@volter/browser-wali 0.1.166 → 0.1.168

package/dist/network-host.js

@@ -0,0 +1,1582 @@
+// Socket peer/error/peek rules adapted from Emscripten src/lib/libsockfs.js
+// and libsyscall.js, commit 862dc0d48acc4134a0088d27ac8f5dd18baba1cd.
+// Copyright 2013, 2021 The Emscripten Authors. SPDX-License-Identifier: MIT
+// Modifications: Linux descriptor flags/accept semantics; transport, grants,
+// process ownership and port arbitration remain this kernel's adapters.
+import { WaliEpollSet } from "./epoll-ready.js";
+import { NETWORK_FD_MIN, NETWORK_PAYLOAD_BYTES, NetworkOperation, } from "./network-protocol.js";
+import { WaliChildProcesses } from "./child-processes.js";
+import { WaliSignals } from "./signals.js";
+import { pollWaliSharedPipeState, waliSharedPipeGeneration } from "./shared-pipes.js";
+import { SharedWaliStdinReader } from "./stdin.js";
+import { monotonicMilliseconds } from "./monotonic-clock.js";
+import { inPrivateTreeWindow, PRIVATE_TREE_WINDOW_BASE, PRIVATE_TREE_WINDOW_SIZE } from "./private-tree.js";
+/** A process reactor hosted by either its own worker or the kernel worker. */
+export function createWaliNetworkSession(reply) {
+    const scope = globalThis;
+    let disposed = false;
+    const channels = new Set();
+    const EPOLL_EVENT_BYTES = 16;
+    const EPOLL_DATA_OFFSET = 8;
+    const sockets = new Map();
+    const socketDescriptorFlags = new Map();
+    const activeReceives = new Map();
+    const epolls = new Map();
+    const epollDescriptorFlags = new Map();
+    const allowedHosts = new Set();
+    const hostByAddress = new Map();
+    const addressIdByHost = new Map();
+    let relayUrl = "/api/wali/tcp";
+    let maxConnections = 16;
+    let maxBytes = 64 * 1024 * 1024;
+    let networkBytes = 0;
+    const externalConnections = new Set();
+    let descriptorLimits;
+    const descriptorLimit = () => descriptorLimits ? Atomics.load(descriptorLimits, 0) : 65_536;
+    /** The next descriptor of this worker's, never one of a private tree's window (ADR-0047). */
+    function takeFd(minimum = NETWORK_FD_MIN) {
+        for (let fd = Math.max(minimum, NETWORK_FD_MIN); fd < descriptorLimit(); fd++) {
+            if (inPrivateTreeWindow(fd)) {
+                fd = PRIVATE_TREE_WINDOW_BASE + PRIVATE_TREE_WINDOW_SIZE - 1;
+                continue;
+            }
+            if (!sockets.has(fd) && !epolls.has(fd) && !children.owns(fd))
+                return fd;
+        }
+        throw Object.assign(new Error("EMFILE"), { code: "EMFILE" });
+    }
+    const descriptorWaiters = new Set();
+    let signals;
+    let activity;
+    function notifyDescriptors() { for (const resolve of [...descriptorWaiters])
+        resolve(); }
+    const children = new WaliChildProcesses((minimum = NETWORK_FD_MIN) => takeFd(minimum), (pid, status, code) => { signals?.raise(17, pid, status, code, "masked"); });
+    children.onChange(notifyDescriptors);
+    let sharedPipes;
+    let stdin;
+    let terminalStdin;
+    let stdioAliasRegistry;
+    let loopbackPort;
+    let nextLoopbackRequestId = 1;
+    let nextOutboundConnectionId = -1;
+    const loopbackAcks = new Map();
+    const listenersByPort = new Map();
+    const loopbackConnections = new Map();
+    function receive(event) {
+        if (event.data.kind === "dispose") {
+            if (disposed)
+                return;
+            disposed = true;
+            // No old dispatch may write into a buffer after this acknowledgement.
+            for (const port of channels) {
+                port.onmessage = null;
+                port.close();
+            }
+            channels.clear();
+            for (const socket of new Set([...sockets.values(), ...activeReceives.keys()]))
+                closeSocket(socket);
+            sockets.clear();
+            socketDescriptorFlags.clear();
+            epolls.clear();
+            epollDescriptorFlags.clear();
+            for (const resolve of loopbackAcks.values())
+                resolve(-9);
+            loopbackAcks.clear();
+            children.dispose();
+            notifyDescriptors();
+            if (signals)
+                Atomics.notify(signals.words, 1);
+            loopbackPort?.close();
+            reply({ kind: "disposed" });
+            return;
+        }
+        if (disposed)
+            return;
+        if (event.data.kind === "initialize") {
+            descriptorLimits = event.data.descriptorLimits ? new Uint32Array(event.data.descriptorLimits) : undefined;
+            activity = event.data.activity ? new Int32Array(event.data.activity) : undefined;
+            allowedHosts.clear();
+            for (const host of event.data.allowedHosts)
+                allowedHosts.add(host);
+            relayUrl = event.data.relayUrl;
+            maxConnections = event.data.maxConnections;
+            maxBytes = event.data.maxBytes;
+            networkBytes = 0;
+            externalConnections.clear();
+            sharedPipes = event.data.sharedPipes;
+            stdin = event.data.stdin ? new SharedWaliStdinReader(event.data.stdin) : undefined;
+            terminalStdin = event.data.terminalStdin ? new SharedWaliStdinReader(event.data.terminalStdin) : undefined;
+            stdioAliasRegistry = event.data.stdioAliasRegistry
+                ? new Int32Array(event.data.stdioAliasRegistry)
+                : undefined;
+            if (event.data.signals) {
+                signals = new WaliSignals(event.data.signals);
+                const shared = signals.words;
+                const waitAsync = Atomics.waitAsync;
+                if (!waitAsync) {
+                    reply({ kind: "error", message: "WALI signal delivery requires Atomics.waitAsync." });
+                    return;
+                }
+                void (async () => {
+                    while (!disposed) {
+                        const generation = Atomics.load(shared, 1);
+                        // wakes blocked polls and child waits, and so notifies descriptors
+                        children.wake();
+                        await waitAsync(shared, 1, generation).value;
+                    }
+                })();
+            }
+            loopbackPort = event.data.loopbackPort;
+            if (loopbackPort) {
+                loopbackPort.onmessage = (message) => {
+                    handleLoopbackMessage(message.data);
+                };
+                loopbackPort.start();
+            }
+            reply({ kind: "ready" });
+            return;
+        }
+        if (event.data.kind === "attach")
+            attach(event.data);
+    }
+    function attach(channel) {
+        channels.add(channel.port);
+        const control = new Int32Array(channel.control);
+        const payload = new Uint8Array(channel.payload);
+        const waitState = channel.waitState && new Int32Array(channel.waitState);
+        channel.port.onmessage = (event) => {
+            void dispatch(control, payload, typeof event.data === "number" ? event.data : event.data.requestId, typeof event.data === "number" ? undefined : event.data.process, waitState);
+        };
+        channel.port.start();
+    }
+    async function dispatch(control, payload, requestId, process, waitState) {
+        if (disposed || Atomics.load(control, 0) !== requestId)
+            return;
+        // Reaping and receive consumption are irreversible. Claim the request
+        // before it starts, so transport cancellation cannot lose status or bytes.
