@volter/browser-wali 0.1.166 → 0.1.167

package/dist/network-worker.js

@@ -1,1151 +1,6 @@
-import { NETWORK_FD_MIN, NetworkOperation, } from "./network-protocol.js";
-import { WaliChildProcesses } from "./child-processes.js";
-import { WaliSignals } from "./signals.js";
-import { pollWaliSharedPipeState, waliSharedPipeGeneration } from "./shared-pipes.js";
-import { SharedWaliStdinReader } from "./stdin.js";
-import { monotonicMilliseconds } from "./monotonic-clock.js";
-import { inPrivateTreeWindow, PRIVATE_TREE_WINDOW_BASE, PRIVATE_TREE_WINDOW_SIZE } from "./private-tree.js";
-const scope = globalThis;
-const EPOLL_EVENT_BYTES = 16;
-const EPOLL_DATA_OFFSET = 8;
-const sockets = new Map();
-const epolls = new Map();
-const allowedHosts = new Set();
-const hostByAddress = new Map();
-const addressIdByHost = new Map();
-let relayUrl = "/api/wali/tcp";
-let maxConnections = 16;
-let maxBytes = 64 * 1024 * 1024;
-let networkBytes = 0;
-const externalConnections = new Set();
-let nextFd = NETWORK_FD_MIN;
-/** The next descriptor of this worker's, never one of a private tree's window (ADR-0047). */
-function takeFd() {
-    if (inPrivateTreeWindow(nextFd))
-        nextFd = PRIVATE_TREE_WINDOW_BASE + PRIVATE_TREE_WINDOW_SIZE;
-    return nextFd++;
-}
-const descriptorWaiters = new Set();
-let signals;
-let activity;
-function notifyDescriptors() { for (const resolve of [...descriptorWaiters])
-    resolve(); }
-const children = new WaliChildProcesses((minimum = NETWORK_FD_MIN) => {
-    nextFd = Math.max(nextFd, minimum);
-    return takeFd();
-}, (pid, status, code) => { signals?.raise(17, pid, status, code); });
-children.onChange(notifyDescriptors);
-let sharedPipes;
-let stdin;
-let stdioAliasRegistry;
-let loopbackPort;
-let nextLoopbackRequestId = 1;
-let nextOutboundConnectionId = -1;
-const loopbackAcks = new Map();
-const listenersByPort = new Map();
-const loopbackConnections = new Map();
-scope.onmessage = (event) => {
-    if (event.data.kind === "initialize") {
-        activity = event.data.activity ? new Int32Array(event.data.activity) : undefined;
-        allowedHosts.clear();
-        for (const host of event.data.allowedHosts)
-            allowedHosts.add(host);
-        relayUrl = event.data.relayUrl;
-        maxConnections = event.data.maxConnections;
-        maxBytes = event.data.maxBytes;
-        networkBytes = 0;
-        externalConnections.clear();
-        sharedPipes = event.data.sharedPipes;
-        stdin = event.data.stdin ? new SharedWaliStdinReader(event.data.stdin) : undefined;
-        stdioAliasRegistry = event.data.stdioAliasRegistry
-            ? new Int32Array(event.data.stdioAliasRegistry)
-            : undefined;
-        if (event.data.signals) {
-            signals = new WaliSignals(event.data.signals);
-            const shared = signals.words;
-            const waitAsync = Atomics.waitAsync;
-            if (!waitAsync) {
-                scope.postMessage({ kind: "error", message: "WALI signal delivery requires Atomics.waitAsync." });
-                return;
-            }
-            void (async () => {
-                for (;;) {
-                    const generation = Atomics.load(shared, 1);
-                    // wakes blocked polls and child waits, and so notifies descriptors
-                    children.wake();
-                    await waitAsync(shared, 1, generation).value;
-                }
-            })();
-        }
-        loopbackPort = event.data.loopbackPort;
-        if (loopbackPort) {
-            loopbackPort.onmessage = (message) => {
-                handleLoopbackMessage(message.data);
-            };
-            loopbackPort.start();
-        }
-        scope.postMessage({ kind: "ready" });
-        return;
-    }
-    if (event.data.kind === "attach")
-        attach(event.data);
-};
-function attach(channel) {
-    const control = new Int32Array(channel.control);
-    const payload = new Uint8Array(channel.payload);
-    const waitState = channel.waitState && new Int32Array(channel.waitState);
-    channel.port.onmessage = (event) => {
-        void dispatch(control, payload, typeof event.data === "number" ? event.data : event.data.requestId, typeof event.data === "number" ? undefined : event.data.process, waitState);
-    };
-    channel.port.start();
-}
-async function dispatch(control, payload, requestId, process, waitState) {
-    if (Atomics.load(control, 0) !== requestId)
-        return;
-    // Reaping is irreversible. Claim a wait before it starts so the transport
-    // watchdog cannot retire it and lose the child's status or filesystem patch.
-    const claimed = [NetworkOperation.ChildWait, NetworkOperation.PollMany, NetworkOperation.EpollWait].includes(Atomics.load(control, 1));
-    if (claimed && Atomics.compareExchange(control, 0, requestId, -requestId) !== requestId)
-        return;
-    let result = -38;
-    let output = new Uint8Array();
-    let checkedActivity = activity ? Atomics.load(activity, 0) : 0;
-    const parked = (state) => {
-        if (!waitState)
-            return;
-        if (state === 0)
-            checkedActivity = activity ? Atomics.load(activity, 0) : 0;
-        Atomics.store(waitState, 1, checkedActivity);
-        Atomics.store(waitState, 0, state);
-        Atomics.notify(control, 0);
-    };
-    parked(0);
-    try {
-        const operation = Atomics.load(control, 1);
-        const inputLength = Atomics.load(control, 3);
-        const args = Array.from({ length: 10 }, (_, index) => Atomics.load(control, 5 + index));
-        const input = payload.slice(0, inputLength);
-        ({ result, output } = await operate(operation, args, input, process, parked));
-        if ([NetworkOperation.EpollControl, NetworkOperation.Send, NetworkOperation.Receive,
-            NetworkOperation.Close, NetworkOperation.TimerFdSetTime].includes(operation))
-            notifyDescriptors();
-    }
-    catch {
-        result = -5;
-    }
-    parked(0);
-    if (output.byteLength > payload.byteLength) {
-        result = -90;
-        output = new Uint8Array();
-    }
-    // Claim this generation before touching the shared response buffers. A
-    // watchdog may have cancelled it and started a later request while operate()
-    // was pending; stale completions must never corrupt that request.
