@ai-ecoverse/slicc-kernel 1.95.3 → 1.97.0

package/dist/node.js

@@ -1251,6 +1251,149 @@ function wasiErrno(code) {
   return WASI_ERRNO[code] ?? E.IO;
 }
 
+// src/kernel/net/loopback-names.ts
+var HOST_LOOPBACK = "host.slicc.internal";
+var HOST_LOOPBACK_ADDRESS = [10, 0, 2, 2];
+var PAGE_LOOPBACK = "kernel.localhost";
+var PAGE_LOOPBACK_URL = `http://{port}.${PAGE_LOOPBACK}`;
+function toHostLoopback(href) {
+  const url = new URL(href);
+  if (url.hostname.replace(/\.$/, "").toLowerCase() !== HOST_LOOPBACK) return href;
+  url.hostname = "127.0.0.1";
+  return url.href;
+}
+var LOOPBACK_V4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+var LOOPBACK_V6 = /* @__PURE__ */ new Set(["::1", "::", "0:0:0:0:0:0:0:1"]);
+var MAPPED_V4 = /^::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}$/;
+var KERNEL_PORT = /^(\d{1,5})\.kernel\.localhost$/;
+var SCHEMES = {
+  "http:": 80,
+  "ws:": 80,
+  "https:": 443,
+  "wss:": 443
+};
+function isKernelLoopbackHost(hostname) {
+  const host = hostname.replace(/^\[(.*)\]$/, "$1").replace(/\.$/, "").toLowerCase();
+  return host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || LOOPBACK_V4.test(host) || LOOPBACK_V6.has(host) || MAPPED_V4.test(host);
+}
+function kernelLoopbackPort(href) {
+  let url;
+  try {
+    url = new URL(href);
+  } catch {
+    return void 0;
+  }
+  const fallback = SCHEMES[url.protocol];
+  if (fallback === void 0 || !isKernelLoopbackHost(url.hostname)) return void 0;
+  const named = KERNEL_PORT.exec(url.hostname.replace(/\.$/, "").toLowerCase())?.[1];
+  const port = Number(named ?? (url.port || fallback));
+  return port >= 1 && port <= 65535 ? port : void 0;
+}
+var DEFAULT_HOSTNAME = "slicc";
+var HOSTNAME_ADDRESS = "127.0.1.1";
+var LIBC_HOSTNAMES = ["emscripten", "wasmer.sh"];
+var LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+function reserved(name2) {
+  const lower = name2.toLowerCase();
+  return lower === "localhost" || lower.endsWith(".localhost") || lower === HOST_LOOPBACK || lower === "wasmer.sh" || /^\d+(\.\d+){3}$/.test(lower);
+}
+function isHostname(name2) {
+  if (typeof name2 !== "string" || name2.length > 253 || reserved(name2)) return false;
+  return name2.split(".").every((l) => LABEL.test(l));
+}
+function ownNames(hostname) {
+  return [.../* @__PURE__ */ new Set([hostname.toLowerCase(), ...LIBC_HOSTNAMES])];
+}
+
+// src/kernel/net/routes.ts
+var HOST_ADDRESS = HOST_LOOPBACK_ADDRESS.join(".");
+function ipv4Bytes(text) {
+  const parts2 = text.split(".");
+  if (parts2.length !== 4 || !parts2.every((p) => /^\d{1,3}$/.test(p))) return void 0;
+  const bytes = parts2.map(Number);
+  return bytes.every((b) => b <= 255) ? bytes : void 0;
+}
+function ipv6Groups(text) {
+  if (!text.includes(":")) return void 0;
+  let canonical;
+  try {
+    canonical = new URL(`http://[${text}]/`).hostname.slice(1, -1);
+  } catch {
+    return void 0;
+  }
+  const [head, tail] = canonical.split("::");
+  const part = (s) => s ? s.split(":").map((h) => Number.parseInt(h, 16)) : [];
+  const front = part(head);
+  const back = part(tail);
+  return tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
+}
+function toBits(values, width) {
+  return values.reduce((acc, v) => acc << BigInt(width) | BigInt(v), 0n);
+}
+function addressBits(host) {
+  const v4 = ipv4Bytes(host);
+  if (v4) return { v6: false, bits: toBits(v4, 8) };
+  const v6 = ipv6Groups(host);
+  return v6 ? { v6: true, bits: toBits(v6, 16) } : void 0;
+}
+function parsePrefix(text) {
+  const parts2 = text.trim().split("/");
+  if (parts2.length > 2) return void 0;
+  const [address = "", size] = parts2;
+  const parsed2 = addressBits(address);
+  if (!parsed2) return void 0;
+  const max = parsed2.v6 ? 128 : 32;
+  const length2 = size === void 0 ? max : /^\d{1,3}$/.test(size) ? Number(size) : -1;
+  if (length2 < 0 || length2 > max) return void 0;
+  return { ...parsed2, length: length2 };
+}
+function within(prefix, addr) {
+  if (prefix.v6 !== addr.v6) return false;
+  const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
+  return addr.bits >> shift === prefix.bits >> shift;
+}
+var RESERVED = [
+  "0.0.0.0/8",
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "224.0.0.0/4",
+  "240.0.0.0/4",
+  "::/96",
+  "::ffff:0:0/96",
+  "fe80::/10",
+  "ff00::/8"
+].map((p) => parsePrefix(p));
+var Routes = class {
+  table = [];
+  exit = false;
+  ipv6;
+  constructor(ipv62 = false) {
+    this.ipv6 = ipv62;
+  }
+  set(table) {
+    const parsed2 = (table.prefixes ?? []).map(parsePrefix);
+    const bad = (table.prefixes ?? []).find((_, i) => !parsed2[i]);
+    if (bad !== void 0) throw new Error(`not an address prefix: ${bad}`);
+    this.table = parsed2;
+    this.exit = table.exit === true;
+  }
+  classify(host) {
+    const name2 = host.toLowerCase().replace(/\.$/, "");
+    if (name2 === "localhost" || name2.endsWith(".localhost") || name2 === "0.0.0.0") {
+      return "loopback";
+    }
+    if (name2 === HOST_LOOPBACK || name2 === HOST_ADDRESS) return "host";
