beam.com 0.1.0-rc.2 → 0.1.0-rc.4

package/runtime/cloudflare/worker.js

@@ -144,7 +144,7 @@ const ofRelease = (release, buffer) => (release.buffers ? release.buffers.has(bu
 // The memory and the open files of a VM whose threads all returned
 // (erts_wasm_hibernate), as snapshot.bin. The files that the boot wrote
 // are the ones that are not views of release.bin (unpack: canOwn).
-function capture(m, release, listeners, bootPoint = false, skip = () => false) {
+function capture(m, release, listeners, bootPoint = false, skip = () => false, flags = '') {
   const PAGE = 65536;
   const heap = m.HEAPU8;
   const words = new BigUint64Array(heap.buffer, 0, heap.length / 8);
@@ -187,6 +187,9 @@ function capture(m, release, listeners, bootPoint = false, skip = () => false) {
     // The release of this memory (snapshot_key of .release.json): a VM of
     // another release does not restore it.
     release: releaseMeta(release).snapshot_key ?? null,
+    // The flags of the emulator of this memory (BEAM_ERL_FLAGS): a VM with
+    // other flags does not restore it (-Mea min changes the allocators).
+    flags,
     nifs: libs && { count: libs.count, libs: libs.libs.map(({ data, ...l }) => l) },
   }));
   const out = new Uint8Array(12 + head.length + (pages.length + libPages) * PAGE);
@@ -219,18 +222,69 @@ async function loadSnapshot(env) {
 
 // The header of a snapshot, without its pages: boot_point, release, ...
 export function snapshotHeader(bytes) {
-  const { pagesData, ...head } = parseSnapshot(bytes);
+  const { pagesData, packed, ...head } = parseSnapshot(bytes);
   return head;
 }
 
-function parseSnapshot(bytes) {
+// A snapshot is "BEAMSNP1" (the pages as they are) or "BEAMSNZ1" (the
+// pages in gzip, packSnapshot): the same header, which the host reads
+// with no inflate. The pages of BEAMSNZ1 are in packed, and inflate()
+// gives pagesData.
+export function parseSnapshot(bytes) {
   const b = new Uint8Array(bytes);
-  if (new TextDecoder().decode(b.subarray(0, 8)) !== 'BEAMSNP1') throw new Error('snapshot.bin: not a snapshot');
+  const magic = new TextDecoder().decode(b.subarray(0, 8));
+  if (magic !== 'BEAMSNP1' && magic !== 'BEAMSNZ1') throw new Error('snapshot.bin: not a snapshot');
   const len = new DataView(b.buffer, b.byteOffset).getUint32(8);
   const head = JSON.parse(new TextDecoder().decode(b.subarray(12, 12 + len)));
-  return { ...head, pagesData: b.subarray(12 + len) };
+  return magic === 'BEAMSNP1' ? { ...head, pagesData: b.subarray(12 + len) }
+    : { ...head, pagesData: null, packed: b.subarray(12 + len) };
 }
 
+// The bytes of the pages of a snapshot (the pages of the VM, then the
+// pages of the NIF libraries).
+const pagesSize = (head) => 65536 * (head.pages.length + (head.nifs?.libs ?? []).reduce((n, l) => n + l.pages.length, 0));
+
+// A snapshot of BEAMSNP1 as BEAMSNZ1: the pages in gzip. A snapshot of
+// the build is a module of the Worker, and the module stays in the memory
+// of the isolate: the pages of a Phoenix app are about 21 MB, and 5 MB in
+// gzip.
+export async function packSnapshot(bytes) {
+  const b = new Uint8Array(bytes);
+  if (new TextDecoder().decode(b.subarray(0, 8)) !== 'BEAMSNP1') return b;
+  const len = new DataView(b.buffer, b.byteOffset).getUint32(8);
+  const gz = new Uint8Array(await new Response(new Blob([b.subarray(12 + len)]).stream()
+    .pipeThrough(new CompressionStream('gzip'))).arrayBuffer());
+  const out = new Uint8Array(12 + len + gz.length);
+  out.set(new TextEncoder().encode('BEAMSNZ1'));
+  out.set(b.subarray(8, 12 + len), 8);
+  out.set(gz, 12 + len);
+  return out;
+}
+
+// The pages of a parsed snapshot (pagesData), with no copy of the whole
+// gzip output: the header gives their size.
+export async function inflateSnapshot(snap) {
+  if (!snap.packed) return snap;
+  const size = pagesSize(snap);
+  const out = new Uint8Array(size);
+  const reader = new Blob([snap.packed]).stream().pipeThrough(new DecompressionStream('gzip')).getReader();
+  let at = 0;
+  for (;;) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    if (at + value.length > size) throw new Error('snapshot: more pages than its header gives');
+    out.set(value, at);
+    at += value.length;
+  }
+  if (at !== size) throw new Error('snapshot: fewer pages than its header gives');
+  snap.pagesData = out;
+  snap.packed = null;
+  return snap;
+}
+
+// BEAM_ERL_FLAGS as one text, with one space between the flags.
+export const erlFlags = (env) => (env.BEAM_ERL_FLAGS ?? '').split(/\s+/).filter(Boolean).join(' ');
+
 // BEAM_CONNECT: the hosts that the VM can connect to, separated by commas:
 // "host", "host:port", "*.domain" (the subdomains of domain), or "*" (all
 // hosts, as "*:443"). The host resolves a name, so the VM cannot reach
@@ -383,7 +437,7 @@ function seed(m) {
 // most).
 const CHUNK = 1 << 20;
 
-class Persist {
+export class Persist {
   constructor(sql, dirs) {
     this.sql = sql;
     this.dirs = dirs.map((d) => d.replace(/\/+$/, '')).filter((d) => d.startsWith('/') && d.length > 1);
@@ -429,6 +483,14 @@ class Persist {
     }
   }
 
