi_abi();
+    init_wasi_fds();
+    init_wasi_files();
+    init_wasi_memory();
+    init_wasi_poll();
+    init_wasi_termios();
+    init_wasix_sockets();
+    WasiExit = class extends Error {
+      code;
+      constructor(code2) {
+        super(`exit ${code2}`);
+        this.code = code2;
+      }
+    };
+    IDS = ["ruid", "euid", "suid", "rgid", "egid", "sgid"];
+    NS_PER_MS = 1000000n;
+    AT_SYMLINK_NOFOLLOW2 = 1;
+    AT_EACCESS2 = 2;
+    ROOT_IDS = Object.freeze({ uid: 0, gid: 0 });
+    GONE = /* @__PURE__ */ new Set(["ENOENT", "ENOTDIR"]);
+    S_IFIFO = 4096;
+    DEFAULT_UMASK = 18;
+    MONOTONIC_BASE = BigInt(Math.round(performance.timeOrigin)) * NS_PER_MS;
+    MAX_READ = 1024 * 1024;
+    SIGPIPE_EXIT = 141;
+    SIG_IGN = 1;
+    SEALED_MODE = 8630;
+    WasiHost = class {
+      mem = new WasiMemory();
+      fds;
+      started = performance.now();
+      cache;
+      startCwd;
+      interruptWakes = false;
+      entered = false;
+      onRaise;
+      muted;
+      signals;
+      sigmask;
+      linkedTls;
+      linkedModules;
+      interrupted;
+      quietly = (fn) => fn();
+      listening;
+      o;
+      constructor(o) {
+        const { kernel } = o;
+        const call2 = (req) => {
+          if (req.op !== "fd-promote") this.fds.flushEarly();
+          return kernel.call(req);
+        };
+        const sys = new Proxy(kernel.sys, {
+          get: (target, name2) => {
+            const member = Reflect.get(target, name2);
+            if (typeof member !== "function") return member;
+            return (...args) => {
+              this.fds.flushEarly();
+              return member.apply(target, args);
+            };
+          }
+        });
+        this.o = { ...o, kernel: { sys, call: call2 } };
+        this.startCwd = o.cwd;
+        this.fds = new WasiFds(this.o.kernel, o.fs);
+        if (o.shared) this.fds.share(o.shared, true);
+        else if (o.forked) this.fds.restore(o.forked.fds, o.forked.cloexec);
+        else this.fds.setup(o.cwd, o.inherited ?? [], o.preopenRoot === true);
+        this.listening = o.shared ? [] : this.fds.sockets();
+      }
+      get cwd() {
+        return this.fds.cwd() ?? this.startCwd;
+      }
+      created(path, mode) {
+        const umask = this.o.kernel.call({ op: "proc-umask" });
+        if (umask !== DEFAULT_UMASK) this.o.fs.chmod(path, mode & ~umask);
+      }
+      sliccTtyImports() {
+        return wrap(sliccTty(this.mem, this.fds, this.o.kernel, () => this.interrupted?.()));
+      }
+      sliccFsImports() {
+        const { mem, fds } = this;
+        const at = (dirfd, p, l) => fds.resolve(dirfd, mem.string(p, l));
         const pathOf = (fd) => {
           const e = fds.get(fd);
           if (e.type === "dir") return e.path;
@@ -8055,6 +8421,18 @@ var init_wasi_host = __esm({
           },
           sock_recv: (fd, iovs, n, riflags, outLen, outFlags) => {
             const e = this.socket(fd);
+            if (this.fds.datagram(fd, e)) {
+              return datagramCalls(this).recvFrom(
+                fd,
+                e.nonblock,
+                iovs,
+                n,
+                riflags,
+                outLen,
+                outFlags,
+                0
+              );
+            }
             const peek = (riflags & RIFLAGS.PEEK) !== 0;
             const want = mem.capacity(iovs, n);
             const data = (riflags & RIFLAGS.WAITALL) !== 0 && !peek ? this.recvAll(fd, want, e.nonblock) : o.kernel.sys.read(fd, Math.min(want, MAX_READ), { nonblock: e.nonblock, peek });
@@ -8221,7 +8599,7 @@ var init_wasi_host = __esm({
         if (e.type === "kernel") {
           const kind = this.fds.kind(fd, e);
           if (kind === "device") this.interrupted?.();
-          ({ filetype, seeks } = kernelFiletype(kind));
+          ({ filetype, seeks } = kernelFiletype(this.fds.datagram(fd, e) ? "dgram" : kind));
           if (e.nonblock) flags |= FDFLAGS.NONBLOCK;
           if (e.append) flags |= FDFLAGS.APPEND;
         } else if (e.type === "file") {
@@ -8849,7 +9227,7 @@ function importsContext({
 }
 function loopbackHost(host) {
   if (host === "localhost") return "127.0.0.1";
-  if (typeof host === "string" && LOOPBACK.test(host)) return host;
+  if (typeof host === "string" && LOOPBACK2.test(host)) return host;
   throw new WasiError("EINVAL");
 }
 function network(raw, call2) {
@@ -8928,7 +9306,7 @@ function processes(host, call2, inThread) {
     }
   };
 }
-var UID2, LOOPBACK, SOL_SOCKET, SO_ERROR, STDIO;
+var UID2, LOOPBACK2, SOL_SOCKET, SO_ERROR, STDIO;
 var init_wasi_imports = __esm({