-    if (!claimed && Atomics.compareExchange(control, 0, requestId, -requestId) !== requestId)
-        return;
-    if (output.byteLength > 0)
-        payload.set(output);
-    Atomics.store(control, 2, result);
-    Atomics.store(control, 4, output.byteLength);
-    Atomics.store(control, 0, requestId + 1);
-    Atomics.notify(control, 0);
-}
-async function operate(operation, args, input, process, parked = () => { }) {
-    if (operation === NetworkOperation.ChildRegister)
-        return scalar(process ? children.register(args[0], process) : -22);
-    if (operation === NetworkOperation.ChildForget)
-        return scalar(children.forget(args[0]));
-    if (operation === NetworkOperation.ChildExists)
-        return scalar(children.has(args[0]) ? 1 : 0);
-    if (operation === NetworkOperation.ChildWait) {
-        const mask = signalMask(args[2] ?? 0, args[3] ?? 0);
-        return scalar(process ? await children.wait(args[0], args[1], process, () => !!signals && (signals.pending() & ~mask) !== 0n, value => parked(value ? 1 : 0)) : -22);
-    }
-    if (operation === NetworkOperation.PidFdOpen)
-        return scalar(children.open(args[0], args[1]));
-    if (operation === NetworkOperation.PollMany)
-        return pollMany(input, args[0], signalMask(args[1], args[2]), parked);
-    if (operation === NetworkOperation.Socket)
-        return scalar(createSocket(args[0], args[1], args[2]));
-    if (operation === NetworkOperation.EpollCreate)
-        return scalar(createEpoll());
-    if (operation === NetworkOperation.EventFd)
-        return scalar(createEventFd(args[0], args[1]));
-    if (operation === NetworkOperation.TimerFdCreate)
-        return scalar(createTimerFd(args[0], args[1]));
-    if (operation === NetworkOperation.SocketPair)
-        return createSocketPair(args[0], args[1], args[2]);
-    if (operation === NetworkOperation.EpollControl)
-        return scalar(epollControl(args[0], args[1], args[2], input));
-    if (operation === NetworkOperation.EpollWait)
-        return epollWait(args[0], args[1], args[2], signalMask(args[3], args[4]), parked);
-    const fd = args[0];
-    if (children.owns(fd)) {
-        if (operation === NetworkOperation.Close)
-            return scalar(children.close(fd));
-        if (operation === NetworkOperation.Poll)
-            return scalar(children.poll(fd, args[1]));
-        if (operation === NetworkOperation.Fcntl)
-            return scalar(children.fcntl(fd, args[1], args[2]));
-        if (operation === NetworkOperation.Duplicate)
-            return scalar(children.fcntl(fd, 0, 0));
-        return scalar(-22);
-    }
-    if (operation === NetworkOperation.Close && epolls.has(fd)) {
-        epolls.delete(fd);
-        return scalar(0);
-    }
-    if (operation === NetworkOperation.Fcntl && epolls.has(fd)) {
-        if (args[1] === 0 || args[1] === 1030)
-            return scalar(duplicateEpoll(fd, args[2]));
-        return scalar(args[1] === 3 || args[1] === 1 || args[1] === 2 || args[1] === 4 ? 0 : -22);
-    }
-    const socket = sockets.get(fd);
-    if (!socket)
-        return scalar(-9);
-    if (operation === NetworkOperation.Connect)
-        return scalar(await connectSocket(socket, input));
-    if (operation === NetworkOperation.Bind)
-        return scalar(bindSocket(socket, input));
-    if (operation === NetworkOperation.Listen)
-        return scalar(await listenSocket(socket, args[1]));
-    if (operation === NetworkOperation.Accept)
-        return acceptSocket(socket, args[1]);
-    if (operation === NetworkOperation.Send)
-        return scalar(sendSocket(socket, input));
-    if (operation === NetworkOperation.Receive) {
-        const response = receiveSocket(socket, Math.max(0, args[1]));
-        if (response.result > 0 && (pollSocket(socket, 1) & 1) === 0)
-            rearmEpollReadable(fd);
-        return response;
-    }
-    if (operation === NetworkOperation.Poll) {
-        const result = pollSocket(socket, args[1]);
-        return scalar(result);
-    }
-    if (operation === NetworkOperation.TimerFdSetTime)
-        return setTimerFd(socket, args[1], input);
-    if (operation === NetworkOperation.Fcntl)
-        return scalar(fcntlSocket(fd, socket, args[1], args[2]));
-    if (operation === NetworkOperation.SocketName)
-        return { result: 0, output: socketName(socket) };
-    if (operation === NetworkOperation.Duplicate)
-        return scalar(duplicateSocket(socket));
-    if (operation === NetworkOperation.Shutdown) {
-        closeSocket(socket);
-        return scalar(0);
-    }
-    if (operation === NetworkOperation.Close) {
-        sockets.delete(fd);
-        if (![...sockets.values()].includes(socket))
-            closeSocket(socket);
-        return scalar(0);
-    }
-    return scalar(-38);
-}
-function createEpoll() {
-    const fd = takeFd();
-    epolls.set(fd, new Map());
-    return fd;
-}
-function signalMask(low, high) { return BigInt(low >>> 0) | (BigInt(high >>> 0) << 32n); }
-async function pollMany(input, timeout, mask = 0n, parked = () => { }) {
-    if (input.byteLength % 8 !== 0)
-        return scalar(-22);
-    const output = input.slice();
-    const view = new DataView(output.buffer);
-    const original = new DataView(input.buffer, input.byteOffset, input.byteLength);
-    const deadline = timeout < 0 ? Infinity : Date.now() + timeout;
-    for (;;) {
-        if (signals && (signals.pending() & ~mask) !== 0n)
-            return scalar(-4);
-        let count = 0;
-        let processOnly = true;
-        for (let offset = 0; offset < input.byteLength; offset += 8) {
-            const fd = view.getInt32(offset, true);
-            const events = view.getInt16(offset + 4, true);
-            const socket = sockets.get(fd);
-            const ready = fd < 0 ? 0 : children.poll(fd, events)