+  // Each file that the VM wrote after the last save. The timer of a write
+  // calls it, and also the stop of the VM, so a stop loses no write.
+  saveDirty() {
+    clearTimeout(this.flush);
+    this.flush = null;
+    for (const p of [...this.dirty]) this.save(this.fs, p);
+  }
+
   // A file or a directory, and all under it.
   remove(path) {
     for (const t of ['beam_fs', 'beam_fs_chunk']) {
@@ -448,6 +510,7 @@ class Persist {
   // Wrap the functions of FS that change files (the system calls of the
   // VM call them).
   attach(FS) {
+    this.fs = FS;
     const abs = (p) => (typeof p === 'string' && !p.startsWith('/') ? `${FS.cwd()}/${p}` : p);
     const wrap = (name, after) => {
       const f = FS[name];
@@ -460,10 +523,7 @@ class Persist {
     wrap('write', (stream) => {
       if (!this.under(stream.path)) return;
       this.dirty.add(stream.path);
-      this.flush ??= setTimeout(() => {
-        this.flush = null;
-        for (const p of [...this.dirty]) this.save(FS, p);
-      }, 1000);
+      this.flush ??= setTimeout(() => this.saveDirty(), 1000);
     });
     wrap('close', (stream) => {
       if (this.under(stream.path) && ((stream.flags & 3) !== 0 || this.dirty.has(stream.path))) this.save(FS, stream.path);
@@ -538,6 +598,8 @@ export default {
     if (!vm) {
       const v = vm = new Vm(env, { host: new URL(request.url).hostname });
       v.ready.catch(() => { if (vm === v) vm = undefined; });
+      // A VM that stopped: the next request starts a new one.
+      v.onDead = () => { if (vm === v) vm = undefined; };
     }
     return vm.fetch(request, ctx);
   },
@@ -1085,6 +1147,22 @@ export class Vm {
     this.nextTimer = 1;
     this.env = env;
     this.waitListen = new Map();  // port -> the resolve functions of listening()
+    // BEAM_YIELD_REDS (1000000, about 50 ms of work; "0": none): the
+    // reductions between the timers of the turns (see turn).
+    this.turns = 0;
+    this.turnEvery = Math.ceil(limit(env.BEAM_YIELD_REDS, 1000000) / 20000);
+    this.conns = new Set();    // the open connections of bridge() (see die)
+    this.sockets = 0;          // the open WebSockets: bridge() and /.tcp/PORT
+    this.peak = 0;             // the memory (MB) of the last log of the peak
+    // The VM stopped (erlang:halt, or a trap such as an allocation that
+    // failed): dead is the reason, and died resolves. onDead: the owner of
+    // the VM drops it, so that a new VM takes the next request.
+    this.dead = null;
+    this.died = new Promise((resolve) => { this.markDead = resolve; });
+    // The waits that the stop of the VM ends (stopWait): a race with
+    // this.died itself keeps one reaction for each race until the VM stops.
+    this.stopWaits = new Set();
+    this.onDead = null;
     // The static files of the release (appFiles of app-com.js), when the
     // release is loaded: a request for one of them needs no VM.
     this.statics = new Promise((resolve) => { this.gotStatics = resolve; });
@@ -1139,6 +1217,13 @@ export class Vm {
       console.log('beam: the snapshot of the build is for another release: a boot in its place');
       built = null;
     }
+    // A snapshot of the build with other flags of the emulator: a boot in
+    // its place (npx beam.com --snapshot --env BEAM_ERL_FLAGS=...). A
+    // snapshot with no flags in its header was made with none.
+    if (built && (built.flags ?? '') !== erlFlags(env)) {
+      console.log(`beam: the snapshot of the build has the flags "${built.flags ?? ''}", and BEAM_ERL_FLAGS is "${erlFlags(env)}": a boot in its place`);
+      built = null;
+    }
     // A Durable Object with Ecto SQLite (sql of .release.json): the
     // snapshot is made at the boot point (wasm_host_server), before the
     // program starts and runs its migrations. So all the objects (the
@@ -1159,6 +1244,7 @@ export class Vm {
     }
     const fromFallback = !snap && !!fallback;
     if (fromFallback) snap = fallback;
+    if (snap) await inflateSnapshot(snap);
     let snapBytes = snap ? snap.pagesData : null;
     const nifs = await nifModules();
     // restored: this VM comes from a snapshot (the page shows it).
@@ -1171,7 +1257,7 @@ export class Vm {
     const t1 = Date.now();
     return new Promise((resolve, reject) => {
       const snapKB = snapBytes ? snapBytes.byteLength >> 10 : 0;
-      this.onready = () => { console.log(`beam: ready in ${Date.now() - t0} ms (release ${release.byteLength >> 10} KB${snap ? `, snapshot ${snapKB} KB` : ''} in ${t1 - t0} ms), ${this.memory()}`); resolve(); };
+      this.onready = () => { this.peak = this.megabytes(); console.log(`beam: ready in ${Date.now() - t0} ms (release ${release.byteLength >> 10} KB${snap ? `, snapshot ${snapKB} KB` : ''} in ${t1 - t0} ms), ${this.memory()}`); resolve(); };
       createBeam({
         noInitialRun: !!snap,
         onRuntimeInitialized: snap ? () => {
@@ -1199,6 +1285,7 @@ export class Vm {
         } : undefined,
         // The boot arguments are set in preRun, after the release is unpacked.
         arguments: [],
+        jspiTurn: (f) => this.turn(f),
         // A plain Worker runs the jobs and timers of the threads in its
         // open requests. After adopt() (a Durable Object), they run on a
         // MessageChannel and on setTimeout.
@@ -1278,15 +1365,20 @@ export class Vm {
           m.beamHost.onsend = (bytes) => this.onsend(bytes);
           if (this.hostFiles) m.beamHost.files = this.hostFiles;
         }],
-        print: (s) => console.log(s),
-        printErr: (s) => console.log(s),
+        print: (s) => this.log(s),
+        printErr: (s) => this.log(s),
         nifModule: (file) => nifModule(nifs, file),
         // Workers compile no WebAssembly at run time: use the imported module.
         instantiateWasm: (imports, done) => {
           WebAssembly.instantiate(wasm, imports).then((instance) => { this.exports = instance.exports; done(instance); });
           return {};
         },
-        onExit: (code) => reject(new Error(`beam exited with status ${code}`)),
+        // In a plain Worker, the thread that stopped can run in the context
+        // of a request that ended: die runs in an open request (run).
+        onExit: (code) => {
+          reject(new Error(`beam exited with status ${code}`));
+          this.run(() => this.die(`exit status ${code}`));
+        },
       }).catch(reject);
     });
   }
@@ -1368,7 +1460,7 @@ export class Vm {
       for (let i = 0; i < 5; i++) await tick();
     }
     try {
-      return capture(this.beam, this.release, this.listeners, bootPoint, (p) => !!this.persist?.under(p));
+      return capture(this.beam, this.release, this.listeners, bootPoint, (p) => !!this.persist?.under(p), erlFlags(this.env));
     } finally {
       x.erts_wasm_resume();
     }
@@ -1446,11 +1538,119 @@ export class Vm {
     }
   }
 
+  // A turn for a scheduler that computes (jspi_host_turn of jspi_lib.js,
+  // each 20000 reductions with no wait), so that the I/O of the host (new
+  // requests, sockets) runs while a process computes:
+  // - Deno: setImmediate, which runs after the poll of the I/O, and costs
+  //   little;
+  // - a Durable Object (and a web page): one turn for each BEAM_YIELD_REDS
+  //   reductions waits for a timer (about 1 ms or more); the other turns
+  //   are tasks;
+  // - a plain Worker: only tasks. A timer there resumes the thread in the
+  //   request that fired it, and that request can end before the work.
+  turn(f) {
+    if (this.plain) {
+      this.jobs.push(f);
+      return void this.handlers.at(-1)?.wake?.();
+    }
+    if (typeof Deno == 'object') return void setImmediate(f);
+    if (this.turnEvery && ++this.turns % this.turnEvery === 0) return void setTimeout(f, 0);
+    this.post(f);
+  }
+
+  // The linear memory of the VM in MB. It never shrinks, so it is also its
+  // peak.
+  megabytes() {
+    return this.beam ? this.beam.HEAPU8.length >> 20 : 0;
+  }
+
   memory() {
-    return `memory ${this.beam.HEAPU8.length >> 20} MB`;
+    return `memory ${this.megabytes()} MB`;
+  }
+
+  // A log line each time the memory of the VM grew by 8 MB or more since
+  // the last one (a Worker has 128 MB for all of the isolate).
+  notePeak() {
+    const mb = this.megabytes();
+    if (mb < this.peak + 8) return;
+    this.peak = mb;
+    this.log(`beam: memory ${mb} MB (a new peak of this VM)`);
+  }
+
+  // The VM stopped: each open request gets 503, each WebSocket closes with
+  // 1011, and the owner drops the VM (onDead). The threads of the VM do not
+  // run again, so without this the open requests and all later ones wait
+  // for an answer that does not come.
+  die(reason) {
+    if (this.dead) return;
+    this.dead = reason;
+    try { this.persist?.saveDirty(); } catch (e) { this.log(`beam: persist: the save at the stop failed (${e.message})`); }
+    const open = [...this.conns].filter((c) => !c.status).length;
+    this.log(`beam: the VM stopped (${reason}), ${this.memory()}: ${open} open requests get 503`);
+    // Each connection in its own request (run): in a plain Worker, its
+    // response, its socket and its timer belong to that request.
+    for (const c of this.conns) {
+      this.bridgeRoom(c);
+      const status = c.status;
+      if (!status) c.status = 503;
+      if (c.ws) this.socketGone(c);
+      this.run(() => {
+        clearTimeout(c.timer);
+        if (!status) {
+          c.resolve(this.stopped());
+          c.finished();
+        } else if (c.ws) {
+          try { c.ws.close(1011, 'the app stopped'); } catch {}
+        } else if (!c.done) {
+          c.done = true;
+          c.writer?.abort(new Error('the app stopped')).catch(() => {});
+        }
+        this.bridgeRelease(c);
+      }, c.h);
+    }
+    this.conns.clear();
+    // The other sockets: /.tcp/PORT, and the connections of the VM.
+    for (const [id, t] of this.tcps) {
+      if (!id.startsWith('b')) this.run(() => { try { t.close(); } catch {} }, t.h);
+    }
+    this.tcps.clear();
+    // The fetch() calls of the VM: no one reads their bodies now.
+    for (const ac of this.fetches?.values() ?? []) ac.abort();
+    this.markDead();
+    for (const resolve of this.stopWaits ?? []) resolve();
+    this.stopWaits?.clear();
+    this.onDead?.(reason);
+  }
+
+  // A log line. In a plain Worker, a thread of the VM can run in the
+  // context of a request that ended, where console.log throws: then an open
+  // request writes the line (run).
+  log(text) {
+    try { console.log(text); } catch { this.run(() => console.log(text)); }
+  }
+
+  // The answer of a VM that stopped. The owner starts a new VM for the
+  // next request.
+  stopped() {
+    return new Response('The app stopped. Try again.\n',
+      { status: 503, headers: { 'content-type': 'text/plain', 'retry-after': '1' } });
+  }
+
+  // The answer above a limit of the host (BEAM_MAX_REQUESTS,
+  // BEAM_MAX_WEBSOCKETS): before the VM gets the request or its body.
+  busy(what) {
+    console.log(`beam: too many ${what}: 503`);
+    return new Response(`The app has too many ${what}. Try again.\n`,
+      { status: 503, headers: { 'content-type': 'text/plain', 'retry-after': '1' } });
+  }
+
+  // A WebSocket of the VM closed (once for each one).
+  socketGone(c) {
+    if (c.counted) { c.counted = false; this.sockets--; }
   }
 