+        const claimed = [NetworkOperation.ChildWait, NetworkOperation.PollMany, NetworkOperation.EpollWait, NetworkOperation.Receive].includes(Atomics.load(control, 1));
+        if (claimed && Atomics.compareExchange(control, 0, requestId, -requestId) !== requestId)
+            return;
+        let result = -38;
+        let output = new Uint8Array();
+        let checkedActivity = activity ? Atomics.load(activity, 0) : 0;
+        const parked = (state) => {
+            if (disposed || !waitState)
+                return;
+            if (state === 0)
+                checkedActivity = activity ? Atomics.load(activity, 0) : 0;
+            Atomics.store(waitState, 1, checkedActivity);
+            Atomics.store(waitState, 0, state);
+            Atomics.notify(control, 0);
+        };
+        parked(0);
+        try {
+            const operation = Atomics.load(control, 1);
+            const inputLength = Atomics.load(control, 3);
+            const args = Array.from({ length: 10 }, (_, index) => Atomics.load(control, 5 + index));
+            const input = payload.slice(0, inputLength);
+            ({ result, output } = await operate(operation, args, input, process, parked));
+            if ([NetworkOperation.EpollControl, NetworkOperation.Send, NetworkOperation.Receive,
+                NetworkOperation.Close, NetworkOperation.Shutdown, NetworkOperation.TimerFdSetTime].includes(operation))
+                notifyDescriptors();
+        }
+        catch (error) {
+            result = error?.code === "EMFILE" ? -24 : -5;
+        }
+        if (disposed)
+            return;
+        parked(0);
+        if (output.byteLength > payload.byteLength) {
+            result = -90;
+            output = new Uint8Array();
+        }
+        // Claim this generation before touching the shared response buffers. A
+        // watchdog may have cancelled it and started a later request while operate()
+        // was pending; stale completions must never corrupt that request.
+        if (!claimed && Atomics.compareExchange(control, 0, requestId, -requestId) !== requestId)
+            return;
+        if (output.byteLength > 0)
+            payload.set(output);
+        Atomics.store(control, 2, result);
+        Atomics.store(control, 4, output.byteLength);
+        Atomics.store(control, 0, requestId + 1);
+        Atomics.notify(control, 0);
+    }
+    async function operate(operation, args, input, process, parked = () => { }) {
+        if (operation === NetworkOperation.ChildRegister)
+            return scalar(process ? children.register(args[0], process) : -22);
+        if (operation === NetworkOperation.ChildForget)
+            return scalar(children.forget(args[0]));
+        if (operation === NetworkOperation.ChildExists)
+            return scalar(children.has(args[0]) ? 1 : 0);
+        if (operation === NetworkOperation.ChildWait) {
+            const mask = signalMask(args[2] ?? 0, args[3] ?? 0);
+            return scalar(process ? await children.wait(args[0], args[1], process, () => disposed || (!!signals && (signals.pending() & ~mask) !== 0n), value => parked(value ? 1 : 0)) : -22);
+        }
+        if (operation === NetworkOperation.PidFdOpen)
+            return scalar(children.open(args[0], args[1]));
+        if (operation === NetworkOperation.PollMany)
+            return pollMany(input, args[0], signalMask(args[1], args[2]), parked);
+        if (operation === NetworkOperation.Socket)
+            return scalar(createSocket(args[0], args[1], args[2]));
+        if (operation === NetworkOperation.EpollCreate)
+            return scalar(createEpoll(args[0] ?? 0));
+        if (operation === NetworkOperation.EventFd)
+            return scalar(createEventFd(args[0], args[1]));
+        if (operation === NetworkOperation.TimerFdCreate)
+            return scalar(createTimerFd(args[0], args[1]));
+        if (operation === NetworkOperation.SocketPair)
+            return createSocketPair(args[0], args[1], args[2]);
+        if (operation === NetworkOperation.EpollControl)
+            return scalar(epollControl(args[0], args[1], args[2], input));
+        if (operation === NetworkOperation.EpollWait)
+            return epollWait(args[0], args[1], args[2], signalMask(args[3], args[4]), parked);
+        const fd = args[0];
+        if (children.owns(fd)) {
+            if (operation === NetworkOperation.Close)
+                return scalar(children.close(fd));
+            if (operation === NetworkOperation.Poll)
+                return scalar(children.poll(fd, args[1]));
+            if (operation === NetworkOperation.Fcntl) {
+                if ((args[1] === 0 || args[1] === 1030) && args[2] >= descriptorLimit())
+                    return scalar(-22);
+                return scalar(children.fcntl(fd, args[1], args[2]));
+            }
+            if (operation === NetworkOperation.Duplicate)
+                return scalar(children.fcntl(fd, 0, 0));
+            if (operation === NetworkOperation.Ioctl) {
+                if (args[1] === 0x5451 || args[1] === 0x5450)
+                    return scalar(children.fcntl(fd, 2, args[1] === 0x5451 ? 1 : 0));
+                return scalar(-25);
+            }
+            return scalar(-22);
+        }
+        if (operation === NetworkOperation.Close && epolls.has(fd)) {
+            epolls.delete(fd);
+            epollDescriptorFlags.delete(fd);
+            return scalar(0);
+        }
+        if (operation === NetworkOperation.Fcntl && epolls.has(fd)) {
+            if (args[1] === 0 || args[1] === 1030) {
+                if (args[2] >= descriptorLimit())
+                    return scalar(-22);
+                return scalar(duplicateEpoll(fd, args[2], args[1] === 1030));
+            }
+            if (args[1] === 1)
+                return scalar(epollDescriptorFlags.get(fd) ?? 0);
+            if (args[1] === 2) {
+                epollDescriptorFlags.set(fd, args[2] & 1);
+                return scalar(0);
+            }
+            return scalar(args[1] === 3 || args[1] === 4 ? 0 : -22);
+        }
+        if (operation === NetworkOperation.Ioctl && epolls.has(fd))
+            return scalar(ioctlDescriptor(fd, args[1]));
+        const socket = sockets.get(fd);
+        if (!socket)
+            return scalar(-9);
+        if (operation === NetworkOperation.Ioctl)
+            return scalar(ioctlSocket(fd, socket, args[1], args[2]));
+        if (operation === NetworkOperation.Connect)
+            return scalar(await connectSocket(socket, input));
+        if (operation === NetworkOperation.Bind)
+            return scalar(bindSocket(socket, input));
+        if (operation === NetworkOperation.Listen)
+            return scalar(await listenSocket(socket, args[1]));
+        if (operation === NetworkOperation.Accept)
+            return acceptSocket(socket, args[1]);
+        if (operation === NetworkOperation.Send) {
+            if ((args[1] & ~(0x40 | 0x4000)) !== 0)
+                return scalar(-95);
+            return scalar(sendSocket(socket, input));
+        }
+        if (operation === NetworkOperation.Receive) {
+            const response = await receiveSocketBlocking(socket, args[1], args[2] ?? 0, signalMask(args[3] ?? 0, args[4] ?? 0), parked);
+            if (response.result > 0 && (pollSocket(socket, 1) & 1) === 0)
+                rearmEpollReadable(fd);
+            return response;
+        }
+        if (operation === NetworkOperation.Poll) {
+            const result = pollSocket(socket, args[1]);
+            return scalar(result);
+        }
+        if (operation === NetworkOperation.TimerFdSetTime)
+            return setTimerFd(socket, args[1], input);
+        if (operation === NetworkOperation.Fcntl)
+            return scalar(fcntlSocket(fd, socket, args[1], args[2]));
+        if (operation === NetworkOperation.SocketName)
+            return socketName(socket, Boolean(args[1]));
+        if (operation === NetworkOperation.GetSocketOption)
+            return socketOption(socket, args[1], args[2]);
+        if (operation === NetworkOperation.SetSocketOption) {
+            // Never claim to apply an option that the relay transport cannot honor.