-                ?? (sharedPipes ? pollWaliSharedPipeState(sharedPipes, fd, events) : undefined)
-                ?? (isStdinDescriptor(fd) && stdin ? ((events & 1) && stdin.poll() ? 1 : 0) : undefined)
-                ?? (socket ? pollSocket(socket, events) : undefined)
-                ?? (fd >= NETWORK_FD_MIN && !inPrivateTreeWindow(fd) ? 0x20 : original.getInt16(offset + 6, true));
-            if (fd >= 0 && !children.owns(fd))
-                processOnly = false;
-            view.setInt16(offset + 6, ready, true);
-            if (ready !== 0)
-                count++;
-        }
-        if (count || timeout === 0 || Date.now() >= deadline)
-            return { result: count, output };
-        const fds = Array.from({ length: input.byteLength / 8 }, (_, index) => view.getInt32(index * 8, true));
-        parked(fds.some(outsideWake) ? 2 : 1);
-        try {
-            await waitForDescriptorChange(processOnly ? deadline - Date.now() : 2);
-        }
-        finally {
-            parked(0);
-        }
-    }
-}
-function waitForDescriptorChange(delay) {
-    return new Promise((resolve) => {
-        const done = () => { if (timer !== undefined)
-            clearTimeout(timer); descriptorWaiters.delete(done); resolve(); };
-        descriptorWaiters.add(done);
-        const timer = Number.isFinite(delay) ? setTimeout(done, Math.max(0, delay)) : undefined;
-    });
-}
-function duplicateEpoll(fd, minimum) {
-    const registrations = epolls.get(fd);
-    if (!registrations)
-        return -9;
-    nextFd = Math.max(nextFd, minimum, NETWORK_FD_MIN);
-    const duplicate = takeFd();
-    epolls.set(duplicate, registrations);
-    return duplicate;
-}
-function createEventFd(initial, flags) {
-    if (initial < 0)
-        return -22;
-    const fd = takeFd();
-    sockets.set(fd, {
-        kind: "event",
-        counter: BigInt(initial >>> 0),
-        generation: 0,
-        semaphore: Boolean(flags & 1),
-        nonblocking: Boolean(flags & 0x800),
-    });
-    return fd;
-}
-function createTimerFd(clockId, flags) {
-    if (![0, 1, 7].includes(clockId) || (flags & ~0x8_0800) !== 0)
-        return -22;
-    const fd = takeFd();
-    sockets.set(fd, {
-        kind: "timer",
-        clockId,
-        intervalNanoseconds: 0n,
-        deadlineNanoseconds: undefined,
-        expirations: 0n,
-        nonblocking: Boolean(flags & 0x800),
-    });
-    return fd;
-}
-function setTimerFd(socket, flags, input) {
-    if (socket.kind !== "timer")
-        return scalar(-9);
-    if ((flags & ~1) !== 0 || input.byteLength !== 32)
-        return scalar(-22);
-    const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
-    const interval = readTimespec(view, 0);
-    const value = readTimespec(view, 16);
-    if (interval === undefined || value === undefined)
-        return scalar(-22);
-    updateTimer(socket);
-    const output = new Uint8Array(32);
-    const outputView = new DataView(output.buffer);
-    writeTimespec(outputView, 0, socket.intervalNanoseconds);
-    writeTimespec(outputView, 16, timerRemaining(socket));
-    socket.intervalNanoseconds = interval;
-    socket.deadlineNanoseconds = value === 0n ? undefined
-        : (flags & 1) ? value : nowNanoseconds(socket.clockId) + value;
-    socket.expirations = 0n;
-    return { result: 0, output };
-}
-function createSocketPair(domain, type, protocol) {
-    if (domain !== 1)
-        return scalar(-97);
-    if ((type & 0xf) !== 1 || protocol !== 0)
-        return scalar(-93);
-    const left = { kind: "local", chunks: [], byteLength: 0, closed: false, peerClosed: false };
-    const right = { kind: "local", chunks: [], byteLength: 0, closed: false, peerClosed: false };
-    left.peer = right;
-    right.peer = left;
-    const leftFd = takeFd();
-    const rightFd = takeFd();
-    sockets.set(leftFd, left);
-    sockets.set(rightFd, right);
-    const output = new Uint8Array(8);
-    const view = new DataView(output.buffer);
-    view.setInt32(0, leftFd, true);
-    view.setInt32(4, rightFd, true);
-    return { result: 0, output };
-}
-function epollControl(epollFd, operation, fd, input) {
-    const sharedPipe = sharedPipes ? pollWaliSharedPipeState(sharedPipes, fd, 0) : undefined;
-    if (!sockets.has(fd) && !children.owns(fd) && sharedPipe === undefined && !(isStdinDescriptor(fd) && stdin))
-        return -9;
-    let registrations = epolls.get(epollFd);
-    if (!registrations) {
-        registrations = new Map();
-        epolls.set(epollFd, registrations);
-    }
-    if (operation === 2)
-        return registrations.delete(fd) ? 0 : -2;
-    if (operation !== 1 && operation !== 3 || input.byteLength < EPOLL_EVENT_BYTES)
-        return -22;
-    if (operation === 1 && registrations.has(fd))
-        return -17;
-    if (operation === 3 && !registrations.has(fd))
-        return -2;
-    const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
-    const events = view.getUint32(0, true);
-    const socket = sockets.get(fd);
-    registrations.set(fd, {
-        events,
-        data: input.slice(EPOLL_DATA_OFFSET, EPOLL_EVENT_BYTES),
-        lastReady: 0,
-        lastPipeGeneration: sharedPipes ? waliSharedPipeGeneration(sharedPipes, fd) ?? 0 : 0,
-        lastStdinGeneration: isStdinDescriptor(fd) && stdin ? stdin.generation() : 0,
-        lastEventGeneration: socket?.kind === "event"
-            ? socket.generation
-            : 0,
-    });
-    return 0;
-}
-async function epollWait(epollFd, maximum, timeout, mask = 0n, parked = () => { }) {
-    const registrations = epolls.get(epollFd);
-    if (!registrations)
-        return scalar(-9);
-    if (maximum <= 0)
-        return scalar(-22);
-    const startedAt = Date.now();
-    // This blocking RPC is claimed before dispatch, so an infinite guest wait
-    // needs no synthetic timeout to placate the request transport watchdog.
