sandboxedjs 0.1.93 → 0.1.95

package/dist/index.js

@@ -6986,8 +6986,8 @@ var WasiHost = class {
       view.setUint16(at + 8, WASI_ESUCCESS, true);
       view.setUint8(at + 10, subscription.type);
       if (subscription.type === EVENTTYPE_FD_READ) {
-        const available = subscription.fd === 0 ? this.opts.stdin.available : this.bytesLeft(subscription.fd);
-        view.setBigUint64(at + 16, BigInt(available), true);
+        const available2 = subscription.fd === 0 ? this.opts.stdin.available : this.bytesLeft(subscription.fd);
+        view.setBigUint64(at + 16, BigInt(available2), true);
       } else if (subscription.type === EVENTTYPE_FD_WRITE) {
         view.setBigUint64(at + 16, BigInt(64 * 1024), true);
       }
@@ -7224,13 +7224,13 @@ var BinaryExecutionRegistry = class {
   }
   async run(ctx, path) {
     const bytes2 = ctx.vfs.readFile(path, ctx.cred);
-    let info;
+    let info2;
     try {
-      info = inspectElf(bytes2);
+      info2 = inspectElf(bytes2);
     } catch (error) {
       return ctx.fail(String(error), 126);
     }
-    const request = { path, bytes: bytes2, info, sha256: binaryDigest(bytes2) };
+    const request = { path, bytes: bytes2, info: info2, sha256: binaryDigest(bytes2) };
     const reasons = [];
     const backends = [...this.backends];
     for (const tier of ["compatibility", "translation", "emulation"]) {
@@ -7249,7 +7249,7 @@ var BinaryExecutionRegistry = class {
         reasons.push(`${backend.id}: ${result.reason}`);
       }
     }
-    return ctx.fail(`cannot execute ${info.architecture} ELF: ${reasons.join("; ") || "no binary backends registered"}`, 126);
+    return ctx.fail(`cannot execute ${info2.architecture} ELF: ${reasons.join("; ") || "no binary backends registered"}`, 126);
   }
 };
 function checkedWasm(artifact) {
@@ -8513,8 +8513,8 @@ var NetworkStack = class {
     return this.ifaces.some((i) => i.ipv4 === addr);
   }
   // ── listening ports ──────────────────────────────────────────────────────
-  registerListener(port, info) {
-    this.listeners.set(port, { port, since: Date.now(), ...info });
+  registerListener(port, info2) {
+    this.listeners.set(port, { port, since: Date.now(), ...info2 });
   }
   unregisterListener(port) {
     this.listeners.delete(port);
@@ -12107,21 +12107,21 @@ var uname = defineCommand({
       { short: "i", long: "hardware-platform" },
       { short: "o", long: "operating-system" }
     ]);
-    const info = unameInfo(ctx.kernel.hostname);
+    const info2 = unameInfo(ctx.kernel.hostname);
     if (args.has("all")) {
-      ctx.line(`${info.sysname} ${info.nodename} ${info.release} ${info.version} ${info.machine} ${info.operatingSystem}`);
+      ctx.line(`${info2.sysname} ${info2.nodename} ${info2.release} ${info2.version} ${info2.machine} ${info2.operatingSystem}`);
       return 0;
     }
     const parts = [];
-    if (args.has("kernel-name")) parts.push(info.sysname);
-    if (args.has("nodename")) parts.push(info.nodename);
-    if (args.has("kernel-release")) parts.push(info.release);
-    if (args.has("kernel-version")) parts.push(info.version);
-    if (args.has("machine")) parts.push(info.machine);
-    if (args.has("processor")) parts.push(info.processor);
-    if (args.has("hardware-platform")) parts.push(info.hardwarePlatform);
-    if (args.has("operating-system")) parts.push(info.operatingSystem);
-    ctx.line(parts.length ? parts.join(" ") : info.sysname);
+    if (args.has("kernel-name")) parts.push(info2.sysname);
+    if (args.has("nodename")) parts.push(info2.nodename);
+    if (args.has("kernel-release")) parts.push(info2.release);
+    if (args.has("kernel-version")) parts.push(info2.version);
+    if (args.has("machine")) parts.push(info2.machine);
+    if (args.has("processor")) parts.push(info2.processor);
+    if (args.has("hardware-platform")) parts.push(info2.hardwarePlatform);
+    if (args.has("operating-system")) parts.push(info2.operatingSystem);
+    ctx.line(parts.length ? parts.join(" ") : info2.sysname);
     return 0;
   }
 });
@@ -15105,15 +15105,15 @@ var Interpreter = class {
     return this.exitCode;
   }
 };
-function splitRecord(record, fs) {
-  if (record === "") return [];
+function splitRecord(record2, fs) {
+  if (record2 === "") return [];
   if (fs === " ") {
-    const trimmed = record.replace(/^[ \t\n]+|[ \t\n]+$/g, "");
+    const trimmed = record2.replace(/^[ \t\n]+|[ \t\n]+$/g, "");
     return trimmed === "" ? [] : trimmed.split(/[ \t\n]+/);
   }
-  if (fs === "") return [...record];
-  if (fs.length === 1 && !"\\^$.[]|()*+?{}".includes(fs)) return record.split(fs);
-  return record.split(new RegExp(translateEre(fs)));
+  if (fs === "") return [...record2];
+  if (fs.length === 1 && !"\\^$.[]|()*+?{}".includes(fs)) return record2.split(fs);
+  return record2.split(new RegExp(translateEre(fs)));
 }
 var ERE_CLASSES = {
   alpha: "A-Za-z",
@@ -19804,6 +19804,7 @@ var Op = {
   setsockopt: 1802,
   getsockopt: 1803,
   socket_close: 1804,
+  resolve: 1805,
   spawn: 2048,
   waitpid: 2049,
   kill: 2050
@@ -20040,6 +20041,28 @@ var wheels_default = {
         patches: []
       }
     },
+    {
+      name: "asyncpg",
+      version: "0.31.0",
+      filename: "asyncpg-0.31.0-cp313-cp313-emscripten_5_0_6_wasm32.whl",
+      sha256: "3eaf965cbd78d2314e8f12b9384e5642725323063aaff2708a8a4b3c01ef10ba",
+      abiId: "sbxabi1-c2637d04695ad927",
+      requires: [
+        'async_timeout>=4.0.3; python_version < "3.11.0"',
+        'gssapi; platform_system != "Windows" and extra == "gssauth"',
+        'sspilib; platform_system == "Windows" and extra == "gssauth"'
+      ],
+      provenance: {
+        sourceTreeDigest: "a9ab0177da5c0c2d0ba635d1f5568687efbf8aefc08cd51cd086277184eba76f",
+        recipeSha256: "fb9cf1a9fd35d8d63ac69dcf6a1671ceeebcb23f381a100b412058d75ff2eedc",
+        buildTools: [
+          "setuptools==84.0.0",
+          "Cython==3.1.4"
+        ],
+        nativeDependencies: [],
+        patches: []
+      }
+    },
     {
       name: "bcrypt",
       version: "5.0.0",
@@ -20061,18 +20084,20 @@ var wheels_default = {
       name: "brotli",
       version: "1.2.0",
       filename: "brotli-1.2.0-cp313-cp313-emscripten_5_0_6_wasm32.whl",
-      sha256: "b67d1b9169ba3e0790d04b8020adb1a58f0b89f8961aca360dca5f020de07a21",
+      sha256: "d8b06cc04770a048b41956c9cc767e7332c49f0229e69744f4b1c2892b888b27",
       abiId: "sbxabi1-c2637d04695ad927",
       requires: [],
       provenance: {
         sourceTreeDigest: "7b563fa2e7f20edac204cc80004cae35c844b36a83758e5957184383332d1209",
-        recipeSha256: "09bf4f6072d637866a6b3c3deaec419dc3ff8a32a6f3b0813f57e06316bfcf39",
+        recipeSha256: "1326c898e999feba536ff15f080fed9ac4b9cd14e0dbfee39a950decf19607ef",
         buildTools: [
           "setuptools==84.0.0",
           "pkgconfig==1.6.0"
         ],
         nativeDependencies: [],
-        patches: []
+        patches: [
+          "0001-meth-noargs-signatures.patch"
+        ]
       }
     },
     {
@@ -20133,6 +20158,25 @@ var wheels_default = {
         patches: []
       }
     },
+    {
+      name: "google-crc32c",
+      version: "1.8.0",
+      filename: "google_crc32c-1.8.0-cp313-cp313-emscripten_5_0_6_wasm32.whl",
+      sha256: "e64c21841598ea21121d7b7bb203e124d58c035db49ffce03631c55216c942cd",
+      abiId: "sbxabi1-c2637d04695ad927",
+      requires: [],
+      provenance: {
+        sourceTreeDigest: "fa277032a78adfccf6adcda32cadc4f6958a324979040c231e01f0963821cb75",
+        recipeSha256: "843dea57727061bdfc7bcd27ac380d16a767effa538cbab6257e106939689f43",
+        buildTools: [
+          "setuptools==84.0.0"
+        ],
+        nativeDependencies: [
+          "crc32c==1.1.2"
+        ],
+        patches: []
+      }
+    },
     {
       name: "httptools",
       version: "0.8.0",
@@ -20169,6 +20213,32 @@ var wheels_default = {
         patches: []
       }
     },
+    {
+      name: "lxml",
+      version: "6.1.3",
+      filename: "lxml-6.1.3-cp313-cp313-emscripten_5_0_6_wasm32.whl",
+      sha256: "dc76d45314b806934bdaf35f9e4ae61e86e741e07bac53fae7e94f9d3dab9d4e",
+      abiId: "sbxabi1-c2637d04695ad927",
+      requires: [
+        'cssselect>=0.7; extra == "cssselect"',
+        'html5lib; extra == "html5"',
+        'BeautifulSoup4; extra == "htmlsoup"',
+        'lxml_html_clean; extra == "html-clean"'
+      ],
+      provenance: {
+        sourceTreeDigest: "aedea680c1fe58ae9a124d81ea28f2316765e444e3809691854ddbf173c22bf5",
+        recipeSha256: "aa62da97bb13eb5fa0a047f7c61ed93554f60142be9fcae64e3053e2a5673e9f",
+        buildTools: [
+          "setuptools==84.0.0",
+          "Cython==3.1.4"
+        ],
+        nativeDependencies: [
+          "xml2==2.13.8",
+          "xslt==1.1.43"
+        ],
+        patches: []
+      }
+    },
     {
       name: "lz4",
       version: "4.4.5",
@@ -20270,6 +20340,113 @@ var wheels_default = {
         ]
       }
     },
+    {
+      name: "pandas",
+      version: "3.0.5",
+      filename: "pandas-3.0.5-cp313-cp313-emscripten_5_0_6_wasm32.whl",
+      sha256: "ae36ad9b403b6fc28cb2bb79f54a38e1897ab43635c596fff2bce87f8148ac48",
+      abiId: "sbxabi1-c2637d04695ad927",
+      requires: [
+        'numpy>=1.26.0; python_version < "3.14"',
+        'numpy>=2.3.3; python_version >= "3.14"',
+        "python-dateutil>=2.8.2",
+        'tzdata; sys_platform == "win32"',
+        'tzdata; sys_platform == "emscripten"',
+        'hypothesis>=6.116.0; extra == "test"',
+        'pytest<9.1,>=8.3.4; extra == "test"',
+        'pytest-xdist>=3.6.1; extra == "test"',
+        'pyarrow>=13.0.0; extra == "pyarrow"',
+        'bottleneck>=1.4.2; extra == "performance"',
+        'numba>=0.60.0; extra == "performance"',
+        'numexpr>=2.10.2; extra == "performance"',