   "src/process/wasi/wasi-imports.ts"() {
     "use strict";
@@ -8937,7 +9315,7 @@ var init_wasi_imports = __esm({
     init_wasi_threads();
     init_wasix_process();
     UID2 = 1e3;
-    LOOPBACK = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+    LOOPBACK2 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
     SOL_SOCKET = 1;
     SO_ERROR = 4;
     STDIO = ["stdin", "stdout", "stderr"];
@@ -10434,524 +10812,252 @@ var init_wasix_linker = __esm({
           memory: this.memory,
           table: this.table,
           stackPointer: this.stackPointer,
-          backing: record.backing,
-          userData: record.userData
-        });
-        this.table.set(record.index, fn);
-        this.types.set(fn, sig);
-      }
-      reserveLoad(size) {
-        return this.indices?.load(this.table.length, size) ?? {
-          base: this.table.length,
-          handle: this.nextHandle++
-        };
-      }
-      reserve(size) {
-        return this.indices?.reserve(this.table.length, size) ?? this.table.length;
-      }
-      tlsBases() {
-        const bases = [];
-        for (const [handle, linked] of this.modules) {
-          const base = linked.instance.exports.__tls_base;
-          if (base instanceof WebAssembly.Global) bases.push([handle, base.value]);
-        }
-        return bases;
-      }
-      carryTls(linked) {
-        const base = this.forkedTls?.get(linked.handle);
-        const global = linked.instance.exports.__tls_base;
-        if (base === void 0 || !(global instanceof WebAssembly.Global)) return false;
-        global.value = base;
-        return true;
-      }
-      replay(record) {
-        if (record.kind === "closure") {
-          growTable(this.table, record.index + 1);
-          this.live.add(record.index);
-          return;
-        }
-        if (record.kind === "closure-free") {
-          this.live.delete(record.index);
-          if (record.index < this.table.length) this.table.set(record.index, null);
-          return;
-        }
-        if (record.kind === "closure-prepare") {
-          this.install(record);
-          return;
-        }
-        if (record.kind === "load") {
-          if (this.modules.has(record.handle)) return;
-          const linked = this.instantiate(record.path, this.moduleAt(record.path), record, false);
-          linked.needed.push(...record.needed ?? []);
-          this.nextHandle = Math.max(this.nextHandle, record.handle + 1);
-          return;
-        }
-        const value2 = record.handle === 0 ? this.main?.exports[record.name] : this.module(record.handle).instance.exports[record.name];
-        if (typeof value2 !== "function") throw new DlError(`${record.name}: not a function`);
-        growTable(this.table, record.index + 1);
-        this.table.set(record.index, value2);
-        this.slots.set(value2, record.index);
-      }
-      moduleAt(path) {
-        const cached = this.cache?.[path];
-        if (cached) return cached;
-        const bytes = this.host.read(path);
-        if (!bytes) throw new DlError(`${path}: gone`);
-        return new WebAssembly.Module(bytes);
-      }
-      module(handle) {
-        const m = this.modules.get(handle);
-        if (!m) throw new DlError(`invalid handle ${handle}`);
-        return m;
-      }
-      locate(name2, cwd, ldPath) {
-        if (name2.includes("/"))
-          return name2.startsWith("/") ? normalize(name2) : normalize(`${cwd}/${name2}`);
-        for (const dir of [...ldPath.filter(Boolean), ...LIBRARY_DIRS]) {
-          const path = normalize(`${dir.startsWith("/") ? "" : `${cwd}/`}${dir}/${name2}`);
-          if (this.byPath.has(path) || this.host.read(path)) return path;
-        }
-        throw new DlError(`${name2}: not found`);
-      }
-      load(path, cwd, ldPath) {
-        const loaded = this.byPath.get(path);
-        if (loaded) return loaded;
-        const bytes = this.host.read(path);
-        if (!bytes) throw new DlError(`${path}: no such file`);
-        let module;
-        try {
-          module = new WebAssembly.Module(bytes);
-        } catch (e) {
-          throw new DlError(`${path}: not a wasm module (${e.message})`);
-        }
-        const info = dylinkInfo(module);
-        if (!info) throw new DlError(`${path}: not a side module (no dylink.0)`);
-        const dir = path.slice(0, path.lastIndexOf("/")) || "/";
-        const search = [dir, ...ldPath, ...info.runtimePath.map((p) => expandOrigin(p, dir))];
-        const needed = info.needed.map(
-          (n) => this.load(this.locate(n, cwd, search), cwd, ldPath).handle
-        );