-    const deadline = timeout < 0 ? Infinity : startedAt + timeout;
-    do {
-        if (signals && (signals.pending() & ~mask) !== 0n)
-            return scalar(-4);
-        const events = [];
-        for (const [fd, registration] of registrations) {
-            const socket = sockets.get(fd);
-            const pollEvents = ((registration.events & 1) ? 1 : 0) | ((registration.events & 4) ? 4 : 0);
-            // Read the generation first so a write racing this poll is still seen
-            // on the next poll, even if readiness was already observed here.
-            const pipeGeneration = sharedPipes
-                ? waliSharedPipeGeneration(sharedPipes, fd) ?? registration.lastPipeGeneration
-                : registration.lastPipeGeneration;
-            const externalReady = children.poll(fd, pollEvents)
-                ?? (sharedPipes ? pollWaliSharedPipeState(sharedPipes, fd, pollEvents) : undefined);
-            const terminalReady = isStdinDescriptor(fd) && stdin
-                ? ((pollEvents & 1) && stdin.poll() ? 1 : 0)
-                : undefined;
-            if (!socket && externalReady === undefined && terminalReady === undefined)
-                continue;
-            const currentReady = (terminalReady ?? externalReady ?? pollSocket(socket, pollEvents))
-                & (registration.events | 0x18);
-            const stdinGeneration = isStdinDescriptor(fd) && stdin
-                ? stdin.generation()
-                : registration.lastStdinGeneration;
-            const edgeReady = (currentReady & ~registration.lastReady)
-                | (pipeGeneration !== registration.lastPipeGeneration ? currentReady : 0)
-                | (stdinGeneration !== registration.lastStdinGeneration ? currentReady : 0)
-                | (socket?.kind === "event" && socket.generation !== registration.lastEventGeneration
-                    ? currentReady
-                    : 0);
-            // A browser terminal's shared byte queue behaves like a TTY, not a
-            // packet socket. Keep reporting readable until the consumer drains it;
-            // otherwise one-byte reads can strand the final key behind EPOLLET.
-            const ready = isStdinDescriptor(fd)
-                ? currentReady
-                : (registration.events & 0x8000_0000) !== 0 ? edgeReady : currentReady;
-            registration.lastReady = currentReady;
-            registration.lastPipeGeneration = pipeGeneration;
-            registration.lastStdinGeneration = stdinGeneration;
-            registration.lastEventGeneration = socket?.kind === "event"
-                ? socket.generation
-                : registration.lastEventGeneration;
-            if (ready !== 0)
-                events.push({ ready, data: registration.data });
-            if (events.length >= maximum)
-                break;
-        }
-        if (events.length > 0) {
-            const output = new Uint8Array(events.length * EPOLL_EVENT_BYTES);
-            const view = new DataView(output.buffer);
-            events.forEach((event, index) => {
-                const offset = index * EPOLL_EVENT_BYTES;
-                view.setUint32(offset, event.ready, true);
-                output.set(event.data, offset + EPOLL_DATA_OFFSET);
-            });
-            return { result: events.length, output };
-        }
-        if (timeout === 0 || Date.now() >= deadline)
-            return { result: 0, output: new Uint8Array() };
-        // Other descriptor sources retain the existing shared-pipe/socket scan.