+        'scipy>=1.14.1; extra == "computation"',
+        'xarray>=2024.10.0; extra == "computation"',
+        'fsspec>=2024.10.0; extra == "fss"',
+        's3fs>=2024.10.0; extra == "aws"',
+        'gcsfs>=2024.10.0; extra == "gcp"',
+        'odfpy>=1.4.1; extra == "excel"',
+        'openpyxl>=3.1.5; extra == "excel"',
+        'python-calamine>=0.3.0; extra == "excel"',
+        'pyxlsb>=1.0.10; extra == "excel"',
+        'xlrd>=2.0.1; extra == "excel"',
+        'xlsxwriter>=3.2.0; extra == "excel"',
+        'pyarrow>=13.0.0; extra == "parquet"',
+        'pyarrow>=13.0.0; extra == "feather"',
+        'pyiceberg>=0.8.1; extra == "iceberg"',
+        'tables>=3.10.1; extra == "hdf5"',
+        'pyreadstat>=1.2.8; extra == "spss"',
+        'SQLAlchemy>=2.0.36; extra == "postgresql"',
+        'psycopg2>=2.9.10; extra == "postgresql"',
+        'adbc-driver-postgresql>=1.2.0; extra == "postgresql"',
+        'SQLAlchemy>=2.0.36; extra == "mysql"',
+        'pymysql>=1.1.1; extra == "mysql"',
+        'SQLAlchemy>=2.0.36; extra == "sql-other"',
+        'adbc-driver-postgresql>=1.2.0; extra == "sql-other"',
+        'adbc-driver-sqlite>=1.2.0; extra == "sql-other"',
+        'beautifulsoup4>=4.12.3; extra == "html"',
+        'html5lib>=1.1; extra == "html"',
+        'lxml>=5.3.0; extra == "html"',
+        'lxml>=5.3.0; extra == "xml"',
+        'matplotlib>=3.9.3; extra == "plot"',
+        'jinja2>=3.1.5; extra == "output-formatting"',
+        'tabulate>=0.9.0; extra == "output-formatting"',
+        'PyQt5>=5.15.9; extra == "clipboard"',
+        'qtpy>=2.4.2; extra == "clipboard"',
+        'zstandard>=0.23.0; extra == "compression"',
+        'pytz>=2020.1; extra == "timezone"',
+        'adbc-driver-postgresql>=1.2.0; extra == "all"',
+        'adbc-driver-sqlite>=1.2.0; extra == "all"',
+        'beautifulsoup4>=4.12.3; extra == "all"',
+        'bottleneck>=1.4.2; extra == "all"',
+        'fastparquet>=2024.11.0; extra == "all"',
+        'fsspec>=2024.10.0; extra == "all"',
+        'gcsfs>=2024.10.0; extra == "all"',
+        'html5lib>=1.1; extra == "all"',
+        'hypothesis>=6.116.0; extra == "all"',
+        'jinja2>=3.1.5; extra == "all"',
+        'lxml>=5.3.0; extra == "all"',
+        'matplotlib>=3.9.3; extra == "all"',
+        'numba>=0.60.0; extra == "all"',
+        'numexpr>=2.10.2; extra == "all"',
+        'odfpy>=1.4.1; extra == "all"',
+        'openpyxl>=3.1.5; extra == "all"',
+        'psycopg2>=2.9.10; extra == "all"',
+        'pyarrow>=13.0.0; extra == "all"',
+        'pyiceberg>=0.8.1; extra == "all"',
+        'pymysql>=1.1.1; extra == "all"',
+        'PyQt5>=5.15.9; extra == "all"',
+        'pyreadstat>=1.2.8; extra == "all"',
+        'pytest>=8.3.4; extra == "all"',
+        'pytest-xdist>=3.6.1; extra == "all"',
+        'python-calamine>=0.3.0; extra == "all"',
+        'pytz>=2020.1; extra == "all"',
+        'pyxlsb>=1.0.10; extra == "all"',
+        'qtpy>=2.4.2; extra == "all"',
+        'scipy>=1.14.1; extra == "all"',
+        's3fs>=2024.10.0; extra == "all"',
+        'SQLAlchemy>=2.0.36; extra == "all"',
+        'tables>=3.10.1; extra == "all"',
+        'tabulate>=0.9.0; extra == "all"',
+        'xarray>=2024.10.0; extra == "all"',
+        'xlrd>=2.0.1; extra == "all"',
+        'xlsxwriter>=3.2.0; extra == "all"',
+        'zstandard>=0.23.0; extra == "all"'
+      ],
+      provenance: {
+        sourceTreeDigest: "373f08151b5a209a84dd35b086316ef11a0d4030150457c2bfdab38305903d54",
+        recipeSha256: "56976ed58b17053971334a62b503d5397b8ff739911fb596a116df23aeccabb0",
+        buildTools: [
+          "setuptools==84.0.0",
+          "Cython==3.1.4",
+          "meson-python==0.21.0",
+          "meson==1.12.0",
+          "ninja==1.13.2",
+          "versioneer==0.29"
+        ],
+        nativeDependencies: [],
+        patches: []
+      }
+    },
     {
       name: "pillow",
       version: "12.3.0",
@@ -20374,6 +20551,31 @@ var wheels_default = {
         patches: []
       }
     },
+    {
+      name: "rapidfuzz",
+      version: "3.14.6",
+      filename: "rapidfuzz-3.14.6-cp313-cp313-emscripten_5_0_6_wasm32.whl",
+      sha256: "b9ed2ea058350925beda765364c0f382bf9a7c08b3bec33840795178de021d32",
+      abiId: "sbxabi1-c2637d04695ad927",
+      requires: [
+        'numpy; extra == "all"'
+      ],
+      provenance: {
+        sourceTreeDigest: "ae2b2bb95f7aba2babbbe668b68d48b5347ca923e6508b76d24228cd13ac7cd3",
+        recipeSha256: "46954814226fff070aa6771d2f09d32a96b718ce8ef7a9f9404375850f7d1f77",
+        buildTools: [
+          "setuptools==84.0.0",
+          "scikit-build-core==1.0.3",
+          "cmake==4.4.3",
+          "ninja==1.13.2",
+          "Cython==3.1.4",
+          "pathspec==1.1.1",
+          "packaging==26.3"
+        ],
+        nativeDependencies: [],
+        patches: []
+      }
+    },
     {
       name: "regex",
       version: "2026.9.10",
@@ -20739,7 +20941,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.1.93"};
+  version: "0.1.95"};
 
 // src/python/extension-abi.ts
 var EXTENSION_ABI = {
@@ -21777,6 +21979,8 @@ var VirtualTcpSocket = class _VirtualTcpSocket {
   network;
   listenerValue = null;
   connectionValue = null;
+  /** Held so closing the guest's socket closes the host's, not just the queues. */
+  hostConnection = null;
   boundPort = 0;
   boundAddress = "0.0.0.0";
   bind(address, port) {
@@ -21794,13 +21998,35 @@ var VirtualTcpSocket = class _VirtualTcpSocket {
     }
     this.listenerValue = this.network.listen(this.boundPort, this.boundAddress, backlog);
   }
-  connect(port, address = "127.0.0.1") {
+  /**
+   * Connect, in the container or out of it.
+   *
+   * The destination used to be discarded, which quietly turned every connect
+   * into a loopback connect: a guest dialling example.com:443 would reach a
+   * container server listening on 443 and believe it had reached the internet.
+   * Loopback is still routed inside the container; anything else goes to the
+   * host's outbound stack, which owns the names and the real sockets, and
+   * which refuses with a reason when the host has no way out.
+   */
+  async connect(port, address = "127.0.0.1") {
     if (this.listenerValue || this.connectionValue) throw new PosixError(Errno.EISCONN);
     if (!isLoopback(address)) {
-      throw new PosixError(
-        Errno.ENETUNREACH,
-        `cannot reach ${address}:${port}: outbound network access is not available through raw sockets in this container; only loopback is routed`
-      );
+      const outbound = this.network.outbound;
+      if (!outbound) {
+        throw new PosixError(
+          Errno.ENETUNREACH,
+          `cannot reach ${address}:${port}: outbound network access is not available through raw sockets in this container; only loopback is routed`
+        );
+      }
+      const dialled = await outbound.connect(address, port, {
+        address: this.boundAddress,
+        port: this.boundPort
+      });
+      this.connectionValue = dialled.connection;
+      this.hostConnection = dialled.host;
+      this.boundPort = dialled.connection.local.port;
+      this.boundAddress = dialled.connection.local.address;
+      return;
     }
     this.connectionValue = this.network.connect(port, this.boundPort, this.boundAddress);
     this.boundPort = this.connectionValue.local.port;
@@ -21851,6 +22077,8 @@ var VirtualTcpSocket = class _VirtualTcpSocket {
   close() {
     if (this.listenerValue) this.network.close(this.listenerValue);
     this.connectionValue?.close();
+    this.hostConnection?.close();
+    this.hostConnection = null;
     this.listenerValue = null;
     this.connectionValue = null;
   }
@@ -21915,7 +22143,7 @@ var SocketDescription = class _SocketDescription {
     this.resource.listen(backlog);
   }
   connect(address, port) {
-    this.resource.connect(port, address);
+    return this.resource.connect(port, address);
   }
   accept() {
     return new _SocketDescription(this.resource.accept(), this.flags);
@@ -21927,7 +22155,11 @@ var SocketDescription = class _SocketDescription {
     this.options.set(`${level}:${option}`, value.slice());
   }
   getOption(level, option) {
-    return this.options.get(`${level}:${option}`)?.slice() ?? new Uint8Array(4);
+    const stored = this.options.get(`${level}:${option}`);
+    if (stored) return stored.slice();
+    if (level === SOL_SOCKET && option === SO_TYPE) return int32(SOCK_STREAM);
+    if (level === SOL_SOCKET && option === SO_ERROR) return int32(0);
+    return new Uint8Array(4);
   }
   localAddress() {
     return this.resource.local;
@@ -21938,6 +22170,15 @@ var SocketDescription = class _SocketDescription {
     return peer;
   }
 };
+var SOL_SOCKET = 1;
+var SO_ERROR = 4;
+var SO_TYPE = 3;
+var SOCK_STREAM = 1;
+function int32(value) {
+  const bytes2 = new Uint8Array(4);
+  new DataView(bytes2.buffer).setInt32(0, value, true);
+  return bytes2;
+}
 function isLoopback(address) {
   if (address === "" || address === "localhost" || address === "0.0.0.0") return true;
   if (address === "::1" || address === "::" || address === "[::1]") return true;
@@ -21949,6 +22190,18 @@ var VirtualTcpNetwork = class {
   }
   occupied;
   listeners = /* @__PURE__ */ new Map();
+  /** The host's outbound stack, when this host can open sockets at all. */
+  outbound = null;
+  /**
+   * Ports held by in-container servers that are not sockets.
+   *
+   * A JavaScript HTTP server in the container is registered with the request
+   * router and never binds one of these sockets, so a guest connecting to its
+   * port found nothing listening. Before sockets could leave the container
+   * this did not arise -- every guest client went out through the egress --
+   * and afterwards `urllib` dialling a container server got ECONNREFUSED.