+            return scalar(socket.kind === "event" || socket.kind === "timer" ? -88 : -92);
+        }
+        if (operation === NetworkOperation.Duplicate)
+            return scalar(duplicateSocket(socket));
+        if (operation === NetworkOperation.Shutdown)
+            return scalar(shutdownSocket(socket, args[1]));
+        if (operation === NetworkOperation.Close) {
+            sockets.delete(fd);
+            socketDescriptorFlags.delete(fd);
+            if (!activeReceives.has(socket) && ![...sockets.values()].includes(socket))
+                closeSocket(socket);
+            return scalar(0);
+        }
+        return scalar(-38);
+    }
+    function createEpoll(flags = 0) {
+        if (flags & ~0x80000)
+            return -22;
+        const fd = takeFd();
+        epolls.set(fd, new WaliEpollSet());
+        epollDescriptorFlags.set(fd, flags & 0x80000 ? 1 : 0);
+        return fd;
+    }
+    function signalMask(low, high) { return BigInt(low >>> 0) | (BigInt(high >>> 0) << 32n); }
+    async function pollMany(input, timeout, mask = 0n, parked = () => { }) {
+        if (input.byteLength % 8 !== 0)
+            return scalar(-22);
+        const output = input.slice();
+        const view = new DataView(output.buffer);
+        const original = new DataView(input.buffer, input.byteOffset, input.byteLength);
+        const deadline = timeout < 0 ? Infinity : Date.now() + timeout;
+        for (;;) {
+            if (disposed)
+                return scalar(-9);
+            if (signals && (signals.pending() & ~mask) !== 0n)
+                return scalar(-4);
+            let count = 0;
+            let processOnly = true;
+            for (let offset = 0; offset < input.byteLength; offset += 8) {
+                const fd = view.getInt32(offset, true);
+                const events = view.getInt16(offset + 4, true);
+                const socket = sockets.get(fd);
+                const ready = fd < 0 ? 0 : children.poll(fd, events)
+                    ?? (sharedPipes ? pollWaliSharedPipeState(sharedPipes, fd, events) : undefined)
+                    ?? terminalReadiness(fd, events)
+                    ?? (socket ? pollSocket(socket, events) : undefined)
+                    ?? (fd >= NETWORK_FD_MIN && !inPrivateTreeWindow(fd) ? 0x20 : original.getInt16(offset + 6, true));
+                if (fd >= 0 && !children.owns(fd))
+                    processOnly = false;
+                view.setInt16(offset + 6, ready, true);
+                if (ready !== 0)
+                    count++;
+            }
+            if (count || timeout === 0 || Date.now() >= deadline)
+                return { result: count, output };
+            const fds = Array.from({ length: input.byteLength / 8 }, (_, index) => view.getInt32(index * 8, true));
+            parked(fds.some(outsideWake) ? 2 : 1);
+            try {
+                await waitForDescriptorChange(processOnly ? deadline - Date.now() : 2);
+            }
+            finally {
+                parked(0);
+            }
+        }
+    }
+    function waitForDescriptorChange(delay) {
+        return new Promise((resolve) => {
+            const done = () => { if (timer !== undefined)
+                clearTimeout(timer); descriptorWaiters.delete(done); resolve(); };
+            descriptorWaiters.add(done);
+            const timer = Number.isFinite(delay) ? setTimeout(done, Math.max(0, delay)) : undefined;
+        });
+    }
+    function duplicateEpoll(fd, minimum, closeOnExec = false) {
+        const registrations = epolls.get(fd);
+        if (!registrations)
+            return -9;
+        const duplicate = takeFd(minimum);
+        epolls.set(duplicate, registrations);
+        epollDescriptorFlags.set(duplicate, closeOnExec ? 1 : 0);
+        return duplicate;
+    }
+    function createEventFd(initial, flags) {
+        if (initial < 0)
+            return -22;
+        if (flags & ~0x8_0801)
+            return -22;
+        const fd = takeFd();
+        socketDescriptorFlags.set(fd, flags & 0x80000 ? 1 : 0);
+        sockets.set(fd, {
+            kind: "event",
+            counter: BigInt(initial >>> 0),
+            generation: 0,
+            semaphore: Boolean(flags & 1),
+            nonblocking: Boolean(flags & 0x800),
+        });
+        return fd;
+    }
+    function createTimerFd(clockId, flags) {
+        if (![0, 1, 7].includes(clockId) || (flags & ~0x8_0800) !== 0)
+            return -22;
+        const fd = takeFd();
+        socketDescriptorFlags.set(fd, flags & 0x80000 ? 1 : 0);
+        sockets.set(fd, {
+            kind: "timer",
+            clockId,
+            intervalNanoseconds: 0n,
+            deadlineNanoseconds: undefined,
+            expirations: 0n,
+            nonblocking: Boolean(flags & 0x800),
+        });
+        return fd;
+    }
+    function setTimerFd(socket, flags, input) {
+        if (socket.kind !== "timer")
+            return scalar(-9);
+        if ((flags & ~1) !== 0 || input.byteLength !== 32)
+            return scalar(-22);
+        const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+        const interval = readTimespec(view, 0);
+        const value = readTimespec(view, 16);
+        if (interval === undefined || value === undefined)
+            return scalar(-22);
+        updateTimer(socket);
+        const output = new Uint8Array(32);
+        const outputView = new DataView(output.buffer);
+        writeTimespec(outputView, 0, socket.intervalNanoseconds);
+        writeTimespec(outputView, 16, timerRemaining(socket));
+        socket.intervalNanoseconds = interval;
+        socket.deadlineNanoseconds = value === 0n ? undefined
+            : (flags & 1) ? value : nowNanoseconds(socket.clockId) + value;
+        socket.expirations = 0n;
+        return { result: 0, output };
+    }
+    function createSocketPair(domain, type, protocol) {
+        if (domain !== 1)
+            return scalar(-97);
+        if (type & ~0x8_080f)
+            return scalar(-22);
+        if ((type & 0xf) !== 1 || protocol !== 0)
+            return scalar(-93);
+        const left = { kind: "local", readShutdown: false, writeShutdown: false, nonblocking: Boolean(type & 0x800), chunks: [], byteLength: 0, closed: false, peerClosed: false };
+        const right = { kind: "local", readShutdown: false, writeShutdown: false, nonblocking: Boolean(type & 0x800), chunks: [], byteLength: 0, closed: false, peerClosed: false };
+        left.peer = right;
+        right.peer = left;
+        const leftFd = takeFd();
+        const rightFd = takeFd(leftFd + 1);
+        sockets.set(leftFd, left);
+        sockets.set(rightFd, right);
+        socketDescriptorFlags.set(leftFd, type & 0x80000 ? 1 : 0);
+        socketDescriptorFlags.set(rightFd, type & 0x80000 ? 1 : 0);
+        const output = new Uint8Array(8);
+        const view = new DataView(output.buffer);
+        view.setInt32(0, leftFd, true);
+        view.setInt32(4, rightFd, true);
+        return { result: 0, output };
+    }
+    function epollControl(epollFd, operation, fd, input) {
+        const sharedPipe = sharedPipes ? pollWaliSharedPipeState(sharedPipes, fd, 0) : undefined;
+        if (!sockets.has(fd) && !children.owns(fd) && sharedPipe === undefined && terminalReadiness(fd, 0) === undefined)
+            return -9;
+        const epoll = epolls.get(epollFd);
+        if (!epoll)
+            return -9;
+        const registrations = epoll.registrations;
+        if (operation === 2) {
+            const entry = registrations.get(fd);
+            if (!entry)
+                return -2;
+            epoll.evict(entry);
+            return 0;
+        }
+        if (operation !== 1 && operation !== 3 || input.byteLength < EPOLL_EVENT_BYTES)
+            return -22;
+        if (operation === 1 && registrations.has(fd))
+            return -17;
+        if (operation === 3 && !registrations.has(fd))
+            return -2;
+        const view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+        const events = view.getUint32(0, true);
+        const socket = sockets.get(fd);
+        epoll.set({
+            fd,
+            events,
+            data: input.slice(EPOLL_DATA_OFFSET, EPOLL_EVENT_BYTES),
+            lastReady: 0,
+            lastPipeGeneration: sharedPipes ? waliSharedPipeGeneration(sharedPipes, fd) ?? 0 : 0,
+            lastStdinGeneration: descriptorInput(fd)?.generation() ?? 0,
+            lastEventGeneration: socket?.kind === "event"
+                ? socket.generation
+                : 0,
+            observedReady: 0,
+        });
+        return 0;
+    }
+    async function epollWait(epollFd, maximum, timeout, mask = 0n, parked = () => { }) {
+        const epoll = epolls.get(epollFd);
+        if (!epoll)
+            return scalar(-9);
+        const registrations = epoll.registrations;
+        if (maximum <= 0 || maximum > 0x7fffffff / EPOLL_EVENT_BYTES)
+            return scalar(-22);
+        const startedAt = Date.now();
+        // This blocking RPC is claimed before dispatch, so an infinite guest wait
+        // needs no synthetic timeout to placate the request transport watchdog.
+        const deadline = timeout < 0 ? Infinity : startedAt + timeout;
+        do {
+            if (disposed)
+                return scalar(-9);
+            if (signals && (signals.pending() & ~mask) !== 0n)
+                return scalar(-4);
+            for (const [fd, registration] of registrations) {
+                const socket = sockets.get(fd);
+                const pollEvents = ((registration.events & 1) ? 1 : 0) | ((registration.events & 4) ? 4 : 0);
+                // Read the generation first so a write racing this poll is still seen
+                // on the next poll, even if readiness was already observed here.