+    const addr = addressBits(name2);
+    if (!addr) return "unreachable";
+    if (addr.v6 && addr.bits === 1n) return "loopback";
+    if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
+    if (RESERVED.some((p) => within(p, addr))) return "reserved";
+    if (addr.v6 && !this.ipv6) return "unreachable";
+    if (this.exit || this.table.some((p) => within(p, addr))) return "uplink";
+    return "unreachable";
+  }
+};
+
 // src/kernel/net/uplink-socket.ts
 var CHUNK = 64 * 1024;
 function hostPort(text) {
@@ -1655,8 +1798,10 @@ function canonicalHost(host) {
 function keyOf(addr) {
   return addr.family === "inet" ? `inet:${addr.port}` : `unix:${addr.path}`;
 }
+var LOCAL_ONLY = new Routes();
 var LoopbackNet = class {
   bound = /* @__PURE__ */ new Map();
+  dgrams = /* @__PURE__ */ new Map();
   activators = /* @__PURE__ */ new Map();
   internal = /* @__PURE__ */ new Set();
   reserved = /* @__PURE__ */ new Set();
@@ -1669,7 +1814,31 @@ var LoopbackNet = class {
   uplinkFor(host) {
     const route = this.route;
     if (!route) return void 0;
-    return route.routes.classify(host) === "uplink" ? route : void 0;
+    return this.destination(host) === "uplink" ? route : void 0;
+  }
+  destination(host) {
+    return (this.route?.routes ?? LOCAL_ONLY).classify(host);
+  }
+  bindDgram(socket, addr, kernel = false) {
+    if (addr.family !== "inet") throw new KernelError("EAFNOSUPPORT");
+    this.bindable(addr, kernel);
+    const port = addr.port === 0 ? this.ephemeral() : addr.port;
+    if (this.dgrams.has(port)) throw new KernelError("EADDRINUSE");
+    this.dgrams.set(port, socket);
+    return { ...addr, port };
+  }
+  releaseDgram(addr, socket) {
+    if (this.dgrams.get(addr.port) === socket) this.dgrams.delete(addr.port);
+  }
+  deliverDgram(port, datagram2) {
+    const target = this.dgrams.get(port);
+    return target ? target.deliver(datagram2) : false;
+  }
+  bindable(addr, kernel) {
+    if (addr.host !== "0.0.0.0" && !isLoopback(addr.host)) {
+      throw new KernelError("EADDRNOTAVAIL");
+    }
+    if (!kernel && this.reserved.has(addr.port)) throw new KernelError("EADDRINUSE");
   }
   kernelOnly(port, reserve = false) {
     if (reserve) this.internal.add(port);
@@ -1707,11 +1876,7 @@ var LoopbackNet = class {
   bind(socket, addr, kernel = false) {
     if (addr.family === "unix") {
       if (addr.path === "") throw new KernelError("EINVAL");
-    } else if (addr.host !== "0.0.0.0" && !isLoopback(addr.host)) {
-      throw new KernelError("EADDRNOTAVAIL");
-    } else if (!kernel && this.reserved.has(addr.port)) {
-      throw new KernelError("EADDRINUSE");
-    }
+    } else this.bindable(addr, kernel);
     const named = addr.family === "inet" && addr.port === 0 ? { ...addr, port: this.ephemeral() } : addr;
     const key = keyOf(named);
     if (this.bound.has(key)) throw new KernelError("EADDRINUSE");
@@ -1737,7 +1902,8 @@ var LoopbackNet = class {
     for (let i = 0; i < span; i++) {
       const port = this.nextEphemeral;
       this.nextEphemeral = port === EPHEMERAL_LAST ? EPHEMERAL_FIRST : port + 1;
-      if (!this.bound.has(`inet:${port}`) && !this.reserved.has(port)) return port;
+      const taken = this.bound.has(`inet:${port}`) || this.dgrams.has(port);
+      if (!taken && !this.reserved.has(port)) return port;
     }
     throw new KernelError("EADDRINUSE");
   }
@@ -3485,14 +3651,14 @@ function protectedPrefixes(paths) {
   }
   return [...new Set(paths.map((p) => normalizePath(p)))];
 }
-function within(path, prefix) {
+function within2(path, prefix) {
   return prefix === "/" || path === prefix || path.startsWith(`${prefix}/`);
 }
 function isProtected(prefixes2, path) {
-  return prefixes2.some((prefix) => within(path, prefix));
+  return prefixes2.some((prefix) => within2(path, prefix));
 }
 function holdsProtected(prefixes2, path) {
-  return prefixes2.some((prefix) => within(prefix, path));
+  return prefixes2.some((prefix) => within2(prefix, path));
 }
 var MAX_LINKS4 = 40;
 function partsOf(path) {
@@ -3868,7 +4034,7 @@ function prefixes(path) {
   const parts2 = split(path);
   return parts2.map((_, i) => `/${parts2.slice(0, i + 1).join("/")}`);
 }
-function within2(path, root) {
+function within3(path, root) {
   return path === root || path.startsWith(`${root}/`);
 }
 var LOCKED = /* @__PURE__ */ new Set(["NotReadableError", "NoModificationAllowedError", "InvalidStateError"]);
@@ -4308,11 +4474,11 @@ var OpfsFs = class {
   movePending(from, to) {
     if (to !== void 0) {
       for (const path of [...this.fileTimes.keys()]) {
-        if (within2(path, to)) this.fileTimes.delete(path);
+        if (within3(path, to)) this.fileTimes.delete(path);
       }
     }
     for (const [path, ms] of [...this.fileTimes]) {
-      if (!within2(path, from)) continue;
+      if (!within3(path, from)) continue;
       this.fileTimes.delete(path);
       if (to !== void 0) this.fileTimes.set(to + path.slice(from.length), ms);