+   */
+  loopbackHttp = null;
   listen(port, address = "0.0.0.0", backlog = 128) {
     if (this.listeners.has(port) || this.occupied?.(port)) throw new PosixError(Errno.EADDRINUSE, `port ${port} is already in use`);
     const listener = new VirtualTcpListener(port, address, backlog);
@@ -21962,7 +22215,11 @@ var VirtualTcpNetwork = class {
   }
   connect(port, localPort = 0, localAddress = "127.0.0.1") {
     const listener = this.listeners.get(port);
-    if (!listener || listener.isClosed) throw new PosixError(Errno.ECONNREFUSED, `port ${port} is not listening`);
+    if (!listener || listener.isClosed) {
+      const bridged = this.connectToNonSocketServer(port, localPort, localAddress);
+      if (bridged) return bridged;
+      throw new PosixError(Errno.ECONNREFUSED, `port ${port} is not listening`);
+    }
     const client = new VirtualTcpConnection(
       { address: localAddress, port: localPort },
       { address: listener.address, port }
@@ -21976,6 +22233,26 @@ var VirtualTcpNetwork = class {
     listener.enqueue(server);
     return client;
   }
+  /** A connection to a port an in-container server holds without a socket. */
+  connectToNonSocketServer(port, localPort, localAddress) {
+    if (!this.loopbackHttp) return null;
+    const client = new VirtualTcpConnection(
+      { address: localAddress, port: localPort },
+      { address: "127.0.0.1", port }
+    );
+    const server = new VirtualTcpConnection(
+      { address: "127.0.0.1", port },
+      { address: localAddress, port: localPort }
+    );
+    client.pairWith(server);
+    server.pairWith(client);
+    if (!this.loopbackHttp(port, server)) {
+      client.close();
+      server.close();
+      return null;
+    }
+    return client;
+  }
   hasListener(port) {
     return this.listeners.has(port);
   }
@@ -21993,7 +22270,7 @@ var POLLIN = 1;
 var POLLOUT = 4;
 var POLLHUP = 16;
 var AF_INET = 2;
-var SOCK_STREAM = 1;
+var SOCK_STREAM2 = 1;
 var IPPROTO_TCP = 6;
 function createHostAbiServer(proc) {
   const files = new FileService(proc.vfs, proc.cred);
@@ -22284,7 +22561,7 @@ function createHostAbiServer(proc) {
         const family = r.u32();
         const type = r.u32();
         const protocol = r.i32();
-        if (family !== AF_INET || (type & 15) !== SOCK_STREAM) throw new PosixError(Errno.EAFNOSUPPORT);
+        if (family !== AF_INET || (type & 15) !== SOCK_STREAM2) throw new PosixError(Errno.EAFNOSUPPORT);
         if (protocol !== 0 && protocol !== IPPROTO_TCP) throw new PosixError(Errno.EPROTONOSUPPORT);
         if (!proc.sockets) throw new PosixError(Errno.ENOSYS);
         return { status: proc.table.add(new SocketDescription(new VirtualTcpSocket(proc.sockets))) };
@@ -22308,9 +22585,15 @@ function createHostAbiServer(proc) {
       }
       case Op.connect: {
         const description = socketDescription(proc.table.get(r.i32()));
-        description.connect(r.string(), r.u32());
+        await description.connect(r.string(), r.u32());
         return { status: 0 };
       }
+      case Op.resolve: {
+        const sockets = proc.sockets;
+        if (!sockets?.outbound) throw new PosixError(Errno.ENOSYS);
+        const address = sockets.outbound.resolve(r.string());
+        return { status: 0, payload: new Writer().string(address).finish() };
+      }
       case Op.send: {
         const description = socketDescription(proc.table.get(r.i32()));
         return { status: await writeBlocking(description, r.bytes32()) };
@@ -22868,6 +23151,32 @@ async function serve(ctx, connection) {
     connection.close();
   }
 }
+async function serveHttpOverConnection(connection, handle) {
+  try {
+    const request = await readRequest(connection);
+    if (!request) {
+      writeResponse(connection, 400, "Bad Request", {}, new TextEncoder().encode("malformed request\n"));
+      return;
+    }
+    const result = await handle(request);
+    writeResponse(connection, result.status, result.statusText, result.headers, result.body);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    try {
+      writeResponse(
+        connection,
+        502,
+        "Bad Gateway",
+        { "x-sbx-error": "1" },
+        new TextEncoder().encode(`${message}
+`)
+      );
+    } catch {
+    }
+  } finally {
+    connection.close();
+  }
+}
 var listeners = /* @__PURE__ */ new WeakMap();
 function ensureHttpEgress(ctx) {
   const sockets = ctx.kernel.pod.sockets;
@@ -23360,7 +23669,7 @@ async function resolve2(options) {
     const clauses = (state.constraints.get(name) ?? []).flatMap((entry) => entry.spec.map((s) => `${s.op}${s.version}`)).sort();
     return `${name}|${[...new Set(clauses)].join(",")}`;
   };
-  const search = async (queue, state) => {
+  const search2 = async (queue, state) => {
     checkBudget();
     if (queue.length === 0) return state;
     const [edge, ...rest] = queue;
@@ -23368,7 +23677,7 @@ async function resolve2(options) {
     const name = requirement.name;
     if (!markerApplies(requirement.marker, environment, extras)) {
       if (requirement.marker) skipped.push({ name, marker: requirement.marker });
-      return search(rest, state);
+      return search2(rest, state);
     }
     const previous = state.constraints.get(name) ?? [];
     const constraints = new Map(state.constraints);
@@ -23385,7 +23694,7 @@ async function resolve2(options) {
           explain(name, next.constraints, already.version)
         );
       }
-      return search(rest, next);
+      return search2(rest, next);
     }
     const signature = signatureOf(name, next);
     const learned = nogoods.get(signature);
@@ -23398,7 +23707,7 @@ async function resolve2(options) {
     if (viable.length === 0) {
       const wanted = [...unusable.get(name)?.versions ?? []].filter((version) => clauses.every((s) => compareVersions(version, s.version, s.op)));
       const nothingUsable = all.length === 0 || wanted.length > 0;
-      const error2 = new ResolutionError(
+      const error = new ResolutionError(
         nothingUsable ? `no distribution of ${name}${all.length > 0 ? ` ${newest(wanted)}` : ""} is usable by this runtime (it needs a pure-Python wheel or one tagged ${WHEEL_TAG})` : `no version of ${name} satisfies every requirement`,
         explain(name, next.constraints, null, all),
         nothingUsable ? {
@@ -23410,8 +23719,8 @@ async function resolve2(options) {
           sourceAvailable: unusable.get(name)?.sourceAvailable ?? false
         } : { reason: "conflicting-requirements", package: name }
       );
-      nogoods.set(signature, error2);
-      throw error2;
+      nogoods.set(signature, error);
+      throw error;
     }
     let failure2 = null;
     const seenVersions = /* @__PURE__ */ new Set();
@@ -23423,9 +23732,9 @@ async function resolve2(options) {
       let requires;
       try {
         requires = await requiresFor(candidate);
-      } catch (error2) {
+      } catch (error) {
         failure2 = new ResolutionError(
-          `could not read the dependencies of ${name} ${candidate.version}: ${error2.message}`
+          `could not read the dependencies of ${name} ${candidate.version}: ${error.message}`
         );
         continue;
       }
@@ -23448,16 +23757,14 @@ async function resolve2(options) {
       const chosen = new Map(next.chosen);
       chosen.set(name, { ...candidate, requires });
       try {
-        return await search([...edges, ...rest], { chosen, constraints: next.constraints });
-      } catch (error2) {
-        if (!(error2 instanceof ResolutionError)) throw error2;
-        if (/cancelled|budget/.test(error2.message)) throw error2;
-        failure2 = error2;
+        return await search2([...edges, ...rest], { chosen, constraints: next.constraints });
+      } catch (error) {
+        if (!(error instanceof ResolutionError)) throw error;
+        if (/cancelled|budget/.test(error.message)) throw error;
+        failure2 = error;
       }
     }
-    const error = failure2 ?? new ResolutionError(`could not resolve ${name}`);
-    nogoods.set(signature, error);
-    throw error;
+    throw failure2 ?? new ResolutionError(`could not resolve ${name}`);
   };
   const seeded = /* @__PURE__ */ new Map();
   for (const root of roots) {
@@ -23465,12 +23772,12 @@ async function resolve2(options) {
     if (specifiers.length === 0 || !markerApplies(marker, environment, root.extras)) continue;
     seeded.set(name, [...seeded.get(name) ?? [], { spec: specifiers, origin: root.origin }]);
   }
-  const solved = await search(roots, { chosen: /* @__PURE__ */ new Map(), constraints: seeded });
+  const solved = await search2(roots, { chosen: /* @__PURE__ */ new Map(), constraints: seeded });
   const distributions = [...solved.chosen.values()].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
   const reported = new Map(skipped.map((s) => [`${s.name}\0${s.marker}`, s]));
   return { distributions, skipped: [...reported.values()] };
 }
-function explain(name, constraints, chosenVersion, available = []) {
+function explain(name, constraints, chosenVersion, available2 = []) {
   const lines = [];
   for (const entry of constraints.get(name) ?? []) {
     if (entry.spec.length === 0) continue;
@@ -23478,9 +23785,9 @@ function explain(name, constraints, chosenVersion, available = []) {
     lines.push(`${entry.origin} requires ${name} ${text2}`);
   }
   if (chosenVersion) lines.push(`but ${name} ${chosenVersion} is already selected`);
-  if (available.length > 0) {
-    const versions = [...new Set(available.map((c) => c.version))].slice(0, 8);
-    lines.push(`usable versions: ${versions.join(", ")}${available.length > 8 ? ", ..." : ""}`);
+  if (available2.length > 0) {
+    const versions = [...new Set(available2.map((c) => c.version))].slice(0, 8);
+    lines.push(`usable versions: ${versions.join(", ")}${available2.length > 8 ? ", ..." : ""}`);
   }
   return lines;
 }
@@ -23963,8 +24270,18 @@ async function runOwnedPython(ctx, argv) {
   if (!manifest) throw new Error("no Python runtime manifest is configured");
   const mounts = containerMounts(ctx);
   const env2 = withSitePackages(ctx.env);
+  await ensureTrustStore(ctx);
   const egressPort = ensureHttpEgress(ctx);
   if (egressPort > 0) env2[EGRESS_ENV] = `127.0.0.1:${egressPort}`;
+  try {
+    if (ctx.vfs.stat(CA_BUNDLE_PATH, { cred: ctx.cred }).size > 0) {
+      env2.SSL_CERT_FILE = CA_BUNDLE_PATH;
+      env2.SSL_CERT_DIR = "/etc/ssl/certs";
+      env2.REQUESTS_CA_BUNDLE = CA_BUNDLE_PATH;
+    }
+  } catch {
+  }
+  if (ctx.kernel.pod.sockets?.outbound) env2.SBX_OUTBOUND_SOCKETS = "1";
   env2.SBX_SERIAL_HOST_CALLS = "1";
   const inherit = claimInheritance(env2);
   const process2 = await startPythonProcess({
@@ -24005,6 +24322,200 @@ function isTerminal(ctx) {
   const stdin = ctx.stdin;
   return Boolean(stdin.isTTY || stdin.interactive);
 }
+var TLS_MODULE_SOURCE = `"""TLS over a SandboxedJs socket, using this interpreter's own OpenSSL.
+
+CPython's \`ssl\` cannot wrap one of these sockets directly: \`_ssl\` wants a real
+\`_socket.socket\` whose descriptor OpenSSL can read and write, and a socket here
+is a host resource reached through the SandboxedJs ABI. But OpenSSL does not
+need a descriptor -- \`SSLContext.wrap_bio\` drives the same protocol over a pair
+of memory buffers, which is how asyncio has always done TLS. So the handshake
+and every record are performed here, in the container, and only the ciphertext
+crosses to the host. Certificates are verified by this interpreter against the
+trust store the host writes into the image, and \`getpeercert\` answers.
+"""
+
+import io
+import socket as _socket_module
+import ssl as _ssl
+
+
+def wrappable(sock):
+    """Whether this socket is one of the container's own."""
+    target = getattr(sock, "_sock", sock)
+    return hasattr(target, "_fd")
+
+
+class SbxTlsSocket:
+    """What \`SSLContext.wrap_socket\` returns for a container socket."""