+                const pipeGeneration = sharedPipes
+                    ? waliSharedPipeGeneration(sharedPipes, fd) ?? registration.lastPipeGeneration
+                    : registration.lastPipeGeneration;
+                const externalReady = children.poll(fd, pollEvents)
+                    ?? (sharedPipes ? pollWaliSharedPipeState(sharedPipes, fd, pollEvents) : undefined);
+                const terminalReady = terminalReadiness(fd, pollEvents);
+                if (!socket && externalReady === undefined && terminalReady === undefined) {
+                    epoll.evict(registration);
+                    continue;
+                }
+                const currentReady = (terminalReady ?? externalReady ?? pollSocket(socket, pollEvents))
+                    & (registration.events | 0x18);
+                const stdinGeneration = descriptorInput(fd)?.generation() ?? registration.lastStdinGeneration;
+                const edgeReady = (currentReady & ~registration.lastReady)
+                    | (pipeGeneration !== registration.lastPipeGeneration ? currentReady : 0)
+                    | (stdinGeneration !== registration.lastStdinGeneration ? currentReady : 0)
+                    | (socket?.kind === "event" && socket.generation !== registration.lastEventGeneration
+                        ? currentReady
+                        : 0);
+                // A browser terminal's shared byte queue behaves like a TTY, not a
+                // packet socket. Keep reporting readable until the consumer drains it;
+                // otherwise one-byte reads can strand the final key behind EPOLLET.
+                const ready = isStdinDescriptor(fd)
+                    ? currentReady
+                    : (registration.events & 0x8000_0000) !== 0 ? edgeReady : currentReady;
+                registration.lastReady = currentReady;
+                registration.lastPipeGeneration = pipeGeneration;
+                registration.lastStdinGeneration = stdinGeneration;
+                registration.lastEventGeneration = socket?.kind === "event"
+                    ? socket.generation
+                    : registration.lastEventGeneration;
+                registration.observedReady = currentReady;
+                if (ready !== 0)
+                    epoll.notify(registration);
+            }
+            const events = epoll.take(maximum, entry => entry.observedReady).map(({ entry, ready }) => ({ ready, data: entry.data }));
+            if (events.length > 0) {
+                const output = new Uint8Array(events.length * EPOLL_EVENT_BYTES);
+                const view = new DataView(output.buffer);
+                events.forEach((event, index) => {
+                    const offset = index * EPOLL_EVENT_BYTES;
+                    view.setUint32(offset, event.ready, true);
+                    output.set(event.data, offset + EPOLL_DATA_OFFSET);
+                });
+                return { result: events.length, output };
+            }
+            if (timeout === 0 || Date.now() >= deadline)
+                return { result: 0, output: new Uint8Array() };
+            // Other descriptor sources retain the existing shared-pipe/socket scan.
+            let childrenOnly = true;
+            for (const fd of registrations.keys())
+                if (!children.owns(fd)) {
+                    childrenOnly = false;
+                    break;
+                }
+            parked([...registrations.keys()].some(outsideWake) ? 2 : 1);
+            try {
+                await waitForDescriptorChange(childrenOnly ? deadline - Date.now() : 2);
+            }
+            finally {
+                parked(0);
+            }
+        } while (true);
+    }
+    function outsideWake(fd) {
+        const socket = sockets.get(fd);
+        if (socket?.kind === "tcp" || socket?.kind === "dns")
+            return true;
+        if (socket?.kind === "timer" && socket.deadlineNanoseconds !== undefined)
+            return true;
+        const input = descriptorInput(fd);
+        if (input)
+            return !input.closed;
+        return false;
+    }
+    function descriptorStream(fd) {
+        if (fd < 0 || fd >= 65_536)
+            return 0;
+        if (sharedPipes) {
+            const id = Atomics.load(new Int32Array(sharedPipes.table), fd);
+            return Atomics.load(new Int32Array(sharedPipes.descriptions), id * 3 + 2);
+        }
+        const alias = stdioAliasRegistry && fd < stdioAliasRegistry.length ? Atomics.load(stdioAliasRegistry, fd) : fd;
+        return alias >= 0 && alias <= 2 ? alias + 1 : 0;
+    }
+    function descriptorInput(fd) {
+        const stream = descriptorStream(fd);
+        return stream === 4 ? terminalStdin : stream === 1 ? stdin : undefined;
+    }
+    function isStdinDescriptor(fd) { return descriptorInput(fd) !== undefined; }
+    function terminalReadiness(fd, events) {
+        const stream = descriptorStream(fd);
+        if (!stream)
+            return;
+        if (stream === 4 && sharedPipes) {
+            const id = Atomics.load(new Int32Array(sharedPipes.table), fd);
+            const mode = Atomics.load(new Int32Array(sharedPipes.descriptions), id * 3 + 1) & 3;
+            return ((events & 1) && mode !== 1 && terminalStdin?.poll() ? 1 : 0)
+                | ((events & 4) && mode !== 0 ? 4 : 0);
+        }
+        return stream === 1 ? ((events & 1) && stdin?.poll() ? 1 : 0) : events & 4;
+    }
+    function scalar(result) {
+        return { result, output: new Uint8Array() };
+    }
+    function createSocket(domain, type, protocol) {
+        if (type & ~0x8_080f)
+            return -22;
+        const baseType = type & 0xf;
+        if (baseType !== 1 && baseType !== 2)
+            return -22;
+        let socket;
+        if ((domain === 2 || domain === 10) && baseType === 2 && (protocol === 0 || protocol === 17)) {
+            socket = { kind: "dns", domain, responses: [], nonblocking: Boolean(type & 0x800) };
+        }
+        else if ((domain === 2 || domain === 10) && baseType === 1 && (protocol === 0 || protocol === 6)) {
+            socket = {
+                kind: "tcp",
+                domain,
+                chunks: [],
+                byteLength: 0,
+                open: false,
+                connecting: false,
+                connectGeneration: 0,
+                closed: false,
+                error: 0,
+                nonblocking: Boolean(type & 0x800),
+                listening: false,
+                backlog: 0,
+                pending: [],
+                acceptWaiters: [],
+                peerClosed: false,
+            };
+        }
+        else {
+            return domain === 2 || domain === 10 ? -93 : -97;
+        }
+        const fd = takeFd();
+        sockets.set(fd, socket);
+        socketDescriptorFlags.set(fd, type & 0x80000 ? 1 : 0);
+        return fd;
+    }
+    async function connectSocket(socket, address) {
+        if (socket.kind === "dns") {
+            const target = parseSocketAddress(address);
+            if (!target)
+                return -22;
+            if (new DataView(address.buffer, address.byteOffset, address.byteLength).getUint16(0, true) !== socket.domain)
+                return -97;
+            socket.peerAddress = target;
+            return 0;
+        }
+        if (socket.kind === "event" || socket.kind === "timer")
+            return -88;
+        if (socket.kind === "local")
+            return -106;
+        const target = parseSocketAddress(address);
+        if (!target)
+            return -22;
+        if (new DataView(address.buffer, address.byteOffset, address.byteLength).getUint16(0, true) !== socket.domain)
+            return -97;
+        if (socket.connecting)
+            return -114; // EALREADY
+        if (socket.open || socket.listening)
+            return -106; // EISCONN
+        const loopback = isLoopbackConnectAddress(target.address);
+        let hostname;
+        if (loopback) {
+            if (!loopbackPort)
+                return -111;
+        }
+        else {
+            if (target.port !== 443)
+                return -111;
+            hostname = hostByAddress.get(target.address);
+            if (!hostname || !allowedHosts.has(hostname))
+                return -13;
+            if (externalConnections.size >= maxConnections)
+                return -24;
+        }
+        // SOCKFS's connecting state, with Linux EINPROGRESS instead of its
+        // optimistic success. Every callback belongs to exactly one attempt.