-        let childrenOnly = true;
-        for (const fd of registrations.keys())
-            if (!children.owns(fd)) {
-                childrenOnly = false;
-                break;
-            }
-        parked([...registrations.keys()].some(outsideWake) ? 2 : 1);
-        try {
-            await waitForDescriptorChange(childrenOnly ? deadline - Date.now() : 2);
-        }
-        finally {
-            parked(0);
-        }
-    } while (true);
-}
-function outsideWake(fd) {
-    const socket = sockets.get(fd);
-    if (socket?.kind === "tcp" || socket?.kind === "dns")
-        return true;
-    if (socket?.kind === "timer" && socket.deadlineNanoseconds !== undefined)
-        return true;
-    if (isStdinDescriptor(fd) && stdin)
-        return !stdin.closed;
-    return false;
-}
-function isStdinDescriptor(fd) {
-    if (fd === 0)
-        return true;
-    if (!stdioAliasRegistry || fd < 0 || fd >= stdioAliasRegistry.length)
-        return false;
-    return Atomics.load(stdioAliasRegistry, fd) === 0;
-}
-function scalar(result) {
-    return { result, output: new Uint8Array() };
-}
-function createSocket(domain, type, protocol) {
-    const baseType = type & 0xf;
-    let socket;
-    if ((domain === 2 || domain === 10) && baseType === 2 && (protocol === 0 || protocol === 17)) {
-        socket = { kind: "dns", domain, responses: [] };
-    }
-    else if ((domain === 2 || domain === 10) && baseType === 1 && (protocol === 0 || protocol === 6)) {
-        socket = {
-            kind: "tcp",
-            domain,
-            chunks: [],
-            byteLength: 0,
-            open: false,
-            closed: false,
-            failed: false,
-            nonblocking: Boolean(type & 0x800),
-            listening: false,
-            backlog: 0,
-            pending: [],
-            acceptWaiters: [],
-            peerClosed: false,
-        };
-    }
-    else {
-        return domain === 2 || domain === 10 ? -93 : -97;
-    }
-    const fd = takeFd();
-    sockets.set(fd, socket);
-    return fd;
-}
-async function connectSocket(socket, address) {
-    if (socket.kind === "dns")
-        return 0;
-    if (socket.kind === "event" || socket.kind === "timer")
-        return -88;
-    if (socket.kind === "local")
-        return -106;
-    const target = parseSocketAddress(address);
-    if (!target)
-        return -111;
-    if (isLoopbackConnectAddress(target.address)) {
-        if (!loopbackPort || socket.open)
-            return socket.open ? -106 : -111;
-        const connectionId = nextOutboundConnectionId--;
-        const result = await requestLoopbackConnect(target.port, connectionId);
-        if (result < 0)
-            return result;
-        socket.loopbackConnectionId = connectionId;
-        socket.open = true;
-        socket.closed = false;
-        socket.peerClosed = false;
-        socket.bound = { address: socket.domain === 10 ? "::1" : "127.0.0.1", port: 0 };
-        loopbackConnections.set(connectionId, socket);
-        return 0;
-    }
-    if (target.port !== 443)
-        return -111;
-    const hostname = hostByAddress.get(target.address);
-    if (!hostname || !allowedHosts.has(hostname))
-        return -13;
-    if (socket.open)
-        return -106;
-    if (externalConnections.size >= maxConnections)
-        return -24;
-    externalConnections.add(socket);
-    const url = new URL(relayUrl, scope.location.href);
-    url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
-    url.search = "";
-    url.searchParams.append("host", hostname);
-    url.searchParams.append("port", "443");
-    return new Promise((resolve) => {
-        const websocket = new WebSocket(url);
-        socket.websocket = websocket;
-        websocket.binaryType = "arraybuffer";
-        let settled = false;
-        const settle = (value) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timeout);
-            if (value < 0)
-                externalConnections.delete(socket);
-            resolve(value);
-        };
-        const timeout = setTimeout(() => {
-            try {
-                websocket.close();
-            }
-            catch { }
-            settle(-110);
-        }, 15_000);
-        websocket.addEventListener("open", () => { socket.open = true; settle(0); });
-        websocket.addEventListener("message", (event) => {
-            if (!(event.data instanceof ArrayBuffer)) {
-                socket.failed = true;
-                return;
-            }
-            const chunk = new Uint8Array(event.data);
-            if (!consumeNetworkBytes(chunk.byteLength)) {
-                socket.failed = true;
-                closeSocket(socket);
-                return;
-            }
-            socket.chunks.push(chunk);
-            socket.byteLength += chunk.byteLength;
-        });
-        websocket.addEventListener("close", () => { externalConnections.delete(socket); socket.closed = true; socket.open = false; settle(-111); });
-        websocket.addEventListener("error", () => { socket.failed = true; settle(-111); });
-    });
-}
-function bindSocket(socket, address) {
-    if (socket.kind === "dns") {
-        if (socket.bound)
-            return -22;
-        const target = parseSocketAddress(address);
-        if (!target || !isLoopbackBindAddress(target.address))
-            return target ? -99 : -22;
-        socket.bound = target;
-        return 0;
-    }
-    if (socket.kind !== "tcp")
-        return -88;
-    if (socket.open || socket.bound)
-        return -22;
-    const target = parseSocketAddress(address);
-    if (!target || !isLoopbackBindAddress(target.address))
-        return target ? -99 : -22;
-    const port = target.port === 0 ? allocateLoopbackPort() : target.port;
-    if (port <= 0 || listenersByPort.has(port))
-        return -98;
-    socket.bound = { address: target.address, port, ...(target.port === 0 ? { ephemeral: true } : {}) };
-    return 0;
-}
-async function listenSocket(socket, backlog) {
-    if (socket.kind !== "tcp")
-        return -95;
-    if (!socket.bound)
-        return -22;
-    if (socket.listening)
-        return 0;
-    if (!loopbackPort)
-        return -97;
-    const existing = listenersByPort.get(socket.bound.port);
-    if (existing && existing !== socket)
-        return -98;
-    let result = await requestLoopbackListen(socket.bound.port);
-    // This worker sees its own listeners, the project's port table every
-    // server's: a port it chose for port 0 that another server holds is
-    // passed over for the next free one, as the kernel would never have chosen it.