+
+    def __init__(self, context, sock, server_hostname, suppress_ragged_eofs=True):
+        self._sock = sock
+        self.context = context
+        self.server_hostname = server_hostname
+        self.suppress_ragged_eofs = suppress_ragged_eofs
+        self._incoming = _ssl.MemoryBIO()
+        self._outgoing = _ssl.MemoryBIO()
+        self._closed = False
+        self._tls = context.wrap_bio(
+            self._incoming, self._outgoing,
+            server_side=False,
+            server_hostname=server_hostname,
+        )
+
+    # -- moving bytes between OpenSSL and the socket ------------------------
+    def _flush(self):
+        data = self._outgoing.read()
+        if data:
+            self._sock.sendall(data)
+
+    def _feed(self):
+        chunk = self._sock.recv(32768)
+        if not chunk:
+            self._incoming.write_eof()
+            return False
+        self._incoming.write(chunk)
+        return True
+
+    def _run(self, operation):
+        """Drive one OpenSSL operation, pumping the socket as it asks."""
+        while True:
+            try:
+                result = operation()
+            except _ssl.SSLWantReadError:
+                self._flush()
+                if not self._feed():
+                    raise
+                continue
+            except _ssl.SSLWantWriteError:
+                self._flush()
+                continue
+            self._flush()
+            return result
+
+    # -- the handshake ------------------------------------------------------
+    def do_handshake(self, block=False):
+        self._run(self._tls.do_handshake)
+
+    # -- the socket ---------------------------------------------------------
+    def recv(self, length=1024, flags=0):
+        if flags:
+            raise OSError("socket flags are not supported")
+        try:
+            return self._run(lambda: self._tls.read(length))
+        except _ssl.SSLZeroReturnError:
+            return b""
+        except _ssl.SSLWantReadError:
+            # The peer closed without close_notify. Ragged, and normal enough
+            # on the public internet that clients ask to tolerate it.
+            if self.suppress_ragged_eofs:
+                return b""
+            raise
+
+    def recv_into(self, buffer, nbytes=0, flags=0):
+        data = self.recv(nbytes or len(buffer), flags)
+        buffer[:len(data)] = data
+        return len(data)
+
+    def read(self, length=1024, buffer=None):
+        if buffer is not None:
+            return self.recv_into(buffer, length)
+        return self.recv(length)
+
+    def send(self, data, flags=0):
+        if flags:
+            raise OSError("socket flags are not supported")
+        return self._run(lambda: self._tls.write(data))
+
+    def sendall(self, data, flags=0):
+        view = memoryview(data)
+        while view:
+            view = view[self.send(view, flags):]
+
+    def write(self, data):
+        return self.send(data)
+
+    _io_refs = 0
+
+    def _decref_socketios(self):
+        # socket.SocketIO calls this when a file object built on this socket is
+        # closed; without it http.client failed with "no attribute
+        # _decref_socketios" the moment it read a response.
+        if self._io_refs > 0:
+            self._io_refs -= 1
+
+    def makefile(self, mode="r", buffering=None, *, encoding=None, errors=None, newline=None):
+        # http.client and everything built on it read the response through a
+        # file object, so this has to work like socket.makefile does.
+        raw = _socket_module.SocketIO(self, "rw" if "w" in mode else "r")
+        self._io_refs += 1
+        buffer = io.BufferedRWPair(raw, raw) if "w" in mode and "r" in mode else (
+            io.BufferedWriter(raw) if "w" in mode else io.BufferedReader(raw)
+        )
+        if "b" in mode:
+            return buffer
+        text = io.TextIOWrapper(buffer, encoding, errors, newline)
+        text.mode = mode
+        return text
+
+    def settimeout(self, value): return self._sock.settimeout(value)
+    def gettimeout(self): return self._sock.gettimeout()
+    def setblocking(self, flag): return self._sock.setblocking(flag)
+    def getblocking(self): return self._sock.getblocking()
+    def setsockopt(self, *args): return self._sock.setsockopt(*args)
+    def getsockopt(self, *args): return self._sock.getsockopt(*args)
+    def fileno(self): return self._sock.fileno()
+    def getpeername(self): return self._sock.getpeername()
+    def getsockname(self): return self._sock.getsockname()
+    def detach(self): return self._sock.detach()
+
+    def shutdown(self, how):
+        return self._sock.shutdown(how)
+
+    def unwrap(self):
+        self._run(self._tls.unwrap)
+        return self._sock
+
+    def close(self):
+        if not self._closed:
+            self._closed = True
+            self._sock.close()
+
+    def __enter__(self): return self
+    def __exit__(self, *args): self.close()
+
+    @property
+    def family(self): return getattr(self._sock, "family", _socket_module.AF_INET)
+    @property
+    def type(self): return getattr(self._sock, "type", _socket_module.SOCK_STREAM)
+    @property
+    def proto(self): return getattr(self._sock, "proto", 0)
+    @property
+    def session(self): return self._tls.session
+    @session.setter
+    def session(self, value): self._tls.session = value
+    @property
+    def session_reused(self): return self._tls.session_reused
+
+    # -- what OpenSSL knows about this connection ---------------------------
+    def getpeercert(self, binary_form=False): return self._tls.getpeercert(binary_form)
+    def get_unverified_chain(self): return self._tls.get_unverified_chain()
+    def get_verified_chain(self): return self._tls.get_verified_chain()
+    def cipher(self): return self._tls.cipher()
+    def shared_ciphers(self): return self._tls.shared_ciphers()
+    def compression(self): return self._tls.compression()
+    def selected_alpn_protocol(self): return self._tls.selected_alpn_protocol()
+    def selected_npn_protocol(self): return None
+    def version(self): return self._tls.version()
+    def pending(self): return self._tls.pending()
+    def get_channel_binding(self, cb_type="tls-unique"):
+        return self._tls.get_channel_binding(cb_type)
+
+
+def wrap(context, sock, server_hostname, suppress_ragged_eofs=True):
+    wrapped = SbxTlsSocket(context, sock, server_hostname, suppress_ragged_eofs)
+    wrapped.do_handshake()
+    return wrapped
+`;
 var SHIM_HEADER = "# generated by sandboxedjs - safe to delete or replace\n";
 var SHIM_SOURCE = `"""Rebuild os.system and os.popen on the container's process table."""
 import io, os, subprocess, sys
@@ -24141,7 +24652,51 @@ if sys.platform in ("emscripten", "wasi"):
     sys.meta_path.insert(0, _SbxPyodideFetchHook())
 
 
-_egress = os.environ.get("SBX_HTTP_EGRESS")
+# The egress shims exist for a host that cannot open sockets. Where the host
+# can, the guest's own clients are used instead: real streaming, real TLS, and
+# whatever protocol the library speaks rather than the subset HTTP-over-egress
+# allows. Both worlds are supported, and which one this is comes from the host
+# rather than from probing.
+if os.environ.get("SBX_OUTBOUND_SOCKETS") == "1":
+
+    class _SbxTruststoreHook:
+        """truststore verifies the peer's chain itself, against the operating
+        system's trust store. In this container the handshake happens on the
+        host, which verified the chain against exactly that store, and the
+        chain is not carried back -- so truststore's own check cannot run and
+        httpx2 failed with "no attribute get_unverified_chain". Its context is
+        therefore the standard one: same verification, done once, where the
+        connection is."""
+
+        def find_spec(self, name, path=None, target=None):
+            if name != "truststore":
+                return None
+            import importlib.util
+
+            class _Loader:
+                def create_module(self, spec):
+                    return None
+
+                def exec_module(self, module):
+                    import ssl as _ssl
+                    module.SSLContext = _ssl.SSLContext
+
+                    def inject_into_ssl():
+                        pass
+
+                    def extract_from_ssl():
+                        pass
+
+                    module.inject_into_ssl = inject_into_ssl
+                    module.extract_from_ssl = extract_from_ssl
+                    module.__version__ = "sandboxedjs"
+
+            return importlib.util.spec_from_loader(name, _Loader(), is_package=True)
+
+    sys.meta_path.insert(0, _SbxTruststoreHook())
+
+
+_egress = None if os.environ.get("SBX_OUTBOUND_SOCKETS") == "1" else os.environ.get("SBX_HTTP_EGRESS")
 if _egress:
     import http.client
     import urllib.request
@@ -24539,10 +25094,86 @@ if os.environ.get("SBX_SERIAL_HOST_CALLS") == "1":
             return spec
 
     sys.meta_path.insert(0, _SbxAnyioThreadHook())
+
+    class _SbxLoopResolverHook:
+        """asyncio resolves names on a worker thread, which cannot run here.
+
+        loop.getaddrinfo hands the call to a ThreadPoolExecutor and awaits
+        it -- the deadlock described above -- so every asyncio client that
+        connects by name hung: aiohttp never got past its first request. In
+        this container resolution is a host call that answers immediately, so
+        it is done on the loop thread instead of being handed away."""
+
+        def find_spec(self, name, path=None, target=None):
+            if name != "asyncio.base_events":
+                return None
+            import importlib.machinery
+            spec = importlib.machinery.PathFinder.find_spec(name, path)
+            if spec is None or spec.loader is None:
+                return spec
+            load = spec.loader.exec_module
+
+            def exec_module(module):
+                load(module)
+                import socket as _socket
+
+                async def getaddrinfo(self, host, port, *, family=0, type=0, proto=0, flags=0):
+                    return _socket.getaddrinfo(host, port, family, type, proto, flags)
+
+                async def getnameinfo(self, sockaddr, flags=0):
+                    return _socket.getnameinfo(sockaddr, flags)
+
+                module.BaseEventLoop.getaddrinfo = getaddrinfo
+                module.BaseEventLoop.getnameinfo = getnameinfo
+
+            spec.loader.exec_module = exec_module
+            return spec
+
+    sys.meta_path.insert(0, _SbxLoopResolverHook())
+
+    def _sbx_patch_loop_resolver(module):
+        """Also patch the module if it is already imported.
+
+        This file imports asyncio itself, a few lines above, so by the time the
+        hook is installed asyncio.base_events is usually already in
+        sys.modules and the hook would never see it -- which is why aiohttp
+        still hung after the hook existed."""