+        socket.connecting = true;
+        socket.closed = false;
+        socket.peerClosed = false;
+        socket.error = 0;
+        const generation = ++socket.connectGeneration;
+        const completion = new Promise((resolve) => {
+            let settled = false;
+            let timeout;
+            const current = () => !disposed && socket.connectGeneration === generation;
+            const settle = (value) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (timeout !== undefined)
+                    clearTimeout(timeout);
+                delete socket.cancelConnect;
+                if (current()) {
+                    socket.connecting = false;
+                    socket.open = value === 0;
+                    socket.closed = value < 0;
+                    socket.error = value < 0 ? -value : 0;
+                    if (value === 0)
+                        socket.peerAddress = target;
+                    else {
+                        // A timeout/error must not be undone by a later open callback.
+                        socket.connectGeneration += 1;
+                        externalConnections.delete(socket);
+                        if (socket.loopbackConnectionId !== undefined) {
+                            loopbackConnections.delete(socket.loopbackConnectionId);
+                            postLoopback({ type: "closed", connectionId: socket.loopbackConnectionId });
+                            delete socket.loopbackConnectionId;
+                        }
+                        try {
+                            socket.websocket?.close();
+                        }
+                        catch { }
+                    }
+                    notifyDescriptors();
+                }
+                resolve(value);
+            };
+            socket.cancelConnect = () => settle(-9);
+            if (loopback) {
+                const connectionId = nextOutboundConnectionId--;
+                socket.loopbackConnectionId = connectionId;
+                socket.peerClosed = false;
+                // Register before requesting: ingress data/close can accompany the ack.
+                loopbackConnections.set(connectionId, socket);
+                void requestLoopbackConnect(target.port, connectionId).then((result) => {
+                    if (!current()) {
+                        postLoopback({ type: "closed", connectionId });
+                        return;
+                    }
+                    if (result === 0)
+                        socket.bound ??= { address: socket.domain === 10 ? "::1" : "127.0.0.1", port: 0 };
+                    settle(result);
+                }, () => settle(-5));
+                return;
+            }
+            externalConnections.add(socket);
+            try {
+                const url = new URL(relayUrl, scope.location.href);
+                url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+                url.search = "";
+                url.searchParams.append("host", hostname);
+                url.searchParams.append("port", "443");
+                const websocket = new WebSocket(url);
+                socket.websocket = websocket;
+                websocket.binaryType = "arraybuffer";
+                timeout = setTimeout(() => settle(-110), 15_000);
+                websocket.addEventListener("open", () => {
+                    if (!current()) {
+                        try {
+                            websocket.close();
+                        }
+                        catch { }
+                        return;
+                    }
+                    settle(0);
+                });
+                websocket.addEventListener("message", (event) => {
+                    if (!current())
+                        return;
+                    if (!(event.data instanceof ArrayBuffer)) {
+                        socket.error = 5;
+                        notifyDescriptors();
+                        return;
+                    }
+                    const chunk = new Uint8Array(event.data);
+                    if (!consumeNetworkBytes(chunk.byteLength)) {
+                        closeSocket(socket);
+                        socket.error = 122;
+                        notifyDescriptors();
+                        return;
+                    }
+                    socket.chunks.push(chunk);
+                    socket.byteLength += chunk.byteLength;
+                    notifyDescriptors();
+                });
+                websocket.addEventListener("close", () => {
+                    if (!current())
+                        return;
+                    externalConnections.delete(socket);
+                    if (!settled)
+                        settle(-111);
+                    else {
+                        socket.closed = true;
+                        socket.open = false;
+                        notifyDescriptors();
+                    }
+                });
+                websocket.addEventListener("error", () => {
+                    if (!current())
+                        return;
+                    if (!settled)
+                        settle(-111);
+                    else {
+                        socket.error = 111;
+                        notifyDescriptors();
+                    }
+                });
+            }
+            catch {
+                settle(-5);
+            }
+        });
+        return socket.nonblocking ? -115 : completion;
+    }
+    function bindSocket(socket, address) {
+        if (socket.kind === "dns") {
+            if (socket.bound)
+                return -22;
+            const target = parseSocketAddress(address);
+            if (!target || !isLoopbackBindAddress(target.address))
+                return target ? -99 : -22;
+            socket.bound = target;
+            return 0;
+        }
+        if (socket.kind !== "tcp")
+            return -88;
+        if (socket.open || socket.connecting || socket.bound)
+            return -22;
+        const target = parseSocketAddress(address);
+        if (!target || !isLoopbackBindAddress(target.address))
+            return target ? -99 : -22;
+        const port = target.port === 0 ? allocateLoopbackPort() : target.port;
+        if (port <= 0 || listenersByPort.has(port))
+            return -98;
+        socket.bound = { address: target.address, port, ...(target.port === 0 ? { ephemeral: true } : {}) };
+        return 0;
+    }
+    async function listenSocket(socket, backlog) {
+        if (socket.kind !== "tcp")
+            return -95;
+        if (socket.connecting || (socket.open && !socket.listening))
+            return -22;
+        if (!socket.bound)
+            return -22;
+        if (socket.listening)
+            return 0;
+        if (!loopbackPort)
+            return -97;
+        const existing = listenersByPort.get(socket.bound.port);
+        if (existing && existing !== socket)
+            return -98;
+        let result = await requestLoopbackListen(socket.bound.port);
+        // This worker sees its own listeners, the project's port table every
+        // server's: a port it chose for port 0 that another server holds is
+        // passed over for the next free one, as the kernel would never have chosen it.
+        while (result === -98 && socket.bound.ephemeral) {
+            const next = allocateLoopbackPort(socket.bound.port + 1);
+            if (next <= 0)
+                break;
+            socket.bound = { ...socket.bound, port: next };
+            result = await requestLoopbackListen(next);
+        }
+        if (result < 0)
+            return result;
+        socket.listening = true;
+        socket.open = true;
+        socket.backlog = Math.max(1, Math.min(128, backlog));
+        listenersByPort.set(socket.bound.port, socket);
+        return 0;
+    }
+    async function acceptSocket(socket, flags) {
+        if (socket.kind !== "tcp" || !socket.listening)
+            return scalar(-22);
+        if ((flags & ~0x8_0800) !== 0)
+            return scalar(-22);
+        let accepted = socket.pending.shift();
+        if (!accepted && socket.nonblocking)
+            return scalar(-11);
+        if (!accepted) {
+            accepted = await new Promise((resolve) => socket.acceptWaiters.push(resolve));
+        }
+        if (!accepted)
+            return scalar(-9);
+        accepted.nonblocking = Boolean(flags & 0x800);
+        let fd;
+        try {
+            fd = takeFd();
+        }
+        catch (error) {
+            socket.pending.unshift(accepted);
+            throw error;
+        }
+        sockets.set(fd, accepted);
+        socketDescriptorFlags.set(fd, flags & 0x80000 ? 1 : 0);
+        // The ingress wire does not yet carry the remote endpoint. Do not invent it.