     }
@@ -4736,7 +4902,7 @@ var OpfsFs = class {
   }
   async moveTo(source, parent, destination, to) {
     const sourceStat = await this.describe(source);
-    if (sourceStat.isDirectory && within2(destination, source.path)) throw fsError("EINVAL", to);
+    if (sourceStat.isDirectory && within3(destination, source.path)) throw fsError("EINVAL", to);
     const target = await this.locate(destination, false).catch((err) => {
       if (missing2(err)) return null;
       throw err;
@@ -4985,7 +5151,7 @@ function pidOwner(proc) {
 function webLocks() {
   return globalThis.navigator?.locks;
 }
-var within3 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var within4 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
 var parentOf5 = (path) => path.slice(0, path.lastIndexOf("/")) || "/";
 var lockName = (instance) => `slicc-unlinked:${instance}`;
 var dirOf = (root) => root === "/" ? `/${UNLINKED_DIR}` : `${root}/${UNLINKED_DIR}`;
@@ -5085,7 +5251,7 @@ var UnlinkedKeeper = class {
     for (const holder of this.holders) {
       if (holder.owns(target)) continue;
       for (const path of holder.held()) {
-        if (!within3(path, target) || holder.isKept(path)) continue;
+        if (!within4(path, target) || holder.isKept(path)) continue;
         held.set(path, [...held.get(path) ?? [], holder]);
       }
     }
@@ -6316,60 +6482,6 @@ function binfmtOf(binfmts, path) {
   return best === void 0 ? void 0 : binfmts.get(best);
 }
 
-// src/kernel/net/loopback-names.ts
-var HOST_LOOPBACK = "host.slicc.internal";
-var HOST_LOOPBACK_ADDRESS = [10, 0, 2, 2];
-var PAGE_LOOPBACK = "kernel.localhost";
-var PAGE_LOOPBACK_URL = `http://{port}.${PAGE_LOOPBACK}`;
-function toHostLoopback(href) {
-  const url = new URL(href);
-  if (url.hostname.replace(/\.$/, "").toLowerCase() !== HOST_LOOPBACK) return href;
-  url.hostname = "127.0.0.1";
-  return url.href;
-}
-var LOOPBACK_V4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
-var LOOPBACK_V6 = /* @__PURE__ */ new Set(["::1", "::", "0:0:0:0:0:0:0:1"]);
-var MAPPED_V4 = /^::ffff:7f[0-9a-f]{2}:[0-9a-f]{1,4}$/;
-var KERNEL_PORT = /^(\d{1,5})\.kernel\.localhost$/;
-var SCHEMES = {
-  "http:": 80,
-  "ws:": 80,
-  "https:": 443,
-  "wss:": 443
-};
-function isKernelLoopbackHost(hostname) {
-  const host = hostname.replace(/^\[(.*)\]$/, "$1").replace(/\.$/, "").toLowerCase();
-  return host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0" || LOOPBACK_V4.test(host) || LOOPBACK_V6.has(host) || MAPPED_V4.test(host);
-}
-function kernelLoopbackPort(href) {
-  let url;
-  try {
-    url = new URL(href);
-  } catch {
-    return void 0;
-  }
-  const fallback = SCHEMES[url.protocol];
-  if (fallback === void 0 || !isKernelLoopbackHost(url.hostname)) return void 0;
-  const named = KERNEL_PORT.exec(url.hostname.replace(/\.$/, "").toLowerCase())?.[1];
-  const port = Number(named ?? (url.port || fallback));
-  return port >= 1 && port <= 65535 ? port : void 0;
-}
-var DEFAULT_HOSTNAME = "slicc";
-var HOSTNAME_ADDRESS = "127.0.1.1";
-var LIBC_HOSTNAMES = ["emscripten", "wasmer.sh"];
-var LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
-function reserved(name2) {
-  const lower = name2.toLowerCase();
-  return lower === "localhost" || lower.endsWith(".localhost") || lower === HOST_LOOPBACK || lower === "wasmer.sh" || /^\d+(\.\d+){3}$/.test(lower);
-}
-function isHostname(name2) {
-  if (typeof name2 !== "string" || name2.length > 253 || reserved(name2)) return false;
-  return name2.split(".").every((l) => LABEL.test(l));
-}
-function ownNames(hostname) {
-  return [.../* @__PURE__ */ new Set([hostname.toLowerCase(), ...LIBC_HOSTNAMES])];
-}
-
 // src/kernel/net/proxy-service.ts
 var SEND_BUFFER2 = 1024 * 1024;
 var TLS_HANDSHAKE = 22;
@@ -7371,7 +7483,7 @@ var DEFAULT_UMASK = 18;
 function isModule(bytes) {
   return MAGIC.every((b, i) => bytes[i] === b);
 }
-function within4(path, dir) {
+function within5(path, dir) {
   return path.startsWith(dir === "/" ? "/" : `${dir}/`);
 }
 var FreshModules = class {
@@ -7395,10 +7507,10 @@ var FreshModules = class {
     const target = normalizePath(to);
     if (source === target) return;
     for (const key of [...this.fresh.keys()]) {
-      if (key === target || within4(key, target)) this.fresh.delete(key);
+      if (key === target || within5(key, target)) this.fresh.delete(key);
     }
     for (const [key, fresh2] of [...this.fresh]) {
-      if (key !== source && !within4(key, source)) continue;
+      if (key !== source && !within5(key, source)) continue;
       this.fresh.delete(key);
       this.fresh.set(target + key.slice(source.length), fresh2);
     }
@@ -7440,7 +7552,7 @@ var FreshModules = class {
         await fs.rm(path, options);
         const at = normalizePath(path);
         for (const key of [...this.fresh.keys()]) {
-          if (key === at || within4(key, at)) this.fresh.delete(key);
+          if (key === at || within5(key, at)) this.fresh.delete(key);
         }
       },