+        import socket as _socket
+
+        async def getaddrinfo(self, host, port, *, family=0, type=0, proto=0, flags=0):
+            return _socket.getaddrinfo(host, port, family, type, proto, flags)
+
+        async def getnameinfo(self, sockaddr, flags=0):
+            return _socket.getnameinfo(sockaddr, flags)
+
+        module.BaseEventLoop.getaddrinfo = getaddrinfo
+        module.BaseEventLoop.getnameinfo = getnameinfo
+
+    _loaded_base_events = sys.modules.get("asyncio.base_events")
+    if _loaded_base_events is not None:
+        _sbx_patch_loop_resolver(_loaded_base_events)
 `;
+var CA_BUNDLE_PATH = "/etc/ssl/certs/ca-certificates.crt";
+async function ensureTrustStore(ctx) {
+  try {
+    if (ctx.vfs.stat(CA_BUNDLE_PATH, { cred: ctx.cred }).size > 0) return;
+  } catch {
+  }
+  try {
+    const tls = await nodeBuiltin("tls");
+    const bundle = tls.rootCertificates.join("\n");
+    if (!bundle) return;
+    ctx.vfs.mkdir("/etc/ssl/certs", { cred: ctx.cred, recursive: true });
+    ctx.vfs.writeFile(CA_BUNDLE_PATH, bundle, { privileged: true, mode: 420 });
+  } catch {
+  }
+}
 function ensureProcessShims(ctx) {
-  const hook = `${SITE_PACKAGES}/sitecustomize.py`;
-  const source = `${SHIM_HEADER}${SHIM_SOURCE}`;
+  writeShim(ctx, `${SITE_PACKAGES}/sitecustomize.py`, SHIM_SOURCE);
+  writeShim(ctx, `${SITE_PACKAGES}/_sbx_tls.py`, TLS_MODULE_SOURCE);
+}
+function writeShim(ctx, hook, body) {
+  const source = `${SHIM_HEADER}${body}`;
   try {
     const existing = ctx.vfs.readText(hook, ctx.cred);
     if (existing === source || !existing.startsWith(SHIM_HEADER)) return;
@@ -24589,6 +25220,7 @@ function containerMounts(ctx) {
 
 // src/python/pip-command.ts
 init_binary();
+var RESOLVE_DEADLINE_MS = 15 * 6e4;
 async function requestRemoteBuild(service, requirement, line) {
   line(`Asking ${new URL(service).host} to build ${requirement}`);
   try {
@@ -24791,6 +25423,14 @@ environments. A package with no usable wheel is an error, never a silent skip.`,
           vfs: ctx.vfs,
           cred: ctx.cred,
           requirements,
+          /* The resolver's own default is three minutes, which is a fine bound
+           * for a library but far too tight for a real requirements file: a
+           * `langchain` plus `deepagents` graph is hundreds of distributions,
+           * each needing a metadata fetch, and the install died mid-resolution
+           * with "exceeded its 180s budget" while still making progress. `pip`
+           * already has a 20-minute ceiling on the whole command; this leaves
+           * room for the download phase inside it. */
+          deadlineMs: RESOLVE_DEADLINE_MS,
           pythonVersion: pythonBackend().manifest?.pythonVersion ?? "3.13.5",
           progress: {
             collecting: (name) => ctx.line(`Collecting ${name}`),
@@ -24943,7 +25583,7 @@ function mountContainerFs(FS, opts) {
   const throwErrno = (code) => {
     throw new FS.ErrnoError(emErrno(code));
   };
-  const translate = (e) => {
+  const translate2 = (e) => {
     if (isSysError(e)) return throwErrno(e.code);
     throw new FS.ErrnoError(emErrno("EIO"));
   };
@@ -24992,7 +25632,7 @@ function mountContainerFs(FS, opts) {
           blocks: Math.ceil(st.size / 512)
         };
       } catch (e) {
-        return translate(e);
+        return translate2(e);
       }
     },
     setattr(node2, attr) {
@@ -25008,7 +25648,7 @@ function mountContainerFs(FS, opts) {
           opts.onWrite?.(path);
         }
       } catch (e) {
-        translate(e);
+        translate2(e);
       }
     },
     lookup(parent, name) {
@@ -25033,7 +25673,7 @@ function mountContainerFs(FS, opts) {
         }
         opts.onWrite?.(path);
       } catch (e) {
-        translate(e);
+        translate2(e);
       }
       return backend.createNode(parent, name, mode, dev);
     },
@@ -25044,7 +25684,7 @@ function mountContainerFs(FS, opts) {
         vfs.rename(from, to, cred);
         opts.onWrite?.(to);
       } catch (e) {
-        translate(e);
+        translate2(e);
       }
       oldNode.name = newName;
       oldNode.parent = newDir;
@@ -25055,7 +25695,7 @@ function mountContainerFs(FS, opts) {
         vfs.unlink(path, cred);
         opts.onWrite?.(path);
       } catch (e) {
-        translate(e);
+        translate2(e);
       }
     },
     rmdir(parent, name) {
@@ -25064,7 +25704,7 @@ function mountContainerFs(FS, opts) {
         vfs.rmdir(path, cred);
         opts.onWrite?.(path);
       } catch (e) {
-        translate(e);
+        translate2(e);
       }
     },
     readdir(node2) {
@@ -25072,7 +25712,7 @@ function mountContainerFs(FS, opts) {
       try {
         return [".", "..", ...vfs.readdir(path, cred)];
       } catch (e) {
-        return translate(e);
+        return translate2(e);
       }
     },
     symlink(parent, newName, oldPath) {
@@ -25081,7 +25721,7 @@ function mountContainerFs(FS, opts) {
         vfs.symlink(oldPath, path, cred);
         opts.onWrite?.(path);
       } catch (e) {
-        translate(e);
+        translate2(e);
       }
     },
     readlink(node2) {
@@ -25089,7 +25729,7 @@ function mountContainerFs(FS, opts) {
       try {
         return vfs.readlink(path, cred);
       } catch (e) {
-        return translate(e);
+        return translate2(e);
       }
     }
   };
@@ -25101,7 +25741,7 @@ function mountContainerFs(FS, opts) {
         stream.sbxBuffer = vfs.lexists(path) ? vfs.readFile(path, cred) : new Uint8Array(0);
         stream.sbxDirty = false;
       } catch (e) {
-        translate(e);
+        translate2(e);
       }
     },
     close(stream) {
@@ -25111,7 +25751,7 @@ function mountContainerFs(FS, opts) {
         vfs.writeFile(path, stream.sbxBuffer, { cred });
         opts.onWrite?.(path);
       } catch (e) {
-        translate(e);
+        translate2(e);
       }
       stream.sbxDirty = false;
     },
@@ -25137,7 +25777,7 @@ function mountContainerFs(FS, opts) {
         opts.onWrite?.(path);
         stream.sbxDirty = false;
       } catch (e) {
-        translate(e);
+        translate2(e);
       }
       return length;
     },
@@ -25744,9 +26384,9 @@ function parsePax(data) {
     if (space < 0) break;
     const length = Number(value.slice(offset, space));
     if (!Number.isFinite(length) || length <= 0) break;
-    const record = value.slice(space + 1, offset + length - 1);
-    const equal2 = record.indexOf("=");
-    if (equal2 > 0) result[record.slice(0, equal2)] = record.slice(equal2 + 1);
+    const record2 = value.slice(space + 1, offset + length - 1);
+    const equal2 = record2.indexOf("=");
+    if (equal2 > 0) result[record2.slice(0, equal2)] = record2.slice(equal2 + 1);
     offset += length;
   }
   return result;
@@ -26526,27 +27166,27 @@ var apt = defineCommand({
     switch (subcommand) {
       case "list": {
         const installedOnly = rest.includes("--installed");
-        for (const [name, info] of Object.entries(provided)) {
-          const available = ctx.kernel.which(name === "python3-pip" ? "pip" : name === "gawk" ? "awk" : name, ctx.cwd, ctx.env, ctx.cred) !== null;
-          if (installedOnly && !available) continue;
-          ctx.line(`${name}/stable ${info.version} amd64${available ? " [installed]" : ""}`);
+        for (const [name, info2] of Object.entries(provided)) {
+          const available2 = ctx.kernel.which(name === "python3-pip" ? "pip" : name === "gawk" ? "awk" : name, ctx.cwd, ctx.env, ctx.cred) !== null;
+          if (installedOnly && !available2) continue;
+          ctx.line(`${name}/stable ${info2.version} amd64${available2 ? " [installed]" : ""}`);
         }
         return 0;
       }
       case "show": {
         let status = 0;
         for (const name of rest) {
-          const info = provided[name];
-          if (!info) {
+          const info2 = provided[name];
+          if (!info2) {
             ctx.warn(`E: No packages found matching ${name}`);
             status = 1;
             continue;
           }
           ctx.line(`Package: ${name}`);
-          ctx.line(`Version: ${info.version}`);
+          ctx.line(`Version: ${info2.version}`);
           ctx.line(`Priority: optional`);
           ctx.line(`Architecture: amd64`);
-          ctx.line(`Description: ${info.description}`);
+          ctx.line(`Description: ${info2.description}`);
           ctx.line("");
         }
         return status;
@@ -26577,10 +27217,10 @@ var apt = defineCommand({
         return 100;
       case "search": {
         const pattern = new RegExp(rest[0] ?? "", "i");
-        for (const [name, info] of Object.entries(provided)) {
-          if (pattern.test(name) || pattern.test(info.description)) {
-            ctx.line(`${name}/stable ${info.version} amd64`);
-            ctx.line(`  ${info.description}`);
+        for (const [name, info2] of Object.entries(provided)) {
+          if (pattern.test(name) || pattern.test(info2.description)) {
+            ctx.line(`${name}/stable ${info2.version} amd64`);
+            ctx.line(`  ${info2.description}`);
             ctx.line("");
           }
         }
@@ -27045,6 +27685,701 @@ function browserCommands() {
   ];
 }
 
+// src/apps/pm.ts
+init_binary();
+init_zip();
+
+// src/apps/registry.ts
+var APPS_ROOT = "/opt";
+var APP_BIN_DIR = "/usr/local/bin";
+var APP_STATE = "/var/lib/pm/installed.json";
+var DEFAULT_REGISTRY = "https://sandboxedjswheels.pages.dev/apps";
+var BUILT_IN_PUBLISHERS = [
+  {
+    publisher: "SandboxedJs",
+    publicKey: "MCowBQYDK2VwAyEAuyxKMeyeO/05mr5Qu8vc+Dd9yMG2/oKDwt7KA+C9Mj4="
+  }
+];
+var AppRegistryError = class extends Error {
+};
+function parseIndex(text2, source) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text2);
+  } catch (error) {
+    throw new AppRegistryError(`${source} is not JSON: ${error.message}`);
+  }
+  const index = parsed;
+  if (index?.format !== "sandboxedjs-app-index") {
+    throw new AppRegistryError(
+      `${source} is not an application index (its format is ${JSON.stringify(index?.format ?? null)})`
+    );
+  }
+  if (!Array.isArray(index.apps)) {
+    throw new AppRegistryError(`${source} has no apps`);
+  }
+  for (const app of index.apps) {
+    for (const field of ["name", "version", "filename", "sha256"]) {
+      if (typeof app[field] !== "string" || !app[field]) {
+        throw new AppRegistryError(`${source}: an entry is missing ${field}`);
+      }
+    }
+  }
+  return index;
+}
+function selectRelease(index, name, version) {
+  const matches3 = index.apps.filter((app) => app.name === name);
+  if (matches3.length === 0) {
+    const names = index.apps.map((app) => app.name).sort();
+    throw new AppRegistryError(
+      `no application named ${name}. The registry has: ${names.join(", ") || "nothing"}`
+    );
+  }
+  if (version) {
+    const exact = matches3.find((app) => app.version === version);
+    if (!exact) {
+      const versions = matches3.map((app) => app.version).join(", ");
+      throw new AppRegistryError(`${name} has no version ${version}; it has ${versions}`);
+    }
+    return exact;
+  }
+  return matches3.slice().sort((a, b) => compareVersions2(b.version, a.version))[0];
+}
+function compareVersions2(a, b) {
+  const left = a.split(/[.-]/);
+  const right = b.split(/[.-]/);
+  for (let index = 0; index < Math.max(left.length, right.length); index += 1) {
+    const x = left[index] ?? "";
+    const y = right[index] ?? "";
+    const nx = Number(x);