-    while (result === -98 && socket.bound.ephemeral) {
-        const next = allocateLoopbackPort(socket.bound.port + 1);
-        if (next <= 0)
-            break;
-        socket.bound = { ...socket.bound, port: next };
-        result = await requestLoopbackListen(next);
-    }
-    if (result < 0)
-        return result;
-    socket.listening = true;
-    socket.open = true;
-    socket.backlog = Math.max(1, Math.min(128, backlog));
-    listenersByPort.set(socket.bound.port, socket);
-    return 0;
-}
-async function acceptSocket(socket, flags) {
-    if (socket.kind !== "tcp" || !socket.listening)
-        return scalar(-22);
-    if ((flags & ~0x8_0800) !== 0)
-        return scalar(-22);
-    let accepted = socket.pending.shift();
-    if (!accepted && (socket.nonblocking || Boolean(flags & 0x800)))
-        return scalar(-11);
-    if (!accepted) {
-        accepted = await new Promise((resolve) => socket.acceptWaiters.push(resolve));
-    }
-    if (!accepted)
-        return scalar(-9);
-    accepted.nonblocking = accepted.nonblocking || Boolean(flags & 0x800);
-    const fd = takeFd();
-    sockets.set(fd, accepted);
-    return { result: fd, output: socketAddress(accepted.domain, "127.0.0.1", 0) };
-}
-function requestLoopbackListen(port) {
-    if (!loopbackPort)
-        return Promise.resolve(-97);
-    const requestId = nextLoopbackRequestId++;
-    return new Promise((resolve) => {
-        const timeout = setTimeout(() => {
-            if (!loopbackAcks.delete(requestId))
-                return;
-            resolve(-110);
-        }, 5_000);
-        loopbackAcks.set(requestId, (result) => {
-            clearTimeout(timeout);
-            resolve(result);
-        });
-        postLoopback({ type: "listen", requestId, port });
-    });
-}
-function requestLoopbackConnect(port, connectionId) {
-    if (!loopbackPort)
-        return Promise.resolve(-111);
-    const requestId = nextLoopbackRequestId++;
-    return new Promise((resolve) => {
-        const timeout = setTimeout(() => {
-            if (!loopbackAcks.delete(requestId))
-                return;
-            resolve(-110);
-        }, 5_000);
-        loopbackAcks.set(requestId, (result) => {
-            clearTimeout(timeout);
-            resolve(result);
-        });
-        postLoopback({ type: "connect", requestId, connectionId, port });
-    });
-}
-function handleLoopbackMessage(message) {
-    if (message.type === "ack") {
-        const resolve = loopbackAcks.get(message.requestId);
-        if (!resolve)
-            return;
-        loopbackAcks.delete(message.requestId);
-        resolve(message.result);
-        return;
-    }
-    if (message.type === "peer-close") {
-        const socket = loopbackConnections.get(message.connectionId);
-        if (socket)
-            socket.peerClosed = true;
-        return;
-    }
-    if (message.type === "data") {
-        const socket = loopbackConnections.get(message.connectionId);
-        if (!socket || socket.closed)
-            return;
-        const bytes = message.bytes.slice();
-        socket.chunks.push(bytes);
-        socket.byteLength += bytes.byteLength;
-        return;
-    }
-    const listener = listenersByPort.get(message.port);
-    if (!listener || !listener.listening || listener.closed
-        || listener.pending.length >= listener.backlog) {
-        postLoopback({ type: "closed", connectionId: message.connectionId });
-        return;
-    }
-    const accepted = {
-        kind: "tcp",
-        domain: listener.domain,
-        chunks: [message.bytes.slice()],
-        byteLength: message.bytes.byteLength,
-        open: true,
-        closed: false,
-        failed: false,
-        nonblocking: false,
-        listening: false,
-        backlog: 0,
-        pending: [],
-        acceptWaiters: [],
-        loopbackConnectionId: message.connectionId,
-        peerClosed: false,
-        ...(listener.bound ? { bound: listener.bound } : {}),
-    };
-    loopbackConnections.set(message.connectionId, accepted);
-    const waiter = listener.acceptWaiters.shift();
-    if (waiter)
-        waiter(accepted);
-    else
-        listener.pending.push(accepted);
-}
-function postLoopback(message) {
-    loopbackPort?.postMessage(message);
-}
-function isLoopbackBindAddress(address) {
-    return address === "0.0.0.0" || address === "127.0.0.1" || address === "::" || address === "::1";
-}
-function isLoopbackConnectAddress(address) {
-    return address === "127.0.0.1" || address === "::1";
-}
-function allocateLoopbackPort(from = 49_152) {
-    for (let port = from; port <= 65_535; port += 1) {
-        if (!listenersByPort.has(port))
-            return port;
-    }
-    return -1;
-}
-function sendSocket(socket, input) {
-    if (socket.kind === "event") {
-        if (input.byteLength < 8)
-            return -22;
-        const increment = new DataView(input.buffer, input.byteOffset, input.byteLength).getBigUint64(0, true);
-        if (increment === 0xffffffffffffffffn)
-            return -22;
-        socket.counter += increment;
-        socket.generation = socket.generation >= 0x7fff_ffff ? 1 : socket.generation + 1;
-        return 8;
-    }
-    if (socket.kind === "local") {
-        if (socket.closed)
-            return -9;
-        if (!socket.peer || socket.peer.closed)
-            return -32;
-        const copy = input.slice();
-        socket.peer.chunks.push(copy);
-        socket.peer.byteLength += copy.byteLength;
-        return copy.byteLength;
-    }
-    if (socket.kind === "timer")
-        return -22;
-    if (socket.kind === "dns") {
-        const response = dnsResponse(input);
-        if (!response)
-            return -13;
-        socket.responses.push(response);
-        return input.byteLength;
-    }
-    if (socket.loopbackConnectionId !== undefined) {
-        if (socket.closed || socket.peerClosed)
-            return -32;
-        postLoopback({ type: "outgoing", connectionId: socket.loopbackConnectionId, bytes: input.slice() });
-        return input.byteLength;
-    }
-    if (!socket.open || !socket.websocket)
-        return socket.closed ? -32 : -11;
-    if (!consumeNetworkBytes(input.byteLength)) {
-        closeSocket(socket);