       rename: async (from, to) => {
@@ -8221,7 +8333,7 @@ function linkedTo(mount, path) {
     return own?.kind !== "directory" && (attr2.nlink ?? 1) > 1;
   };
 }
-var within5 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
+var within6 = (path, target) => path === target || target === "/" || path.startsWith(`${target}/`);
 var HeldSet = class extends Set {
   idle;
   constructor(idle) {
@@ -8240,7 +8352,7 @@ var HeldSet = class extends Set {
   }
 };
 function heldUnder(held, target) {
-  for (const paths of held) for (const path of paths.keys()) if (within5(path, target)) return true;
+  for (const paths of held) for (const path of paths.keys()) if (within6(path, target)) return true;
   return false;
 }
 var HeldPaths = class extends Map {
@@ -8356,24 +8468,24 @@ var HeldPaths = class extends Map {
     return this.owning === path;
   }
   revoke(prefix) {
-    for (const path of this.keys()) if (within5(path, prefix)) this.revoked.add(path);
+    for (const path of this.keys()) if (within6(path, prefix)) this.revoked.add(path);
   }
   renamed(from, to) {
     for (const [path, count2] of [...this]) {
-      if (!within5(path, from)) continue;
+      if (!within6(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.delete(path);
       this.set(moved2, (this.get(moved2) ?? 0) + count2);
       if (this.revoked.delete(path)) this.revoked.add(moved2);
     }
     for (const [path, count2] of [...this.opens]) {
-      if (!within5(path, from)) continue;
+      if (!within6(path, from)) continue;
       const moved2 = to + path.slice(from.length);
       this.opens.delete(path);
       this.opens.set(moved2, (this.opens.get(moved2) ?? 0) + count2);
     }
     for (const [id2, key] of this.handles) {
-      if (within5(key, from)) this.handles.set(id2, to + key.slice(from.length));
+      if (within6(key, from)) this.handles.set(id2, to + key.slice(from.length));
     }
   }
   isRevoked(path) {
@@ -8478,13 +8590,13 @@ var MountTable = class {
     });
   }
   under(path) {
-    for (const mount of this.mounts.values()) if (within5(mount.target, path)) return true;
+    for (const mount of this.mounts.values()) if (within6(mount.target, path)) return true;
     return false;
   }
   locate(path) {
     let best;
     for (const mount of this.mounts.values()) {
-      if (within5(path, mount.target) && (!best || mount.target.length > best.target.length))
+      if (within6(path, mount.target) && (!best || mount.target.length > best.target.length))
         best = mount;
     }
     if (!best) return void 0;
@@ -8627,7 +8739,7 @@ var MountTable = class {
   async commitUnder(prefix) {
     const at = normalizePath(prefix);
     await Promise.all(
-      [...this.sessions.keys()].filter((p) => within5(p, at)).map((p) => this.commit(p))
+      [...this.sessions.keys()].filter((p) => within6(p, at)).map((p) => this.commit(p))
     );
   }
   async commitOverlapping(real, offset, length2) {
@@ -8664,11 +8776,11 @@ var MountTable = class {
     mount.epoch++;
     const linked2 = mount.caps.links ? linkedTo(mount, path) : () => false;
     for (const [key, cached] of [...mount.attrs])
-      if (within5(key, path) || linked2(cached.value)) mount.attrs.delete(key);
+      if (within6(key, path) || linked2(cached.value)) mount.attrs.delete(key);
     mount.lists.delete(path);
     mount.lists.delete(parentOf7(path));
     for (const [key, cached] of [...mount.lists])
-      if (within5(key, path) || cached.value.some((e) => linked2(e.attr))) mount.lists.delete(key);
+      if (within6(key, path) || cached.value.some((e) => linked2(e.attr))) mount.lists.delete(key);
   }
   async getattr(mount, path, rel2, settled = false) {
     for (let round = 1; ; round++) {
@@ -8808,7 +8920,7 @@ var MountFs = class _MountFs {
       if (redirects >= MAX_LINKS7) throw errnoError("ELOOP", paths[0]);
       const at = paths.map((path) => {
         const real = normalizePath(path);
-        return within5(real, moved2.of) ? normalizePath(moved2.to + real.slice(moved2.of.length)) : real;
+        return within6(real, moved2.of) ? normalizePath(moved2.to + real.slice(moved2.of.length)) : real;
       });
       return again(at, redirects + 1);
     }
@@ -10401,6 +10513,282 @@ var ProcessClocks = class {
   }
 };
 
+// src/kernel/net/uplink.ts
+function carriesUdp(uplink) {
+  return uplink.traits.udp === true && typeof uplink.udp === "function";
+}
+function answerOf(result) {
+  const answer = Array.isArray(result) ? { addresses: result } : result;
+  const addresses = Array.isArray(answer?.addresses) ? answer.addresses.filter((a) => typeof a === "string") : [];
+  return {
+    addresses,
+    ...typeof answer?.ttl === "number" && answer.ttl >= 0 ? { ttl: answer.ttl } : {}
+  };
+}
+var NEVER = new Routes(true);
+
+// src/kernel/dgram.ts
+var DGRAM_QUEUE_BYTES = 256 * 1024;
+var DGRAM_QUEUE_COUNT = 512;
+var DGRAM_SEND_ROOM = 256 * 1024;
+var MAX_DATAGRAM_V4 = 65507;
+var MAX_DATAGRAM_V6 = 65527;
+var SOL_SOCKET2 = 1;