+        return { result: fd, output: socketAddress(accepted.domain, accepted.domain === 10 ? "::" : "0.0.0.0", 0) };
+    }
+    function requestLoopbackListen(port) {
+        if (!loopbackPort)
+            return Promise.resolve(-97);
+        const requestId = nextLoopbackRequestId++;
+        return new Promise((resolve) => {
+            const timeout = setTimeout(() => {
+                if (!loopbackAcks.delete(requestId))
+                    return;
+                resolve(-110);
+            }, 5_000);
+            loopbackAcks.set(requestId, (result) => {
+                clearTimeout(timeout);
+                resolve(result);
+            });
+            postLoopback({ type: "listen", requestId, port });
+        });
+    }
+    function requestLoopbackConnect(port, connectionId) {
+        if (!loopbackPort)
+            return Promise.resolve(-111);
+        const requestId = nextLoopbackRequestId++;
+        return new Promise((resolve) => {
+            const timeout = setTimeout(() => {
+                if (!loopbackAcks.delete(requestId))
+                    return;
+                resolve(-110);
+            }, 5_000);
+            loopbackAcks.set(requestId, (result) => {
+                clearTimeout(timeout);
+                resolve(result);
+            });
+            postLoopback({ type: "connect", requestId, connectionId, port });
+        });
+    }
+    function handleLoopbackMessage(message) {
+        if (message.type === "ack") {
+            const resolve = loopbackAcks.get(message.requestId);
+            if (!resolve)
+                return;
+            loopbackAcks.delete(message.requestId);
+            resolve(message.result);
+            return;
+        }
+        if (message.type === "peer-close") {
+            const socket = loopbackConnections.get(message.connectionId);
+            if (socket)
+                socket.peerClosed = true;
+            notifyDescriptors();
+            return;
+        }
+        if (message.type === "data") {
+            const socket = loopbackConnections.get(message.connectionId);
+            if (!socket || socket.closed)
+                return;
+            const bytes = message.bytes.slice();
+            socket.chunks.push(bytes);
+            socket.byteLength += bytes.byteLength;
+            notifyDescriptors();
+            return;
+        }
+        const listener = listenersByPort.get(message.port);
+        if (!listener || !listener.listening || listener.closed
+            || listener.pending.length >= listener.backlog) {
+            postLoopback({ type: "closed", connectionId: message.connectionId });
+            return;
+        }
+        const accepted = {
+            kind: "tcp",
+            domain: listener.domain,
+            chunks: [message.bytes.slice()],
+            byteLength: message.bytes.byteLength,
+            open: true,
+            connecting: false,
+            connectGeneration: 0,
+            closed: false,
+            error: 0,
+            nonblocking: false,
+            listening: false,
+            backlog: 0,
+            pending: [],
+            acceptWaiters: [],
+            loopbackConnectionId: message.connectionId,
+            peerClosed: false,
+            ...(listener.bound ? { bound: listener.bound } : {}),
+        };
+        loopbackConnections.set(message.connectionId, accepted);
+        const waiter = listener.acceptWaiters.shift();
+        if (waiter)
+            waiter(accepted);
+        else
+            listener.pending.push(accepted);
+        notifyDescriptors();
+    }
+    function postLoopback(message) {
+        loopbackPort?.postMessage(message);
+    }
+    function isLoopbackBindAddress(address) {
+        return address === "0.0.0.0" || address === "127.0.0.1" || address === "::" || address === "::1";
+    }
+    function isLoopbackConnectAddress(address) {
+        return address === "127.0.0.1" || address === "::1";
+    }
+    function allocateLoopbackPort(from = 49_152) {
+        for (let port = from; port <= 65_535; port += 1) {
+            if (!listenersByPort.has(port))
+                return port;
+        }
+        return -1;
+    }
+    function sendSocket(socket, input) {
+        if (socket.kind === "event") {
+            if (input.byteLength < 8)
+                return -22;
+            const increment = new DataView(input.buffer, input.byteOffset, input.byteLength).getBigUint64(0, true);
+            if (increment === 0xffffffffffffffffn)
+                return -22;
+            socket.counter += increment;
+            socket.generation = socket.generation >= 0x7fff_ffff ? 1 : socket.generation + 1;
+            return 8;
+        }
+        if (socket.kind === "local") {
+            if (socket.closed)
+                return -9;
+            if (socket.writeShutdown || !socket.peer || socket.peer.closed || socket.peer.readShutdown)
+                return -32;
+            const copy = input.slice();
+            socket.peer.chunks.push(copy);
+            socket.peer.byteLength += copy.byteLength;
+            return copy.byteLength;
+        }
+        if (socket.kind === "timer")
+            return -22;
+        if (socket.kind === "dns") {
+            const response = dnsResponse(input);
+            if (!response)
+                return -13;
+            socket.responses.push(response);
+            return input.byteLength;
+        }
+        if (socket.connecting)
+            return -11;
+        if (socket.loopbackConnectionId !== undefined) {
+            if (socket.closed || socket.peerClosed)
+                return -32;
+            postLoopback({ type: "outgoing", connectionId: socket.loopbackConnectionId, bytes: input.slice() });
+            return input.byteLength;
+        }
+        if (socket.error) {
+            const error = socket.error;
+            socket.error = 0;
+            return -error;
+        }
+        if (!socket.open || !socket.websocket)
+            return -32;
+        if (!consumeNetworkBytes(input.byteLength)) {
+            closeSocket(socket);
+            return -122;
+        }
+        try {
+            socket.websocket.send(input);
+        }
+        catch {
+            return -22;
+        }
+        return input.byteLength;
+    }
+    /** A readiness wait, not a polling loop or a transport watchdog. */
+    async function receiveSocketBlocking(socket, maximum, flags, mask, parked) {
+        if (maximum < 0)
+            return scalar(-22);
+        // Receive only supported flags; no false claim of WAITALL/ancillary/OOB.
+        if (flags & ~(2 | 0x40))
+            return scalar(-95);
+        // Linux I/O pins the open description, even if another thread closes
+        // the descriptor while the call is waiting. Close transport only at last use.
+        activeReceives.set(socket, (activeReceives.get(socket) ?? 0) + 1);
+        try {
+            for (;;) {
+                if (disposed)
+                    return scalar(-9);
+                // A stream may return fewer bytes than requested. Bound consumption to
+                // this channel's output capacity so a large read cannot lose queued bytes.
+                const response = receiveSocket(socket, Math.min(maximum, NETWORK_PAYLOAD_BYTES), flags);
+                if (response.result !== -11 || socket.nonblocking || Boolean(flags & 0x40))
+                    return response;
+                if (signals && (signals.pending() & ~mask) !== 0n)
+                    return scalar(-4);
+                let delay = Infinity;
+                if (socket.kind === "timer" && socket.deadlineNanoseconds !== undefined) {
+                    delay = Number(timerRemaining(socket)) / 1_000_000;
+                }
+                parked(socket.kind === "tcp" || socket.kind === "dns"
+                    || (socket.kind === "timer" && socket.deadlineNanoseconds !== undefined) ? 2 : 1);
+                // The owner installs the wake before yielding; events arriving while the
+                // request is being serviced cannot slip between the scan and subscription.
+                try {
+                    await waitForDescriptorChange(delay);
+                }
+                finally {
+                    parked(0);
+                }
+            }
+        }
+        finally {
+            const remaining = activeReceives.get(socket) - 1;
+            if (remaining > 0)
+                activeReceives.set(socket, remaining);
+            else {
+                activeReceives.delete(socket);
+                if (![...sockets.values()].includes(socket)) {
+                    closeSocket(socket);
+                    notifyDescriptors();
+                }
+            }
+        }
+    }
+    function receiveSocket(socket, maximum, flags = 0) {
+        if (socket.kind === "event") {
+            if (maximum < 8)
+                return { result: -22, output: new Uint8Array() };
+            if (socket.counter === 0n)
+                return { result: socket.nonblocking ? -11 : -11, output: new Uint8Array() };
+            const value = socket.semaphore ? 1n : socket.counter;
+            socket.counter -= value;
+            const output = new Uint8Array(8);
+            new DataView(output.buffer).setBigUint64(0, value, true);
+            return { result: 8, output };
+        }
+        if (socket.kind === "local") {
+            if (socket.closed)
+                return { result: -9, output: new Uint8Array() };
+            if (maximum === 0)
+                return scalar(0);
+            // Already queued bytes precede EOF, including after local SHUT_RD.