-        return -122;
-    }
-    socket.websocket.send(input);
-    return input.byteLength;
-}
-function receiveSocket(socket, maximum) {
-    if (socket.kind === "event") {
-        if (maximum < 8)
-            return { result: -22, output: new Uint8Array() };
-        if (socket.counter === 0n)
-            return { result: socket.nonblocking ? -11 : -11, output: new Uint8Array() };
-        const value = socket.semaphore ? 1n : socket.counter;
-        socket.counter -= value;
-        const output = new Uint8Array(8);
-        new DataView(output.buffer).setBigUint64(0, value, true);
-        return { result: 8, output };
-    }
-    if (socket.kind === "local") {
-        if (socket.closed)
-            return { result: -9, output: new Uint8Array() };
-        if (socket.byteLength === 0)
-            return { result: socket.peerClosed ? 0 : -11, output: new Uint8Array() };
-        return drainChunks(socket, maximum);
-    }
-    if (socket.kind === "timer") {
-        if (maximum < 8)
-            return { result: -22, output: new Uint8Array() };
-        updateTimer(socket);
-        if (socket.expirations === 0n)
-            return { result: -11, output: new Uint8Array() };
-        const output = new Uint8Array(8);
-        new DataView(output.buffer).setBigUint64(0, socket.expirations, true);
-        socket.expirations = 0n;
-        return { result: 8, output };
-    }
-    if (maximum === 0)
-        return { result: 0, output: new Uint8Array() };
-    if (socket.kind === "dns") {
-        const response = socket.responses.shift();
-        if (!response)
-            return { result: -11, output: new Uint8Array() };
-        const output = response.subarray(0, maximum);
-        return { result: output.byteLength, output };
-    }
-    if (socket.byteLength === 0)
-        return {
-            result: socket.closed || socket.peerClosed ? 0 : socket.failed ? -5 : -11,
-            output: new Uint8Array(),
-        };
-    return drainChunks(socket, maximum);
-}
-function drainChunks(socket, maximum) {
-    const output = new Uint8Array(Math.min(maximum, socket.byteLength));
-    let offset = 0;
-    while (offset < output.byteLength) {
-        const chunk = socket.chunks[0];
-        const count = Math.min(chunk.byteLength, output.byteLength - offset);
-        output.set(chunk.subarray(0, count), offset);
-        offset += count;
-        socket.byteLength -= count;
-        if (count === chunk.byteLength)
-            socket.chunks.shift();
-        else
-            socket.chunks[0] = chunk.subarray(count);
-    }
-    return { result: output.byteLength, output };
-}
-function pollSocket(socket, events) {
-    if (socket.kind === "event")
-        return ((events & 1) && socket.counter > 0n ? 1 : 0) | ((events & 4) ? 4 : 0);
-    if (socket.kind === "timer") {
-        updateTimer(socket);
-        return (events & 1) && socket.expirations > 0n ? 1 : 0;
-    }
-    if (socket.kind === "local") {
-        return (socket.peerClosed ? 0x10 : 0)
-            | ((events & 1) && (socket.byteLength > 0 || socket.peerClosed) ? 1 : 0)
-            | ((events & 4) && !socket.peerClosed ? 4 : 0);
-    }
-    if (socket.kind === "dns")
-        return ((events & 1) && socket.responses.length ? 1 : 0) | ((events & 4) ? 4 : 0);
-    if (socket.listening)
-        return (events & 1) && socket.pending.length > 0 ? 1 : 0;
-    let ready = socket.closed || socket.peerClosed ? 0x10 : socket.failed ? 0x8 : 0;
-    if ((events & 1) && (socket.byteLength > 0 || socket.closed || socket.peerClosed))
-        ready |= 1;
-    if ((events & 4) && socket.open && !socket.peerClosed)
-        ready |= 4;
-    return ready;
-}
-function rearmEpollReadable(fd) {
-    const target = sockets.get(fd);
-    for (const registrations of epolls.values()) {
-        for (const [registeredFd, registration] of registrations) {
-            if (registeredFd === fd || (target && sockets.get(registeredFd) === target)) {
-                registration.lastReady &= ~1;
-            }
-        }
-    }
-}
-function fcntlSocket(_fd, socket, command, argument) {
-    if (command === 0 || command === 1030)
-        return duplicateSocket(socket, Math.max(argument, NETWORK_FD_MIN));
-    if (command === 1 || command === 2 || command === 4)
-        return 0;
-    if (command === 3)
-        return socket.kind === "timer" ? (socket.nonblocking ? 0x800 : 0) : 0x802;
-    return -22;
-}
-function duplicateSocket(socket, minimum = NETWORK_FD_MIN) {
-    nextFd = Math.max(nextFd, minimum);
-    const fd = takeFd();
-    sockets.set(fd, socket);
-    return fd;
-}
-function closeSocket(socket) {
-    if (socket.kind === "tcp") {
-        externalConnections.delete(socket);
-        if (socket.listening && socket.bound) {
-            listenersByPort.delete(socket.bound.port);
-            postLoopback({ type: "unlisten", port: socket.bound.port });
-            for (const resolve of socket.acceptWaiters.splice(0))
-                resolve(undefined);
-            for (const accepted of socket.pending.splice(0))
-                closeSocket(accepted);
-        }
-        if (socket.loopbackConnectionId !== undefined) {
-            loopbackConnections.delete(socket.loopbackConnectionId);
-            postLoopback({ type: "closed", connectionId: socket.loopbackConnectionId });
-        }
-        socket.closed = true;
-        socket.open = false;
-        try {
-            socket.websocket?.close();
-        }
-        catch { }
-    }
-    if (socket.kind === "local") {
-        socket.closed = true;
-        if (socket.peer)
-            socket.peer.peerClosed = true;
-    }
-}
-function consumeNetworkBytes(bytes) {
-    if (bytes < 0 || networkBytes > maxBytes - bytes)
-        return false;
-    networkBytes += bytes;
-    return true;
-}
-function socketName(socket) {
-    if (socket.kind === "event" || socket.kind === "timer")
-        return new Uint8Array();
-    if (socket.kind === "local")
-        return new Uint8Array();
-    if (socket.kind === "dns")
-        return socketAddress(socket.domain, socket.bound?.address ?? (socket.domain === 10 ? "::" : "0.0.0.0"), socket.bound?.port ?? 0);
-    return socketAddress(socket.domain, socket.bound?.address ?? (socket.domain === 10 ? "::" : "0.0.0.0"), socket.bound?.port ?? 0);