   event(header, body) {
+    if (this.dead) return;
     const h = new TextEncoder().encode(JSON.stringify(header) + '\n');
     if (!body || !body.byteLength) return this.beam.beamHost.push(h);
     const b = new Uint8Array(h.length + body.byteLength);
@@ -1479,6 +1679,10 @@ export class Vm {
       finished();
       return file;
     }
+    if (this.dead) {
+      finished();
+      return this.stopped();
+    }
     await this.ready;
     if (this.resume) {
       const f = this.resume;
@@ -1488,7 +1692,13 @@ export class Vm {
     // The first request makes the snapshot, and the other requests wait for
     // it, so that the snapshot has the state of no request.
     if (this.makeKey) this.snapping = this.makeSnapshot().finally(() => { this.snapping = null; });
-    if (this.snapping) await this.snapping;
+    // A snapshot that takes too long does not hold the request: the VM
+    // goes on, and the snapshot ends later or fails.
+    if (this.snapping) await this.stopWait(this.snapping, SNAPSHOT_WAIT);
+    if (this.dead) {
+      finished();
+      return this.stopped();
+    }
     const url = new URL(request.url);
     const upgrade = request.headers.get('upgrade')?.toLowerCase() === 'websocket';
     const tcp = upgrade && url.pathname.match(/^\/\.tcp\/(\d+)$/);
@@ -1608,6 +1818,37 @@ export class Vm {
     return new Promise((r) => this.waitListen.set(port, [...(this.waitListen.get(port) ?? []), r]));
   }
 
+  // The first of promise, the stop of the VM, and ms milliseconds (LATE).
+  // The wait leaves nothing behind when it ends.
+  async stopWait(promise, ms = 0) {
+    if (this.dead) return;
+    let resolve, timer;
+    const stop = new Promise((r) => { resolve = r; });
+    (this.stopWaits ??= new Set()).add(resolve);
+    if (ms) timer = setTimeout(() => resolve(LATE), ms);
+    try {
+      return await Promise.race([promise, stop]);
+    } finally {
+      clearTimeout(timer);
+      this.stopWaits.delete(resolve);
+    }
+  }
+
+  // The wait of a request for the listener of port, or null when it
+  // listens. cancel() removes the wait of a request that ends first.
+  listenWait(port) {
+    if (this.listeners.has(port)) return null;
+    let resolve;
+    const promise = new Promise((r) => { resolve = r; });
+    this.waitListen.set(port, [...(this.waitListen.get(port) ?? []), resolve]);
+    const cancel = () => {
+      const rest = (this.waitListen.get(port) ?? []).filter((r) => r !== resolve);
+      if (rest.length) this.waitListen.set(port, rest);
+      else this.waitListen.delete(port);
+    };
+    return { promise, cancel };
+  }
+
   // The Origin that the app gets. Phoenix compares the Origin of a
   // WebSocket with the host of its config (PHX_HOST), so a page of the app on
   // another name of the Worker (wrangler dev, a custom domain, a preview URL,
@@ -1623,9 +1864,53 @@ export class Vm {
 
   // The request as a TCP connection to the HTTP server of the
   // app on PORT. Bandit does the HTTP; here only the bytes are framed.
+  // The limits of the host (vars, 0 for no limit):
+  // - BEAM_MAX_REQUESTS: the requests that wait for the app at one time
+  //   (no limit by default); one more gets 503 before the VM reads it;
+  // - BEAM_MAX_WEBSOCKETS: the open WebSockets (no limit by default);
+  // - BEAM_REQUEST_TIMEOUT: the seconds until the head of the response
+  //   (60 by default), after the end of the request body; then the request
+  //   gets 504, and the app gets the end of the connection;
+  // - BEAM_MAX_BODY: the bytes of a request body (no limit by default);
+  //   a larger one gets 413.
+  // The body goes to the app in the chunks of the client (bridgeUpload).
   async bridge(request, url, upgrade, h, finished) {
+    const maxSockets = limit(this.env.BEAM_MAX_WEBSOCKETS, 0);
+    if (upgrade && maxSockets && this.sockets >= maxSockets) {
+      finished();
+      return this.busy('WebSockets');
+    }
+    const maxRequests = limit(this.env.BEAM_MAX_REQUESTS, 0);
+    if (!upgrade && maxRequests && [...this.conns].filter((c) => !c.ws).length >= maxRequests) {
+      finished();
+      return this.busy('requests');
+    }
+    const body = request.method === 'GET' || request.method === 'HEAD' || upgrade ? null : request.body;
+    const declared = request.headers.get('content-length');
+    const maxBody = limit(this.env.BEAM_MAX_BODY, 0);
+    if (body && maxBody && declared !== null && Number(declared) > maxBody) {
+      finished();
+      return this.tooLarge(maxBody);
+    }
     const port = Number(this.env.PORT ?? 4000);
-    await this.listening(port);
+    // The time limit counts from here: the app can also fail to listen.
+    const timeout = limit(this.env.BEAM_REQUEST_TIMEOUT, 60);
+    const deadline = Date.now() + timeout * 1000;
+    // Only a request that comes before the app listens waits here.
+    const listen = this.listenWait(port);
+    let waited;
+    if (listen) {
+      waited = await this.stopWait(listen.promise, timeout * 1000);
+      listen.cancel();
+    }
+    if (this.dead) {
+      finished();
+      return this.stopped();
+    }
+    if (waited === LATE) {
+      finished();
+      return this.late(`the app did not listen on port ${port}`, timeout);
+    }
     const id = `b${this.nextId++}`;
     const headers = new Headers(request.headers);
     headers.set('host', url.host);
@@ -1638,6 +1923,8 @@ export class Vm {
     if (origin) headers.set('origin', origin);
     headers.delete('transfer-encoding');
     headers.delete('sec-websocket-extensions');  // no compression: frames as they are
+    // The host has the whole request: no "100 Continue" from the app.
+    headers.delete('expect');
     // The Workers runtime compresses the response for each client. The app
     // gets only gzip of Accept-Encoding: Plug.Static serves the files that
     // are gzipped already (Livebook has no other ones), and the response
@@ -1652,43 +1939,198 @@ export class Vm {
     } else {
       headers.set('connection', 'close');
     }
-    const body = request.method === 'GET' || request.method === 'HEAD' || upgrade
-      ? new Uint8Array(0) : new Uint8Array(await request.arrayBuffer());
-    if (body.length || !['GET', 'HEAD'].includes(request.method)) headers.set('content-length', String(body.length));
+    // A body of no declared length goes to the app as chunked.
+    if (body && declared !== null) headers.set('content-length', declared);
+    else if (body) {
+      headers.delete('content-length');
+      headers.set('transfer-encoding', 'chunked');
+    } else if (!upgrade && !['GET', 'HEAD'].includes(request.method)) headers.set('content-length', '0');
     let head = `${request.method} ${url.pathname}${url.search} HTTP/1.1\r\n`;
     for (const [k, v] of headers) head += `${k}: ${v}\r\n`;
-    head = new TextEncoder().encode(head + '\r\n');
-    const bytes = new Uint8Array(head.length + body.length);
-    bytes.set(head);
-    bytes.set(body, head.length);
+    // The values of Headers are bytes (one character for each byte).
+    const bytes = latin1Bytes(head + '\r\n');
+    if (this.dead) {
+      finished();
+      return this.stopped();
+    }
     return new Promise((resolve) => {
-      const c = { id, buf: new Uint8Array(0), resolve, finished, upgrade, head: request.method === 'HEAD', h, origin: request.headers.get('origin'), path: url.pathname };
+      const c = { id, in: new Pieces(), resolve, finished, upgrade, head: request.method === 'HEAD', h, origin: request.headers.get('origin'), path: url.pathname, sent: 0, read: 0, room: null };
       if (h) h.sockets++;
-      this.tcps.set(id, { send: (b) => this.bridgeData(c, b), close: () => this.bridgeEnd(c), h });
-      this.event({ t: 'tcp_accept', id: this.listeners.get(port), conn: id, host: request.headers.get('cf-connecting-ip') ?? '0.0.0.0', port: 0 });
-      this.event({ t: 'tcp_data', id }, bytes);
+      this.conns.add(c);
+      c.timeout = timeout;
+      // A body can take long to come: the time limit starts at its end.
+      if (!body) this.bridgeClock(c, deadline - Date.now());
+      // An error of one connection ends that connection, not the VM.
+      // A send ends when the client read its bytes (the newest write of
+      // the response, c.wrote): tcpSend then tells the VM (tcp_sent).
+      this.tcps.set(id, {
+        send: (b) => { this.bridgeGuard(c, () => this.bridgeData(c, b)); return c.wrote; },
+        close: () => this.bridgeGuard(c, () => this.bridgeEnd(c)),
+        ack: (n) => this.bridgeRead(c, n), h,
+      });
+      // ack: wasm_tcp tells the host what the app read (tcp_read): the
+      // body of the request, and the messages of a WebSocket. sent: the
+      // host tells wasm_tcp what the client took (tcp_sent).
+      this.event({ t: 'tcp_accept', id: this.listeners.get(port), conn: id, host: request.headers.get('cf-connecting-ip') ?? '0.0.0.0', port: 0, ack: !!body || upgrade, sent: true });
+      // With a body, the head goes in the event of the first part of the
+      // body (bridgeUpload): a small body is one event, as before the parts.
+      if (body) this.bridgeUpload(c, body, declared === null, maxBody, bytes);
+      else this.bridgeSend(c, bytes);
     });
   }
 