+            if (socket.byteLength === 0)
+                return { result: socket.readShutdown ? 0 : -11, output: new Uint8Array() };
+            return drainChunks(socket, maximum, Boolean(flags & 2));
+        }
+        if (socket.kind === "timer") {
+            if (maximum < 8)
+                return { result: -22, output: new Uint8Array() };
+            updateTimer(socket);
+            if (socket.expirations === 0n)
+                return { result: -11, output: new Uint8Array() };
+            const output = new Uint8Array(8);
+            new DataView(output.buffer).setBigUint64(0, socket.expirations, true);
+            socket.expirations = 0n;
+            return { result: 8, output };
+        }
+        if (socket.kind === "dns") {
+            const response = flags & 2 ? socket.responses[0] : socket.responses.shift();
+            if (!response)
+                return { result: -11, output: new Uint8Array() };
+            const output = response.subarray(0, maximum);
+            return { result: output.byteLength, output };
+        }
+        if (maximum === 0)
+            return scalar(0);
+        if (socket.listening)
+            return scalar(-107);
+        if (socket.byteLength === 0 && socket.error) {
+            const error = socket.error;
+            socket.error = 0;
+            return scalar(-error);
+        }
+        if (!socket.open && !socket.closed && !socket.peerClosed)
+            return scalar(-107);
+        if (socket.byteLength === 0)
+            return {
+                result: socket.closed || socket.peerClosed ? 0 : -11,
+                output: new Uint8Array(),
+            };
+        return drainChunks(socket, maximum, Boolean(flags & 2));
+    }
+    function drainChunks(socket, maximum, peek = false) {
+        const output = new Uint8Array(Math.min(maximum, socket.byteLength));
+        let offset = 0;
+        let index = 0;
+        while (offset < output.byteLength) {
+            const chunk = socket.chunks[peek ? index++ : 0];
+            const count = Math.min(chunk.byteLength, output.byteLength - offset);
+            output.set(chunk.subarray(0, count), offset);
+            offset += count;
+            if (!peek) {
+                socket.byteLength -= count;
+                if (count === chunk.byteLength)
+                    socket.chunks.shift();
+                else
+                    socket.chunks[0] = chunk.subarray(count);
+            }
+        }
+        return { result: output.byteLength, output };
+    }
+    function pollSocket(socket, events) {
+        if (socket.kind === "event")
+            return ((events & 1) && socket.counter > 0n ? 1 : 0) | ((events & 4) ? 4 : 0);
+        if (socket.kind === "timer") {
+            updateTimer(socket);
+            return (events & 1) && socket.expirations > 0n ? 1 : 0;
+        }
+        if (socket.kind === "local") {
+            const eof = socket.readShutdown;
+            return (socket.peerClosed || (socket.readShutdown && socket.writeShutdown) ? 0x10 : 0)
+                | (eof ? events & 0x2000 : 0) // POLLRDHUP is requested, unlike HUP.
+                | (socket.byteLength > 0 || eof ? events & (1 | 0x40) : 0)
+                // EPIPE is immediate, so a shut write half is still ready for write.
+                | (events & (4 | 0x100 | 0x200));
+        }
+        if (socket.kind === "dns")
+            return ((events & 1) && socket.responses.length ? 1 : 0) | ((events & 4) ? 4 : 0);
+        if (socket.listening)
+            return (events & 1) && socket.pending.length > 0 ? 1 : 0;
+        let ready = (socket.closed || socket.peerClosed ? 0x10 : 0) | (socket.error ? 0x8 : 0);
+        if ((events & 1) && (socket.byteLength > 0 || socket.closed || socket.peerClosed))
+            ready |= 1;
+        // Failed connection completion remains writable after SO_ERROR is consumed.
+        if ((events & 4) && !socket.connecting && ((socket.open && !socket.peerClosed) || socket.closed))
+            ready |= 4;
+        return ready;
+    }
+    function rearmEpollReadable(fd) {
+        const target = sockets.get(fd);
+        for (const epoll of epolls.values()) {
+            for (const [registeredFd, registration] of epoll.registrations) {
+                if (registeredFd === fd || (target && sockets.get(registeredFd) === target)) {
+                    registration.lastReady &= ~1;
+                }
+            }
+        }
+    }
+    // FIOCLEX/FIONCLEX mutate descriptor flags, never the shared status flags.
+    function ioctlDescriptor(fd, request) {
+        if (request !== 0x5451 && request !== 0x5450)
+            return -25;
+        const flags = epolls.has(fd) ? epollDescriptorFlags : socketDescriptorFlags;
+        flags.set(fd, request === 0x5451 ? 1 : 0);
+        return 0;
+    }
+    function ioctlSocket(fd, socket, request, value) {
+        if (request === 0x5451 || request === 0x5450)
+            return ioctlDescriptor(fd, request);
+        if (request === 0x5421) {
+            socket.nonblocking = value !== 0;
+            return 0;
+        }
+        if (socket.kind === "event" || socket.kind === "timer")
+            return -25; // FIONBIO
+        if (request !== 0x541b)
+            return -25; // FIONREAD/SIOCINQ
+        if (socket.kind === "tcp" && socket.listening)
+            return -22;
+        const length = socket.kind === "dns" ? socket.responses[0]?.byteLength ?? 0 : socket.byteLength;
+        return Math.min(length, 0x7fff_ffff);
+    }
+    function fcntlSocket(fd, socket, command, argument) {
+        if (command === 0 || command === 1030) {
+            return argument < 0 || argument >= descriptorLimit() ? -22 : duplicateSocket(socket, Math.max(argument, NETWORK_FD_MIN), command === 1030);
+        }
+        if (command === 1)
+            return socketDescriptorFlags.get(fd) ?? 0;
+        if (command === 2) {
+            socketDescriptorFlags.set(fd, argument & 1);
+            return 0;
+        }
+        if (command === 4) {
+            socket.nonblocking = Boolean(argument & 0x800);
+            return 0;
+        }
+        if (command === 3)
+            return 2 | (socket.nonblocking ? 0x800 : 0);
+        return -22;
+    }
+    function duplicateSocket(socket, minimum = NETWORK_FD_MIN, closeOnExec = false) {
+        const fd = takeFd(minimum);
+        sockets.set(fd, socket);
+        socketDescriptorFlags.set(fd, closeOnExec ? 1 : 0);
+        return fd;
+    }
+    // libsyscall.js only supports SO_ERROR. Additional read-only Linux queries
+    // below expose actual owner state, never a fabricated successful setting.
+    function socketOption(socket, level, name) {
+        if (socket.kind === "event" || socket.kind === "timer")
+            return scalar(-88);
+        if (level !== 1)
+            return scalar(-92);
+        let value;
+        switch (name) {
+            case 3:
+                value = socket.kind === "dns" ? 2 : 1;
+                break; // SO_TYPE
+            case 4: // SO_ERROR is consumed across all aliases of the description.
+                value = socket.kind === "tcp" ? socket.error : 0;
+                if (socket.kind === "tcp")
+                    socket.error = 0;
+                break;
+            case 30:
+                value = socket.kind === "tcp" && socket.listening ? 1 : 0;
+                break;
+            case 38:
+                value = socket.kind === "tcp" ? 6 : socket.kind === "dns" ? 17 : 0;
+                break;
+            case 39:
+                value = socket.kind === "local" ? 1 : socket.domain;
+                break;
+            default: return scalar(-92);
+        }
+        const output = new Uint8Array(4);
+        new DataView(output.buffer).setInt32(0, value, true);
+        return { result: 0, output };
+    }
+    /** shutdown changes the shared description; it never removes an fd alias. */
+    function shutdownSocket(socket, how) {
+        if (socket.kind === "event" || socket.kind === "timer")
+            return -88;
+        if (how < 0 || how > 2 || !Number.isInteger(how))
+            return -22;
+        if (socket.kind === "dns")
+            return socket.peerAddress ? -95 : -107;
+        if (socket.kind === "local") {
+            if (!socket.peer)
+                return -107;
+            if (how === 0 || how === 2) {
+                socket.readShutdown = true;
+                socket.peer.writeShutdown = true;
+            }
+            if (how === 1 || how === 2) {
+                socket.writeShutdown = true;
+                socket.peer.readShutdown = true;
+            }
+            if (socket.readShutdown && socket.writeShutdown)
+                socket.peer.peerClosed = true;
+            return 0;
+        }
+        if (socket.listening || socket.connecting || (!socket.open && !socket.peerAddress && socket.loopbackConnectionId === undefined))
+            return -107;
+        // The relay/loopback protocol carries full close, not independent FIN.
+        // Do not silently destroy the other half while claiming SHUT_RD/SHUT_WR.