-        const memoryBase = this.allocate(info.memorySize, 2 ** info.memoryAlign);
-        const { base: tableBase, handle } = this.reserveLoad(info.tableSize);
-        const record = {
-          kind: "load",
-          handle,
-          path,
-          memoryBase,
-          tableBase,
-          ...needed.length > 0 ? { needed } : {}
-        };
-        const linked = this.instantiate(path, module, record, true);
-        linked.needed.push(...needed);
-        this.publisher?.(record);
-        return linked;
-      }
-      instantiate(path, module, at, init) {
-        const info = dylinkInfo(module);
-        growTable(this.table, at.tableBase + info.tableSize);
-        const pending = [];
-        const env = {
-          memory: this.memory,
-          __indirect_function_table: this.table,
-          __stack_pointer: this.stackPointer,
-          __memory_base: new WebAssembly.Global({ value: "i32", mutable: false }, at.memoryBase),
-          __table_base: new WebAssembly.Global({ value: "i32", mutable: false }, at.tableBase),
-          __c_longjmp: this.cLongjmp,
-          __cpp_exception: this.cppException
-        };
-        const gotMem = {};
-        const gotFunc = {};
-        const linked = {
-          handle: at.handle,
-          path,
-          module,
-          info,
-          instance: void 0,
-          memoryBase: at.memoryBase,
-          tableBase: at.tableBase,
-          needed: []
-        };
-        for (const imp of WebAssembly.Module.imports(module)) {
-          if (imp.module === "env" && imp.kind === "function" && !(imp.name in env)) {
-            env[imp.name] = this.functionImport(imp.name);
-          } else if (imp.module === "GOT.mem") {
-            const g = new WebAssembly.Global({ value: "i32", mutable: true }, 0);
-            gotMem[imp.name] = g;
-            pending.push(() => {
-              g.value = this.addressOrNull(imp.name);
-            });
-          } else if (imp.module === "GOT.func") {
-            const g = new WebAssembly.Global({ value: "i32", mutable: true }, 0);
-            gotFunc[imp.name] = g;
-            pending.push(() => {
-              g.value = this.slotOrNull(imp.name);
-            });
-          }
-        }
-        const imports = {
-          ...this.host.hostImports(module),
-          env,
-          "GOT.mem": gotMem,
-          "GOT.func": gotFunc
-        };
-        linked.instance = new WebAssembly.Instance(module, imports);
-        this.types.register(() => this.host.read(path), linked.instance, this.table, at.tableBase);
-        this.modules.set(at.handle, linked);
-        const first = this.byPath.get(path);
-        if (!first || at.handle < first.handle) this.byPath.set(path, linked);
-        for (const resolve of pending) resolve();
-        if (init) {
-          call(linked.instance, "__wasm_apply_data_relocs");
-          call(linked.instance, "__wasm_call_ctors");
-        } else if (!this.carryTls(linked)) {
-          call(linked.instance, "__wasix_init_tls");
-        }
-        return linked;
-      }
-      functionImport(name2) {
-        const now = this.find(name2);
-        if (now && typeof now[1] === "function") return now[1];
-        let resolved2;
-        return (...args) => {
-          if (!resolved2) {
-            const later = this.find(name2);
-            if (!later || typeof later[1] !== "function")
-              throw new WebAssembly.RuntimeError(`unresolved symbol ${name2}`);
-            resolved2 = later[1];
-          }
-          return resolved2(...args);
-        };
-      }
-      addressOrNull(name2) {
-        const found = this.find(name2);
-        if (!found || !(found[1] instanceof WebAssembly.Global)) return 0;
-        return this.baseOf(found[0]) + found[1].value;
-      }
-      slotOrNull(name2) {
-        const found = this.find(name2);
-        if (!found || typeof found[1] !== "function") return 0;
-        return this.slot(found[1], found[0], name2);
-      }
-      find(name2) {
-        const inMain = this.main?.exports[name2];
-        if (inMain !== void 0) return [0, inMain];
-        for (const m of this.modules.values()) {
-          const v = m.instance?.exports[name2];
-          if (v !== void 0) return [m.handle, v];
-        }
-        return void 0;
-      }
-      findIn(m, name2, seen) {
-        if (seen.has(m.handle)) return void 0;
-        seen.add(m.handle);
-        const v = m.instance.exports[name2];
-        if (v !== void 0) return [m.handle, v];
-        for (const h of m.needed) {
-          const found = this.findIn(this.module(h), name2, seen);
-          if (found) return found;
-        }