+  // Bytes to the app on the connection c.
+  bridgeSend(c, bytes) {
+    c.sent += bytes.length;
+    this.event({ t: 'tcp_data', id: c.id }, bytes);
+  }
+
+  // The body of a request to the app, in parts of UPLOAD_PART bytes or more
+  // (or the rest of the body): one event for each part, not for each small
+  // chunk of the client. A part goes when less than UPLOAD_WINDOW bytes are
+  // unread in the VM (tcp_read of wasm_tcp): so a large body does not fill
+  // the memory of the VM, and a slow app slows the client. The head of the
+  // request goes with the bytes of the first read of the client, with no
+  // wait for UPLOAD_PART bytes.
+  async bridgeUpload(c, body, chunked, max, head) {
+    // workerd has readAtLeast. The option min of the standard BYOB read is
+    // not safe: when the stream closes with fewer bytes than min, the read
+    // errors the stream (Node.js 26, Chromium). So the other hosts use the
+    // default reader, and the parts come from the chunks here.
+    let byob = null;
+    try { byob = body.getReader({ mode: 'byob' }); } catch {}
+    if (byob && !byob.readAtLeast) { byob.releaseLock(); byob = null; }
+    const reader = byob ?? body.getReader();
+    const read = byob ? (min) => byob.readAtLeast(min, new Uint8Array(UPLOAD_READ)) : () => reader.read();
+    let total = 0;
+    let part = [];
+    let size = 0;
+    // The gathered part to the app, when less than UPLOAD_WINDOW bytes are
+    // unread. False when the connection ended while it waited.
+    const flush = async () => {
+      while (c.sent - c.read >= UPLOAD_WINDOW && !c.done && !this.dead) {
+        await new Promise((resolve) => { c.room = resolve; });
+      }
+      if (c.done || this.dead) return false;
+      const bytes = part.length === 1 ? part[0] : join(part, size);
+      part = [];
+      size = 0;
+      out(chunked ? chunk(bytes) : bytes);
+      return true;
+    };
+    // Bytes to the app, after the head when it did not go yet.
+    const out = (bytes) => {
+      clearTimeout(alone);
+      this.bridgeSend(c, head ? join([head, bytes], head.length + bytes.length) : bytes);
+      head = null;
+    };
+    // A client that sends no body yet: the head goes alone after HEAD_WAIT
+    // ms, so the app sees the request (and its own time limits run).
+    const alone = setTimeout(() => { if (head && !c.done && !this.dead) out(new Uint8Array(0)); }, HEAD_WAIT);
+    try {
+      for (;;) {
+        // A read can end the stream with its last bytes (done and a value).
+        const { value, done } = await read(head ? 1 : UPLOAD_PART);
+        if (c.done || this.dead) break;
+        if (value?.length) {
+          total += value.length;
+          if (max && total > max) {
+            this.bridgeRefuse(c, this.tooLarge(max));
+            break;
+          }
+        }
+        // A chunk of the client can be large (Deno): it goes in pieces of
+        // UPLOAD_READ bytes or less, so the window stays small.
+        let ok = true;
+        for (let at = 0; ok && value && at < value.length; at += UPLOAD_READ) {
+          const piece = value.subarray(at, at + UPLOAD_READ);
+          part.push(piece);
+          size += piece.length;
+          if (size >= UPLOAD_PART) ok = await flush();
+        }
+        if (ok && (done || head) && size) ok = await flush();
+        if (!ok) break;
+        if (done) {
+          if (chunked) out(CHUNKS_END);
+          else if (head) out(new Uint8Array(0));
+          this.bridgeClock(c, c.timeout * 1000);
+          return;
+        }
+      }
+      reader.cancel().catch(() => {});
+    } catch {
+      // The client stopped the upload.
+      this.bridgeRefuse(c, new Response('bad request\n', { status: 400 }));
+    }
+  }
+
+  // The time limit of the response of c: BEAM_REQUEST_TIMEOUT, in ms ms.
+  bridgeClock(c, ms) {
+    if (c.timeout && !c.status && !c.done) c.timer = setTimeout(() => this.bridgeTimeout(c, c.timeout), Math.max(ms, 1));
+  }
+
+  // The app read n bytes of the connection c (tcp_read).
+  bridgeRead(c, n) {
+    c.read += n;
+    this.bridgeRoom(c);
+    c.inbound?.flush();
+  }
+
+  // The upload of c waits no more (more room, or the end of c).
+  bridgeRoom(c) {
+    const room = c.room;
+    c.room = null;
+    room?.();
+  }
+
+  // The answer of the host in place of the app (when the app has not
+  // answered yet), and the end of the connection for the app.
+  bridgeRefuse(c, response) {
+    if (!c.status) {
+      clearTimeout(c.timer);
+      c.status = response.status;
+      c.resolve(response);
+      c.finished();
+    }
+    this.bridgeDone(c);
+  }
+
+  // The answer above BEAM_MAX_BODY.
+  tooLarge(max) {
+    this.log(`beam: a request body above ${max} bytes: 413`);
+    return new Response(`The body is larger than ${max} bytes.\n`, { status: 413, headers: { 'content-type': 'text/plain' } });
+  }
+
   // Bytes from the HTTP server of the app to the connection c of bridge().
   bridgeData(c, data) {
-    const b = new Uint8Array(c.buf.length + data.length);
-    b.set(c.buf);
-    b.set(data, c.buf.length);
-    c.buf = b;
-    if (!c.status) {
-      const end = indexOf(c.buf, [13, 10, 13, 10]);
-      if (end < 0) return;
-      const lines = new TextDecoder().decode(c.buf.subarray(0, end)).split('\r\n');
-      c.status = Number(lines[0].split(' ')[1]);
+    c.in.push(data);
+    while (!c.status) {
+      // The head of the response: it is small, so the bytes are joined.
+      const head = c.in.peek(c.in.size);
+      const end = indexOf(head, [13, 10, 13, 10]);
+      if (end < 0) {
+        if (head.length > HEAD_MAX) throw new Error(`a head of a response above ${HEAD_MAX} bytes`);
+        return;
+      }
+      // The bytes of a header value are characters of one byte (Headers
+      // takes no character above U+00FF).
+      const lines = latin1(head.subarray(0, end)).split('\r\n');
+      c.in.drop(end + 4);
+      const status = Number(lines[0].split(' ')[1]);
+      // An informational head (100 Continue, 103 Early Hints): the head of
+      // the response comes after it.
+      if (status >= 100 && status < 200 && !(status === 101 && c.upgrade)) continue;
       const headers = new Headers();
       for (const l of lines.slice(1)) {
         const i = l.indexOf(':');
         headers.append(l.slice(0, i).trim(), l.slice(i + 1).trim());
       }
-      c.buf = c.buf.slice(end + 4);
-      if (c.status === 101 && c.upgrade) return this.bridgeUpgrade(c);
-      if (c.upgrade && c.status === 403) {
+      clearTimeout(c.timer);
+      if (status === 101) {
+        c.status = 101;
+        return this.bridgeUpgrade(c);
+      }
+      if (c.upgrade && status === 403) {
         console.log(`beam: the app refused the WebSocket of ${c.path} (403) from the origin ${c.origin}. ` +
           `A Phoenix app compares the Origin with the host of its config (PHX_HOST=${this.env.PHX_HOST ?? this.vars.PHX_HOST ?? ''}): see check_origin.`);
       }
@@ -1696,13 +2138,21 @@ export class Vm {
       c.chunked = /chunked/i.test(headers.get('transfer-encoding') ?? '');
       headers.delete('transfer-encoding');
       headers.delete('connection');
-      if (c.head || c.status === 204 || c.status === 304) c.length = 0;
+      if (c.head || status === 204 || status === 304) { c.length = 0; c.chunked = false; }
+      c.left = 0;
       const { readable, writable } = new TransformStream();
-      c.writer = writable.getWriter();
       // The app compressed the body (Bandit: gzip, deflate): the runtime
       // must send it as it is, not compress it again.
       const encodeBody = headers.has('content-encoding') ? 'manual' : 'automatic';
-      c.resolve(new Response(c.length === 0 ? null : readable, { status: c.status, headers, encodeBody }));
+      // The Response first: a status that it refuses ends the connection
+      // with 502 (bridgeGuard), and the client gets an answer.
+      const response = new Response(c.length === 0 ? null : readable, { status, headers, encodeBody });
+      c.status = status;
+      c.writer = writable.getWriter();
+      // The client went away (or the stream failed): the app gets the end
+      // of the connection.
+      c.writer.closed.catch(() => this.bridgeDone(c));
+      c.resolve(response);
       c.finished();
     }
     if (c.ws) return this.bridgeFrames(c);
@@ -1710,32 +2160,95 @@ export class Vm {
   }
 