+        if (how !== 2)
+            return -95;
+        closeSocket(socket);
+        return 0;
+    }
+    function closeSocket(socket) {
+        if (socket.kind === "tcp") {
+            socket.cancelConnect?.();
+            socket.connectGeneration += 1;
+            socket.connecting = false;
+            externalConnections.delete(socket);
+            if (socket.listening && socket.bound) {
+                listenersByPort.delete(socket.bound.port);
+                postLoopback({ type: "unlisten", port: socket.bound.port });
+                for (const resolve of socket.acceptWaiters.splice(0))
+                    resolve(undefined);
+                for (const accepted of socket.pending.splice(0))
+                    closeSocket(accepted);
+            }
+            if (socket.loopbackConnectionId !== undefined) {
+                loopbackConnections.delete(socket.loopbackConnectionId);
+                postLoopback({ type: "closed", connectionId: socket.loopbackConnectionId });
+            }
+            socket.closed = true;
+            socket.open = false;
+            try {
+                socket.websocket?.close();
+            }
+            catch { }
+        }
+        if (socket.kind === "local") {
+            socket.closed = true;
+            socket.readShutdown = true;
+            socket.writeShutdown = true;
+            if (socket.peer) {
+                socket.peer.peerClosed = true;
+                socket.peer.readShutdown = true;
+                socket.peer.writeShutdown = true;
+            }
+        }
+    }
+    function consumeNetworkBytes(bytes) {
+        if (bytes < 0 || networkBytes > maxBytes - bytes)
+            return false;
+        networkBytes += bytes;
+        return true;
+    }
+    function socketName(socket, peer) {
+        if (socket.kind === "event" || socket.kind === "timer")
+            return scalar(-88);
+        if (socket.kind === "local") {
+            const output = new Uint8Array(2);
+            new DataView(output.buffer).setUint16(0, 1, true);
+            return { result: 0, output };
+        }
+        const endpoint = peer ? socket.peerAddress : socket.bound;
+        if (peer && !endpoint) {
+            // A connected ingress socket has a peer, but the ingress wire supplies no
+            // endpoint. Name that transport gap instead of reporting it unconnected.
+            return scalar(socket.kind === "tcp" && socket.open && !socket.listening ? -95 : -107);
+        }
+        return { result: 0, output: socketAddress(socket.domain, endpoint?.address ?? (socket.domain === 10 ? "::" : "0.0.0.0"), endpoint?.port ?? 0) };
+    }
+    function socketAddress(domain, address, port) {
+        const output = new Uint8Array(domain === 10 ? 28 : 16);
+        const view = new DataView(output.buffer);
+        view.setUint16(0, domain, true);
+        view.setUint16(2, port, false);
+        if (domain === 2) {
+            output.set(address.split(".").map(Number), 4);
+        }
+        else {
+            const [left, right] = address.split("::");
+            const head = left ? left.split(":") : [];
+            const tail = right ? right.split(":") : [];
+            const groups = right === undefined ? head : [...head, ...Array(8 - head.length - tail.length).fill("0"), ...tail];
+            for (let index = 0; index < 8; index++)
+                view.setUint16(8 + index * 2, parseInt(groups[index] ?? "0", 16), false);
+        }
+        return output;
+    }
+    function updateTimer(timer) {
+        if (timer.deadlineNanoseconds === undefined)
+            return;
+        const now = nowNanoseconds(timer.clockId);
+        if (now < timer.deadlineNanoseconds)
+            return;
+        const elapsed = now - timer.deadlineNanoseconds;
+        const count = timer.intervalNanoseconds === 0n ? 1n : 1n + elapsed / timer.intervalNanoseconds;
+        const next = timer.expirations + count;
+        timer.expirations = next > 0xffffffffffffffffn ? 0xffffffffffffffffn : next;
+        timer.deadlineNanoseconds = timer.intervalNanoseconds === 0n
+            ? undefined : timer.deadlineNanoseconds + count * timer.intervalNanoseconds;
+    }
+    function timerRemaining(timer) {
+        if (timer.deadlineNanoseconds === undefined)
+            return 0n;
+        const remaining = timer.deadlineNanoseconds - nowNanoseconds(timer.clockId);
+        return remaining > 0n ? remaining : 0n;
+    }
+    function readTimespec(view, offset) {
+        const seconds = view.getBigInt64(offset, true);
+        const nanoseconds = view.getBigInt64(offset + 8, true);
+        if (seconds < 0n || nanoseconds < 0n || nanoseconds >= 1000000000n)
+            return;
+        return seconds * 1000000000n + nanoseconds;
+    }
+    function writeTimespec(view, offset, nanoseconds) {
+        view.setBigInt64(offset, nanoseconds / 1000000000n, true);
+        view.setBigInt64(offset + 8, nanoseconds % 1000000000n, true);
+    }
+    function nowNanoseconds(clockId) {
+        const milliseconds = clockId === 0 ? performance.timeOrigin + performance.now() : monotonicMilliseconds();
+        return BigInt(Math.floor(milliseconds * 1_000_000));
+    }
+    function dnsResponse(query) {
+        if (query.byteLength < 17)
+            return;
+        let offset = 12;
+        const labels = [];
+        while (offset < query.byteLength) {
+            const length = query[offset++];
+            if (length === 0)
+                break;
+            if (length > 63 || offset + length > query.byteLength)
+                return;
+            labels.push(new TextDecoder().decode(query.subarray(offset, offset + length)));
+            offset += length;
+        }
+        if (offset + 4 > query.byteLength)
+            return;
+        const hostname = labels.join(".").toLowerCase();
+        const qtype = (query[offset] << 8) | query[offset + 1];
+        const questionEnd = offset + 4;
+        const allowed = allowedHosts.has(hostname) && (qtype === 1 || qtype === 28);
+        const answerLength = allowed ? (qtype === 1 ? 16 : 28) : 0;
+        const response = new Uint8Array(questionEnd + answerLength);
+        response.set(query.subarray(0, questionEnd));
+        response[2] = 0x81;
+        response[3] = allowed ? 0x80 : 0x83;
+        response[6] = 0;
+        response[7] = allowed ? 1 : 0;
+        response.fill(0, 8, 12);
+        if (!allowed)
+            return response;
+        const identifier = addressId(hostname);
+        let answer = questionEnd;
+        response[answer++] = 0xc0;
+        response[answer++] = 0x0c;
+        response[answer++] = 0;
+        response[answer++] = qtype;
+        response[answer++] = 0;
+        response[answer++] = 1;
+        response[answer++] = 0;
+        response[answer++] = 0;
+        response[answer++] = 0;
+        response[answer++] = 60;
+        response[answer++] = 0;
+        response[answer++] = qtype === 1 ? 4 : 16;
+        if (qtype === 1) {
+            const address = `203.0.113.${identifier}`;
+            hostByAddress.set(address, hostname);
+            response.set([203, 0, 113, identifier], answer);
+        }
+        else {
+            const address = `2001:db8::${identifier.toString(16)}`;
+            hostByAddress.set(address, hostname);
+            response.set([0x20, 0x01, 0x0d, 0xb8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, identifier], answer);
+        }
+        return response;
+    }
+    function addressId(hostname) {
+        const current = addressIdByHost.get(hostname);
+        if (current)
+            return current;
+        const next = addressIdByHost.size + 1;
+        if (next > 254)
+            throw new Error("Too many WALI DNS targets.");
+        addressIdByHost.set(hostname, next);
+        return next;
+    }
+    function parseSocketAddress(value) {
+        if (value.byteLength < 8)
+            return;
+        const view = new DataView(value.buffer, value.byteOffset, value.byteLength);
+        const family = view.getUint16(0, true);
+        const port = view.getUint16(2, false);
+        if (family === 2 && value.byteLength >= 16) {
+            return { address: [...value.subarray(4, 8)].join("."), port };
+        }
+        if (family === 10 && value.byteLength >= 28) {
+            const groups = [];
+            for (let offset = 8; offset < 24; offset += 2)
+                groups.push(view.getUint16(offset, false).toString(16));
+            return { address: compressIpv6(groups), port };
+        }
+        return;
+    }
+    function compressIpv6(groups) {
+        let bestStart = -1;
+        let bestLength = 0;
+        for (let start = 0; start < groups.length;) {
+            if (groups[start] !== "0") {
+                start += 1;
+                continue;
+            }
+            let end = start;
+            while (groups[end] === "0")
+                end += 1;
+            if (end - start > bestLength) {
+                bestStart = start;
+                bestLength = end - start;
+            }
+            start = end;
+        }
+        if (bestLength < 2)
+            return groups.join(":");
+        const before = groups.slice(0, bestStart).join(":");
+        const after = groups.slice(bestStart + bestLength).join(":");
+        return `${before}::${after}`;
+    }
+    return { receive };
+}
+//# sourceMappingURL=network-host.js.map