+    const ny = Number(y);
+    if (Number.isFinite(nx) && Number.isFinite(ny) && x !== "" && y !== "") {
+      if (nx !== ny) return nx - ny;
+      continue;
+    }
+    if (x !== y) return x < y ? -1 : 1;
+  }
+  return 0;
+}
+function parseSpecifier(specifier) {
+  const at = specifier.lastIndexOf("@");
+  if (at <= 0) return { name: specifier };
+  return { name: specifier.slice(0, at), version: specifier.slice(at + 1) };
+}
+function validateManifest2(manifest, source) {
+  const app = manifest;
+  if (typeof app?.name !== "string" || typeof app?.version !== "string") {
+    throw new AppRegistryError(`${source} is not an application manifest`);
+  }
+  for (const binary of app.bins ?? []) {
+    if (typeof binary?.name !== "string" || typeof binary?.path !== "string") {
+      throw new AppRegistryError(`${source}: a bins entry needs a name and a path`);
+    }
+    if (binary.name.includes("/")) {
+      throw new AppRegistryError(`${source}: a command name cannot contain a slash`);
+    }
+  }
+  for (const service of app.services ?? []) {
+    if (typeof service?.port !== "number" || !Number.isInteger(service.port)) {
+      throw new AppRegistryError(`${source}: a service needs an integer port`);
+    }
+  }
+  return app;
+}
+
+// src/apps/sbjs.ts
+init_binary();
+init_zip();
+var MANIFEST_PATH = "META/manifest.json";
+var SIGNATURE_PATH = "META/signature.json";
+var TRUSTED_KEYS_PATH = "/etc/pm/trusted-keys.json";
+var PackageError = class extends Error {
+};
+async function openPackage(bytes2, trusted) {
+  const entries = readZip(bytes2);
+  const byName = new Map(entries.map((entry) => [entry.name, entry]));
+  const manifestEntry = byName.get(MANIFEST_PATH);
+  if (!manifestEntry) {
+    throw new PackageError(
+      `not a SandboxedJs package: it has no ${MANIFEST_PATH}. A plain zip can be installed with --allow-unsigned, but it carries no publisher.`
+    );
+  }
+  const manifestBytes = manifestEntry.data();
+  const manifest = parseManifest(manifestBytes);
+  validateManifest2(manifest.app, `${MANIFEST_PATH}'s app`);
+  for (const entry of entries) {
+    if (entry.isDirectory || entry.name.startsWith("META/")) continue;
+    const expected = manifest.files[entry.name];
+    if (!expected) {
+      throw new PackageError(`${entry.name} is in the package but not in its manifest`);
+    }
+    const actual = await digestHex("sha256", entry.data());
+    if (actual !== expected) {
+      throw new PackageError(
+        `${entry.name} does not match the manifest (expected ${expected}, found ${actual})`
+      );
+    }
+  }
+  for (const name of Object.keys(manifest.files)) {
+    if (!byName.has(name)) {
+      throw new PackageError(`${name} is in the manifest but missing from the package`);
+    }
+  }
+  const signatureEntry = byName.get(SIGNATURE_PATH);
+  if (!signatureEntry) {
+    return { manifest, signature: null, entries, trustedBy: null };
+  }
+  const signature = parseSignature(signatureEntry.data());
+  const valid = await verifySignature(manifestBytes, signature);
+  if (!valid) {
+    throw new PackageError(
+      `the signature on ${manifest.app.name} does not match its manifest; the package has been altered since it was signed`
+    );
+  }
+  const trustedBy = trusted.find((key) => key.publicKey === signature.publicKey) ?? null;
+  return { manifest, signature, entries, trustedBy };
+}
+function parseManifest(bytes2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(bytes2));
+  } catch (error) {
+    throw new PackageError(`${MANIFEST_PATH} is not JSON: ${error.message}`);
+  }
+  const manifest = parsed;
+  if (manifest?.format !== "sandboxedjs-package") {
+    throw new PackageError(`${MANIFEST_PATH} is not a package manifest`);
+  }
+  if (!manifest.files || typeof manifest.files !== "object") {
+    throw new PackageError(`${MANIFEST_PATH} lists no files`);
+  }
+  if (!manifest.app) {
+    throw new PackageError(`${MANIFEST_PATH} carries no application manifest`);
+  }
+  return manifest;
+}
+function parseSignature(bytes2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(bytes2));
+  } catch (error) {
+    throw new PackageError(`${SIGNATURE_PATH} is not JSON: ${error.message}`);
+  }
+  const signature = parsed;
+  if (signature?.format !== "sandboxedjs-signature") {
+    throw new PackageError(`${SIGNATURE_PATH} is not a signature`);
+  }
+  if (signature.algorithm !== "ed25519") {
+    throw new PackageError(
+      `${signature.algorithm} signatures are not supported by this runtime; only ed25519 is`
+    );
+  }
+  for (const field of ["publicKey", "signature"]) {
+    if (typeof signature[field] !== "string" || !signature[field]) {
+      throw new PackageError(`${SIGNATURE_PATH} has no ${field}`);
+    }
+  }
+  return signature;
+}
+async function verifySignature(manifestBytes, signature) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new PackageError(
+      "this runtime has no WebCrypto, so a package signature cannot be checked"
+    );
+  }
+  let key;
+  try {
+    key = await subtle.importKey(
+      "spki",
+      intoBuffer(base64ToBytes(signature.publicKey)),
+      { name: "Ed25519" },
+      false,
+      ["verify"]
+    );
+  } catch (error) {
+    throw new PackageError(
+      `cannot use the package's public key: ${error.message}. Ed25519 needs Node 20 or a browser that implements it.`
+    );
+  }
+  return subtle.verify(
+    { name: "Ed25519" },
+    key,
+    intoBuffer(base64ToBytes(signature.signature)),
+    intoBuffer(manifestBytes)
+  );
+}
+function intoBuffer(bytes2) {
+  return bytes2.slice().buffer;
+}
+function base64ToBytes(text2) {
+  const binary = atob(text2);
+  const bytes2 = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes2[index] = binary.charCodeAt(index);
+  }
+  return bytes2;
+}
+async function fingerprint(publicKey) {
+  const digest2 = await digestHex("sha256", base64ToBytes(publicKey));
+  return digest2.slice(0, 32).replace(/(.{4})(?=.)/g, "$1-");
+}
+function asRegistryError(error) {
+  return new AppRegistryError(error.message);
+}
+
+// src/apps/pm.ts
+function registryBase(ctx) {
+  const configured = ctx.env.SBX_PM_REGISTRY ?? ctx.env.PM_REGISTRY;
+  return configured && configured.trim() || DEFAULT_REGISTRY;
+}
+var pm = defineCommand({
+  name: "pm",
+  path: "/usr/bin/pm",
+  summary: "install and manage applications",
+  usage: "pm <install|remove|list|info|search|available> [name[@version]]",
+  manual: `Applications are programs the container runs, packaged with what
+they need. They are not Python or Node packages: use pip or npm for those.
+
+  pm install NAME[@VERSION]   download, verify and install
+  pm remove NAME              remove it and the commands it installed
+  pm list                     what is installed here
+  pm info NAME                what a package provides
+  pm search TEXT              search the registry
+  pm available                everything the registry offers
+  pm trust list|add|remove    publisher keys this container trusts
+
+Packages come from ${DEFAULT_REGISTRY} unless SBX_PM_REGISTRY names another.
+
+A package is a .sbjs file: a zip carrying META/manifest.json, which lists a
+sha256 for every file in it, and META/signature.json, an Ed25519 signature
+over that manifest. Installing checks both, and refuses a package signed by a
+key this container does not trust. --allow-untrusted and --allow-unsigned
+override that, one install at a time.
+
+A signature says who published a package and that nothing in it has changed
+since. It does not say the program is safe to run.`,
+  async run(ctx) {
+    const [subcommand, ...rest] = ctx.args;
+    try {
+      switch (subcommand) {
+        case "install":
+          return await install2(ctx, rest);
+        case "remove":
+        case "uninstall":
+          return await remove(ctx, rest);
+        case "list":
+          return listInstalled2(ctx);
+        case "info":
+          return await info(ctx, rest);
+        case "search":
+          return await search(ctx, rest);
+        case "available":
+          return await available(ctx);
+        case "trust":
+          return await trust(ctx, rest);
+        case void 0:
+        case "--help":
+        case "-h":
+          ctx.line(pm.usage);
+          return 0;
+        default:
+          ctx.warn(`pm: unknown command ${subcommand}`);
+          return 2;
+      }
+    } catch (error) {
+      ctx.warn(`pm: ${error.message}`);
+      return error instanceof AppRegistryError ? 2 : 1;
+    }
+  }
+});
+async function install2(ctx, args) {
+  if (args.length === 0) {
+    ctx.warn("pm install: name it, as `pm install officesuite`");
+    return 2;
+  }
+  const options = {
+    allowUnsigned: args.includes("--allow-unsigned"),
+    allowUntrusted: args.includes("--allow-untrusted") || args.includes("--allow-unsigned")
+  };
+  const names = args.filter((argument) => !argument.startsWith("--"));
+  if (names.length === 0) {
+    ctx.warn("pm install: name it, as `pm install officesuite`");
+    return 2;
+  }
+  const index = await fetchIndex(ctx);
+  for (const specifier of names) {
+    const { name, version } = parseSpecifier(specifier);
+    const release = selectRelease(index, name, version);
+    await installRelease(ctx, index, release, /* @__PURE__ */ new Set(), options);
+  }
+  return 0;
+}
+async function installRelease(ctx, index, release, seen, options) {
+  if (seen.has(release.name)) return;
+  seen.add(release.name);
+  for (const required of release.requires ?? []) {
+    const { name, version } = parseSpecifier(required);
+    if (installedApps(ctx).some((app) => app.name === name)) continue;
+    await installRelease(ctx, index, selectRelease(index, name, version), seen, options);
+  }
+  const base2 = registryBase(ctx).replace(/\/$/, "");
+  const url = `${base2}/${release.filename}`;
+  ctx.line(`Fetching ${release.name} ${release.version}`);
+  const archive = await download(url);
+  const digest2 = await digestHex("sha256", archive);
+  if (digest2 !== release.sha256) {
+    throw new AppRegistryError(
+      `${release.filename} failed verification: the registry publishes sha256 ${release.sha256} but the download hashes to ${digest2}`
+    );
+  }
+  const verified = await verify(ctx, archive, release, options);
+  const root = `${APPS_ROOT}/${release.name}`;
+  removeInstalled(ctx, release.name, { quiet: true });
+  const manifest = unpack(ctx, archive, root, release, verified);
+  const bins = linkBinaries(ctx, manifest, root);
+  record(ctx, {
+    ...manifest,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    root,
+    installedBins: bins,
+    sha256: release.sha256,
+    ...verified?.signature ? {
+      publisher: verified.signature.publisher ?? verified.trustedBy?.publisher ?? "unknown",
+      publicKey: verified.signature.publicKey
+    } : {}
+  });
+  ctx.line(`Installed ${manifest.name} ${manifest.version} in ${root}`);
+  if (bins.length > 0) ctx.line(`  commands: ${bins.join(", ")}`);
+  for (const service of manifest.services ?? []) {
+    ctx.line(
+      `  service: ${service.name} on port ${service.port}` + (service.path ? ` at ${service.path}` : "") + ` (start it with \`${service.command}\`)`
+    );
+  }
+  if (manifest.docs) ctx.line(`  docs: ${root}/${manifest.docs}`);
+}
+async function download(url) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new AppRegistryError(`${url} answered ${response.status} ${response.statusText}`);