-        return void 0;
-      }
-      baseOf(handle) {
-        return handle === 0 ? this.memoryBase : this.module(handle).memoryBase;
-      }
-      indexed = 0;
-      indexTable() {
-        for (let i = this.indexed; i < this.table.length; i++) {
-          const fn = this.table.get(i);
-          if (fn && !this.slots.has(fn)) this.slots.set(fn, i);
-        }
-        this.indexed = this.table.length;
-      }
-      slot(fn, handle, name2) {
-        this.indexTable();
-        const known = this.slots.get(fn);
-        if (known !== void 0) return known;
-        const index3 = this.reserve(1);
-        growTable(this.table, index3 + 1);
-        this.table.set(index3, fn);
-        this.slots.set(fn, index3);
-        this.publisher?.({ kind: "slot", index: index3, handle, name: name2 });
-        return index3;
+          backing: record.backing,
+          userData: record.userData
+        });
+        this.table.set(record.index, fn);
+        this.types.set(fn, sig);
       }
-      allocate(size, alignment) {
-        if (size === 0) return 0;
-        const to = Math.max(alignment, 16);
-        const pages2 = Math.ceil((size + (to > PAGE2 ? to : 0)) / PAGE2);
-        return align(this.memory.grow(pages2) * PAGE2, to);
+      reserveLoad(size) {
+        return this.indices?.load(this.table.length, size) ?? {
+          base: this.table.length,
+          handle: this.nextHandle++
+        };
       }
-    };
-  }
-});
-
-// src/kernel/net/routes.ts
-function ipv4Bytes(text) {
-  const parts = text.split(".");
-  if (parts.length !== 4 || !parts.every((p) => /^\d{1,3}$/.test(p))) return void 0;
-  const bytes = parts.map(Number);
-  return bytes.every((b) => b <= 255) ? bytes : void 0;
-}
-function ipv6Groups(text) {
-  if (!text.includes(":")) return void 0;
-  let canonical;
-  try {
-    canonical = new URL(`http://[${text}]/`).hostname.slice(1, -1);
-  } catch {
-    return void 0;
-  }
-  const [head, tail] = canonical.split("::");
-  const part = (s) => s ? s.split(":").map((h) => Number.parseInt(h, 16)) : [];
-  const front = part(head);
-  const back = part(tail);
-  return tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
-}
-function toBits(values, width) {
-  return values.reduce((acc, v) => acc << BigInt(width) | BigInt(v), 0n);
-}
-function addressBits(host) {
-  const v4 = ipv4Bytes(host);
-  if (v4) return { v6: false, bits: toBits(v4, 8) };
-  const v6 = ipv6Groups(host);
-  return v6 ? { v6: true, bits: toBits(v6, 16) } : void 0;
-}
-function parsePrefix(text) {
-  const parts = text.trim().split("/");
-  if (parts.length > 2) return void 0;
-  const [address = "", size] = parts;
-  const parsed = addressBits(address);
-  if (!parsed) return void 0;
-  const max = parsed.v6 ? 128 : 32;
-  const length = size === void 0 ? max : /^\d{1,3}$/.test(size) ? Number(size) : -1;
-  if (length < 0 || length > max) return void 0;
-  return { ...parsed, length };
-}
-var HOST_ADDRESS, RESERVED;
-var init_routes = __esm({
-  "src/kernel/net/routes.ts"() {
-    "use strict";
-    init_loopback_names();
-    HOST_ADDRESS = HOST_LOOPBACK_ADDRESS.join(".");
-    RESERVED = [
-      "0.0.0.0/8",
-      "127.0.0.0/8",
-      "169.254.0.0/16",
-      "224.0.0.0/4",
-      "240.0.0.0/4",
-      "::/96",
-      "::ffff:0:0/96",
-      "fe80::/10",
-      "ff00::/8"
-    ].map((p) => parsePrefix(p));
-  }
-});
-
-// src/process/wasi/wasix-sockets.ts
-function readAddr(view, ptr) {
-  const tag = view.getUint8(ptr);
-  if (tag === UNIX) {
-    let end = ptr + 2;
-    while (end < ptr + 110 && view.getUint8(end) !== 0) end++;
-    const path = new TextDecoder().decode(
-      new Uint8Array(view.buffer, ptr + 2, end - ptr - 2).slice()
-    );
-    return { family: "unix", path };
-  }
-  const port2 = view.getUint16(ptr + 2, true);
-  if (tag === INET4) {
-    const host = [0, 1, 2, 3].map((i) => view.getUint8(ptr + 4 + i)).join(".");
-    return { family: "inet", host, port: port2 };
-  }
-  if (tag === INET6) {
-    return { family: "inet", host: ipv6Host(new Uint8Array(view.buffer, ptr + 4, 16)), port: port2 };
-  }
-  throw new WasiError("EAFNOSUPPORT");
-}
-function ipv6Host(bytes) {
-  const zeros = (n) => bytes.subarray(0, n).every((b) => b === 0);
-  if (zeros(16)) return "0.0.0.0";
-  if (zeros(15) && bytes[15] === 1) return LOOPBACK2;
-  if (zeros(10) && bytes[10] === 255 && bytes[11] === 255) return bytes.subarray(12).join(".");
-  const groups = [0, 2, 4, 6, 8, 10, 12, 14].map(
-    (i) => (bytes[i] << 8 | bytes[i + 1]).toString(16)
-  );
-  return new URL(`http://[${groups.join(":")}]/`).hostname.slice(1, -1);
-}