   // The body of a response: by content-length, chunked, or until the end.
+  // The pieces of the app go to the stream as they are (views, no copy):
+  // also the data of a large chunk, before its end.
   bridgeBody(c) {
     if (c.done) return;
+    const pieces = c.in;
     if (c.chunked) {
-      for (;;) {
-        const nl = indexOf(c.buf, [13, 10]);
-        if (nl < 0) return;
-        const size = parseInt(new TextDecoder().decode(c.buf.subarray(0, nl)), 16);
+      while (pieces.size && !c.done) {
+        if (c.left > 0) {
+          const part = pieces.next(c.left);
+          c.left -= part.length;
+          this.bridgeWrite(c, part);
+          if (c.left === 0) c.left = -2;  // then the CRLF of the chunk
+          continue;
+        }
+        if (c.left < 0) {
+          const n = Math.min(-c.left, pieces.size);
+          pieces.drop(n);
+          c.left += n;
+          continue;
+        }
+        // The size line of the next chunk (a chunk extension after ";").
+        const line = pieces.peek(Math.min(pieces.size, CHUNK_LINE));
+        const nl = line.indexOf(10);
+        if (nl < 0) {
+          if (line.length >= CHUNK_LINE) this.bridgeBad(c);
+          return;
+        }
+        const size = parseInt(new TextDecoder().decode(line.subarray(0, nl)), 16);
+        pieces.drop(nl + 1);
         if (size === 0) return this.bridgeDone(c);
-        if (c.buf.length < nl + 2 + size + 2) return;
-        c.writer.write(c.buf.slice(nl + 2, nl + 2 + size));
-        c.buf = c.buf.slice(nl + 2 + size + 2);
+        if (!(size > 0)) return this.bridgeBad(c);
+        c.left = size;
       }
+      return;
     }
-    if (c.buf.length) {
-      const part = c.length === null ? c.buf : c.buf.subarray(0, c.length);
-      if (part.length) c.writer.write(part.slice());
+    while (pieces.size && c.length !== 0) {
+      const part = pieces.next(c.length ?? Infinity);
       if (c.length !== null) c.length -= part.length;
-      c.buf = new Uint8Array(0);
+      this.bridgeWrite(c, part);
     }
     if (c.length === 0) this.bridgeDone(c);
   }
 
+  // A part of the body to the client. A write to a stream that the client
+  // closed fails, and writer.closed then ends the connection.
+  bridgeWrite(c, part) {
+    if (c.writer) c.wrote = c.writer.write(part).catch(() => {});
+  }
+
+  // fn for the connection c (an event of the app). An exception ends c:
+  // 502 before the head of the response, else the end of the stream or of
+  // the WebSocket. Before, it stopped the thread of the VM, and so the VM.
+  bridgeGuard(c, fn) {
+    try {
+      fn();
+    } catch (e) {
+      this.log(`beam: the response of ${c.path} failed (${e.message}): the connection ends`);
+      if (c.ws) {
+        try { c.ws.close(1011); } catch {}
+        this.socketGone(c);
+        this.conns.delete(c);
+        this.tcps.delete(c.id);
+        this.event({ t: 'tcp_closed', id: c.id });
+        this.bridgeRelease(c);
+      } else if (!c.status) {
+        this.bridgeRefuse(c, new Response('bad gateway\n', { status: 502 }));
+      } else {
+        c.writer?.abort(e).catch(() => {});
+        c.writer = null;
+        this.bridgeDone(c);
+      }
+    }
+  }
+
+  // A chunked body that is not HTTP/1.1: the stream of the response
+  // fails, and the app gets the end of the connection.
+  bridgeBad(c) {
+    console.log(`beam: a bad chunked body from the app for ${c.path}: the response stops`);
+    c.writer?.abort(new Error('a bad chunked body from the app')).catch(() => {});
+    c.writer = null;
+    this.bridgeDone(c);
+  }
+
   bridgeDone(c) {
     if (c.done) return;
     c.done = true;
+    this.bridgeRoom(c);
     c.writer?.close().catch(() => {});
+    this.conns.delete(c);
     this.tcps.delete(c.id);
     this.event({ t: 'tcp_closed', id: c.id });
     this.bridgeRelease(c);
@@ -1746,17 +2259,40 @@ export class Vm {
     if (c.released) return;
     c.released = true;
     if (c.h) { c.h.sockets--; c.h.wake?.(); }
+    this.notePeak();
   }
 