+  }
+  return new Uint8Array(await response.arrayBuffer());
+}
+async function verify(ctx, archive, release, options) {
+  let opened;
+  try {
+    opened = await openPackage(archive, trustedKeys(ctx));
+  } catch (error) {
+    if (options.allowUnsigned && /has no META\/manifest\.json/.test(error.message)) {
+      ctx.warn(`pm: ${release.name} is unsigned and its publisher is unknown`);
+      return null;
+    }
+    throw asRegistryError(error);
+  }
+  if (!opened.signature) {
+    if (!options.allowUnsigned) {
+      throw new AppRegistryError(
+        `${release.name} carries no signature, so its publisher cannot be established. Install it with --allow-unsigned if you got it from somewhere you trust.`
+      );
+    }
+    ctx.warn(`pm: ${release.name} is unsigned and its publisher is unknown`);
+    return opened;
+  }
+  const print = await fingerprint(opened.signature.publicKey);
+  if (!opened.trustedBy && !options.allowUntrusted) {
+    throw new AppRegistryError(
+      `${release.name} is signed by a key this container does not trust (${opened.signature.publisher ?? "unnamed"}, ${print}). Add it with \`pm trust add ${print}\` after checking it, or install with --allow-untrusted.`
+    );
+  }
+  ctx.line(
+    opened.trustedBy ? `  signed by ${opened.trustedBy.publisher} (${print})` : `  signed by an untrusted key (${opened.signature.publisher ?? "unnamed"}, ${print})`
+  );
+  return opened;
+}
+function trustedKeys(ctx) {
+  let stored = [];
+  try {
+    const parsed = JSON.parse(ctx.vfs.readText(TRUSTED_KEYS_PATH, ctx.cred));
+    stored = Array.isArray(parsed.keys) ? parsed.keys : [];
+  } catch {
+  }
+  const known = new Set(stored.map((key) => key.publicKey));
+  return [...stored, ...BUILT_IN_PUBLISHERS.filter((key) => !known.has(key.publicKey))];
+}
+function writeTrustedKeys(ctx, keys) {
+  ctx.vfs.mkdir("/etc/pm", { cred: ctx.cred, recursive: true });
+  ctx.vfs.writeFile(
+    TRUSTED_KEYS_PATH,
+    `${JSON.stringify({ format: "sandboxedjs-trusted-keys", keys }, null, 2)}
+`,
+    { cred: ctx.cred, mode: 420 }
+  );
+}
+async function trust(ctx, args) {
+  const [action, ...rest] = args;
+  const keys = trustedKeys(ctx);
+  switch (action) {
+    case "list":
+    case void 0: {
+      if (keys.length === 0) {
+        ctx.line("No publisher keys are trusted; only unsigned installs are possible.");
+        return 0;
+      }
+      for (const key of keys) {
+        ctx.line(`${key.publisher}  ${await fingerprint(key.publicKey)}`);
+      }
+      return 0;
+    }
+    case "add": {
+      const [publisher, publicKey] = rest;
+      if (!publisher || !publicKey) {
+        ctx.warn("pm trust add: give a publisher name and its base64 public key");
+        return 2;
+      }
+      const next = keys.filter((key) => key.publicKey !== publicKey);
+      next.push({ publisher, publicKey, addedAt: (/* @__PURE__ */ new Date()).toISOString() });
+      writeTrustedKeys(ctx, next);
+      ctx.line(`Trusting ${publisher} (${await fingerprint(publicKey)})`);
+      return 0;
+    }
+    case "remove": {
+      const [publisher] = rest;
+      const next = keys.filter((key) => key.publisher !== publisher);
+      if (next.length === keys.length) {
+        ctx.warn(`pm: no trusted key named ${publisher}`);
+        return 1;
+      }
+      writeTrustedKeys(ctx, next);
+      ctx.line(`Removed ${publisher}`);
+      return 0;
+    }
+    default:
+      ctx.warn(`pm trust: unknown action ${action}`);
+      return 2;
+  }
+}
+function unpack(ctx, archive, root, release, verified) {
+  const entries = verified?.entries ?? readZip(archive);
+  const manifest = verified?.manifest.app ?? readAppManifest(entries, release);
+  if (manifest.name !== release.name || manifest.version !== release.version) {
+    throw new AppRegistryError(
+      `${release.filename} contains ${manifest.name} ${manifest.version}, but the registry lists it as ${release.name} ${release.version}`
+    );
+  }
+  ctx.vfs.mkdir(root, { cred: ctx.cred, recursive: true });
+  for (const entry of entries) {
+    if (entry.name.startsWith("META/")) continue;
+    const target = resolveInside(root, entry.name);
+    if (entry.isDirectory) {
+      ctx.vfs.mkdir(target, { cred: ctx.cred, recursive: true });
+      continue;
+    }
+    const parent = target.slice(0, target.lastIndexOf("/"));
+    if (parent) ctx.vfs.mkdir(parent, { cred: ctx.cred, recursive: true });
+    const executable = (entry.mode & 73) !== 0 || (manifest.bins ?? []).some((binary) => binary.path === entry.name);
+    ctx.vfs.writeFile(target, entry.data(), {
+      cred: ctx.cred,
+      mode: executable ? 493 : 420
+    });
+  }
+  return manifest;
+}
+function readAppManifest(entries, release) {
+  const entry = entries.find((candidate) => candidate.name === "app.json");
+  if (!entry) throw new AppRegistryError(`${release.filename} has no app.json`);
+  return validateManifest2(
+    JSON.parse(new TextDecoder().decode(entry.data())),
+    `${release.name}'s app.json`
+  );
+}
+function resolveInside(root, name) {
+  const clean2 = name.replace(/\\/g, "/");
+  if (clean2.startsWith("/")) {
+    throw new AppRegistryError(`archive entry ${name} is an absolute path`);
+  }
+  const parts = [];
+  for (const part of clean2.split("/")) {
+    if (part === "" || part === ".") continue;
+    if (part === "..") {
+      throw new AppRegistryError(`archive entry ${name} escapes the package directory`);
+    }
+    parts.push(part);
+  }
+  return `${root}/${parts.join("/")}`;
+}
+function linkBinaries(ctx, manifest, root) {
+  const installed3 = [];
+  if ((manifest.bins ?? []).length === 0) return installed3;
+  ctx.vfs.mkdir(APP_BIN_DIR, { cred: ctx.cred, recursive: true });
+  for (const binary of manifest.bins ?? []) {
+    const target = resolveInside(root, binary.path);
+    const wrapper = `${APP_BIN_DIR}/${binary.name}`;
+    ctx.vfs.writeFile(
+      wrapper,
+      `#!/bin/sh
+# installed by pm for ${manifest.name} ${manifest.version}
+exec ${target} "$@"
+`,
+      { cred: ctx.cred, mode: 493 }
+    );
+    installed3.push(binary.name);
+  }
+  return installed3;
+}
+async function remove(ctx, args) {
+  if (args.length === 0) {
+    ctx.warn("pm remove: name it");
+    return 2;
+  }
+  let code = 0;
+  for (const specifier of args) {
+    const { name } = parseSpecifier(specifier);
+    if (!removeInstalled(ctx, name, { quiet: false })) {
+      ctx.warn(`pm: ${name} is not installed`);
+      code = 1;
+    } else {
+      ctx.line(`Removed ${name}`);
+    }
+  }
+  return code;
+}
+function removeInstalled(ctx, name, options) {
+  const apps = installedApps(ctx);
+  const app = apps.find((entry) => entry.name === name);
+  if (!app) return false;
+  for (const binary of app.installedBins) {
+    try {
+      ctx.vfs.unlink(`${APP_BIN_DIR}/${binary}`, ctx.cred);
+    } catch {
+    }
+  }
+  try {
+    removeTree(ctx, app.root);
+  } catch (error) {
+    if (!options.quiet) ctx.warn(`pm: could not remove ${app.root}: ${error.message}`);
+  }
+  writeState(ctx, apps.filter((entry) => entry.name !== name));
+  return true;
+}
+function removeTree(ctx, path) {
+  let stats;
+  try {
+    stats = ctx.vfs.stat(path, { cred: ctx.cred });
+  } catch {
+    return;
+  }
+  if (stats.isDirectory()) {
+    for (const entry of ctx.vfs.readdir(path, ctx.cred)) {
+      removeTree(ctx, `${path}/${entry}`);
+    }
+    ctx.vfs.rmdir(path, ctx.cred);
+    return;
+  }
+  ctx.vfs.unlink(path, ctx.cred);
+}
+function listInstalled2(ctx) {
+  const apps = installedApps(ctx);
+  if (apps.length === 0) {
+    ctx.line("No applications installed. `pm available` lists what there is.");
+    return 0;
+  }
+  for (const app of apps.slice().sort((a, b) => a.name.localeCompare(b.name))) {
+    const commands12 = app.installedBins.length > 0 ? `  (${app.installedBins.join(", ")})` : "";
+    ctx.line(`${app.name} ${app.version}${commands12}`);
+  }
+  return 0;
+}
+async function info(ctx, args) {
+  const name = args[0];
+  if (!name) {
+    ctx.warn("pm info: name it");
+    return 2;
+  }
+  const local = installedApps(ctx).find((app) => app.name === name);
+  if (local) {
+    ctx.line(`${local.name} ${local.version} (installed ${local.installedAt})`);
+    if (local.summary) ctx.line(`  ${local.summary}`);
+    ctx.line(`  root: ${local.root}`);
+    if (local.installedBins.length > 0) ctx.line(`  commands: ${local.installedBins.join(", ")}`);
+    for (const service of local.services ?? []) {
+      ctx.line(`  service: ${service.name} on port ${service.port}${service.path ?? ""}`);
+    }
+    if (local.docs) ctx.line(`  docs: ${local.root}/${local.docs}`);
+    return 0;
+  }
+  const release = selectRelease(await fetchIndex(ctx), name);
+  ctx.line(`${release.name} ${release.version} (not installed)`);
+  if (release.summary) ctx.line(`  ${release.summary}`);
+  ctx.line(`  size: ${Math.round(release.size / 1024)} kB`);
+  if ((release.bins ?? []).length > 0) {
+    ctx.line(`  commands: ${(release.bins ?? []).map((b) => b.name).join(", ")}`);
+  }
+  return 0;
+}
+async function search(ctx, args) {
+  const term = (args[0] ?? "").toLowerCase();
+  const index = await fetchIndex(ctx);
+  const matches3 = index.apps.filter(
+    (app) => app.name.toLowerCase().includes(term) || (app.summary ?? "").toLowerCase().includes(term)
+  );
+  if (matches3.length === 0) {
+    ctx.line(`nothing matches ${JSON.stringify(args[0] ?? "")}`);
+    return 1;
+  }
+  for (const app of matches3) ctx.line(`${app.name} ${app.version}  ${app.summary ?? ""}`);
+  return 0;
+}
+async function available(ctx) {
+  const index = await fetchIndex(ctx);
+  for (const app of index.apps.slice().sort((a, b) => a.name.localeCompare(b.name))) {
+    ctx.line(`${app.name} ${app.version}  ${app.summary ?? ""}`);
+  }
+  return 0;
+}
+async function fetchIndex(ctx) {
+  const base2 = registryBase(ctx).replace(/\/$/, "");
+  const url = `${base2}/index.json`;
+  let response;
+  try {
+    response = await fetch(url);
+  } catch (error) {
+    throw new AppRegistryError(
+      `cannot reach the application registry at ${url}: ${error.message}`
+    );
+  }
+  if (!response.ok) {
+    throw new AppRegistryError(`${url} answered ${response.status} ${response.statusText}`);
+  }
+  return parseIndex(await response.text(), url);
+}
+function installedApps(ctx) {
+  try {
+    const text2 = ctx.vfs.readText(APP_STATE, ctx.cred);
+    const parsed = JSON.parse(text2);
+    return Array.isArray(parsed.apps) ? parsed.apps : [];
+  } catch {
+    return [];
+  }
+}
+function record(ctx, app) {
+  const apps = installedApps(ctx).filter((entry) => entry.name !== app.name);
+  apps.push(app);
+  writeState(ctx, apps);
+}
+function writeState(ctx, apps) {
+  const directory2 = APP_STATE.slice(0, APP_STATE.lastIndexOf("/"));
+  ctx.vfs.mkdir(directory2, { cred: ctx.cred, recursive: true });
+  ctx.vfs.writeFile(
+    APP_STATE,
+    `${JSON.stringify({ format: "sandboxedjs-installed-apps", apps }, null, 2)}
+`,
+    { cred: ctx.cred, mode: 420 }
+  );
+}
+function appCommands() {
+  return [pm];
+}
+
 // src/bin/index.ts
 function allCommands() {
   return [
@@ -27064,7 +28399,8 @@ function allCommands() {
     ...ffmpegCommands(),
     ...wasiCommands(),
     ...packageCommands(),
-    ...browserCommands()
+    ...browserCommands(),
+    ...appCommands()
   ];
 }
 function installUserland(kernel) {