-function writeAddr(view, ptr, addr) {
-  new Uint8Array(view.buffer, ptr, 110).fill(0);
-  if (!addr) return;
-  if (addr.family === "unix") {
-    view.setUint8(ptr, UNIX);
-    new Uint8Array(view.buffer, ptr + 2, 107).set(
-      new TextEncoder().encode(addr.path).subarray(0, 107)
-    );
-    return;
-  }
-  view.setUint16(ptr + 2, addr.port, true);
-  const groups = ipv4(addr.host) ? void 0 : ipv6Groups(addr.host);
-  if (groups) {
-    view.setUint8(ptr, INET6);
-    groups.forEach((g, i) => void view.setUint16(ptr + 4 + i * 2, g));
-    return;
-  }
-  view.setUint8(ptr, INET4);
-  const octets = ipv4(addr.host) ?? [127, 0, 0, 1];
-  octets.forEach((b, i) => void view.setUint8(ptr + 4 + i, b));
-}
-function ipBytes(host) {
-  const groups = ipv4(host) ? void 0 : ipv6Groups(host);
-  return groups ? groups.flatMap((g) => [g >> 8, g & 255]) : ipv4(host);
-}
-function ipv4(host) {
-  const parts = host.split(".");
-  if (parts.length !== 4) return void 0;
-  const bytes = parts.map((p) => /^\d{1,3}$/.test(p) ? Number(p) : Number.NaN);
-  return bytes.every((b) => b >= 0 && b <= 255) ? bytes : void 0;
-}
-function wasixSocketImports(host, preview1) {
-  const { mem, fds, o } = host;
-  const call2 = (req) => o.kernel.call(req);
-  const socket = (fd) => {
-    const e = fds.get(fd);
-    if (e.type !== "kernel" || fds.kind(fd, e) !== "socket") throw new WasiError("ENOTSOCK");
-    return e;
-  };
-  const option = (opt) => OPTIONS[opt];
-  return {
-    sock_open: (af, type, _proto, out) => {
-      if (af !== INET4 && af !== INET6 && af !== UNIX) throw new WasiError("EAFNOSUPPORT");
-      if (type !== STREAM) throw new WasiError("EPROTONOSUPPORT");
-      const fd = call2({ op: "sock-open", domain: af === UNIX ? "unix" : "inet" });
-      fds.adopt(fd, "socket", false);
-      mem.view().setUint32(out, fd, true);
-    },
-    sock_pair: (af, type, _proto, out1, out2) => {
-      if (af !== UNIX)
-        throw new WasiError(af === INET4 || af === INET6 ? "EOPNOTSUPP" : "EAFNOSUPPORT");
-      if (type !== STREAM) throw new WasiError("EPROTONOSUPPORT");
-      mem.view().setUint32(out1, 0, true);
-      mem.view().setUint32(out2, 0, true);
-      const [a, b] = call2({ op: "sock-pair", domain: "unix" });
-      fds.adopt(a, "socket", false);
-      fds.adopt(b, "socket", false);
-      mem.view().setUint32(out1, a, true);
-      mem.view().setUint32(out2, b, true);
-    },
-    sock_bind: (fd, addr) => {
-      socket(fd);
-      call2({ op: "sock-bind", fd, addr: readAddr(mem.view(), addr) });
-    },
-    sock_listen: (fd, backlog) => {
-      socket(fd);
-      call2({ op: "sock-listen", fd, backlog });
-    },
-    sock_connect: (fd, addr) => {
-      const e = socket(fd);
-      call2({ op: "sock-connect", fd, addr: readAddr(mem.view(), addr), nonblock: e.nonblock });
-    },
-    sock_accept_v2: (fd, flags, outFd, outAddr) => {
-      const e = socket(fd);
-      const r = call2({ op: "sock-accept", fd, nonblock: e.nonblock });
-      fds.adopt(r.fd, "socket", (flags & FDFLAGS.NONBLOCK) !== 0);
-      mem.view().setUint32(outFd, r.fd, true);
-      writeAddr(mem.view(), outAddr, r.peer);
-    },
-    sock_addr_local: (fd, out) => {
-      socket(fd);
-      writeAddr(mem.view(), out, call2({ op: "sock-name", fd, peer: false }));
-    },
-    sock_addr_peer: (fd, out) => {
-      socket(fd);
-      writeAddr(mem.view(), out, call2({ op: "sock-name", fd, peer: true }));
-    },
-    sock_recv_from: (fd, iovs, n, riflags, outLen, outFlags, outAddr) => {
-      const r = preview1.sock_recv(
-        fd,
-        iovs,
-        n,
-        riflags,
-        outLen,
-        outFlags
-      );
-      if (r !== E.SUCCESS) return r;
-      writeAddr(mem.view(), outAddr, call2({ op: "sock-name", fd, peer: true }));
-      return E.SUCCESS;
-    },
-    sock_send_to: (fd, iovs, n, flags, _addr, out) => preview1.sock_send(fd, iovs, n, flags, out),
-    sock_status: (fd, out) => {
-      socket(fd);
-      mem.view().setUint8(out, 1);
-    },
-    sock_get_opt_flag: (fd, opt, out) => {
-      socket(fd);
-      const pair = option(opt);
-      const v = pair ? call2({ op: "sock-getopt", fd, level: pair[0], name: pair[1] }) : 0;
-      mem.view().setUint8(out, v ? 1 : 0);
-    },
-    sock_set_opt_flag: (fd, opt, flag) => {
-      socket(fd);
-      const pair = option(opt);
-      if (pair) call2({ op: "sock-setopt", fd, level: pair[0], name: pair[1], value: flag ? 1 : 0 });
-    },
-    sock_get_opt_size: (fd, opt, out) => {
-      socket(fd);
-      const pair = option(opt);
-      const v = pair ? call2({ op: "sock-getopt", fd, level: pair[0], name: pair[1] }) : 0;