   // The app closed the connection.
   bridgeEnd(c) {
+    clearTimeout(c.timer);
     this.tcps.delete(c.id);
     if (!c.status) {
+      c.status = 502;
       c.resolve(new Response('bad gateway\n', { status: 502 }));
       c.finished();
     }
-    if (c.ws) { try { c.ws.close(); } catch {} this.bridgeRelease(c); }
-    else this.bridgeDone(c);
+    if (c.ws) {
+      try { c.ws.close(); } catch {}
+      this.socketGone(c);
+      this.conns.delete(c);
+      this.bridgeRelease(c);
+    } else this.bridgeDone(c);
+  }
+
+  // No head of a response in BEAM_REQUEST_TIMEOUT seconds: 504 for the
+  // client, and the end of the connection for the app (tcp_closed).
+  bridgeTimeout(c, seconds) {
+    if (c.status || c.done) return;
+    c.status = 504;
+    c.resolve(this.late(`no response for ${c.path}`, seconds));
+    c.finished();
+    this.bridgeDone(c);
+  }
+
+  // The answer of BEAM_REQUEST_TIMEOUT.
+  late(what, seconds) {
+    console.log(`beam: ${what} in ${seconds} s: 504`);
+    return new Response('The app did not answer in time.\n', { status: 504, headers: { 'content-type': 'text/plain' } });
   }
 
   // A WebSocket: the client end to the browser, frames to the app.
@@ -1765,14 +2301,23 @@ export class Vm {
     server.accept();
     server.binaryType = 'arraybuffer';
     c.ws = server;
+    c.counted = true;
+    this.sockets++;
     c.frames = [];  // the parts of a message in fragments
+    // The messages of the client go while less than UPLOAD_WINDOW bytes
+    // are unread in the VM; the others wait here (Inbound).
+    c.inbound = new Inbound(c, (b) => this.bridgeSend(c, b), () => {
+      console.log(`beam: the app reads the WebSocket of ${c.path} too slowly: it closes (1008)`);
+      closeSocket(server, 1008);
+    });
     server.addEventListener('message', (e) => {
       const text = typeof e.data === 'string';
-      this.event({ t: 'tcp_data', id: c.id }, frame(text ? 1 : 2, text ? new TextEncoder().encode(e.data) : new Uint8Array(e.data)));
+      c.inbound.push(frame(text ? 1 : 2, text ? new TextEncoder().encode(e.data) : new Uint8Array(e.data)));
     });
     server.addEventListener('close', (e) => {
-      const code = e.code && e.code !== 1005 ? e.code : 1000;
-      this.event({ t: 'tcp_data', id: c.id }, frame(8, new Uint8Array([code >> 8, code & 255])));
+      this.socketGone(c);
+      const code = wireCode(e.code);
+      c.inbound.push(frame(8, new Uint8Array([code >> 8, code & 255])), true);
     });
     c.resolve(new Response(null, { status: 101, webSocket: client }));
     c.finished();
@@ -1781,18 +2326,21 @@ export class Vm {
 
   // WebSocket frames from the app (not masked) to messages for the client.
   bridgeFrames(c) {
+    const pieces = c.in;
     for (;;) {
-      const b = c.buf;
+      // The head of a frame (2 to 10 bytes), then its payload in one array.
+      const b = pieces.peek(Math.min(pieces.size, 10));
       if (b.length < 2) return;
       let len = b[1] & 127, at = 2;
       if (len === 126) { if (b.length < 4) return; len = (b[2] << 8) | b[3]; at = 4; }
       else if (len === 127) { if (b.length < 10) return; len = Number(new DataView(b.buffer, b.byteOffset).getBigUint64(2)); at = 10; }
-      if (b.length < at + len) return;
-      const fin = b[0] & 128, op = b[0] & 15, data = b.slice(at, at + len);
-      c.buf = b.slice(at + len);
+      if (pieces.size < at + len) return;
+      const fin = b[0] & 128, op = b[0] & 15;
+      pieces.drop(at);
+      const data = pieces.take(len);
       if (op === 9) { this.event({ t: 'tcp_data', id: c.id }, frame(10, data)); continue; }
       if (op === 10) continue;
-      if (op === 8) { c.ws.close(len >= 2 ? (data[0] << 8) | data[1] : 1000); continue; }
+      if (op === 8) { closeSocket(c.ws, len >= 2 ? (data[0] << 8) | data[1] : 1000); continue; }
       if (op !== 0) c.op = op;
       c.frames.push(data);
       if (!fin) continue;
@@ -1800,7 +2348,8 @@ export class Vm {
       let i = 0;
       for (const f of c.frames) { all.set(f, i); i += f.length; }
       c.frames = [];
-      c.ws.send(c.op === 1 ? new TextDecoder().decode(all) : all);
+      // The client can close at any time: a send after it is dropped.
+      try { c.ws.send(c.op === 1 ? new TextDecoder().decode(all) : all); } catch {}
     }
   }
 