-}
-function socketAddress(domain, address, port) {
-    const output = new Uint8Array(domain === 10 ? 28 : 16);
-    const view = new DataView(output.buffer);
-    view.setUint16(0, domain, true);
-    view.setUint16(2, port, false);
-    if (domain === 2) {
-        const parts = address === "0.0.0.0" ? [0, 0, 0, 0]
-            : address === "127.0.0.1" ? [127, 0, 0, 1] : [127, 0, 0, 1];
-        output.set(parts, 4);
-    }
-    else if (address === "::1") {
-        output[23] = 1;
-    }
-    return output;
-}
-function updateTimer(timer) {
-    if (timer.deadlineNanoseconds === undefined)
-        return;
-    const now = nowNanoseconds(timer.clockId);
-    if (now < timer.deadlineNanoseconds)
-        return;
-    const elapsed = now - timer.deadlineNanoseconds;
-    const count = timer.intervalNanoseconds === 0n ? 1n : 1n + elapsed / timer.intervalNanoseconds;
-    const next = timer.expirations + count;
-    timer.expirations = next > 0xffffffffffffffffn ? 0xffffffffffffffffn : next;
-    timer.deadlineNanoseconds = timer.intervalNanoseconds === 0n
-        ? undefined : timer.deadlineNanoseconds + count * timer.intervalNanoseconds;
-}
-function timerRemaining(timer) {
-    if (timer.deadlineNanoseconds === undefined)
-        return 0n;
-    const remaining = timer.deadlineNanoseconds - nowNanoseconds(timer.clockId);
-    return remaining > 0n ? remaining : 0n;
-}
-function readTimespec(view, offset) {
-    const seconds = view.getBigInt64(offset, true);
-    const nanoseconds = view.getBigInt64(offset + 8, true);
-    if (seconds < 0n || nanoseconds < 0n || nanoseconds >= 1000000000n)
-        return;
-    return seconds * 1000000000n + nanoseconds;
-}
-function writeTimespec(view, offset, nanoseconds) {
-    view.setBigInt64(offset, nanoseconds / 1000000000n, true);
-    view.setBigInt64(offset + 8, nanoseconds % 1000000000n, true);
-}
-function nowNanoseconds(clockId) {
-    const milliseconds = clockId === 0 ? performance.timeOrigin + performance.now() : monotonicMilliseconds();
-    return BigInt(Math.floor(milliseconds * 1_000_000));
-}
-function dnsResponse(query) {
-    if (query.byteLength < 17)
-        return;
-    let offset = 12;
-    const labels = [];
-    while (offset < query.byteLength) {
-        const length = query[offset++];
-        if (length === 0)
-            break;
-        if (length > 63 || offset + length > query.byteLength)
-            return;
-        labels.push(new TextDecoder().decode(query.subarray(offset, offset + length)));
-        offset += length;
-    }
-    if (offset + 4 > query.byteLength)
-        return;
-    const hostname = labels.join(".").toLowerCase();
-    const qtype = (query[offset] << 8) | query[offset + 1];
-    const questionEnd = offset + 4;
-    const allowed = allowedHosts.has(hostname) && (qtype === 1 || qtype === 28);
-    const answerLength = allowed ? (qtype === 1 ? 16 : 28) : 0;
-    const response = new Uint8Array(questionEnd + answerLength);
-    response.set(query.subarray(0, questionEnd));
-    response[2] = 0x81;
-    response[3] = allowed ? 0x80 : 0x83;
-    response[6] = 0;
-    response[7] = allowed ? 1 : 0;
-    response.fill(0, 8, 12);
-    if (!allowed)
-        return response;
-    const identifier = addressId(hostname);
-    let answer = questionEnd;
-    response[answer++] = 0xc0;
-    response[answer++] = 0x0c;
-    response[answer++] = 0;
-    response[answer++] = qtype;
-    response[answer++] = 0;
-    response[answer++] = 1;
-    response[answer++] = 0;
-    response[answer++] = 0;
-    response[answer++] = 0;
-    response[answer++] = 60;
-    response[answer++] = 0;
-    response[answer++] = qtype === 1 ? 4 : 16;
-    if (qtype === 1) {
-        const address = `203.0.113.${identifier}`;
-        hostByAddress.set(address, hostname);
-        response.set([203, 0, 113, identifier], answer);
-    }
-    else {
-        const address = `2001:db8::${identifier.toString(16)}`;
-        hostByAddress.set(address, hostname);
-        response.set([0x20, 0x01, 0x0d, 0xb8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, identifier], answer);
-    }
-    return response;
-}
-function addressId(hostname) {
-    const current = addressIdByHost.get(hostname);
-    if (current)
-        return current;
-    const next = addressIdByHost.size + 1;
-    if (next > 254)
-        throw new Error("Too many WALI DNS targets.");
-    addressIdByHost.set(hostname, next);
-    return next;
-}
-function parseSocketAddress(value) {
-    if (value.byteLength < 8)
-        return;
-    const view = new DataView(value.buffer, value.byteOffset, value.byteLength);
-    const family = view.getUint16(0, true);
-    const port = view.getUint16(2, false);
-    if (family === 2 && value.byteLength >= 8) {
-        return { address: [...value.subarray(4, 8)].join("."), port };
-    }
-    if (family === 10 && value.byteLength >= 24) {
-        const groups = [];
-        for (let offset = 8; offset < 24; offset += 2)
-            groups.push(view.getUint16(offset, false).toString(16));
-        return { address: compressIpv6(groups), port };
-    }
-    return;
-}
-function compressIpv6(groups) {
-    let bestStart = -1;
-    let bestLength = 0;
-    for (let start = 0; start < groups.length;) {
-        if (groups[start] !== "0") {
-            start += 1;
-            continue;
-        }
-        let end = start;
-        while (groups[end] === "0")
-            end += 1;
-        if (end - start > bestLength) {
-            bestStart = start;
-            bestLength = end - start;
-        }
-        start = end;
-    }
-    if (bestLength < 2)
-        return groups.join(":");
-    const before = groups.slice(0, bestStart).join(":");
-    const after = groups.slice(bestStart + bestLength).join(":");
-    return `${before}::${after}`;
-}
+import { createWaliNetworkSession } from "./network-host.js";
+// Standalone clients retain their dedicated worker. Kernel clients use
+// kernel-network-worker and attach one process session through a port.
+const session = createWaliNetworkSession(message => postMessage(message));
+self.onmessage = (event) => session.receive(event);
 //# sourceMappingURL=network-worker.js.map