-      mem.view().setBigUint64(out, BigInt(v), true);
-    },
-    sock_set_opt_size: (fd, opt, size) => {
-      socket(fd);
-      const pair = option(opt);
-      if (pair) call2({ op: "sock-setopt", fd, level: pair[0], name: pair[1], value: Number(size) });
-    },
-    sock_get_opt_time: (fd, _opt, out) => {
-      socket(fd);
-      new Uint8Array(mem.view().buffer, out, 16).fill(0);
-    },
-    sock_set_opt_time: (fd) => void socket(fd),
-    sock_send_file: () => E.NOSYS,
-    resolve: (name2, len, _port, addrs, naddrs, out) => {
-      const found = call2({ op: "sock-resolve", name: mem.string(name2, len), family: 0 });
-      const ips = found.map(ipBytes).filter((ip) => ip !== void 0);
-      if (ips.length === 0) throw new WasiError("ENOENT");
-      if (naddrs < 1) throw new WasiError("EINVAL");
-      const view = mem.view();
-      const count = Math.min(ips.length, naddrs);
-      new Uint8Array(view.buffer, addrs, ADDR_IP_SIZE * count).fill(0);
-      for (let i = 0; i < count; i++) {
-        const at = addrs + i * ADDR_IP_SIZE;
-        view.setUint8(at, ips[i].length === 4 ? INET4 : INET6);
-        new Uint8Array(view.buffer, at + 2, ips[i].length).set(ips[i]);
+      reserve(size) {
+        return this.indices?.reserve(this.table.length, size) ?? this.table.length;
+      }
+      tlsBases() {
+        const bases = [];
+        for (const [handle, linked] of this.modules) {
+          const base = linked.instance.exports.__tls_base;
+          if (base instanceof WebAssembly.Global) bases.push([handle, base.value]);
+        }
+        return bases;
+      }
+      carryTls(linked) {
+        const base = this.forkedTls?.get(linked.handle);
+        const global = linked.instance.exports.__tls_base;
+        if (base === void 0 || !(global instanceof WebAssembly.Global)) return false;
+        global.value = base;
+        return true;
+      }
+      replay(record) {
+        if (record.kind === "closure") {
+          growTable(this.table, record.index + 1);
+          this.live.add(record.index);
+          return;
+        }
+        if (record.kind === "closure-free") {
+          this.live.delete(record.index);
+          if (record.index < this.table.length) this.table.set(record.index, null);
+          return;
+        }
+        if (record.kind === "closure-prepare") {
+          this.install(record);
+          return;
+        }
+        if (record.kind === "load") {
+          if (this.modules.has(record.handle)) return;
+          const linked = this.instantiate(record.path, this.moduleAt(record.path), record, false);
+          linked.needed.push(...record.needed ?? []);
+          this.nextHandle = Math.max(this.nextHandle, record.handle + 1);
+          return;
+        }
+        const value2 = record.handle === 0 ? this.main?.exports[record.name] : this.module(record.handle).instance.exports[record.name];
+        if (typeof value2 !== "function") throw new DlError(`${record.name}: not a function`);
+        growTable(this.table, record.index + 1);
+        this.table.set(record.index, value2);
+        this.slots.set(value2, record.index);
+      }
+      moduleAt(path) {
+        const cached = this.cache?.[path];
+        if (cached) return cached;
+        const bytes = this.host.read(path);
+        if (!bytes) throw new DlError(`${path}: gone`);
+        return new WebAssembly.Module(bytes);
+      }
+      module(handle) {
+        const m = this.modules.get(handle);
+        if (!m) throw new DlError(`invalid handle ${handle}`);
+        return m;
+      }
+      locate(name2, cwd, ldPath) {
+        if (name2.includes("/"))
+          return name2.startsWith("/") ? normalize(name2) : normalize(`${cwd}/${name2}`);
+        for (const dir of [...ldPath.filter(Boolean), ...LIBRARY_DIRS]) {
+          const path = normalize(`${dir.startsWith("/") ? "" : `${cwd}/`}${dir}/${name2}`);
+          if (this.byPath.has(path) || this.host.read(path)) return path;
+        }
+        throw new DlError(`${name2}: not found`);
+      }
+      load(path, cwd, ldPath) {
+        const loaded = this.byPath.get(path);
+        if (loaded) return loaded;
+        const bytes = this.host.read(path);
+        if (!bytes) throw new DlError(`${path}: no such file`);
+        let module;
+        try {
+          module = new WebAssembly.Module(bytes);
+        } catch (e) {
+          throw new DlError(`${path}: not a wasm module (${e.message})`);
+        }
+        const info = dylinkInfo(module);
+        if (!info) throw new DlError(`${path}: not a side module (no dylink.0)`);