+var IPPROTO_IP = 0;
+var SO_TYPE2 = 3;
+var SO_ERROR2 = 4;
+var SO_BROADCAST = 6;
+var SO_SNDBUF2 = 7;
+var SO_RCVBUF2 = 8;
+var SO_DOMAIN2 = 39;
+var SOCK_DGRAM = 2;
+var AF_INET2 = 2;
+var IP_MULTICAST_FIRST = 32;
+var IP_MULTICAST_LAST = 36;
+var SEND_ERRORS = ["ENETUNREACH", "EHOSTUNREACH", "EACCES", "EMSGSIZE"];
+var UNREACHABLE = ["EACCES", "ENETUNREACH", "EHOSTUNREACH"];
+function sendError(e) {
+  if (e instanceof KernelError) return e;
+  const code = e?.code;
+  return new KernelError(SEND_ERRORS.find((errno2) => errno2 === code) ?? "EHOSTUNREACH");
+}
+function sameAddr(a, b) {
+  return a.port === b.port && canonicalHost(a.host) === canonicalHost(b.host);
+}
+function familyOf(host) {
+  return host.includes(":") ? 6 : 4;
+}
+var KernelDgram = class {
+  local;
+  peer;
+  net;
+  queue = [];
+  queued = 0;
+  pending;
+  closed = false;
+  sending = 0;
+  changes = new Changes();
+  options = /* @__PURE__ */ new Map();
+  uplinks = /* @__PURE__ */ new Map();
+  stop = new AbortController();
+  constructor(net) {
+    this.net = net;
+  }
+  bind(addr) {
+    if (this.local) throw new KernelError("EINVAL");
+    this.local = this.net.bindDgram(this, addr);
+  }
+  bound() {
+    this.local ??= this.net.bindDgram(this, { family: "inet", host: "0.0.0.0", port: 0 });
+    return this.local;
+  }
+  connectTo(addr) {
+    if (addr.family !== "inet") throw new KernelError("EAFNOSUPPORT");
+    this.route(addr.host);
+    this.bound();
+    this.peer = { family: "inet", host: canonicalHost(addr.host), port: addr.port };
+    this.pending = void 0;
+    this.drain((d) => sameAddr(d.from, addr));
+  }
+  drain(keep2) {
+    const kept = this.queue.filter(keep2);
+    this.queue.splice(0, this.queue.length, ...kept);
+    this.queued = kept.reduce((sum, d) => sum + d.bytes.length, 0);
+  }
+  route(host) {
+    const where = this.net.destination(host);
+    if (where === "loopback" || where === "uplink") return where;
+    throw new KernelError("ENETUNREACH");
+  }
+  takeError() {
+    const pending = this.pending;
+    this.pending = void 0;
+    return pending;
+  }
+  async send(bytes, to) {
+    if (this.closed) throw new KernelError("EBADF");
+    const pending = this.takeError();
+    if (pending) throw new KernelError(pending);
+    const target = to ?? this.peer;
+    if (!target) throw new KernelError("EDESTADDRREQ");
+    if (target.family !== "inet") throw new KernelError("EAFNOSUPPORT");
+    const max = familyOf(target.host) === 6 ? MAX_DATAGRAM_V6 : MAX_DATAGRAM_V4;
+    if (bytes.length > max) throw new KernelError("EMSGSIZE");
+    const where = this.route(target.host);
+    const local = this.bound();
+    if (where === "uplink") return this.sendUp(bytes, target);
+    const from = {
+      family: "inet",
+      host: local.host === "0.0.0.0" ? "127.0.0.1" : local.host,
+      port: local.port
+    };
+    const delivered = this.net.deliverDgram(target.port, { bytes: bytes.slice(), from });
+    if (!delivered && this.peer && sameAddr(this.peer, target)) {
+      this.pending = "ECONNREFUSED";
+      this.changes.wake();
+    }
+    return bytes.length;
+  }
+  async sendUp(bytes, to) {
+    const uplink = this.net.uplinkFor(to.host)?.uplink;
+    if (!uplink || !carriesUdp(uplink)) throw new KernelError("ENETUNREACH");
+    this.sending += bytes.length;
+    try {
+      const socket = await this.uplinkSocket(uplink, familyOf(to.host));
+      await socket.send(bytes.slice(), to.host, to.port);
+    } catch (e) {
+      throw sendError(e);
+    } finally {
+      this.sending -= bytes.length;
+      this.changes.wake();
+    }
+    return bytes.length;
+  }
+  uplinkSocket(uplink, family) {
+    const known = this.uplinks.get(family);
+    if (known !== void 0) return known;
+    const opening2 = Promise.resolve().then(() => {
+      if (!uplink.udp) throw new KernelError("ENETUNREACH");
+      return uplink.udp({ family, signal: this.stop.signal });
+    });
+    this.uplinks.set(family, opening2);
+    opening2.then(
+      (socket) => {
+        if (this.closed) {
+          socket.close();
+          return;
+        }
+        void this.pump(socket, family);
+      },
+      () => this.uplinks.delete(family)
+    );
+    return opening2;
+  }
+  async pump(socket, family) {
+    const iterate = async () => {
+      for await (const message3 of socket.messages) {
+        if (this.closed) return;
+        const from = { family: "inet", host: message3.host, port: message3.port };
+        if ("bytes" in message3) this.deliver({ bytes: message3.bytes, from });
+        else this.unreachable(message3.error, from);
+      }
+    };
+    await iterate().catch(() => void 0);
+    if (!this.closed) this.uplinks.delete(family);
+    socket.close();
+  }
+  unreachable(error, from) {
+    if (!this.peer || !sameAddr(this.peer, from)) return;
+    this.pending = UNREACHABLE.find((errno2) => errno2 === error) ?? "EHOSTUNREACH";
+    this.changes.wake();
+  }
+  deliver(datagram2) {