@@ -30783,7 +32119,7 @@ ${indent(detail, 4)}
     if (detail) host2.write(`${indent(detail, depth * 2 + 2)}
 `);
   };
-  const record = (outcome, name, error) => {
+  const record2 = (outcome, name, error) => {
     counts.tests += 1;
     if (outcome === "pass") counts.pass += 1;
     else if (outcome === "fail") {
@@ -30805,13 +32141,13 @@ ${indent(detail, 4)}
     if (!matchesPattern2(display)) return true;
     if (runOnly && !options.only) return true;
     if (options.skip) {
-      record("skip", display);
+      record2("skip", display);
       report(depth, "skip", name, started);
       return true;
     }
     if (!fn) {
       const outcome = options.todo ? "todo" : "skip";
-      record(outcome, display);
+      record2(outcome, display);
       report(depth, outcome, name, started);
       return true;
     }
@@ -30875,21 +32211,21 @@ ${indent(detail, 4)}
       controller.abort();
     }
     if (skipped) {
-      record("skip", display);
+      record2("skip", display);
       report(depth, "skip", name, started);
       return true;
     }
     if (error !== void 0) {
       if (todo) {
-        record("todo", display);
+        record2("todo", display);
         report(depth, "todo", name, started);
         return true;
       }
-      record("fail", display, error);
+      record2("fail", display, error);
       report(depth, "fail", name, started, errorText(error));
       return false;
     }
-    record(todo ? "todo" : "pass", display);
+    record2(todo ? "todo" : "pass", display);
     report(depth, todo ? "todo" : "pass", name, started);
     return true;
   };
@@ -30904,7 +32240,7 @@ ${indent(detail, 4)}
       else host2.write(`${"  ".repeat(depth)}\u25B6 ${suite.name}
 `);
       if (suite.options.skip) {
-        for (const child of suite.children) if (child.kind === "test") record("skip", fullName(child));
+        for (const child of suite.children) if (child.kind === "test") record2("skip", fullName(child));
         report(depth, "skip", suite.name, started);
         return true;
       }
@@ -30916,7 +32252,7 @@ ${indent(detail, 4)}
     } catch (error) {
       for (const child of suite.children) {
         if (child.kind === "test") {
-          record("cancelled", fullName(child), error);
+          record2("cancelled", fullName(child), error);
           report(depth + (isRoot ? 0 : 1), "cancelled", child.name, started, errorText(error));
         }
       }
@@ -34818,6 +36154,212 @@ ${BUNDLER_HINT}`),
 
 // src/worker/local-runtime-pod.ts
 init_path();
+
+// src/net/outbound-tcp.ts
+var FIRST_SYNTHETIC = 2887581696;
+var SYNTHETIC_COUNT = 65534;
+function toDotted(value) {
+  return [value >>> 24, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+var OutboundTcp = class {
+  constructor(policy, dialer) {
+    this.policy = policy;
+    this.dialer = dialer;
+  }
+  policy;
+  dialer;
+  byName = /* @__PURE__ */ new Map();
+  byAddress = /* @__PURE__ */ new Map();
+  next = 0;
+  /** Whether this address was handed out by `resolve`. */
+  knows(address) {
+    return this.byAddress.has(address);
+  }
+  hostnameFor(address) {
+    return this.byAddress.get(address);
+  }
+  /**
+   * The address for `hostname`, allocating one on first use.
+   *
+   * Refusal happens here as well as at connect, because a name that cannot be
+   * reached should fail as a resolution failure -- which is what every client
+   * reports as "unknown host" rather than as a mid-connection error.
+   */
+  resolve(hostname) {
+    const name = hostname.trim().toLowerCase();
+    if (!name) throw new PosixError(Errno.EINVAL, "empty hostname");
+    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(name)) return name;
+    if (isLoopbackHostname(name)) return "127.0.0.1";
+    const known = this.byName.get(name);
+    if (known) return known;
+    if (!this.allowed(name)) {
+      throw new PosixError(
+        Errno.ENETUNREACH,
+        `cannot resolve ${hostname}: outbound network access is not allowed for this container`
+      );
+    }
+    if (this.next >= SYNTHETIC_COUNT) {
+      throw new PosixError(Errno.ENOSPC, "no addresses left for resolved names");
+    }
+    const address = toDotted(FIRST_SYNTHETIC + this.next + 1);
+    this.next += 1;
+    this.byName.set(name, address);
+    this.byAddress.set(address, name);
+    return address;
+  }
+  /** Open a connection to a resolved address, or to a literal one. */
+  async connect(address, port, local) {
+    const hostname = this.byAddress.get(address) ?? address;
+    if (!this.allowed(hostname)) {
+      throw new PosixError(
+        Errno.ENETUNREACH,
+        `cannot reach ${hostname}:${port}: outbound network access is not allowed for this container`
+      );
+    }
+    if (!this.dialer) {
+      throw new PosixError(
+        Errno.ENETUNREACH,
+        `cannot reach ${hostname}:${port}: this host cannot open sockets (a browser cannot), so outbound traffic has to leave over HTTP through the container's egress`
+      );
+    }
+    const host2 = await this.dialer(hostname, port);
+    const guest = new VirtualTcpConnection(
+      { address: local.address, port: host2.localPort || local.port },
+      { address, port }
+    );
+    const bridge = new VirtualTcpConnection({ address, port }, { address: local.address, port: local.port });
+    guest.pairWith(bridge);
+    bridge.pairWith(guest);
+    host2.onData((bytes2) => {
+      try {
+        bridge.write(bytes2);
+      } catch {
+        host2.close();
+      }
+    });
+    host2.onClose(() => {
+      bridge.shutdown(false, true);
+      bridge.close();
+    });
+    void (async () => {
+      for (; ; ) {
+        if (bridge.readable) {
+          let chunk;
+          try {
+            chunk = bridge.read(64 * 1024);
+          } catch {
+            break;
+          }
+          if (chunk.length === 0) {
+            host2.end();
+            break;
+          }
+          host2.write(chunk);
+          continue;
+        }
+        await bridge.waitForChange();
+      }
+    })();
+    return { connection: guest, host: host2 };
+  }
+  allowed(hostname) {
+    const policy = this.policy();
+    if (isLoopbackHostname(hostname)) return true;
+    if (!policy.allowOutbound) return false;
+    const hosts = policy.allowedHosts;
+    if (!hosts) return true;
+    return hosts.some((allowed) => hostname === allowed || hostname.endsWith(`.${allowed}`));
+  }
+};
+
+// src/net/node-tcp-dialer.ts
+init_binary();
+function canDialTcp() {
+  return typeof process !== "undefined" && Boolean(process.versions?.node);
+}
+function createNodeTcpDialer() {
+  return async (host2, port) => {
+    const net = await nodeBuiltin("net");
+    return await new Promise((resolve3, reject) => {
+      const socket = net.connect({ host: host2, port });
+      const pending = [];
+      let onData = null;
+      let onClose = null;
+      let closed = false;
+      socket.on("data", (chunk) => {
+        const bytes2 = new Uint8Array(chunk);
+        if (onData) onData(bytes2);
+        else pending.push(bytes2);
+      });
+      const finish = () => {
+        if (closed) return;
+        closed = true;
+        onClose?.();
+      };
+      socket.on("close", finish);
+      socket.on("end", finish);
+      socket.on("error", (error) => {
+        if (!closed) {
+          closed = true;
+          onClose?.();
+        }
+        reject(translate(error, host2, port));
+      });
+      socket.on("connect", () => {
+        socket.setNoDelay(true);
+        resolve3({
+          write(bytes2) {
+            socket.write(bytes2);
+          },
+          end() {
+            socket.end();
+          },
+          close() {
+            socket.destroy();
+          },
+          onData(handler) {
+            onData = handler;
+            for (const chunk of pending.splice(0)) handler(chunk);
+          },
+          onClose(handler) {
+            onClose = handler;
+            if (closed) handler();
+          },
+          get remoteAddress() {
+            return socket.remoteAddress ?? host2;
+          },
+          get remotePort() {
+            return socket.remotePort ?? port;
+          },
+          get localPort() {
+            return socket.localPort ?? 0;
+          }
+        });
+      });
+    });
+  };
+}
+function translate(error, host2, port) {
+  const where = `${host2}:${port}`;
+  switch (error.code) {
+    case "ECONNREFUSED":
+      return new PosixError(Errno.ECONNREFUSED, `connection refused by ${where}`);
+    case "ENOTFOUND":
+    case "EAI_AGAIN":
+      return new PosixError(Errno.ENETUNREACH, `cannot resolve ${host2}`);
+    case "ETIMEDOUT":
+      return new PosixError(Errno.ETIMEDOUT, `connection to ${where} timed out`);
+    case "ECONNRESET":
+      return new PosixError(Errno.ECONNRESET, `connection to ${where} was reset`);
+    case "EHOSTUNREACH":
+    case "ENETUNREACH":
+      return new PosixError(Errno.ENETUNREACH, `cannot reach ${where}`);
+    default:
+      return new PosixError(Errno.ECONNREFUSED, `connection to ${where} failed: ${error.message}`);
+  }
+}
+
+// src/worker/local-runtime-pod.ts
 var WASM_ALIASES = {
   esbuild: "esbuild-wasm",
   rollup: "@rollup/wasm-node"
@@ -35173,6 +36715,32 @@ var LocalRuntimePod = class _LocalRuntimePod {
   constructor(options) {
     ensureProcessGlobal();
     this.sockets = new VirtualTcpNetwork((port) => this.router.activePortsIncludes(port));
+    this.sockets.loopbackHttp = (port, connection) => {
+      if (!this.router.activePortsIncludes(port)) return false;
+      void serveHttpOverConnection(connection, async (request) => {
+        const url = new URL(request.target, `http://127.0.0.1:${port}`);
+        const answer = await this.router.request(port, {
+          method: request.method,
+          path: `${url.pathname}${url.search}`,
+          headers: request.headers,
+          ...request.body.length > 0 ? { body: request.body } : {}
+        });
+        const payload = answer.body ?? new Uint8Array();
+        return {
+          status: Number(answer.statusCode ?? 200),
+          statusText: String(answer.statusMessage ?? ""),
+          headers: answer.headers ?? {},
+          body: typeof payload === "string" ? new TextEncoder().encode(payload) : payload instanceof Uint8Array ? payload : new Uint8Array(payload)
+        };
+      });
+      return true;
+    };
+    if (canDialTcp()) {
+      this.sockets.outbound = new OutboundTcp(
+        () => this.networkPolicy ?? { allowOutbound: false, allowedHosts: null },
+        createNodeTcpDialer()
+      );
+    }
     this.router = new VirtualHttpRouter(this.sockets);
     this.workdir = options.workdir ?? "/";
     this.env = { ...options.env };
@@ -36142,6 +37710,14 @@ var Container = class _Container {
     installUserland(kernel);
     const container = new _Container(kernel, pod, opts);
     if (opts.files) container.mountSync(opts.files, { cwd: opts.cwd ?? "/" });
+    if (opts.modules && opts.modules.length > 0) {
+      const result = await container.exec(`pm install ${opts.modules.join(" ")}`);
+      if (result.exitCode !== 0) {
+        throw new Error(
+          `could not install ${opts.modules.join(", ")}: ${(result.stderr || result.stdout).trim() || `pm exited ${result.exitCode}`}`
+        );
+      }
+    }
     return container;
   }
   // ── file seeding ──────────────────────────────────────────────────────────