@@ -1810,17 +2359,29 @@ export class Vm {
     const listener = this.listeners.get(port);
     finished();
     if (!listener) return new Response(`no listener on ${port}\n`, { status: 404 });
+    const maxSockets = limit(this.env.BEAM_MAX_WEBSOCKETS, 0);
+    if (maxSockets && this.sockets >= maxSockets) return this.busy('WebSockets');
     const id = `w${this.nextId++}`;
     const [client, server] = Object.values(new WebSocketPair());
     server.accept();
     server.binaryType = 'arraybuffer';  // (the default can be Blob)
     if (h) h.sockets++;
-    this.tcps.set(id, { send: (b) => server.send(b), close: () => server.close(), h });
-    this.event({ t: 'tcp_accept', id: listener, conn: id, host: request.headers.get('cf-connecting-ip') ?? '0.0.0.0', port: 0 });
+    const counted = { counted: true };
+    this.sockets++;
+    const t = { send: (b) => { try { server.send(b); } catch {} }, close: () => { this.socketGone(counted); try { server.close(); } catch {} }, h };
+    const win = { sent: 0, read: 0 };
+    const inbound = new Inbound(win, (b) => this.tcpIn(id, win, b), () => {
+      console.log(`beam: the app reads the connection ${id} to port ${port} too slowly: it closes (1008)`);
+      closeSocket(server, 1008);
+    });
+    t.ack = (n) => { win.read += n; inbound.flush(); };
+    this.tcps.set(id, t);
+    this.event({ t: 'tcp_accept', id: listener, conn: id, host: request.headers.get('cf-connecting-ip') ?? '0.0.0.0', port: 0, ack: true, sent: true });
     server.addEventListener('message', (e) => {
-      this.tcpData(id, typeof e.data === 'string' ? new TextEncoder().encode(e.data) : e.data);
+      inbound.push(typeof e.data === 'string' ? new TextEncoder().encode(e.data) : new Uint8Array(e.data));
     });
     server.addEventListener('close', () => {
+      this.socketGone(counted);
       this.tcpClosed(id);
       if (h) { h.sockets--; h.wake?.(); }
     });
@@ -1833,7 +2394,7 @@ export class Vm {
   // first (fetchFirst); the other protocols use connect(). direct: the
   // tunnel of wasm_host_fetch, which never goes back to the fetch path.
   async tcpConnect({ id, host, port, direct }, h) {
-    let socket;
+    let socket, inbound;
     if (h) h.sockets++;
     const allowed = connectAllowed(this.env.BEAM_CONNECT, host, port);
     const fetchPath = this.listeners.has('fetch') && !direct;
@@ -1843,11 +2404,21 @@ export class Vm {
       socket = net.connect({ host, port });
       // A send resolves when the bytes are written; a close sends the
       // bytes that wait, and then ends the socket.
-      this.tcps.set(id, {
+      const t = {
         send: (b) => new Promise((resolve) => socket.write(b, () => resolve())),
         close: () => socket.end(() => socket.destroy()),
         h,
-      });
+      };
+      // The data of the peer goes while less than UPLOAD_WINDOW bytes are
+      // unread in the VM; else the socket pauses.
+      const win = { sent: 0, read: 0 };
+      inbound = new Inbound(win, (b) => this.tcpIn(id, win, b), () => {});
+      t.ack = (n) => {
+        win.read += n;
+        inbound.flush();
+        if (!inbound.full()) socket.resume();
+      };
+      this.tcps.set(id, t);
       await new Promise((resolve, reject) => {
         socket.once('connect', resolve);
         socket.once('error', reject);
@@ -1869,9 +2440,12 @@ export class Vm {
       if (h) { h.sockets--; h.wake?.(); }
       return;
     }
-    this.event({ t: 'tcp_open', id });
+    this.event({ t: 'tcp_open', id, ack: true, sent: true });
     await new Promise((resolve) => {
-      socket.on('data', (b) => this.tcpData(id, new Uint8Array(b.buffer, b.byteOffset, b.byteLength)));
+      socket.on('data', (b) => {
+        inbound.push(new Uint8Array(b.buffer, b.byteOffset, b.byteLength), true);
+        if (inbound.full()) socket.pause();
+      });
       socket.on('error', () => {});
       socket.once('close', resolve);
     });
@@ -1908,6 +2482,9 @@ export class Vm {
     } catch (e) {
       console.log(`beam: resolve ${name}: ${e.message}`);
     }
+    // At most DNS_MAX names: a new name removes the oldest.
+    this.dns.delete(name);
+    if (this.dns.size >= DNS_MAX) this.dns.delete(this.dns.keys().next().value);
     this.dns.set(name, { at: now, addresses });
     return addresses.some((a) => inRanges(a));
   }
@@ -1917,21 +2494,29 @@ export class Vm {
   // an open connection to host:port. The pair ends when one side closes.
   async fetchPair(id, host, port, h) {
     const conn = `x${this.nextId++}`;
-    let done;
+    let done, pairEnd;
     const ended = new Promise((r) => { done = r; });
     const end = (other) => {
       if (!this.fetchConns.has(conn)) return;
       this.fetchConns.delete(conn);
       this.tcps.delete(id);
       this.tcps.delete(conn);
+      // The fetches of this connection: no one reads their bodies now.
+      for (const ac of this.fetches.values()) if (ac.conn === conn) ac.abort();
+      pairEnd();
       this.event({ t: 'tcp_closed', id: other });
       done();
     };
     this.fetchConns.set(conn, { host, port, h });
-    this.tcps.set(id, { send: (b) => this.event({ t: 'tcp_data', id: conn }, b), close: () => end(conn), h });
-    this.tcps.set(conn, { send: (b) => this.event({ t: 'tcp_data', id }, b), close: () => end(id), h });
-    this.event({ t: 'tcp_open', id });
-    this.event({ t: 'tcp_accept', id: this.listeners.get('fetch'), conn, host, port });
+    // A send of one socket ends when the other socket read the bytes
+    // (tcp_read): so the window of the sender (tcp_sent) holds them.
+    const toConn = relay((b) => this.event({ t: 'tcp_data', id: conn }, b));
+    const toId = relay((b) => this.event({ t: 'tcp_data', id }, b));
+    pairEnd = () => { toConn.end(); toId.end(); };
+    this.tcps.set(id, { send: toConn.send, close: () => end(conn), ack: toId.read, h });
+    this.tcps.set(conn, { send: toId.send, close: () => end(id), ack: toConn.read, h });
+    this.event({ t: 'tcp_open', id, ack: true, sent: true });
+    this.event({ t: 'tcp_accept', id: this.listeners.get('fetch'), conn, host, port, ack: true, sent: true });
     await ended;
     if (h) { h.sockets--; h.wake?.(); }
   }
@@ -1944,6 +2529,12 @@ export class Vm {
     if (h) h.sockets++;
     this.fetchPending++;
     const ac = new AbortController();
+    ac.conn = msg.conn;
+    // ack: wasm_host_fetch tells the host what it read (fetch_read). The
+    // body then goes while less than UPLOAD_WINDOW bytes are unread.
+    ac.sent = 0;
+    ac.read = 0;
+    ac.signal.addEventListener('abort', () => ac.room?.());
     this.fetches.set(msg.id, ac);
     try {
       const url = c && fetchUrl(c.host, c.port, msg.tls, msg.path);
@@ -1961,7 +2552,13 @@ export class Vm {
         for (;;) {
           const { done, value } = await reader.read();
           if (done) break;
-          if (value?.byteLength) this.event({ t: 'fetch_data', id: msg.id }, value);
+          if (!value?.byteLength) continue;
+          this.event({ t: 'fetch_data', id: msg.id }, value);
+          ac.sent += value.byteLength;
+          while (msg.ack && ac.sent - ac.read >= UPLOAD_WINDOW && !ac.signal.aborted) {
+            await new Promise((resolve) => { ac.room = resolve; });
+          }
+          if (ac.signal.aborted) throw new Error('the fetch stopped');
         }
       }
       this.event({ t: 'fetch_end', id: msg.id });
@@ -1974,12 +2571,42 @@ export class Vm {
     }
   }
 
-  // Data of a TCP socket: to Erlang, or to its peer after a splice.
+  // Data of a TCP socket: to Erlang (then true), or to its peer after a
+  // splice.
   tcpData(id, bytes) {
     const t = this.tcps.get(id);
     const peer = t?.peer && this.tcps.get(t.peer);
     if (peer) this.run(() => peer.send(bytes), peer.h);
     else this.event({ t: 'tcp_data', id }, bytes);
+    return !peer;
+  }
+
+  // Data of a peer for the socket id, with the window win of Inbound: the
+  // bytes that go to Erlang count, and the bytes to a spliced peer do not
+  // (no tcp_read comes for them).
+  tcpIn(id, win, bytes) {
+    if (this.tcpData(id, bytes)) win.sent += bytes.length;
+  }
+
+  // A send of the VM to the socket t. The host tells the VM how many bytes
+  // the peer took (tcp_sent), after each ACK_BYTES: wasm_tcp holds a send
+  // while SEND_WINDOW bytes wait in the host. A send that fails counts
+  // too, because the socket then ends.
+  tcpSend(id, t, body) {
+    const done = () => {
+      t.took = (t.took ?? 0) + body.length;
+      if (t.took >= ACK_BYTES) {
+        this.event({ t: 'tcp_sent', id, n: t.took });
+        t.took = 0;
+      }
+    };
+    let r;
+    try {
+      r = t.send(body);
+    } finally {
+      if (typeof r?.then !== 'function') done();
+    }
+    if (typeof r?.then === 'function') r.then(done, done);
   }
 
   // The end of a TCP socket: to Erlang, and the end of its peer too.
@@ -1995,10 +2622,22 @@ export class Vm {
     }
   }
 
+  // A message of the VM (jspi_host_send). It runs in the thread of the VM:
+  // an exception of the host must not stop that thread, so it goes to the
+  // log.
   onsend(bytes) {
+    try {
+      this.onsendEvent(bytes);
+    } catch (e) {
+      this.log(`beam: the host failed on a message of the VM (${e?.message ?? e})`);
+    }
+  }
+
+  onsendEvent(bytes) {
     const nl = bytes.indexOf(10);
     const msg = JSON.parse(new TextDecoder().decode(bytes.subarray(0, nl)));
-    const body = bytes.slice(nl + 1);
+    // bytes is a new array (jspi_host_send): the body is a view of it.
+    const body = bytes.subarray(nl + 1);
     switch (msg.t) {
       case 'ready':
         this.onready();
@@ -2029,9 +2668,20 @@ export class Vm {
       case 'fetch_cancel':
         this.fetches.get(msg.id)?.abort();
         break;
+      // wasm_host_fetch read n bytes of the body of a fetch().
+      case 'fetch_read': {
+        const ac = this.fetches.get(msg.id);
+        if (ac) { ac.read += msg.n; ac.room?.(); }
+        break;
+      }
       case 'tcp_send': {
         const t = this.tcps.get(msg.id);
-        if (t) this.run(() => t.send(body), t.h);
+        if (t) this.run(() => this.tcpSend(msg.id, t, body), t.h);
+        break;
+      }
+      // wasm_tcp: the app read n bytes of a socket.
+      case 'tcp_read': {
+        this.tcps.get(msg.id)?.ack?.(msg.n);
         break;
       }
       case 'tcp_close': {
@@ -2115,7 +2765,198 @@ export function staticResponse(statics, request) {
   return new Response(body, { headers });
 }
 