+    if (this.closed) return false;
+    if (this.peer && !sameAddr(this.peer, datagram2.from)) return true;
+    const full = this.queue.length >= DGRAM_QUEUE_COUNT || this.queued + datagram2.bytes.length > DGRAM_QUEUE_BYTES;
+    if (full) return true;
+    this.queue.push(datagram2);
+    this.queued += datagram2.bytes.length;
+    this.changes.wake();
+    return true;
+  }
+  async receive(max, peek, signal) {
+    for (; ; ) {
+      const pending = this.takeError();
+      if (pending) throw new KernelError(pending);
+      if (this.closed) throw new KernelError("EBADF");
+      const next2 = this.queue[0];
+      if (next2) {
+        if (!peek) {
+          this.queue.shift();
+          this.queued -= next2.bytes.length;
+          this.changes.wake();
+        }
+        const size = Math.max(0, max);
+        return {
+          bytes: next2.bytes.slice(0, size),
+          from: next2.from,
+          truncated: next2.bytes.length > size
+        };
+      }
+      await this.changes.wait(signal);
+    }
+  }
+  async read(max, signal) {
+    return (await this.receive(max, false, signal)).bytes;
+  }
+  async peek(max, signal) {
+    return (await this.receive(max, true, signal)).bytes;
+  }
+  write(bytes) {
+    return this.send(bytes);
+  }
+  poll() {
+    return {
+      readable: this.queue.length > 0 || this.pending !== void 0 || this.closed,
+      writable: this.sending < DGRAM_SEND_ROOM,
+      hangup: this.closed,
+      ...this.pending !== void 0 ? { error: true } : {}
+    };
+  }
+  changed(signal) {
+    return this.changes.wait(signal);
+  }
+  shutdown(how) {
+    if (!this.peer) throw new KernelError("ENOTCONN");
+    if (how < 0 || how > 2) throw new KernelError("EINVAL");
+  }
+  getOption(level, name2) {
+    if (level === SOL_SOCKET2) {
+      switch (name2) {
+        case SO_TYPE2:
+          return SOCK_DGRAM;
+        case SO_ERROR2: {
+          const pending = this.takeError();
+          return pending ? wasiErrno(pending) : 0;
+        }
+        case SO_DOMAIN2:
+          return AF_INET2;
+        case SO_BROADCAST:
+          return 0;
+        case SO_SNDBUF2:
+          return this.options.get(`${level}:${name2}`) ?? DGRAM_SEND_ROOM;
+        case SO_RCVBUF2:
+          return this.options.get(`${level}:${name2}`) ?? DGRAM_QUEUE_BYTES;
+      }
+    }
+    if (level === IPPROTO_IP && name2 >= IP_MULTICAST_FIRST && name2 <= IP_MULTICAST_LAST) {
+      throw new KernelError("ENOPROTOOPT");
+    }
+    return this.options.get(`${level}:${name2}`) ?? 0;
+  }
+  setOption(level, name2, value) {
+    if (level === SOL_SOCKET2 && name2 === SO_BROADCAST && value !== 0) {
+      throw new KernelError("EOPNOTSUPP");
+    }
+    if (level === IPPROTO_IP && name2 >= IP_MULTICAST_FIRST && name2 <= IP_MULTICAST_LAST) {
+      throw new KernelError("ENOPROTOOPT");
+    }
+    this.options.set(`${level}:${name2}`, value);
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    this.stop.abort();
+    for (const opening2 of this.uplinks.values()) {
+      opening2.then(
+        (socket) => socket.close(),
+        () => void 0
+      );
+    }
+    this.uplinks.clear();
+    if (this.local) this.net.releaseDgram(this.local, this);
+    this.queue.length = 0;
+    this.queued = 0;
+    this.changes.wake();
+  }
+};
+
 // src/fs/pages.ts
 var PAGE = 64 * 1024;
 var READAHEAD = 1024 * 1024;
@@ -10659,7 +11047,7 @@ function mountTable(mounts = []) {
 }
 
 // src/version.ts
-var KERNEL_VERSION = true ? "1.95.3" : "0.0.0-dev";
+var KERNEL_VERSION = true ? "1.97.0" : "0.0.0-dev";
 var OS_RELEASE = "6.0.0-slicc";
 function procVersion() {
   return `Linux version ${OS_RELEASE} (slicc-kernel ${KERNEL_VERSION}) #1 SMP PREEMPT_DYNAMIC
@@ -11146,6 +11534,7 @@ function levelOf(file) {
   if (state.readable) bits2 |= EPOLL.IN;
   if (state.writable) bits2 |= EPOLL.OUT;
   if (state.rdhup) bits2 |= EPOLL.RDHUP;
+  if (state.error) bits2 |= EPOLL.ERR;
   if (state.hangup) bits2 |= file.read ? EPOLL.HUP : EPOLL.ERR;
   return bits2;
 }
@@ -12839,106 +13228,6 @@ var HttpHandles = class {
   }
 };
 
-// src/kernel/net/routes.ts
-var HOST_ADDRESS = HOST_LOOPBACK_ADDRESS.join(".");
-function ipv4Bytes(text) {
-  const parts2 = text.split(".");
-  if (parts2.length !== 4 || !parts2.every((p) => /^\d{1,3}$/.test(p))) return void 0;
-  const bytes = parts2.map(Number);
-  return bytes.every((b) => b <= 255) ? bytes : void 0;
-}
-function ipv6Groups(text) {
-  if (!text.includes(":")) return void 0;
-  let canonical;
-  try {
-    canonical = new URL(`http://[${text}]/`).hostname.slice(1, -1);
-  } catch {
-    return void 0;
-  }
-  const [head, tail] = canonical.split("::");
-  const part = (s) => s ? s.split(":").map((h) => Number.parseInt(h, 16)) : [];
-  const front = part(head);
-  const back = part(tail);
-  return tail === void 0 ? front : [...front, ...new Array(8 - front.length - back.length).fill(0), ...back];
-}
-function toBits(values, width) {
-  return values.reduce((acc, v) => acc << BigInt(width) | BigInt(v), 0n);