+        const dir = path.slice(0, path.lastIndexOf("/")) || "/";
+        const search = [dir, ...ldPath, ...info.runtimePath.map((p) => expandOrigin(p, dir))];
+        const needed = info.needed.map(
+          (n) => this.load(this.locate(n, cwd, search), cwd, ldPath).handle
+        );
+        const memoryBase = this.allocate(info.memorySize, 2 ** info.memoryAlign);
+        const { base: tableBase, handle } = this.reserveLoad(info.tableSize);
+        const record = {
+          kind: "load",
+          handle,
+          path,
+          memoryBase,
+          tableBase,
+          ...needed.length > 0 ? { needed } : {}
+        };
+        const linked = this.instantiate(path, module, record, true);
+        linked.needed.push(...needed);
+        this.publisher?.(record);
+        return linked;
+      }
+      instantiate(path, module, at, init) {
+        const info = dylinkInfo(module);
+        growTable(this.table, at.tableBase + info.tableSize);
+        const pending = [];
+        const env = {
+          memory: this.memory,
+          __indirect_function_table: this.table,
+          __stack_pointer: this.stackPointer,
+          __memory_base: new WebAssembly.Global({ value: "i32", mutable: false }, at.memoryBase),
+          __table_base: new WebAssembly.Global({ value: "i32", mutable: false }, at.tableBase),
+          __c_longjmp: this.cLongjmp,
+          __cpp_exception: this.cppException
+        };
+        const gotMem = {};
+        const gotFunc = {};
+        const linked = {
+          handle: at.handle,
+          path,
+          module,
+          info,
+          instance: void 0,
+          memoryBase: at.memoryBase,
+          tableBase: at.tableBase,
+          needed: []
+        };
+        for (const imp of WebAssembly.Module.imports(module)) {
+          if (imp.module === "env" && imp.kind === "function" && !(imp.name in env)) {
+            env[imp.name] = this.functionImport(imp.name);
+          } else if (imp.module === "GOT.mem") {
+            const g = new WebAssembly.Global({ value: "i32", mutable: true }, 0);
+            gotMem[imp.name] = g;
+            pending.push(() => {
+              g.value = this.addressOrNull(imp.name);
+            });
+          } else if (imp.module === "GOT.func") {
+            const g = new WebAssembly.Global({ value: "i32", mutable: true }, 0);
+            gotFunc[imp.name] = g;
+            pending.push(() => {
+              g.value = this.slotOrNull(imp.name);
+            });
+          }
+        }
+        const imports = {
+          ...this.host.hostImports(module),
+          env,
+          "GOT.mem": gotMem,
+          "GOT.func": gotFunc
+        };
+        linked.instance = new WebAssembly.Instance(module, imports);
+        this.types.register(() => this.host.read(path), linked.instance, this.table, at.tableBase);
+        this.modules.set(at.handle, linked);
+        const first = this.byPath.get(path);
+        if (!first || at.handle < first.handle) this.byPath.set(path, linked);
+        for (const resolve of pending) resolve();
+        if (init) {
+          call(linked.instance, "__wasm_apply_data_relocs");
+          call(linked.instance, "__wasm_call_ctors");
+        } else if (!this.carryTls(linked)) {
+          call(linked.instance, "__wasix_init_tls");
+        }
+        return linked;
+      }
+      functionImport(name2) {
+        const now = this.find(name2);
+        if (now && typeof now[1] === "function") return now[1];
+        let resolved2;
+        return (...args) => {
+          if (!resolved2) {
+            const later = this.find(name2);
+            if (!later || typeof later[1] !== "function")
+              throw new WebAssembly.RuntimeError(`unresolved symbol ${name2}`);
+            resolved2 = later[1];
+          }
+          return resolved2(...args);
+        };
+      }
+      addressOrNull(name2) {
+        const found = this.find(name2);
+        if (!found || !(found[1] instanceof WebAssembly.Global)) return 0;
+        return this.baseOf(found[0]) + found[1].value;
+      }
+      slotOrNull(name2) {
+        const found = this.find(name2);
+        if (!found || typeof found[1] !== "function") return 0;
+        return this.slot(found[1], found[0], name2);
+      }
+      find(name2) {
+        const inMain = this.main?.exports[name2];
+        if (inMain !== void 0) return [0, inMain];
+        for (const m of this.modules.values()) {
+          const v = m.instance?.exports[name2];
+          if (v !== void 0) return [m.handle, v];
+        }
+        return void 0;
+      }
+      findIn(m, name2, seen) {