+// The result of a wait that passed its time limit.
+const LATE = Symbol('late');
+
+// A request body (bridgeUpload): the bytes that can be unread in the VM,
+// the smallest part of an event (except the last one), and the size of a
+// read in workerd and of the largest piece of a client chunk. A client chunk can be 2 KB (workerd), and each event
+// costs a turn of the VM.
+const UPLOAD_WINDOW = 256 * 1024;
+const UPLOAD_PART = 32 * 1024;
+// The time that the head of a request waits for the first bytes of its
+// body (bridgeUpload), in ms.
+const HEAD_WAIT = 20;
+const UPLOAD_READ = 64 * 1024;
+
+// The size bytes of the list parts, as one array.
+function join(parts, size) {
+  const b = new Uint8Array(size);
+  let at = 0;
+  for (const p of parts) { b.set(p, at); at += p.length; }
+  return b;
+}
+
+// A chunk of a chunked body, and the end of the body.
+const CHUNKS_END = new TextEncoder().encode('0\r\n\r\n');
+function chunk(data) {
+  const size = new TextEncoder().encode(`${data.length.toString(16)}\r\n`);
+  const b = new Uint8Array(size.length + data.length + 2);
+  b.set(size);
+  b.set(data, size.length);
+  b.set([13, 10], size.length + data.length);
+  return b;
+}
+
+// A limit of a var: a number above 0, else the default (0: no limit).
+// "0" turns a limit with a default off.
+function limit(text, fallback) {
+  if (text === undefined || text === null || text === '') return fallback;
+  const n = Number(text);
+  return Number.isFinite(n) && n > 0 ? n : 0;
+}
+
 // The position of the bytes pat in b, or -1.
+// The longest size line of a chunk of a response (with its extensions),
+// and the longest head of a response.
+const CHUNK_LINE = 4096;
+const HEAD_MAX = 1 << 20;
+// The longest wait of a request for a snapshot that the VM makes.
+const SNAPSHOT_WAIT = 10000;
+// Flow control of the sockets: wasm_tcp gives tcp_read after each
+// ACK_BYTES that the app read, and the host gives tcp_sent after each
+// ACK_BYTES that a peer took. Above SOCKET_QUEUE bytes from a peer that
+// wait for the app (Inbound), a WebSocket closes.
+const ACK_BYTES = 64 * 1024;
+const SOCKET_QUEUE = 16 * 1024 * 1024;
+
+// The names of the fetch path in the cache of isCloudflare.
+const DNS_MAX = 1024;
+
+// Bytes as text of one character for each byte (ISO-8859-1), and back.
+function latin1(b) {
+  let s = '';
+  for (let i = 0; i < b.length; i += 8192) s += String.fromCharCode(...b.subarray(i, i + 8192));
+  return s;
+}
+function latin1Bytes(s) {
+  const b = new Uint8Array(s.length);
+  for (let i = 0; i < s.length; i++) b[i] = s.charCodeAt(i);
+  return b;
+}
+
+// The close code of a client for the app: 1005, 1006 and 1015 are not
+// codes for the wire (RFC 6455).
+function wireCode(code) {
+  if (code === 1006 || code === 1015) return 1001;
+  return code && code !== 1005 ? code : 1000;
+}
+
+// close(code) of a WebSocket, with a code that it takes (else 1000), and
+// no exception for a socket that is closed already.
+function closeSocket(ws, code) {
+  try {
+    ws.close(code === 1000 || (code >= 3000 && code <= 4999) || (code >= 1001 && code <= 1014 && ![1004, 1005, 1006].includes(code)) ? code : 1000);
+  } catch {}
+}
+
+// Bytes in pieces (views of the arrays that came, no copy), joined only
+// when a reader needs them in one array (peek, take).
+// The bytes from a peer to a socket of the VM, with flow control: they go
+// while less than UPLOAD_WINDOW bytes are unread in the VM (win.sent, and
+// win.read from tcp_read), and the others wait here. Above SOCKET_QUEUE
+// bytes that wait, over() runs once, and the next bytes are dropped. A
+// forced push always waits (the end of a WebSocket).
+export class Inbound {
+  constructor(win, send, over) {
+    Object.assign(this, { win, send, over, queue: [], queued: 0, overflow: false });
+  }
+
+  full() {
+    return this.win.sent - this.win.read >= UPLOAD_WINDOW;
+  }
+
+  push(bytes, force = false) {
+    if (!this.queue.length && !this.full()) return this.send(bytes);
+    if (!force && (this.overflow || this.queued + bytes.length > SOCKET_QUEUE)) {
+      if (!this.overflow) {
+        this.overflow = true;
+        this.over();
+      }
+      return;
+    }
+    this.queue.push(bytes);
+    this.queued += bytes.length;
+  }
+
+  // After a tcp_read: the bytes that wait, while the window has room.
+  flush() {
+    while (this.queue.length && !this.full()) {
+      const bytes = this.queue.shift();
+      this.queued -= bytes.length;
+      this.send(bytes);
+    }
+  }
+}
+
+// The bytes from one socket of the VM to another one in the host (the
+// fetch path): deliver gives them to the other socket. A send ends when
+// the other socket read them (read, from its tcp_read), so the window of
+// the sender (tcp_sent) holds the bytes that wait. end() ends each send.
+export function relay(deliver) {
+  let sent = 0, read = 0;
+  const waits = [];
+  return {
+    send: (b) => {
+      deliver(b);
+      sent += b.length;
+      if (read >= sent) return undefined;
+      const mark = sent;
+      return new Promise((resolve) => waits.push([mark, resolve]));
+    },
+    read: (n) => {
+      read += n;
+      while (waits.length && waits[0][0] <= read) waits.shift()[1]();
+    },
+    end: () => { for (const [, resolve] of waits.splice(0)) resolve(); },
+  };
+}
+
+export class Pieces {
+  constructor() { this.list = []; this.size = 0; }
+  push(b) {
+    if (!b.length) return;
+    this.list.push(b);
+    this.size += b.length;
+  }
+  // The first n bytes in one array. A view when the first piece has them;
+  // else a join, which then is the first piece.
+  peek(n) {
+    if (!this.list.length || this.list[0].length >= n) return (this.list[0] ?? new Uint8Array(0)).subarray(0, n);
+    const out = new Uint8Array(n);
+    let at = 0;
+    for (const p of this.list) {
+      if (at >= n) break;
+      const k = Math.min(p.length, n - at);
+      out.set(p.subarray(0, k), at);
+      at += k;
+    }
+    this.drop(n);
+    this.list.unshift(out);
+    this.size += n;
+    return out;
+  }
+  drop(n) {
+    this.size -= n;
+    while (n > 0) {
+      const p = this.list[0];
+      if (p.length <= n) { this.list.shift(); n -= p.length; }
+      else { this.list[0] = p.subarray(n); n = 0; }
+    }
+  }
+  take(n) {
+    const b = this.peek(n);
+    this.drop(n);
+    return b;
+  }
+  // At most max bytes of the first piece (a view).
+  next(max) {
+    const b = this.list[0].subarray(0, Math.min(max, this.list[0].length));
+    this.drop(b.length);
+    return b;
+  }
+}
+
 function indexOf(b, pat) {
   outer: for (let i = 0; i + pat.length <= b.length; i++) {
     for (let j = 0; j < pat.length; j++) if (b[i + j] !== pat[j]) continue outer;