-}
-function addressBits(host) {
-  const v4 = ipv4Bytes(host);
-  if (v4) return { v6: false, bits: toBits(v4, 8) };
-  const v6 = ipv6Groups(host);
-  return v6 ? { v6: true, bits: toBits(v6, 16) } : void 0;
-}
-function parsePrefix(text) {
-  const parts2 = text.trim().split("/");
-  if (parts2.length > 2) return void 0;
-  const [address = "", size] = parts2;
-  const parsed2 = addressBits(address);
-  if (!parsed2) return void 0;
-  const max = parsed2.v6 ? 128 : 32;
-  const length2 = size === void 0 ? max : /^\d{1,3}$/.test(size) ? Number(size) : -1;
-  if (length2 < 0 || length2 > max) return void 0;
-  return { ...parsed2, length: length2 };
-}
-function within6(prefix, addr) {
-  if (prefix.v6 !== addr.v6) return false;
-  const shift = BigInt((prefix.v6 ? 128 : 32) - prefix.length);
-  return addr.bits >> shift === prefix.bits >> shift;
-}
-var RESERVED = [
-  "0.0.0.0/8",
-  "127.0.0.0/8",
-  "169.254.0.0/16",
-  "224.0.0.0/4",
-  "240.0.0.0/4",
-  "::/96",
-  "::ffff:0:0/96",
-  "fe80::/10",
-  "ff00::/8"
-].map((p) => parsePrefix(p));
-var Routes = class {
-  table = [];
-  exit = false;
-  ipv6;
-  constructor(ipv62 = false) {
-    this.ipv6 = ipv62;
-  }
-  set(table) {
-    const parsed2 = (table.prefixes ?? []).map(parsePrefix);
-    const bad = (table.prefixes ?? []).find((_, i) => !parsed2[i]);
-    if (bad !== void 0) throw new Error(`not an address prefix: ${bad}`);
-    this.table = parsed2;
-    this.exit = table.exit === true;
-  }
-  classify(host) {
-    const name2 = host.toLowerCase().replace(/\.$/, "");
-    if (name2 === "localhost" || name2.endsWith(".localhost") || name2 === "0.0.0.0") {
-      return "loopback";
-    }
-    if (name2 === HOST_LOOPBACK || name2 === HOST_ADDRESS) return "host";
-    const addr = addressBits(name2);
-    if (!addr) return "unreachable";
-    if (addr.v6 && addr.bits === 1n) return "loopback";
-    if (!addr.v6 && addr.bits >> 24n === 127n) return "loopback";
-    if (RESERVED.some((p) => within6(p, addr))) return "reserved";
-    if (addr.v6 && !this.ipv6) return "unreachable";
-    if (this.exit || this.table.some((p) => within6(p, addr))) return "uplink";
-    return "unreachable";
-  }
-};
-
-// src/kernel/net/uplink.ts
-function answerOf(result) {
-  const answer = Array.isArray(result) ? { addresses: result } : result;
-  const addresses = Array.isArray(answer?.addresses) ? answer.addresses.filter((a) => typeof a === "string") : [];
-  return {
-    addresses,
-    ...typeof answer?.ttl === "number" && answer.ttl >= 0 ? { ttl: answer.ttl } : {}
-  };
-}
-var NEVER = new Routes(true);
-
 // src/kernel/net/resolver.ts
 var RESOLVE_TTL_MAX = 60;
 var RESOLVE_TIMEOUT_MS = 1e4;
@@ -13675,6 +13964,19 @@ async function waitReady(fds, read, write, deadline, interrupted3) {
   }
 }
 
+// src/kernel/net/datagram-wire.ts
+function encodeReceived(got) {
+  const host = new TextEncoder().encode(got.host);
+  const out = new Uint8Array(4 + host.length + got.bytes.length);
+  const view2 = new DataView(out.buffer);
+  view2.setUint8(0, got.truncated ? 1 : 0);
+  view2.setUint16(1, got.port);
+  view2.setUint8(3, host.length);
+  out.set(host, 4);
+  out.set(got.bytes, 4 + host.length);
+  return out;
+}
+
 // src/kernel/socket-syscalls.ts
 var SOCKET_OPS = [
   "sock-open",
@@ -13687,19 +13989,36 @@ var SOCKET_OPS = [
   "sock-name",
   "sock-getopt",
   "sock-setopt",
-  "sock-resolve"
+  "sock-resolve",
+  "sock-sendto",
+  "sock-recvfrom"
 ];
 function socketAt(fds, fd) {
+  const file = anySocketAt(fds, fd);
+  if (file instanceof KernelDgram) throw new KernelError("EOPNOTSUPP");
+  return file;
+}
+function anySocketAt(fds, fd) {
   const file = fds.get(fd).file;
-  if (!(file instanceof KernelSocket)) throw new KernelError("ENOTSOCK");
+  if (!(file instanceof KernelSocket) && !(file instanceof KernelDgram)) {
+    throw new KernelError("ENOTSOCK");
+  }
+  return file;
+}
+function dgramAt(fds, fd) {
+  const file = anySocketAt(fds, fd);
+  if (!(file instanceof KernelDgram)) throw new KernelError("EOPNOTSUPP");
   return file;
 }
 var ok2 = (json5) => json5 === void 0 ? { ok: true, kind: "void" } : { ok: true, kind: "json", json: json5 };
 async function socketSyscall(req, proc) {
   const { fds, net } = proc;
   switch (req.op) {
-    case "sock-open":
-      return ok2(fds.install(new OpenFile(net.socket(req.domain)), 3));
+    case "sock-open": {
+      if (req.type === "dgram" && req.domain !== "inet") throw new KernelError("EPROTONOSUPPORT");
+      const file = req.type === "dgram" ? new KernelDgram(net) : net.socket(req.domain);
+      return ok2(fds.install(new OpenFile(file), 3));
+    }
     case "sock-pair": {
       const [a, b] = KernelSocket.pair(net, req.domain, proc.cred?.());
       const first = fds.install(new OpenFile(a), 3);
@@ -13711,44 +14030,64 @@ async function socketSyscall(req, proc) {
       }
     }
     case "sock-bind":
-      socketAt(fds, req.fd).bind(req.addr);
+      anySocketAt(fds, req.fd).bind(req.addr);