+        if (seen.has(m.handle)) return void 0;
+        seen.add(m.handle);
+        const v = m.instance.exports[name2];
+        if (v !== void 0) return [m.handle, v];
+        for (const h of m.needed) {
+          const found = this.findIn(this.module(h), name2, seen);
+          if (found) return found;
+        }
+        return void 0;
+      }
+      baseOf(handle) {
+        return handle === 0 ? this.memoryBase : this.module(handle).memoryBase;
+      }
+      indexed = 0;
+      indexTable() {
+        for (let i = this.indexed; i < this.table.length; i++) {
+          const fn = this.table.get(i);
+          if (fn && !this.slots.has(fn)) this.slots.set(fn, i);
+        }
+        this.indexed = this.table.length;
+      }
+      slot(fn, handle, name2) {
+        this.indexTable();
+        const known = this.slots.get(fn);
+        if (known !== void 0) return known;
+        const index3 = this.reserve(1);
+        growTable(this.table, index3 + 1);
+        this.table.set(index3, fn);
+        this.slots.set(fn, index3);
+        this.publisher?.({ kind: "slot", index: index3, handle, name: name2 });
+        return index3;
+      }
+      allocate(size, alignment) {
+        if (size === 0) return 0;
+        const to = Math.max(alignment, 16);
+        const pages2 = Math.ceil((size + (to > PAGE2 ? to : 0)) / PAGE2);
+        return align(this.memory.grow(pages2) * PAGE2, to);
       }
-      view.setUint32(out, count, true);
-    }
-  };
-}
-var INET4, INET6, UNIX, STREAM, ADDR_IP_SIZE, LOOPBACK2, OPTIONS;
-var init_wasix_sockets = __esm({
-  "src/process/wasi/wasix-sockets.ts"() {
-    "use strict";
-    init_routes();
-    init_wasi_abi();
-    init_wasi_files();
-    INET4 = 1;
-    INET6 = 2;
-    UNIX = 3;
-    STREAM = 1;
-    ADDR_IP_SIZE = 18;
-    LOOPBACK2 = "127.0.0.1";
-    OPTIONS = {
-      1: [1, 15],
-      2: [1, 2],
-      3: [6, 1],
-      4: [1, 5],
-      6: [1, 6],
-      10: [1, 30],
-      11: [1, 4],
-      12: [1, 9],
-      14: [1, 10],
-      15: [1, 8],
-      16: [1, 7],
-      25: [1, 3]
     };
   }
 });
@@ -11630,7 +11736,7 @@ function kernelOf(init, port2, hooks = { masks: () => null, raise: () => {
   const call2 = (req) => {
     const r = transport.call(req, Number.POSITIVE_INFINITY, req.op);
     if (!r.ok) throw new SyscallError(r.errno);
-    return r.kind === "json" ? r.json : void 0;
+    return r.kind === "json" ? r.json : r.kind === "bytes" ? r.bytes : void 0;
   };
   const say = (text) => sys.write(2, new TextEncoder().encode(`${init.argv0}: ${text}
 `));
@@ -12675,7 +12781,7 @@ function flagsOf(o) {
   const access = write2 ? o.read ? O_RDWR6 : O_WRONLY6 : 0;
   return access | (o.append ? O_APPEND4 : 0);
 }
-function openRequest(abs, o) {
+function openRequest2(abs, o) {
   return {
     op: "fd-open-vfs",
     path: abs,
@@ -12855,7 +12961,7 @@ function* aliasOf(fd, abs, o) {
   if (file) {
     const at = yield { op: "fd-vfs-stat", fd };
     if (!at.orphan)
-      return { fd: yield openRequest(at.path, { ...o, create: false }), file };
+      return { fd: yield openRequest2(at.path, { ...o, create: false }), file };
     const wantWrite = o.write === true || o.append === true || o.truncate === true;
     if (wantWrite && info.access === "read") throw new JsCallError("EBADF", abs);
     if (!wantWrite && info.access === "write") throw new JsCallError("EBADF", abs);
@@ -12880,7 +12986,7 @@ function* opened(abs, o) {
   if (isExclusive(o)) throw new JsCallError("EEXIST", abs);
   switch (node.kind) {
     case "device":
-      return { fd: yield openRequest(abs, { ...o, create: false }), file: false };
+      return { fd: yield openRequest2(abs, { ...o, create: false }), file: false };
     case "tty":
       return { fd: yield { op: "fd-open-tty" }, file: false };
     case "clipboard":
@@ -14059,7 +14165,7 @@ function syncOps(kernel, shared) {
         existing = absent(err);
       }
       checkOpen(abs, options, existing);
-      const fd = kernel.json(openRequest(abs, options));
+      const fd = kernel.json(openRequest2(abs, options));
       try {
         kernel.call({ op: "fd-vfs-stat", fd });
       } catch (err) {
@@ -14669,7 +14775,7 @@ async function vfsStat(kernel, abs, op, tryDev) {
 async function vfsOpen(kernel, abs, options, statOf, infos, handles) {
   const existing = await statOf(isExclusive(options) ? "lstat" : "stat", abs).catch(absent);
   checkOpen(abs, options, existing);
-  const fd = await kernel.json(openRequest(abs, options));
+  const fd = await kernel.json(openRequest2(abs, options));
   try {
     await kernel.call({ op: "fd-vfs-stat", fd });
   } catch (err) {