       return ok2();
     case "sock-listen":
       socketAt(fds, req.fd).listen(req.backlog, proc.cred?.());
       return ok2();
     case "sock-accept":
       return ok2(await accept(proc, req.fd, req.nonblock));
-    case "sock-connect": {
-      const socket = socketAt(fds, req.fd);
-      const stamp = net.facadeAt(req.addr) && await proc.stamp?.();
-      const dialing = socket.connect(req.addr, true, proc.cred?.(), stamp || void 0);
-      if (req.nonblock) {
-        dialing?.catch(() => void 0);
-        throw new KernelError("EINPROGRESS");
-      }
-      if (dialing !== void 0) await interruptible2(dialing, proc.blocking());
-      return ok2();
-    }
+    case "sock-connect":
+      return connect(req, proc);
     case "sock-shutdown":
-      socketAt(fds, req.fd).shutdown(req.how);
+      anySocketAt(fds, req.fd).shutdown(req.how);
       return ok2();
     case "sock-name": {
-      const socket = socketAt(fds, req.fd);
+      const socket = anySocketAt(fds, req.fd);
       const addr = req.peer ? socket.peer : socket.local;
       if (req.peer && !addr) throw new KernelError("ENOTCONN");
-      return ok2(addr ?? unnamed(socket.domain));
+      return ok2(addr ?? unnamed(socket instanceof KernelDgram ? "inet" : socket.domain));
     }
     case "sock-getopt":
-      return ok2(socketAt(fds, req.fd).getOption(req.level, req.name));
+      return ok2(anySocketAt(fds, req.fd).getOption(req.level, req.name));
     case "sock-setopt":
-      socketAt(fds, req.fd).setOption(req.level, req.name, req.value);
+      anySocketAt(fds, req.fd).setOption(req.level, req.name, req.value);
       return ok2();
     case "sock-resolve": {
       const addresses = await proc.resolve(req.name, req.family, () => proc.blocking());
       if (addresses.length === 0) throw new KernelError("ENOENT");
       return ok2(addresses);
     }
+    default:
+      return datagram(req, proc);
+  }
+}
+async function connect(req, proc) {
+  const target = anySocketAt(proc.fds, req.fd);
+  if (target instanceof KernelDgram) {
+    target.connectTo(req.addr);
+    return ok2();
+  }
+  const stamp = proc.net.facadeAt(req.addr) && await proc.stamp?.();
+  const dialing = target.connect(req.addr, true, proc.cred?.(), stamp || void 0);
+  if (req.nonblock) {
+    dialing?.catch(() => void 0);
+    throw new KernelError("EINPROGRESS");
+  }
+  if (dialing !== void 0) await interruptible2(dialing, proc.blocking());
+  return ok2();
+}
+async function datagram(req, proc) {
+  const dgram = dgramAt(proc.fds, req.fd);
+  if (req.op === "sock-sendto") {
+    if (req.nonblock && !pollFile(dgram).writable) throw new KernelError("EAGAIN");
+    return ok2(await dgram.send(req.body, req.addr));
   }
+  const ready2 = pollFile(dgram).readable;
+  if (req.nonblock && !ready2) throw new KernelError("EAGAIN");
+  const got = await dgram.receive(req.max, req.peek, ready2 ? void 0 : proc.blocking());
+  const { bytes, from, truncated } = got;
+  return { ok: true, kind: "bytes", bytes: encodeReceived({ bytes, truncated, ...from }) };
 }
 function interruptible2(dialing, signal) {
   return new Promise((resolve2, reject) => {
@@ -15352,7 +15691,8 @@ var WasmProcess = class {
     const terminal = (file.tty ?? file.pty?.slave)?.name;
     return {
       tty: file.tty !== void 0,
-      kind: file instanceof KernelSocket ? "socket" : kernelFdKind(file),
+      kind: file instanceof KernelSocket || file instanceof KernelDgram ? "socket" : kernelFdKind(file),
+      ...file instanceof KernelDgram ? { dgram: true } : {},
       ...file.heldMeta ? { meta: file.heldMeta } : {},
       ...flags2 !== void 0 ? { flags: flags2 } : {},
       ...this.fds.closesOnExec(fd) ? { cloexec: true } : {},
@@ -15741,7 +16081,7 @@ function inheritedFds(fds) {
   return fds.numbers().filter((fd) => fd > 2 && !fds.get(fd).file.held).map((fd) => {
     const open = fds.get(fd);
     const flags2 = fds.statusFlags(fd);
-    const kind = open.file instanceof KernelSocket ? "socket" : kernelFdKind(open.file);
+    const kind = open.file instanceof KernelSocket || open.file instanceof KernelDgram ? "socket" : kernelFdKind(open.file);
     const meta = open.file.heldMeta;
     return {
       fd,
@@ -18480,7 +18820,7 @@ function grantConnect(hook, fetch2, liveness = {}) {
     return new HostfsClient(first, grant, fetch2);
   };
 }
-async function openHostfs(spec, connect, timing = {}) {
+async function openHostfs(spec, connect2, timing = {}) {
   const readonly2 = spec.options?.ro !== void 0;
   const { port1, port2 } = new MessageChannel();
   const slot2 = mediumSlot(
@@ -18507,7 +18847,7 @@ async function openHostfs(spec, connect, timing = {}) {
   );
   const watching = keepWatching(
     {
-      connect: () => connect(spec.source, { readonly: readonly2 }),
+      connect: () => connect2(spec.source, { readonly: readonly2 }),
       up(client) {
         active = timed(client, timing.callMs ?? HOSTFS_CALL_MS);
         slot2.insert(client, handlers);